GDPR compensation for damage (article 82)

Article 82 of the General Data Protection Regulation grants anyone who has suffered material or non-material damage as a result of an infringement of the regulation the right to receive compensation from the controller or processor. For several years national courts diverged on two questions: is damage required, or is the infringement alone enough, and must non-material damage reach a seriousness threshold? The Court of Justice of the Union answered in 2023. In its judgment of May 4, 2023, case C-300/21, it held that mere infringement is not enough, that damage and a causal link must be proven, but that national law may not require non-material damage to reach a seriousness threshold. In a judgment of December 14, 2023, case C-340/21, it accepted that fear of misuse of data by third parties after a leak can constitute non-material damage. These rulings lower the threshold for access to compensation. Each award remains modest, but multiplied by hundreds of thousands of people and combined with representative actions, it makes liability after a data leak a European mass risk that cyber liability cover must now absorb.