a private individual (plaintiff) – Court Ruling (Germany, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A private individual in Germany challenged a company for processing their personal data without permission. The court found that the individual did not prove they suffered harm from the company's actions. This case highlights the importance of responding to user objections about data use.
What happened
The individual objected to a company's processing of their personal data for marketing without a response from the company.
Who was affected
The person affected was a private individual whose personal data was used by a commercial entity for marketing purposes.
What the authority found
The court ruled that the individual did not sufficiently demonstrate any non-material damage from the company's data processing.
Why this matters
This ruling emphasizes that companies must take user objections seriously and respond appropriately. It also shows that individuals can challenge data use, even if they can't prove significant harm.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 9 April 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject, a private individual, objected to the controller’s processing of their personal data. The controller, a commercial entity, had collected and processed the data subject’s personal data for marketing and profiling purposes. The data subject sent an email to the controller objecting to such a “processing or use” of his data to which the controller failed to respond The data subject claimed that the processing was unlawful and requested its cessation under Article 17(1)(d) GDPR. The data subject claimed that, when he receives messages of this nature, it gives rise to an uneasy feeling that personal data has been disclosed to unauthorized persons, precisely because the data was unlawfully used. The data subject had to deal with unwanted advertising and the origin of the data, creating a quite stressful impression of loss of control. Moreover, the controller initially did not respond after the infringement, which, from the data subject’s perspective, constituted yet another disregard of him. The controller argued that its processing was justified under Article 6(1)(f) GDPR as a legitimate interest. The lower courts had differing views on whether the processing met GDPR standards. The court stated, that a claim for non-material damages cannot be denied on the grounds that the harm does not exceed a certain severity threshold. However the court found, that the data subject did not sufficiently demonstrate that he suffered non-material damage at all. The court stated that the CJEU had clarified in several judgements that a mere infringement of the provisions of the GDPR is not sufficient to establish a claim for damages; rather, as an independent prerequisite, actual damage (caused by the infringement) must also be demonstrated by the data subject. The court elaborated that once the loss of control is established this itself constitutes the non-material damage, and there is no need for further distinct or additional concerns or anxieties on the
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for a private individual (plaintiff) in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. a private individual (plaintiff) - Germany (2025). Retrieved from cookiefines.eu
Last updated: