ECJ on Art. 82 GDPR: No compensation without damage!

1. Background

In its judgment of 4 May 2023, the ECJ (C-300/21) clarified that a non-material claim for damages under data protection law requires proof of specific and causal harm. A materiality threshold for claiming damages in national law is not permissible. The procedural rules for the judicial assessment of damages are governed by national law. What partly sounds self-evident has so far been decided inconsistently by German courts and has led to much discussion in the legal literature. Until now, it has been unclear when a non-material claim for damages exists under the GDPR. However, further legal questions on damages remain open.

2. Initial proceedings and questions for a preliminary ruling

The starting point for the ECJ's decision was a data processing by Österreichische Post AG on the party affiliation of the Austrian population. Since 2017, Österreichische Post AG has been using an algorithm to define so-called "target group addresses" on the basis of various socio-demographic characteristics and calculated certain political preferences of the persons concerned.

The Austrian plaintiff, whose data was processed for this purpose without his consent and who was subsequently attributed an affinity to a certain party, was enraged and offended by this. The imputed affinity was embarrassing and damaging to his credit. He sued for non-material damages in the amount of € 1,000. In support of his claim, he argued that he had been embarrassed by Austrian Post's conduct.

After the court of first instance and the court of appeal had dismissed the action, the Austrian Supreme Court referred the following questions to the ECJ for a preliminary ruling: (1) Can non-material damages under Article 82 GDPR be based exclusively on a breach of the provisions of the GDPR or does this also require that the data subject has suffered harm (which must be proven)? (2) Are there further Union law requirements for the assessment of damages in addition to the principles of effectiveness and equivalence? (3) In order for non-material damage to be awarded, must there be a consequence of some weight which goes beyond the harassment caused by the infringement?

3. Opinion of the Advocate General

In his opinion, Advocate General Sánchez-Bordona spoke out strongly against a claim for damages without harm. Rather, the unity of the law would require a transfer of civil law principles. The compensation and satisfaction function of the law on damages presupposes not only a violation of the law but also harm to the person affected. Otherwise, the monetary payment would not constitute compensation, but would be tantamount to a criminal punishment.

The Advocate General further explained that the injuring party must have committed a legal violation of at least some weight. This was reasonable, because every infringement of the GDPR triggers displeasure and annoyance among the data subject. Further disadvantages suffered must therefore be necessary for a claim for damages. As a result, mere annoyance, which is not compensable, must be distinguished from genuine immaterial harm, which is compensable.

4. Decision of the ECJ

In its judgment, the ECJ largely agrees with the Advocate General's Opinion.

(a) Questions 1 and 2: No damages without harm.

The ECJ requires harm for a claim for damages under Article 82 of the GDPR on the basis of the unambiguous wording of Article 82 of the GDPR and the systematic nature of the liability rules. According to the wording, three cumulative conditions are required for a claim under Article 82 GDPR: (i) a breach of the provisions of the GDPR, (ii) harm suffered by the data subject and (iii) a causal link between the unlawful processing and the harm. The separate mention of "damage" and "breach" in Art. 82 GDPR would be superfluous if assessed differently. The analysis of the systematics of the liability rules confirms this view. The imposition of sanctions under Art. 83 and 84 GDPR does not presuppose individual harm. However, there is a material difference between these provisions and Art. 82 GDPR. The non-material damage claim does not pursue a punitive purpose.

The ECJ leaves the assessment of the concrete amount of damages to the national courts. Since the GDPR itself does not contain any provisions in this regard, the amount of damages can be determined according to national criteria, taking into account the principle of equivalence and effectiveness.

(b) Question 3: National materiality threshold

The ECJ also ruled that Art. 82 GDPR precludes a national materiality threshold and thus deviates from the legal opinion of Advocate General Sánchez-Bordona. The substantive requirements for damages are to be determined autonomously and uniformly according to Art. 82 GDPR. However, the GDPR gives rise to a broad understanding of the concept of damage. Moreover, a materiality threshold contradicts the uniform interpretation of EU law; otherwise, there would be a risk that national courts could interpret the concept of materiality differently.

At the same time, however, the ECJ emphasises that the affected party must prove specific non-material harm. As a rule, the affected party will only be able to meet this burden of proof in the case of demonstrable impairment. It is therefore not yet foreseeable whether a materiality threshold will find its way into substantive law via these procedural detours.

5. New class action

German courts will have to deal with this question, among others, in the context of a new class action, which is to come into force on 25 June 2023. German procedural law already knows the model declaratory action (Musterfeststellungsklage), with which consumer associations can obtain so-called model findings on the factual and legal situation for similar consumer claims. However, consumers have so far had to assert their claims, especially for damages, in a subsequent individual action. This is now to change: With the so-called remedial action (Abhilfeklage), consumer associations are to be able to directly sue for damages and other claims for performance by consumers. In this way, business practices of companies that violate consumer law are to be comprehensively stopped and remedies are to be created.

This legal remedy is thus also predestined for consumer claims for damages due to violations of the GDPR. After all, it is almost effortless and risk-free for the consumer. There is an increased incentive to claim even the smallest damages, which consumers have so far tended to refrain from enforcing in court. Companies must therefore expect that consumer associations will increasingly "collect" consumers for the remedial claim when breaches of the GDPR become known. They must then fear not only claims for damages, but also increased publicity.

6. Conclusion and outlook

The ECJ's decision is predominantly to be welcomed and creates clarity in one of the essential questions regarding damages in the event of data protection infringements by means of a factual interpretation of Article 82 of the GDPR. A flood of lawsuits will thus be prevented, because each plaintiff must present and prove a causal concrete (immaterial) harm. The fact that the ECJ has not set a de minimis limit should be acceptable, because concrete, causal harm must be proven. However, national courts are likely to continue to search for a line of argument at this point as to what extent such proof can be provided by expressions of harassment or displeasure.

The topic of damages claims in data protection will become particularly explosive due to the fact that consumers will presumably be able to file their claims in an uncomplicated and risk-free manner via the new remedial action as early as 25 June 2023.

The ECJ will decide on further questions regarding the action for damages in question in the near future. Following a referral from Bulgaria, it is to be decided who bears the burden of proof for compliance with the technical organisational measures in this context (C-340/21). The German courts are actively involved in the interpretation of Art. 82 of the GDPR: The BAG (C-667/21) wants to clarify whether it is a special or general preventive claim and whether fault is to be taken into account when calculating damages. Further questions are to be answered by the ECJ following referrals from the AG Munich (C-189/22 and C-182/22), the LG Saarbrücken (C-741/21), the LG Ravensburg (C-456/22) and the AG Hagen (C-687/21).

Back to list