This case provides crucial insights into GDPR enforcement. It examines the conditions for compensating non-material damage, the adequacy of apologies as remedies, and the irrelevance of a controller’s intent in determining compensation, clarifying key aspects of data protection rights.

Below is a simplified summary of the case’s facts, questions, and arguments, along with my own analysis at the end. For easy reference, I’ve included paragraphs’ numbers.

You can find the full case here.

FACTS

Paragraphs 12-17 of the judgement

The applicant is a well-known journalist in Latvia, specializing in the automotive sector. As part of a campaign to raise awareness about the risks of purchasing second-hand vehicles, the Consumer Rights Protection Centre (PTAC) distributed a video on various websites. The video featured a character imitating the applicant without his consent. Despite the applicant’s explicit objections to the creation and distribution of the video, it remained available online. The PTAC refused his requests to cease the video’s distribution and compensate him for the alleged harm to his reputation.

The applicant subsequently filed a case with the Administratīvā rajona tiesa (District Administrative Court, Latvia), seeking:

• a declaration that PTAC’s actions, involving the unauthorized use of his personal data, were unlawful;

• compensation for non-material damage, including an apology and payment of EUR 2,000.

The court found PTAC’s actions unlawful and ordered it to:

• cease the distribution of the video;

• issue a public apology;

• pay EUR 100 as compensation for non-material damage.

On appeal, the Administratīvā apgabaltiesa (Regional Administrative Court, Latvia) delivered a judgment on 20 May 2023, which upheld part of the lower court’s decision. It ruled:

• The processing of the applicant’s personal data was unlawful under Article 6 of the GDPR.

• PTAC must stop the distribution of the video and publish an apology on the websites where it was shared, in line with Article 14 of the Law of 2005. However, it dismissed the claim for financial compensation for non-material damage, concluding:

• the infringement was not serious since the video aimed to serve a public interest and did not intend to harm the applicant’s reputation, honor, or dignity;

• the infringement stemmed from PTAC’s misinterpretation of complex legal provisions.

In his appeal to the Augstākā tiesa (Senāts) (Supreme Court, Latvia), the applicant challenges the judgment, specifically its refusal to grant financial compensation for non-material damage. He argues that the appellate court:

• misjudged the seriousness of the infringement of his rights;

• incorrectly evaluated the harm caused by the infringement.

Furthermore, he contends that compensation solely in the form of an apology is neither fair nor adequate under Article 82 of the GDPR.

QUESTIONS

(1) The referring court seeks clarification on whether Article 82(1) of the GDPR, interpreted in light of Article 8(1) of the Charter of Fundamental Rights of the European Union, should be understood to mean that a violation of the GDPR’s provisions is, on its own, sufficient to constitute “damage” as defined under Article 82(1).

(2) The referring court seeks to determine whether Article 82(1) of the GDPR should be interpreted to mean that an apology can be considered adequate compensation for non-material damage under that provision, particularly in cases where it is not possible to restore the situation to what it was before the damage occurred.

(3) The referring court asks whether Article 82(1) of the GDPR allows the controller’s attitude and motivation to be taken into account in evaluating whether to reduce the compensation awarded to the data subject below the actual harm they suffered.

ARGUMENTS

Question 1

24. The Court has consistently interpreted Article 82(1) of the GDPR to mean that a violation of the GDPR alone does not automatically grant a right to compensation. To claim compensation under this provision, three cumulative conditions must be met:

25. There must be actual damage (material or non-material).

26. An infringement of the GDPR must have occurred.

27. A causal link must exist between the damage and the infringement.

Therefore, anyone seeking compensation for non-material damage must show not only that the GDPR was violated but also that the violation caused them actual harm.

26. The Court has also clarified that even if the violated GDPR provision grants rights to individuals, the violation alone does not automatically constitute “non-material damage” under the GDPR. A right to compensation requires that the other two conditions mentioned in paragraph 24 - actual damage and a causal link - are also met.

27. This interpretation of Article 82(1) of the GDPR is supported by recitals 75, 85, and 146 of the GDPR, which clarify the following:

28. damage from unlawful data processing is a possible, but not automatic, outcome;

29. a GDPR infringement does not always lead to damage;

30. to claim compensation, there must be a clear causal link between the infringement and the damage suffered by the data subject.

31. In light of the above, the answer to the first question is that Article 82(1) of the GDPR, interpreted in light of Article 8(1) of the Charter, means that a violation of the GDPR provisions alone does not constitute “damage” under Article 82(1).

Question 2

32. In this case, since the GDPR does not define the rules for assessing damages under the right to compensation in Article 82, national courts must apply their own domestic laws to determine the amount of financial compensation. However, this must be done in compliance with the principles of equivalence and effectiveness under EU law.

33. Regarding the principle of effectiveness, the compensatory nature of the right to compensation under Article 82 of the GDPR requires that each Member State’s legal system define the criteria for assessing compensation. This compensation must be full and effective, but it does not require the inclusion of punitive damages to achieve complete compensation.

34. Article 82(1) of the GDPR does not rule out the possibility of an apology serving as standalone or supplementary compensation for non-material damage, as allowed under Article 14 of the Law of 2005 in this case. However, this form of compensation must comply with the principles of equivalence and effectiveness. Specifically, the apology must fully compensate for the non-material damage caused by the GDPR infringement. It is up to the national court to determine, based on the circumstances of each case, whether this requirement is met.

35. Based on the above, the answer to the second question is that Article 82(1) of the GDPR allows an apology to be sufficient compensation for non-material damage, particularly when it is impossible to restore the original situation, provided the apology fully compensates the damage suffered by the data subject.

Question 3

39. Firstly, Article 83 of the GDPR, read alongside recital 148, indicates that the controller’s attitude and motivation can be considered as “aggravating or mitigating factors” when deciding on the imposition and amount of an administrative fine. However, these criteria are not mentioned in Article 82 or recital 146, which specifically address the right to compensation.

40. The absence of any reference to such criteria in Article 82 of the GDPR is justified by its exclusively compensatory purpose. Compensation under this article, particularly financial compensation, aims to fully address the damage suffered. This contrasts with Articles 83 and 84, also in Chapter VIII of the GDPR, which have a primarily punitive purpose, allowing for the imposition of administrative fines and other penalties.

41. Thus, given the differences in wording and purpose between Article 82 of the GDPR** **(read alongside recital 146) and Article 83 (read alongside recital 148), the criteria specified in Article 83 cannot be applied, even by analogy, to Article 82. This is particularly relevant when determining the amount of damages under Article 82, as well as the form (financial or otherwise) and the level of compensation awarded.

42. Given the exclusively compensatory nature of the right to compensation under Article 82(1) of the GDPR, the severity of the infringement does not affect the amount of damages awarded. The compensation cannot exceed the amount required to fully address the damage suffered. Only the actual harm experienced by the data subject is considered when determining the monetary compensation.

43. Similarly, the compensatory function of Article 82(1) of the GDPR would be undermined if the controller’s attitude and motivation were considered when deciding the form of compensation or when awarding redress that is less than full compensation for the damage suffered, as suggested by the referring court in this case.

44. Based on the above, the answer to the third question is that Article 82(1) of the GDPR must be interpreted as prohibiting the consideration of the controller’s attitude and motivation to justify awarding compensation that is less than the actual damage suffered by the data subject.

Conclusion

This case provides a nuanced look into the complexities of GDPR enforcement and compensation for non-material damages, revealing several intriguing aspects:

The Role of Non-Material Compensation. The decision emphasizes that apologies can, under specific circumstances, be considered sufficient compensation for non-material damages under the GDPR. This raises interesting questions about the valuation of non-material damages and how apologies can be quantified or considered adequate (to be decided by each court individually).

Interpretation of “Damage” under GDPR. The court’s analysis confirms that not every GDPR infringement leads to compensable damage. To claim compensation, individuals must prove actual harm caused by the infringement and establish a clear causal link between the two. This reinforces the principle that a breach of privacy rights alone does not guarantee compensation unless the harm can be demonstrated and directly attributed to the violation.

Controller’s Motivation and Attitude. The decision also touches on the relevance (or irrelevance) of a controller’s motivations and attitudes in awarding compensation. It’s made clear that compensatory awards should focus solely on the damage suffered, without adjusting for the controller’s intent unless it impacts the severity of the harm.

I hope this overview is helpful for your work or studies🤓