Non-material damage under the GDPR? CJEU provides guidance

Privacy Law

20 June 2024

Non-material damage under the GDPR? CJEU provides guidance

Stelt u zich eens voor: u werkt al jaren met dezelfde zelfstandige. Hij stuurt facturen, factureert btw en heeft een eigen kvk-nummer. Toch krijgt u in 2026 ineens vragen van de Belastingdienst over de aard van uw samenwerking. Hoe heeft het zo ver kunnen komen?

On 11 April 2024, the Court of Justice of the European Union (CJEU) clarified how non-material damage under the General Data Protection Regulation (GDPR) must be assessed.

What happened here?

This ruling concerned a lawyer who discovered that a legal database was using his personal data for direct marketing. This was despite the fact that he had withdrawn his consent and had objected. Nevertheless, he kept receiving marketing letters. After objecting several times, the lawyer engaged a bailiff to reinforce his objection.

The lawyer ultimately brought proceedings in Germany for the material and non-material damages he had suffered. He argued that the loss of control over his personal data was, in itself, sufficient grounds for compensation. The court confirmed that compensation under Article 82 GDPR requires: 1) an infringement, 2) damage, and 3) a causal link between the infringement and the damage.

A fine is not the same as compensation under the GDPR

The CJEU has clarified that a mere breach of the GDPR does not automatically entitle a person to compensation. It is the data controllers who are liable for breaches committed by their staff, and they cannot be exempted if instructions were not properly followed. The CJEU has also confirmed that the criteria for fines (Article 83 GDPR) do not apply to compensation (Article 82 GDPR).

So how should national courts assess compensation under the GDPR?

They must do so by following guidelines that are consistent with the GDPR. This means assessing fair and appropriate compensation, so that the damage actually suffered is compensated. So not by imposing a deterrent or punitive (high) amount of damages, as sometimes happens with fines. Naturally, national courts must always take this into account.

With this ruling, the CJEU emphasizes that, when assessing compensation, national courts should only take into account the damage actually suffered by the data subject.

Do you have further questions about claiming compensation under the GDPR? Or would you like to know more about other principles of the GDPR? The business lawyers of The Legal Company can help you with this. Contact us via info@thelegalcompany.nl or call 020 345 0152.

Nothing changes as constantly as laws and regulations. Please note that our blogs may no longer align with current laws and regulations and may therefore be outdated. If you have questions or an issue relating to this blog, or would like legal assistance, please contact us.

De afgelopen jaren stonden in het teken van de Wet VBAR, het wetsvoorstel dat een einde moest maken aan onduidelijkheid over de zzp’er. Het kabinet heeft delen van dat voorstel inmiddels geschrapt. Op het eerste gezicht is dat goed nieuws: minder regels, minder administratieve last. Maar in de praktijk blijven dezelfde toetsen overeind.

“De inhoud van de samenwerking is leidend, niet wat er op papier staat.”

De Belastingdienst handhaaft sinds 1 januari 2025 weer actief op schijnzelfstandigheid. En recente uitspraken van de Hoge Raad bevestigen dat rechters strikt toetsen of er sprake is van ondergeschiktheid en gezagsverhouding.

Voor uw praktijk betekent dit drie dingen. Een: leg de samenwerking duidelijk vast, met aandacht voor de inhoud. Twee: voorkom dat een zzp’er feitelijk werkt als werknemer. Drie: wees voorbereid op een controle, en weet hoe u de relatie kunt herzien als dat moet.

Heeft u vragen over uw concrete situatie? Wij sparren dagelijks met opdrachtgevers over hun zzp-relaties. Vraag een offerte op of bekijk onze Legal Safe abonnementen.