GDPR Compensation: Latham & Watkins Client Victorious Before ECJ
Latham & Watkins secured a significant decision for MediaMarktSaturn in a landmark ruling in the European Court of Justice (ECJ — Case C-687/21). The ruling tightens requirements for damages claims in data protection law, thus adapting the ECJ’s December 2023 decision that had set a relatively low threshold for damages claims under Art. 82 of the General Data Protection Regulation (GDPR) (Case C-340/21).
In the earlier ruling, the ECJ found the mere fear that personal data had been disclosed following a cyberattack or other data breach could present sufficient grounds for a claim for damages. This interpretation would have had far-reaching consequences for companies and their liability. However, the ECJ’s latest decision clarifies that proof of a GDPR breach alone is not enough to warrant a claim, and that the claimant must also have suffered material or non-material damage as a result. Moreover, the ECJ emphasized that the mere fear of disclosure of data without third-party awareness is not enough to justify a damages claim. Rather, there must also be objective evidence to support such potential misuse of personal data. In particular, a purely hypothetical risk of misuse by an unauthorized third party cannot lead to compensation. This is the case, for example, if no third party has taken note of the personal data in question.
“This decision by the ECJ sets new standards and creates clarity around the burden of proof in actions for damages in data protection law,” says Tim Wybitul, data protection partner at Latham & Watkins in Frankfurt. “The ECJ's decision offers companies more legal certainty and prevents unfounded claims for damages leading to a disproportionate burden. Mass lawsuits against companies affected by cyberattacks will now be more difficult, despite the ECJ’s generally plaintiff-friendly approach.”
The Latham team was led by partner Tim Wybitul in Frankfurt, with associates Isabelle Brams and Constanze Köttgen.
Representative MediaMarktSaturn: Global Data Privacy Officer Kai Schumacher, with Bernhard Hackl.