GDPR enforcement: Advocate General tends towards restrictive interpretation of non-material damages

Besides administrative fines and data subject access right, claims for damages under Article 82(1) GDPR are among the most debated issues when interpreting and applying EU data protection law. The European Court of Justice (ECJ) currently has to deal with a total of 9 cases in this context. In the first case (ECJ C-300/21 - Österreichische Post), the EU Advocate General has now presented his opinion, which rejects an extensive interpretation of the provision.

Background

On 12 May 2021, the Austrian Supreme Court of Justice (Oberster Gerichtshof) referred several questions to the ECJ in the case “UI v Österreichische Post”. The background of the case was as follows: Österreichische Post AG publishes address directories. In the course of an election, it also collected information on political party affinities of the Austrian population and defined ‘target group addresses’ with the assistance of an algorithm according to certain socio-demographic features. The claimant, who had not consented to the processing of his personal data for this purpose, was upset by the storage of his party affinity data and angered and offended by the affinity specifically attributed to him. He therefore claimed compensation of EUR 1,000 in respect to his “​inner discomfort".

The Supreme Court of Justice now had to decide whether this inner discomfort was in itself sufficient to constitute a claim for damages and, if so, how its amount should be assessed. It therefore submitted the following questions to the ECJ:

1. Does the award of compensation also require that an applicant must have suffered harm, or is the mere infringement of provisions of the GDPR in itself sufficient for the award of compensation?
2. Does the assessment of the compensation depend on further requirements in addition to the principles of effectiveness and equivalence?
3. Does EU law require an infringement of at least some weight of at least some weight that goes beyond the mere upset caused by that infringement?

In his opinion of 6 October 2022, the EU Advocate General Manuel Campos Sánchez-Bordona informed the ECJ of his view and suggested how these questions should be answered.

On the 1st question: No punitive or deterring nature of GDPR damages

With regard to the first question, the Advocate General states that "a mere infringement of the [GDPR] is not in itself sufficient if that infringement is not accompanied by the relevant material or non-material damage". This can already derived from the from the wording of Article 82(1) GDPR which literally mentions "suffered" damages "as a result of" an infringement.

Moreover, the GDPR does not "allow punitive damages to be awarded", which might have led to a different assessment. He justifies this on the grounds that the primary aim of the civil liability is to compensate for damages. The Advocate General explicitly states that compensation for material or non-material damages under Article 82(1) GDPR neither has a punitive nature nor must such damages act as a deterrent since this effect is attributed to criminal penalties and administrative fines.

Furthermore, Article 82(1) GDPR should not be understood in a way of an "irrebuttable presumption of damage", once an infringement of the GDPR has occurred. According to the Advocate General it does not follow from the GDPR "that its objective is to grant data subjects control over their personal data as a right in itself, or that data subjects must have the greatest control possible over those data". The aim of the GDPR shall not be "to limit systematically the processing of personal data but rather to legitimise it under strict conditions". This also has a direct impact on the burden of proof, as "it remains to be seen (and must be proved [by the data subject]) whether or not the data subject has also suffered damage".

On the 2nd question: Damages do not include punitive damages, but (only) compensation for private damages

On the second question of the Supreme Court of Justice on whether the assessment of the compensation depends on further EU-law requirements in addition to the principles of effectiveness and equivalence, the Advocate General notes that both the principle of equivalence as well as the principle of effectiveness "do not appear to play an important role" for Article 82 GDPR. Since, as stated in question 1, punitive damages are not included, compensation (only) has a "private compensatory function", which, according to the adjectives "full" and "effective", firstly depends on what claim was put forward by each applicant. Here, it should be borne in mind, that "if the applicant claims that he or she has suffered financial damage, […] the difficulty in proving the damage must not result in nominal damages". 

On the 3rd question: A mere annoyance or upset does not constitute damage, but strong negative feelings do

The third question, whether an "infringement of at least some weight" is conditional, is confirmed by the Advocate General, who holds that "the compensation for non-material damage […] does not cover mere upset which the person concerned may feel as a result of the infringement".

The recitals 75 and 85 as well as 146 would not be helpful in assessing this. The question is anyway to be understood as whether a "lower limit" exists, "below which that person will not be awarded compensation". In such case the "distinction […] between non-material damage for which compensation may be awarded and other inconveniences arising as a result of abuse of the law which, owing to their insignificance, do not necessarily create the right to compensation" would be an "inevitable corollary of life in society". Therefore, Article 82 GDPR shall be no "suitable instrument for countering infringements in connection with the processing of personal data where all those infringements create for the data subject is annoyance or upset".

The "difficult task […] to determine when, owing to its characteristics, a subjective feeling of displeasure may be deemed, in each case, to be non-material damage" shall be the responsibility of the national courts. In doing so, the Advocate General concedes, "that there is a fine line between mere upset (which is not eligible for compensation) and genuine non-material damage (which is eligible for compensation) and [that he is] aware of how complicated it is to delimit […] the two categories".

Practical impact of the EU Advocate General’s opinion

The Advocate General has presented the ECJ with a very well-reasoned opinion using basic and acknowledged legal methods of interpretation. In doing so, he contradicts an extensive interpretation of Article 82 GDPR and takes into account the meaning and purpose of data protection as well as the needs of a digital society.

The argumentation of the Advocate General could be crucial for at least two reasons. Firstly, it is in direct contrast to case law, which awards compensation for damages even without proof of any actual damage arguing with a supposed deterring and sanctioning effect of GDPR damages. Secondly, after a data breach, affected data subjects still need to prove what damages they may have suffered from the data breach beyond the mere loss of control over their personal data. Whether the mere possibility of identity theft after a data breach would be sufficient to give rise to non-material damages (see for example Regional Court of Cologne, decision dated 18 May 2022, case number 28 O 328/21 – EUR 1,200; Regional Court of Munich I, decision dated 9 December 2021, case number 31 O 16606/20 – EUR 2,500) remains to be seen and could be very well challenged. Awarding non-material damages for delayed or incomplete reactions to data subject access request (see for example Labour Court of Düsseldorf, decision dated 5 March 2020, case number 9 Ca 6557/18 – total amount of EUR 5,000; Regional Labour Court of Hamm, decision dated 11 May 2021, case number 6 Sa 1260/20 – EUR 1,000), for unsolicited marketing emails (Local Court of Pfaffenhofen/Ilm, decision dated 9 September 2021, case number 2 C 133/21 – EUR 300) or the mere transfer of an IP-Address to a country outside the EU (Regional Court of Munich I, decision dated 20 January 2022, case number 3 O 17493/20 – EUR 100) would definitely not be possible anymore if the ECJ follows the Advocate General’s opinion.

It should be noted that the Advocate General’s opinion is only a proposal to the ECJ and has no legally binding effect. However, the ECJ has shown a tendency in the past to follow well-argued opinions. If the ECJ were to follow this opinion, the Austrian Supreme Court would have to reconsider whether the political affinity attributed to the claimant was indeed damaging to his reputation and whether his feeling of "great upset and a loss of confidence" crossed this line. The special category of personal data revealing a political opinion within the meaning of Art. 9(1) GDPR is also likely to play an important role in this context.