Official Journal of the European Union

C series

—

C/2024/4691

5.8.2024

(Joined Cases C-182/22 and C-189/22, (1) Scalable Capital)

(References for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - Regulation (EU) 2016/679 - Article 82 - Right to compensation for damage caused by data processing that infringes that regulation - Concept of ‘non-material damage’ - Compensation of a punitive nature or purely in respect of damages and satisfaction - Minimal or symbolic compensation - Theft of personal data stored on a trading application - Identity theft or fraud)

(C/2024/4691)

Language of the case: German

Referring court

Parties to the main proceedings

Applicants: JU (C-182/22), SO (C-189/22)

Defendant: Scalable Capital GmbH

Operative part of the judgment

1.Article 82(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that the right to compensation laid down in that provision fulfils an exclusively compensatory function, in that financial compensation based on that provision must allow the damage suffered to be compensated in full.

2.Article 82(1) of Regulation 2016/679

must be interpreted as not requiring that the severity and the possible intentional nature of the infringement of that regulation by the controller be taken into account for the purposes of compensation for damage under that provision.

3.Article 82(1) of Regulation 2016/679

must be interpreted as meaning that, when determining the amount of damages due in respect of the right to compensation for non-material damage, it is appropriate to consider that such damage caused by a personal data breach is not, by its nature, less significant than physical injury.

4.Article 82(1) of Regulation 2016/679

must be interpreted as meaning that, where damage is established, a national court may, where that damage is not serious, compensate for it by awarding minimal compensation to the data subject, provided that that compensation is such as to compensate in full for the damage suffered.

5.Article 82(1) of Regulation 2016/679, read in the light of recitals 75 and 85 of that regulation,

must be interpreted as meaning that the concept of ‘identity theft’, in order to be classified as such and to give rise to a right to compensation for non-material damage under that provision, implies that the identity of a person affected by a theft of personal data has actually been misused by a third party. However, compensation for non-material damage caused by the theft of personal data, under that provision, cannot be limited to cases where it is shown that that data theft subsequently gave rise to identify theft or fraud.

(1)

Language of the case: German

ELI: http://data.europa.eu/eli/C/2024/4691/oj

ISSN 1977-091X (electronic edition)

—