A Fresh Perspective on Data Protection and Damages

photo by Unsplash

Opening statements by Peter Hense at a University of Vienna panel titled "EU Future Talks, Non-Material Damages for GDPR Violations: Quo Vadis Österreichische Post (C-300/21)."

Please see video here.

The landmark decision in the "Österreichische Post" case heralds a transformative era in European legal practice, with a heightened focus on private enforcement of privacy and data protection laws. This shift comes as a welcome development for conscientious citizens, particularly in light of the evident shortcomings in the Data Protection Commission (DPC) of Ireland's enforcement of the General Data Protection Regulation (GDPR).

In this groundbreaking ruling, the judiciary revitalizes the age-old Roman legal axiom of "restitutio in integrum", recalibrating it to meet the idiosyncrasies of our increasingly digital landscape.

The 19th century origins of our civil law were predominantly focused on liability related to tangible physical harm, such as anthrax infections originating from tainted goat hair in Germany, or phosphorus-induced jawbone necrosis in British match factories. Legal discourse of the time was rooted in concepts of causality, vicarious liability, and rules of evidence. Today, however, we are confronted with unscrupulous business practices that exploit consumer data for pecuniary gain. Contemporary health and privacy challenges necessitate a recalibration of not only our legal frameworks but also our collective mindset. The Court of Justice of the European Union (CJEU) has demonstrated its keen understanding of this necessity, effectively employing Europe's traditional legal precepts to navigate the current age of TikTok and generative AI.

The doctrine of "restitutio in integrum", a cornerstone of damage law, maintains that any harm inflicted by an illicit act should be rectified to the greatest extent possible, reinstating the status quo ante.

The European Court of Justice's (ECJ) verdict in the "Österreichische Post" case illuminates how this principle can be invoked in cases of frequent data protection infractions. The court unequivocally advocates for the primacy of individual protection when personal data has been misappropriated. Furthermore, it posits that any redress provided by the offending parties must be comprehensive enough to rectify the imbalance engendered by the transgression.

As the 20th century witnessed the evolution of damage law, significant adaptations were necessitated to reflect societal and economic developments. A case in point is Germany's pioneering concept of compensation for the loss of holiday enjoyment. Notably, this shift was spearheaded by the judiciary, who acknowledged the necessity to compensate hard-working people for ruined package holidays. Intriguingly, these trailblazing rulings deemed wasted vacation time as material damage.

Yet, discussions on compensation should not be confined within the parameters of German or Austrian perspectives. The delineation between material and immaterial damages is not a fixed or sacred dictate; rather, it is a more complex and fluid concept.

Holistic compensation, or restitution, encompasses tangible costs of lost time, forfeited work opportunities, and actual legal costs - uncapped as opposed to the German model. These material damages are supplemented by immaterial damages.

The ECJ's ruling in "Österreichische Post" exemplifies this comprehensive approach to compensation. The court underscored that recompense must be commensurate to wholly rectify the imbalance instigated by data protection infringements, thereby acknowledging that such violations yield both tangible and intangible repercussions.

If compensation for a spoilt package holiday is deemed justifiable, then the personal turmoil precipitated by data misuse certainly warrants complete restitution. The rights of individuals, whose data has been unlawfully exploited, must supersede any emotional responses from corporate representatives whose negligence or intentional misconduct has resulted in the infraction.

In the forthcoming years, the European directive (EU) 2020/1828 on representative actions for the protection of the collective interests of consumers, will become increasingly pertinent. It is an economic truism that large-scale legal transgressions can only be countered with large-scale legal defenses.