To embed, copy and paste the code into your website or blog:
Germany's Federal Constitutional Court holds that the question should be referred to the European Court of Justice
Is a data subject entitled to compensation from a controller or processor if the data subject's GDPR rights have been infringed, even if they have not suffered any kind of material damage? The answer to this question is unresolved in Germany, and according to the Federal Constitutional Court ("
FCC"), the European Court of Justice ("
ECJ") will need to answer it.
The outcome could have major implications for controllers and processors. If a data subject needs not prove any kind of quantifiable, material damages when his or her GDPR rights have been allegedly infringed, controllers and processors face the prospect of compensating countless individuals who need not prove any sort of concrete, cognizable damages before a court. If a controller falls victim to a hacker, for example, then any data subject who shows their data being compromised in some fashion could be entitled to compensation, even if the hack did not cause any damage to the data subject (other than the fact that their data was exposed). Even with small individual compensations, aggregate totals could quickly add up for controllers and processors if they are required to compensate aggrieved data subjects.