In summary: The mere transmission of personal data to an unauthorised person is sufficient to establish a claim for non-material damages under GDPR, even without demonstrable economic loss.
The German Federal Court of Justice has ruled that a rejection message sent in error to the wrong person via Xing establishes a GDPR damages claim — solely through loss of control over the data and the well-founded fear of misuse.
The Berlin private bank Quirin sent a rejection message to an applicant via Xing in 2018 — the message contained his name, gender and details of the salary offer. However, due to an error, it also reached a former colleague of the applicant who works in the same industry. The colleague asked the applicant if the message was intended for him and forwarded it.
The Darmstadt Regional Court initially recognised a GDPR damages claim, but the Frankfurt Court of Appeal overturned this judgment. It argued that the claimant had not proven any concrete harm such as fear or stress, but had only asserted a formal GDPR violation. The case reached the Federal Court of Justice, which submitted preliminary ruling questions to the European Court of Justice in 2023.
In September 2025, the European Court of Justice ruled that negative feelings — such as those arising from loss of control over one’s own data or fear of misuse — can establish a claim for non-material damages, provided that these are credibly substantiated by the person affected. The Federal Court of Justice followed this line in its judgment of 23 June 2026 (Case VI ZR 97/22): the transmission of personal data to the wrong recipient constitutes unlawful data processing. Damage arises at the moment when the third party becomes aware of the data — this is already a loss of control. Furthermore, the applicant’s fear that the colleague could exploit the information is reasonably justified.
For compliance officers, the judgment represents an escalation of liability risks: data breaches and transmission errors can lead to damages claims even without measurable economic consequences. The Federal Court of Justice rejected a claim for injunctive relief. The exact amount of damages must be determined by the Frankfurt Court of Appeal in a new hearing.
Source: www.it-daily.net · Published 29 July 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrase and classification through Lumi News Pipeline v1.7.3.