Anyone suing for damages due to a data protection breach must take civil action. This also applies if the claim is directed against a public authority. This was decided by the Administrative Court (VG) Düsseldorf and the legal dispute was referred to the Local Court (Ref.: 29 K 2876/26 of 23 March 2026).

In the underlying case, the plaintiff asserted a non-material claim for damages against a public-law institution before the administrative court in accordance with Art. 82 para. 1 GDPR. However, he was unsuccessful because the administrative court did not have jurisdiction.

In this context, the court emphasised that nothing to the contrary follows from Art. 82 para. 6 GDPR or Art. 79 para. 2 GDPR. Art. 82(6) GDPR does not say anything about which national court has jurisdiction for claims for damages under data protection law, but only regulates the jurisdiction of the respective Member State. The same applies with regard to Art. 79 para. 2 GDPR. The national jurisdiction rules therefore remain in place, according to which claims for damages arising from breaches of public law obligations under the Administrative Court Code must generally be asserted before the ordinary courts if - as in this case - they are not based on a public law contract. The immaterial damage claim is not an official liability claim. Therefore, the regional courts do not have jurisdiction by special assignment. As long as the amount in dispute limit is not exceeded, the local court therefore retains jurisdiction.

At the same time, the court clarified that splitting the legal process is also unobjectionable under EU law. The consequence of this split is that claims for information under the GDPR must be dealt with before the administrative courts, while claims for damages must be asserted before the civil courts.