What is the case about ?

The Austrian Postal Service started generating in 2017 statistics about data subjects’ political affinities based on social and demographic characteristics such as addresses. The collected data was traded to other entities for targeted advertising. The claimant in this case was a subject who, according to the statistical extrapolation, was presumed to be affiliated with a certain political party. Regardless of his information being disclosed or not to third parties, the claimant had not consented to this processing. Therefore, he argued that the storage of such data regarding his probable political affiliations was illegal and caused him emotional damages. His claims were that such processing caused him great upset, a loss of confidence as well as a feeling of being exposed.

An action against the Austrian Post was thus brought by the claimant in order to stop the processing in question and to obtain a payment as compensation for the emotional damages. This case was presented before the Austrian Supreme Court, which then formed a preliminary question to ask the ECJ for clarification on whether there’s a“threshold” for damage claims, meaning if serious harm must be proven in order to claim compensation under the GDPR.

GDPR damages: what are the conditions according to the ECJ?

This was the first ECJ decision to confirm that the claim for non-material damages does not require a certain threshold of seriousness to be met, which is in accordance with the broad interpretation of the “damage” concept of the GDPR. In other words, there is not a level of seriousness required for the emotional impact to be qualified as damage.

However, subjects alleging a GDPR infringement must demonstrate that the violation of the GDPR caused them a non-material damage. The Court establishes that a mere violation of the GDPR does not automatically triggers a right to compensation.

The right to compensation provided by the GDPR is subject to three cumulative conditions : a violation of the GDPR, material or moral damage as a consequence of this violation and a link between the damage and the violation. This differs from administrative fines in the context of public enforcement in which the existence of material or emotional damages does not have to be demonstrated.

Finally, the GDPR lacks provisions defining the rules on the assessment of the damages resulting from an infringement thus giving an individual a right to compensation. Therefore, the ECJ decision highlights that each member state is responsible for establishing specific regulations regarding actions for safeguarding damage claims under Article 82 GDPR. These national regulations must include rules for determining the compensation amount in different cases. Certain principles like equivalence and effectiveness must still observed in those national regulations. The ECJ emphasizes how the GDPR is an instrument aiming to ensure “full and effective” compensation for the disputed damage.

What to remember from this decision ?

The ECJ denied a minimum threshold for GDPR damages. The possibility of emotional damage resulting from a GDPR violation is confirmed but framed by the existence of a link between these two elements. National legislations must define rules for a full and effective compensation in such cases.