In a landmark decision dated December 14, 2023, the European Union’s Court of Justice (Third Chamber) clarified an important aspect of the General Data Protection Regulation (GDPR) concerning the rights of individuals to receive compensation for non-material damage. The case, identified as C-456/22, arose after two individuals, AT and VX, sought damages from the Municipality of Ummendorf, Germany, for publishing their personal data online without consent.
The Court’s judgment emphasized that under GDPR’s Article 82(1), any person who has suffered damage as a result of a GDPR infringement has the right to compensation from the data controller or processor responsible. Importantly, the Court ruled that there is no ‘de minimis threshold’—meaning no minimum level of harm must be proven for a claim to be valid. This broad interpretation of ‘non-material damage’ ensures that individuals are entitled to compensation even for minor violations of their data protection rights, reflecting the regulation’s objective to provide robust personal data protection.
The Court further explained that while individuals must demonstrate actual damage to claim compensation, the mere fact of a GDPR infringement does not automatically entitle them to compensation. This decision is significant as it reinforces the principle that the protection of personal data is paramount in the EU, and even small breaches can lead to liabilities for organizations.