What can compensate a non-material damage caused by the infringement of the GDPR? Is a public apology enough? Does punitive damages exist under the GDPR? The CJEU had to answer these questions in a case involving the unlawful processing of a famous journalist’s personal data. Read our article to find out the answers to these questions.
ILF’s Hungarian member, Smartlegal Schmidt&Partners summarizes this issue in the article.
- Facts
The Latvian Consumer Rights Protection Centre („Centre”) ran a campaign to raise consumer awareness of the risks of buying second-hand cars. In the campaign the Centre distributed a video featuring a character imitating the applicant who is a well-known journalist („Applicant”).
As the Centre did not cease the distribution of the video despite the Applicant’s request, the Applicant sued the Centre seeking compensation for non-material damage in the form of an apology and the payment of EUR 2000.
Both the first and second instance courts[i] found that processing of the Applicant’s personal data by the Centre was unlawful and ordered the Centre to make a public apology. While the first instance court ordered the Centre to pay EUR 100 in compensation for non-material damages, the second instance court rejected the Applicant’s claim for financial compensation.
The Applicant lodged an appeal on a point of law with the Latvian Supreme Court which stayed the proceedings and referred the case to the Court of Justice of the European Union in order to interpret Article 82 of the GDPR[ii].
- GDPR infringement = damage?
By its first question, the referring court wanted to know what the CJEU had already been asked on several occasions: if a GDPR-infringement in itself is sufficient to constitute damage within the meaning of Article 82 of the GDPR.
The Court recalled its practice[iii] that the mere infringement of the GDPR is not sufficient to confer a right to compensation. Indeed, the right to compensation has three cumulative conditions:
- the infringement of the GDPR,
- the existence of a (material or non-material) damage,
- a casual link between the GDPR-infringement and the damage.
The above interpretation is supported by the recitals[iv] of the GDPR, as it is apparent from them that the occurrence of a damage in only a potential and not an automatic consequence of the unlawful processing.
- Is an apology enough?
Further, the Latvian Supreme Court asked the CJEU if the making of an apology may constitute sufficient compensation for non-material damage in accordance with Article 82 of the GDPR.
The Luxembourg Court remined that the criteria for assessing the compensation due under Article 82 must be prescribed within the legal system of each Member State, provided that such compensation is full and effective.
The CJEU already held that where the damage suffered by the data subject is not serious, the national court may compensate for it by awarding minimal compensation provided that the small amount of damages granted can offset in full the damage.[v]
According to the Court, based on Article 82 of the GDPR the making of an apology may be able to constitute a standalone or supplementary compensation for non-material damage.
- Is the motivation of the controller relevant?
Last but not least, the CJEU had to clarify if factors like the motivation or the attitude of the controller may be taken into account in order to award compensation which is lower than the damage actually suffered by the data subject.
The Court pointed out that in relation to administrative fines which have punitive function, the attitude and motivation of the controller should be taken into account as an aggravating or mitigating factor.
Since the right to compensation has exclusively compensatory and not punitive functions, circumstances like the severity and possible intentional nature of the infringement cannot influence the amount of damages.[vi]
Similarly, given the exclusively compensatory function of the right to compensation, the controller’s attitude and motivation cannot be taken into account when deciding on the level of compensation.
- Comment
The most important takeaway of the CJEU’ judgement is that the right to compensation has compensatory and not punitive function. This means that the attitude or motivation of the controller cannot be a decisive factor when ordering damages. However, in some cases, where the data subject’s damages are not significant, an apology may be sufficient to compensate for the damage, if the legal system of the Member State concerned provides for such compensation.
In this article we analysed the judgement C-507/23 of the CJEU.
Written by Anita Vereb
SMARTLEGAL is a team of agile business & litigation lawyers in Budapest, Hungary, helping international corporate clients and individual entrepreneurs doing business in Hungary. For more information please visit our website at this link.