European Union: Court of Justice of European Union issued ruling in lawsuit relating to prohibitory injunctions under General Data Protection Regulation (IP v Quirin Privatbank AG) (Case C-655/23)

On 20 March 2025, the Advocate General of the Court of Justice of the European Union (CJEU) issued an opinion on the General Data Protection Regulation (GDPR), examining whether data subjects can demand that controllers refrain from repeating unlawful processing of personal data. The opinion applies to data controllers and processors, particularly those handling sensitive personal data. It concludes that while the GDPR does not explicitly grant this right, it is implied through Articles 5 and 6, allowing data subjects to seek judicial remedies under Article 79. Supervisory authorities can order compliance measures under Article 58(2), but this does not prevent individuals from pursuing court orders independently. The opinion clarifies that Articles 17 (erasure) and 18 (restriction of processing) do not inherently prevent future unlawful processing, and it explores whether national courts can establish such a right under Article 84 in conjunction with Article 79. Additionally, it considers whether the availability of a prohibitory injunction influences claims for non-material damages under Article 82.