CJEU strengthens data subject rights in two damage claims

On 20 June, the CJEU strengthened data subjects rights in two cases looking at the interpretation of Article 82 GDPR (the right of compensation for damages resulting from data processing that infringes the GDPR) and clarified the concept of non-material damages and how to assess compensation.

In the first judgment (joined cases C‑182/22 and C‑189/22), the CJEU addressed several questions referred by a German court regarding compensation for non-material damage caused by a theft of personal data stored on a trading application and determined that the right to compensation has an exclusively compensatory function and that severity and possible intentional nature of the infringement do not need to be considered for compensation purposes. It was indicated that claims for non-material damages do not need to exceed a "de minimis threshold". Where the claimant establishes causation, a national court may award nominal damages if the compensatory function noted above is satisfied. Further, the CJEU stated that a data subject can only claim compensation for non-material damage caused by "identity theft" where the perpetrator has later actually misused the personal data; and emphasised that compensation for non-material damages is not limited to identity theft.

In the second judgment (case C‑590/22), the CJEU responded to a question referred by a German court concerning the compensation for non-material damages where a tax consultant had erroneously disclosed tax returns to an unauthorised third party. The CJEU ruled that a GDPR infringement alone is not sufficient to award compensation; data subject musts establish causation between the infringement and the damage; data subjects could claim non-material damages where they successfully proves that its fear of negative consequences resulting from the unauthorised disclosure; and emphasised that damages under Article 82 GDPR can always and only compensate the damages suffered by the data subject; compensation of non-material damages should not have a dissuasive or punitive effect (such as relevant for administrative fines under Article 83 GDPR).

Authors: Alexander Duisberg (Partner); David Plischka (Associate); Lisa Kopp (Associate)