CJEU Provides Clarity On Right To Compensation For GDPR Infringements

In the run up to Christmas 2023, the Court of Justice of the European Union ("CJEU") delivered three noteworthy judgments (in cases C-340/21, C-456/22 and C-667/21), which further clarify the scope of an individual's right to recover compensation under Article 82 GDPR for non-material damage suffered as a result of a GDPR infringement.

The judgments follow the approach taken by the CJEU in the Austrian Post case (C-300/21) (previously discussed here). In that case, the CJEU found that three cumulative conditions apply in order to recover compensation under Article 82 GDPR, including: (i) a GDPR infringement; (ii) damage and (iii) a causal link between the two. In addition, the CJEU ruled that Article 82 GDPR prohibits any national law or rule requiring non-material damage suffered to reach a minimum threshold of seriousness in order to confer a right to compensation.