Punitive damages for GDPR infringements

Published 09/12/2020

Austrian courts have so far been cautious about compensation for immaterial damages in the case of data protection violations. In the meantime, however, there is a trend in German jurisprudence towards punitive damages according to the US model.

Accordingly, every violation of the GDPR already constitutes damage that shall be compensated. There is a risk of abuse by financially motivated “warning lawyers” and financial burdens for employers due to the large number of persons affected.

Employers have already been ordered by German courts to pay non-material damages:

• for sharing an employee photo without consent in a social media post (EUR 1,000);
• for non-compliance with a right to information under Art. 15 GDPR (EUR 5,000);
• for sending a message to the wrong recipient in the application process (EUR 1,000) and
• for the unlawful disclosure of health data to authorities (EUR 1,500).

Please review your privacy statements, consent forms, information disclosure processes, and data breach procedures.