The ECJ On The Right To Compensation For GDPR Infringement

On 4 May 2023, the ECJ issued its judgment in Case C‑300/21 (U.I. v Österreichische Post AG) ruling on the preliminary reference within the context of a dispute on the unauthorised processing of personal data and compensation for the non-material damage suffered by the data subject. In this particular case, Österreichische Post collected information on the political affinities of the Austrian population using an algorithm and without the data subjects' consent. The ECJ referred to Article 82 GDPR and ruled that the mere infringement of the provisions of the GDPR is not sufficient to confer a right to compensation, and that there must be a causal link between the infringement and the damage suffered. Moreover, the right to compensation is not limited to non-material damage that reaches a certain threshold of seriousness. Finally, the Court clarified that the GDPR does not contain any rules governing the assessment of damages. It is therefore up to the national law of