2023-05-04 18:17:09
UUnder what conditions and to what extent is there compensation under the General Data Protection Regulation? So how high is the financial liability risk for companies, for example in the event of unlawful processing of personal data, data leaks or hacker attacks? The European Court of Justice (ECJ) answered these sensitive questions for the first time in a whole series of nine preliminary proceedings on Thursday.
In part, the judgment accommodates the defendant companies by making certain limitations by the ECJ. He makes it clear that not every breach of the General Data Protection Regulation in itself justifies a claim for damages. Rather, plaintiffs would have to demonstrate that they suffered damage that went beyond this as a result of the breach of data protection regulations.
No lower limit for claims
At the same time, the judgment also brings relief for the citizens affected, as well as for lawyers and legal tech companies that specialize in class action lawsuits for data protection violations: the ECJ rejects a de minimis limit for non-financial damage, as is sometimes also drawn by German courts. “The claim for damages does not depend on the fact that the resulting non-pecuniary damage reaches a certain level,” says the judgment.
The Advocate General at the ECJ, on the other hand, had advocated a lower limit: Anger or annoyance, “mere feelings of resentment” and “weak and temporary feelings or emotions” due to data protection violations should not entitle to damages. The ECJ disagrees: Such a limitation is not compatible with the broad concept of damage in the General Data Protection Regulation. However, the ECJ does not specify in its judgment which requirements are to be placed on the existence of non-pecuniary damage.
No Punitive Damages
In order to make business easier, the Court of Justice opposed claims for the recognition of so-called punitive damages when it came to the question of the nature and assessment of damages. The ECJ follows the line of the Advocate General. He had referred to the role of the supervisory authorities, whose task it was to impose fines. The ECJ emphasizes that the damage suffered must be compensated “fully and effectively” – but “without such full compensation requiring the imposition of punitive damages”. Corporate lawyers welcomed this limitation. Otherwise there would be excessive incentives for lawsuits – especially in conjunction with the expansion of collective legal protection through the new remedial action, which will soon enable bundled claims for damages by consumer protection associations.
Despite the clarifications in the judgment, legal uncertainties remain. The Court of Justice leaves open what is actually important in order to guarantee the necessary “full compensation”. It is up to the Member States to set criteria for assessing damages. Whether the Austrian plaintiff, whose case was ruled by the ECJ, is entitled to non-pecuniary damages must now be clarified at national level. The man had demanded 1,000 euros from the Austrian Post for the fact that he had been given a high affinity for the right-wing FPÖ as part of a data collection for advertising purposes, which he had not agreed to. This caused him immaterial damage in the form of a major annoyance and loss of trust. However, the data was not passed on to third parties.
#Compensation #trifles