Under Art. 82 GDPR, any person who has suffered material or non-material damage as a result of an infringement of the GDPR has the right to receive compensation.
Requirements
An infringement of the GDPR, damage and a causal link are required. In its judgment of 4 May 2023 (C-300/21, Österreichische Post), the CJEU held that a mere infringement does not in itself give rise to a claim, but that there is also no threshold of seriousness for the damage.
According to case law, non-material damage can already lie in the loss of control over one's own data or in a well-founded fear of misuse. In practice, the amounts are often in the low hundreds of euros, but they can add up where many people are affected.
Who is liable?
The controller is liable and, insofar as it has breached its obligations, the processor. They are exempt from liability if they prove that they are not in any way responsible for the event giving rise to the damage.
Legal provisions
- Art. 82 GDPR
- Liability and right to compensation.
- Art. 79 GDPR
- Right to an effective judicial remedy.
- Recital 146 GDPR
- Broad interpretation of the concept of damage.
Related terms.
Data subject The data subject is the identified or identifiable natural person to whom personal data relates. Art. 4(1) GDPR Data breach A data breach is a breach of the security of personal data, for example through loss, unauthorised access or accidental disclosure. Art. 4(12) GDPR 