BGH - VI ZR 97/22

Summary

The German Federal Court of Justice (BGH) has ruled that individuals can claim non-pecuniary damages for GDPR violations, even if the violation only causes 'negative feelings' or loss of control over personal data. The case involved a job applicant whose data was unlawfully shared. While the court upheld the claim for damages, it rejected the request for injunctive relief due to no risk of recurrence.

Full text

Help BGH - VI ZR 97/22: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 08:01, 28 July 2026 view sourceAv (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators105 edits Tag: Decisions [1.0] Latest revision as of 07:02, 29 July 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators105 editsTag: Visual edit Line 93: Line 93: After the data subject was informed they were no longer considered for the position, they brought court proceedings requesting injunctive relief in order to prohibit the controller from processing the data subject’s personal data in connection with their job application. In addition, the data subject claimed non-material damages.After the data subject was informed they were no longer considered for the position, they brought court proceedings requesting injunctive relief in order to prohibit the controller from processing the data subject’s personal data in connection with their job application. In addition, the data subject claimed non-material damages. The court of first instance granted the injunction and awarded the data subject € 1,000 in damages. The appellate court upheld the injunction but rejected the damages claim. The Federal Court of Justice (BGH) referred several questions to the CJEU regarding the interpretation of [[Article 82 GDPR|Article 82 GDPR]]. The court of first instance granted the injunction and awarded the data subject € 1,000 in damages. The appellate court upheld the injunction but rejected the damages claim. The Federal Court of Justice (BGH) referred several questions to the CJEU regarding the interpretation of [[Article 82 GDPR]]. The CJEU rendered its judgment in September 2025. It held that Member States may provide for injunctive relief in national law in cases of unlawful processing. According to the CJEU, negative feelings caused by a loss of control over personal data can also constitute non-pecuniary damages.The CJEU rendered its judgment in the case [[CJEU - C-655/23 - Quirin Privatbank|C-655/23 ''Quirin Privatbank'']] in September 2025. It held that Member States may provide for injunctive relief in national law in cases of unlawful processing. According to the CJEU, negative feelings caused by a loss of control over personal data can also constitute non-pecuniary damages. === Holding ====== Holding === First, the Federal Court of Justice held that the data subject was entitled to non-material damages in accordance with [[Article 82 GDPR|Article 82 GDPR]]. The court confirmed the appellate court had correctly found that sending the message containing personal data to a third party had been unlawful due to the lack of a legal basis under [[Article 6 GDPR|Article 6(1) GDPR]] – the data subject had not consented to the processing. Furthermore, the controller had not argued that the processing would have been lawful under a different legal basis.First, the Federal Court of Justice held that the data subject was entitled to non-material damages in accordance with [[Article 82 GDPR]]. The court confirmed the appellate court had correctly found that sending the message containing personal data to a third party had been unlawful due to the lack of a legal basis under [[Article 6 GDPR|Article 6(1) GDPR]] – the data subject had not consented to the processing. Furthermore, the controller had not argued that the processing would have been lawful under a different legal basis. The court also confirmed that the data subject had suffered non-material damage as a result of this GDPR violation. In the present case, the data subject’s concern that the recipient of the message might use the personal data contained in it for their own job applications already constituted loss of control of the data subject’s personal data and was therefore enough to establish a claim for damages under [[Article 82 GDPR|Article 82 GDPR]]. The court referred the case back to the appellate court so that it could determine the amount of non-material damages.The court also confirmed that the data subject had suffered non-material damage as a result of this GDPR violation. In the present case, the data subject’s concern that the recipient of the message might use the personal data contained in it for their own job applications already constituted loss of control of the data subject’s personal data and was therefore enough to establish a claim for damages under [[Article 82 GDPR]]. The court referred the case back to the appellate court so that it could determine the amount of non-material damages. Finally, the court held that the appellate court had erroneously upheld the data subject’s claim for injunctive relief: there was no risk of recurrence required for such a claim in German law. As the staff selection process in which the data subject had participated had already been completed, there was no likelihood whatsoever that such an infringement of the data subject’s rights would recur.Finally, the court held that the appellate court had erroneously upheld the data subject’s claim for injunctive relief: there was no risk of recurrence required for such a claim in German law. As the staff selection process in which the data subject had participated had already been completed, there was no likelihood whatsoever that such an infringement of the data subject’s rights would recur. Latest revision as of 07:02, 29 July 2026 BGH - VI ZR 97/22 Court: BGH (Germany) Jurisdiction: Germany Relevant Law: Article 82 GDPR Decided: 23.06.2026 Published: 22.07.2026 Parties: National Case Number/Name: VI ZR 97/22 European Case Law Identifier: Appeal from: Appeal to: Not appealed Original Language(s): German Original Source: REWIS (in German) Initial Contributor: av The Federal Court of Justice held that a job applicant had a right to non-material damages for the disclosure of their personal data to a third party during a staff selection process for a bank. The court dismissed the data subject’s request for injunctive relief as there was no risk of recurrence. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts An employee of a private bank (the controller) erroneously sent a third party a message that was intended for a candidate in the controller’s staff selection process (the data subject) in October 2018. The message contained the data subject’s full name and information about their salary expectations. After the data subject was informed they were no longer considered for the position, they brought court proceedings requesting injunctive relief in order to prohibit the controller from processing the data subject’s personal data in connection with their job application. In addition, the data subject claimed non-material damages. The court of first instance granted the injunction and awarded the data subject € 1,000 in damages. The appellate court upheld the injunction but rejected the damages claim. The Federal Court of Justice (BGH) referred several questions to the CJEU regarding the interpretation of Article 82 GDPR. The CJEU rendered its judgment in the case C-655/23 Quirin Privatbank in September 2025. It held that Member States may provide for injunctive relief in national law in cases of unlawful processing. According to the CJEU, negative feelings caused by a loss of control over personal data can also constitute non-pecuniary damages. Holding First, the Federal Court of Justice held that the data subject was entitled to non-material damages in accordance with Article 82 GDPR. The court confirmed the appellate court had correctly found that sending the message containing personal data to a third party had been unlawful due to the lack of a legal basis under Article 6(1) GDPR – the data subject had not consented to the processing. Furthermore, the controller had not argued that the processing would hav

Entities