Referral C-40/25 (CRIF, 23 Jan 2025)

Must Article 17 of the GDPR be interpreted as meaning that a data subject whose personal data have been unlawfully disclosed by the controller through onward transfer has the right to obtain a prohibitory injunction against the controller prohibiting further unlawful onward transfer of those data if the data subject does not request the controller to erase the data because the data subject cannot then be found in the controller’s database, which may make it difficult or even impossible to conclude a contract if the controller’s customers make their business decisions dependent on a successful search for the data subject in the controller’s database?