FRANCE Law and Practice Contributed by: Sylvain Naillat and Helena Delabarre, Nomos
data, or cease unlawful processing), sometimes sub - ject to penalty payments, as well as damages. Non-Material Damage Non-material damage is compensable under Article 82 GDPR, but a mere infringement is insufficient. The claimant must prove: • an infringement; • actual damage (including non-material); and • a causal link ( CJEU, C-300/21, Österreichische Post ). No minimum seriousness threshold applies, yet harm must be real and proven. Negative emotions (fear, anxiety, loss of control, repu - tational concern, risk of misuse) may qualify if sub - stantiated and causally linked ( CJEU, C-340/21, Nat- sionalna agentsia za prihodite CJEU, C-655/23, Quirin Privatbank ). Purely hypothetical risk or unproven fear is insufficient. Compensation is strictly compensatory, not punitive. It must reflect the actual damage suffered; fault is irrelevant to quantification once liability is established ( CJEU, C-667/21, Krankenversicherung Nordrhein ). A separate injunction under national law cannot reduce damages ( CJEU, C-655/23, Quirin Privatbank ). The GDPR does not harmonise methods of calculation. Quantification remains subject to national procedural autonomy, constrained by equivalence and effective - ness, and Article 83 fine criteria cannot be transposed to Article 82 ( CJEU, C-741/21, juris GmbH ). 2.2 Recent Case Law The court decisions that have most significantly shaped the framework for privacy litigation before the courts (ie, to be distinguished from the CNIL’s GDPR enforcement cases through administrative proceed - ings) in recent years are described below. Article 82 GDPR – Conditions and Nature of Compensation • CJEU, C-300/21, Österreichische Post (4 May 2023): The court held that compensation requires proof of an infringement, actual damage, and a
causal link, and that a mere GDPR breach does not automatically entitle a claimant to damages. Non-material damage need not reach a serious - ness threshold, but it must be proven, and com - pensation must remain purely compensatory under national rules subject to equivalence and effective - ness. • CJEU, C-741/21, juris (11 April 2024): The court clarified that infringement of a GDPR right does not in itself constitute non-material damage, although “loss of control” may qualify if genuinely suffered. It further held that the fine criteria in Article 83 are irrelevant when assessing damages under Article 82. • CJEU, C-590/22, PS (20 June 2024): The court recognised that proven fear of disclosure, together with its negative consequences, may constitute non-material damage, while reaffirming that Article 82 has no punitive or deterrent function. • CJEU, C-200/23, Agentsia po vpisvaniyata (4 Octo - ber 2024): The court held that temporary public accessibility of personal data may generate com - pensable “loss of control” even without additional tangible harm, provided actual damage is estab - lished. • CJEU, C-655/23, Quirin Privatbank (4 September 2025): The court confirmed that negative emotions may amount to non-material damage if proven and causally linked, and it clarified that preventative injunctions cannot replace or reduce compensation under Article 82. Structure of Liability and Exoneration • CJEU, C-667/21, Krankenversicherung Nordrhein (21 December 2023): The court characterised Article 82 as establishing fault-based liability with a strict exoneration standard, under which the controller avoids liability only by proving that it is not in any way responsible for the event causing the damage. • CJEU, C-741/21, juris (11 April 2024): The court confirmed that a controller cannot evade liability by attributing the infringement to a person acting under its authority. GDPR Breach and Unfair Competition CJEU, C-21/23, Lindenapotheke (4 October 2024): The court ruled that Chapter VIII of the GDPR does
121 CHAMBERS.COM
Powered by FlippingBook