a private individual (plaintiff) – Court Ruling (Germany, 2025)

The data subject, a private individual, objected to the controller’s processing of their personal data. The controller, a commercial entity, had collected and processed the data subject’s personal data for marketing and profiling purposes. The data subject sent an email to the controller objecting to such a “processing or use” of his data to which the controller failed to respond The data subject claimed that the processing was unlawful and requested its cessation under Article 17(1)(d) GDPR. The data subject claimed that, when he receives messages of this nature, it gives rise to an uneasy feeling that personal data has been disclosed to unauthorized persons, precisely because the data was unlawfully used. The data subject had to deal with unwanted advertising and the origin of the data, creating a quite stressful impression of loss of control. Moreover, the controller initially did not respond after the infringement, which, from the data subject’s perspective, constituted yet another disregard of him. The controller argued that its processing was justified under Article 6(1)(f) GDPR as a legitimate interest. The lower courts had differing views on whether the processing met GDPR standards. The court stated, that a claim for non-material damages cannot be denied on the grounds that the harm does not exceed a certain severity threshold. However the court found, that the data subject did not sufficiently demonstrate that he suffered non-material damage at all. The court stated that the CJEU had clarified in several judgements that a mere infringement of the provisions of the GDPR is not sufficient to establish a claim for damages; rather, as an independent prerequisite, actual damage (caused by the infringement) must also be demonstrated by the data subject. The court elaborated that once the loss of control is established this itself constitutes the non-material damage, and there is no need for further distinct or additional concerns or anxieties on the part of the data subject. The court held, that in the current case a loss of control could at most be presumed if the controller had made the data subject’s data accessible to third parties when sending the advertising email which the controller did not. The court also held, that where loss of control cannot be established, it suffices for a damages claim that the individual affected demonstrates a well-founded fear that his personal data would be misused by unauthorized third parties as a result of the GDPR infringement. However, the court held that a mere assertion of fear without any proven negative consequences is insufficient, as is a purely hypothetical risk of misuse by an unauthorized third party. The court considered that the data subject had submitted that he fears the controller might also disclose his email address to third parties because the controller has already used it without authorization (vis-à-vis the data subject). However the court held that only those further infringements could, if they occur, give rise to independent claims for damages. Regarding the the controller’s failure to respond to the data subject’s email objecting to the sending of the emails, the court held, that this might at most exacerbate any existing non-material damage, but it does not establish it in the first place.