Highest EU court will decide on GDPR damages

When dealing with a civil action for non-material damages under Article 82 (1) General Data Protection Regulation (“GDPR”), the Supreme Court of Justice (Oberster Gerichtshof – “OGH”) of the Republic of Austria decided to refer the following questions to the Court of Justice of the European Union (“CJEU”).

1. Does awarding compensation under Article 82 GDPR require, in addition to an infringement of provisions of the GDPR, that the plaintiff has suffered a damage, or is the infringement of provisions of the GDPR itself sufficient for a compensation?
2. Are there additional requirements under EU law for the determination of compensation for damages in addition to the principles of effectiveness and equivalence?
3. Is the position compatible with EU law that it is a requirement for awarding compensation for non-material damages that there is any consequence or effect of the infringement of at least some gravity which goes beyond the mere nuisance caused by the infringement?

Facts of the case

The plaintiff was affected by a data privacy scandal at the Austrian postal service, which revealed that the postal service processed and sold information on the political affiliation of the entire Austrian population. The plaintiff was angry about this because he was attributed a “high affinity” to the FPÖ, an extremely right-wing political party. He was therefore of the opinion that he was entitled to compensation for non-material damages by the Austrian Post in the amount of EUR 1,000 due to his great inner discomfort. After the Vienna Regional Court and the Vienna Higher Regional Court dismissed the claim for compensation for lack of serious detriment, the Austrian Supreme Court of Justice in Vienna, as the court of last instance in Austria, had to decide.

Decision

Although the Austrian Supreme Court expressly did not share the position of the German Federal Constitutional Court that the dismissal of a claim based on Article 82 (1) GDPR for lack of serious detriment is inadmissible without a CJEU referral (see decision dated 14 January 2021, case number 1 BvR 2853/19), it referred the question of the threshold for such a claim for compensation to the CJEU. Obtaining a preliminary ruling is however considered to be in the interest of a uniform application of EU law.

In its decision, the Austrian Supreme Court first analyses the state of the discussion in case law and legal literature - also taking sources from Germany into account. The judges indicate that they assume that the EU legislator, when establishing liability for non-material damages, clearly did not have in mind that minimal effects on the emotional state of the individual affected by a GDPR infringement should trigger such a claim. The result of the interpretation sought by the plaintiff, that because of the effet utile even negligible emotional effects should allow for compensation, would lead to punitive damages beyond the idea of compensation, which is generally alien to EU law.

Practical impact

It is a very positive development that the Austrian Supreme Court has taken the opportunity to present one of the currently most controversial issues of GDPR litigation to the CJEU for clarification: When is a data subject entitled to compensation for non-material damage in the event of an infringement of the GDPR? This question is currently answered in very different ways in German case law on Article 82 GDPR and should therefore urgently be clarified for reasons of legal certainty.

The first of the submitted questions is easy to answer due to the clear wording of Article 82 (1) GDPR ("Any person who has suffered a [...] non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation [...]"). Of course, the infringement as such is not sufficient for entitlement to compensation. Such a claim only arises if the infringement has also caused (at least non-material) harm.

The focus is therefore on the second and third question and thus on determining under what circumstances a data subject actually suffers non-material harm at all. Is an alleged, merely individually perceived inconvenience sufficient or is an objectively comprehensible impairment with a certain weight required? Since the intention behind Article 82 GDPR is not to introduce U.S.-style punitive damages (see for example Dresden Higher Regional Court, decision dated 11 June 2019, case number 4 U 760/19; Frankfurt Regional Court, decision dated 18 August 2020, case number 2-27 O 100/20), there is reason to favour the latter interpretation. If the bar for non-material damages was set too low, this would surely give rise to a new plaintiff industry and would trigger a Diesel-like wave of litigation after every major data breach. Until the CJEU renders its decision, German courts now have the possibility to adjourn GDPR damage cases in accordance with Section 148 (1) of the German Code of Civil Procedure (cf. Ingolstadt Regional Court, decision dated 18 June 2020, case number 72 O 712/19 for the option adjourn cases when questions about the interpretation of the GDPR are pending with the CJEU).