The VI. Civil Senate of the Federal Court of Justice referred questions to the Court of Justice of the European Union for a preliminary ruling on the interpretation of provisions of the General Data Protection Regulation (GDPR) with regard to the existence of a right to injunctive relief under EU law for data subjects whose personal data was unlawfully disclosed by the controller by means of onward transfer, or on the possibility of recourse to national law in this respect and on the concept of non-material damage within the meaning of Art. 82 (1) GDPR. 1 GDPR submitted.
Facts:
The plaintiff is claiming injunctive relief and compensation for non-material damage from the defendant due to the disclosure of personal data. He was in an application process with the defendant private bank, which took place via an online portal. In the course of this, an employee of the defendant also sent a message intended only for the plaintiff via the messenger service of the portal to a third person who was not involved in the application process, who had worked with the plaintiff in the same holding some time ago and therefore knew him. Among other things, the message stated that the defendant was unable to meet the plaintiff’s salary expectations. The plaintiff claims that his – immaterial – damage does not lie in the abstract loss of control over the disclosed data, but in the fact that at least one other person who knows the plaintiff and potential and former employers now has knowledge of circumstances that are subject to confidentiality. It was to be feared that the third party working in the same industry had passed on the data contained in the message or had been able to gain an advantage as a competitor for any jobs in the application process by knowing it. In addition, he considers the “defeat” in the salary negotiations a disgrace, which he would not have passed on to third parties – especially not to potential competitors.
Previous process history:
The Regional Court partially upheld the action, ordered the defendant to cease and desist as requested and awarded the plaintiff, who is claiming non-material damages of at least € 2,500, an amount of € 1,000. On appeal by the defendant, the Higher Regional Court amended the judgment of the Regional Court with regard to the asserted claim for non-material damages and dismissed the action in this respect. The plaintiff contests this with his appeal, which was allowed by the Court of Appeal and with which he continues to pursue his claims in full. With its appeal, the defendant seeks the complete dismissal of the action.
Decision of the Federal Court of Justice:
The Federal Court of Justice stayed the proceedings and referred the following questions to the Court of Justice of the European Union for a preliminary ruling on the interpretation of the General Data Protection Regulation (GDPR): 1. (a) Is Article 17 GDPR to be interpreted as meaning that the data subject whose personal data has been unlawfully disclosed by the controller by way of onward transfer is entitled to a claim against the controller to refrain from further unlawful onward transfer of that data if the data subject does not request the controller to erase the data? b)Can such a claim for injunctive relief (also) arise from Art. 18 GDPR or another provision of the GDPR? 2. if questions 1a) and/or 1b) are answered in the affirmative: a)Does the right to injunctive relief under EU law only exist if there is a risk of further infringements of the data subject’s rights under the GDPR in the future (risk of repetition)? b)Is the existence of the risk of repetition assumed, if applicable, due to the already existing violation of the GDPR? 3.If questions 1a) and 1b) are answered in the negative: Are Art. 84 in conjunction with Art. Are Article 84 in conjunction with Article 79 GDPR to be interpreted as allowing the national court to award the data subject whose personal data has been unlawfully disclosed by the controller by way of onward transfer, in addition to compensation for the material or non-material damage pursuant to Article 82 GDPR and the claims arising from Article 17 and Article 18 GDPR, a claim against the controller for injunctive relief against further unlawful onward transfer of this data in accordance with the provisions of national law? 4.Is Art. 82 para. 1 GDPR to be interpreted as meaning that mere negative feelings such as anger, resentment, dissatisfaction, worry and fear, which are in themselves part of the general risk of life and often part of everyday experience, are sufficient for the assumption of non-material damage within the meaning of that provision? Or is a disadvantage for the natural person concerned that goes beyond these feelings necessary for the assumption of damage? 5.Is Art. 82 para. 1 GDPR to be interpreted as meaning that the degree of fault of the controller or processor or its employees is a relevant criterion when assessing the amount of non-material damage to be compensated? 6.if questions 1a), 1b) or 3 are answered in the affirmative: Is Art. 82 para. 1 GDPR to be interpreted to the effect that, when assessing the amount of the non-material damage to be compensated, the fact that the data subject is entitled to injunctive relief in addition to the claim for damages can be taken into account as reducing the claim?
Lower courts:
Regional Court Darmstadt – judgment of May 26, 2020 – 13 O 244/19 Higher Regional Court Frankfurt am Main – judgment of March 2, 2022 – 13 U 206/20
