European Union: German Federal Court of Justice announced lawsuit relating to prohibitory injunctions under General Data Protection Regulation (IP v Quirin Privatbank AG) (Case C-655/23)

On 7 November 2023, the Court of Justice of the European Union received a request from the German Federal Court of Justice for a preliminary ruling on the interpretation of the General Data Protection Regulation, affecting data controllers and processors. The questions concern whether a data subject can obtain a prohibitory injunction against a controller to prevent unlawful onward transfers under Articles 17 and 18 of GDPR and whether such a right depends on the risk of recurrence of GDPR infringements. If no such right exists, the request examines whether national courts can grant prohibitory injunctions under Articles 79 and 84 of GDPR. It also addresses the threshold for non-material damages under Article 82(1), and whether the degree of fault of the controller or processor should influence compensation, and whether the availability of a prohibitory injunction should reduce the amount of compensation.