Official Journal of the European Union

Series C

C/2024/1993

18.3.2024

(Case C-687/21, (1) MediaMarktSaturn)

(Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - Regulation (EU) 2016/679 - Interpretation of Articles 5, 24, 32 and 82 - Assessment of the validity of Article 82 - Inadmissibility of the request for an assessment of validity - Right to compensation for damage caused by data processing which infringes that regulation - Transmission of data to an unauthorised third party on account of an error made by the employees of the controller - Assessment of the appropriateness of the protective measures implemented by the controller - Compensatory function fulfilled by the right to compensation - Effect of the severity of the infringement - Whether necessary to establish the existence of damage caused by that infringement - Concept of ‘non-material damage’)

(C/2024/1993)

Language of the case: German

Referring court

Parties to the main proceedings

Applicant: BL

Defendant: MediaMarktSaturn Hagen-Iserlohn GmbH, formerly known as Saturn Electro-Handelsgesellschaft mbH Hagen

Operative part of the judgment

1.Articles 5, 24, 32 and 82 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read together

must be interpreted as meaning that in an action for compensation based on Article 82, the fact that the employees of the controller provided to an unauthorised third party in error a document containing personal data is not sufficient, in itself, to consider that the technical and organisational measures implemented by the controller at issue were not ‘appropriate’, within the meaning of Articles 24 and 32.

2.Article 82(1) of Regulation 2016/679

must be interpreted as meaning that the right to compensation laid down in that provision, in particular in the case of non-material damage, fulfils a compensatory function, in that financial compensation based on that provision must allow the damage actually suffered as a result of the infringement of that regulation to be compensated in full, and not a punitive function.

3.Article 82 of Regulation 2016/679

must be interpreted as meaning that that article does not require that the severity of the infringement made by the controller be taken into consideration for the purposes of compensation under that provision.

4.Article 82(1) of Regulation 2016/679

must be interpreted as meaning that the person seeking compensation by way of that provision is required to establish not only the infringement of provisions of that regulation, but also that that infringement caused him or her material or non-material damage.

5.Article 82(1) of Regulation 2016/679

must be interpreted as meaning that if a document containing personal data was provided to an unauthorised third party and it was established that that person did not become aware of those personal data, ‘non-material damage’, within the meaning of that provision, does not exist due to the mere fact that the data subject fears that, following that communication having made possible the making of a copy of that document before its recovery, a dissemination, even abuse, of those data may occur in the future.

(1)

Language of the case: German

ELI: http://data.europa.eu/eli/C/2024/1993/oj

ISSN 1977-091X (electronic edition)

JUDGMENT OF 6. 3. 2025 – CASE C-41/24 WALTHAM ABBEY RESIDENTS ASSOCIATION

*

* * *

* * *