24.08.2022
I. Through numerous media reports (e.g. https://www.derstandard.at/story/2000138472819/datenschutzanwalt-fordert-in-massenbrief-190-euro-von-websitebetreibern-fuer-google and https://www.kleinezeitung.at/oesterreich/6165832/Verstoss-gegen-Datenschutz_Aufregung-um-Unterlassungsschreiben) it became known this week that a large number of practically identical letters are currently being sent to website operators, in which the unlawful processing of personal data (IP addresses) is alleged and (among other things) a small amount is demanded as compensation for this violation of law. In legal terms, these letters refer to a decision of both the Supreme Court in Austria and a decision of the Munich I Regional Court in support of the claim for compensation and a "noticeable disadvantage“ due to the alleged violation of law, as well as annoyance due to the “negligent handling” of the issue of data protection. In fact, the legal situation with regard to the compensation demanded is not clearly clarified.
II. The legal basis used here for claiming damages for data protection violations is Article 82 of the General Data Protection Regulation (GDPR). If courts can actually determine that a person affected by a data protection violation has suffered damage (this can also be non-material damage or mere annoyance or fear of disclosure of personal data)[1], compensation is due in accordance with Art 82 GDPR. Whether the “annoyance” that is automatically associated with every violation of law or the violation of law per se (even without any “Trouble“ about it) justifies the award of damages under Art 82 GDPR, much has been written in legal theory (mostly negatively[2]), however, there is still no conclusive supreme court ruling on this issue.
The GDPR is Union law and only the European Court of Justice can make binding decisions on such unresolved questions of Union law. In this respect, both the Supreme Court in Austria and the Regional Court of Saarbrücken referred the European Court of Justice (ECJ) last year to the question of whether a violation of the provisions of the GDPR, without any further requirements, can give rise to a claim for damages by the person concerned and asked which criteria should be used to determine the extent of the compensation in accordance with Article 82 of the GDPR.[3] A relevant decision by the ECJ is unlikely until 2023 at the earliest.
In these requests for a preliminary ruling, it is pointed out that, on the one hand, there is much to be said for interpreting the concept of damage within the meaning of Article 82 GDPR broadly, but, on the other hand, there are also indications that “Minor damage“ should not be subject to any compensation. In practical terms, the question boils down to whether mere proof of (any) violation of law is sufficient for the civil courts to award compensation, or whether certain damages to the person affected (even if they are mere feelings of discontent) must be alleged and proven, and finally whether these damages must exceed a certain de minimis threshold.
III. The Supreme Court has already stated that no “particularly severe impairment of the emotional world” will have to be demanded in order to justify a claim under Art. 82 GDPR. On the other hand, however, in this decision the OGH also accepted the view of the lower courts, according to which the determination that a data subject has been affected by a certain data processing “massively annoyed“ would be sufficient to justify a claim for damages.[4] The question of whether a claim for damages is due in the event of a mere violation of the provisions of the GDPR, even without any damage being established, was left open.
IV. In case of unlawful processing of an IP address could Of course, the courts seised (such as the Regional Court of Munich I [5] ) avoid these questions of interpretation of Art 82 GDPR by stating that the complaint lodged by the plaintiff concerning this unlawful processing of personal data “ perceived individual discomfort so significantly “ would be that a claim for damages under Art 82 GDPR is justified.
However, the mere statement of a data subject who deliberately visits numerous websites for only a short time in order to document data protection violations that these documented violations cause considerable discomfort would, in our opinion, be hardly credible, especially if there is no other plausible reason for visiting the respective website. In other (non-data protection) contexts, the principle has been established in Austrian case law that "Emotional damage“ should only be replaced if they are at least “understandable“, even if an average person “similar feelings of displeasure“ felt[6] – however, this case law cannot simply be used to interpret Article 82 GDPR (a norm of Union law).
If the court does not find a significant “malaise“ due to unlawful data processing, the question then arises whether the mere determination of the violation of law is sufficient to assume damage and to award compensation for such damage. In this regard, it would then be advisable for the courts seised to wait for the ECJ’s decision on the issues mentioned above and to interrupt the proceedings until then for reasons of procedural economy. Any “test case” regarding claims for damages is therefore likely to take a considerable amount of time.
v. In any case, such letters should be taken as an opportunity to critically question whether your own website meets all data protection requirements or whether improvements need to be made. Our law firm is happy to advise you on data protection issues.
[1] The person affected must prove in court that the damage has occurred; in the case of non-material damage, this is generally only possible through a statement, which the court must then evaluate.
[2] See for example Jahnel, Commentary on the GDPR (2021) Art 82 Rz 9 ff mwN; Silent in Knyrim (ed.) Practical Guide to Data Protection Law4 (2020) paras 19.99 et seq.
[3] Currently pending before the ECJ in cases C-300/21 and C-741/21.
[4] Supreme Court 23.06.2021, 6 Ob 56/21k.
[5] Regional Court Munich I, 20.01.2022, 3 O 17493/20.
[6] For example OGH 10.11.1998, 4 Ob 281/98x.