On 4 May 2023, the ECJ issued its judgment in Case C‑300/21 (U.I. v Österreichische Post AG) ruling on the preliminary reference within the context of a dispute on the unauthorised processing of personal data and compensation for the non-material damage suffered by the data subject. In this particular case, Österreichische Post collected information on the political affinities of the Austrian population using an algorithm and without the data subjects' consent. The ECJ referred to Article 82 GDPR and ruled that the mere infringement of the provisions of the GDPR is not sufficient to confer a right to compensation, and that there must be a causal link between the infringement and the damage suffered. Moreover, the right to compensation is not limited to non-material damage that reaches a certain threshold of seriousness. Finally, the Court clarified that the GDPR does not contain any rules governing the assessment of damages. It is therefore up to the national law of each Member State to establish the criteria for determining the extent of compensation payable, in light of the compensatory function of the right to compensation provided by the GDPR, and to ensure compliance with the principles of equivalence and effectiveness.
Originally published by May, 2023
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
