[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9VRDfKIk1XvadXDGRpINzigt-ZTY0K34WxatT0jcQps":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"25b1f3f2-309e-43b9-9447-64d9ef3e43c8","BGH - VI ZR 97\u002F22","bgh-vi-zr-97-22-e176b6","Created page with \"{{COURTdecisionBOX |Jurisdiction=Germany |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=BGH |Court_Original_Name=Bundesgerichtshof |Court_English_Name=Federal Court of Justice |Court_With_Country=BGH (Germany) |Case_Number_Name=VI ZR 97\u002F22 |ECLI= |Original_Source_Name_1=REWIS |Original_Source_Link_1=https:\u002F\u002Frewis.io\u002Fservice\u002Fpdf\u002Furteile\u002Fbp0-23-06-2026-vi-zr-9722.pdf |Original_Source_Language_1=German |Original_Source_Language__Code_1=DE |Original_So...\" Show changes","Germany's Federal Court of Justice ruled that a job applicant is entitled to non-material damages after their personal data, including salary expectations, was mistakenly disclosed to a third party by a bank. The court confirmed the disclosure was unlawful under GDPR and that the applicant's concern over data misuse constituted sufficient damage, referring the case back to determine the exact compensation amount.","German court awards damages for GDPR violation in job application data leak.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=BGH_-_VI_ZR_97\u002F22&diff=52508&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-07-28T08:01:39+00:00","2026-07-28T10:00:17.703317+00:00",7,[17,20],{"name":18,"type":19},"BGH","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,38,40],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":21,"slug":37},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":39},{"id":23,"icon":25,"name":26,"slug":27},{"category":41},{"id":42,"icon":25,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":48,"vendors":49},[],[],{"slug":51,"title":52,"body":53,"framework_refs":54,"framework_notes":66},"german-court-awards-gdpr-damages-after-bank-discloses-applicants-data-to-wrong-party","German Court Awards GDPR Damages After Bank Discloses Applicant's Data to Wrong Party","A German bank mistakenly disclosed a job applicant's personal data — including sensitive salary expectations — to an unauthorized third party, violating GDPR's core principles of data minimization and accuracy. Germany's Federal Court of Justice (BGH) confirmed that even the applicant's subjective concern about potential misuse of their data constitutes sufficient 'non-material damage' to warrant compensation under GDPR Article 82. This ruling reinforces that organizations cannot treat accidental disclosures as harmless administrative errors — any unauthorized sharing of personal data carries real legal and financial consequences. The case highlights how internal data handling workflows, particularly during recruitment processes, must be tightly controlled to prevent misdirected communications.",[55,56,57,58,59,60,61,62,63,64,65],"GDPR Article 5(1)(f) — Integrity and confidentiality","GDPR Article 82 — Right to compensation and liability","GDPR Article 32 — Security of processing","GDPR Article 33 — Notification of a personal data breach to the supervisory authority","NIST SP 800-53 AC-3 — Access Enforcement","NIST SP 800-53 SI-12 — Information Management and Retention","NIST SP 800-53 IR-6 — Incident Reporting","CIS Control 3 — Data Protection","CIS Control 14 — Security Awareness and Skills Training","ISO\u002FIEC 27001 Annex A.8.2 — Information Classification","ISO\u002FIEC 27001 Annex A.18.1.4 — Privacy and protection of personally identifiable information",{}]