In its long-awaited ruling, the European Court of Justice (ECJ) today, May 4, 2023, for the first time ever positions itself on the claim for damages under Art. 82 of the General Data Protection Regulation (GDPR) and its requirements.
Background to the case
The ECJ decision (Case C-300/21) was preceded by the fact that the Austrian postal service created political profiles using an algorithm based on social demographic characteristics and subsequently sold this information. The plaintiff in the original proceedings saw his rights violated by this processing and subsequent storage of his personal data due to the possible assignment to a political spectrum. The damage lay in his great annoyance, loss of confidence and the accompanying feeling of exposure. He claimed damages under Article 82 of the GDPR.
Does a breach of data protection law itself already indicate damage?
The submitting Austrian court wanted to get clarification from the ECJ,
- whether the breach of the GDPR provisions is sufficient or whether concrete damage is required, and
- whether a certain threshold of significance must be exceeded for the award of non-material damage.
The clarification of the question of whether the violation of a legal provision is sufficient for the successful assertion of a claim for damages was eagerly awaited, especially from the practice: In the meantime, it has become almost part of the standard repertoire of most lawyers representing employees to simultaneously file a claim for information pursuant to Art. 15 GDPR in the context of an action for protection against dismissal. The employer must comply with the employee's request for information within the statutory period of one month. If the employer does not comply with this request, the employee regularly asserts a claim for damages in or out of court before the conciliation hearing.
The ECJ's decision: existence of a causal damage yes, significance no
The ECJ now answered the questions to the effect that Art. 82 GDPR explicitly mentions not only the breach but also the damage itself as a prerequisite for a claim. Taking into account today's decision, it is therefore not sufficient if employees in future only claim a breach of data protection provisions by the employer.
The ECJ literally states that the interpretation of Art. 82 GDPR "does not [mean] that a person affected by a breach of the GDPR which has had negative consequences for him would be exempt from proving that those consequences constitute non-material damage within the meaning of Art. 82 of that regulation." Rather, it must be shown that the breach of the legal provision also caused causal damage.
At the same time, however, the court also states that a materiality threshold does not have to be exceeded for the (successful) assertion of a non-material damage claim.
Outlook and recommendations for practice
Employee data protection, in particular the right to information under Art. 15 GDPR, has recently run the risk of being used more and more frequently as a means of pressure by employees and their lawyers in order to increase the volume of negotiations, e.g. in unfair dismissal proceedings; employers usually find it difficult to prove this abuse of rights.
The ECJ's decision has the potential to curb this development. In particular, the court's statement that a violation of data protection provisions and the resulting negative consequences for employees are not sufficient to presume damage gives employers hope in this regard.
At the same time, however, the court expressly states that any violation of data protection regulations, no matter how insignificant, can in itself be suitable to justify a (non-material) claim for damages. Here we can only hope that the national labour courts will use a sense of proportion when assessing the amount of possible damages.
For employers, prevention of claims for damages by (former) employees should remain the top priority. Suitable measures in this respect are, on the one hand, the consideration of data protection provisions and, on the other hand, early clarifying arrangements with employees in the separation stage with regard to claims for damages under data protection law. With regard to the assertion of the latter, it is advisable in practice to exclude such claims through corresponding exclusion clauses in termination and liquidation agreements.
