Judgment of the Court (Fourth Chamber) of 4 September 2025 (request for a preliminary ruling from the Bundesgerichtshof – Germany) – IP v Quirin Privatbank AG

(Case C-655/23, (1) Quirin Privatbank)

(Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - Regulation (EU) 2016/679 - Rights of the data subject - Article 17 - Right to erasure of data - Article 18 - Right to restriction of processing - Article 79 - Right to an effective judicial remedy - Unlawful processing of personal data - Action seeking an order requiring the controller to refrain from any further unlawful processing in the future - Basis - Conditions - Article 82(1) - Right to compensation - Concept of ‘non-material damage’ - Assessment of the compensation - Possible consideration of the degree of fault on the part of the controller - Possible impact of the grant of a ‘prohibitory injunction’)

(C/2025/5554)

Language of the case: German

Referring court

Bundesgerichtshof

Parties to the main proceedings

Applicant: IP

Defendant: Quirin Privatbank AG

Operative part of the judgment

The provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as not providing, for the data subject concerned by the unlawful processing of personal data, in the event that that data subject does not request that his or her data be erased, a judicial remedy enabling him or her to obtain, as a preventive measure, an order that the controller refrain from carrying out further unlawful processing in the future. However, those provisions do not prevent Member States from providing for such a remedy in their respective legal systems.

Article 82(1) of Regulation 2016/679

must be interpreted as meaning that the concept of ‘non-material damage’ in that provision encompasses negative feelings experienced by the data subject as a result of an unauthorised transmission of his or her personal data to a third party, such as fear or annoyance, which are caused by a loss of control over those data, by a potential misuse of those data or by harm to his or her reputation, provided that the data subject demonstrates that he or she has such feelings, with their negative consequences, on account of the infringement of that regulation.

3.	Article 82(1) of Regulation 2016/679 must be interpreted as precluding the degree of fault on the part of the controller from being taken into account for the purpose of assessing the compensation for non-material damage payable under that article.

Article 82(1) of Regulation 2016/679

must be interpreted as precluding the fact that the data subject has obtained, under the applicable national law, an injunction to prohibit the reiteration of an infringement of that regulation, enforceable against the controller, from being taken into account in order to reduce the extent of the financial compensation for non-material damage payable under that article or, a fortiori, to replace that compensation.

(1) OJ C, C/2024/1391.