Referral C-667/21 (Krankenversicherung Nordrhein, 8 Nov 2021)

1. Is Article 9(2)(h) of Regulation (EU) 2016/679 (General Data Protection Regulation; ‘the GDPR’) to be interpreted as prohibiting a medical service of a health insurance fund from processing its employee’s data concerning health which are a prerequisite for the assessment of that employee’s working capacity?

2. If the Court answers Question 1 in the negative, with the consequence that an exception to the prohibition on the processing of data concerning health laid down in Article 9(1) of the GDPR is possible under Article 9(2)(h) of the GDPR: in a case such as the present one, are there further data protection requirements, beyond the conditions set out in Article 9(3) of the GDPR, that must be complied with, and, if so, which ones?

3. If the Court answers Question 1 in the negative, with the consequence that an exception to the prohibition on the processing of data concerning health laid down in Article 9(1) of the GDPR is possible under Article 9(2)(h) of the GDPR: does the permissibility or lawfulness of the processing of data concerning health depend on the fulfilment of at least one of the conditions set out in Article 6(1) of the GDPR?

4. Does Article 82(1) of the GDPR have a specific or general preventive character, and must that be taken into account in the assessment of the amount of non-material damage to be compensated at the expense of the controller or processor on the basis of Article 82(1) of the GDPR?

5. Is the degree of fault on the part of the controller or processor a decisive factor in the assessment of the amount of non-material damage to be compensated on the basis of Article 82(1) of the GDPR? In particular, can non-existent or minor fault on the part of the controller or processor be taken into account in their favour?