Does the award of compensation under Article 82 of [the GDPR] also require, in addition to infringement of provisions of the GDPR, that an applicant must have suffered harm, or is the infringement of provisions of the GDPR in itself sufficient for the award of compensation?

The mere infringement of the GDPR is not sufficient for compensation; actual harm must be proven.

Does the assessment of the compensation depend on further EU-law requirements in addition to the principles of effectiveness and equivalence?

National courts must apply domestic rules, respecting EU law principles of equivalence and effectiveness.

Is it compatible with EU law to take the view that the award of compensation for non-material damage presupposes the existence of a consequence [or effect] of the infringement of at least some weight that goes beyond the upset caused by that infringement?

EU law precludes a national rule requiring non-material damage to reach a certain degree of seriousness for compensation.

GDPR infringement alone doesn't warrant compensation; harm must be proven.

European Court of Justice (Third Chamber) · 4 mei 2023 · Judgment · Preliminary ruling

(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 82(1) – Right to compensation for damage caused by data processing that infringes that regulation – Conditions governing the right to compensation – Mere infringement of that regulation not sufficient – Need for damage caused by that infringement – Compensation for non-material damage resulting from such processing – Incompatibility of a national rule making compensation for such damage subject to the exceeding of a threshold of seriousness – Rules for the determination of damages by national courts)

Rechtsvraag

Whether the mere infringement of the GDPR provisions is sufficient to confer a right to compensation and under what conditions compensation for non-material damage can be claimed.

Regel

Article 82(1), GDPR (Right to compensation for damage caused by data processing that infringes that regulation)
Recital 146, GDPR (Concept of damage should be broadly interpreted)
Principle of Equivalence and Effectiveness (Ensure consistent application of EU law without making it impossible or excessively difficult to exercise rights conferred by EU law)

Conclusie

The court concluded that an infringement of the GDPR alone does not suffice to grant compensation; actual damage must be proven. A national rule requiring a threshold of seriousness for non-material damage is precluded. National courts must apply domestic rules for compensation while ensuring compliance with EU principles of equivalence and effectiveness.

Tijdlijn

2017 Österreichische Post, a company incorporated under Austrian law, collected information on the political affinities of the Austrian population using an algorithm to define 'target group addresses'.
14-07-2020 The Landesgericht für Zivilrechtssachen Wien upheld the application for an injunction against Österreichische Post to cease processing the personal data in question but rejected the claim for compensation by UI.
09-12-2020 The Oberlandesgericht Wien confirmed the decision of the Landesgericht für Zivilrechtssachen Wien, indicating that compensation for non-material damage requires a certain threshold of seriousness.
15-04-2021 The Oberster Gerichtshof, by interim judgment, did not uphold Österreichische Post's appeal against the injunction but continued to consider UI's appeal concerning compensation.
12-05-2021 The Court of Justice of the European Union received a request for a preliminary ruling from the Oberster Gerichtshof regarding the interpretation of Article 82 of the GDPR.
06-10-2022 The Advocate General delivered an opinion on the case at the sitting of the Court of Justice.
04-05-2023 The Court of Justice delivered its judgment, interpreting Article 82 of the GDPR in relation to the right to compensation for damage caused by data processing.