On 6 October 2022, the Advocate General (Campos Sánchez-Bordona) issued his opinion in UI v Österreichische Post AG on the interpretation of the rules on civil liability under the GDPR .
He concluded that a data subject must have suffered harm in order to claim compensation, and that breach of the GDPR alone was not sufficient. There is also a distinction to be drawn between mere upset (which does not give rise to a right for compensation) and non-material damage (which does).
The case concerns Österreichische Post, the Austrian postal service, which collected information on the applicant and deployed an algorithm which classified them as a possible target for election advertising from a certain political party. The applicant claimed compensation of EUR 1,000 for non-material damage, claiming the processing of their personal data without consent in this way had caused upset and reputational damage.
The first and second instance Austrian courts rejected the applicant’s claim for compensation and the decision was appealed to the Supreme Court of Austria (Oberster Gerichtshof), who referred a number of questions to the CJEU.
Damage as a pre-requisite to compensation:
One of the questions referred to the Advocate General was whether the applicant must have suffered harm to give rise to a right to compensation under Article 82(1) of the GDPR, or whether the breach of the GDPR was sufficient in itself.
Article 82(1) states that “any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.”
The Advocate General stated that damage is an essential element of civil liability, and that breach of the GDPR does not automatically give rise to a claim for compensation, if the infringement is not accompanied by material or non-material damage. Loss of control over personal data does not necessarily constitute damage by itself.
Upset as non-material damage:
The Advocate General was also asked whether compensation for non-material damage is conditional on an “infringement of at least some weight that goes beyond the upset caused by that infringement”.
He noted that all infringements of the GDPR are likely to cause a negative reaction on the part of the data subject, but that “mere upset” alone does not entitle an applicant to compensation. A fine line needs to be drawn between mere upset or inconvenience and ‘non-material damage’ (which is eligible for compensation). It is for the courts of the Member States to draw this distinction on the facts of each case.
The CJEU is expected to issue its judgement shortly, and whilst the CJEU is not bound to follow the Advocate General’s opinion, it is often influential to the CJEU’s decision.