GDPR damages: CJEU rejects threshold for non-material harm

The Court of Justice of the European Union (CJEU) has issued a landmark judgment confirming that the General Data Protection Regulation (GDPR) does not require a minimum threshold of seriousness for claims regarding non-material or emotional damages. While the court noted that a claim still requires proof of actual damage, violation, and causation, it rejected attempts by some national legal communities to implement a threshold for compensable harm.

In a related development, the UK Supreme Court is currently considering a similar question in the case of Michael Farley and others v Paymaster (1836) Ltd. This litigation arose after the Sussex Police pension scheme administrator sent annual benefit statements containing sensitive personal information, including National Insurance numbers and salary details, to incorrect residential addresses. The UK court is weighing whether a claimant who proves non-material damage may be denied compensation if the harm is deemed too slight, a decision that could significantly impact the scale of mass data breach claims in England and Wales.