On 14 December 2023, the CJEU issued judgment in the case of VB v Natsionalna agentsia za prihodite. The case relates (amongst other things) to the question of whether “fear” can constitute non-material damage (for which individuals can claim compensation).
The defendant had been the subject of a cyber-attack in which personal information was published on the internet. The appellant was one of the approximately six million individuals whose data had been published and feared that “her personal data, having been published without her consent, might be misused in the future, or that she herself might be blackmailed, assaulted or even kidnapped.”
The court held that it is possible for fear to constitute damage, stating that “Article 82(1) of the GDPR must be interpreted as meaning that the fear experienced by a data subject with regard to a possible misuse of his or her personal data by third parties as a result of an infringement of that regulation is capable, in itself, of constituting ‘non-material damage’”.
This is in line with an earlier ruling by the court (see the May 2023 DPO Digest) in which it held that there is no threshold for seriousness of harm (although such harm must be evidenced).
The full judgment can be found here.
If you would like to discuss the implications of this case for your organisation, please get in touch with your usual contact, or email hello@hellodpo.com
