GDPR non-material damage: BGH to ECJ | IT-Medienrecht

BGH Seeks Clarity from ECJ on GDPR Interpretation

The VI. Civil Senate of the Federal Court of Justice (BGH) has referred several questions to the Court of Justice of the European Union (ECJ) for a preliminary ruling. These questions concern the interpretation of provisions within the General Data Protection Regulation (GDPR). Specifically, they address the existence of a right to injunctive relief under EU law for data subjects whose personal data was unlawfully disclosed through onward transfer by a controller.

The referral also examines the possibility of recourse to national law in this regard, and the concept of non-material damage as defined in Art. 82 (1) GDPR. This move aims to clarify complex legal aspects of data protection within the European Union.

Facts of the Case

The plaintiff is seeking injunctive relief and compensation for non-material damage from a private bank, the defendant. This claim arises from the disclosure of the plaintiff's personal data. The plaintiff had been involved in an application process with the bank, managed via an online portal.

During this process, an employee of the defendant mistakenly sent a message, intended solely for the plaintiff, to a third party. This third party was not involved in the application process but had previously worked with the plaintiff in the same holding and knew him. The message included sensitive information, such as the defendant's inability to meet the plaintiff's salary expectations.

The plaintiff argues that his non-material damage stems from the fact that a third party, familiar with him and potentially his past or future employers, now possesses confidential information. He fears this third party, working in the same industry, might have disseminated the data or gained a competitive advantage in other application processes. Moreover, the plaintiff considers the "defeat" in salary negotiations a disgrace, which he would not have shared with third parties, particularly potential competitors.

Procedural History

The Regional Court partially upheld the initial action. It ordered the defendant to cease and desist as requested and awarded the plaintiff €1,000 in non-material damages, although the plaintiff had claimed at least €2,500.

Upon the defendant's appeal, the Higher Regional Court amended the judgment. It dismissed the claim for non-material damages. The plaintiff subsequently appealed this decision, which was allowed by the Court of Appeal, and continues to pursue his claims in full. Conversely, the defendant seeks the complete dismissal of the action through its own appeal.

Federal Court of Justice's Decision on GDPR Interpretation

The Federal Court of Justice (BGH) has stayed the proceedings. It has referred the following questions to the Court of Justice of the European Union for a preliminary ruling on the interpretation of the General Data Protection Regulation (GDPR):

Questions Referred to the ECJ

1. a) Is Art. 17 GDPR to be interpreted as meaning that the data subject whose personal data has been unlawfully disclosed by the controller by forwarding is entitled to a claim against the controller to refrain from further unlawful forwarding of this data if the data subject does not request the controller to erase the data?

   b) Can such a claim for injunctive relief (also) arise from Art. 18 GDPR or another provision of the GDPR?

2. If questions 1a) and/or 1b) are answered in the affirmative:

   a) Does the right to injunctive relief under EU law only exist if there is a risk of further infringements of the data subject’s rights under the GDPR in the future (risk of repetition)?

   b) Is the existence of the risk of repetition assumed, if applicable, due to the already existing violation of the GDPR?

3. If questions 1a) and 1b) are answered in the negative:

   Are Art. 84 in conjunction with Art. 79 GDPR to be interpreted as meaning that they allow the national court to award the data subject whose personal data has been unlawfully disclosed by the controller by way of onward transfer, in addition to compensation for the material or non-material damage pursuant to Article 82 GDPR and the claims arising from Article 17 and Article 18 GDPR, a claim against the controller to cease and desist from any further unlawful onward transfer of that data in accordance with the provisions of national law?

4. Is Art. 82 para. 1 GDPR to be interpreted as meaning that mere negative feelings such as anger, resentment, dissatisfaction, worry and fear, which are in themselves part of the general risk of life and often part of everyday experience, are sufficient for the assumption of non-material damage within the meaning of that provision? Or is a disadvantage for the natural person concerned that goes beyond these feelings necessary for the assumption of damage?
5. Is Art. 82 para. 1 GDPR to be interpreted as meaning that the degree of fault of the controller or processor or its employees is a relevant criterion when assessing the amount of non-material damage to be compensated?
6. If questions 1a), 1b) or 3 are answered in the affirmative:

   Is Art. 82 para. 1 GDPR to be interpreted to the effect that, when assessing the amount of the non-material damage to be compensated, the fact that the data subject is entitled to injunctive relief in addition to the claim for damages can be taken into account as reducing the claim?

Lower Court Decisions

The case has passed through the following lower courts:

• LG Darmstadt – Judgment of May 26, 2020 – 13 O 244/19
• OLG Frankfurt am Main – Judgment of March 2, 2022 – 13 U 206/20

Conclusion

The Federal Court of Justice's referral underscores the complex legal questions surrounding GDPR enforcement, particularly concerning injunctive relief and the definition of non-material damages. The ECJ's preliminary ruling will provide crucial guidance on these matters.

Its decision is expected to significantly impact how data protection breaches are handled across the EU, offering much-needed clarity for both data subjects and controllers.