A GDPR infringement alone is not enough: CJEU on damages

In Case C-300/21, Österreichische Post (Austrian Post) had used an algorithm to determine individuals' affinity with political parties. One person concerned felt exposed by this, experienced annoyance and a loss of trust, and claimed 1,000 euros in non-material damages, although his data had not been passed on to third parties. The Austrian Supreme Court (Oberster Gerichtshof) referred several questions on Art. 82 GDPR to the CJEU (EuGH).

In its judgment of 4.5.2023, the Court ruled that a mere infringement of the GDPR is not sufficient for a claim for damages. Three conditions must be met together: an infringement, damage actually suffered and a causal link between the two. The infringement of data protection provisions alone therefore does not yet give rise to a claim.

At the same time, the Court put an end to a practice widespread in German courts: compensation for non-material damage is not limited to damage that reaches a certain degree of seriousness. Even minor damage that has actually been suffered can be compensated. However, anyone relying on damage must still prove that the negative consequences of the infringement actually constitute non-material damage — merely unpleasant feelings that accompany practically every infringement are not sufficient for this in themselves.

As to the amount of damages, the Court clarifies: in the absence of uniform EU rules, how damage is assessed is governed by the law of the individual Member States, in this case German law. The compensation must be full and effective, i.e. actually compensate for the damage specifically suffered. By contrast, the GDPR does not require punitive damages that go beyond compensation and are additionally intended to deter. This explains why German courts tend to award rather moderate amounts in comparable cases.

For those affected, this means: anyone claiming damages must set out specific damage, however small — no more, but also no less. The BGH (Federal Court of Justice) has built on this by recognising the mere loss of control as damage (judgment of 18.11.2024 – VI ZR 10/24).