The mere transmission of personal data to an unauthorised person is sufficient to establish a claim for non-material damages under GDPR, even without demonstrable economic loss.