menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Poland) language
Contact our local member in Poland mail_outline
Visit the website of GKR Legal account_balance

arrow_backPrevious Article
Article 82
Next Articlearrow_forward

Right to compensation and liability

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 82 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 82 keyboard_arrow_up

Key words related to article 82

There is no recital in the Regulation related to article 82.

Show the recitals of the Directive related to article 82 keyboard_arrow_down Hide the recitals of the Directive related to article 82 keyboard_arrow_up

Whereas, if the controller fails to respect the rights of data subjects, national legislation must provide for a judicial remedy; whereas any damage which a person may suffer as a result of unlawful processing must be compensated for by the controller, who may be exempted from liability if he proves that he is not responsible for the damage, in particular in cases where he establishes fault on the part of the data subject or in case of force majeure; whereas sanctions must be imposed on any person, whether governed by private of public law, who fails to comply with the national measures taken under this Directive;

The GDPR

Article 82 of the Regulation confirms the above, by specifying the principle of compensation for the material or immaterial damage suffered by any person as a result of an infringement of this Regulation (paragraph 1). The compensation may be received from the “controller” or the “processor”.

Paragraph 2 of this provision also specifies the events giving rise to the liability of both participants: that a processor shall be liable for its “participation in processing” while the processor shall be only liable for failure to perform the obligations specifically imposed by the Regulation or where it has acted outside or contrary to lawful instructions of the controller.

Exemption from the Directive is applicable in favour of the two actors if proven that the event which caused the damage is not attributable to it.

The real novelty of this provision involves the establishment of a joint liability of the controller(s) and/or the processor(s) involved in the same processing under the conditions defined by the provision. To this end, either the controllers or the processors, or the controller or the processor involved in the same processing must be held liable for damage caused by the processing pursuant to paragraphs 2 and 3. In this case, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject (paragraph 4). Where a controller or processor has paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2 (paragraph 5).

Court proceedings for exercising the right to receive compensation shall be brought before the courts designated competent under the law of the Member State referred to in Article 79 (2) (paragraph 6).

The Directive

Article 23 of the Directive provided for the right to receive from the controller compensation for the damage suffered as a result of an unlawful processing operation or of any act incompatible with said Directive. A controller or processor shall be exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage (fault of the data subject, force majeure, etc.).

This provision implied that a legal remedy is available under national legislation (recital 55).

Potential issues

The first difficulty will be to determine the scope of the requirement of “participation” in the same processing. It seems that the provision considers that there could be a controller who does not participate in the processing (paragraph 2) without defining the scope of these terms. If so, it would be appropriate to admit that the qualification of a controller for a specific processing is not sufficient to give rise to liability for non-compliance.

But what do these conditions for “participation” refer to? The explanation for the concept is particularly unclear: whether the victim is confronted with joint controllers and they are bound by the solidarity rule or the controller is potentially responsible for infringement of the protection rules in the performance of the processing.

The concept is also used to define the liability of potential processors held jointly with one or more controllers (see paragraph 4). In the latter case, however, the participation can be conceived only if the processor acts on the controller’s instruction.

The other difficulty relates to the definition of joint liability. It seems that two conditions must be met: (i) the controllers and/or the processors shall be involved in the same processing and (ii) the violation of specific obligations shall be cause damage suffered by the claimant. However, it seems to be that responsibility for only part of the overall damage shall be sufficient for liability for the entire damage suffered by the claimant. The definition of joint liability seems to be very wide and, on reflection, very severe with respect to the processors who are not liable for the compliance, do not have the same obligations as the controller and who could be required to remedy part of the damages caused by faults not attributable to their service.  Not surprisingly, paragraph (5) allows a controller or processor who has had to pay full compensation to a claimant to recoup that part of the damages actually caused by other controllers or processors involved in the joint processing.

Finally, it should be noted that the text seems to exclude  possible liability of any possible processors processing data on behalf of the main processor. These processors of the processor  appear exempt from the joint liability rule.  Even more amazingly, the text only refers to joint liability of one controller with one processor while in practice, several controllers and processors can participate in the same processing.

arrow_back Previous Article • Article 82 • Next Article arrow_forward
arrow_back Previous Article • Article 82 Next Article arrow_forward
arrow_back Previous Article • Article 82 Next Article arrow_forward

Summary

European Union

European Union

CJEU caselaw

C-40/17 (29 July 2019) - Fashion ID

1.  Articles 22 to 24 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as not precluding national legislation which allows consumer-protection associations to bring or defend legal proceedings against a person allegedly responsible for an infringement of the protection of personal data.

2.      The operator of a website, such as Fashion ID GmbH & Co. KG, that embeds on that website a social plugin causing the browser of a visitor to that website to request content from the provider of that plugin and, to that end, to transmit to that provider personal data of the visitor can be considered to be a controller, within the meaning of Article 2(d) of Directive 95/46. That liability is, however, limited to the operation or set of operations involving the processing of personal data in respect of which it actually determines the purposes and means, that is to say, the collection and disclosure by transmission of the data at issue.

3.      In a situation such as that at issue in the main proceedings, in which the operator of a website embeds on that website a social plugin causing the browser of a visitor to that website to request content from the provider of that plugin and, to that end, to transmit to that provider personal data of the visitor, it is necessary that that operator and that provider each pursue a legitimate interest, within the meaning of Article 7(f) of Directive 95/46, through those processing operations in order for those operations to be justified in respect of each of them.

4.      Article 2(h) and Article 7(a) of Directive 95/46 must be interpreted as meaning that, in a situation such as that at issue in the main proceedings, in which the operator of a website embeds on that website a social plugin causing the browser of a visitor to that website to request content from the provider of that plugin and, to that end, to transmit to that provider personal data of the visitor, the consent referred to in those provisions must be obtained by that operator only with regard to the operation or set of operations involving the processing of personal data in respect of which that operator determines the purposes and means. In addition, Article 10 of that directive must be interpreted as meaning that, in such a situation, the duty to inform laid down in that provision is incumbent also on that operator, but the information that the latter must provide to the data subject need relate only to the operation or set of operations involving the processing of personal data in respect of which that operator actually determines the purposes and means.

Opinion of Advocate general

Judgement of the court

C-300/21 (4 May 2023) - Österreichische Post 

1.      Article 82(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that the mere infringement of the provisions of that regulation is not sufficient to confer a right to compensation.

2.      Article 82(1) of Regulation 2016/679

must be interpreted as precluding a national rule or practice which makes compensation for non-material damage, within the meaning of that provision, subject to the condition that the damage suffered by the data subject has reached a certain degree of seriousness.

3.      Article 82 of Regulation 2016/679

must be interpreted as meaning that for the purposes of determining the amount of damages payable under the right to compensation enshrined in that article, national courts must apply the domestic rules of each Member State relating to the extent of financial compensation, provided that the principles of equivalence and effectiveness of EU law are complied with.

Decision of the Court

Opinion of the advocate general

C-667/21,  ZQ contre Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts (21 décembre 2023)

(English not available yet)

1)      L’article 9, paragraphe 2, sous h), du règlement (UE) 2016/679 du Parlement européen et du Conseil, du 27 avril 2016, relatif à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données, et abrogeant la directive 95/46/CE (règlement général sur la protection des données),

doit être interprété en ce sens que :

l’exception prévue à cette disposition est applicable aux situations dans lesquelles un organisme de contrôle médical traite des données concernant la santé de l’un de ses employés en qualité non pas d’employeur, mais de service médical, afin d’apprécier la capacité de travail de cet employé, sous réserve que le traitement concerné satisfasse aux conditions et garanties expressément imposées par ce point h) et par le paragraphe 3 dudit article 9.

2)      L’article 9, paragraphe 3, du règlement 2016/679

doit être interprété en ce sens que :

le responsable d’un traitement de données concernant la santé, fondé sur l’article 9, paragraphe 2, sous h), de ce règlement, n’est pas tenu, en vertu de ces dispositions, de garantir qu’aucun collègue de la personne concernée ne peut accéder aux données se rapportant à l’état de santé de celle‑ci. Toutefois, une telle obligation peut s’imposer au responsable d’un tel traitement soit en vertu d’une réglementation adoptée par un État membre sur la base de l’article 9, paragraphe 4, dudit règlement, soit au titre des principes d’intégrité et de confidentialité énoncés à l’article 5, paragraphe 1, sous f), du même règlement et concrétisés à l’article 32, paragraphe 1, sous a) et b), de celui-ci.

3)      L’article 9, paragraphe 2, sous h), et l’article 6, paragraphe 1, du règlement 2016/679

doivent être interprétés en ce sens que :

un traitement de données concernant la santé fondé sur cette première disposition doit, afin d’être licite, non seulement respecter les exigences découlant de celle‑ci, mais aussi remplir au moins l’une des conditions de licéité énoncées à cet article 6, paragraphe 1.

4)      L’article 82, paragraphe 1, du règlement 2016/679

doit être interprété en ce sens que :

le droit à réparation prévu à cette disposition remplit une fonction compensatoire, en ce qu’une réparation pécuniaire fondée sur ladite disposition doit permettre de compenser intégralement le préjudice concrètement subi du fait de la violation de ce règlement, et non une fonction dissuasive ou punitive.

5)      L’article 82 du règlement 2016/679

doit être interprété en ce sens que :

d’une part, l’engagement de la responsabilité du responsable du traitement est subordonné à l’existence d’une faute commise par celui‑ci, laquelle est présumée à moins que ce dernier prouve que le fait qui a provoqué le dommage ne lui est nullement imputable, et, d’autre part, cet article 82 ne requiert pas que le degré de gravité de cette faute soit pris en compte lors de la fixation du montant des dommages‑intérêts alloués en réparation d’un préjudice moral sur le fondement de cette disposition.

Decision of the Court (FR)

Opinion of the advocate general

C-456/22, VX, AT v. Gemeinde Ummendorf (14 December 2023)

Article 82(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as precluding national legislation or a national practice which sets a ‘de minimis threshold’ in order to establish non-material damage caused by an infringement of that regulation. The data subject is required to show that the consequences of the infringement which he or she claims to have suffered constitute damage which differs from the mere infringement of the provisions of that regulation.

Decision of the Court

C-340/21,  VB v. Natsionalna agentsia za prihodite (14 December 2023)

1.      Articles 24 and 32 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that unauthorised disclosure of personal data or unauthorised access to those data by a ‘third party’, within the meaning of Article 4(10) of that regulation, are not sufficient, in themselves, for it to be held that the technical and organisational measures implemented by the controller in question were not ‘appropriate’, within the meaning of Articles 24 and 32.

2.      Article 32 of Regulation 2016/679

must be interpreted as meaning that the appropriateness of the technical and organisational measures implemented by the controller under that article must be assessed by the national courts in a concrete manner, by taking into account the risks associated with the processing concerned and by assessing whether the nature, content and implementation of those measures are appropriate to those risks.

3.      The principle of accountability of the controller, set out in Article 5(2) of Regulation 2016/679 and given expression in Article 24 thereof,

must be interpreted as meaning that, in an action for damages under Article 82 of that regulation, the controller in question bears the burden of proving that the security measures implemented by it are appropriate pursuant to Article 32 of that regulation.

4.      Article 32 of Regulation 2016/679 and the principle of effectiveness of EU law

must be interpreted as meaning that, in order to assess the appropriateness of the security measures implemented by the controller under that article, an expert’s report cannot constitute a systematically necessary and sufficient means of proof.

5.      Article 82(3) of Regulation 2016/679

must be interpreted as meaning that the controller cannot be exempt from its obligation to pay compensation for the damage suffered by a data subject, under Article 82(1) and (2) of that regulation, solely because that damage is a result of unauthorised disclosure of, or access to, personal data by a ‘third party’, within the meaning of Article 4(10) of that regulation, in which case that controller must then prove that it is in no way responsible for the event that gave rise to the damage concerned.

6.      Article 82(1) of Regulation 2016/679

must be interpreted as meaning that the fear experienced by a data subject with regard to a possible misuse of his or her personal data by third parties as a result of an infringement of that regulation is capable, in itself, of constituting ‘non-material damage’ within the meaning of that provision.

Decision of the Court

Opinion of the advocate general

Retour au sommaire Retour au sommaire
arrow_back Previous Article • Article 82 Next Article arrow_forward
Regulation
1e 2e

Art. 82

1.   Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.

2.   Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.

3.   A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.

4.   Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject.

5.   Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2.

6.   Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in Article 79(2).
1st proposal close

Art. 77

1. Any person who has suffered damage as a result of an unlawful processing operation or of an action incompatible with this Regulation shall have the right to receive compensation from the controller or the processor for the damage suffered.

2. Where more than one controller or processor is involved in the processing, each controller or processor shall be jointly and severally liable for the entire amount of the damage.

3. The controller or the processor may be exempted from this liability, in whole or in part, if the controller or the processor proves that they are not responsible for the event giving rise to the damage.
2nd proposal close

Art. 77

1. Any person who has suffered material or immaterial damage as a result of a processing which is not in compliance with this Regulation shall have the right to receive compensation from the controller or the processor for the damage suffered.

2. Any controller (…) involved in the processing shall be liable for the damage caused by the processing which is not in compliance with this Regulation. A processor shall be liable for (…) the damage caused by the processing only where it has not complied with obligations of this Regulation specifically directed to processors or acted outside or contrary to lawful instructions of the controller.

3. A controller or the processor shall be exempted from liability in accordance with paragraph 2, (…) if (…) it proves that it is not in any way responsible (…) , for the event giving rise to the damage.

4. Where more than one controller or processor or a controller and a processor are involved in the same processing and, where they are, in accordance with paragraphs 2 and 3, responsible for any damage caused by the processing, (…) each controller or processor shall be held (…) liable for the entire damage.

5. Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage in accordance with the conditions set out in paragraph 2.

6. Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under national law of the Member State referred to in paragraph 2 of Article 75.
Directive close

Art. 23

1. Member States shall provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered.

2. The controller may be exempted from this liability, in whole or in part, if he proves that he is not responsible for the event giving rise to the damage.

 

 
Poland
compare_arrows

No special provisions in Poland. General rules of the civil liability shall apply.
Czechia close

Article 21
(4) If a breach of obligations provided by law occurs in the course of processing of personal data by the controller or by the processor, they shall be liable jointly and severally.

Article 25
General regulation of liability for damage shall apply to matters not specified by this Act.

Article 46
(1) Legal person shall not be liable for an administrative delict if he proves that he has made all reasonable effort to prevent the breach of a legal obligation.
arrow_back Previous Article • Article 82 Next Article arrow_forward
close

2016 - www.itiplaw.eu.