Data Breach Claims – A Turning of the Tide?
Wednesday 23rd November 2022
The EU Advocate General (AG) recently gave his opinion on a claim for non-material damages under the General Data Protection Regulation (GDPR) in the European Union.
What is the current position?
Individuals have the right to receive compensation if they have suffered material or non-material damage as a result of an infringement of GDPR.
What does non-material damage mean?
In the UK, “non-material damage” includes distress. The UK Courts have recently decided a number of data misuse cases, taking a firm line on what constitutes misuse of information and “trivial” claims.
The EU GDPR doesn’t define “non-material damage”. European countries’ approaches on awarding compensation for non-material damage is notably varied. Due to most claims being low value and highly fact-specific, cases have been dealt with by lower courts, meaning that decisions have been non-binding and often unreported.
The AG’s opinion in a nutshell
When should compensation be awarded?
The AG said that compensation should only be awarded for any actual damage suffered by a person whose privacy rights have been infringed. There must have been a causal connection between the infringement of GDPR and the actual harm suffered. Compensation for “mere upset” should not be awarded.
Can punitive damages be awarded under the GDPR?
Punitive damages is a form of compensation awarded as a “punishment” against the wrong-doer, without considering the actual damage suffered by an individual. The AG said that punitive damages should not be awarded for GDPR infringement claims brought by individuals, since there is no reference to compensation of a punitive nature under GDPR.
Is there an automatic presumption of damage for an infringement?
The AG said not. GDPR should not be interpreted to include an irrebuttable presumption of damage should an infringement occurs. Furthermore, the AG clarified that mere loss of control does not automatically amount to damage worthy of compensation.
Could this influence data claims in the UK?
The AG’s opinion will be welcomed by UK businesses even though it does not directly affect them. It is nevertheless likely that UK courts will be influenced by the European approach towards non-material damages once the case involving the AG’s opinion has been determined. This will likely be in early-mid 2023. Although it’s worth keeping an eye on what the UK Government has planned in the Data Protection and Digital Information Bill which could disrupt the current regime.
