62023CJ0655_RES
Case C‑655/23
IP
v
Quirin Privatbank AG
(Request for a preliminary ruling from the Bundesgerichtshof)
Judgment of the Court (Fourth Chamber) of 4 September 2025
(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Rights of the data subject – Article 17 – Right to erasure of data – Article 18 – Right to restriction of processing – Article 79 – Right to an effective judicial remedy – Unlawful processing of personal data – Action seeking an order requiring the controller to refrain from any further unlawful processing in the future – Basis – Conditions – Article 82(1) – Right to compensation – Concept of ‘non-material damage’ – Assessment of the compensation – Possible consideration of the degree of fault on the part of the controller – Possible impact of the grant of a ‘prohibitory injunction’)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Remedies – No obligation on Member States to provide for a remedy whereby the controller may be ordered to refrain from further unlawful processing – National legislation allowing such a remedy to be exercised within the domestic legal system – Whether permissible
(Charter of Fundamental Rights of the European Union, Art. 8(1) and (2); European Parliament and Council Regulation 2016/679, recitals 1, 10 and 11 and Arts 1, 4(1), 5, 6, 17, 18 and 77 to 79)
(see paragraphs 38-52, operative part 1)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Right to compensation and liability – Right to compensation for the damage suffered – Non-material damage – Concept – Negative feelings experienced by the data subject as a result of an unauthorised transmission of his or her personal data to a third party – Included – Conditions – Need to demonstrate the existence of such feelings and their negative consequences on account of the infringement of that regulation
(European Parliament and Council Regulation 2016/679, recitals 1, 10, 75, 85 and 146 and Arts 1 and 82(1))
(see paragraphs 55, 56, 58-64, operative part 2)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Right to compensation and liability – Right to compensation for the damage suffered – Determination of the amount and form of the compensation – National legislation allowing the degree of seriousness of the fault on the part of the person responsible for the damage to be taken into account for the purpose of assessing the compensation for non-material damage – Not permissible
(European Parliament and Council Regulation 2016/679, recital 146 and Arts 82 and 83)
(see paragraphs 66, 67, 69-73, operative part 3)
Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Right to compensation and liability – Right to compensation for the damage suffered – Determination of the amount and form of the compensation – Taking account of an injunction prohibiting the reiteration of an infringement of that regulation in order to reduce, or not award, financial compensation for non-material damage – Not permissible
(European Parliament and Council Regulation 2016/679, Art 82)
(see paragraphs 77-79, 81-83, operative part 4)
Résumé
Ruling on a request for a preliminary ruling from the Bundesgerichtshof (Federal Court of Justice, Germany), the Court of Justice clarifies the scope of the rights conferred by various provisions of the GDPR (
1
) on the data subject where his or her personal data have been unlawfully processed.
IP applied, through an online professional social networking platform, for a position with Quirin Privatbank, a company incorporated under German law. Subsequently, an employee of that company used that network’s electronic messaging service to send to a third party, who was not involved in the recruitment process, a message intended solely for IP, in which she informed the latter that his salary expectations could not be met and offered him a different level of remuneration. Having previously worked with IP, that third party forwarded that message to him and asked him whether he was seeking employment.
IP brought an action before the Landgericht Darmstadt (Regional Court, Darmstadt, Germany) seeking an order that Quirin Privatbank, first, refrain from any processing of personal data in connection with his application that could reiterate the unauthorised disclosure of those data and, second, pay him damages as compensation for the non-material damage suffered. The court of first instance upheld those claims.
Following the appeal brought by Quirin Privatbank before the Oberlandesgericht Frankfurt (Higher Regional Court, Frankfurt, Germany), that judgment was varied in part in that the claim for damages was dismissed. In the opinion of that court, evidence of specific harm had not been provided by IP and, even if he had experienced humiliation, it could not be classified as non-material damage.
IP and Quirin Privatbank each brought an appeal against that judgment before the Bundesgerichtshof (Federal Court of Justice), which is the referring court.
Harbouring doubts as to the interpretation of a number of provisions of the GDPR, the Federal Court of Justice referred questions to the Court of Justice on the scope of the remedies, the scope of the right to compensation for damage suffered and the criteria for assessing the non-material damage for which compensation may be claimed.
Findings of the Court
First, the Court is called upon to rule on the question whether the provisions of the GDPR provide, for the data subject concerned by the unlawful processing of personal data who has not requested that his or her data be erased, a judicial remedy enabling him or her to obtain, as a preventive measure, a prohibitory injunction requiring the controller to refrain from any further unlawful processing in the future, and, if not, whether those provisions prevent Member States from providing for such a remedy in their respective legal systems.
The Court notes, in that regard, that the GDPR contains no provisions which provide, explicitly or implicitly, that data subjects enjoy a right to obtain, as a preventive measure and by means of judicial proceedings, an order that the controller of personal data refrain, in future, from committing an infringement of the provisions of that regulation, specifically in the form of a reiteration of unlawful processing.
Furthermore, the Court notes that none of the provisions of that regulation relating to remedies (
2
) oblige Member States to establish a preventive remedy. In particular, Article 79(1) of the GDPR, which lays down the right to an effective judicial remedy against a controller, does not require Member States to provide for a specific remedy whereby a prohibitory injunction may be obtained, as a preventive measure, by means of a legal action.
That said, having regard, inter alia, to the recognition, by the GDPR, of the right of each data subject to an effective judicial remedy where he or she considers that his or her rights under that regulation have been infringed as a result of the processing of his or her personal data in non-compliance with that regulation, ‘without prejudice’ to any other administrative or non-judicial remedy, the Court finds that Member States are not prevented from providing for such a preventive remedy with a view to the controller being ordered to refrain from any further infringement of the rights conferred on the data subject by that regulation.
The Court notes, on that point, that several provisions of the GDPR expressly make it possible for Member States to lay down additional, stricter or derogating national rules which leave them a margin of discretion as to the manner in which those provisions may be implemented (‘opening clauses’). In that context, it states that, while the provisions of the GDPR relating to remedies do not specifically include such an opening clause, the EU legislature did not intend to bring about an exhaustive harmonisation of the remedies available in the event of an infringement of that regulation and, in particular, did not rule out the availability of such preventive remedies.
The Court adds that that interpretation is confirmed by the objectives pursued by the GDPR. Indeed, the possibility for the data subject to bring a legal action seeking an order requiring a controller to refrain, in future, from infringing the substantive provisions of the GDPR is such as to enhance the effectiveness of those provisions and thus the high level of protection of data subjects with regard to the processing of their personal data.
The Court concludes that the GDPR does not preclude a legal remedy in the form of an injunction aimed at preventing a possible infringement of the substantive provisions of that regulation, in particular through a potential reiteration of unlawful processing, from being available on the basis of provisions of the law of a Member State which are applicable before the national court seised.
Second, the Court clarifies the concept of ‘non-material damage’ which, under the GDPR, (
3
) entitles the data subject to obtain compensation from the controller for the damage suffered.
In that context, it recalls that Article 82(1) GDPR, relating to the right to compensation, precludes a national rule or practice which makes compensation for ‘non-material damage’ subject to the condition that the damage suffered by the data subject has reached a certain degree of seriousness. That provision does not require that the non-material damage alleged by the data subject must reach a ‘de minimis threshold’ in order that such damage may be redressed. (
4
)
In addition, the Court observes that situations, such as those relied on in the dispute in the main proceedings, relating to ‘damage to reputation’ resulting from a personal data breach or a ‘loss of control’ over such data are expressly included among the examples of possible damage listed in the GDPR. (
5
)
It also recalls that the fear experienced by a data subject that his or her personal data will be misused in the future as a result of an infringement of the GDPR, is capable, in itself, of constituting ‘non-material damage’, provided that that fear, with its negative consequences, is duly proven, which is a matter for the national court hearing the case to determine. (
6
)
Therefore, the Court acknowledges that, while they may also form part of the general risk inherent in everyday life, the feelings mentioned by the referring court, in particular fear or annoyance, are capable of constituting ‘non-material damage’, within the meaning of the GDPR, provided that the data subject demonstrates that he or she is experiencing such feelings, with their negative consequences, precisely because of the infringement of that regulation at issue, such as the unauthorised transmission of his or her personal data to a third party giving rise to the risk of misuse of those data, which is a matter for the national courts seised to determine.
The Court points out that that interpretation is consistent with the wording of Article 82(1) of the GDPR, read in the light of recitals 85 and 146 of that regulation, which encourage the acceptance of a broad interpretation of the concept of ‘non-material damage’, and is supported by the objective of that regulation of ensuring a high level of protection of natural persons with regard to the processing of personal data.
Third, the Court finds that Article 82(1) of the GDPR, relating to the right to compensation, precludes the degree of seriousness of the fault on the part of the controller from being taken into account for the purpose of assessing the compensation for non-material damage payable under that article.
In that regard, it recalls that, in view of the exclusively compensatory function of the right to compensation, national courts are required to ensure ‘full and effective’ compensation for the damage suffered, without there being any need, for the purposes of such compensation in full, to require the payment of punitive damages. (
7
)
It specifies that the exclusively compensatory function of the right to compensation under the GDPR precludes the severity and possible intentional nature of the infringement of that regulation by the controller being taken into account for the purpose of compensating damage under that provision. Therefore, the attitude and motivation of the controller cannot be taken into consideraiton in order, where relevant, to award compensation to the data subject that is lower than the damage he or she has actually suffered, whether as regards the amount or the form of that compensation.
Fourth and lastly, the Court finds that Article 82(1) of the GDPR precludes the fact that the data subject has obtained, under the applicable national law, an injunction to prohibit the reiteration of an infringement of that regulation, enforceable against the controller, from being taken into account in order to reduce the extent of the financial compensation for non-material damage payable under that article or, a fortiori, to replace that compensation.
The Court recalls having previously accepted that, within the limits stemming from the principle of effectiveness, certain circumstances may influence the assessment of compensation payable under Article 82 of the GDPR, especially in order to restrict that compensation. A form of compensation provided for by the applicable national law may be regarded as compatible with the GDPR only in so far as that form of compensation is capable of ensuring that compensation for the damage suffered by the data subject is full and effective. In particular, compensation payable under Article 82 of the GDPR cannot be awarded, in part or in full, in the form of a prohibitory injunction, since the right to compensation for damage fulfils an exclusively compensatory function, whereas the purpose of a prohibitory injunction imposed on the person responsible for the damage is purely preventive.
(
1
)	Articles 17, 18, 79 and 82 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).
(
2
)	Chapter VIII of the GDPR, headed ‘Remedies, liability and penalties’, comprises, inter alia, Articles 77 to 79 thereof.
(
3
)	Article 82(1) of the GDPR.
(
4
)	See, to that effect, judgments of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data) (C‑300/21, EU:C:2023:370, paragraph 51), and of 4 October 2024, Agentsia po vpisvaniyata (C‑200/23, EU:C:2024:827, paragraphs 147 and 149).
(
5
)	See recitals 75 and 85 of the GDPR.
(
6
)	See, to that effect, judgments of 20 June 2024, PS (Incorrect address) (C‑590/22, EU:C:2024:536, paragraph 32, 35 and 36), and of 4 October 2024, Agentsia po vpisvaniyata (C‑200/23, EU:C:2024:827, paragraphs 143, 144 and 155 and the case-law cited).
(
7
)	See, to that effect, judgments of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data) (C‑300/21, EU:C:2023:370, paragraphs 57 and 58), and of 4 October 2024, Patērētāju tiesību aizsardzības centrs (C‑507/23, EU:C:2024:854, paragraph 34).