Court case VI ZR 97/22 – Court Ruling (Germany, 2026)

An employee of a private bank (the controller) erroneously sent a third party a message that was intended for a candidate in the controller’s staff selection process (the data subject) in October 2018. The message contained the data subject’s full name and information about their salary expectations. After the data subject was informed they were no longer considered for the position, they brought court proceedings requesting injunctive relief in order to prohibit the controller from processing the data subject’s personal data in connection with their job application. In addition, the data subject claimed non-material damages. The court of first instance granted the injunction and awarded the data subject € 1,000 in damages. The appellate court upheld the injunction but rejected the damages claim. The Federal Court of Justice (BGH) referred several questions to the CJEU regarding the interpretation of Article 82 GDPR. The CJEU rendered its judgment in the case C-655/23 Quirin Privatbank in September 2025. It held that Member States may provide for injunctive relief in national law in cases of unlawful processing. According to the CJEU, negative feelings caused by a loss of control over personal data can also constitute non-pecuniary damages. First, the Federal Court of Justice held that the data subject was entitled to non-material damages in accordance with Article 82 GDPR. The court confirmed the appellate court had correctly found that sending the message containing personal data to a third party had been unlawful due to the lack of a legal basis under Article 6(1) GDPR – the data subject had not consented to the processing. Furthermore, the controller had not argued that the processing would have been lawful under a different legal basis. The court also confirmed that the data subject had suffered non-material damage as a result of this GDPR violation. In the present case, the data subject’s concern that the recipient of the message might use the personal data contained in it for their own job applications already constituted loss of control of the data subject’s personal data and was therefore enough to establish a claim for damages under Article 82 GDPR. The court referred the case back to the appellate court so that it could determine the amount of non-material damages. Finally, the court held that the appellate court had erroneously upheld the data subject’s claim for injunctive relief: there was no risk of recurrence required for such a claim in German law. As the staff selection process in which the data subject had participated had already been completed, there was no likelihood whatsoever that such an infringement of the data subject’s rights would recur.