Compensation for non-material damage does not automatically accompany every breach of the GDPR (AG's opinion)

On 6 October 2022, Advocate General Campos Sánchez-Bordona delivered his opinion in UI v Österreichische Post AG (Case C‑300/21) on the interpretation of Article 82 of the General Data Protection Regulation, holding that:

• A “mere breach” of the GDPR is not sufficient to warrant an award of compensation if the infringement in question is not accompanied by the requisite relevant material or non-material damage; and
• Compensation for non-material damage does not cover “mere upset” under Article 82(1).

Background

The opinion followed a referral made by the Austrian Supreme Court in relation to Article 82(1) of the GDPR and its interpretation. Article 82(1) states that any person who has suffered material or non-material damage as a result of an infringement of GDPR shall have the right to receive compensation from the controller or the processor for the damage suffered.

Initial claim

The referral was made in the context of a compensation claim wherein Österreichische Post AG, an organisation which publishes address directories, processed the personal data of UI, a natural person, without consent. The processing took place in order to classify target groups for political and election purposes. UI claimed “inner discomfort” and upset as non-material damage in light of the data processing.

The appellate court initially ruled:

• Compensation for non-material damages does not automatically accompany every breach of the GDPR, and only damage that goes beyond upset or the feelings caused by the breach are eligible for compensation; and
• In accordance with underlying Austrian Law, mere discomfort and feelings of unpleasantness must be borne by everyone without any consequence in terms of compensation. For compensation, the damage ought to be of a certain significance.

The judgment was appealed to the Austrian Supreme Court, who referred certain questions to the European Court of Justice for guidance. They were:

1. Does the award of compensation under Article 82 of Regulation (EU) 2016/679 (1) (the GDPR) also require, in addition to infringement of provisions of the GDPR, that an applicant must have suffered harm, or is the infringement of provisions of the GDPR in itself sufficient for the award of compensation?
2. Does the assessment of the compensation depend on further EU-law requirements in addition to the principles of effectiveness and equivalence?
3. Is it compatible with EU law to take the view that the award of compensation for non-material damage presupposes the existence of a consequence of the infringement of at least some weight that goes beyond the upset caused by that infringement?

Decision following referral

Advocate General Campos Sánchez-Bordona held:

In response to question 1:

• There is an “unequivocal requirement” that the natural person concerned must have suffered damage as a result of an infringement of the GDPR.
• An interpretation which automatically associates the notion of infringement with compensation without damage having occurred is not compatible with the wording of Article 82 of the GDPR.
• Alternatively, Individual Member States may provide payment for punitive damages based on the extent of harm suffered, given the absence of Community rules on this point.

In response to question 2:

• The principles of effectiveness and equivalence do not play an important role in this case, and the harmonised provisions of the GDPR (i.e., Article 82 of the GDPR) are applicable in respect of all non-material damage occurring as a result of an infringement, regardless of its source.

In response to question 3:

• This question was answered in the affirmative, based on a recognised distinction between “non-material damage for which compensation may be awarded and other inconveniences arising as a result of abuse of the law which, owing to their insignificance, do not necessarily create the right to compensation”.
• The right to compensation under Article 82(1) of the GDPR is not a suitable instrument for countering infringements in connection with the processing of personal data where the consequence of said infringements is “annoyance or upset”.
• The distinction between non-material damage is which and is not eligible for compensation is to Member States to apply and refine.

Important takeaways

Whilst the United Kingdom is no longer bound by opinions of the ECJ, the Opinion will be welcomed by organisations across the European Union and the decision reflects a broadly similar approach to that of the English courts in relation to low value or trivial data protection claims¹. For organisations facing civil claims for damages following alleged breaches of the GDPR, the Opinion is welcomed as:

• a mere infringement is not sufficient to award compensation if said infringement is not accompanied by the relevant material or non-material damage.
• If non-material damage is to be relied upon, it must be “genuine”, as opposed to “mere upset” which is not eligible for compensation.
• It is for Individual Member States to define instances where “subjective feelings of displeasure” may prove significant enough to constitute non-material damage and therefore warrant compensation.

Comment

AG Campos Sánchez-Bordona’s opinion effectively narrows the scope for (or indeed correctly scopes) compensation in data protection claims by adopting a restrictive interpretation of non-material damage. While the opinion does not have a binding effect, the ECJ may choose to adopt it at a later point. For now, the opinion highlights the need for data subjects to prove or clarify damage beyond loss of control over personal data and feelings of upset or discomfort.