News from the ECJ on the claim for damages under Art. 82 GDPR or how can concerns be proven as damage?

In Case C-590/22 of June 20, 2024 (essentially referring to Case C-300/21 of May 4, 2023, Österreichische Post), the ECJ confirmed its view, which can now be regarded as established case law, that a claim for damages exists if there has been a breach of the GDPR, damage has occurred and there is a causal link in this regard. Damage does not only exist when this has reached a certain degree of severity. With reference to Case C- 741 of 11 April 2024, it emphasizes that the data subject must also prove the damage.

According to the ECJ, the fear of a data subject triggered by a breach of the GDPR that their personal data could be misused by third parties can in itself constitute “non-material damage” within the meaning of Art. 82(1) (see, to this effect, judgments of December 14, 2023, Natsionalna agentsia za prihodite, C-340/21, EU:C:2023:986, paragraphs 79 to 86, and of January 25, 2024, MediaMarktSaturn, C-687/21, EU:C:2024:72, paragraph 65). The concern justified by a loss of control – even if only temporary – could be sufficient for this. However, the data subject must prove this specific damage. The mere assertion of a concern without proven negative consequences can therefore not lead to compensation under this provision.

It follows that the criteria for determining the amounts of fines set out in Art. 83 GDPR, which are also mentioned in the 148th Recital of that regulation, cannot be used to assess the amount of damages under Art. 82 GDPR (judgment of 11 April 2024, juris, C-741/21, EU:C:2024:288, para. 57).

Finally, the ECJ states that Article 82(1) GDPR must be interpreted as meaning that
when assessing the amount of the claim for damages based on that provision, first, the criteria for determining the amount of fines provided for in Article 83 of that regulation are not to be applied mutatis mutandis and, second, that claim for damages is not to be regarded as having a deterrent function.

It remains to be seen when the courts will assume that a concern has been sufficiently proven as damage. In the case of standardized letters, the national courts have so far been reluctant.