The Court of Justice of the European Union (CJEU) delivered a judgment on June 20, 2024, in merged cases C-182/22 and C-189/22 Scalable Capital, concerning the liability of the controller for damages to individuals. This ruling focused on the interpretation of Article 82(1) of the GDPR concerning compensation for non-material damage resulting from data breaches.
Background
The applicants, who had opened accounts with Scalable Capital, experienced theft of their personal data, including names and ID copies, by unknown third parties. They sought compensation from the Local Court of Munich, leading to questions referred to the CJEU about the nature of compensation under the GDPR.
CJEU Findings
- Compensatory Nature: The CJEU clarified that Article 82(1) serves an exclusively compensatory function, not a punitive one. Compensation aims to fully redress the damage suffered due to GDPR violations.
- Severity and Intent: The court held that the severity or intentional nature of the GDPR breach does not need to be considered when determining compensation. Non-material damage from data breaches should not be viewed as inherently less significant than physical harm.
- Minimal Compensation: The CJEU stated that when non-material damage is minor, national courts could award minimal compensation, provided it fully compensates the affected individuals.
- Identity Theft: The ruling emphasized that ‘identity theft’ involves actual misuse of personal data by a third party. However, compensation is not limited to cases where such misuse leads to fraud or further identity theft.
This judgment reinforces that individuals must receive full compensation for non-material damages due to data breaches under the GDPR, emphasizing the regulation’s protective measures for personal data rights.
👉 Read the decision here.
♻️ Share this if you found it useful.
💥 Follow me on Linkedin for updates and discussions on privacy education.
📍 Subscribe to my newsletter for weekly updates and insights – subscribers get an integrated view of the week and more information than on the blog.