BEERG Newsletter - GDPR: How much compensation?

Davinia Brennan, Michael Byrne, and Samuel Elliott from Matheson, Dublin write: How much damage is some damage? CJEU finds some damage, but no minimum level of damage, is required for GDPR compensation claims.

Almost five years after the GDPR came into force, uncertainty prevails over the scope of the right to compensation for non-material damage under the GDPR. Prior to the GDPR, it was not possible for individuals (or groups of individuals) to recover damages for "non-material loss" i.e. pain, suffering and anxiety arising from breach of their data protection rights.

The issue has been subject to scrutiny recently before the Irish courts. The Irish Circuit Court, in Cunniam v Parcel Connect Limited & Ors [2023] IECC 1, granted a stay on proceedings brought by a data subject where non-material damages were alleged, pending the delivery of six decisions from the Court of Justice of the European Union ("CJEU") relating to compensation claims under the GDPR (discussed further here), effectively putting claims of this kind on hold for the time being.

The first of these six decisions was delivered on 4 May 2023, in UI v Österreichische Post AG (Case C-300/21) ("the Austrian Post case"). In its judgment, the CJEU confirmed that a mere infringement of the GDPR does not give rise to the right to compensation in itself. Rather, the court confirmed that, as in all tort cases, there must be a breach, some damage and a causal link between the two. 

However, in an unexpected departure from the Advocate General's Opinion, the CJEU ruled that there is no requirement for the non-material damage suffered to reach a minimum threshold of seriousness in order to confer a right to compensation. 

Read the full article here.