CJEU case C-655/23 Quirin Privatbank – CJEU Judgment (Germany, 2025)

The data subject ("IP") was a candidate in a staff selection process for the bank Quirin (‘the controller’), which took place via an online portal. An employee of the controller, using the online portal's messaging service, erroneously sent a third party a job offer only intended for the data subject disclosing details about the data subject's salary exceptions and the salary offered to them. The data subject brought an action before the Regional Court seeking an order that the controller refrain in future from processing, either by itself or through third parties, his personal data relating to the selection process, ‘if that processing occurs as it did in the message sent via the online portal’. The data subject also claimed non-material damages. The Landgericht (Regional Court) partially upheld the application, however the data subject pursued all his claims in full through two instances. Against that background, the Federal Court of Justice (Bundesgerichtshof - BGH) referred six questions to the CJEU for a preliminary ruling: # May the data subject require the controller to cease and desist further unlawful onward transfer of personal data under Articles 17 or 18, or any other provision GDPR, if the data subject does not request the controller to erase the data, where unlawful processing of personal data has already taken place? # If the answers to Questions 1 is in the affirmative, does the right to obtain a prohibitory injunction under EU law exist only if a risk of recurrence exists? # If the answers to Questions 1 is in the negative: Must Article 84 GDPR, in conjunction with Article 79 thereof, be interpreted as permitting the national court to confer on the data subject a right to obtain a prohibitory injunction against the controller prohibiting further unlawful onward transfer of those data in accordance with the provisions of national law? # Do simple negative feelings (such as discontent, annoyance, anxiety and fear) fall within the meaning of moral damage in accordance with Article 82(1) GDPR? # Must Article 82(1) GDPR be interpreted as meaning that the degree of seriousness of the fault of the controller is a relevant factor in assessing compensation for non-material damages? # If the answers to Questions 1 or 3 are in the affirmative: Must Article 82(1) GDPR be interpreted as meaning that, in assessing the amount of non-material damage to be compensated, the fact that the data subject concerned has a right to obtain a prohibitory injunction in addition to the right to compensation can be taken into account as reducing the claim?’ The CJEU directed the AG to consider only four of the six questions: # May the data subject require the controller to cease and desist further unlawful onward transfer of personal data under Articles 17 or 18, or any other provision GDPR, if the data subject does not request the controller to erase the data, where unlawful processing of personal data has already taken place? # If the answers to Questions 1 is in the affirmative, does the right to obtain a prohibitory injunction under EU law exist only if a risk of recurrence exists? # If the answers to Questions 1 is in the negative: Must Article 84 GDPR, in conjunction with Article 79 thereof, be interpreted as permitting the national court to confer on the data subject a right to obtain a prohibitory injunction against the controller prohibiting further unlawful onward transfer of those data in accordance with the provisions of national law? # If the answers to Questions 1 or 3 are in the affirmative: Must Article 82(1) GDPR be interpreted as meaning that, in assessing the amount of non-material damage to be compensated, the fact that the data subject concerned has a right to obtain a prohibitory injunction in addition to the right to compensation can be taken into account as reducing the claim?’ = The AG pointed out that the lack of explicit recognition of injunctive relief in the GDPR seems to be the origin of the referring court's uncertainty. However, the AG stated, that to interpret a provision of EU law, account must be taken not only of its wording. == The AG took the view that the data subject’s claim for injunctive relief can be inferred from Articles 5(1)(a) and 6(1) GDPR, read together with Article 79(1) GDPR. In the AG's view, the data subject’s right to injunctive relief is a corollary of the data subject’s right that any processing of personal data must be lawful. Otherwise, the AG opined, the legal protection provided for personal data would be incomplete. Thus the AG concluded, that a data subject has the right to demand that a data controller refrain from further unlawful processing in accordance with the GDPR and the option to apply to a court for an order imposing that obligation to desist on the controller. == The AG argued, that in line with his findings above Articles 5 and 6, together with Article 79 GDPR, make it unnecessary to consider the effects of [https://gdprhub.eu/Article%2017%20GDPR Articles 17] and 18 GDPR as a basis for injunctive actions. However, for completeness's sake the AG opined that neither Articles 17 nor 18 GDPR is, by itself, sufficient to act as the basis for the data subject’s right to require the controller to refrain from further unlawful processing (similar to that already carried out). The AG discussed in this context the interpretation of specifically Article 18(1)(b) GDPR, finding that it cannot be inferred from it that the data subject has a right to injunctive relief, because the aim of that provision is to prevent, temporarily and for a legitimate purpose of the data subject, the controller from carrying out the legal obligation which results from unlawful processing, by erasing the personal data concerned without delay. = As in the AG's view the GDPR provides a sufficient basis to justify the data subject’s right to injunctive relief, he did not consider whether that same solution may be reached by relying national law. = The AG opined, that it is for each Member State to draw up rules governing actions for an order to desist which are aimed at preventing the recurrence of unlawful processing, pursuant to the principle of procedural autonomy within the principles of equivalence end effectiveness. The AG considered, that the German procedural rules to prevent the recurrence of unlawful processing of personal data do not seem to infringe those two principles because they are the same as the rules laid down for similar situations by national law. Additionally and those rules do not appear to impose an excessive burden on individuals bringing such an action. = The AG opined, that the concept of ‘non-material damage’, within the meaning of Article 82(1) GDPR, must be given an autonomous and uniform definition which does not seem to fit to the German interpretation of non-material damage. The AG stated, that according to the CJEU's interpretation, Article 82(1) GDPR has an exclusively compensatory aim while the German concept of non-material damages also pursues preventative aims. The AG found, that the aim of the compensation under Article 82 GDPR is not the same as the aim of actions for an order to desist, because the latter does not redress damage already suffered. Thus, the AG concluded, that in assessing the amount of non-material damage resulting from unlawful processing that is to be compensated because it has already occurred, the fact that the data subject is also entitled to seek an order to desist, in future, from any further unlawful processing similar to that already carried out, is not a mitigating circumstance. The CJEU answered the first three questions together, and the rest separately. = Similar to the AG, the Court first stated that the context and objectives of a provision of EU law must be taken into consideration in its interpretation. The Court also reiterated that data subjects benefit from a right to lawful processing of their personal data, which is the corollary of the general obligation of controllers to not process data in a way that is inconsistent with the GDPR. However, the Court did not follow the opinion of the AG, and held that the GDPR does not confer a data subject with the right to bring an action for an order that the controller desists from unlawful data processing in the future. This is because the GDPR does not have specific provisions for this, and this right cannot be inferred from Article 17 or 18 GDPR. The wording of the right to an effective judicial remedy under Article 79(1) GDPR does not require Member States to provide a specific remedy such as a restraining order as a preventative measure. Nonetheless, the Court stated that the GDPR also does not prevent Member States from providing a preventative remedy like the one requested by the data subject. The GDPR aims to ensure harmonisation of national legislation regarding data protection, however, it expressly gives Member States a margin of discretion in implementing its provisions through its opening clauses. This was the case even if the provisions of Chapter VIIII GDPR do not include opening clauses; according to the Court, the EU legislator did not intend to include an exhaustive harmonisation of remedies available. = The Court first stated that under Article 82(1) GDPR the data subject has the right to obtain compensation for damage suffered from the controller or processor. The concept of non-material damages also must be given an autonomous and uniform definition specific to EU law. With this, the data subject is required to demonstrate a violation of the GDPR, as well as damage from said violation. The Court held that negative feelings, such as fear or annoyance, caused by a loss of control over personal data falls under the scope of non-material damages under the GDPR. Loss of control as non-material damages is specified in Recital 85 GDPR. However, the data subject must demonstrate these negative feelings. = The Court stated that Article 82(1) GDPR does not define the rules in assessing damages, and therefore, national courts must apply national law as long as the principles of equivalence and effectiveness of EU law are respected. Under German law, the degree of seriousness of the fault of the person responsible for the damages is a criterion used when assessing damages. The Court stated that compensation under Article 82 GDPR has an exclusively compensatory function, and not a dissuasive or punitive one. This means the degree of seriousness and possible intentional nature of the controller’s actions cannot be taken into consideration. = Here, the Court reiterated that the GDPR does not define the rules for assessing damages under Article 82 GDPR. However, national law must comply with the principles of equivalence and effectiveness of EU law, and therefore must ensure the data subject receives full and effective compensation. The Court followed the reasoning of the AG in stating that non-material damages cannot be reduced when the data subject can obtain injunctive relief; compensation under Article 82 GDPR has an exclusively compensatory nature, and is therefore a separate measure to an injunction aiming to prevent the occurrence of new damage.