The GDPR Concept of Nonmaterial Damage – on the Road of its Decoding
The concept of non-material damage
In its decision under Case C-300/21 (Österreichische Post), the European Court of Justice (“CJEU”, the “Court”) stated that the existence of ‘damage’ which has been ‘suffered’ constitutes one of the conditions for the right to compensation laid down in Article 82 of the GDPR (see also our previous alert on Case C-300/21). Importantly, the CJEU clarified that reaching a de minimis threshold of ‘seriousness’ is not a prerequisite for a claim for damages under that provision. The Court also noted that, since GDPR does not define the concept of damage and there is no reference to the domestic law of the Member States, the concept of ‘nonmaterial damage’, within the meaning of Article 82 of the GDPR, must be given an autonomous and uniform definition specific to EU law. However, in its decision under the above case, the CJEU did not provide such definition.
Further insight from the Court on the concept of non-material damage under the GDPR is expected in its forthcoming decision of the Court under the pending case below.
Case C-340/21 (VB v Natsionalna agentsia za prihodite (Bulgarian National Revenue Agency)): what the Advocate General advises
In connection with that case, the Bulgarian Supreme Administrative Court referred the following question (among others) to the CJEU: in a case involving a personal data breach consisting an unauthorised access to, and dissemination of, personal data by means of a “hacking attack”, should the worries, fears, and anxieties suffered by the data subject with regard to a possible misuse of personal data in the future fall per se within the concept of non-material damage and entitle him or her to compensation for damage where such misuse has not been established and/or the data subject has not suffered any further harm?
The Advocate General Pitruzzella opines that even the misuse of personal data is only potential, and not actual, it is sufficient to be considered that the data subject may have suffered non-material damage caused by the infringement of the GDPR, provided that the data subject demonstrates that the fear of such misuse has actually and specifically caused him or her actual and certain emotional damage (worries, fears, anxieties).
The Advocate General further elaborates on the concept of nonmaterial damage stating that there is a fine line between mere upset (which is not eligible for compensation) and genuine non-material damage (which is eligible for compensation), and the data subject seeking compensation will have the burden of producing precise, and not generic, evidence actually capable of establishing the existence of ‘non-material damage actually suffered’ as a result of the personal data breach, without, however, that damage had to reach a predetermined threshold of particular gravity.
Our comment
The opinion of the Advocate General is in line with the CJEU’s decision under Case C-300/21 with respect to the rejection of a predetermined threshold of seriousness of emotional harm to be considered in legal terms non-material damage. However, the Advocate General also maintains that light negative reactions like a ‘mere upset’ of the data subject do not qualify as genuine nonmaterial damage under Article 82 of the GDPR (it seems that in its decision under Case C-300/21 (item 50), the Court accepts the restriction of non-material damage, which excludes minor negative consequences from its scope). The lack of predetermined threshold of seriousness of the emotional harm to be considered non-material damage, on one hand, and the exclusion of minor negative consequences from the scope of the non-material damage, on the other hand, may be seen as internally contradictory statement. In addition, this position creates uncertainty in practice about where to draw the line between these two.
Therefore, it remains to be seen whether the new decision of the CJEU will reconfirm the above interpretation of Article 82 of the GDPR and, more importantly, whether the Court will provide the anticipated definition of non-material damage or at least give an explanation with practical value on what constitutes ‘mere upset’ (which is out of the scope of the nonmaterial damage) and what ‘worries, fears, anxieties’ (which qualify as nonmaterial damage).