According to the Opinion of the CJEU Advocate General, not every infringement of the GDPR or mere annoyance or displeasure about it triggers a claim for compensation.
In some cases, the data protection supervisory authorities at national and federal state level and the German courts interpret the provisions of the General Data Protection Regulation (GDPR) differently, so there is a great deal of legal uncertainty in data protection for companies. One particularly controversial question is whether a mere breach of the GDPR can lead to (non-material) damage or whether further effects on the data subject are required in order to be able to claim compensation. There are indications that the European Court of Justice (CJEU) will clarify this question in the near future.
The starting point here is Art. 82 GDPR, which regulates the material and immaterial damage that the data controller or processor must pay to the data subject in the event of an infringement of the GDPR. Just about every prerequisite for the right to compensation and its legal nature is controversial when applying and interpreting this provision. Therefore, the Austrian Supreme Court (OGH) made a request for a preliminary ruling by the CJEU in proceedings for compensation under Art. 82 GDPR. In the case pending before the CJEU, Case C-300/21 the respective Advocate General Sánchez-Bordona published his Opinion on 6 October 2022. Now the CJEU's judgment on the matter is being eagerly awaited.
The CJEU will clarify some of the most important questions on the interpretation of Art. 82 GDPR
In the proceedings, a private individual claimed compensation under the GDPR from an address trading company due to the storage of personal data on party affinity which the defendant company collected on the Austrian population. Although the company did not pass on the information collected about the claimant to third parties without his consent, it did use an algorithm to attribute the claimant's proximity to a party on the right-wing political spectrum. Not only did the claimant firmly reject this classification, but in addition to being very upset, he also felt a loss of confidence, felt angered, embarrassed, offended and worried about his creditworthiness. Because of "internal discomfort", he claimed compensation of EUR 1,000 from the company for non-material damage.
The claimant lost at the first instances, but did not give up and took the case all the way to the OHG, which in the spring of 2021 decided to refer these questions to the CJEU:
"Does the award of compensation under Article 82 [...] GDPR [...] also require, in addition to infringement of provisions of the GDPR, that an applicant must have suffered harm, or is the infringement of provisions of the GDPR in itself sufficient for the award of compensation? […]
Is it compatible with EU law to take the view that the award of compensation for non-material damage presupposes the existence of a consequence of the infringement of at least some weight that goes beyond the upset caused by that infringement?"
Since, as a European regulation, the GDPR is supplemented by national provisions with their own doctrines of damage in the legal systems of the respective Member States, the above questions regarding Art. 82 GDPR are highly controversial among lawyers. The procedure is therefore about nothing less than the most important prerequisites of Art. 82 GDPR: On the one hand, there is the question of whether the infringement of a provision of the GDPR alone already constitutes the damage to be compensated, and also leads to a claim under Art. 82 GDPR if no harm is suffered; on the other hand, there is the question of whether only damage that exceeds a certain materiality threshold is to be compensated, so that "minor damage" would be excluded from this.
Does every infringement of the GDPR in itself constitute damage which is eligible for compensation?
The wording of Art. 82 (1), (2) sentence 1 GDPR is the first source of controversy in the application of Art. 82 GDPR:
"Any person who has suffered material or non-material damage shall have the right to receive compensation from the controller or processor for the damage suffered. (subsection 1); Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation (subsection 2 sentence 1) […]".
Due to this wording it is disputed whether every infringement of one of the provisions of the GDPR in itself automatically constitutes compensable damage or whether further circumstances must be present and ultimately also proven.
In his Opinion of 6 October 2022, the Advocate General concludes, after extensive reasoning and interpretation of the GDPR, that a GDPR infringement does not automatically give rise to damage which is eligible for compensation under Article 82 GDPR. He also emphasises that compensation does not have to be paid for feelings such as mere anger. In the reasoning of the Opinion, the Advocate General recalls the purpose of the GDPR in support of his conclusion:
"The aim of the GDPR is not, I stress, to limit systematically the processing of personal data but rather to legitimise it under strict conditions. That aim is served especially by promoting confidence on the part of data subjects that processing will be carried out in a safe environment[…] [GDPR] to which the data subjects themselves contribute."
(Source Opinion of Advocate General Sánchez-Bordona delivered on 6 October 2022)
The Advocate General then emphasises in the aforementioned procedure that the damage must have been suffered and cannot, for example, already be affirmed or even (irrefutably) assumed on the basis of the GDPR infringement alone. This applies in particular if the data subject has not suffered any concrete damage as a result of the infringement. The Advocate General concludes that the mere infringement of a provision of the GDPR is not sufficient for a claim for compensation under Article 82 GDPR, but that there must also be material or non-material damage. The Advocate General rejected the assumption that the provision is punitive in nature (this also corresponds to the interpretation of most German courts).
On the grounds for this, he states:
"In my view, it is not straightforward to conclude from the GDPR that it is objective to grant data subjects control over personal data as a right in itself, or that data subjects must have the greatest control possible over those data."
If not every infringement of the provisions of the GDPR automatically gives rise to damage which is eligible for compensation, e.g. due to loss of control, the question arises whether the damage suffered as a result of the infringement must be of a certain significance in order to give rise to a claim for compensation under Art. 82 GDPR.
Can a materiality threshold be read into Art. 82 GDPR?
Lawyers and German courts (e.g Dresden Higher Regional Court, judgement of 20 August 2020 - 4 U 784/20) frequently call for a materiality threshold for compensation under Art. 82 GDPR, i.e. that the damage to be compensated exceeds certain trivialities that are not eligible for compensation. Mere upset, fears, worries or negative feelings arising from unlawful data processing would not be eligible for compensation and have to be compensated in money. Other courts oppose the requirement of a materiality threshold and also allow perceived stress and worry to suffice as compensable damage (e.g Cologne Higher Regional Court, judgment of 14 July 2022 - 15 U 137/21, Hanover Higher Labour Court, judgement of 22 October 2021 - 16 Sa 761/20, Hamm Higher Labour Court, judgement of 14 December 2021 - 17 Sa 1185/20).
In the procedure before the CJEU, the Advocate General emphasises in his Opinion on this point that, in his view, a right to compensation does not extend to mere annoyance resulting from an infringement of the GDPR provisions. Recitals 75, 85 and 146 of the GDPR, which are often used to justify the opposite view, do not enable the Advocate General to reach a different conclusion. Rather, he emphasises that it cannot be deduced from the CJEU's previous case law on compensation that all non-material damage must be compensated regardless of its severity. The Advocate General states that it is up to the national courts to determine under which circumstances the subjective feeling of displeasure can be deemed as non-material damage in an individual case, but acknowledges that this is a difficult task.
The Advocate General is very clear on this point in his reasoning:
"[…] In addition, the right to compensation under Article 82(1) of the GDPR does not appear to me to be a suitable instrument for countering infringements in connection with the processing of personal data where all those infringements create for the data subject is annoyance or upset.[…] As a rule, any breach of a provision governing data protection leads to some negative reaction on the part of the data subject. Compensation arising as a result of a mere feeling of displeasure due to another person’s failure to comply with the law is easily confused with compensation without damage, which has already been ruled out."
However, the Advocate General also emphasises that the data subject who feels annoyance and displeasure on the occasion of a breach of the GDPR is not left unprotected if they are not granted compensation under Article 82 GDPR, as the GDPR provides sufficient other legal instruments for their protection.
Awaiting the CJEU's decision
In light of the above considerations, the Advocate General's Opinion ends with a recommendation to the CJEU to respond to the above questions referred by the OGH:
"Art. 82 [GDPR] is to be interpreted
as meaning that for the purposes of the award of compensation for damage suffered by a person as a result of an infringement of that regulation, a mere infringement of the provision is not in itself sufficient if that infringement is not accompanied by the relevant material or non-material damage.
The compensation for non-material damage provided for in the [GDPR] does not cover mere upset which the person concerned may feel as a result of infringement of provisions of regulation 2016/679. It is for the national courts to determine when, owing to its characteristics, a subjective feeling of displeasure may be deemed, in each case, to be non-material damage."
Now the decision of the CJEU is being eagerly awaited in the matter; the Court does not have to share the assessment of the Advocate General and may decide the opposite. If the judges follow the Advocate General and his interpretation of Art. 82 GDPR, some courts might no longer award the GDPR compensation to the same extent as before (a continuously updated overview of German case law on Art. 82 GDPR can be found here on our blog). Particularly in light of the implementation of the EU Directive on representative actions which will enable consumer protection associations to bring legal proceedings against a company on behalf of a large number of consumers in the event of infringements of consumer protection regulations (such as the GDPR), it would be particularly welcome to receive timely clarification from the higher courts on these controversial points regarding the claim for compensation under data protection law (see also: Klagewelle wegen Schadensersatz nach Datenschutzverstoß? (cmshs-bloggt.de); Verbandsklage bei DSGVO-Verletzungen möglich (cmshs-bloggt.de)).
