Case C-654/25, Undelam: Request for a preliminary ruling from the Bundesgerichtshof (Germany) lodged on 6 October 2025 – US and DR v KY
Date: 2025-10-06
Institutions: Court of Justice
Subjects: data protection, data-processing law, indemnification, infringement of EU law, personal data, protection of privacy








C_202600444EN.000101.fmx.xml












Official Journal of the European Union


EN
C series













C/2026/444


2.2.2026






Request for a preliminary ruling from the Bundesgerichtshof (Germany) lodged on 6 October 2025 – US and DR v KY


(Case C-654/25, Undelam
                (1)
)

(C/2026/444)
Language of the case: German

Referring court

Bundesgerichtshof

Parties to the main proceedings


Applicants: US and DR

Defendant: KY

Questions referred







1.


Is Article 4(1) of the GDPR (2) to be interpreted as meaning that, in cases involving the automated transfer of a dynamic internet protocol address (‘IP address’), that IP address already constitutes personal data if a third party has the additional knowledge required in order to identify the data subject?
Or is a finding of personal data conditional upon the controller responsible for its transfer, or the recipient of the transfer, having means that could reasonably be used in order to identify the data subject, where necessary with the aid of a third party?
In the latter case: Does it suffice in that respect that, under certain conditions, there may be legal possibilities to identify the data subject, or must those conditions be fulfilled in both fact and law in the specific case?










2.


Is Article 82(1) of the GDPR to be interpreted as meaning that non-material damage can also occur even if the data subject knowingly causes the controller to commit an infringement of the GDPR for the sole purpose of being able to document the infringement and assert a claim based on that infringement against the controller?
If so: Can the existence of non-material damage also be affirmed if similar infringements are caused intentionally and in large numbers by automated means?










3.


If both questions raised in Question 2 are answered in the affirmative:
Must Article 82(1) of the GDPR be interpreted as meaning that, in a case of the kind described in Question 2, a right to receive compensation for non-material damage resulting from abusive conduct on the part of the data subject can be denied because, despite formal compliance with the conditions laid down in the EU legislation, the objective of that legislation was not achieved and there was an intention to obtain an advantage arising out of the EU legislation by artificially creating the conditions laid down for obtaining that advantage? In that regard, does the answer depend on whether the sole motivation for intentionally causing the infringement of the GDPR was to obtain a financial advantage?






(1)  The name of the present case is a fictitious name. It does not correspond to the real name of any party to the proceedings.

(2)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ 2016 L 119, p. 1).


ELI: http://data.europa.eu/eli/C/2026/444/oj
ISSN 1977-091X (electronic edition)