{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:m-l-c-182-22-och-c-189-22","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:m-l-c-182-22-och-c-189-22)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-19","fingerprint":"ewai:eu:d068f1","proof":"sha256:ebe96a09462dd4eacb604963635bae21b6453d08e19b32484d87f54e32ff001a","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:m-l-c-182-22-och-c-189-22","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62022CJ0182","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (Third Chamber)","paragraphs":[]},{"title":"20 June 2024 (\n *1\n )","paragraphs":["para_4","para_5","para_6","para_7"]},{"title":"SO (C‑189/22)","paragraphs":["para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24","para_25","para_26"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_29"]},{"title":"2","paragraphs":["para_31"]},{"title":"Legal context","paragraphs":[]},{"title":"3","paragraphs":[]},{"title":"Recitals 75, 85 and 146 of the GDPR are worded as follows:","paragraphs":["para_35","para_36","para_37"]},{"title":"(85)","paragraphs":["para_39","para_40"]},{"title":"(146)","paragraphs":["para_42"]},{"title":"4","paragraphs":[]},{"title":"Article 4 of the regulation, entitled ‘Definitions’, provides:","paragraphs":["para_45"]},{"title":"(1)","paragraphs":["para_47","para_48"]},{"title":"(7)","paragraphs":["para_50","para_51"]},{"title":"(10)","paragraphs":["para_53","para_54"]},{"title":"(12)","paragraphs":["para_56","para_57"]},{"title":"5","paragraphs":["para_59","para_60","para_61","para_62"]},{"title":"The disputes in the main proceedings and the questions referred for a preliminary ruling","paragraphs":[]},{"title":"6","paragraphs":["para_65"]},{"title":"7","paragraphs":["para_67"]},{"title":"8","paragraphs":["para_69"]},{"title":"9","paragraphs":["para_71"]},{"title":"10","paragraphs":["para_73"]},{"title":"11","paragraphs":["para_75"]},{"title":"12","paragraphs":["para_77"]},{"title":"13","paragraphs":["para_79"]},{"title":"14","paragraphs":["para_81","para_82","para_83"]},{"title":"(2)","paragraphs":["para_85","para_86","para_87"]},{"title":"(3)","paragraphs":["para_89"]},{"title":"(4)","paragraphs":["para_91"]},{"title":"(5)","paragraphs":["para_93"]},{"title":"Procedure before the Court","paragraphs":[]},{"title":"15","paragraphs":["para_96"]},{"title":"16","paragraphs":["para_98"]},{"title":"Admissibility of the requests for a preliminary ruling","paragraphs":[]},{"title":"17","paragraphs":["para_101"]},{"title":"18","paragraphs":["para_103"]},{"title":"19","paragraphs":["para_105"]},{"title":"20","paragraphs":["para_107"]},{"title":"Consideration of the questions referred","paragraphs":[]},{"title":"The first question and the first part of the second question","paragraphs":[]},{"title":"21","paragraphs":["para_111"]},{"title":"22","paragraphs":["para_113"]},{"title":"23","paragraphs":["para_115"]},{"title":"24","paragraphs":["para_117"]},{"title":"The second part of the second question","paragraphs":[]},{"title":"25","paragraphs":["para_120"]},{"title":"The third part of the second question","paragraphs":[]},{"title":"26","paragraphs":["para_123"]},{"title":"27","paragraphs":["para_125"]},{"title":"28","paragraphs":["para_127"]},{"title":"29","paragraphs":["para_129"]},{"title":"30","paragraphs":["para_131"]},{"title":"The third question","paragraphs":[]},{"title":"31","paragraphs":["para_134"]},{"title":"32","paragraphs":["para_136"]},{"title":"33","paragraphs":["para_138"]},{"title":"34","paragraphs":["para_140"]},{"title":"35","paragraphs":["para_142"]},{"title":"36","paragraphs":["para_144"]},{"title":"37","paragraphs":["para_146"]},{"title":"38","paragraphs":["para_148"]},{"title":"39","paragraphs":["para_150"]},{"title":"The fourth question","paragraphs":[]},{"title":"40","paragraphs":["para_153"]},{"title":"41","paragraphs":["para_155"]},{"title":"42","paragraphs":["para_157"]},{"title":"43","paragraphs":["para_159"]},{"title":"44","paragraphs":["para_161"]},{"title":"45","paragraphs":["para_163"]},{"title":"46","paragraphs":["para_165"]},{"title":"The fifth question","paragraphs":[]},{"title":"Admissibility","paragraphs":[]},{"title":"47","paragraphs":["para_169"]},{"title":"48","paragraphs":["para_171"]},{"title":"49","paragraphs":["para_173"]},{"title":"50","paragraphs":["para_175"]},{"title":"Substance","paragraphs":[]},{"title":"51","paragraphs":["para_178"]},{"title":"52","paragraphs":["para_180"]},{"title":"53","paragraphs":["para_182"]},{"title":"54","paragraphs":["para_184"]},{"title":"55","paragraphs":["para_186"]},{"title":"56","paragraphs":["para_188"]},{"title":"57","paragraphs":["para_190"]},{"title":"58","paragraphs":["para_192"]},{"title":"Costs","paragraphs":[]},{"title":"59","paragraphs":["para_195"]},{"title":"On those grounds, the Court (Third Chamber) hereby rules:","paragraphs":["para_197","para_198","para_199","para_200"]},{"title":"Article 82(1) of Regulation 2016/679","paragraphs":["para_202","para_203"]},{"title":"Article 82(1) of Regulation 2016/679","paragraphs":["para_205","para_206"]},{"title":"Article 82(1) of Regulation 2016/679","paragraphs":["para_208","para_209","para_210","para_211","para_212","para_213"]}],"paragraphs":[{"text":"62022CJ0182","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (Third Chamber)","paragraph_id":"para_2"},{"text":"20 June 2024 (\n *1\n )","paragraph_id":"para_3"},{"text":"(References for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 82 – Right to compensation for damage caused by data processing that infringes that regulation – Concept of ‘non-material damage’ – Compensation of …","paragraph_id":"para_4"},{"text":"In Joined Cases C‑182/22 and C‑189/22,","paragraph_id":"para_5"},{"text":"REQUESTS for a preliminary ruling under Article 267 TFEU from the Amtsgericht München (Local Court, Munich, Germany), made by decisions of 3 March 2022, received at the Court on 10 and 11 March 2022, in the proceedings","paragraph_id":"para_6"},{"text":"JU (C‑182/22),","paragraph_id":"para_7"},{"text":"SO (C‑189/22)","paragraph_id":"para_8"},{"text":"v","paragraph_id":"para_9"},{"text":"Scalable Capital GmbH,","paragraph_id":"para_10"},{"text":"THE COURT (Third Chamber),","paragraph_id":"para_11"},{"text":"composed of K. Jürimäe, President of the Chamber, N. Piçarra and N. Jääskinen (Rapporteur), Judges,","paragraph_id":"para_12"},{"text":"Advocate General: A.M. Collins,","paragraph_id":"para_13"},{"text":"Registrar: A. Calot Escobar,","paragraph_id":"para_14"},{"text":"having regard to the written procedure,","paragraph_id":"para_15"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_16"},{"text":"–","paragraph_id":"para_17"},{"text":"SO, by M. Ruigrok van de Werve, Rechtsanwalt,","paragraph_id":"para_18"},{"text":"–","paragraph_id":"para_19"},{"text":"Scalable Capital GmbH, by M.C. Mekat, Rechtsanwalt,","paragraph_id":"para_20"},{"text":"–","paragraph_id":"para_21"},{"text":"Ireland, by M. Browne, Chief State Solicitor, A. Joyce and M. Tierney, acting as Agents, and by D. Fennelly, Barrister-at-Law,","paragraph_id":"para_22"},{"text":"–","paragraph_id":"para_23"},{"text":"the European Commission, by A. Bouchagiar, M. Heller and H. Kranenborg, acting as Agents,","paragraph_id":"para_24"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 26 October 2023,","paragraph_id":"para_25"},{"text":"gives the following","paragraph_id":"para_26"},{"text":"Judgment","paragraph_id":"para_27"},{"text":"1","paragraph_id":"para_28"},{"text":"These requests for a preliminary ruling concern the interpretation of Article 82 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( OJ 2016, L 119, p. 1 ; ‘the GDPR’).","paragraph_id":"para_29"},{"text":"2","paragraph_id":"para_30"},{"text":"The requests have been made in two sets of proceedings between, on the one hand, JU and SO, respectively, and, on the other hand, Scalable Capital GmbH, concerning compensation for the non-material damage which they claim to have suffered as a result of the theft, by third parties whose identity is unknown, of their personal data stored on a trading application managed by that company.","paragraph_id":"para_31"},{"text":"Legal context","paragraph_id":"para_32"},{"text":"3","paragraph_id":"para_33"},{"text":"Recitals 75, 85 and 146 of the GDPR are worded as follows:","paragraph_id":"para_34"},{"text":"‘(75)","paragraph_id":"para_35"},{"text":"The risk to the rights and freedoms of natural persons, of varying likelihood and severity, may result from personal data processing which could lead to physical, material or non-material damage, in particular: where the processing may give rise to discrimination, identity theft or fraud, financial …","paragraph_id":"para_36"},{"text":"…","paragraph_id":"para_37"},{"text":"(85)","paragraph_id":"para_38"},{"text":"A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthoris …","paragraph_id":"para_39"},{"text":"…","paragraph_id":"para_40"},{"text":"(146)","paragraph_id":"para_41"},{"text":"… The controller or processor should be exempt from liability if it proves that it is not in any way responsible for the damage. The concept of damage should be broadly interpreted in the light of the case-law of the Court of Justice in a manner which fully reflects the objectives of this Regulation. … Data subjects should receive full and effective compensation for the damage they have suffered. …’","paragraph_id":"para_42"},{"text":"4","paragraph_id":"para_43"},{"text":"Article 4 of the regulation, entitled ‘Definitions’, provides:","paragraph_id":"para_44"},{"text":"‘For the purposes of this Regulation:","paragraph_id":"para_45"},{"text":"(1)","paragraph_id":"para_46"},{"text":"“personal data” means any information relating to an identified or identifiable natural person (“data subject”); …","paragraph_id":"para_47"},{"text":"…","paragraph_id":"para_48"},{"text":"(7)","paragraph_id":"para_49"},{"text":"“controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; …","paragraph_id":"para_50"},{"text":"…","paragraph_id":"para_51"},{"text":"(10)","paragraph_id":"para_52"},{"text":"“third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;","paragraph_id":"para_53"},{"text":"…","paragraph_id":"para_54"},{"text":"(12)","paragraph_id":"para_55"},{"text":"“personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;","paragraph_id":"para_56"},{"text":"…’","paragraph_id":"para_57"},{"text":"5","paragraph_id":"para_58"},{"text":"Article 82 of that regulation, entitled ‘Right to compensation and liability’, states in paragraphs 1 to 3:","paragraph_id":"para_59"},{"text":"‘1.   Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.","paragraph_id":"para_60"},{"text":"2.   Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.","paragraph_id":"para_61"},{"text":"3.   A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.’","paragraph_id":"para_62"},{"text":"The disputes in the main proceedings and the questions referred for a preliminary ruling","paragraph_id":"para_63"},{"text":"6","paragraph_id":"para_64"},{"text":"Scalable Capital, a company incorporated under German law, manages a trading application in which the applicants in the main proceedings, JU and SO, had opened an account. To that end, they entered certain personal data in their respective accounts, in particular their names, dates of birth, postal …","paragraph_id":"para_65"},{"text":"7","paragraph_id":"para_66"},{"text":"In 2020, personal data and data relating to the deposit made by those applicants were seized by third parties whose identity remains unknown. According to Scalable Capital, those personal data have not been used fraudulently to date.","paragraph_id":"para_67"},{"text":"8","paragraph_id":"para_68"},{"text":"In that context, the applicants in the main proceedings brought an action before the Amtsgericht München (Local Court, Munich, Germany), which is the referring court, seeking compensation for the non-material damage which they claim to have suffered as a result of the theft of their personal data.","paragraph_id":"para_69"},{"text":"9","paragraph_id":"para_70"},{"text":"In the first place, the referring court’s questions stem from the divergent approaches of the German courts to the assessment of the damages which should be awarded in that type of situation. This results in significant variations in the amount of financial compensation awarded in cases which are ne …","paragraph_id":"para_71"},{"text":"10","paragraph_id":"para_72"},{"text":"In the second place, as regards the assessment of non-material damage, the referring court relies on German law to distinguish between a ‘compensatory’ function and a ‘personal satisfaction’ function. The purpose of the compensatory function is to offset the actual and foreseeable consequences of th …","paragraph_id":"para_73"},{"text":"11","paragraph_id":"para_74"},{"text":"In the third place, German law does not provide for a scale for determining the amount of damages to be awarded according to the situations in which they are claimed. However, the large number of individual decisions issued makes it possible to establish a framework to which to refer, which leads to …","paragraph_id":"para_75"},{"text":"12","paragraph_id":"para_76"},{"text":"In the fourth place, the referring court questions the possibility of awarding small amounts of compensation, which could be perceived as symbolic, in cases where the damage linked to an infringement of the GDPR is minimal.","paragraph_id":"para_77"},{"text":"13","paragraph_id":"para_78"},{"text":"In the fifth place, the referring court notes that the parties to the main proceedings interpret the concept of ‘identity theft’ differently. In that regard, that court considers that there is only a theft of identity when the unlawfully obtained data are used by a third party in order to impersonate the data subject.","paragraph_id":"para_79"},{"text":"14","paragraph_id":"para_80"},{"text":"In those circumstances, the Amtsgericht München (Local Court, Munich) decided, in Cases C‑182/22 and C‑189/22, to stay the proceedings and to refer the following questions, which are worded identically in both cases, to the Court of Justice for a preliminary ruling:","paragraph_id":"para_81"},{"text":"‘(1)","paragraph_id":"para_82"},{"text":"Is Article 82 of the [GDPR] to be interpreted as meaning that the right to compensation, including the determination of the amount of that compensation, does not have a punitive character, in particular, that it has no general or specific dissuasive function, but a purely compensatory function and, in some instances, a satisfaction function?","paragraph_id":"para_83"},{"text":"(2)","paragraph_id":"para_84"},{"text":"Is the right to compensation for non-material damage to be determined on the basis that it also has an individual satisfaction function – understood here to mean the private interest of the injured party in seeing the behaviour that caused the damage penalised – or does it have only a compensatory function – understood here to mean the function of compensating for the detrimental effects suffered?","paragraph_id":"para_85"},{"text":"If it is to be assumed that the right to compensation for non-material damage has both a compensatory and a satisfaction function: is it to be determined on the basis that the compensatory function has structural precedence over the satisfaction function or, at least, that the relationship between the two is that of the rule and the exception? Does that mean that it can have a satisfaction function only when the infringement is deliberate or a result of gross negligence?","paragraph_id":"para_86"},{"text":"If the right to compensation for non-material damage does not have a satisfaction function: when determining that compensation, is additional weight attributed only to deliberate or grossly negligent data protection infringements deemed to be contributory factors?","paragraph_id":"para_87"},{"text":"(3)","paragraph_id":"para_88"},{"text":"Is the compensation for non-material damage to be determined on the basis of a structural order of precedence or, at least, a rule-exception relationship, which attributes less weight to the detrimental effects of a data infringement than to the detrimental and painful effects associated with a physical injury?","paragraph_id":"para_89"},{"text":"(4)","paragraph_id":"para_90"},{"text":"[Assuming] that damage has been sustained, can a national court award only minimal compensation, which may be perceived by the injured party or generally as merely symbolic, in the light of the non-serious nature of the damage?","paragraph_id":"para_91"},{"text":"(5)","paragraph_id":"para_92"},{"text":"Are the consequences of the compensation for non-material damage to be assessed on the basis that identity theft within the meaning of recital 75 of the [GDPR] requires an offender to have actually assumed the identity of the person concerned, that is to say to have somehow impersonated that person, or does the mere fact that offenders have gained possession of data that identify the person concerned constitute such identity theft?’","paragraph_id":"para_93"},{"text":"Procedure before the Court","paragraph_id":"para_94"},{"text":"15","paragraph_id":"para_95"},{"text":"By decision of the President of the Court of 19 April 2022, Cases C‑182/22 and C‑189/22 were joined for the purposes of the written and oral parts of the procedure and the judgment.","paragraph_id":"para_96"},{"text":"16","paragraph_id":"para_97"},{"text":"On 1 June 2022, the President of the Court rejected Scalable Capital’s request to anonymise the present proceedings pursuant to Article 95(2) of the Rules of Procedure of the Court of Justice.","paragraph_id":"para_98"},{"text":"Admissibility of the requests for a preliminary ruling","paragraph_id":"para_99"},{"text":"17","paragraph_id":"para_100"},{"text":"Scalable Capital submits, in essence, that the present requests for a preliminary ruling are inadmissible in so far as they have no bearing on the outcome of the disputes in the main proceedings. It claims that an abstract loss of control of data, as in the present case, must not be classified as ‘d …","paragraph_id":"para_101"},{"text":"18","paragraph_id":"para_102"},{"text":"In that connection, according to settled case-law, it is solely for the national court before which the dispute has been brought, and which must assume responsibility for the subsequent judicial decision, to determine, in the light of the particular circumstances of the case, both the need for a pre …","paragraph_id":"para_103"},{"text":"19","paragraph_id":"para_104"},{"text":"In the present case, it is sufficient to recall that, where it is not obvious that the interpretation of a provision of EU law bears no relation to the facts of the main action or its purpose, the objection alleging the inapplicability of that provision to the case in the main action does not relate …","paragraph_id":"para_105"},{"text":"20","paragraph_id":"para_106"},{"text":"It follows that the present requests for a preliminary ruling are admissible.","paragraph_id":"para_107"},{"text":"Consideration of the questions referred","paragraph_id":"para_108"},{"text":"The first question and the first part of the second question","paragraph_id":"para_109"},{"text":"21","paragraph_id":"para_110"},{"text":"By its first question and the first part of its second question, which it is appropriate to examine together, the referring court asks, in essence, whether Article 82(1) of the GDPR must be interpreted as meaning that the right to compensation laid down in that provision fulfils a compensatory funct …","paragraph_id":"para_111"},{"text":"22","paragraph_id":"para_112"},{"text":"In that regard, the Court has already held that Article 82 of the GDPR fulfils a function that is compensatory and not punitive, contrary to other provisions of that regulation also contained in Chapter VIII thereof, namely Articles 83 and 84, which have, for their part, essentially a punitive purpo …","paragraph_id":"para_113"},{"text":"23","paragraph_id":"para_114"},{"text":"Accordingly, Article 82(1) of the GDPR has been interpreted as meaning that the right to compensation laid down in that provision, in particular in the case of non-material damage, fulfils an exclusively compensatory function, in that financial compensation based on that provision must allow the dam …","paragraph_id":"para_115"},{"text":"24","paragraph_id":"para_116"},{"text":"Consequently, the answer to the first question and the first part of the second question is that Article 82(1) of the GDPR must be interpreted as meaning that the right to compensation laid down in that provision fulfils an exclusively compensatory function, in that financial compensation based on that provision must allow the damage suffered to be compensated in full.","paragraph_id":"para_117"},{"text":"The second part of the second question","paragraph_id":"para_118"},{"text":"25","paragraph_id":"para_119"},{"text":"In view of the answer given to the first question and to the first part of the second question, there is no need to answer the second part of the second question.","paragraph_id":"para_120"},{"text":"The third part of the second question","paragraph_id":"para_121"},{"text":"26","paragraph_id":"para_122"},{"text":"By the third part of its second question, the referring court asks, in essence, whether Article 82(1) of the GDPR must be interpreted as meaning that it requires that the severity and possible intentional nature of the infringement of that regulation by the controller be taken into account for the purposes of compensation for damage under that provision.","paragraph_id":"para_123"},{"text":"27","paragraph_id":"para_124"},{"text":"As regards the assessment of any damages payable under Article 82 of the GDPR, in the absence of a provision having such a purpose in that regulation, national courts must apply the domestic rules of each Member State relating to the extent of financial compensation, provided that the principles of …","paragraph_id":"para_125"},{"text":"28","paragraph_id":"para_126"},{"text":"It must, however, be pointed out, first, that the controller’s liability under Article 82 of the GDPR is subject to fault on the part of the controller, which is presupposed unless it proves that it is not in any way responsible for the event giving rise to the damage, and second, that Article 82 do …","paragraph_id":"para_127"},{"text":"29","paragraph_id":"para_128"},{"text":"Furthermore, the exclusively compensatory function of the right to compensation provided for in Article 82(1) of the GDPR precludes taking into account the potentially intentional nature of the infringement of that regulation, which the controller is presumed to have committed, when setting the amou …","paragraph_id":"para_129"},{"text":"30","paragraph_id":"para_130"},{"text":"In the light of the foregoing, the answer to the third part of the second question is that Article 82(1) of the GDPR must be interpreted as not requiring that the severity and the possible intentional nature of the infringement of that regulation by the controller be taken into account for the purposes of compensation for damage under that provision.","paragraph_id":"para_131"},{"text":"The third question","paragraph_id":"para_132"},{"text":"31","paragraph_id":"para_133"},{"text":"By its third question, the referring court asks, in essence, whether Article 82(1) of the GDPR must be interpreted as meaning that, when determining the amount of damages due in respect of the right to compensation for non-material damage, it is appropriate to consider that such damage caused by a personal data breach is, by its nature, less significant than physical injury.","paragraph_id":"para_134"},{"text":"32","paragraph_id":"para_135"},{"text":"In that connection, it should be recalled that, according to settled case-law, in the absence of EU rules on the matter, it is for the national legal order of each Member State to establish procedural rules for actions intended to safeguard the rights of individuals, in accordance with the principle …","paragraph_id":"para_136"},{"text":"33","paragraph_id":"para_137"},{"text":"In the present case, it should be noted that the GDPR does not contain any provision intended to define the rules on the assessment of the damages to which a data subject, within the meaning of Article 4(1) of that regulation, may be entitled under Article 82 thereof, where an infringement of that r …","paragraph_id":"para_138"},{"text":"34","paragraph_id":"para_139"},{"text":"Since there is nothing in the documents before the Court to suggest that the principle of equivalence might be relevant in the context of the cases at issue in the main proceedings, it is necessary to focus on the principle of effectiveness. From that point of view, it is for the referring court to …","paragraph_id":"para_140"},{"text":"35","paragraph_id":"para_141"},{"text":"In that regard, it follows from the case-law referred to in paragraph 23 of the present judgment that, in view of the exclusively compensatory function of the right to compensation provided for in Article 82(1) of that regulation, financial compensation based on that provision must be regarded as ‘full and effective’ if it allows the damage actually suffered as a result of the infringement of that regulation to be compensated in full.","paragraph_id":"para_142"},{"text":"36","paragraph_id":"para_143"},{"text":"From that point of view, recital 146 of that regulation states, moreover, that ‘the concept of damage should be broadly interpreted in the light of the case-law of the Court of Justice in a manner which fully reflects the objectives of this Regulation’ and that ‘data subjects should receive full and effective compensation for the damage they have suffered’.","paragraph_id":"para_144"},{"text":"37","paragraph_id":"para_145"},{"text":"It should also be noted that recitals 75 and 85 of the GDPR set out various circumstances that could be classified as ‘physical, material or non-material damage’ without establishing a hierarchy between them nor do they indicate that harm resulting from a data breach is, by its very nature, less significant than physical injury.","paragraph_id":"para_146"},{"text":"38","paragraph_id":"para_147"},{"text":"Assuming, as a matter of principle, that physical injury is, by its nature, more serious than non-material damage, would risk calling into question the principle of full and effective compensation for the damage suffered.","paragraph_id":"para_148"},{"text":"39","paragraph_id":"para_149"},{"text":"In the light of the foregoing, the answer to the third question is that Article 82(1) of the GDPR must be interpreted as meaning that, when determining the amount of damages due in respect of the right to compensation for non-material damage, it is appropriate to consider that such damage caused by a personal data breach is not, by its nature, less significant than physical injury.","paragraph_id":"para_150"},{"text":"The fourth question","paragraph_id":"para_151"},{"text":"40","paragraph_id":"para_152"},{"text":"By its fourth question, the referring court asks, in essence, whether Article 82(1) of the GDPR must be interpreted as meaning that, where damage is established, a national court may, where that damage is not serious, compensate for it by awarding minimal compensation to the data subject, which could be perceived as symbolic.","paragraph_id":"para_153"},{"text":"41","paragraph_id":"para_154"},{"text":"It should be recalled at the outset that it follows from settled case-law that Article 82(1) of the GDPR must be interpreted as meaning that mere infringement of that regulation is not sufficient to confer a right to compensation, since the existence of ‘damage’, material or non-material, or of ‘dam …","paragraph_id":"para_155"},{"text":"42","paragraph_id":"para_156"},{"text":"Thus, the person seeking compensation for non-material damage on the basis of that provision is required to establish not only the infringement of provisions of that regulation, but also that that infringement caused him or her such damage, which cannot therefore be presumed merely on the basis that …","paragraph_id":"para_157"},{"text":"43","paragraph_id":"para_158"},{"text":"Where a person succeeds in demonstrating that the infringement of the GDPR has caused him or her damage within the meaning of Article 82 of that regulation, it follows, in essence, from paragraph 33 of the present judgment that the criteria for assessing the compensation due in the context of action …","paragraph_id":"para_159"},{"text":"44","paragraph_id":"para_160"},{"text":"In that regard, the Court has held that Article 82(1) of the GDPR does not require that, following a proven infringement of provisions of that regulation, the damage alleged by the data subject must reach a ‘ de minimis threshold’ in order to give rise to a right to compensation (see, to that effect, judgment of 14 December 2023, Gemeinde Ummendorf, C‑456/22 , EU:C:2023:988 , paragraph  18 ).","paragraph_id":"para_161"},{"text":"45","paragraph_id":"para_162"},{"text":"However, such considerations do not preclude the national courts from awarding compensation of a small amount provided that such compensation fully offsets that damage, which it is for the national court to ascertain, in accordance with the principles referred to in paragraph 43 of the present judgment.","paragraph_id":"para_163"},{"text":"46","paragraph_id":"para_164"},{"text":"In the light of the foregoing, the answer to the fourth question is that Article 82(1) of the GDPR must be interpreted as meaning that, where damage is established, a national court may, where that damage is not serious, compensate for it by awarding minimal compensation to the data subject, provided that that compensation is such as to compensate in full for the damage suffered.","paragraph_id":"para_165"},{"text":"The fifth question","paragraph_id":"para_166"},{"text":"Admissibility","paragraph_id":"para_167"},{"text":"47","paragraph_id":"para_168"},{"text":"In its written observations, the European Commission questioned the relevance of the fifth question for the purpose of providing an answer for the disputes in the main proceedings, in so far as it states that no reference to a specific provision of EU law has been made by the referring court.","paragraph_id":"para_169"},{"text":"48","paragraph_id":"para_170"},{"text":"In that regard, the fifth question refers to the concept of ‘identity theft’, within the meaning of recital 75 of the GDPR and does not formally concern Article 82 of that regulation. However, the mere fact that the Court is called upon to give a decision in abstract and general terms cannot have the effect of rendering a request for a preliminary ruling inadmissible (judgment of 15 November 2007, International Mail Spain, C‑162/06 , EU:C:2007:681 , paragraph  24 ).","paragraph_id":"para_171"},{"text":"49","paragraph_id":"para_172"},{"text":"By that question, the referring court asks the Court to interpret the concept of ‘identity theft’, as set out in recital 75 of the GDPR, in order to determine the amount of the financial compensation provided for in Article 82 of the GDPR. That question therefore does indeed concern a provision of E …","paragraph_id":"para_173"},{"text":"50","paragraph_id":"para_174"},{"text":"In those circumstances, the fifth question is admissible.","paragraph_id":"para_175"},{"text":"Substance","paragraph_id":"para_176"},{"text":"51","paragraph_id":"para_177"},{"text":"According to settled case-law, in the procedure laid down by Article 267 TFEU providing for cooperation between national courts and the Court of Justice, it is for the latter to provide the national court with an answer which will be of use to it and enable it to decide the case before it. To that e …","paragraph_id":"para_178"},{"text":"52","paragraph_id":"para_179"},{"text":"In the present case, the fifth question concerns the right to compensation provided for in Article 82(1) of the GDPR, and more specifically the concept of ‘identity theft’, referred to in recital 75 of the GDPR. It should be noted that, in addition to that recital, that concept is also mentioned in recital 85 of that regulation.","paragraph_id":"para_180"},{"text":"53","paragraph_id":"para_181"},{"text":"Consequently, it must be held that, by its fifth question, the referring court asks, in essence, whether Article 82(1) of the GDPR, read in the light of recitals 75 and 85 of that regulation, must be interpreted as meaning that the concept of ‘identity theft’, in order to be classified as such and t …","paragraph_id":"para_182"},{"text":"54","paragraph_id":"para_183"},{"text":"The concept of identity theft is not expressly defined within the GDPR. However, identity ‘theft’ or ‘fraud’ are referred to in recital 75 of that regulation as forming part of a non-exhaustive list of the consequences of processing personal data liable to cause physical, material or non-material da …","paragraph_id":"para_184"},{"text":"55","paragraph_id":"para_185"},{"text":"As the Advocate General observed in point 29 of his Opinion, the different language versions of recitals 75 and 85 of the GDPR refer to the terms ‘identity theft’, ‘identity fraud’, ‘abuse of identity’, ‘misuse of identity’, ‘misappropriation of identity’ and ‘usurpation of identity’ used without di …","paragraph_id":"para_186"},{"text":"56","paragraph_id":"para_187"},{"text":"Moreover, as the Advocate General also observed in point 30 of his Opinion, among the various concepts set out in the lists in recitals 75 and 85 of the GDPR, ‘loss of control’ or the inability ‘to exercise control’ over personal data are distinguished from identity ‘theft’ or ‘fraud’. It follows th …","paragraph_id":"para_188"},{"text":"57","paragraph_id":"para_189"},{"text":"However, it must be stated, in that regard, that compensation for non-material damage caused by the theft of personal data, pursuant to Article 82(1) of the GDPR, cannot be limited to cases where it is shown that that data theft subsequently gave rise to identity theft or fraud. The theft of a data …","paragraph_id":"para_190"},{"text":"58","paragraph_id":"para_191"},{"text":"For those reasons, the answer to the fifth question is that Article 82(1) of the GDPR, read in the light of recitals 75 and 85 of that regulation, must be interpreted as meaning that the concept of ‘identity theft’, in order to be classified as such and to give rise to a right to compensation for no …","paragraph_id":"para_192"},{"text":"Costs","paragraph_id":"para_193"},{"text":"59","paragraph_id":"para_194"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_195"},{"text":"On those grounds, the Court (Third Chamber) hereby rules:","paragraph_id":"para_196"},{"text":"1.","paragraph_id":"para_197"},{"text":"Article 82(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)","paragraph_id":"para_198"},{"text":"must be interpreted as meaning that the right to compensation laid down in that provision fulfils an exclusively compensatory function, in that financial compensation based on that provision must allow the damage suffered to be compensated in full.","paragraph_id":"para_199"},{"text":"2.","paragraph_id":"para_200"},{"text":"Article 82(1) of Regulation 2016/679","paragraph_id":"para_201"},{"text":"must be interpreted as not requiring that the severity and the possible intentional nature of the infringement of that regulation by the controller be taken into account for the purposes of compensation for damage under that provision.","paragraph_id":"para_202"},{"text":"3.","paragraph_id":"para_203"},{"text":"Article 82(1) of Regulation 2016/679","paragraph_id":"para_204"},{"text":"must be interpreted as meaning that, when determining the amount of damages due in respect of the right to compensation for non-material damage, it is appropriate to consider that such damage caused by a personal data breach is not, by its nature, less significant than physical injury.","paragraph_id":"para_205"},{"text":"4.","paragraph_id":"para_206"},{"text":"Article 82(1) of Regulation 2016/679","paragraph_id":"para_207"},{"text":"must be interpreted as meaning that, where damage is established, a national court may, where that damage is not serious, compensate for it by awarding minimal compensation to the data subject, provided that that compensation is such as to compensate in full for the damage suffered.","paragraph_id":"para_208"},{"text":"5.","paragraph_id":"para_209"},{"text":"Article 82(1) of Regulation 2016/679, read in the light of recitals 75 and 85 of that regulation,","paragraph_id":"para_210"},{"text":"must be interpreted as meaning that the concept of ‘identity theft’, in order to be classified as such and to give rise to a right to compensation for non-material damage under that provision, implies that the identity of a person affected by a theft of personal data has actually been misused by a t …","paragraph_id":"para_211"},{"text":"[Signatures]","paragraph_id":"para_212"},{"text":"(\n *1\n ) Language of the case: German.","paragraph_id":"para_213"}],"word_count":6377,"cites":["C-182/22","C-189/22","C-567/20","C-300/21","C-295/04","C-298/04","C-393/17","C-107/23","C-741/21","C-687/21","C-667/21","C-403/16","C-456/22","C-162/06","C-169/22"],"cited_by":[],"sha256":"f0725b63113097755bd4351b0a4ec662f8b030daed187c2bad4c508eb70f4fae","source_url":"https://publications.europa.eu/resource/celex/62022CJ0182.ENG.xhtml.ECR_62022CJ0182_EN_01.html","fetched_at":"2026-10-01T11:23:10.317+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/m-l-c-182-22-och-c-189-22","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:m-l-c-182-22-och-c-189-22","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:m-l-c-182-22-och-c-189-22","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:m-l-c-182-22-och-c-189-22"},"hash":"sha256:ebe96a09462dd4eacb604963635bae21b6453d08e19b32484d87f54e32ff001a","version":"legal-2026-10-19","expires":"2026-10-20T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-19+legal-2026-10-19+2026-10-19T07:58:47","content_hash":"sha256:ebe96a09462dd4eacb604963635bae21b6453d08e19b32484d87f54e32ff001a","revalidate_after":"2026-10-19T10:04:25.337Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:m-l-c-182-22-och-c-189-22","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:m-l-c-182-22-och-c-189-22"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:m-l-c-182-22-och-c-189-22"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:m-l-c-182-22-och-c-189-22"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/m-l-c-182-22-och-c-189-22","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-b1df08e3998de53124b79890b891c17b","response_hash":"sha256:ebe96a09462dd4eacb604963635bae21b6453d08e19b32484d87f54e32ff001a"}},"freshness":{"freshness_class":"stable","as_of":"2026-11-02T16:38:30.538Z","valid_for":604800,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Am-l-c-182-22-och-c-189-22","note":"Oföränderligt objekt med hash. Får cachas länge.","tokens":14276}}