VX and AT v Gemeinde Ummendorf (C-456/22)

Contents

Judgment of the Court (Third Chamber)14 December 2023^note(Reference for a preliminary ruling — Protection of personal data — Regulation (EU) 2016/679 — Article 82 — Right to compensation and liability — Concept of non-material damage — Online publication of the agenda for a municipal council meeting containing personal data — Publication without the consent of the data subjects — Claim of those data subjects seeking compensation for non-material damage)In Case C‑456/22,REQUEST for a preliminary ruling under Article 267 TFEU from the Landgericht Ravensburg (Regional Court, Ravensburg, Germany), made by decision of 30 June 2022, received at the Court on 8 July 2022, in the proceedingsVX,ATvGemeinde Ummendorf,THE COURT (Third Chamber),composed of K. Jürimäe, President of the Chamber, N. Piçarra, M. Safjan, N. Jääskinen (Rapporteur) and M. Gavalec, Judges,Advocate General: N. Emiliou,Registrar: A. Calot Escobar,having regard to the written procedure,after considering the observations submitted on behalf of:– AT and VX, by O. Leuze, Rechtsanwalt,– Gemeinde Ummendorf, by A. Staudacher, Rechtsanwalt,– Ireland, by M. Browne, A. Joyce and M. Tierney, acting as Agents, and by D. Fennelly, Barrister-at-Law,– the European Commission, by A. Bouchagiar, M. Heller and H. Kranenborg, acting as Agents,having decided, after hearing the Advocate General, to proceed to judgment without an Opinion,gives the following

Judgment

1This request for a preliminary ruling concerns the interpretation of Article 82(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’).

2The request has been made in proceedings between two natural persons, AT and VX, on the one hand, and the Gemeinde Ummendorf (Municipality of Ummendorf, Germany), on the other, concerning the award of damages, under Article 82(1) of the GDPR, by way of compensation for the suffering endured (pretium doloris) which they claim to have undergone as a result of the disclosure, without their consent, of their personal data on that municipality’s website.

Legal context

3The first, third and sixth sentences of recital 146 of the GDPR are worded as follows:‘The controller or processor should compensate any damage which a person may suffer as a result of processing that infringes this Regulation. … The concept of damage should be broadly interpreted in the light of the case-law of the Court of Justice [of the European Union] in a manner which fully reflects the objectives of this Regulation. … Data subjects should receive full and effective compensation for the damage they have suffered. …’

4Article 5(1)(a) of that regulation, entitled ‘Principles relating to processing of personal data’, provides:‘Personal data shall be:(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”)’.

5Article 82 of that regulation, entitled ‘Right to compensation and liability’, provides in paragraph 1 thereof:‘Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.’

The dispute in the main proceedings and the question referred for a preliminary ruling

6On 19 June 2020, the Municipality of Ummendorf, without the consent of the applicants in the main proceedings, published on the internet the agenda of a meeting of the municipal council, in which their names were referred to on several occasions, and a judgment delivered on 10 March 2020 by the Verwaltungsgericht Sigmaringen (Administrative Court, Sigmaringen, Germany), which also referred to their surnames and forenames and the address of their domicile. Those documents were accessible on the homepage of that municipality’s website until 22 June 2020.

7Taking the view that that publication infringed the GDPR and that the Municipality of Ummendorf had acted intentionally, since the names of the other parties to the proceedings which led to that judgment had been deleted, the applicants in the main proceedings asked the municipality to compensate them for the non-material damage which they claimed to have suffered, within the meaning of Article 82(1) of that regulation. They submit that the unlawful disclosure of personal data of an individual constitutes ‘damage’, within the meaning of that provision, without any ‘de minimis threshold’ being relied on, which would be contrary to the scheme of the GDPR and to the deterrent effect of that provision.

8The Municipality of Ummendorf, on the other hand, submits that compensation for ‘non-material damage’, within the meaning of Article 82(1) of the GDPR, requires proof of a noticeable disadvantage and an objectively comprehensible impairment of personal interests.

9Hearing the case on appeal between the parties to the main proceedings, the Landgericht Ravensburg (Regional Court, Ravensburg, Germany), which is the referring court, takes the view that, by publishing on the internet the personal data of the applicants in the main proceedings, the Municipality of Ummendorf infringed Article 5(1)(a) of the GDPR. That court is uncertain, however, whether that publication caused the applicants non-material damage within the meaning of Article 82(1) of that regulation, with the result that they are entitled to compensation for the suffering endured.

10In particular, the referring court considers that the mere loss of control over the personal data of the applicants in the main proceedings is not sufficient to constitute non-material damage within the meaning of Article 82(1) of the GDPR. It considers that, in order to accept the existence of non-material damage, a ‘de minimis threshold’ must be exceeded and that that is not the case where the data subjects have lost control over their data only for a short period of time, without causing them a noticeable disadvantage and without an objectively comprehensible impairment to their personal interests having been demonstrated.

11In those circumstances, the Landgericht Ravensburg (Regional Court, Ravensburg) decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling:‘Is the concept of non-material damage in Article 82(1) of [the GDPR] to be interpreted as meaning that the assumption of non-material damage requires a noticeable disadvantage and an objectively comprehensible impairment of personal interests, or is the mere short-term loss of the data subject’s unfettered control over his or her data due to the publication of personal data on the internet for a period of a few days, which did not have any noticeable or adverse consequences for the data subject, sufficient for that purpose?’

Consideration of the question referred

12By its question, the referring court asks, in essence, whether Article 82(1) of the GDPR must be interpreted as precluding national legislation or a national practice which sets a ‘de minimis threshold’ in order to establish non-material damage caused by an infringement of that regulation.

13In that regard, it should be recalled that that provision provides that ‘any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered’.

14As the Court has pointed out, it is clear from the wording of Article 82(1) of the GDPR that the existence of ‘damage’ which has been ‘suffered’ constitutes one of the conditions for the right to compensation laid down in that provision, as does the existence of an infringement of that regulation and of a causal link between that damage and that infringement, those three conditions being cumulative (judgments of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraph 32, and of today, Natsionalna agentsia za prihodite, C‑340/21, paragraph 77). It follows that those three conditions are necessary and sufficient in order to have a right to compensation within the meaning of that provision.

15Having regard to the absence of any reference in Article 82(1) of the GDPR to the national law of the Member States, the concept of ‘non-material damage’, within the meaning of that provision, must be given an autonomous and uniform definition specific to EU law (see, to that effect, judgment of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraphs 30 and 44).

16From that point of view, on the basis of considerations of a literal, systemic and teleological nature, the Court has interpreted Article 82(1) of the GDPR as precluding a national rule or practice which makes compensation for ‘non-material damage’, within the meaning of that provision, subject to the condition that the damage suffered by the data subject has reached a certain degree of seriousness (judgments of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraph 51, and of today, Natsionalna agentsia za prihodite, C‑340/21, paragraph 78).

17Accordingly, it cannot be considered that, in addition to the three conditions set out in paragraph 14 of the present judgment, other conditions for establishing liability laid down in Article 82(1) of the GDPR, such as the tangible nature of the damage or the objective nature of the infringement, may be added.

18It follows that Article 82(1) of the GDPR does not require that, following a proven infringement of provisions of that regulation, the ‘non-material damage’ alleged by the data subject must reach a ‘de minimis threshold’ in order for that damage to be capable of compensation.

19That interpretation is supported by the third sentence of recital 146 of the GDPR, which states that ‘the concept of damage should be broadly interpreted in the light of the case-law of the Court … in a manner which fully reflects the objectives [of that regulation]’. It would be contrary to that broad conception of ‘damage’, favoured by the EU legislature, if that concept were limited solely to damage of a certain degree of seriousness, in particular as regards the duration of the period during which the negative consequences of the infringement of that regulation were suffered by the data subjects (see, to that effect, judgments of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraph 46, and of today, Natsionalna agentsia za prihodite, C‑340/21, paragraph 81).

20Furthermore, such an interpretation is consistent with one of the objectives of the GDPR, which is to ensure a consistent and high level of protection of natural persons with regard to the processing of personal data within the European Union. Making compensation for non-material damage subject to a certain threshold of seriousness would risk undermining the coherence of the rules established by the GDPR, since the graduation of such a threshold, on which the possibility or otherwise of obtaining that compensation would depend, would be liable to fluctuate according to the assessment of the courts seised (see, to that effect, judgment of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraphs 48 and 49).

21A person concerned by an infringement of the GDPR which has negative consequences for him or her is, however, required to demonstrate that those consequences constitute non-material damage within the meaning of Article 82 of that regulation (see, to that effect, judgments of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraph 50, and of today, Natsionalna agentsia za prihodite, C‑340/21, paragraph 84). The mere infringement of the provisions of that regulation is not sufficient to confer a right to compensation (judgment of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraph 42).

22In those circumstances, although there is nothing to preclude the publication on the internet of personal data and the consequent loss of control over those data for a short period of time from causing the data subjects ‘non-material damage’, within the meaning of Article 82(1) of the GDPR, giving rise to a right to compensation, those persons must also demonstrate that they have actually suffered such damage, however minimal.

23In the light of the foregoing, the answer to the question referred is that Article 82(1) of the GDPR must be interpreted as precluding national legislation or a national practice which sets a ‘de minimis threshold’ in order to establish non-material damage caused by an infringement of that regulation. The data subject is required to show that the consequences of the infringement which he or she claims to have suffered constitute damage which differs from the mere infringement of the provisions of that regulation.

Costs

24Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

Operative part

On those grounds, the Court (Third Chamber) hereby rules: Article 82(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),must be interpreted as precluding national legislation or a national practice which sets a ‘de minimis threshold’ in order to establish non-material damage caused by an infringement of that regulation. The data subject is required to show that the consequences of the infringement which he or she claims to have suffered constitute damage which differs from the mere infringement of the provisions of that regulation.