Data breach in a job application: when are damages owed?

The case

The claimant was in an application process with a private bank via the Xing portal. An employee of the bank sent a message via the portal's messenger informing him that his salary expectations could not be met, but that they were offering 80,000 euros plus variable remuneration — and accidentally also sent this message to a third person who was not involved in the application process and who knew the claimant from a former shared workplace. The third party forwarded the message to the claimant and asked whether he was looking for a job. The claimant then demanded that similar data processing be refrained from in future (injunctive relief) as well as non-material damages.

Proceedings and decision

The BGH (Federal Court of Justice) had initially stayed the proceedings and referred questions on the interpretation of the GDPR to the CJEU (EuGH); following the latter's decision (CJEU, judgment of 4.9.2025 – C-655/23, Quirin Privatbank), it was now able to give a final ruling (BGH, judgment of 23.6.2026 – VI ZR 97/22). As a result, the claimant succeeded on the merits as regards damages: non-material damage under Art. 82(1) GDPR exists as soon as the third party informed without authorisation actually takes note of the data and reacts to it — here by asking the claimant. In addition, the claimant's well-founded fear that the third party, who worked in the same industry, might gain an advantage from the information as a potential competitor in the application process was sufficient. According to the CJEU's now established case law, even a minor but actually proven disadvantage is sufficient for this — a particular seriousness of the infringement is not an additional requirement.

The claim for injunctive relief

On the asserted claim for injunctive relief, by contrast, the claimant was unsuccessful. The CJEU had previously clarified that the GDPR itself does not provide for a preventive, forward-looking claim for injunctive relief where no erasure is requested — but Member States may provide for such a claim under national law. Under national law, however, such a claim fails if there is no longer a risk of repetition. That was precisely what was lacking here: the application process had since been concluded, and the infringement was based on a one-off special situation — the accidental selection of the wrong chat partner in an ongoing application process, which by its nature can no longer arise once the process has ended.

What companies should bear in mind

For companies that handle application processes via portals and messenger services, the decision is a clear warning: even a single, unintentional misdirected message can give rise to liability for damages as soon as the unintended recipient actually takes note of the information or becomes aware of it — a merely abstract risk is not sufficient, but a single specific incident is. Conversely, for those affected: anyone who above all wants to prevent a repetition after a data breach should demand action promptly while the underlying process is still ongoing — after that, as a rule, only the route via damages remains.