A number of decisions of the EU Court of Justice provide further interpretive clarification on the compensation of damages arising from processing of personal data under Article 82 of the GDPR.
Article 82 of the GDPR
Article 82(1) of the GDPR reads as follows:
«Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered. ».
This provision is directly applicable to all national legal systems of EU member states, as it is prescribed by an EU regulation and has direct effect.
Again, Article 82 admits that the data controller can avoid liability only if he proves that the fact that generated the damage is “in no way” attributable to him; thus, introducing into the action for damages, an inversion of the burden of proof. In view of this, Article 82 also reverses situations in some national laws prior to the GDPR, where the burden of proof was on the plaintiff.
Damages from GDPR violations
The provision provides a clear indication of the scope of compensation for the damage caused by the unlawful processing of personal data; the following are compensable:
- Material damages
- Non-material damages
Article 82 of the GDPR establishes the right of anyone who has suffered tangible or intangible damage as a result of unlawful processing of personal data to receive compensation. The provision, therefore, clearly indicates that the right to compensation does not belong solely to the data subject but to “anyone” who suffers damage as a result of unlawful processing.
