The ECJ judgment
In its judgment, rendered on 4 May 2023 (proceeding C-300/21), the European Court of Justice stated far-reaching principles on compensation of damages arising from a GDPR breach whose impact on Italian data protection law is worth scrutinising.
The preliminary question to the ECJ was raised in the context of a legal action brought by an Austrian citizen claiming compensation for non-material damages arising from the unlawful and inaccurate processing of his personal data relating to political opinions.
In the context of such proceeding, the Austrian Supreme Court requested the ECJ to preliminary rule on whether:
- compensation of damages is owed to the data subject on the sole basis of the infringement of provisions of the GDPR, irrespective of the data subject proving an actual damage suffered by them; and
- compensation for non-material damage requires a prejudice, caused by the GDPR infringement, which exceeds a certain materiality threshold.
The Luxembourg court set forth that compensation under Article 82 GDPR:
- not only requires an infringement of provisions of the GDPR, but also the claimant complaining and proving the suffering of an actual prejudice, thus excluding compensability of a damage inre ipsa.
- does not require a damage to exceed a certain “threshold of seriousness”.
The first preliminary ruling: no compensation is owed to data subjects, unless they suffered an actual damage
The ECJ restated that a GDPR breach per se is not a sufficient to trigger the right of the data subject to be compensated. The Luxembourg court expressly ruled out that a damage lays in re ipsa in the infringement of any GDPR provision, whereas data subjects are entitled to compensation provided that an actual damage (material or immaterial) is suffered by them.
The unavoidable need for a negative consequence arising from a GDPR breach and affecting – either materially or non-materially - the data subject was grounded by the ECJ on the perspicuous wording of Article 82 GDPR, expressly laying down the occurrence of a “damage” as a requirement to compensation, although making clear that a “material or non-material damage” under GDPR must be interpreted regardless of Member State’s law on damages.
The second preliminary ruling: compensation is not subject to a materiality threshold of the damage
The ECJ observed that compensation for damages arising from the infringement of GDPR is not made conditional upon any severity threshold being met and the GDPR objective to ensure a consistent and high-level protection of personal data would be frustrated if national laws could deprive certain data subjects from compensation on the basis of the tenuity of the damage suffered by them. Hence, tenuous or exiguous damages are to be compensated too, once proved, according to the EU judges.
What is the impact of the ECJ preliminary rulings on compensation for damages arising from GDPR breaches in Italy?
The first preliminary ruling is in principle consistent with the most recent Italian case law on compensation of damages arising from unlawful processing of data, setting out that compensation of non-material damages is not triggered by the mere violation of privacy law (cfr. Italian Supreme Court, judgment no. 29982/20).
More prominent is the second preliminary ruling, whose impact on compensations for damages arising from GDPR breaches in Italy may turn out to be more incisive. Indeed, same as under Austrian law, according to Italian Courts compensation of non-pecuniary damages in Italy can be awarded only in respect of "non-futile damages", which require the offence to exceed the minimum threshold of “tolerability”. Such requirement excludes from compensation those damages consisting in mere upset, annoyance or inconvenience.
Compensability of exiguous damages caused by unlawful processing of data could potentially generate far-reaching consequences in Italy, where a new class action regime entered into force on 19 May 2021 contemplating more effective legal tools to address serial violations of rights.
