ECJ rules on GDPR claims for damages

In accordance with Advocate General Sánchez-Bordona’s opinion, the ECJ ruled that a mere infringement of the GDPR is not sufficient for the assertion of a claim for damages pursuant to Art. 82 GDPR. Rather, an individual damage must be verifiable as well. 

In deviation from the Advocate General’s assessment, however, the ECJ concluded that the assumption of a damage is not limited by the fact that the damage must be substantial. The Court added, however, that the concept of a non-material damage had to be based upon the European law’s definition and not upon the individual member states’ individual legal understanding. Accordingly, this required the application of a broad standard, on the basis of which the national courts had to develop criteria for a determination of the damage’s extent. 

GDPR violations by Austrian Post

The reference for a preliminary ruling was based upon proceedings before the Austrian Supreme Court. In the course of the proceedings, the plaintiff claimed non-material damages of EUR 1,000 from Österreichische Post AG (Austrian Post). The plaintiff based his claim upon Austrian Post’s practice of collecting, since 2017 and without the data subjects’ consent, information on the Austrian population’s party affinities in order to identify target groups for various political parties’ canvassing. According to the plaintiff’s submission, such practice had caused him “great annoyance”, “a loss of trust” and “the feeling of being exposed”, as he found the political affinity attributed to him “insulting”, “shameful” and “discrediting”. 

Conclusion: ECJ passes the ball back to national courts

In conclusion, it remains to be stated that even after this ECJ ruling, it is still not clear in practice when compensable damage within the meaning of Art. 82 GDPR is to be assumed. Ultimately, it is up to the national courts to determine the requirements for the burden of proof based on the concept of damage under European law.

It thus remains to be seen whether a feeling of subjective discontent (“uncertainty,” “annoyance,” etc.) resulting from the uncertainty in connection with the processing of personal data is sufficient for the assumption of a non-material claim for damages. Furthermore, it remains to be seen what amount of damages national courts will deem appropriate in the future.