2023 marks 5 years since the adoption of the General Data
Protection Regulation (''GDPR''),
and whilst the relevant stakeholders have become largely accustomed
to it, questions about its interpretation and enforcement still
crop up requiring preliminary rulings from the CJEU. Such a
question came up in UI vs. Österreichische Post AG,
decided on 4 May 2023, which confirmed, inter alia, that
the mere infringement of the GDPR does not equate to a claim for
compensation.
Background of the case
By way of background, the case concerned Österreichische
Post, an Austrian company which collected information on
the political affinities of the Austrian population. By means of an
algorithm, the collected data was repacked and sold to various
organisations to enable them to send targeted advertising. Through
statistical extrapolation of the data, Österreichische Post
was able to determine that the applicant in the main proceedings
(the ''Applicant'') was more
inclined to
