European Union: Ruling in Case C-300/21 on the Compensation Factors relating to Infringements of the GDPR

On 4 May 2023, the European Court of Justice (CJEU) issued its ruling in Case C-300/21 regarding the unlawful processing of data by the newspaper Österreichische Post (paper). The paper had processed an individual's data without his consent. Thus, the individual requested non-material damage compensation for a significant loss of confidence and emotional distress. The CJEU clarified in its ruling that compensation becomes possible once three conditions are met: a breach of an article of the General Data Protection Regulation (GDPR), material or non-material damage from the breach, and a causal mechanism between the breach and the damage. In consequence, not every breach automatically guarantees the right to compensation. The CJEU also pointed out that non-material damage needs to be proven. Therefore, regardless of how upsetting or damaging a breach was, the mere breach is not sufficient to justify a claim for damages. Finally, the CJEU stated that, when determining the amount of damages, national courts are to apply the national rules of each Member State on the amount of financial compensation.