CJEU Decision: No 'De Minimis' Threshold For GDPR Compensation Claims

• Jurisdiction: European Union
• Published date: 24 May 2023
• Subject Matter: Privacy, Data Protection
• Law Firm: Matheson
• Author: Ms Davinia Brennan, Michael Byrne and Samuel Elliott

How much damage is some damage? CJEU finds some damage, but no minimum level of damage, is required for GDPR compensation claims

Almost five years after the GDPR came into force, uncertainty prevails over the scope of the right to compensation for non-material damage under the GDPR. Prior to the GDPR, it was not possible for individuals (or groups of individuals) to recover damages for "non-material loss" i.e. pain, suffering and anxiety arising from breach of their data protection rights.

The issue has been subject to scrutiny recently before the Irish courts. The Irish Circuit Court, in Cunniam v Parcel Connect Limited & Ors [2023] IECC 1, granted a stay on proceedings brought by a data subject where non-material damages were alleged, pending the delivery of six decisions from the Court of Justice of the European Union ("CJEU") relating to compensation claims under the GDPR (discussed further here), effectively putting claims of this kind on hold for the time being.

The first of these six decisions was delivered on 4 May 2023, in UI v Österreichische Post AG (Case C-300/21) ("the Austrian Post case"). In its judgment, the CJEU confirmed that a mere infringement of the GDPR does not give rise to the right to compensation in itself. Rather, the court confirmed that, as in all tort cases, there must be a breach, some damage and a causal link between the two. However, in an unexpected departure from the Advocate General's Opinion, the CJEU ruled that there is no requirement for the non-material damage suffered to reach a minimum threshold of seriousness in order to confer a right to compensation.

Accordingly, the position, in summary, following the judgment is that:

1. some damage or harm is required in order for a claimant to ground a claim for non-material loss; but

2. there is no de minimis level of damage prescribed for this.

In reality, given that non-material loss claims are, by their nature, psychological claims which are difficult to prove and assess, the judgment raises as many questions as it provides answers.

Background

In the Austrian Post case, the complainant brought proceedings in the Austrian courts seeking ?1,000 in compensation from Austrian Post for alleged non-material damage arising from the unlawful processing of his personal data, specifically relating to his supposed political affiliations. The complainant claimed that he did not consent to the collection of his data, and the fact that data relating to his supposed political affiliations were processed and retained by Austrian Post caused him great upset, a loss of confidence and a feeling of exposure. He was also offended by the specific political affinity attributed to him.

The Austrian court referred three questions for preliminary ruling by the CJEU:

1. Does the award of compensation under...