CJEU issues judgement in two joined cases on right to compensation for non-material damage for identity theft

Background

The CJEU explained that personal data, including the names, dates of birth, home addresses as well as data relating to initial deposits, were provided by the applicants to open their accounts with Scalable Capital, an automated portfolio management service. Following the theft of this data by third parties, the applicants brought an action before Amtsgericht München (Local Court, Munich, Germany) seeking compensation for the non-material damage they claim to have suffered due to their personal data being stolen.

The Amtsgericht München decided to stay the proceedings and referred several questions to the CJEU for a preliminary ruling.

CJEU judgment 

In interpreting Article 82(1) of the GDPR, the CJEU ruled that:

• damages under Article 82(1) are intended to be compensatory rather than punitive and financial compensation under the provision must allow for the damage suffered to be compensated in full;
• the severity and the intentional nature of the infringement of the GDPR by the controller is not relevant for the assessment of damages under Article 82(1);
• damage caused by a personal data breach is not to be regarded in and of itself as any less significant than damages caused by a physical injury.
• where non-serious damage is established, a national court may award nominal damages to a data subject if the compensatory function noted above is satisfied; and
• compensation for non-material damage caused by ‘identify theft’ is only available where the personal data has been later misused by a third party. However, compensation for non-material damage caused by the theft of personal data is not limited to cases where it is shown that that data theft subsequently gave rise to identify theft, i.e. non-material damages other than ‘identity theft’ can still be compensated.

The judgment is available here.