On 4 May 2023, the European Court of Justice (CJEU) delivered its highly anticipated judgement in Österreichische Post (Case C-300/21) on a crucial issue: the extent to which data subjects affected by a breach of the GDPR have a right to compensation for non-material damage under Article 82 GDPR.
Background
The underlying case arose from a data subject in Austria seeking 1,000 EUR ($1,009) in compensation for alleged non-material damages arising from Österreichische Post’s processing of his personal data for the purposes of political advertising. The individual had not consented to the processing and claimed that he felt offended by the fact that an affinity to a certain political party was attributed to him, alongside feelings of great upset, loss of confidence and exposure caused by the retention of his data on these supposed political opinions.
The Austrian Supreme Court had referred various questions to the CJEU regarding the substantiality threshold for compensation for non-material damage, including whether the applicant must have suffered harm, or if an infringement of the GDPR in itself is sufficient for an award of compensation.
The Key Findings of the CJEU
The CJEU found that to have a right to compensation under the Article 82 GDPR, three cumulative conditions must be met:
- The existence of an infringement of the GDPR
- A damage (material or non-material) resulting from that infringement
- A causal link between the damage and the infringement
Accordingly, not every ‘mere’ infringement of the GDPR will be sufficient, by itself, to give rise to a right to compensation.
Regarding the second condition, the CJEU found that the right to compensation is not limited to non-material damage that reaches a certain threshold of seriousness. There is no such threshold in the GDPR, and such a limitation would not be consistent with the broad conception of damage in the GDPR and could lead to fluctuating decisions as national courts interpreted the appropriate threshold in different ways.
Finally, the CJEU stated that, as the GDPR does not contain any rules governing the assessment of damages, it is for the legal system of each EU member state to set out the criteria for determining the extent of compensation payable, provided that the principles of equivalence and effectiveness are complied with. This will therefore be a question for national courts, applying their domestic rules, although the CJEU did note that the right to financial compensation under Article 82 must be “full and effective” and compensate for any damage actually suffered as a result of the infringement in its entirety.
Practical Implications
The decision is welcome confirmation that a claimant must be able to prove that an alleged GDPR violation has caused them actual non-material damage. It will not be sufficient for individuals to merely assert a breach of their rights and the requirements to prove damage and causation will be relatively high barriers to more frivolous claims.
Unfortunately, the decision does not provide any guidance on what is meant by non-material damage. For businesses defending claims, the absence of any requirement for seriousness is less welcome. We can expect significant variation across the EU (the UK has its own separate lines of authority following Brexit) in determining how to measure the amount of compensation payable, potentially leading to forum shopping by prospective claimants seeking the highest levels of damages. Further cases are pending in the CJEU on the scope of material and non-material damage; businesses should track these developments closely when formulating responses to claims from data subjects.
Businesses should also monitor the progress of the implementation of the new EU Collective Redress Directive, which has the potential to provide the legal framework for data class actions to be brought in significant numbers, which will add to the scale of complexities of defending claims for non-material damage.
