Take-Aways (AI)
- The ECJ rules that a GDPR violation alone does not justify a claim for damages; actual damage is required.
- The damage does not have to be of any particular significance; even minor immaterial impairments may suffice.
- The person concerned bears the burden of proof for the existence of the damage and its causality.
- The assessment of damages is carried out in accordance with national law insofar as it corresponds to the limits of Union law.
The ECJ has ruled in the Judgment C‑300/21 of May 4, 2023 in the case of Österreichische Post AG dealt with compensation for damages in the event of violations of the GDPR. The starting point was a successful claim for payment of EUR 1,000 against Austrian Post as compensation for non-material damage.
The ECJ has stated that
- a breach of the GDPR is not in itself sufficient to give rise to a claim for damages. On the contrary, it follows from the autonomous interpretation that an Damage present must;
- the damage, however not a certain materiality The ECJ refers here to its usual case law that the GDPR wants a high level of protection; a circular argument, because the interpretation of the GDPR thus becomes the standard of interpretation;
- the person concerned the damage prove must; and
- the Dimensioning of damages follows national law, as long as this remains within certain limits of EU law.