CJEU case C-687/21 Saturn Electro – CJEU Judgment (Germany, 2021)

CJEU Judgment
Court of Justice of the European Union16 November 2021Germany
final
CJEU Judgment

CJEU judgment — not a DPA enforcement action

This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.

The Court of Justice of the European Union looked into a case where Saturn Electro accidentally gave a customer's personal documents to another person. This case is important because it questions if people can get compensation for non-material damage when their data is mistakenly shared. The court's decision will guide how such mistakes are handled under GDPR.

What happened

Saturn Electro mistakenly handed a customer's personal documents to another customer.

Who was affected

A customer whose personal information, including name and address, was accidentally given to someone else at a Saturn store.

What the authority found

The Court of Justice examined whether accidental data disclosure without harm still constitutes a GDPR violation and if compensation is due.

Why this matters

This case could set a precedent for how accidental data disclosures are treated under GDPR, especially regarding compensation for non-material damage. Businesses should be aware of the potential for liability even when no harm seems to occur.

GDPR Articles Cited

Art. 2(1) GDPR
Art. 5(1)(f) GDPR
Art. 6(1) GDPR
Art. 82 GDPR
Decision AuthorityCJEU
Reviewed AuthorityAmG Hagen (Germany)
Full Legal Summary
Detailed

The case concerns a customer of Saturn whose appliance and purchase documents, while in the shop, were mistakenly given to another customer. The first customer seeks compensation for this error. The District Court of Hagen referred the following questions to the CJEU for a preliminary ruling: 1. As no automatic legal effects are specified, is the compensation rule enacted in Article 82 GDPR invalid in the case of non-material damage? 2. Is it necessary, for the purposes of the right to compensation, to establish the occurrence of non-material damage, to be demonstrated by the claimant, in addition to the unauthorised disclosure of the protected data to an unauthorised third party? 3. Does the accidental disclosure of the personal data of the data subject (name, address, occupation, income, employer) to a third party in a paper document (printout), as the result of a mistake by employees of the processing undertaking, suffice in order to establish infringement of the GDPR? 4. Where the undertaking accidentally discloses, through its employees, data entered in an automated data processing system to an unauthorised third party in the form of a printout, does that accidental disclosure to a third party qualify as unlawful further processing (Article 2(1), Article 5(1)(f), Article 6(1) and Article 24 GDPR)? 5. Is non-material damage within the meaning of Article 82 GDPR incurred even where the third party who received the document containing the personal data did not read the data before returning the document containing the information, or does the discomfort of the person whose personal data were unlawfully disclosed suffice for the purpose of establishing non-material damage within the meaning of Article 82 GDPR, given that every unauthorised disclosure of personal data entails the risk, which cannot be eliminated, that the data might nevertheless have been passed on to any number of people or even misused? 6. Where accidental disclosure to third parties is preventabl

Outcome

CJEU Judgment

A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.

Violations (1)

Third-Party Cookies Without Consent
critical

Third-party tracking cookies or scripts are loaded without obtaining prior user consent.

Art. 13, 14 GDPR

Related Cases (0)

No other cases found for CJEU case C-687/21 Saturn Electro in DE

This is the only recorded case for this entity in this jurisdiction.

Details

Judgment Date

16 November 2021

Authority

Court of Justice of the European Union

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. CJEU case C-687/21 Saturn Electro - Germany (2021). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: