For the first time in the EU, a court has awarded a data subject compensation for immaterial (emotional) harm due to the unlawful processing of their personal data.
The court awarded the individual €800 – an amount the company concerned won't have trouble paying. But, with the processing activity affecting about two million customers, the company is also facing a mass claim lawsuit.
The developments are likely to be followed closely as the outcome could set a precedent for other similar cases in Europe.
But let's take a step back and see what led to the initial lawsuit.
Political party affinities evaluated by profiling
Austrian Post, Austria's postal service, stores and processes certain data about its customers: name, sex, age, etc. That's neither new nor controversial.
However, following a data subject request, it was revealed that Austrian Post allegedly evaluated and stored the data on the political affinities of approximately two million of its customers. According to media coverage, the company used statistical methods (ie profiling) to calculate how strongly an individual’s political orientation matched established Austrian political parties (eg strongly in favour of party A; unlikely to favour party B).
Publicly available information indicates that none of these customers had been informed about or consented to this data processing activity, and that in certain cases this data had also been sold to third parties. Many customers filed data subject access requests with Austrian Post, revealing that it had evaluated and stored data on their political party affinities.
Not surprisingly, a lawsuit on compensation for immaterial damage followed.
Unlawful processing constitutes emotional harm
The claimant only argued that he felt disturbed by being profiled in this way without being informed or giving his consent.
The Regional Court of Feldkirch, as court of first instance, held that the mere feeling of being disturbed by the unlawful processing of political party affinity data by itself already constitutes immaterial harm and awarded the claimant €800 of the €2,500 claimed.
The court acknowledged that party affinity falls within the special categories of data under Article 9 of the GDPR. But, interestingly, the court also ruled that not every perceived inconvenience or minor infringement shall give rise to a claim for damages (for immaterial harm). Nevertheless, in this case, the court concluded that this de minimis threshold had been exceeded.
As calculating immaterial harm can be difficult, the court determined the amount based on a judicial assessment (which is possible in Austria). In this respect, the court took into account that political opinions are a very sensitive type of information and that the unlawful processing had been conducted without even notifying the data subject.
Still, the court did not elaborate on how the amount had been calculated. Since both parties have appealed the decision, we could easily end up with a higher or lower amount of damages awarded in the higher instance(s).
GDPR (mass claims) litigation on the rise – first model case filed
In addition to individual claims, a mass claim lawsuit is being prepared by a well-known organisation that specialises in such proceedings.
According to a press statement made by the organisation, more than 1,600 customers have contacted them in this regard. The organisation plans to claim up to €3,000 for each affected customer as compensation for alleged immaterial harm.
To test their case, the organisation filed a model claim for one affected individual in September 2019. The outcome of this and the other pending proceedings will pave the way for establishing if and to what extent data subjects are entitled to claim damages for immaterial harm following unlawful processing of personal data.
What's next?
Unlawful processing of personal data can undoubtedly cause serious issues from a civil law perspective. Nevertheless, as the GDPR does not contain any specific rules on how to determine the amount to be claimed for immaterial damages, the general principles for claiming (immaterial) damages apply. It is, however, highly questionable as to whether these requirements were actually met by the claimant in the case before the Feldkirch regional court.
It is generally conceivable that an individual may suffer immaterial harm due to wrongful processing of personal data. But if the courts allow substantial amounts of damages to be claimed simply by establishing the processing was unlawful and unpleasant rather than requiring a claimant to prove the actual immaterial harm suffered (as they would normally have to), this may lead to a flood of GDPR litigation. This is especially true in respect of the collective redress regimes recently introduced in many European countries.
Given that unlawful processing of personal data is, by its nature, bound to affect large numbers of individuals, future developments in data protection litigation should be monitored closely.
