CJEU Ruling on Compensation for Data Breach [C-182/22 and C-189/22 Scalable Capital]

The Court of Justice of the European Union (CJEU) delivered a judgment on June 20, 2024, in merged cases C-182/22 and C-189/22 Scalable Capital, concerning the liability of the controller for damages to individuals. This ruling focused on the interpretation of Article 82(1) of the GDPR concerning compensation for non-material damage resulting from data breaches.

Background

The applicants, who had opened accounts with Scalable Capital, experienced theft of their personal data, including names and ID copies, by unknown third parties. They sought compensation from the Local Court of Munich, leading to questions referred to the CJEU about the nature of compensation under the GDPR.

CJEU Findings

1. Compensatory Nature: The CJEU clarified that Article 82(1) serves an exclusively compensatory function, not a punitive one. Compensation aims to fully redress the damage suffered due to GDPR violations.
2. Severity and Intent: The court held that the severity or intentional nature of the GDPR breach does not need to be considered when determining compensation. Non-material damage from data breaches should not be viewed as inherently less significant than physical harm.
3. Minimal Compensation: The CJEU stated that when non-material damage is minor, national courts could award minimal compensation, provided it fully compensates the affected individuals.
4. Identity Theft: The ruling emphasized that ‘identity theft’ involves actual misuse of personal data by a third party. However, compensation is not limited to cases where such misuse leads to fraud or further identity theft.

This judgment reinforces that individuals must receive full compensation for non-material damages due to data breaches under the GDPR, emphasizing the regulation’s protective measures for personal data rights.

👉 Read the decision here.