Action brought on 17 October 2025 – NJ v Parliament

(Case T-737/25)

(C/2026/117)

Language of the case: German

Parties

Applicant: NJ (represented by: C. Däuble and T. Herbrich, lawyers)

Defendant: European Parliament

Form of order sought

The applicant claims that the Court should:

—

order the defendant to pay compensation for non-material damage in the total amount of EUR 4 700,00 plus interest at a rate of 2 percentage points above the respective interest rate set by the European Central Bank for main refinancing operations, from the date of the judgment, which was caused to the applicant by the infringements of Regulation 2018/1725; (1)

—

order the defendant to compensate for the material damage in the form of the costs of pre-litigation legal proceedings in the amount of EUR 16 031,68 plus interest at a rate of 2 percentage points above the respective interest rate set by the European Central Bank for its main refinancing operations, from the date of the judgment, which the applicant incurred as a result of the infringements of Regulation 2018/1725;

—	order the defendant to pay the costs of the proceedings.

Pleas in law and main arguments

In support of the action, the applicant relies on three pleas in law.

First plea in law, alleging infringement of Article 33(1) and Article 4(1)(f) of Regulation (EU) 2018/1725

The unauthorised access by third parties to the applicant’s data stored in the ‘PEOPLE app’ at the beginning of 2024 was attributable to the defendant’s failure to implement the appropriate technical and organisational measures required under Article 33(1) of Regulation (EU) 2018/1725 by the defendant as the controller to ensure a level of protection appropriate to the risk. According to Article 4(1)(f) in conjunction with Article 33(1)(b) of Regulation (EU) 2018/1725, the controller must ensure the security of the processing of personal data, including protection against unauthorised or unlawful processing and against accidental loss, and, in particular, ensure its confidentiality.

As a result of the data breach and the resulting access by third parties to the applicant’s highly personal and sensitive data, he or she suffered a profound loss of control. In addition to the loss of control, the applicant suffers from severe anxiety and fear of misuse of his or her personal data.

2.	Second plea in law, alleging infringement of Article 17(1)(a) and Article 14(3) and (4) of Regulation (EU) 2018/1725

By responding to the applicant’s request for information in a manner that was, first, incorrect or incomplete and, secondly, only five weeks after his or her request, and by failing to inform his or her of an extension of the deadline together with the reasons for the delay, the defendant violated its obligation to provide information in a timely manner under Article 17(1)(a), Article 14(3) and (4) of Regulation (EU) 2018/1725 and violated the applicant’s right to information, which is guaranteed under primary law in Article 8(2) sentence 2 of the Charter of Fundamental Rights.

In accordance with recitals 45 and 55 of Regulation (EU) 2018/1725, the restriction of rights is to be classified as independent non-material damage. The non-material damage suffered by the applicant is exacerbated by the obviously inaccurate statement of the purposes of processing and the resulting incomplete provision of information.

Third plea in law, alleging infringement of Article 4(1)(c) and (e) of Regulation (EU) 2018/1725 (obligation to minimise data and limit storage)

While the collection of the applicant’s personal data by the defendant may still be necessary for recruitment purposes, its continued storage in the ‘PEOPLE app’ for a period of 10 years is no longer necessary or required for the processing purpose of ‘recruitment’ – even in the broadest sense of the term.

The unjustified storage period of ten years would result in a further loss of control over his or her data for the applicant and would increase his or her annoyance, frustration and incomprehension. According to the Court of Justice’s manifest case-law, those negative feelings caused by the infringement of the law constitute independent non-material damage.

(1) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39).