Advocate General Campos Sánchez-Bordona delivered his Opinion in IP v. Quirin Privatbank (C-655/23), a request for a preliminary reference from the Federal Court of Justice (Germany) concerning the interpretation of several provisions of the GDPR (Regulation 2016/679).

He concluded that, in accordance with 5(1)(a), 6(1), and 79(1) GDPR, ‘a data subject whose personal data have been unlawfully disclosed by the controller has the right to bring an action for an order that the controller desist, in future, from any further unlawful onward transfers of those data, similar to the transfers already carried out.’ The rules governing the conditions under which such orders can be brought are for national law to determine.

The Advocate General’s Opinion can be found here.