[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_NcsnwAhUN1rKWSULo93dRJNzta10n-FGaXiBeZ4LE0":3},{"article":4,"iocs":42,"watch_terms":43,"solutions":44,"lesson":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"a4805332-525a-4baf-beff-1d9995ddf2f4","Article 82 GDPR","article-82-gdpr-d212cf","No minimum threshold ← Older revision Revision as of 13:10, 12 October 2026 Line 272: Line 272: Meanwhile the CJEU clarified that the loss of control over personal data may constitute ‘non-material damage’ if a data subject shows that they actually suffered such damage. CJEU, Case C-590\u002F22, ''PS GbR'', 20 June 2024, margin number 33 (available [[CJEU - C‑590\u002F22 - PS (Incorrect address)|here]]); CJEU, Case C-200\u002F23, ''Agentsia po vpisvaniya'', 4 October 2024, margin number 150 and 156 (available [[CJEU - C-200\u002F23 - Agentsia po vpisvaniyata|here]]) each with further references. This includes cases where no actual misuse of the respective data is proven. CJEU, Case C-200\u002F23, ''Agentsia po vpisvaniya'', 4 October 2024, margin number 145 (available [[CJEU - C-200\u002F23 - Agentsia po vpisvaniyata|here]]). Meanwhile the CJEU clarified that the loss of control over personal data may constitute ‘non-material damage’ if a data subject shows that they actually suffered such damage. CJEU, Case C-590\u002F22, ''PS GbR'', 20 June 2024, margin number 33 (available [[CJEU - C‑590\u002F22 - PS (Incorrect address)|here]]); CJEU, Case C-200\u002F23, ''Agentsia po vpisvaniya'', 4 October 2024, margin number 150 and 156 (available [[CJEU - C-200\u002F23 - Agentsia po vpisvaniyata|here]]) each with further references. This includes cases where no actual misuse of the respective data is proven. CJEU, Case C-200\u002F23, ''Agentsia po vpisvaniya'', 4 October 2024, margin number 145 (available [[CJEU - C-200\u002F23 - Agentsia po vpisvaniyata|here]]). {{Quote-CJEU|\"The loss of control over personal data, even for a short period of time, may constitute ‘non-material damage’, within the meaning of Article 82(1) of the GDPR, giving rise to a right to compensation, provided that the data subject can show that he or she has actually suffered such damage, however slight, bearing in mind that the mere infringement of the provisions of that regulation is not sufficient to confer a right to compensation on that basis [...].|CJEU - C‑590\u002F22 - PS (Incorrect address)|33}}Similarly, the CJEU held that mere negative feelings experienced by the data subject, such as ''fear'' or ''annoyance'', which are caused by a loss of control over those data, by a potential misuse of those data or by harm to the data subject's reputation can constitute a non-material damage, provided that the data subject demonstrates that they is experiencing such feelings. CJEU, Case C‑655\u002F23, Quirin Privatbank, 4 September 2025, margin number 64 (available [[CJEU - C-655\u002F23 - Quirin Privatbank|here]]). The same is true about non-material damage suffered by the data subject's by an uncertainty as to whether their data have been processed. CJEU, Case C-526\u002F24, Brillen Rottler, 19 March 2026, margin number 67 (available [[CJEU - C-526\u002F24 - Brillen Rottler|here]]). {{Quote-CJEU|\"The loss of control over personal data, even for a short period of time, may constitute ‘non-material damage’, within the meaning of Article 82(1) of the GDPR, giving rise to a right to compensation, provided that the data subject can show that he or she has actually suffered such damage, however slight, bearing in mind that the mere infringement of the provisions of that regulation is not sufficient to confer a right to compensation on that basis [...].|CJEU - C‑590\u002F22 - PS (Incorrect address)|33}}Similarly, the CJEU held that mere negative feelings experienced by the data subject, such as ''fear'' or ''annoyance'', which are caused by a loss of control over those data, by a potential misuse of those data or by harm to the data subject's reputation can constitute a non-material damage, provided that the data subject demonstrates that they are experiencing such feelings. CJEU, Case C‑655\u002F23, Quirin Privatbank, 4 September 2025, margin number 64 (available [[CJEU - C-655\u002F23 - Quirin Privatbank|here]]). The same is true about non-material damage suffered by the data subject's by an uncertainty as to whether their data have been processed. CJEU, Case C-526\u002F24, Brillen Rottler, 19 March 2026, margin number 67 (available [[CJEU - C-526\u002F24 - Brillen Rottler|here]]). =====No minimum threshold===== =====No minimum threshold===== Line 363: Line 363: [[Category:GDPR Articles]] [[index.php?title=Category:GDPR Articles]]","The Court of Justice of the European Union (CJEU) has clarified that loss of control over personal data can constitute 'non-material damage' under GDPR Article 82, even without proof of actual misuse. This includes feelings like fear or annoyance, provided the data subject demonstrates they suffered such damage. The rulings emphasize that mere infringement of GDPR provisions is insufficient for compensation.","CJEU clarifies non-material damage under GDPR for data loss.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Article_82_GDPR&diff=53375&oldid=51311",null,"2026-10-12T13:10:14+00:00","2026-10-12T14:00:12.733835+00:00",7,[17,20],{"name":18,"type":19},"GDPR","product",{"name":21,"type":22},"personal data","technology","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":12,"name":25,"slug":26},"Policy","policy",[28,32,37],{"category":29},{"id":30,"icon":12,"name":18,"slug":31},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":33},{"id":34,"icon":12,"name":35,"slug":36},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":38},{"id":39,"icon":12,"name":40,"slug":41},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[],[18],{"controls":45,"vendors":46},[],[],{"slug":48,"title":49,"body":50,"framework_refs":51,"framework_notes":65},"cjeu-loss-of-control-over-personal-data-qualifies-as-compensable-harm-under-gdpr-article-82","CJEU: Loss of Control Over Personal Data Qualifies as Compensable Harm Under GDPR Article 82","The Court of Justice of the European Union has ruled that individuals do not need to prove actual misuse of their personal data to claim non-material damages under GDPR Article 82 — loss of control alone, accompanied by demonstrable feelings such as fear or distress, is sufficient. This significantly lowers the threshold for successful compensation claims and raises the legal and financial stakes for organizations that experience data breaches or unauthorized disclosures. However, the court also clarified that a mere technical GDPR violation, without evidence of personal impact on the data subject, is not enough for compensation. This ruling means organizations must treat every incident involving personal data exposure as a potential liability event, not just a compliance checkbox. Proactive data governance, rapid breach response, and transparent communication with affected individuals are now more critical than ever.",[52,53,54,55,56,57,58,59,60,61,62,63,64],"GDPR Article 82 (Right to compensation and liability)","GDPR Article 83 (General conditions for imposing administrative fines)","GDPR Article 33 (Notification of a personal data breach to the supervisory authority)","GDPR Article 34 (Communication of a personal data breach to the data subject)","GDPR Article 25 (Data protection by design and by default)","GDPR Article 30 (Records of processing activities)","NIST SP 800-53 IR-6 (Incident Reporting)","NIST SP 800-53 SI-12 (Information Management and Retention)","NIST Privacy Framework PR.DS-P (Data Processing Ecosystem Risk Management)","CIS Control 3 (Data Protection)","CIS Control 17 (Incident Response Management)","ISO\u002FIEC 27701 (Privacy Information Management)","ITIL Service Management — Problem and Incident Management",{}]