Salary expectations to the wrong recipient: annoyance alone is damage

One message, one wrong recipient

An applicant was negotiating a position with a private bank. The process ran through the career network Xing. On 23 October 2018, an employee of the bank wrote to him via the platform's messenger: his trader profile was interesting, but the bank could not meet his salary expectations. What was possible was 80,000 euros plus variable remuneration. The message was politely worded. The only problem was that it also went to a person who had nothing to do with the process.

This third party had previously worked with the applicant in the same holding company. He forwarded the message and asked whether it was intended for the applicant and whether he was looking for a job. The bank later did not consider the applicant any further. He then demanded that the bank refrain from such mishaps in future, along with damages of at least 2,500 euros.

From Darmstadt via Luxembourg to Karlsruhe

The case occupied the courts from 2020 to 2026. The Regional Court of Darmstadt ordered the bank to cease and desist and to pay 1,000 euros in damages. The Higher Regional Court of Frankfurt upheld the injunction but struck out the damages: the applicant had not demonstrated any specific harm. The Federal Court of Justice referred the open questions to the European Court of Justice.

The ECJ replied in its judgment of 4 September 2025 (C-655/23, Quirin Privatbank). On that basis, the Federal Court of Justice closed the case with its judgment of 23 June 2026 (VI ZR 97/22). The outcome: damages yes, injunction no. The amount of damages must now be determined afresh by the Higher Regional Court.

Damages under the GDPR: annoyance counts

The basis is Article 82 of the General Data Protection Regulation (GDPR). Under it, anyone who suffers damage as a result of an infringement of the Regulation can claim compensation from the controller. This also applies to non-material damage, that is, disadvantages that cannot be expressed in money. Three things must come together: an infringement, damage and a connection between the two.

The ECJ has construed the concept of damage broadly. Negative feelings such as worry or annoyance are enough. The trigger may be the loss of control over one's own data, a possible misuse or damage to reputation. There is no de minimis threshold. The data subject must, however, show that these feelings arise precisely because of the infringement. An infringement without any noticeable consequence is no more sufficient than a purely hypothetical risk.

Oversight or intent: irrelevant to the amount

Two further answers from the ECJ concern the amount of compensation. First, it makes no difference whether the controller acted intentionally or negligently. Damages under the GDPR are meant to compensate, not to punish. Punishment is a matter for the fines imposed by the supervisory authorities. Whether oversight or intent, the amount stays the same.

Second, a court may not reduce the sum of money because the data subject has additionally obtained an injunction. The injunction operates for the future, the damages make good the past. Neither can replace or reduce the other.

The Federal Court of Justice: damage yes, injunction no

The Federal Court of Justice applied these requirements. At the latest when the third party read the message and asked the applicant about it, damage had occurred. For the court, this enquiry already amounted to a misuse of the data. The loss of control therefore did not remain without consequence. In addition, the applicant's fear that a competitor from the same industry would pass on the information or gain an advantage from it was well founded. The applicant had also argued that he experienced losing the salary negotiation as a humiliation.

The claim for an injunction, by contrast, was dismissed. The GDPR itself does not provide for such a preventive claim, but German law recognises it. After an infringement, it is presumed that it will be repeated. This presumption can only be rebutted under strict requirements, for instance where a one-off special situation triggered the infringement. That was the position here: the applicant only wanted to prevent the specific error from being repeated in the ongoing application process. That process had long been concluded.

What HR departments can learn from this

Salary expectations, rejections and offers are among the most sensitive data a company sends out. Such messages go out constantly via email, applicant portals and messengers. One wrong recipient is enough to turn a routine message into a data protection infringement carrying liability for damages. The fact that it was an oversight does not help. And the data subject does not have to prove sleepless nights. Worry and annoyance are enough, provided they are well founded.

The most effective protection is a glance at the recipient field before sending. A fixed sending channel in which the recipient is tied to the application, such as the applicant management system, makes sense. For offers and rejections containing figures, a second pair of eyes helps. And what is not in the message cannot end up with the wrong person either: an applicant's salary expectation does not have to be repeated in a reply.

If the mishap happens anyway, timing matters. The Federal Court of Justice saw the damage arising at the latest when the wrong recipient read the message and responded. Anyone who notices the error should ask the wrong recipient to delete it and inform the applicant openly. In the bank's case, the applicant claimed not only damages but also reimbursement of his pre-litigation legal costs. The Higher Regional Court must now decide on both.