On 4 May 2023, the Court of Justice of the European Union ("CJEU") delivered a preliminary ruling for the case UI v Österreichische Post AG (Case C-300/21). The CJEU addressed three important questions surrounding the interpretation of Article 82 of the General Data Protection Regulation ("GDPR") on the right to compensation:

  • Is an infringement of the GDPR alone enough to warrant the right to compensation?
  • Does Article 82 propose that national courts should apply domestic rules to determine the extent of financial compensation?
  • Does Article 82(1) preclude a national rule which enforces a threshold of seriousness that must be satisfied before a data subject can receive compensation for non-material damage?

CJEU rulings are binding within the EU and no longer in the UK (though UK organisations may need to adhere to them, when the extraterritorial provisions of the EU's GDPR apply).

Background

The Austrian Post collected information to identify political affinities in Austria and by processing this information, they found that a particular citizen had a high degree of affinity with a right-wing political party. The affiliated citizen, who had not consented to the processing of his personal data, felt upset and embarrassed that this association had been generated, and sought to claim compensation for non-material damage.

CJEU ruling

Article 82(1) stipulates that:

"Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered".

Is an infringement of the GDPR alone enough to warrant the right to compensation?

The CJEU set out that the right to compensation is subject to three cumulative conditions that are laid out in the wording of Article 82(1): 1) there has been material or non-material damage; 2) there has been an infringement of the GDPR; and 3) there is a causal link between the damage and infringement of the GDPR. As this provision makes no express reference to the law of a Member State for the purpose of determining its meaning and scope, it must assume its uniform and literal interpretation throughout the European Union.

Therefore, in addressing the first question, the CJEU dismissed any interpretation that the mere infringement of the GDPR could be sufficient by itself, and in any event, to trigger an automatic right to receive compensation.

Does Article 82 mean that, for the amount of damages payable, national courts should apply domestic rules to determine the extent of financial compensation?

In the absence of a GDPR provision to define explicit rules for the assessment of damages, the CJEU determined that it is for the legal system of each Member State to prescribe criteria for the extent of compensation payable.

The CJEU confirmed that the national courts must apply the domestic rules of their respective Member State relating to the extent of financial compensation, provided that the EU principles of equivalence and effectiveness are preserved in the process.

Does Article 82(1) preclude a national rule which enforces a threshold of seriousness that must be satisfied before a data subject can receive compensation for non-material damage?

The CJEU reiterated the important notion that, the GDPR affords a high level of protection for natural persons and, to that end, also ensures a consistent application of rules to natural persons. In light of this consideration, to make compensation subject to a threshold would risk undermining the GDPR's coherence, as such threshold would be liable to fluctuation depending on the assessment that each relevant court produces.

Therefore, Article 82(1) must be interpreted as precluding any national rule which makes compensation for non-material damage subject to a certain degree of severity. The CJEU nevertheless affirmed that, in the absence of national rules, the fact remains that any person concerned by an alleged infringement is still obliged to demonstrate how the consequence of such infringement constitutes non-material damage.

Overall, whilst there are concerns that this preliminary ruling may open extensive floodgates in the absence of a designated threshold for non-material damage, its overarching premise indisputably rejects the notion that the right to compensation can be afforded automatically.

Find the preliminary ruling here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.