A mere infringement of the General Data Protection Regulation (GDPR) does not in itself give rise to a right to compensation. There must also be damage! This is what the Court of Justice of the European Union (CJEU) ruled on 4 May 2023. This ruling concerned compensation for non-material damage on the basis of the General Data Protection Regulation (GDPR).
The facts of the ruling
The case concerns Österreichische Post, which collects information on the political affinity of the Austrian population. By means of an algorithm, Österreichische Post is able to define “target group addresses” indicating the degree to which a particular Austrian is likely to have an affinity with a particular political party.
The claimant in this case was one of the affected Austrian citizens who was determined to have a strong affinity with a particular Austrian political party. He had not consented to the processing of his personal data and therefore felt angry and “greatly upset, having lost trust and feeling exposed”. As a result of the unlawful processing of his personal data, he claimed compensation of €1,000 for the non-material damage suffered.
The case was referred to the Austrian Supreme Court, which had doubts about the scope of the right to compensation offered by the GDPR for material or non-material damage resulting from infringements of the GDPR. The Austrian Supreme Court referred the following three questions to the CJEU for a preliminary ruling:
- “Does the award of damages under Article 82 [GDPR] require, in addition to infringement of the provisions of the GDPR, that the claimant party has suffered damage, or is the infringement of provisions of the GDPR as such already sufficient for the award of damages?”
The CJEU holds that the right to compensation laid down in Article 82 of the GDPR must satisfy the following 3 conditions:
- There must be an infringement of the GDPR;
- This infringement must have caused material or non-material damage;
- A causal link must be established between the infringement and the damage.
As a result of these conditions, not every infringement of the GDPR in itself gives rise to a right to compensation. An infringement must satisfy conditions 1 and 2 in order to give rise to a right to compensation.
- “Is the view that the award of [compensation for] non-material damage presupposes that the effect or consequence of the infringement is of at least some weight and goes beyond the annoyance caused by the infringement compatible with EU law?”
The Court holds that the right to compensation is not limited to non-material damage that reaches a certain threshold of seriousness. According to the Court, no such requirement exists under the GDPR. The EU legislature also applies a broad interpretation of ‘damage’.
- “Are there, in addition to the principles of effectiveness and equivalence, other provisions of EU law relevant to calculating the compensation?”
The Court states that the GDPR contains no specific rules for assessing the extent of the damage. Member States must therefore establish their own criteria for determining the amount of non-material damages. However, Member States must ensure that these criteria aim to provide full and effective compensation for the damage suffered.
Conclusion of the ruling
It has become clear that not every infringement of the GDPR automatically gives rise to a right to compensation. Where a right to compensation does exist, each EU Member State will need to establish its own criteria for the amount of compensation. However, these criteria must at all times satisfy the principles of equivalence and effectiveness. Finally, it can be concluded that there is no requirement that the non-material damage suffered must exceed a certain threshold of seriousness in order to give rise to a right to compensation.
What does this mean for you?
In this case, the Austrian Supreme Court defended the position that a threshold should be introduced for non-material damage claims resulting from infringements of the GDPR. The CJEU did not go along with this and confirmed that it is possible to establish liability for compensation of non-material damage resulting from an infringement of the GDPR.
This ruling underscores the importance of GDPR compliance within all European organisations. After all, non-compliance can lead to financial sanctions from supervisory authorities and national courts in the form of damages.
Do you have questions after reading this blog about how best to minimise your organisation’s exposure to such liability? Then contact the corporate lawyers of The Legal Company via 020 345 0152 or email info@thelegalcompany.nl
