GDPR: compensation can take the form of a simple apology

Context

A Latvian national court has referred a question to the CJEU for a preliminary ruling. The question concerned the right of appeal under GDPR.

The facts underlying this case can be summarized as follows: a consumer rights protection center launched an advertising campaign. As part of the campaign, a character was used to imitate a journalist without obtaining his consent.

In response, the journalist filed a lawsuit seeking to establish the campaign's illegality and to obtain compensation for the non-material damages he suffered. He requested a formal apology letter and a lump sum payment of 2,000 euros.

The Court’s decision

The CJEU notes that the GDPR grants data subjects the right to seek compensation from the data controller for any damage they may have suffered.

The Court underscores its prior rulings, stating that to claim compensation, a data subject must have experienced material or non-material damage due to a breach of GDPR provisions. A simple breach does not automatically constitute damage, even if the provision grants rights to the data subject; damage is a possible, but not inevitable, outcome of a GDPR breach.

The right to compensation serves a strictly compensatory purpose. Any compensation awarded should fully cover the damage experienced by the affected individual.

As a result, minimal compensation may be awarded if it fully compensates for the damage suffered.

In this context, an apology may be considered sufficient compensation, if it fully addresses the non-material damage suffered.

To remember

A simple GDPR breach does not automatically qualify as damage that entitles the individual to compensation.

Compensation for non-material damage may take the form of a simple apology, as long as it fully addresses the damage suffered. Furthermore, the CJEU clarifies that the data controller's intentions or behavior are not relevant when determining compensation.

Source : C.J.E.U., 4 October 2024, case C-507/23, www.curia.be.