According to the Advocate General of the CJEU, compensation for GDPR violations is only warranted if actual material or non-material damage has occurred.
IT law is still relatively new and case law is often not yet solidified. There is still disagreement on when compensation claims for data protection violations arise. A case before the CJEU could soon provide more clarity (Case No.: C?300/21). In his opinion delivered on October 6, 2022, the Advocate General of the CJEU clarified that a claim for damages under Article 82 of the GDPR requires material or non-material damage to occur. Therefore, a mere violation of data protection regulations is not sufficient for compensation claims, explains the business law firm MTR Rechtsanwälte, which specializes in IT law among others.
The case before the CJEU involves an Austrian plaintiff seeking compensation for non-material damage suffered. The background is that a data broker collected data and information on party affiliations without consent to use it specifically for election advertising by various parties. For the plaintiff, this behavior was a major annoyance, causing a loss of trust and a feeling of exposure. Even though his data has not yet been published, he asserted claims for compensation.
The Supreme Court of Austria referred the case to the CJEU and wanted to know, among other things, whether damage must have occurred for a claim for compensation under Article 82 of the GDPR or whether a violation of data protection regulations is sufficient.
In his opinion delivered on October 6, 2022, the Advocate General of the CJEU made it clear that damage must have occurred to the affected party for a compensation claim to arise. A mere violation of a regulation is not sufficient. Temporary annoyance on the part of the affected person is not enough to justify a claim for non-material compensation, according to the Advocate General. The claim for compensation serves to compensate for damage suffered and not to sanction a company’s behavior.
The decision of the CJEU is still pending. However, the judges often follow the assessments of the Advocate General.
For questions regarding data protection and the GDPR, MTR Rechtsanwälte provides its clients with a lawyer experienced in IT law.
