Wrong recipient: CJEU on injunctions and damages

An applicant had applied to Quirin Privatbank via a professional network. An employee accidentally sent a confidential message about his salary expectations to an uninvolved person, who forwarded it to the applicant. The applicant demanded injunctive relief and damages, but not the erasure of his data.

In its judgment of 4.9.2025 – C-655/23, the CJEU (EuGH) first ruled on the claim for injunctive relief: the GDPR itself provides for a right to have an infringement refrained from in future only if the data subject at the same time requests the erasure of their data. However, the Regulation does not preclude national remedies. In Germany, a claim for injunctive relief can therefore still be based on §§ 823, 1004 BGB (German Civil Code).

As regards damages under Art. 82 GDPR, the Court clarifies that negative feelings such as annoyance or worry resulting from an unauthorised disclosure can also constitute non-material damage. However, the data subject must prove that they actually suffered such negative consequences. Damages have an exclusively compensatory function and no punitive or deterrent function, and the degree of fault does not affect their amount.

For practice: anyone who experiences a data protection infringement should record their own consequences in concrete terms, i.e. what happened, how it affected them and when. Whether a claim exists, and in what amount, depends on the individual case.