In the case of the applicant, the Court of Justice of the European Union has ruled in favour of the applicant.

A German court has ruled that a job candidate who received a confidential application message via the social network Xing due to an error is entitled to compensation under the European Union's General Data Protection Regulation (GDPR). The Federal Court of Justice (BGH) confirmed this in its decision dated September 2025, rejecting the claim for an injunction against further data misuse, however. The case dates back to October 2018, when an employee of Quirin-Bank mistakenly sent a private message containing sensitive information to a third party through the Xing platform. The incident occurred during a recruitment process conducted over Xing. The employee intended to send a message exclusively to the candidate but accidentally forwarded it to another individual not involved in the hiring process. The content of the message was far from trivial. It included the candidate’s surname, gender, and indicated that a hiring process was underway. Additionally, it outlined how the bank evaluated the candidate’s profile and mentioned a potential salary of 80,000 euros plus variable compensation. The unintended recipient was not a stranger, he had previously worked with the candidate within the same holding company. He relayed the message to the candidate and directly asked whether he was currently looking for a new position. In court, the private bank initially argued that no personal data in the sense of GDPR had been transferred because the surname alone did not allow clear identification. However, the BGH rejected this argument. The sixth civil chamber affirmed that the message contained typical identifying characteristics, sufficient for the definition of personal data under GDPR. It emphasized that the regulation does not require unique identification, merely that the person can be identified. This holds true even if the recipient already possessed additional knowledge about the individual. The BGH’s ruling builds upon guidance provided by the European Court of Justice (ECJ) in September 2025. At the request of the BGH, the ECJ clarified that GDPR does not demand specific material damage or a threshold of significance for compensation claims. Concerns, distress, or justified fears of abuse following a data breach are enough to warrant damages. This paved the way for recognizing non-material disadvantages, which the BGH now applies practically in its decision. The BGH’s judgment significantly impacts the interpretation of non-material damage under Article 82 of GDPR. Earlier courts had dismissed the plaintiff’s claim, arguing that the complainant had described a data protection violation but not a concrete harm. The BGH corrected this stance, stating that the concept of damage under EU law must be interpreted broadly. According to the ruling, a mere violation does not automatically lead to a right to compensation. Independent proof of legal infringement, damage, and causality must be established. However, the damage in this case became evident when the third party read the message and contacted the complainant. This constituted abusive use of the data, making the loss of control over the information consequential rather than harmless. Furthermore, the court confirmed that justified concerns about future misuse can constitute non-material damage. Given that the recipient operated in the same industry, the complainant’s fear of data sharing or competitive disadvantage appeared reasonable. The third party’s inquiry transformed an abstract risk into a concretely verifiable effect. This reinforces the BGH’s approach: a claim requires that the damage is clearly linked to the data breach and that there is a direct causal relationship between the breach and the harm suffered.