Compensation for non-material damage pursuant to Article 82 GDPR
The General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 [the GDPR]) provides both for public enforcement by data protection authorities and for private enforcement by any person who has suffered damage as a result of an infringement of the Regulation (on this inter-connection, see Johanna Chamberlain & Jane Reichel “The Relationship Between Damages and Administrative Fines in the EU General Data Protection Regulation” 89 Mississippi Law Journal (forthcoming 2020; SSRN)). As to private enforcement by means of damages claims, Article 82(1) GDPR provides that “[a]ny person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered”. CMS legal are tracking fines levied by data protection authorities in the EU – they record that, so far, 186 fines have been levied, for a total of almost €460m (the EDPB gives different numbers (pdf, pp33-34), discussed here). However, there is as yet no equivalent tracker for compensation claims, in part because there have been very few. So far as I can find, there have been eight judgments considering substantive claims for damages pursuant to Article 82 (though there have been other cases in which such compensation was claimed but the substantive issue was not reached).…