June 19, 2023 /
A breach of the General Data Protection Regulation (GDPR) alone does not justify a claim for damages, the European Court of Justice (ECJ) has ruled. In order to assert a claim for damages, non-material damage and a causal link between the breach and the damage must be proven in addition to the breach of the GDPR. It should be noted that the claim for damages does not depend on whether the immaterial damage incurred reaches a certain threshold of materiality.
The case in Austria
In 2017, Austrian Post collected information on the political affinities of the Austrian population. It created “target group addresses” based on social and demographic characteristics. One plaintiff, who had not consented to the processing of his personal data, felt exposed and experienced a loss of trust as well as anger, as he was attributed a high affinity to a certain political party. The plaintiff demanded compensation of 1,000 euros for the non-material damage he had allegedly suffered.
Provisions of the ECJ
The ECJ clarified that a claim for damages requires material or non-material damage and a causal link between the damage and the infringement in addition to an infringement. This distinguishes the action for damages from other legal remedies provided for in the GDPR, for which the existence of individual damage does not have to be proven.
Claim for damages regardless of the materiality of the damage
Furthermore, the claim for damages is not limited to non-material damage that reaches a certain level of materiality. Such a materiality threshold could affect the coherence of the regulation introduced by the GDPR, as the assessment of the threshold could vary depending on the court.
Member States and the assessment of damages
The GDPR does not contain any specific rules regarding the assessment of damages. It is up to the individual Member States to determine the structure of legal proceedings and the criteria for determining the extent of compensation, taking into account the principles of equivalence and effectiveness. The ECJ emphasized the compensatory function of the claim for damages provided for in the GDPR and pointed out that this instrument should ensure full and effective compensation for the damage suffered.