Case C-667/21

ZQ

v

Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts

(Request for a preliminary ruling from the Bundesarbeitsgericht)

Judgment of the Court (Third Chamber) of 21 December 2023

(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 6(1) – Conditions for lawful processing – Article 9(1) to (3) – Processing of special categories of data – Data concerning health – Assessment of an employee’s working capacity – Health insurance medical service processing data concerning the health of its own employees – Conditions for such processing and whether permissible – Article 82(1) – Right to compensation and liability – Compensation for non-material damage – Compensatory function – Impact of negligence on the part of the data controller)

1. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Processing of special categories of personal data – Prohibition – Derogations – Processing necessary for the purposes of the assessment of the working capacity of the employee – Processing of data concerning the health of one of its employees in its capacity as a medical service – Whether permissible – Conditions

   (European Parliament and Council Regulation 2016/679, Art. 9(1), (2)(h), and (3))

   (see paragraphs 44, 47-51, 53, 57, 58, operative part 1)

2. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Processing of special categories of personal data – Prohibition – Derogations – Processing necessary for the purposes of the assessment of the working capacity of the employee – Obligation of the data controller to prevent the colleagues of such a worker from having access to data relating to his or her state of health – Conditions for imposition

   (European Parliament and Council Regulation 2016/679, Arts 5(1)(f), 9(1), (2)(h), (3) and (4), and 32(1)(a) and (b))

   (see paragraphs 61-68, 70, operative part 2)

3. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Processing of special categories of personal data – Prohibition – Derogations – Conditions for lawfulness of processing – Applicability

   (European Parliament and Council Regulation 2016/679, Arts 5(1), 6(1), and 9 (2)(h))

   (see paragraphs 75-79, operative part 3)

4. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Right to compensation and liability – Conditions – Liability of the data controller– Criterion – Existence of a fault – Exemption from liability – Burden of proof lying with the controller

   (European Parliament and Council Regulation 2016/679, Art. 82(1) to (3))

   (see paragraphs 82, 90-100, 103, operative part 5)

5. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Right to compensation and liability – Right to compensation for the damage suffered – Determination of the amount of damages payable – Application of national rules relating to the extent of financial compensation – Condition – Respect for the principles of equivalence and effectiveness – No taking into account the degree of seriousness of the fault committed by the controller

   (European Parliament and Council Regulation 2016/679, Art. 82)

   (see paragraphs 83, 101-103, operative part 5)

6. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Right to compensation and liability – Right to compensation for the damage suffered – Compensatory function – Compensation in full for the damage suffered – No dissuasive or punitive function

   (European Parliament and Council Regulation 2016/679, recital 146, sixth sentence, and Art. 82(1))

   (see paragraphs 84-87, operative part 4)

See the text of the decision.