09.05.2023 | KPMG Law Insights

ECJ on Data Protection: No Materiality Threshold for Damages

A breach of the General Data Protection Regulation (GDPR) alone is not sufficient to give rise to a claim for compensation for non-material damage. In the opinion of the ECJ, damage must actually have occurred to the person concerned. However, this damage need not exceed a “materiality threshold.”

In its judgment of May 4, 2023 (Case No.: C-300/21), the ECJ for the first time commented on a question that had been highly controversial, especially before German courts: the prerequisites for a claim for damages under Art. 82 GDPR .

The ECJ has clarified that a claim for damages under the GDPR is subject to three conditions:

  • a breach of provisions of the GDPR,
  • the occurrence of material or immaterial damage, and
  • the causality between the breach and the damage.

A mere violation of the GDPR is thus expressly not sufficient to establish a claim for damages, as the occurrence of a causal damage must be proven in each case.

No materiality threshold – even minor damage must be compensated for

However, this damage does not have to exceed a materiality threshold. The Court justifies this, among other things, by stating that the application of a corresponding de minimis limit would entail a significant risk of divergent case law and would thus run counter to the objective of maintaining a uniform level of data protection within the Member States, as set out in recital 10 of the GDPR.

The amount of damages is in principle subject to national law, provided that the principles of equivalence and effectiveness are observed. Financial compensation must fully compensate for the damage suffered as a result of the infringement. The claim does not have a punitive character.

The courts must decide at what point damage exists

The fact that plaintiffs must also prove concrete damage for a claim for damages is to be welcomed. However, it is not always clear at what point non-material damage is to be assumed. The determination of this remains the responsibility of the national courts. It remains to be seen whether the “subjective feeling of dissatisfaction” of the affected parties due to a GDPR violation, which is often cited in German case law, will be sufficient to establish that damages are compensable. The ECJ ruling does not provide any concrete answers to this question. Consequently, the presentation of a corresponding damage, which will be required by the courts in the future, will be decisive.

An increase in mass litigation must be expected

The clear denial of a materiality threshold tends to play into the hands of warning law firms and other service providers in the field of mass actions. In addition, German lawmakers are planning to implement the EU directive on collective actions this year. This means that consumer associations will also be able to sue directly for damages with the so-called remedial action for consumers. As a result, an increase in mass lawsuits related to GDPR violations is also to be expected. Affected companies are therefore likely to increasingly turn to legal tech products to fend off mass lawsuits.


Company executives should address the organizational and strategic challenges of mass litigation at an early stage. Again, better safe than sorry. The ECJ ruling has once again increased the financial risks associated with data privacy breaches. Companies should therefore continue to focus on establishing and expanding solid data protection management systems, including adequate handling of data subjects’ rights and data protection incidents, in order to prevent fines and claims for damages as far as possible.

Explore #more

13.06.2024 | Press releases

Handelsblatt and Best Lawyers honor KPMG Law Experts

Best Lawyers has once again identified the best commercial lawyers in Germany for 2024 exclusively for Handelsblatt. A total of 28 lawyers were honored by…

27.05.2024 | KPMG Law Insights

Agreement on ecodesign regulation: products to become more sustainable

After lengthy negotiations, the Council and Parliament of the European Union reached a provisional agreement on the Ecodesign Regulation on the night of December 5,…

22.05.2024 | KPMG Law Insights

The AI Act is coming: EU wants to get a grip on AI risks

For many people, artificial intelligence (AI) is the great hope for business, healthcare and science. But there are also plenty of critics who fear the…

17.05.2024 | KPMG Law Insights

Podcast series “KPMG Law on air”: When the family business is to be sold

Around 38,000 family businesses are currently handed over each year. In most cases, the change of ownership takes place within the family. But more and…

03.05.2024 | KPMG Law Insights

Doubts about inability to work? What employers can do

The certificate of incapacity for work (AU certificate) serves as proof of incapacity for work due to illness. However, only if the certificate meets certain…

27.03.2024 | KPMG Law Insights

EU Buildings Directive: life cycle greenhouse potential becomes relevant

On March 12, 2024, the EU Parliament approved the amendment to the EU Buildings Directive. The directive obliges member states and, indirectly, building owners and…

19.03.2024 | Business Performance & Resilience, KPMG Law Insights

CSDDD: Provisional agreement on the EU Supply Chain Directive

The EU member states agreed on the CSDDD, the EU Supply Chain Directive, on March 15, 2024. Germany abstained from the vote. Negotiators from the…

21.02.2024 | KPMG Law Insights, KPMG Law Insights

The Digital Services Act – what does it mean for companies?

The Digital Services Act (DSA) is a key component of the EU’s digital strategy and came into force on November 16, 2022. As a regulation,…

15.02.2024 | KPMG Law Insights

Data compliance management: How to implement it in practice

Part 3 of the article series “Professional tips for data compliance management”   The third part of this series of articles deals with data compliance

14.02.2024 | Business Performance & Resilience, PR Publications

Guest article in ZURe: Monitoring the implementation of the LkSG

The current issue of ZURe (p. 20 ff.) contains a guest article by KPMG Law Partner Thomas Uhlig (Head of General Business and Commercial Law),…


Francois Heynike, LL.M. (Stellenbosch)

Head of Technology Law

THE SQUAIRE Am Flughafen
60549 Frankfurt am Main

tel: +49-69-951195770

© 2024 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit

 KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.