At the beginning of September, the CJEU published several important cases, one of which is particularly interesting to discuss, as it concerns the injunction as a legal remedy under GDPR and the evaluation of non-material damage under the GDPR.
The Facts and Questions
The data subject applied for the position at Quirin Privatbank via a social networking platform. Later, via this network, an employee of Quirin Privatbank sent a message to a third party, which was intended only for the data subject. The message concerned the data subject’s level of remuneration, which was too high for Quirin Privatbank. The third party forwarded it to the data subject with the question of whether the latter was looking for a job.
Such actions of Quirin Privatbank resulted in the proceedings before the Darmstadt Regional Court in Germany. The data subject was asking for two main things:
-
to issue an injunction to Quirin Privatbank to stop processing the data subject’s data, because it could worsen the unauthorised disclosure. However, the data subject did not ask the controller to delete his data.
-
to pay him compensation for the non-material damage. As this action of a company could have caused a potential negative competitive recruitment situation and humiliation for the data subject.
However, the referring court has more than 2 questions, namely 6:
-
the first three questions ask whether the GDPR provides an opportunity to obtain a prohibitory injunction, where the data was processed unlawfully and the data subject did not request his data to be deleted.
-
the fourth question asks whether the “non-material” damages under Article 82(1) can include the negative feelings, such as fear or annoyance, which are caused by loss of control over the data, potential misuse or damage to the data subject’s reputation.
-
the fifth question asks whether the degree of seriousness of the controller’s unlawful processing should be taken into account in order to assess the sufficient compensation under Article 82(1).
-
the sixth question asks whether the injunction can reduce the amount of compensation under Article 82 or even substitute it.
The Answers
Questions 1-3
The Court explained that the GDPR does not give data subjects an explicit right to go to court and demand a preventive order stopping a controller from repeating unlawful processing in the future. This is due to the fact that Chapter VIII, namely Articles 77-79 do not explicitly include the possibility for data subject to exercise injunction against the controller. Moreover, the Chapter VIII does not require Member States to provide a specific preventive measure as a prohibitory injunction. At the same time, the GDPR does not preclude Member States to provide this opportunity in their national legal systems.
Therefore, a prohibitory injunction cannot be obtained directly under the GDPR.
Question 4
The Court held that ** feelings such as fear and annoyance indeed are capable of constituting ’non-material damage’ under the GDPR**. However, there are other decisive components that are crucial to take into account:
- an infringement of the GDPR (like, ’loss of control’ of one’s data, personal data breach), and
- causal link between the infringement and the damage which cause such feelings (damage to reputation, fear of data to be misused in the future).
Also, the Court emphasised that there is no scale for measuring how serious someone’s feelings must be in order to qualify as ’non-material damage’.
Question 5
The Court said: no - the severity and possible intentional nature of the infringement by the controller is not taken into account for the compensatory purposes of Article 82(1) GDPR. So, Article 82(1) covers only compensation and has no punitive or preventive function, unlike the provisions of criminal law. In this context, the controller’s motives, incentives, or the scale of the damage do not matter.
Question 6
As clarified in Question 5, Article 82 provides only a compensatory function. At the same time prohibitive injunction is a measure of the preventive nature. Therefore, they are two parallel measures that are not mutually exclusive or interchangeable. So, the answer is no - the injunction cannot reduce the amount of compensation under Article 82 or substitute it.
Key Takeaways
-
The GDPR does not itself provide a right to obtain a prohibitory injunction, but Member States may introduce such remedies in national law.
-
Fear, annoyance, and similar feelings can qualify as non-material damage, as long as they stem from a GDPR infringement and there is a causal link.
-
Article 82(1) GDPR is compensatory only: severity, intent, or motives of the controller do not affect compensation, and an injunction cannot reduce or replace it.
