In February 2020, the Higher Regional Court of Innsbruck reversed and amended a decision of the Regional Court of Feldkirch, which had awarded an individual €800 as compensation for merely being 'disturbed' by the unlawful processing of their personal data.
The Innsbruck court’s decision is final and binding. To sum up:
- According to the general principles of Austrian tort law, a claimant must, even in the case of general data protection regulation (GDPR) damages claims, show that their emotional life suffered considerable disadvantage and resulted in a personal impairment because of the alleged GDPR violations. In the case at hand, the claimant’s arguments were only of general nature (eg 'immaterial damage', 'adversity', 'uncertainty', 'disadvantage'), ie the claimant was not able to show that he had suffered any specific immaterial damage. The court also stressed that, like other civil damages proceedings, it’s the claimant who bears the burden of proof for the incurred damage in GDPR claims.
- For immaterial damages to be awarded under the GDPR, there must be an actual impairment on an emotional level. As the Innsbruck court pointed out, the mere fact that a company (allegedly) processed data contrary to the GDPR does not automatically establish any immaterial damages suffered by the claimant.
- For immaterial damages to be relevant under the GDPR, a minimum level of personal impairment is required. Not every hurt feeling is sufficient. For example, in the opinion of the court, the data subject’s negative thoughts (eg 'being disturbed') resulting from the GDPR violation are not relevant in this regard. Instead, the court set a 'materiality threshold' requiring a more differentiated impairment of feelings to be established by claimants in order to be successful.
The Innsbruck court went even further by stating that an objective understanding of the personal impairment must be considered when assessing the relevance of hurt feelings because of GDPR violations. Thus, courts must assess on a case-by-case basis whether the specific GDPR violation causes 'emotional damage' going beyond the feeling of dislike that an 'average data protection aware person' may experience in light of the specific GDPR violation.
However, the Innsbruck court left completely open:
- how this objective understanding interacts with the required subjective impairment;
- which party must assert/prove this objective understanding and its fulfilment; and (most importantly)
- what the criteria are for this 'average data protection aware person'.
Also, somewhat surprisingly, the Innsbruck court did not refer any questions on compensation for immaterial damages under the GDPR to the Court of Justice of the European Union.
Even though the Innsbruck court’s ruling details when such a claim for damages might succeed, the bar for claimants is now set higher.
In the case of mass claims, it has now become much more difficult to prove the emotional damage suffered by a large group of individuals.
Although the judgment of the Innsbruck court brings more clarity on civil law and GDPR violations, key questions of data protection tort law are still unanswered.
