Data privacy litigation: CJEU brings clarity into non-material damages claims

Individual actions for non-material damages following alleged infringements of the European General Data Protection Regulation (GDPR) have seemingly become a mass claim phenomenon. In many cases, claimants seek compensation solely based on a feeling of discomfort resulting from, for example, the loss of control over their personal data. Such data mass claims, driven by specialised claim vehicles and litigation funders, have opened the door to questions around the definition of non-material damages and appropriate compensation.

With its long-awaited decision regarding non-material damages under Article 82 of the GDPR (UI v Österreichische Post AG, Case C-300/21), issued on 4 May 2023, the Court of Justice of the European Union (CJEU) set new thresholds for all non-material damages claims to come after the Advocate General Giovanni Pitruzella delivered his Opinion in Case C-340/21 on 27 April 2023, analysed by us here.

New thresholds for non-material damages claims

In its ruling, the CJEU provided some clarity on four key issues concerning non-material damages claims under Article 82 of the GDPR. However, the CJEU did not adopt the recommendations of Advocate General Campos Sánchez-Bordona entirely, analysed by us here. The CJEU addressed the issues on an abstract level and, therefore, the decision provides scope for interpretation to national courts.

1. No compensation is to be awarded without actual damage. The CJEU ruled that a mere ‘infringement’ of the GDPR provisions does not automatically give rise to the right to compensation from the controller. The individual must prove that they have suffered material or non-material damage resulting from the alleged infringement. There is no irrebuttable presumption of causality between the infringement of the GDPR and a (non-material) damage.
2. Article 82 of the GDPR serves the purpose of compensation, not punishment. The CJEU emphasised that punitive and deterrent functions are served by fines and penalties imposed by supervisory authorities and courts under Article 83 and 84 of the GDPR. In contrast, the right to compensation under Article 82 of the GDPR serves to compensate the losses suffered and it is not intended to create a right to punitive damages.
3. No threshold of seriousness for the constitution of damage. The CJEU concluded that Article 82 of the GDPR does not contain a requirement that non-material damage must reach a certain threshold of seriousness. Such a requirement is not contained in the wording of Article 82 of the GDPR and would adversely affect the coherence of the GDPR regime.
4. The assessment of the amount of damages is up to the national courts. The GDPR does not contain any provisions regarding the amount of damages to which an individual is entitled under Article 82 GDPR. This assessment is the responsibility of the national courts, which must, in particular, observe the European law principle of effectiveness, under which procedural rules governing the assessment of damages must not make it in practice impossible or excessively difficult to exercise rights under Article 82 GDPR.

Impact on GDPR mass claims

The CJEU ruling will likely have a significant impact on mass claims concerning non-material damages under the GDPR. Designed to serve as a reference point for future cases, it however remains to be seen how national courts will assess non-material damages. In any case, claimants seeking compensation under Article 82 of the GDPR will need to provide evidence of actual harm suffered.

Further, the CJEU did not go as far as the Advocate General’s Opinion and leaves it to national courts to determine whether ‘feelings of annoyance or discomfort’ resulting from, eg the ‘mere loss of control’, would constitute compensable non-material damage.