In its recent decisions C-687/21 and C-340/21, the European Court of Justice (ECJ) provided important clarifications on the right to compensation under Art. 82 GDPR, building on previous case law.
First of all, it is important to make a clear distinction between the breach of the GDPR and the resulting damage. In decision C-300/21 of 4 May 2023, the ECJ had already emphasized that a mere breach of the GDPR does not automatically give rise to a claim for damages. The loss of control over personal data that occurs as a result of a GDPR breach can in itself constitute non-material damage. This follows from Recital 85 of the GDPR and was confirmed by the ECJ in Decision C-340/21. It is not necessary for a specific misuse of the data to have already taken place. A well-founded fear of possible future misuse may be sufficient; it is important to note that different standards apply to the infringement and the resulting damage:
The ECJ clarified in C-340/21 that the national courts must make a concrete assessment when examining the claim for damages. They must examine whether the fears expressed by the person concerned can be considered justified in view of the specific circumstances of the individual case.
It should be noted that the ECJ also set limits in C-687/21: If it can be proven that a third party has gained knowledge of the data, mere concern about possible misuse is not sufficient to justify a claim for damages.
This differentiated approach of the ECJ ensures that, on the one hand, the rights of the persons concerned are safeguarded and, on the other hand, that no excessive claims arise. It requires the national courts to carefully weigh up each individual case and thus contributes to a balanced application of Art. 82 GDPR.
Update:
Incidentally, the Freiburg Regional Court has just ruled in this regard
1. in the event of an action for damages under Art. 82 GDPR, it is incumbent on the party bringing the action to prove that it has been affected by a data protection incident to the full satisfaction of the court using the standard of proof set out in Section 286 ZPO. This requirement is not satisfied by a mere reference to the results of a query on the website https:///haveibeenpwned.com, at least not if the defendant has previously stated decidedly on the basis of which specific circumstances it assumes that the hit report of the website https://haveibeenpwned.com/ is not a reliable basis for the assumption that the party to the present proceedings is actually affected by the API bug 2021 at the defendant.
2. if a party to the action alleges that the defendant party has violated provisions of the GDPR that protect it, that it has suffered (non-material) partial damage within the meaning of Art. 82 GDPR as a result, but that further damage is possible, then this procedural constellation is comparable to that involving the violation of an absolute right, not that of the sole assertion of pecuniary damage (a.A.
Regional Court of Stuttgart, judgment of 24.1.2024 27 O 92/23
juris Rn. 33). An interest in a declaratory judgment within the meaning of Section 256 para. 1 ZPO is therefore already to be affirmed if the subsequent realization of further damage in the foreseeable future appears possible according to the nature of the injury, a probability of the occurrence of further damage is not required (contrary to
LG Stuttgart, judgment of 24.1.2024 27 O 92/23
juris Rn. 33)
3. a request for injunctive relief that is not related to the specific form of infringement and is based on the vague term “prior art”, which is subject to interpretation, does not meet the requirements of Section 253 (2) No. 2 ZPO and is inadmissible. A formulation of the application that is subject to interpretation is not acceptable in order to ensure effective legal protection if the party bringing the action could use the formulation of the application to orient itself to the specific form of infringement without jeopardizing effective legal protection (connection BGH, judgment of 6 October 2011 – I ZR 54/10; BGH, judgment of 2 June 2022 – I ZR 140/15 and BGH, judgment of 9 September 2021 – I ZR 113/20).(para.71) (para.72) (para.73)
This topic will probably keep us busy for a while yet!
In recent months, several higher regional courts have also dealt with similar issues. Here is an overview of twenty recent OLG rulings on the subject of data protection and data anxiety, sorted by date of decision:
These decisions show that the courts take a differentiated view and carefully examine the circumstances of the individual case. For companies and data subjects, the issue of compensation for data breaches therefore remains complex and legally challenging.
Marian Härtel ist Rechtsanwalt und Fachanwalt für IT-Recht mit einer über 25-jährigen Erfahrung als Unternehmer und Berater in den Bereichen Games, E-Sport, Blockchain, SaaS und Künstliche Intelligenz. Seine Beratungsschwerpunkte umfassen neben dem IT-Recht insbesondere das Urheberrecht, Medienrecht sowie Wettbewerbsrecht. Er betreut schwerpunktmäßig Start-ups, Agenturen und Influencer, die er in strategischen Fragen, komplexen Vertragsangelegenheiten sowie bei Investitionsprojekten begleitet. Dabei zeichnet sich seine Beratung durch einen interdisziplinären Ansatz aus, der juristische Expertise und langjährige unternehmerische Erfahrung miteinander verbindet. Ziel seiner Tätigkeit ist stets, Mandanten praxisorientierte Lösungen anzubieten und rechtlich fundierte Unterstützung bei der Umsetzung innovativer Geschäftsmodelle zu gewährleisten.
The European Council has adopted the AI Act, the world's first comprehensive set of regulations for artificial intelligence (AI). This...
Read moreDetails
The problem Often enough, I have preached to clients and also here on the blog that one should not underestimate...
Read moreDetails
Introduction: Digital transformation has made online banking a popular and convenient way to manage finances. But as online transactions increase,...
Read moreDetailsThe Regional Court of Frankfurt am Main has appealed against the vast majority of German regional and regional courts and...
Read moreDetails
Have you received a warning about file sharing from law firms such as Frommer Legal, Daniel Sebastian, Yussof Sarwari or...
Read moreDetails
Introduction In competition law, there are always interesting cases that show how complex and multi-layered the topic of product design...
Read moreDetails
Digital transformation is one of the most discussed topics of the present day. It presents companies with new challenges and...
Read moreDetails
The Federal Ministry of Justice and for Consumer Protection (BMJV) is conducting a public consultation on the implementation of the...
Read moreDetailsTomorrow, a symposium for lawyers focusing on computer games and digital media will be held in Frankfurt. I will also...
Read moreDetails
Introduction The Telecommunications Telemedia Data Protection Act (TTDSG) is a German law that regulates data protection in the area of...
Read moreDetails
In dieser spannenden Folge unseres Podcasts tauchen wir tief in die Welt der innovativen Geschäftsmodelle ein. Unser Host Marian Härtel,...
In diese Episode wird die komplexe Beziehung zwischen dem 'Fail Fast'-Prinzip und den Verantwortlichkeiten der Gründer gegenüber Investoren und Mitarbeitern...
In dieser faszinierenden Episode tauchen wir tief in die rechtlichen Aspekte des Metaverse ein. Als Rechtsanwalt und Technik-Enthusiast beleuchte ich...
In der letzten Folge der ersten Staffel des ITmedialaw.com Podcasts werfen wir einen Blick in die Zukunft des Rechts im...
