The European Union’s top court has handed down a couple of notable rulings today in the arena of data protection.
One (Case C-300/21) deals with compensation for breaches of the bloc’s General Data Protection Regulation (GDPR); and the second (Case C-487/21) clarifies the nature of information that individuals exercising GDPR rights to obtain a copy of data held on them should expect to receive.
Read on for a summary of the judgements and some potential implications.
No automatic right to damages — but no threshold for harm either
The CJEU’s GDPR compensation ruling relates to a referral from an Austrian court where an individual sought to sue the national postal service for damages after it used an algorithm to predict the political views of citizens according to socio-demographic criteria without their knowledge or consent — leaving the individual feeling exposed, upset and with a knock to their confidence, per the Court’s press release.
As regards regional damages for privacy violations, there have been a number of attempts to bring class action style suits seeking compensation for data protection breaches in recent years. This CJEU ruling may make it easier to do so within the EU, although the court has puts one limit on such claims since the judges have ruled that just the fact of an infringement of the GDPR does not automatically give rise to a right of compensation — meaning there is an onus on litigants to demonstrate personal harm.
At the same time, the CJEU has ruled there is no requirement for the non-material damage suffered to reach a certain threshold of seriousness in order to confer a right to compensation.
So, in other words, the court has avoided setting a bar on how much/what type of harm needs to be demonstrated to file a compensation claim. Which looks like a big deal.
“[T]he Court holds that the right to compensation is not limited to non-material damage that reaches a certain threshold of seriousness,” it writes in a press release accompanying the judgement. “The GDPR does not contain any such requirement and such a restriction would be contrary to the broad conception of ‘damage’, adopted by the EU legislature. Indeed, the graduation of such a threshold, on which the possibility or otherwise of obtaining that compensation woulda depend, would be liable to fluctuate according to the assessment of the courts seised.”
