In a judgment (C-300/21) handed down on Thursday, 4 May, the Court of Justice of the EU (CJEU) ruled that mere infringement of the General Data Protection Regulation (GDPR) does not create a right to compensation. However, it stresses that obtaining compensation does not depend on the seriousness of the damage suffered.
The Österreichische Post has been collecting information on the political preferences of Austrian citizens since 2017. Yet, an individual who had not consented to his personal data being processed argued that he had suffered moral prejudice when the post office was able to establish his affinity with a political party and sought compensation of €1000.
However, the Austrian Supreme Court asked the CJEU to clarify, firstly, whether mere infringement of the GDPR confers a right to compensation and, secondly, whether compensation is only possible if the damage reaches a certain degree of seriousness.
In its judgment, the CJEU reiterates that, in order to obtain compensation, there must be an infringement of the GDPR, material or non-material damage resulting from that infringement, and a causal link between the damage and the infringement. Consequently, not every infringement of the GDPR, by itself, confers a right to compensation. “Thus, the claim for compensation is distinct from other remedies set out in the GDPR, including those allowing the imposition of administrative fines, for which the existence of individual damage does not have to be demonstrated,” it explains.
Furthermore, the CJEU points out that the GDPR does not subject obtaining compensation to damages exceeding a certain threshold of seriousness. In its opinion, to do otherwise would run the risk of undermining the consistency of the regulation, since the assessment of the seriousness of an event may vary from judge to judge.
Finally, the CJEU believes that it is Member States’ responsibility to define the criteria that determine how much compensation is to be paid, “provided that the principles of equivalence and effectiveness are complied with”. Nevertheless, it reiterates that the right to compensation provided by the GDPR aims to ensure “full and effective compensation for the damage suffered”.
See the judgment: https://aeur.eu/f/6q8 (Original version in French by Hélène Seynaeve)