In a landmark EU General Data Protection Regulation (GDPR) decision, the Court of Justice of the European Union (CJEU) has ruled in case C‑300/21 that the right to compensation should not be limited to non-material damages that reach a certain "threshold of seriousness".
The background of the case involved the Austrian postal service illegally collecting personal data to calculate the political persuasions of millions of Austrian citizens. The plaintiff objected and commenced proceedings seeking compensation of €1,000 as non-material damage under Article 82, arguing that this processing had upset, angered and offended him by this wrongful political attribution. In October 2022, Advocate General Sánchez-Bordona issued an Opinion saying that an infringement of the law itself is insufficient to give rise to a claim for compensation under Article 82 of the GDPR.
Today's decision means EU citizens have a right to compensation under the GDPR subject to three conditions being met:
- An infringement of the GDPR has transpired,
- The infringement resulted in material or non-material damage,
- A causal link between the damage and the infringement can be made.
In a statement, NOYB honorary chair Max Schrems said, "We welcome the clarifications by the CJEU. A whole industry tried to reinterpret the GDPR, in order to avoid having to pay damages to users whose rights they violated. This seems to be rejected. We are very happy about the result."
In a related article in The Register discussing the impending decision from earlier this week, Peter Church at Linklaters LLP noted: "This is a major decision that could affect businesses right across the EU. If the CJEU suggests individuals have a right to compensation simply for breach of the GDPR or for mere upset, that will unleash a torrent of claims, including class actions with liabilities running into the billions."
What is this page?
You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.
The Privacy Newsfeed monitors over 300 global publications, of which more than 5,750 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.
