09.05.2023 | KPMG Law Insights

ECJ on Data Protection: No Materiality Threshold for Damages

A breach of the General Data Protection Regulation (GDPR) alone is not sufficient to give rise to a claim for compensation for non-material damage. In the opinion of the ECJ, damage must actually have occurred to the person concerned. However, this damage need not exceed a “materiality threshold.”

In its judgment of May 4, 2023 (Case No.: C-300/21), the ECJ for the first time commented on a question that had been highly controversial, especially before German courts: the prerequisites for a claim for damages under Art. 82 GDPR .

The ECJ has clarified that a claim for damages under the GDPR is subject to three conditions:

  • a breach of provisions of the GDPR,
  • the occurrence of material or immaterial damage, and
  • the causality between the breach and the damage.

A mere violation of the GDPR is thus expressly not sufficient to establish a claim for damages, as the occurrence of a causal damage must be proven in each case.

No materiality threshold – even minor damage must be compensated for

However, this damage does not have to exceed a materiality threshold. The Court justifies this, among other things, by stating that the application of a corresponding de minimis limit would entail a significant risk of divergent case law and would thus run counter to the objective of maintaining a uniform level of data protection within the Member States, as set out in recital 10 of the GDPR.

The amount of damages is in principle subject to national law, provided that the principles of equivalence and effectiveness are observed. Financial compensation must fully compensate for the damage suffered as a result of the infringement. The claim does not have a punitive character.

The courts must decide at what point damage exists

The fact that plaintiffs must also prove concrete damage for a claim for damages is to be welcomed. However, it is not always clear at what point non-material damage is to be assumed. The determination of this remains the responsibility of the national courts. It remains to be seen whether the “subjective feeling of dissatisfaction” of the affected parties due to a GDPR violation, which is often cited in German case law, will be sufficient to establish that damages are compensable. The ECJ ruling does not provide any concrete answers to this question. Consequently, the presentation of a corresponding damage, which will be required by the courts in the future, will be decisive.

An increase in mass litigation must be expected

The clear denial of a materiality threshold tends to play into the hands of warning law firms and other service providers in the field of mass actions. In addition, German lawmakers are planning to implement the EU directive on collective actions this year. This means that consumer associations will also be able to sue directly for damages with the so-called remedial action for consumers. As a result, an increase in mass lawsuits related to GDPR violations is also to be expected. Affected companies are therefore likely to increasingly turn to legal tech products to fend off mass lawsuits.


Company executives should address the organizational and strategic challenges of mass litigation at an early stage. Again, better safe than sorry. The ECJ ruling has once again increased the financial risks associated with data privacy breaches. Companies should therefore continue to focus on establishing and expanding solid data protection management systems, including adequate handling of data subjects’ rights and data protection incidents, in order to prevent fines and claims for damages as far as possible.

Explore #more

21.02.2024 | KPMG Law Insights, KPMG Law Insights

The Digital Services Act – what does it mean for companies?

The Digital Services Act (DSA) is a key component of the EU’s digital strategy and came into force on November 16, 2022. As a regulation,…

15.02.2024 | KPMG Law Insights

Data compliance management: How to implement it in practice

Part 3 of the article series “Professional tips for data compliance management”   The third part of this series of articles deals with data compliance

14.02.2024 | PR Publications

Guest article in ZURe: Monitoring the implementation of the LkSG

The current issue of ZURe (p. 20 ff.) contains a guest article by KPMG Law Partner Thomas Uhlig (Head of General Business and Commercial Law),…

14.02.2024 | KPMG Law Insights

The AI Act is coming: EU wants to get a grip on AI risks

For many people, artificial intelligence (AI) is the great hope for business, healthcare and science. But there are also plenty of critics who fear the…

09.02.2024 | KPMG Law Insights

Podcast series “KPMG Law on air”: The employment law function

In almost all German companies, the employment law function is located in the HR department and not in the legal department. One of the reasons…

02.02.2024 | KPMG Law Insights

CSDDD: Provisional agreement on the EU Supply Chain Directive

On December 14, 2023, the Council and the European Parliament reached a provisional political agreement on the EU Corporate Sustainability Due Diligence Directive (CSDDD). This…

01.02.2024 | KPMG Law Insights

Podcast series “KPMG Law on air”: Fair play in eSports

eSports is a billion-dollar market that is growing rapidly. This makes it all the more important for the economic players involved to comply with applicable…

24.01.2024 | KPMG Law Insights

How the new unitary patent works – ten facts

The new unitary patent can be applied for at the European Patent Office (EPO) from June 1, 2023. The Implementing Regulations and the Schedule of

22.01.2024 | PR Publications

Guest article in the Börsen-Zeitung on the subject of EU antitrust regulations

Agreements with competitors on sustainability efforts may violate antitrust law. Which legal interest should then take precedence? KPMG Law expert Jonas Brueckner discusses this question…

18.01.2024 | KPMG Law Insights

AI and copyright – what is permitted when using LLMs?

A few months ago, new players entered the legal scene and have since caused numerous legal discussions: Large Language Models (LLM), better known as…


Francois Heynike, LL.M. (Stellenbosch)

Head of Technology Law

THE SQUAIRE Am Flughafen
60549 Frankfurt am Main

tel: +49-69-951195770

© 2024 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit

 KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.