Compensation for Non-Material Damage caused by Data Protection Violations

For a long time, the focus with regard to data protection violations was primarily on the risk of fines, which significantly increased under the GDPR. In the meantime, the risk that data subjects will assert claims for compensation in the event of data protection violations has also come to the fore for companies. The background to this situation is that Art. 82 GDPR not only provides for the compensation of material damage that rarely assumes threatening proportions, but also a claim for compensation for non-pecuniary damage (so-called non-material damage).

The case law of the German courts on the conditions and amount of this claim for compensation is by no means uniform. In part, the courts assume that the claim for compensation under the GDPR has the character of a sanction and serves as a deterrent. Therefore, it does not matter whether the data subject has been adversely affected. Moreover, the data breach itself triggers the claim for compensation. With compensation in the four-digit range per case, a data protection violation can therefore have serious economic consequences for a company, depending on the number of data subjects concerned.

Since the GDPR is EU law, the European Court of Justice (ECJ) has jurisdiction over its interpretation. Due to the uncertainties surrounding the interpretation of the claim for compensation, numerous national courts have referred questions to the ECJ. In one of these cases pending before the ECJ, a reference for a preliminary ruling from the (Austrian) Supreme Court of Justice, Case C-300/21, was published by the Advocate General in his Opinion on October 6, 2022.

The initial case

The defendant in the main proceedings is Österreichische Post AG, which, as a publisher of addresses, collected information on the party affiliations of the Austrian population and, using an algorithm, defined target group addresses on the basis of certain social-demographic characteristics. The plaintiff is a natural person whose party affiliation has been determined by Österreichische Post AG in this way without his consent. This data was not passed on to third parties. The plaintiff asserted a claim for compensation for non-material damage in the amount of EUR 1,000 and justified his claim with personal hardship. The conduct of the Österreichische Post had caused him great annoyance, a loss of confidence, and a feeling of exposure.

After the first two instances had rejected the claim, the Supreme Court (Austria) submitted three questions on the interpretation of Art. 82 GDPR to the ECJ on May 12, 2022 for preliminary ruling, namely (1) whether the claim for compensation under Art. 82 GDPR presupposes that the data subject has suffered damage, or whether it is sufficient that provisions of the GDPR have been infringed, (2) whether there are other requirements of EU law for the assessment of compensation in addition to the principles of effectiveness and equivalence, and (3) whether the award of compensation presupposes that there is a consequence of some severity to the infringement that goes beyond mere anger over the infringement.

In his Opinion, the Advocate General proposes that the claim for compensation for non-material damage be interpreted narrowly.

No compensation without damage

In the opinion of the Advocate General, the GDPR does not provide for punitive compensation. If Art. 82 GDPR had a sanctioning or deterrent function, it would be irrelevant whether the data subject suffered damage or even an impairment. A mere data breach would be sufficient for a verdict awarding compensation to be issued. In the Advocate General’s view, however, the claim for compensation under civil law does not have such character of a sanction under any conceivable interpretation. The claim for compensation was intended to satisfy and compensate, and presupposed that the data subject had suffered damage. Its purpose was not to punish and deter. This public function was served by the fines and criminal sanctions that can be imposed by supervisory authorities and courts.

Accordingly, Art. 82 GDPR does not suggest that damage has automatically occurred if a data protection standard is violated. The mere loss of control over one’s own data as a result of the data protection violation does not automatically lead to the presumption of damage and thus to a claim for compensation. Rather, it is also necessary for the assertion of non-material damage that the data subject demonstrate and prove this.

No symbolic compensation

Art. 82 GDPR does not specify how the compensation is to be calculated. According to recital 146 of the GDPR, data subjects should receive full and effective compensation for the damage suffered. In the opinion of the Advocate General, this may include elements other than financial ones if the relevant national legal system provides for such remedies. This can be, for example, confiscation of the unearned profits, or the payment of symbolic compensation. However, it is always a prerequisite that the national legal system provide such claims as legal remedies in addition to the legal remedies under the GDPR. To the extent that financial damage is concerned, Art. 82 GDPR applies. However, this does not provide for symbolic compensation in the event that damage is difficult to prove.

Pure anger does not constitute damage

In the opinion of the Advocate General, mere anger about a data protection violation does not entail eligibility for compensation. Any breach of a data protection regulation would lead to a negative reaction from the data subject. If, however, compensation were awarded for a mere sense of displeasure, this would come very close to compensation without damage, which the GDPR does not provide for. The Advocate General admits that it is difficult to distinguish between non-compensable anger and genuine compensable non-material damage. However, this difficult delineation is the responsibility of the national courts.

Conclusion

We await with great anticipation whether the ECJ will follow the Advocate General’s Opinion. In any case, the decision will pave the way for future damage compensation claims in the event of data protection violations and thus also significantly influence the assessment of the economic risk of such incidents. However, final legal certainty should not be expected even if the ECJ does follow the Advocate General’s Opinion. This because, the decisive question in the individual case of the extent of the data subject’s discomfort, i.e., when the data subject’s anger crosses the line into compensable impairment, would still have to be answered by the national courts. Therefore, it remains crucial to avoid data protection violations and the associated risks of compensation under civil law (see our Data Protection Update No. 123 of November 24, 2022).