Referral C-655/23 (Quirin Privatbank, 7 Nov 2023)

1. (a) Must Article 17 of the GDPR be interpreted as meaning that a data subject whose personal data have been unlawfully disclosed by the controller through onward transfer has the right to obtain a prohibitory injunction against the controller prohibiting further unlawful onward transfer of those data if the data subject does not request the controller to erase the data?
(b) Can such a right to obtain a prohibitory injunction (also) arise from Article 18 of the GDPR or any another provision thereof?

2. If the answers to Questions 1(a) and/or 1(b) are in the affirmative:
(a) Does the right to obtain a prohibitory injunction under EU law exist only if a risk of further infringements of the data subject’s rights under the GDPR is to be apprehended in the future (risk of recurrence)?
(b) Is the existence of the risk of recurrence presumed, where applicable, by reason of the existing infringement of the GDPR?

3. If the answers to Questions 1(a) and 1(b) are in the negative:
Must Article 84 of the GDPR, in conjunction with Article 79 thereof, be interpreted as permitting the national court to confer on the data subject whose personal data were unlawfully disclosed by the controller through onward transfer, in addition to the right to obtain compensation for material or non-material damage pursuant to Article 82 GDPR and the rights arising from Articles 17 and 18 of the GDPR, a right to obtain a prohibitory injunction against the controller prohibiting further unlawful onward transfer of those data in accordance with the provisions of national law?

4. Must Article 82(1) of the GDPR be interpreted as meaning that mere negative feelings such as annoyance, displeasure, dissatisfaction, worry and fear, which are in themselves part of the general risk of life and often part of everyday experience, are sufficient for the assumption of non-material damage within the meaning of that provision? Or is a disadvantage to the natural person concerned which goes beyond those feelings necessary for the assumption of damage?

5. Must Article 82(1) GDPR to be interpreted as meaning that the degree of fault of the controller or processor or its employees constitutes a relevant criterion in assessing the amount of non-material damage to be compensated?

6. If the answers to Questions 1(a), 1(b) or 3 are in the affirmative:
Must Article 82(1) of the GDPR be interpreted as meaning that, in assessing the amount of non-material damage to be compensated, the fact that the data subject concerned has a right to obtain a prohibitory injunction in addition to the right to compensation can be taken into account as reducing the claim?