CJEU strengthens data subject rights in two damage claims
06 August 2024
On 20 June, the CJEU strengthened data subjects rights in two cases looking at the interpretation of Article 82 GDPR (the right of compensation for damages resulting from data processing that infringes the GDPR) and clarified the concept of non-material damages and how to assess compensation.
In the first judgment (joined cases C‑182/22 and C‑189/22), the CJEU addressed several questions referred by a German court regarding compensation for non-material damage caused by a theft of personal data stored on a trading application and determined that the right to compensation has an exclusively compensatory function and that severity and possible intentional nature of the infringement do not need to be considered for compensation purposes. It was indicated that claims for non-material damages do not need to exceed a "de minimis threshold". Where the claimant establishes causation, a national court may award nominal damages if the compensatory function noted above is satisfied. Further, the CJEU stated that a data subject can only claim compensation for non-material damage caused by "identity theft" where the perpetrator has later actually misused the personal data; and emphasised that compensation for non-material damages is not limited to identity theft.
In the second judgment (case C‑590/22), the CJEU responded to a question referred by a German court concerning the compensation for non-material damages where a tax consultant had erroneously disclosed tax returns to an unauthorised third party. The CJEU ruled that a GDPR infringement alone is not sufficient to award compensation; data subject musts establish causation between the infringement and the damage; data subjects could claim non-material damages where they successfully proves that its fear of negative consequences resulting from the unauthorised disclosure; and emphasised that damages under Article 82 GDPR can always and only compensate the damages suffered by the data subject; compensation of non-material damages should not have a dissuasive or punitive effect (such as relevant for administrative fines under Article 83 GDPR).
Authors: Alexander Duisberg (Partner); David Plischka (Associate); Lisa Kopp (Associate)
The information provided is not intended to be a comprehensive review of all developments in the law and practice, or to cover all aspects of those referred to.
Readers should take legal advice before applying it to specific issues or transactions.
Sign-up to select your areas of interest
Sign-up