Personal data and liability for damages: Consequences of the CJEU judgment

The judgment of the Court of Justice of the European Union (CJEU) issued on June 20, 2024, in the joined cases C-182/22 and C-189/22 Scalable Capital and Others, concerning claims for non-material damages resulting from violations of personal data protection regulations, does not, in the opinion of Mirosław Wróblewski, President of the Personal Data Protection Office, necessitate changes to Polish law. However, it will have an impact on its interpretation.

In this case, the court submitted preliminary questions to the CJEU regarding the grounds and principles for determining the amount of compensation claims for non-material damages under the GDPR. The CJEU indicated, among other things, that the right to compensation sought under Article 82 of the GDPR is solely compensatory in nature and should not serve a deterrent or punitive function. The compensatory function of damages is related to the fact that the obligation to redress the damage arises regardless of its extent or whether the breach was intentional or unintentional.

Moreover, according to the CJEU, the provisions of the GDPR should be interpreted such that, for "identity theft" to be recognized, it is required that the identity of the person affected by the theft of personal data has actually been appropriated and used by a third party. However, within the meaning of Article 82(1) of the GDPR, compensation for non-material damage caused by the theft of personal data cannot be limited to cases where it has been demonstrated that such data theft subsequently resulted in identity theft or identity fraud as understood in criminal law. At the same time, the CJEU proposed a strict interpretation of the term "identity theft," limiting it exclusively to cases where a third party has appropriated the identity of a person who has lost control over their personal data as a result of its prior theft.

In light of the above CJEU judgment, the President of the Personal Data Protection Office stated that it would not necessitate changes to Polish legal regulations but could influence the interpretation of provisions related to compensation claims for non-material damage caused by violations of data protection laws.

More about the CJEU judgment and its interpretation presented by the President of the CJEU can be found in the attachment.