82Furthermore, the first sentence of recital 85 of the GDPR states that ‘a personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, … or any other significant economic or social disadvantage to the natural person concerned’. It is apparent from that illustrative list of types of ‘damage’ that may be suffered by the data subjects that the EU legislature intended to include in those concepts, in particular, the mere ‘loss of control’ over their own data, as a result of an infringement of that regulation, even if there had been no misuse of the data in question to the detriment of those data subjects.
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.