Background
On 12 May 2021, the Austrian Supreme Court submitted a number of questions on the interpretation of Article 82(1) GDPR to the CJEU in the case of UI v Österreichische Post AG.[1]
The Defendant in the case stored information on political party affinities of the Austrian population, in order to target individuals on the basis of their party affinity data. The CJEU was requested to determine whether and to what extent the Plaintiff was entitled to claim for “non-material loss” arising from breaches of their data rights under Art. 82(1) GDPR.
On 6 October 2022, the EU Advocate General delivered his opinion (“the Opinion”), which may be broadly summarised as follows:
1. A mere infringement of the GDPR is not in itself sufficient, if that infringement is not accompanied by the relevant material or non-material damage.
2. The principles of effectiveness and equivalence do not appear to play an important role for Art. 82. In this respect, damages for breach of Art. 82(1) have only a private compensatory function.
3. The compensation for non-material damages does not cover “mere upset” which the person concerned may feel as a result of the infringement.
Headline Significance of the Advocate General’s Opinion
The Opinion could be highly significant, primarily in how it directly contravenes the prevailing case law, which allows compensation for damages even without proof of any actual damage. In this respect, the Opinion moves away from the supposed deterring and sanctioning effect of damages awarded under the GDPR.
The Opinion appears to suggest a de minimus threshold, beyond “mere upset”, which must be exceeded before claimants can successfully seek damages for actual loss or distress. This approach appears to broadly follow recent developments of the English High Court in Rolfe v Veale[2]and Johnson v Eastlight Community Homes Ltd.[3]The decision of the CJEU on this issue may be instructive as to the persuasive weight UK judgments hold post-Brexit.
The Opinion is also reflective of the rejection model prevalent in the US, where courts see no “harm” in mere privacy violations, and thus reject such claims at the outset.
Since the GDPR came into force in 2018, certain court decisions have sought to restrict its effect, possibly in response to the pervasiveness of non-legal, industry messages that the GDPR has “gone too far”. The Opinion could be read as a concession to such trends, in a manner which, if followed, may have far-reaching consequences for damages under the GDPR.
Practical Effect of the Advocate General’s Opinion
The primary practical effect of the Opinion, should it be followed, would be the drastic decrease in claims under Article 82(1). Should the CJEU require that a certain threshold of causal, negative emotional consequences be reached by the claimant for a successful claim of non-material damages to be made, a significant amount of data subjects who have lost control of their data are unlikely to be awarded compensation under the GDPR.
The Opinion envisages that Member States will create their own thresholds to limit the compensation for non-material damages under the GDPR. This may lead to the fragmentation of the principle across the EU bloc, and may encourage jurisdiction shopping among claimants.
While no provision for class actions exists under Irish court rules, in other jurisdictions, the occurrence of class actions for breach of data rights is likely to be significantly reduced, in the event that the Opinion is followed.
The Opinion suggests that other avenues for relief should be pursued, such as declarations, nominal damages or injunctions. This is likely to deter data subjects from bringing claims for breaches of their data rights, where the cost of litigation is likely to outweigh the benefits of mere declaratory relief.
While the Opinion had the opportunity to provide clear guidelines as to the threshold for non-material damages, regrettably, the language used is unhelpfully vague and the Opinion contains no positive definitions. It is unclear how “mere upset” is distinguishable from other negative emotional states which would result in successful claims of non-material damages. It is instructive that the Opinion failed to take an explicit view on whether the Plaintiff in UI v Österreichische Post AG should be entitled to non-material damages.
In this respect, the judgment of the CJEU is eagerly anticipated, in order to clarify whether the death knell of non-material damages for breach of data rights is, in fact, being rung out across the EU.
[1] CJEU – UI v Österreichische Post AG (pending case) – C-300/21. [2]Rolfe v Veale Wasbrough Vizards LLP [2021] EWHC 2809 (QB). [3]Johnson v Eastlight Community Homes [2021] EWHC 3069 (QB).