Compensating a scratch on the soul? The status quo of the right to receive compensation for immaterial damage under Article 82 GDPR

12/01/2023 - Advocate General Sánchez-Bordona (‘the AG’) recently issued an Opinion on CJEU case C-300/21 (UI v. Österreichische Post AG). This is the first AG Opinion for the several preliminary ruling requests pending before the CJEU that concern immaterial damage under the GDPR. The AG’s conclusion is rather concrete; a “mere upset” that a data subject feels as a result of a GDPR infringement does not warrant compensation for immaterial damage. How this might affect the GDPR’s already frail immaterial damage redress mechanism will be elaborated in the blog below.

Legal background

Among the many things the GDPR originated is the precise distinction that a data subject can receive compensation for both material and immaterial damage, i.e., “any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered” (Art. 82(1) GDPR). 

However, the concept of immaterial damage is often more vague and harder to define than material damage. The Dutch Civil Code e.g., describes it as “other damage than material loss” (BW 6:106). In the GDPR, Recital 146 stipulates that the concept of damage must be interpreted “broadly in the light of the case-law of the CJEU in a manner which fully reflects the objectives of the GDPR”. As such, the GDPR might provide the right to receive compensation for such damage but lapses in its understanding of what exactly is considered damage, material or not. Without an explicit definition, data subjects therefore rely on CJEU case-law.

The issue herein is paradoxical – in order to rely on it, CJEU case-law must first exist. Its absence is perhaps self-explanatory; the nascent nature of the GDPR allows for it. On the national side however, there has been an increase in cases concerning immaterial damage. Yet, the lack of an EU-level regime creates an uncertainty for the data subjects. In one such case e.g., a Dutch court stated that immaterial damage can be successfully claimed if the claimant provides “concrete information” supporting their claim. Having concrete information about a non-concrete loss seems to further the paradox. 

The case at hand

In this case, the Austrian Postal Service had collected and sold the personal data of millions of Austrians. Using an algorithm, individuals were linked to certain political parties and then the result would be sold for election advertising. The concerned plaintiff, who had not consented to the processing, found out through an access request that he was linked to a far-right populist party. He subsequently filed a compensation claim for immaterial damage, claiming that the affiliation was “insulting and shameful, as well as extremely damaging his reputation” and “caused him great upset and a loss of confidence, and also a feeling of public exposure”.

The first and second instance courts dismissed the claim, however the Austrian Supreme Court referred the following questions to the CJEU for a preliminary ruling:

1. Is a GDPR infringement sufficient to justify a claim for damages under Art. 82, or is proof of suffered harm also required?
2. What are the requirements under EU law for the assessment of damages?
3. Does a certain threshold have to be exceeded for the assumption of immaterial damage, or is the upset caused by the infringement sufficient?

The Opinion

The AG stated that Art. 82 should be interpreted with a meaning that a mere GDPR infringement is insufficient to claim compensation if there is no material or immaterial damage resulting from the infringement. The Opinion referred to the wording of “suffered”, as stipulated in Art. 82 and Recital 146, therefore there would need to be an actual incurred harm. The GDPR does not presume that a violation of its provisions implies harm; rather this needs to be established on a case-by-case basis. The AG additionally illustrated the absence of a system for punitive damages in the GDPR. Art. 82 is meant to compensate an injured data subject, with the compensation amount reflecting the actual damage suffered.

Furthermore, the AG noted the “fine line” between mere upset (which is non-compensable), and genuine immaterial damage (which is compensable). The loss of control over a data subject’s data does not always represent a compensable damage under Art. 82(1). The AG further noted that a certain threshold needs to be exceeded but it is up to the national courts to differentiate between mere annoyance and actual damage stemming from a GDPR infringement. In any case data subjects should first resort to other GDPR-provided remedies, such as the right to lodge a complaint with a supervisory authority (Art. 77). 

Cause for alarm?

An AG Opinion is not binding, but the CJEU could opt to follow it, as it often does. If the CJEU agrees with the AG, the decision could be welcomed by data controllers as a precedent to defend themselves from future compensation claims. Experts such as Max Schrems called the developments “alarming”, stating that if the CJEU follows the Opinion it “may severely limit the enforcement of European’s privacy rights”. Conversely, imposing a stricter understanding of what is actually compensable immaterial damage can also have a positive effect. The chairman of the Dutch Data Protection Authority stated in 2021 that “compensation should be the rule, not the exception”, i.e., a “scratch on the soul” should also be compensable. Having such a low threshold where any upset regarding the ill-natured processing of one’s personal data is compensable, could lead to frivolous litigation, hampering the objectives of the GDPR.

In any case, the CJEU is yet to issue its final decision, which is expected to come in the following months. Considerati will continue to monitor these developments. If you have any questions about the implications of these developments on your organisation, do not hesitate to contact us