Request for a preliminary ruling from the Oberlandesgericht Wien (Austria) lodged on 23 January 2025 – CRIF GmbH v YO

(Case C-40/25, CRIF)

(C/2025/1880)

Language of the case: German

Referring court

Oberlandesgericht Wien

Parties to the main proceedings

Appellant and original defendant party: CRIF GmbH

Respondent and original applicant: YO

Question referred

Must Article 17 of the GDPR (1) be interpreted as meaning that a data subject whose personal data have been unlawfully disclosed by the controller through onward transfer has the right to obtain a prohibitory injunction against the controller prohibiting further unlawful onward transfer of those data if the data subject does not request the controller to erase the data because the data subject cannot then be found in the controller’s database, which may make it difficult or even impossible to conclude a contract if the controller’s customers make their business decisions dependent on a successful search for the data subject in the controller’s database?

(1)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1).