–

AT and VX, by O. Leuze, Rechtsanwalt,

–

Gemeinde Ummendorf, by A. Staudacher, Rechtsanwalt,

–

Ireland, by M. Browne, A. Joyce and M. Tierney, acting as Agents, and by D. Fennelly, Barrister-at-Law,

–

the European Commission, by A. Bouchagiar, M. Heller and H. Kranenborg, acting as Agents,

1

This request for a preliminary ruling concerns the interpretation of Article 82(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1) (‘the GDPR’).

2

The request has been made in proceedings between two natural persons, AT and VX, on the one hand, and the Gemeinde Ummendorf (Municipality of Ummendorf, Germany), on the other, concerning the award of damages, under Article 82(1) of the GDPR, by way of compensation for the suffering endured (pretium doloris) which they claim to have undergone as a result of the disclosure, without their consent, of their personal data on that municipality’s website.

3

The first, third and sixth sentences of recital 146 of the GDPR are worded as follows:

‘The controller or processor should compensate any damage which a person may suffer as a result of processing that infringes this Regulation. … The concept of damage should be broadly interpreted in the light of the case-law of the Court of Justice [of the European Union] in a manner which fully reflects the objectives of this Regulation. … Data subjects should receive full and effective compensation for the damage they have suffered. …’

4

Article 5(1)(a) of that regulation, entitled ‘Principles relating to processing of personal data’, provides:

‘Personal data shall be:

5

Article 82 of that regulation, entitled ‘Right to compensation and liability’, provides in paragraph 1 thereof:

‘Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.’

6

On 19 June 2020, the Municipality of Ummendorf, without the consent of the applicants in the main proceedings, published on the internet the agenda of a meeting of the municipal council, in which their names were referred to on several occasions, and a judgment delivered on 10 March 2020 by the Verwaltungsgericht Sigmaringen (Administrative Court, Sigmaringen, Germany), which also referred to their surnames and forenames and the address of their domicile. Those documents were accessible on the homepage of that municipality’s website until 22 June 2020.

7

Taking the view that that publication infringed the GDPR and that the Municipality of Ummendorf had acted intentionally, since the names of the other parties to the proceedings which led to that judgment had been deleted, the applicants in the main proceedings asked the municipality to compensate them for the non-material damage which they claimed to have suffered, within the meaning of Article 82(1) of that regulation. They submit that the unlawful disclosure of personal data of an individual constitutes ‘damage’, within the meaning of that provision, without any ‘de minimis threshold’ being relied on, which would be contrary to the scheme of the GDPR and to the deterrent effect of that provision.

8

The Municipality of Ummendorf, on the other hand, submits that compensation for ‘non-material damage’, within the meaning of Article 82(1) of the GDPR, requires proof of a noticeable disadvantage and an objectively comprehensible impairment of personal interests.

9

Hearing the case on appeal between the parties to the main proceedings, the Landgericht Ravensburg (Regional Court, Ravensburg, Germany), which is the referring court, takes the view that, by publishing on the internet the personal data of the applicants in the main proceedings, the Municipality of Ummendorf infringed Article 5(1)(a) of the GDPR. That court is uncertain, however, whether that publication caused the applicants non-material damage within the meaning of Article 82(1) of that regulation, with the result that they are entitled to compensation for the suffering endured.

10

In particular, the referring court considers that the mere loss of control over the personal data of the applicants in the main proceedings is not sufficient to constitute non-material damage within the meaning of Article 82(1) of the GDPR. It considers that, in order to accept the existence of non-material damage, a ‘de minimis threshold’ must be exceeded and that that is not the case where the data subjects have lost control over their data only for a short period of time, without causing them a noticeable disadvantage and without an objectively comprehensible impairment to their personal interests having been demonstrated.

11

In those circumstances, the Landgericht Ravensburg (Regional Court, Ravensburg) decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling:

‘Is the concept of non-material damage in Article 82(1) of [the GDPR] to be interpreted as meaning that the assumption of non-material damage requires a noticeable disadvantage and an objectively comprehensible impairment of personal interests, or is the mere short-term loss of the data subject’s unfettered control over his or her data due to the publication of personal data on the internet for a period of a few days, which did not have any noticeable or adverse consequences for the data subject, sufficient for that purpose?’

12

By its question, the referring court asks, in essence, whether Article 82(1) of the GDPR must be interpreted as precluding national legislation or a national practice which sets a ‘de minimis threshold’ in order to establish non-material damage caused by an infringement of that regulation.

13

In that regard, it should be recalled that that provision provides that ‘any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered’.

14

As the Court has pointed out, it is clear from the wording of Article 82(1) of the GDPR that the existence of ‘damage’ which has been ‘suffered’ constitutes one of the conditions for the right to compensation laid down in that provision, as does the existence of an infringement of that regulation and of a causal link between that damage and that infringement, those three conditions being cumulative (judgments of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraph 32, and of today, Natsionalna agentsia za prihodite, C‑340/21, paragraph 77). It follows that those three conditions are necessary and sufficient in order to have a right to compensation within the meaning of that provision.

15

Having regard to the absence of any reference in Article 82(1) of the GDPR to the national law of the Member States, the concept of ‘non-material damage’, within the meaning of that provision, must be given an autonomous and uniform definition specific to EU law (see, to that effect, judgment of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraphs 30 and 44).

16

From that point of view, on the basis of considerations of a literal, systemic and teleological nature, the Court has interpreted Article 82(1) of the GDPR as precluding a national rule or practice which makes compensation for ‘non-material damage’, within the meaning of that provision, subject to the condition that the damage suffered by the data subject has reached a certain degree of seriousness (judgments of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraph 51, and of today, Natsionalna agentsia za prihodite, C‑340/21, paragraph 78).

17

Accordingly, it cannot be considered that, in addition to the three conditions set out in paragraph 14 of the present judgment, other conditions for establishing liability laid down in Article 82(1) of the GDPR, such as the tangible nature of the damage or the objective nature of the infringement, may be added.

18

It follows that Article 82(1) of the GDPR does not require that, following a proven infringement of provisions of that regulation, the ‘non-material damage’ alleged by the data subject must reach a ‘de minimis threshold’ in order for that damage to be capable of compensation.

19

That interpretation is supported by the third sentence of recital 146 of the GDPR, which states that ‘the concept of damage should be broadly interpreted in the light of the case-law of the Court … in a manner which fully reflects the objectives [of that regulation]’. It would be contrary to that broad conception of ‘damage’, favoured by the EU legislature, if that concept were limited solely to damage of a certain degree of seriousness, in particular as regards the duration of the period during which the negative consequences of the infringement of that regulation were suffered by the data subjects (see, to that effect, judgments of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraph 46, and of today, Natsionalna agentsia za prihodite, C‑340/21, paragraph 81).

20

Furthermore, such an interpretation is consistent with one of the objectives of the GDPR, which is to ensure a consistent and high level of protection of natural persons with regard to the processing of personal data within the European Union. Making compensation for non-material damage subject to a certain threshold of seriousness would risk undermining the coherence of the rules established by the GDPR, since the graduation of such a threshold, on which the possibility or otherwise of obtaining that compensation would depend, would be liable to fluctuate according to the assessment of the courts seised (see, to that effect, judgment of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraphs 48 and 49).

21

A person concerned by an infringement of the GDPR which has negative consequences for him or her is, however, required to demonstrate that those consequences constitute non-material damage within the meaning of Article 82 of that regulation (see, to that effect, judgments of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraph 50, and of today, Natsionalna agentsia za prihodite, C‑340/21, paragraph 84). The mere infringement of the provisions of that regulation is not sufficient to confer a right to compensation (judgment of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraph 42).

22

In those circumstances, although there is nothing to preclude the publication on the internet of personal data and the consequent loss of control over those data for a short period of time from causing the data subjects ‘non-material damage’, within the meaning of Article 82(1) of the GDPR, giving rise to a right to compensation, those persons must also demonstrate that they have actually suffered such damage, however minimal.

23

In the light of the foregoing, the answer to the question referred is that Article 82(1) of the GDPR must be interpreted as precluding national legislation or a national practice which sets a ‘de minimis threshold’ in order to establish non-material damage caused by an infringement of that regulation. The data subject is required to show that the consequences of the infringement which he or she claims to have suffered constitute damage which differs from the mere infringement of the provisions of that regulation.

24

Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Third Chamber) hereby rules:

Article 82(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),

must be interpreted as precluding national legislation or a national practice which sets a ‘de minimis threshold’ in order to establish non-material damage caused by an infringement of that regulation. The data subject is required to show that the consequences of the infringement which he or she claims to have suffered constitute damage which differs from the mere infringement of the provisions of that regulation.