On 20 June 2024 the Court of Justice of the European Union (CJEU) issued a ruling in Case C-590/22, concerning the right to compensation for non-material damages under GDPR Article 82(1). This followed a request from the Local Court of Wesel, Germany, about damages claims for non-material damage stemming from the disclosure of personal data.
Background
The case arose when tax returns were mistakenly sent to an incorrect address, resulting in unauthorized access to sensitive data. Claimants sought compensation, asserting they suffered non-material damage due to this disclosure. The Local Court referred several questions to the CJEU, focusing on whether GDPR infringement alone warrants compensation.
CJEU Findings
The court clarified that infringement alone does not justify compensation; actual damage must be shown, though no specific severity threshold is required. It also established that fear of data disclosure could merit compensation if the negative impact is substantiated. The CJEU emphasized that while fear must be proven, the existence of non-material damage does not need to be extensive.
Criteria for Damages
The Court ruled out the application of the administrative fine criteria from Article 83 when determining compensation amounts, since these are different types of liability. Additionally, it stated that compensation is purely compensatory, not punitive (same as in the other decision from 20 June in Cases C-182/22 and 189/22 Scalable Capital), and thus, should not serve a dissuasive function. The court further indicated that simultaneous breaches of national laws unrelated to GDPR specifications should not affect compensation assessments under Article 82(1) GDPR.
👉 Read the decision here.
♻️ Share this if you found it useful.
💥 Follow me on Linkedin for updates and discussions on privacy education.
📍 Subscribe to my newsletter for weekly updates and insights – subscribers get an integrated view of the week and more information than on the blog.
