EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
contractual clauses and politically contested frame - works such as the EU–US Data Privacy Framework, which continues to attract scrutiny from privacy activ - ists and regulators. Transfer impact assessments and ongoing monitoring remain essential in practice. Technology-Driven Disputes A growing strand of litigation and regulatory action concerns technology-driven processing, particularly where AI, automated profiling and other high-risk algorithmic systems intersect with data protection rights. Regulatory investigations into AI chatbots gen - erating deepfake or harmful content illustrate height - ened scrutiny of system design, risk assessments and compliance with GDPR obligations, especially where sensitive data or children’s rights are implicated. Disputes also arise from large-scale biometric and tracking practices, underscoring continued regula - tory focus on facial recognition and mass surveillance technologies. 2.2 Recent Case Law At EU level, in the past two years, the CJEU has delivered a series of judgments that have significant - ly structured privacy litigation in the EU, particularly in relation to Article 82, GDPR compensation claims, security obligations and the scope of data subject rights. Many of these decisions refine and consolidate an increasingly coherent line of case law governing civil liability and procedural standards in GDPR litiga - tion. • Compensation under Article 82, GDPR – in Öster- reichische Post (C-300/21, 4 May 2023), the court clarified that compensation requires three cumula - tive elements: (i) an infringement of the GDPR, (ii) actual damage (material or non-material), and (iii) a causal link between the infringement and the dam - age. A mere infringement is insufficient to found liability. At the same time, member states may not impose a minimum seriousness threshold for non- material damage. The judgment firmly established Article 82 as a compensatory (not punitive) mecha - nism and structured the analytical framework now applied by national courts. • Security obligations and breach-related liability (Articles 24 and 32 GDPR) – in Natsionalna agent-
sia za prihodit (C-340/21, 14 December 2023), the court clarified that the mere occurrence of unau - thorised disclosure or access does not automati - cally establish that the controller failed to imple - ment “appropriate” technical and organisational measures under Articles 24 and 32, GDPR. The appropriateness of security measures must be assessed concretely and in light of the risk, taking into account the nature of the processing and the data involved. The CJEU thus rejected any irrebut - table presumption that a breach equals non-com - pliance. However, it acknowledged that erroneous disclosure by employees may indicate deficiencies in organisational measures if it reflects inadequate risk assessment or internal governance. The judg - ment also confirmed that fear of misuse may con - stitute non-material damage, provided that it is well founded and substantiated. This case therefore reinforces the risk-based logic of the GDPR while maintaining a fact-sensitive approach to liability. • Fear, loss of control and hypothetical risk (Article 82) – in MediaMarktSaturn (C-687/21, 25 January 2024), the CJEU further clarified the boundaries of non-material damage. It held that the concept of “non-material damage” may, in principle, encom - pass well-founded fear of future misuse and even temporary loss of control over personal data. However, a purely hypothetical risk is insufficient. Where it is established that an unauthorised third party did not actually become aware of the person - al data, the mere fear of possible future dissemi - nation does not, in itself, constitute compensable damage. The judgment reiterates that the data subject must demonstrate actual damage, however minimal. In this respect, MediaMarktSaturn does not depart from earlier case law but refines it by drawing a clearer distinction between abstract risk and substantiated harm. • Liability regime and burden of proof (Article 82 (3)) – in juris GmbH (C-741/21, 11 April 2024), the CJEU clarified the operation of Article 82 (3), confirming that the GDPR establishes a fault-based liability regime with a reversed burden of proof. A controller cannot avoid liability merely by arguing that the damage resulted from negligence of an employee acting under its authority. Since employ - ees act under the controller’s authority within the meaning of Article 29, GDPR, the controller
96 CHAMBERS.COM
Powered by FlippingBook