Last week (4 May 2023), the Court of Justice, asked by the Supreme Court of Austria (Oberster Gerichtshof) to interpret Art 82 of Regulation (EU) 2016/679 (GDPR), delivered its judgment on the case No C-300/21, UI v. Österreichische Post AG.
In the dispute in the main proceeding, UI brought an action against Österreichische Post AG seeking, first, an injunction to cease the processing of his personal data by the defendant, and, second, an order requiring that company to compensate him for the non-material damage which he claims to have suffered, on the grounds that his processed data would have shown a high degree of affinity with a certain Austrian political party. Moreover, although that information was not communicated to third parties, the fact that data relating to his supposed political opinions were retained within that company caused him great upset, a loss of confidence and a feeling of exposure.
The case poses three questions on the application of Art 82 of Regulation No 2016/679, namely: (i) whether the mere infringement of the provisions of that regulation is sufficient to confer a right to compensation; (ii) whether it precludes a national rule or practice which makes compensation for non-material damage, subject to the condition that the damage suffered by the data subject has reached a certain degree of seriousness; and (iii) which rules has to be applied in order to determine the financial compensation.
In the decision, the Court of Justice stated that Art 82 of Regulation No 2016/679 must be interpreted: (i) “as meaning that the mere infringement of the provisions of that regulation is not sufficient to confer a right to compensation”; and (ii) “as precluding a national rule or practice which makes compensation for non-material damage, within the meaning of that provision, subject to the condition that the damage suffered by the data subject has reached a certain degree of seriousness”; and (iii) “as meaning that for the purposes of determining the amount of damages payable under the right to compensation enshrined in that article, national courts must apply the domestic rules of each Member State relating to the extent of financial compensation, provided that the principles of equivalence and effectiveness of EU law are complied with”.
Although the dispute in main proceedings was purely domestic, the Court’s reasoning may well apply to cross-border cases too.
On GDPR and its conflict-of-laws related issues, the readers of RDIPP may refer to:
Martina Mantovani, 2019, No 3, 535 ff.; Cristina M. Mariottini, 2016, No 3, 905 ff.; Christian Kohler, 2016, No 3, 653 ff.