The European Union’s top court has handed down a couple of notable rulings today in the arena of data protection.
One (Case C-300/21) deals with compensation for breaches of the bloc’s General Data Protection Regulation (GDPR); and the second (Case C-487/21) clarifies the nature of information that individuals exercising GDPR rights to obtain a copy of data held on them should expect to receive.
Read on for a summary of the judgements and some potential implications.
No automatic right to damages — but no threshold for harm either
The CJEU’s GDPR compensation ruling relates to a referral from an Austrian court where an individual sought to sue the national postal service for damages after it used an algorithm to predict the political views of citizens according to socio-demographic criteria without their knowledge or consent — leaving the individual feeling exposed, upset and with a knock to their confidence, per the Court’s press release.
As regards regional damages for privacy violations, there have been a number of attempts to bring class action styl …
