After the request for a preliminary ruling issued by the Austrian Supreme Court on 15 April 2021 in respect of 6 Ob 35/21x [Österreichische Post AG - see also KWR Blog of 18 April 2023 Emotional Damage | KWR ], the decision of the ECJ is now available after a long wait. In its decision in case C-300/21, the ECJ clarified that not every breach of the GDPR gives rise to compensation for material or immaterial damage. Furthermore, the ECJ ruled that no so-called materiality threshold may be applied in the case of immaterial damage.
Background
The defendant in the main proceedings was the Austrian Postal Services, which collected information on the political affinities of the Austrian population. These were determined by means of statistical extrapolation based on social and demographic characteristics. The Austrian Postal Services attributed a high degree of political affinity to an extreme right-wing political party to the plaintiff. Related data were not transmitted to third parties. The plaintiff had not given his consent to the processing of his personal data for this purpose.
The plaintiff felt insulted and angered by the fact that he was attributed a tendency towards an extreme right-wing party. He claimed that this had led to a loss of confidence in him and had caused him to feel exposed.
According to Austrian law, compensation for immaterial damage must generally exceed a so-called "materiality threshold" in order for an entitlement to damages to be affirmed. Does this threshold also apply to violations of the GDPR and was this threshold reached in the present case?
As the Supreme Court had doubts in its decision-making, it requested the ECJ to clarify open questions concerning the requirements for an entitlement to compensation for (immaterial) damage under the GDPR. In summary, it wanted to know whether every infringement of the GDPR would gives rise to damages, whether the abovementioned "materiality threshold" could be applied by national courts and how the amount of damages should be assessed.
Not every breach of the GDPR gives rise to damages
The ECJ ruled that not every breach of the GDPR would automatically entitle to damages. The ECJ referred to the wording of Art. 82 GDPR. The following three conditions must be met for an entitlement to damages in the event of a GDPR breach:
- breach of the GDPR and
- (immaterial) damage and
- causality.
No materiality threshold
According to the tenth recital of the GDPR, the aim is to ensure a consistent and high level of protection of individuals with regard to the processing of personal data within the Union. To this end, the goal is to ensure uniform and consistent application of the rules throughout the Union. If national courts were allowed to make the claim for compensation for immaterial damage dependent on a materiality threshold, there would be a risk of divergent jurisprudence in the Member States. A uniform level of data protection would thus no longer be guaranteed. Therefore, according to the ECJ, no materiality threshold must be applied in court practice.
Assessment of damage
The GDPR does not contain any rules for determining the amount of damages. According to the established case law of the ECJ, national law must be applied in the absence of Union law provisions. Taking these two principles into account, the national provisions of the individual Member States are to be applied for the assessment of the amount of damages.
The KWR Data Protection Team will be happy to answer any questions you may have.