Court case VI ZR 97/22 – Court Ruling (Germany, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court ruled on a case where a private bank mistakenly sent a job candidate's information to the wrong person. The court decided that the candidate deserved compensation for the emotional distress caused by this error. This ruling underlines the importance of careful data handling in hiring processes.
What happened
A private bank sent a job candidate's personal information to a third party by mistake.
Who was affected
The job candidate whose personal data was incorrectly shared.
What the authority found
The court upheld an injunction against the bank's processing of the candidate's data and recognized the candidate's right to non-material damages.
Why this matters
This ruling reinforces that companies must handle personal data with care, especially during hiring. It also shows that emotional distress can be grounds for compensation.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
An employee of a private bank (the controller) erroneously sent a third party a message that was intended for a candidate in the controller’s staff selection process (the data subject) in October 2018. The message contained the data subject’s full name and information about their salary expectations. After the data subject was informed they were no longer considered for the position, they brought court proceedings requesting injunctive relief in order to prohibit the controller from processing the data subject’s personal data in connection with their job application. In addition, the data subject claimed non-material damages. The court of first instance granted the injunction and awarded the data subject € 1,000 in damages. The appellate court upheld the injunction but rejected the damages claim. The Federal Court of Justice (BGH) referred several questions to the CJEU regarding the interpretation of Article 82 GDPR. The CJEU rendered its judgment in the case C-655/23 Quirin Privatbank in September 2025. It held that Member States may provide for injunctive relief in national law in cases of unlawful processing. According to the CJEU, negative feelings caused by a loss of control over personal data can also constitute non-pecuniary damages. First, the Federal Court of Justice held that the data subject was entitled to non-material damages in accordance with Article 82 GDPR. The court confirmed the appellate court had correctly found that sending the message containing personal data to a third party had been unlawful due to the lack of a legal basis under Article 6(1) GDPR – the data subject had not consented to the processing. Furthermore, the controller had not argued that the processing would have been lawful under a different legal basis. The court also confirmed that the data subject had suffered non-material damage as a result of this GDPR violation. In the present case, the data subject’s concern that the recipient of the message might use the personal da
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case VI ZR 97/22 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case VI ZR 97/22 - Germany (2026). Retrieved from cookiefines.eu
Last updated: