Case C-687/21, MediaMarktSaturn: Judgment of the Court (Third Chamber) of 25 January 2024 (request for a preliminary ruling from the Amtsgericht Hagen — Germany) — BL v MediaMarktSaturn Hagen-Iserlohn GmbH, formerly known as Saturn Electro-Handelsgesellschaft mbH Hagen (Reference for a preliminary ruling — Protection of natural persons with regard to the processing of personal data — Regulation (EU) 2016/679 — Interpretation of Articles 5, 24, 32 and 82 — Assessment of the validity of Article 82 — Inadmissibility of the request for an assessment of validity — Right to compensation for damage caused by data processing which infringes that regulation — Transmission of data to an unauthorised third party on account of an error made by the employees of the controller — Assessment of the appropriateness of the protective measures implemented by the controller — Compensatory function fulfilled by the right to compensation — Effect of the severity of the infringement — Whether necessary to establish the existence of damage caused by that infringement — Concept of ‘non-material damage’)
Date: 2024-01-25
Institutions: Court of Justice
Subjects: data protection, data-processing law, indemnification, natural person, personal data, protection of privacy








C_202401993EN.000101.fmx.xml












Official Journal of the European Union


EN
Series C













C/2024/1993


18.3.2024





Judgment of the Court (Third Chamber) of 25 January 2024 (request for a preliminary ruling from the Amtsgericht Hagen — Germany) — BL v MediaMarktSaturn Hagen-Iserlohn GmbH, formerly known as Saturn Electro-Handelsgesellschaft mbH Hagen
(Case C-687/21, (1) MediaMarktSaturn)
(Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - Regulation (EU) 2016/679 - Interpretation of Articles 5, 24, 32 and 82 - Assessment of the validity of Article 82 - Inadmissibility of the request for an assessment of validity - Right to compensation for damage caused by data processing which infringes that regulation - Transmission of data to an unauthorised third party on account of an error made by the employees of the controller - Assessment of the appropriateness of the protective measures implemented by the controller - Compensatory function fulfilled by the right to compensation - Effect of the severity of the infringement - Whether necessary to establish the existence of damage caused by that infringement - Concept of ‘non-material damage’)
(C/2024/1993)
Language of the case: German

Referring court

Amtsgericht Hagen

Parties to the main proceedings


Applicant: BL

Defendant: MediaMarktSaturn Hagen-Iserlohn GmbH, formerly known as Saturn Electro-Handelsgesellschaft mbH Hagen

Operative part of the judgment







1.


Articles 5, 24, 32 and 82 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read together
must be interpreted as meaning that in an action for compensation based on Article 82, the fact that the employees of the controller provided to an unauthorised third party in error a document containing personal data is not sufficient, in itself, to consider that the technical and organisational measures implemented by the controller at issue were not ‘appropriate’, within the meaning of Articles 24 and 32.










2.


Article 82(1) of Regulation 2016/679
must be interpreted as meaning that the right to compensation laid down in that provision, in particular in the case of non-material damage, fulfils a compensatory function, in that financial compensation based on that provision must allow the damage actually suffered as a result of the infringement of that regulation to be compensated in full, and not a punitive function.










3.


Article 82 of Regulation 2016/679
must be interpreted as meaning that that article does not require that the severity of the infringement made by the controller be taken into consideration for the purposes of compensation under that provision.










4.


Article 82(1) of Regulation 2016/679
must be interpreted as meaning that the person seeking compensation by way of that provision is required to establish not only the infringement of provisions of that regulation, but also that that infringement caused him or her material or non-material damage.










5.


Article 82(1) of Regulation 2016/679
must be interpreted as meaning that if a document containing personal data was provided to an unauthorised third party and it was established that that person did not become aware of those personal data, ‘non-material damage’, within the meaning of that provision, does not exist due to the mere fact that the data subject fears that, following that communication having made possible the making of a copy of that document before its recovery, a dissemination, even abuse, of those data may occur in the future.






(1)  
            OJ C 64, 7.2.2022.


ELI: http://data.europa.eu/eli/C/2024/1993/oj
ISSN 1977-091X (electronic edition)