Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

EU: CJEU publishes judgment on right to compensation for non-material damages based on fear

On June 20, 2024, the Court of Justice of the European Union (CJEU) issued a judgment in Case C-590/22, AT, BT v. PS GbR, VG, MB, DH, WB, GS, regarding the right to be awarded damages under Article 82(1) of the General Data Protection Regulation (GDPR) following a request for a preliminary ruling from a local court in Wesel.

Background

The CJEU outlined that the letter containing the tax returns of applicants and clients of PS was sent by PS to the wrong address and subsequently opened by mistake by the tenant living at that address. Following this, the applicants brought an action before the Local Court of Wesel claiming compensation for the non-material damage which they believe they have suffered as a result of the disclosure of their personal data to third parties.

The CJEU further explained that the Local Court of Wesel decided to stay the proceedings and refer several questions to the CJEU regarding the establishment of a claim for compensation for non-material damage.

Findings of the CJEU

The CJEU held that Article 82(1) of the GDPR must be interpreted as meaning that an infringement of the GDPR is not, in itself, sufficient to give rise to a right to compensation under that provision. The data subject must also establish the existence of damage caused by that infringement. The CJEU confirmed that the damage does not have to reach a certain degree of seriousness.

The CJEU also outlined that a person's fear that their personal data has, as a result of an infringement of the GDPR, been disclosed to third parties is sufficient to give rise to a right to compensation. The CJEU clarifies that it is not necessary to establish that the disclosure took place if the negative consequences of the fear are proven.

Furthermore, the CJEU highlighted it is not necessary for the determination of the amount of damages due as compensation:

  • first to apply mutatis mutandis, the criteria for setting the amount of administrative fines laid down in Article 83 of the GDPR, and then to confer on that right to compensation a dissuasive function; and
  • to take account of simultaneous infringements of national provisions that relate to the protection of personal data but which are not intended to specify the rules of the GDPR.

You can read the judgment here.