Referral C-185/25 (Waldfelber, 7 Mar 2025)

1. Is Article 4(7) of Regulation (EU) 2016/679 1 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (‘the GDPR’), to be interpreted as meaning that natural persons, who, in the exercise of their duties, process personal data by means of the tools made available and prescribed to them, not in their own personal interest but as the head of an organisation (an institution or other entity without legal personality), but which is backed by a legal entity, are ‘controllers’ who can be held liable in court?

2. (a) Is Article 15(1)(g) of the GDPR to be interpreted as meaning that, in a case in which the processed data consists of a factual statement about or an evaluative assessment of the data subject in an email, ‘all available information on the origin of the data’ refers only to the author of the email, or does it also include the group of persons with whom the author has discussed the data subject?

2. (b) In the event that names of the parties to the conversation that have not been stored constitute ‘available information on the origin of the data’ for purposes of Article 15(1)(g) of the GDPR:

when weighing up the interests of the data subject against the interests of such a party to the conversation, is the fact that it was not foreseeable for the party that their statements would be made the subject of data processing relevant?

3. Is Article 82(2) of the GDPR to be interpreted as meaning that negative consequences for the data subject resulting from an infringement of that Regulation, which occurred after the processing of the personal data and is solely an infringement of the obligation to provide information pursuant to Article 15(1) of the GDPR, constitute damage caused by ‘processing which infringes this Regulation’ and leads to the obligation of the controller to pay compensation?

4. If Question 1 or 3 is answered in the affirmative: does Article 82 of the GDPR preclude national provisions according to which a claim for the compensation for damage caused to an injured party by a body of a legal entity in the sovereign execution of the law cannot be asserted against the body itself?