In principle, Article 82 GDPR grants any person who has suffered material or non-material damage as a result of an infringement of the GDPR the right to receive compensation for the damage suffered.
Indications as to the more exact arrangement of the claim for damages are not included in the GDPR, however. Recital 146 of the GDPR reads:
"The concept of damage should be broadly interpreted in the light of the case-law if the Court of Justice in a manner which fully reflects the objectives of this Regulation. [...]Data subjects should receive full and effective compensation for the damage they have suffered."
The real question regarding the possible amount and whether there is a materiality threshold – as is known from non-material compensation for damages law – is not answered, however, including by the Recital. It is therefore not surprising that courts have already dealt with the issue of the grounds for damages and the amount of damages.
On November 7, 2018, Diez Local Court (Case: 8 C 130/28) ruled that a mere infringement of the GDPR does not automatically entail a claim for damages by the person who has suffered a non-material damage. Rather, the person must have suffered noticeable disadvantage and it had to be an objectively comprehensible impairment of personality-related interests with a certain weight.
Now, apparently the first German higher court decision has been issued in a reference order of Dresden Higher Regional Court dated June 11, 2019 (Case: 4 U 760/19; available in the database of Dresden Higher Regional Court). Dresden Higher Regional Court largely affirmed the ruling of Diez Local Court.
The plaintiff filed a claim for damages against Facebook for material and non-material damage in accordance with Article 82 GDPR for the deletion of a post and the temporary blocking of his user account. Dresden Higher Regional Court rejected this claim.
The court did not consider the deletion of the post and the temporary blocking of the plaintiff's user account an infringement of mandatory provisions of the GDPR. In addition, the court also did not find material or non-material damage of the plaintiff within the meaning of Article 82 GDPR.
"Just like the data loss, the mere blocking of his data represents not yet a damage within the meaning of the GDPR (Wytibul/Haß/Albrecht, NJW 2018 p. 113 (114)). The alleged obstruction in personality development by the three-day blocking has at most trivial character."
In the court's opinion, however, immaterial trivial damage would not lead to a claim for compensation. The reference to "full and effective compensation for the damage" contained in Recital 146 GDPR does not give rise to such compensation, either. In particular the substantial abuse risk of a virtually unconditional claim in terms of legal consequences for damages for pain and suffering in the area of data protection would be an argument for this.
The decision of Dresden Higher Regional Court on limiting the claim for damages under Article 82(1) GDPR is welcome in particular in view of the risk of abuse. In addition, it excludes contradictions in damage law. Previously, jurisdiction in the protection area of general personality rights had already excluded an immaterial claim for damages in cases of minor damage. Companies are therefore not subject to different legal consequences depending on whether or not data protection law is concerned in addition to general personality rights.
In practice, companies would be well advised to check not only whether there has actually been a data protection violation but also whether the asserted damage is merely minor or trivial prior to making any payments in relation to such assertions. We will be pleased to assist you in defending against any such asserted claims for damages.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.