Train, Don't Blame! Postal Marketing Under The GDPR

CJEU dismisses controller's attempt to avoid GDPR liability by relying on employee's acts.

A recent Court of Justice of the European Union (CJEU) ruling concerning a business-to-business (B2B) postal marketing case has found that a controller cannot avoid liability for compensation under the GDPR by simply relying on the negligence or fault of someone acting under its authority. Echoing the Austrian Post Case (see here), the CJEU also determined that an infringement of data subject rights, in itself, is insufficient to constitute "non-material damage" under the GDPR. The individual must prove that he or she actually suffered damage and that there is a causal link between the damage and the controller's actions.