)
The General Data Protection Legislation (‘GDPR’) applies universally to every business active across Ireland and the EU and to private authorities and private individuals in many cases.
The issue of when compensation may arise for a breach of one’s rights under GDPR is therefore highly significant.
One of the most contentious provisions of the GDPR was the inclusion of the term ‘non-material damage’. Article 82(1) GDPR provides that a data subject has the right to receive compensation for material or non-material damage suffered because of a breach of GDPR. Non-material damage has been one of the most debated issues when interpreting EU data protection law, but the EU General Advocate has now presented his opinion on what constitutes non-material damage, which rejects the broad interpretation of this provision.
Background
On 6 October 2022, Advocate General Campos Sánchez-Bordona (‘AG’) delivered an opinion in UI v Österreichische Post (Case C-300/21) on the right to compensation for non-material damage under GDPR (the ‘Opinion’). This case considered the actions of the Austrian Post, who collected information on the political affinities of the Austrian population for the purpose of election advertising.
The claimant was one of the individuals whose data was processed, and the Austrian Post created a profile, using an algorithm, which associated him with a particular political party. The claimant had not consented to this process and was upset and offended by the affinity attributed to him believing it to be shameful and damaging to his reputation and as a result, claimed €1,000 in damages for “inner-discomfort”.
His claim was dismissed in the lower Austrian courts, and the Austrian Supreme Court was tasked with deciding whether inner discomfort was sufficient to constitute a claim in damages. In doing so, the Supreme Court referred the following questions to the Court of Justice of the European Union (CJEU):
Does the award of compensation under Article 82 of the GDPR also require in addition to infringement of provisions of the GDPR, that an applicant must have suffered harm, or is the infringement of provisions of GDPR in itself, sufficient for the award of compensation?
National courts have adopted a broad interpretation of Article 82 in the past. This question asks if there is a right to compensation based on a “mere” violation of GDPR, without consideration of the harm suffered.
The AG is relatively clear in this regard, stating “a mere infringement of the GDPR is not in itself sufficient if that infringement is not accompanied by the relevant material or non-material damage”. In doing so, the use of the terms “suffered” damages “as a result” of an infringement are referenced. The view of the AG is that a claimant must therefore prove an infringement of the GDPR and harm in the form of material or non-material damage. Thus, rejecting arguments that there is an irrebuttable presumption that once a GDPR violation has occurred – particularly when the breach involved a “loss of control” of data, that the claimant is immediately entitled to damages.
Does the assessment of compensation depend on further EU law requirements in addition to the principles of effectiveness and equivalence?
This question considers how compensation should be assessed and whether the principles of effectiveness and equivalence should apply. While the AG does not provide a comprehensive answer to this, he notes that both the principles of effectiveness and equivalence “do not appear to play an important role” under Article 82. He proceeds to list the relevant issues but concludes that decisions on compensation will depend on the nature of each claim. Ultimately, he leaves the task of assessing compensation to the national courts.
Is it compatible with EU law to take the view that an award of compensation for non-material damage requires the applicant to have suffered a harm (resulting from infringement of the GDPR) that goes beyond the “upset” caused by the infringement?
This question considered that if compensation is only available for actual or non-material damage, what does this mean in practise? Is “mere-upset” enough? The AG noted that any infringement of GDPR is likely to be met with a negative reaction from the data subject. That said, compensation for non-material damage requires a claimant to demonstrate more than “mere upset” as to allow this would be akin to not requiring proof of harm. Nevertheless, he notes the fine line between “mere upset” (which is not eligible for compensation”) and “genuine non-material damage” (which is eligible for compensation) and the task of determining what subjective feelings of displeasure will amount to non-material damage will lie with the national courts of Member States.
Conclusion
It must be noted that the AG’s opinion is only a proposal to the CJEU and has no legally binding effect. However, it is likely to be followed as research shows the court often follows the Advocate General’s opinions. If followed, the opinion will undoubtedly decrease the level of uncertainty surrounding what non-material damage entails.
The Advocate General has provided very welcome clarification surrounding the interpretation and application of Article 82 which contradicts the extensive interpretation of Article 82, rejecting the notion that infringement should automatically trigger some flat-rate compensation. It is yet to be seen if the CJEU will adopt this approach in the future, but the opinion could potentially be the first step towards a more restrictive approach to when compensation may arise for a breach of rights under GDPR.
About the author: Ciarán Leavy, Partner and Head of Commercial Litigation.