Why so serious? – CJEU holds that no threshold of seriousness required for breach of GDPR
Locations
On 4 May 2023, the Court of Justice of the European Union (CJEU) published its judgment concerning non-material damage under Article 82 of the General Data Protection Regulation (GDPR) in the Case C-300/21 UI v Österreichische Post AG (Austrian Post Case).
Article 82 GDPR provides as follows:
"any person who has suffered material or non-material damage as a result of a breach of [the GDPR] shall be entitled to receive compensation from the controller or the processor.”
As such, the question arose as to whether a mere infringement of the GDPR immediately gives right to compensation under Article 82 of the GDPR. The Austrian Post Case has provided some clarification in this regard.
The Austrian Post Case - Case C-300/21
In this case, a data subject sought €1,000.00 compensation for alleged non-material damage arising from the processing of his personal data for political advertising using an algorithm. The algorithm used by Austrian Post had gathered information on the likely political affinity of citizens using socio-demographic criteria such as age and address. The data subject had asserted that the use of his personal data, without his consent, had caused great upset and a loss of confidence due to the affinity established between him and an Austrian political party.
This follows on from Advocate General (AG) Campos Sánchez-Bordona’s opinion delivered on 6 October 2022, where he was of the view;
- A mere infringement does not in of itself warrant compensation;
- Non-material claims should satisfy a minimum threshold; and
- It is a matter for national Courts of Member States to determine compensation in each case.
The Austrian Supreme Court referred a series of questions to the CJEU seeking clarification on compensation under Article 82 of the GDPR.
CJEU Judgment
The CJEU first detailed that the right to compensation provided for under Article 82 of the GDPR is subject to three conditions, namely:
CJEU Judgment
The CJEU first detailed that the right to compensation provided for under Article 82 of the GDPR is subject to three conditions, namely:
- An infringement of GDPR;
- Material or non-material damage resulting from that infringement; and
- A causal link between the infringement of the GDPR and the damage.
The CJEU found that not every infringement of the GDPR gives rise, of itself, to the right to compensation. The CJEU held that any other interpretation of the GDPR would clearly run counter to the clear meaning of the text contained within.
The CJEU differed in the opinion of the AG by holding that the right to compensation cannot be made contingent upon individuals satisfying a certain “seriousness” threshold, which is the case under Austrian law at present, noting that the terms set out in Article 82 of the GDPR should be given an “autonomous and uniform” interpretation in the EU.
The CJEU noted that the GDPR did not contain any rules governing the assessment of damages. Therefore, it is for the legal system of each Member State to prescribe the detailed rules governing actions under Article 82 of the GDPR, including the criteria for determining the extent of the compensation payable in that context, subject to compliance with the principles of equivalence and effectiveness.
Conclusion
In conclusion, the recent CJEU judgment in the Austrian Post Case provides some clarity on the conditions for the right to compensation under Article 82 of the GDPR. The CJEU held that while an infringement of the GDPR and resulting material or non-material damage are required for the right to compensation, a certain "seriousness" threshold cannot be imposed as a prerequisite for such compensation, as was the case in Austrian law. The CJEU then emphasised that the terms of Article 82 of the GDPR should be given an “autonomous and uniform” interpretation in the EU. Ultimately, the judgment leaves it up to each Member State's legal system to determine the rules governing the criteria for determining the extent of any compensation payable, subject to compliance with the principles of equivalence and effectiveness.
See the CJEU press release here
See the full text of Case C-300/21 here.
Written by Steven Whelan and Rosie Callan.
The CJEU differed in the opinion of the AG by holding that the right to compensation cannot be made contingent upon individuals satisfying a certain “seriousness” threshold, which is the case under Austrian law at present, noting that the terms set out in Article 82 of the GDPR should be given an “autonomous and uniform” interpretation in the EU.
The CJEU noted that the GDPR did not contain any rules governing the assessment of damages. Therefore, it is for the legal system of each Member State to prescribe the detailed rules governing actions under Article 82 of the GDPR, including the criteria for determining the extent of the compensation payable in that context, subject to compliance with the principles of equivalence and effectiveness.
Conclusion
In conclusion, the recent CJEU judgment in the Austrian Post Case provides some clarity on the conditions for the right to compensation under Article 82 of the GDPR. The CJEU held that while an infringement of the GDPR and resulting material or non-material damage are required for the right to compensation, a certain "seriousness" threshold cannot be imposed as a prerequisite for such compensation, as was the case in Austrian law. The CJEU then emphasised that the terms of Article 82 of the GDPR should be given an “autonomous and uniform” interpretation in the EU. Ultimately, the judgment leaves it up to each Member State's legal system to determine the rules governing the criteria for determining the extent of any compensation payable, subject to compliance with the principles of equivalence and effectiveness.
See the CJEU press release here
See the full text of Case C-300/21 here.
Written by Steven Whelan and Rosie Callan.