According to the opinion of the Advocate General of the CJEU, claims for damages for violations of the GDPR exist only if there is indeed a material or non-material damage.
IT law is still relatively young and case law is often not yet well established. There is still disagreement over when a claim for damages due to data protection violations exists. A case before the CJEU could soon provide more clarity (Case: C-300/21). In his conclusion from October 6, 2022, the Advocate General of the CJEU made it clear that a claim for damages under Article 82 GDPR requires the occurrence of material or non-material damage. A simple violation of data protection regulations is therefore not sufficient for claims for damages, explains the economic law firm MTR Rechtsanwälte, which specializes, among other things, in IT law.
Before the CJEU, the case involves an Austrian’s claim for damages for non-material damage suffered. The background is that an address broker collected data and information about party affiliations without consent to use it specifically for election advertising of various parties. For the plaintiff, this behavior was a major annoyance that caused a loss of trust and a feeling of exposure. Even though his data has not yet been published, he made claims for damages.
The Supreme Court of Austria referred the case to the CJEU and wanted to know, among other things, whether for a claim for damages under Article 82 GDPR, damage must have occurred or whether a violation of the data protection regulations is sufficient.
In his conclusion from October 6, 2022, the Advocate General of the CJEU made it clear that damage must have occurred to the affected party for a claim for damages to arise. The mere violation of a norm is not sufficient. Temporary annoyance of an affected party is not enough to justify a claim for non-material damages, the attorney stated. The claim for damages serves to compensate for suffered damage and not to sanction a company’s behavior.
The decision of the CJEU is still pending. However, the judges often follow the assessments of the Advocate General.
For questions about data protection and the GDPR, MTR Rechtsanwälte provides its clients with an attorney experienced in IT law.
