ECJ on Data Protection: No Materiality Threshold for Damages

A breach of the General Data Protection Regulation (GDPR) alone is not sufficient to give rise to a claim for compensation for non-material damage. In the opinion of the ECJ, damage must actually have occurred to the person concerned. However, this damage need not exceed a “materiality threshold.”

In its judgment of May 4, 2023 (Case No.: C-300/21), the ECJ for the first time commented on a question that had been highly controversial, especially before German courts: the prerequisites for a claim for damages under Art. 82 GDPR .

The ECJ has clarified that a claim for damages under the GDPR is subject to three conditions:

• a breach of provisions of the GDPR,
• the occurrence of material or immaterial damage, and
• the causality between the breach and the damage.

A mere violation of the GDPR is thus expressly not sufficient to establish a claim for damages, as the occurrence of a causal damage must be proven in each case.

No materiality threshold – even minor damage must be compensated for

However, this damage does not have to exceed a materiality threshold. The Court justifies this, among other things, by stating that the application of a corresponding de minimis limit would entail a significant risk of divergent case law and would thus run counter to the objective of maintaining a uniform level of data protection within the Member States, as set out in recital 10 of the GDPR.

The amount of damages is in principle subject to national law, provided that the principles of equivalence and effectiveness are observed. Financial compensation must fully compensate for the damage suffered as a result of the infringement. The claim does not have a punitive character.

The courts must decide at what point damage exists

The fact that plaintiffs must also prove concrete damage for a claim for damages is to be welcomed. However, it is not always clear at what point non-material damage is to be assumed. The determination of this remains the responsibility of the national courts. It remains to be seen whether the “subjective feeling of dissatisfaction” of the affected parties due to a GDPR violation, which is often cited in German case law, will be sufficient to establish that damages are compensable. The ECJ ruling does not provide any concrete answers to this question. Consequently, the presentation of a corresponding damage, which will be required by the courts in the future, will be decisive.

An increase in mass litigation must be expected

The clear denial of a materiality threshold tends to play into the hands of warning law firms and other service providers in the field of mass actions. In addition, German lawmakers are planning to implement the EU directive on collective actions this year. This means that consumer associations will also be able to sue directly for damages with the so-called remedial action for consumers. As a result, an increase in mass lawsuits related to GDPR violations is also to be expected. Affected companies are therefore likely to increasingly turn to legal tech products to fend off mass lawsuits.

Conclusion

Company executives should address the organizational and strategic challenges of mass litigation at an early stage. Again, better safe than sorry. The ECJ ruling has once again increased the financial risks associated with data privacy breaches. Companies should therefore continue to focus on establishing and expanding solid data protection management systems, including adequate handling of data subjects’ rights and data protection incidents, in order to prevent fines and claims for damages as far as possible.