Referral C-273/25 (Erser, 8 Apr 2025)

1. Is Article 82(1) of the GDPR to be interpreted as meaning that a national court must, in the event of an infringement of the GDPR, award compensation to a data subject who has merely demonstrated that a third party (and not the defendant data controller) has published the data subject’s personal data on the internet? In other words: does the mere loss of control, even for a short time, over one’s own data constitute non-material damage within the meaning of Article 82(1) of the GDPR?

2. If Question 1 is answered in the affirmative: to what extent does the answer differ, or does it make any difference, if the data published consist only of certain personal data (including, at most, numerical user ID, name and gender) that the data subject himself or herself had already published on the internet, together with the data subject’s telephone number, which a third party (who is not the defendant data controller) has linked to those personal data?