CJEU Decides That A Mere Infringement of the GDPR Is Not Sufficient for Non-Material Compensation

Background

The background to the case was the legal dispute of an affected party in Austria against the Austrian postal service (“Österreichische Post AG”). Accordingly, the Österreichische Post AG collected information on the political affinities of the Austrian population. It defined target group addresses using an algorithm that considers various social and demographic criteria. The data thus generated were sold to various organizations, to enable them to send targeted advertising.

The applicant, who was affiliated with a certain Austrian political party, brought proceedings in the Austrian courts and requested EUR 1.000,00 as compensation for their non-material damage. Although the information of the applicant was not communicated to third parties the applicant claimed that they did not consent to the processing of their personal data and that they felt offended by the fact that an affinity with the party in question had been attributed to them, the fact that data relating to his supposed political opinions were retained within that company caused them great upset, a loss of confidence, and a feeling of exposure.

The Austrian courts rejected the claim for compensation since the damage did not reach a certain “threshold of seriousness” and the mere anger of the claimant about unlawful processing is below this threshold.

The supreme court in Austria, which was hearing the appeal, referred the matter to the CJEU for a ruling on the following questions:

• Must Article 82 (1) of the GDPR be interpreted as meaning that the mere infringement of the provisions of the GDPR is sufficient to confer a right to compensation?
• For compensation to be awarded, must Article 82 (1) of the GDPR be interpreted as precluding a national rule or practice which makes compensation for non-material damage, within the meaning of that provision, subject to the condition that the damage suffered by the data subject has reached a certain degree of seriousness?
• Must national courts apply the domestic rules of each Member State relating to the extent of financial compensation?

The Decision of the CJEU

Question 1: Must Article 82 (1) of the GDPR be interpreted as meaning that the mere infringement of the provisions of the GDPR is sufficient to confer a right to compensation?

Article 82 (1) of the GDPR reads as follows:

“Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.”

In its decision, the CJEU underlines that since the GDPR makes no reference to the law of the Member States as regards the concepts of “material or non-material damage” and of “compensation for the damage suffered” those terms must be regarded, for the purposes of the application of the GDPR, as constituting autonomous concepts of EU law which must be interpreted in a uniform manner in all of the Member States.

In light of these principles, the CJEU, first of all, evaluates the wording of the provision. According to the CJEU, it is clear from the wording, that the existence of the following conditions must be present cumulatively:

• “Damage” which has been “suffered”,
•  An infringement of the GDPR,
• A causal link between the suffered damage and the infringement of the GDPR.

In the decision, it is underlined that the separate reference to “damage” and to an “infringement” in Article 82 (1) of the GDPR would be superfluous if the EU legislature had considered that an infringement of the GDPR could be sufficient for the right of compensation. Moreover, the CJEU supports this argument by stating that contrary, Articles 83 and 84 of the GDPR, which permit the imposition of administrative fines and other penalties, have essentially a punitive purpose and are not conditional on the existence of individual damage.

Question 2: Must Article 82 (1) of the GDPR be interpreted as precluding a national rule or practice which makes compensation for non-material damage, within the meaning of that provision, subject to the condition that the damage suffered by the data subject has reached a certain degree of seriousness?

Concerning this question, the CJEU reminds that the concept of “non-material damage” must be given an autonomous and uniform definition specific to EU law since no reference to the domestic law of the Member States is given. Accordingly, Article 82 (1) expresses that “non-material damage” may give rise to a right to compensation, without any reference being made to any threshold of seriousness. Also, Recital 146 of the GDPR states that “the concept of damage should broadly be interpreted in the light of the case-law of the Court of Justice in a manner which fully reflects the objective of this Regulation”. So, it would be contrary to a broad interpretation of “damage” to limit the concept solely to damage of a certain degree of seriousness.

The Decision underlines that making compensation for non-material damage subject to a certain threshold of seriousness would risk undermining the coherence of the rules established by the GDPR. Since such a threshold would fluctuate according to the assessment of the courts seized. However, a person who had negative consequences due to an infringement of the GDPR still has to demonstrate that those consequences constitute non-material damage within the meaning of Article 82 of the GDPR.

Question 3: Must national courts apply the domestic rules of each Member State relating to the extent of financial compensation?

As regards the last question, the CJEU declares that the GDPR does not contain any rules about the assessment of the damages to which a data subject, may be entitled where an infringement of the GDPR has caused him or her harm. Therefore, each Member State’s legal system must prescribe the criteria for determining the extent of the compensation payable to the data subject. However, the Court highlights that the principles of equivalence and effectiveness of EU law must be complied with. The principle of effectiveness refers to the requirements that national law should be interpreted in line with EU law, that conflicting provisions of national law should not be applied, and that consequences resulting from breaches of EU law should be overridden. The principle of effectiveness also means that detailed procedural rules governing actions to protect the rights of individuals deriving from EU law should not render the exercise of those rights practically impossible or unduly difficult. The principle of equivalence requires that Member States should not treat matters under EU law less favorably than purely national matters.

Conclusion

In conclusion, it is clear that this judgment has clarified many debated issues concerning Article 82 of the GDPR. Such as the need for actual damage caused by an infringement of the GDPR, the fact that such damage must not reach a minimum threshold of seriousness and that the amount of compensation should be determined in accordance with the domestic law of the Member States by considering the principles of equality and effectiveness. However, whereas the CJEU leaves the burden of proof on the claimant, it is not clarified what proof of non-material damage is required. In this respect, while it is clear that the judgment has played an important role in clarifying Article 82 in regard to non-material damage, there are still unanswered questions that have to be enlightened.