BGH: GDPR not exhaustive on injunctive relief; online store data transfer case remanded

Federal Court of Justice VI ZR 144/23 July 21, 2026 rewis logo REWIS: LEGAL TECHNOLOGY Case Law Database Information provided without guarantee © REWIS UG (limited liability) URL: https://rewis.io/s/u/A6Si/ Federal Court of Justice 6th Civil Division 2 VI ZR 144/23 dated July 21, 2026 | rewis.io VI ZR 144/23 dated July 21, 2026 Judgement | Federal Court of Justice | 6th Civil Division Headnote A claim for injunctive relief under national law directed against the repeated transfer of personal data in violation of the General Data Protection Regulation cannot, as a matter of principle, be rejected on the grounds that the provisions of Union law are exhaustive. Disposition Upon the plaintiff’s appeal, the judgement of the 16th Civil Division of the Higher Regional Court of Frankfurt am Main dated March 30, 2023, is set aside. The case is remanded to the appellate court for a new hearing and decision, including on the costs of the appeal proceedings.

1 The plaintiff seeks an injunction against the defendant to prevent the transfer of personal data. 2 The defendant operates an online store with the websites www.z[...].com and www.de.z[...].com. These websites incorporate third-party functions such a way that the program data is not stored on the server on which the defendant’s websites are hosted, but rather the User (or the User’s browser) is redirected to websites operated by third parties, the service providers. In the process, the third-party server is provided with the current IP address of the current User of the website to enable data retrieval from there (a so-called cloud solution). 3 The plaintiff considers this practice to be impermissible and points, among other things, to the defendant’s ability to store user data on its own servers. He alleges that in 2020 he ordered goods from the defendant’s online store, providing his name and address.

In doing so, in addition to 3 VI ZR 144/23 dated July 21, 2026 | rewis.io his IP address, numerous usage data from the ordering process were also unlawfully transmitted to third parties. 4 In the first instance, the plaintiff filed a lawsuit seeking to order the defendant to refrain from “delivering” its websites z[...].com or de.z[...].com or, in each case, subdomains or subpages thereof to any of the services—specified in detail by the plaintiff —in such a way that, when the page is accessed, “personal data or data relating to the plaintiff—such as his IP address—” are transmitted to the respective operator of these services or to persons commissioned by them for this purpose, unless the plaintiff has previously consented to this within the meaning of Art. 4 No. 11 of the GDPR. 5 The Regional Court dismissed the lawsuit on the grounds that it was inadmissible due to a lack of specificity .

applies Art. 4

Furthermore, it was also unfounded. The plaintiff filed an appeal against the Regional Court’s judgement and, in appeal proceedings, he amended his claim such that the primary claim replaces the previous wording “[...] that when the page is accessed, the plaintiff’s personal or personally identifiable data—such as his IP address— [...]” is replaced by the wording “[...] that when the page is accessed, any data pertaining to the plaintiff [...]”.In addition, he filed several alternative claims. The Higher Regional Court dismissed the plaintiff’s lawsuit. With his lawsuit to the Federal Court of Justice, which was granted by the Senate, the plaintiff continues to pursue his request for an injunction . Reasons for the Decision I. 6 The appellate court stated in support of its decision that the lawsuit was inadmissible as filed in the first instance due to a lack of sufficient specificity, because the term “personal data or personally identifiable data of the plaintiff” were legal concepts whose application required a legal classification that should not be left to the enforcement proceedings.

However, with the motion filed in the appellate instance , the lawsuit is admissible. To the extent that the plaintiff, in his amended (primary) claim, seeks an injunction preventing “any of the plaintiff’s data from being transmitted to the operators of the services when the page is accessed,” this is sufficiently specific. This is because the defendant would thereby be prohibited from transmitting all data received when its website is accessed to the specified services. The term “data,” with its meaning of “information about a person or a thing,” which is attributed to it both in Art. 4(1) of the GDPR and in everyday language, has a sufficiently clear core meaning, such that its application can be left to the enforcement proceedings. 7 4 VI ZR 144/23 dated July 21, 2026 | rewis.io However, the lawsuit is unfounded. The General Data Protection Regulation does not establish an individual right to enjoin the transfer of data to third parties if the plaintiff—as in this case—does not simultaneously demand the erasure of the data.

applies Art. 4(1)

It is not possible to rely on legal grounds outside the General Data Protection Regulation, in particular German national law. The provisions of the General Data Protection Regulation constitute an exhaustive, fully harmonized European framework regarding the consequences of violations of rules governing the processing of personal data. Due to this priority of application of the Union-wide exhaustively harmonized data protection law, national law may be invoked only if a corresponding enabling clause arises from the General Data Protection Regulation. This is not the case with respect to the claim for injunctive relief asserted by the plaintiff. II. 8 These arguments do not withstand review on appeal in their entirety. 9 1. The appellate court correctly affirmed the admissibility of the lawsuit. In particular, the claim—which must also be examined ex officio in the appeal proceedings (see, e.g., the Senate’s judgment of March 9, 2021—VI ZR 73/20, NJW 2021, 1756 para. 15 with further references)—is sufficiently specific. 10 a) Pursuant to § 253(2)(2) of the Code of Civil Procedure (ZPO), a claim for injunctive relief may not be formulated so vaguely that the subject matter of the dispute and the scope of the court’s authority to review and decision-making authority of the Court (Section 308(1) of the German Code of Civil Procedure (ZPO)) are not clearly delineated, so that the defendant cannot mount an exhaustive defense and the decision regarding what the defendant is prohibited from doing is ultimately left to the enforcement court.

Sufficient specificity is generally met when there is a reference to the specific infringing act or the specific form of infringement at issue is the subject matter of the complaint, and the relief sought, at least by reference to the statement of claims, unambiguously indicates in which aspects of the contested conduct the basis and the connecting factor for the alleged alleged infringement and thus the injunction (see Senate judgment of October 14, 2025—VI ZR 431/24, VersR 2026, 235, para. 23, with further references). The use of terms requiring interpretation is permissible only if, on the one hand, further specification is not possible or reasonable for the plaintiff, and, on the other hand, there is no doubt among the parties as to their content, so that the scope of the claim and the judgement is established (see Senate judgment of March 31, 2026—VI ZR 157/24, NJW 2026, 1578, para. 20, with further references). 11 b) In any event, the most recent (primary) lawsuit filed by the plaintiff meets these requirements.

According to this lawsuit, the defendant is to be prohibited from 5 VI ZR 144/23 dated July 21, 2026 | rewis.io from designing the web pages of its online store in such a way that, when accessed by the plaintiff, data is transmitted from his computer to the services specified in the lawsuit without the plaintiff’s consent. In the plaintiff’s view, all data originating from him—simply by virtue of its transfer together with his IP address—constitutes personal data. This unambiguously clarifies which conduct of the defendant is to be prohibited. 12 2. However, based on the reasoning of the appellate court, the asserted claim for injunctive relief cannot be denied on the merits. The Appellate Court erred in assuming that a claim for injunctive relief regarding the unlawful transfer of personal data is excluded from the outset under national law because the provisions of the General Data Protection Regulation constitute an exhaustive regulation in this regard. 13 The Court of Justice of the European Union (hereinafter “the Court”) stated in its judgement of September 4, 2025—which was issued after the appellate court’s decision— September 2025 in Case C-655/23, the Court of Justice of the European Union (hereinafter: the Court) held that the provisions of the General Data Protection Regulation are to be interpreted as providing, in favor of the data subject affected by the unlawful processing of personal data, in the event that such a person—like the plaintiff in the present case—does not request the erasure of their data, do not provide for a judicial remedy that would enable them to obtain, as a preventive measure, an order requiring the controller to refrain from refrain from any further unlawful processing in the future.

However, they do not prevent Member States from providing for such a legal remedy in their respective legal systems (see CJEU, NJW 2025, 3137, para. 52). The possibility for the data subject to bring a lawsuit against the controller seeking a future injunction against a violation of the substantive provisions of the General Data Protection Regulation does not undermine its objectives, but rather may strengthen the practical effectiveness of these provisions and thereby enhance the high level of protection sought by this Regulation for data subjects with respect to the processing of their personal data (ibid., para. 50). Accordingly, in the present case, an order requiring the defendant to cease and desist under national law, as sought in the complaint, cannot be denied on the grounds that the provisions of Union law are exhaustive. 14 3. Nor is the appellate judgment accurate for any other reasons.

Based on the findings made, it cannot be ruled out that the plaintiff is entitled to a claim for injunctive relief under national law. 15 According to the supreme court case law issued prior to the entry into force of the General Data Protection Regulation, in the case of a violation of the general right of personality caused by unlawful data processing, 6 VI ZR 144/23 of July 21, 2026 | rewis.io in its manifestation as the right to informational self-determination, the injured party is generally entitled to claims under the analogous application of § 1004(1), § 823 (1) of the German Civil Code (BGB) in conjunction with Art. 1(1) and Art. 2(1) of the German Basic Law (GG) (on the claim for injunctive relief pursuant to § 1004(1), first sentence, BGB by analogy, see the Senate’s judgment of March 16, 2010—VI ZR 176/09, VersR 2010, 677, para. 11 et seq.; regarding the claim for remedy of consequences pursuant to § 1004(1), sentence 2 BGB, see Senate judgment of May 22, 1984—VI ZR 105/82, BGHZ 91, 233, 239 et seq., juris para. 21 et seq.; Federal Court of Justice (BGH), judgement of July 7, 1983—III ZR 159/82, NJW 1984, 436).

applies Art. 1(1), Art. 2(1)

In the event of a violation of a data protection provision that qualifies as a protective statute, claims may also arise by analogy under Section 1004(1), second para, and Section 823(2) of the German Civil Code (BGB) (see, regarding the claim for injunctive relief in the case of an unlawful data transfer under §§ 4, 29 BDSG (old version) , Senate judgments of July 24, 2018—VI ZR 330/17, ZIP 2019, 1172, para. 53; of February 27, 2018—VI ZR 489/16, BGHZ 217, 350, para. 42; February 20, 2018—VI ZR 30/17, BGHZ 217, 340, para. 21 et seq.). These bases for claims must also be considered in the event of unlawful data protection under the General Data Protection Regulation General Data Protection Regulation (see Senate judgments of June 23, 2026 – VI ZR 97/22, juris para. 26; of May 12, 2026 – VI ZR 375/24, juris para. 29 et seq.). 16 Whether, as the defendant contends, an injunction under national law may be precluded by the fact that there is no need for such an order—does not require a decision in the context of the review to be conducted here pursuant to § 561 ZPO.

Based on the findings made, it cannot be assumed that the plaintiff has asserted his claim for legal protection (prevention of the unlawful transfer of his personal data to third parties) by asserting one of the rights provided for by the General Data Protection Regulation—in particular, Article 17 of the GDPR (right to erasure). III. 17 The contested judgement was therefore to be set aside (Section 562(1) of the German Code of Civil Procedure (ZPO)) and the case remanded to the appellate court for a new hearing and decision (Section 563(1), first sentence, ZPO). Seiters Oehler Allgayer Böhm Linder

applies Art. 17