CJEU rules on right to compensation over fear of non-material damages

On Thursday, 20 June 2024, the Court of Justice of the European Union (CJEU) issued a judgment in Case C-590/22 concerning the right to be awarded damages under Article 82(1) of the EU General Data Protection Regulation (GDPR).

The case relates to a letter containing tax returns sent to the wrong individual in Germany, which were then opened by mistake. The claimant brought the case to a Local Court in Wesel seeking compensation for the non-material damage disclosure of their personal data to third parties. The local court then referred the case to the CJEU.

In its judgement, the CJEU ruled that Article 82(1) of the EU General Data Protection Regulation (GDPR) "must be interpreted as meaning that an infringement of that regulation is not, in itself, sufficient to give rise to a right to compensation under that provision. The data subject must also establish the existence of damage caused by that infringement, without, however, that damage having to reach a certain degree of seriousness."

The CJEU also stated that "a person’s fear" that their personal data has, as a result of a GDPR infringement, been disclosed to third parties "is sufficient to give rise to a right to compensation for non-material damage."

The CJEU then clarified that it is not necessary to establish that the disclosure took place where negative consequences of the fear are proven.