BGH - VI ZR 97/22

Summary

Germany's Federal Court of Justice ruled that a job applicant is entitled to non-material damages after their personal data, including salary expectations, was mistakenly disclosed to a third party by a bank. The court confirmed the disclosure was unlawful under GDPR and that the applicant's concern over data misuse constituted sufficient damage, referring the case back to determine the exact compensation amount.

Full text

Help BGH - VI ZR 97/22: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 08:01, 28 July 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators101 edits Tag: Decisions [1.0] (No difference) Latest revision as of 08:01, 28 July 2026 BGH - VI ZR 97/22 Court: BGH (Germany) Jurisdiction: Germany Relevant Law: Article 82 GDPR Decided: 23.06.2026 Published: 22.07.2026 Parties: National Case Number/Name: VI ZR 97/22 European Case Law Identifier: Appeal from: Appeal to: Not appealed Original Language(s): German Original Source: REWIS (in German) Initial Contributor: av The Federal Court of Justice held that a job applicant had a right to non-material damages for the disclosure of their personal data to a third party during a staff selection process for a bank. The court dismissed the data subject’s request for injunctive relief as there was no risk of recurrence. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts An employee of a private bank (the controller) erroneously sent a third party a message that was intended for a candidate in the controller’s staff selection process (the data subject) in October 2018. The message contained the data subject’s full name and information about their salary expectations. After the data subject was informed they were no longer considered for the position, they brought court proceedings requesting injunctive relief in order to prohibit the controller from processing the data subject’s personal data in connection with their job application. In addition, the data subject claimed non-material damages. The court of first instance granted the injunction and awarded the data subject € 1,000 in damages. The appellate court upheld the injunction but rejected the damages claim. The Federal Court of Justice (BGH) referred several questions to the CJEU regarding the interpretation of Article 82 GDPR. The CJEU rendered its judgment in September 2025. It held that Member States may provide for injunctive relief in national law in cases of unlawful processing. According to the CJEU, negative feelings caused by a loss of control over personal data can also constitute non-pecuniary damages. Holding First, the Federal Court of Justice held that the data subject was entitled to non-material damages in accordance with Article 82 GDPR. The court confirmed the appellate court had correctly found that sending the message containing personal data to a third party had been unlawful due to the lack of a legal basis under Article 6(1) GDPR – the data subject had not consented to the processing. Furthermore, the controller had not argued that the processing would have been lawful under a different legal basis. The court also confirmed that the data subject had suffered non-material damage as a result of this GDPR violation. In the present case, the data subject’s concern that the recipient of the message might use the personal data contained in it for their own job applications already constituted loss of control of the data subject’s personal data and was therefore enough to establish a claim for damages under Article 82 GDPR. The court referred the case back to the appellate court so that it could determine the amount of non-material damages. Finally, the court held that the appellate court had erroneously upheld the data subject’s claim for injunctive relief: there was no risk of recurrence required for such a claim in German law. As the staff selection process in which the data subject had participated had already been completed, there was no likelihood whatsoever that such an infringement of the data subject’s rights would recur. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Federal Court of Justice VI ZR 97/22 June 23, 2026 rewis logo REWIS: LEGAL TECHNOLOGY Case Law Database Information provided without guarantee © REWIS UG (limited liability) URL: https://rewis.io/s/u/jRzc/ Federal Court of Justice 6th Civil Division 2 VI ZR 97/22 dated June 23, 2026 | rewis.io VI ZR 97/22 dated June 23, 2026 Judgement | Federal Court of Justice | 6th Civil Division Headnote 1. On the concept of non-pecuniary damage within the meaning of Art. 82 of the GDPR. 2. On the requirements for a claim for injunctive relief under national law directed against the repeated transfer of personal data in violation of the General Data Protection Regulation. Disposition Upon appeal by the plaintiff and the defendant, the judgement of the 13th Civil Division of the Higher Regional Court of Frankfurt am Main, with its seat in Darmstadt, dated March 2, 2022, is set aside. Upon the defendant’s appeal, the judgement of the Darmstadt Regional Court—13th Civil Chamber— dated May 26, 2020, is amended to the extent that it granted the plaintiff’s claim for an injunction. To that extent, the lawsuit is dismissed. In all other respects, the case is remanded to the appellate court for a new hearing and decision, including on the costs of the appeal proceedings. As a matter of law Facts of the Case 1 The plaintiff is filing a lawsuit against the defendant for the disclosure of personal data, seeking an injunction and compensation for non-pecuniary damages. 2 The plaintiff was in the process of applying for a position at the defendant’s private bank, which took place via the online portal Xing. In the course of this process, an employee of the defendant sent a message via the portal’s messenger service on October 23, 2018, via the portal’s messenger service, a message intended solely for the plaintiff to a third party who was not involved in the application process. The message read as follows: “Dear Mr. K [plaintiff’s last name], I hope you are well! Our manager—Mr. R[...]— finds your sales representative profile very interesting. However, we cannot meet your salary expectations 3 VI ZR 97/22 dated June 23, 2026 | rewis.io meet your salary expectations. He can offer 80k + variable compensation. Would this still be of interest to you under these circumstances? I look forward to hearing from you and wish you a great start to your Tuesday. Best regards, I[...] J[...]" 3 The third party, who had worked with the plaintiff some time ago at the same holding company and therefore knew him, forwarded the message to the plaintiff and asked whether it was intended for the plaintiff and whether he was looking for a job. 4 After the defendant informed the plaintiff that he would no longer be considered for the application process, the plaintiff objected to the sending of the message dated October 23, 2018, to the third party. In a letter from his attorney dated February 25, 2019, the plaintiff filed a lawsuit against the defendant and demanded that the defendant issue a cease-and-desist declaration subject to a penalty, provide information regarding data processing, pay damages, and reimburse legal costs . The defendant subsequently issued a declaration of cessation subject to a penalty—which specifically referred to the repeated dissemination of the message dated October 23, 2018, in its exact wording—and rejected the remaining claims. 5 The plaintiff asserts that his—non-pecuniary—damage does not lie in the abstract loss of control over the disclosed data, but rather in the fact that at least one additional person who knows the plaintiff and potential as well as former employers—is now aware of circumstances that are subject to confidentiality. There is reason to fear that the third party, who works in the same industry, may have disclosed the data contained in the message or, by virtue of this knowledge, may gain an advantage as a competitor in any job applications . Furthermore, he c

Entities