CJEU to rule on data protection breach damages

Germany's Federal Constitutional Court has ruled that the CJEU must be asked to clarify when a claim for damages is recognised under article 82 of the General Data Protection Regulation (GDPR) and when damage is to be assumed.

The Federal Constitutional Court has overturned a ruling of the Goslar local court from 2019, which was about the unlawful sending of an advertising email. The recipient had filed a lawsuit because his email address had been used without his consent in breach of article 6 of the GDPR. In addition to injunctive relief and information about his stored data, he also demanded damages under article 82 of the GDPR.

The local court ruled that the recipient of the ad was not entitled to non-material damages due to the lack of materiality - it had only been a single advertising email which had not been sent at an inopportune time, which had clearly shown that it was advertising due to its appearance and which had not made it necessary to deal with it at length, the court said.

However, since the GDPR is EU law and there is as yet no CJEU case law on this issue, the Federal Constitutional Court concluded that the question of when non-material damage gives rise to a claim for financial compensation must be referred to the CJEU.

"It is now almost impossible to imagine a company that does not process personal data. Accordingly, even with appropriate technical and organisational measures in place, the risk of data breaches is growing," said Sibylle Schumacher, dispute resolution expert at Pinsent Masons, the law firm behind Out-Law. "The possibility of making a claim for material or non-material damages in the event of data breaches can therefore quickly become expensive for businesses. This is not least because data breaches often affect not only individuals but entire groups of people."

German courts have recently been dealing more and more frequently with claims for damages based on data protection violations. In particular, claims for compensation for non-material damage have come to the fore.

"Whether and under which conditions such non-material damage is to be assumed has been highly controversial so far," said Nadia Schaff, expert in data protection law at Pinsent Masons.  "This concerns in particular the question whether such a claim requires a certain materiality or not."

The CJEU will clarify some points that are of great relevance, Schaff said. "However, other points of discussion, for example around the obligation to prove that damage has actually occurred, are unaffected by the request for preliminary ruling. It remains to be seen how the case law of the courts will develop in this respect," Schaff said.

With its decision, the Federal Constitutional Court ruled in favour of the recipient of the advertising email: the recipient was also of the opinion that the local court should have referred the question of the interpretation of article 82 of the GDPR to the CJEU. He therefore first filed a complaint with the Goslar local court. When this was unsuccessful, he filed a constitutional complaint with the Federal Constitutional Court, which followed him in his argumentation:

The "claim for monetary compensation has not been exhaustively clarified in the case-law of the Court of Justice of the European Union, nor can it be determined directly from the GDPR in terms of its individual requirements necessary for the assessment of the facts presented in the initial proceedings", the Federal Constitutional Court's judgment states. "The local court was also unable to assume a correct application of Union law that is so obvious that there would be no room for reasonable doubt...This is all the more true as article 82 of the GDPR expressly includes non-material damages."

The local court must now hear the case again and submit a relevant request to the CJEU.