Mere infringement of the GDPR does not give rise to a right to compensation

Judgment of the Court (Third Chamber) in Case C-300/21 | Österreichische Post (Non-material damage resulting from unlawful processing of data) - 4 May 2023

On those grounds, the Court (Third Chamber) hereby rules:

1. Article 82(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that the mere infringement of the provisions of that regulation is not sufficient to confer a right to compensation.

2. Article 82(1) of Regulation 2016/679

must be interpreted as precluding a national rule or practice which makes compensation for non-material damage, within the meaning of that provision, subject to the condition that the damage suffered by the data subject has reached a certain degree of seriousness.

3. Article 82 of Regulation 2016/679

must be interpreted as meaning that for the purposes of determining the amount of damages payable under the right to compensation enshrined in that article, national courts must apply the domestic rules of each Member State relating to the extent of financial compensation, provided that the principles of equivalence and effectiveness of EU law are complied with.