A data subject has a right under Article 82(1) of Regulation 2016/679 to compensation for damage caused by an infringement of the right of access in Article 15(1) of that regulation.

Under Article 82(1) of Regulation 2016/679, non-material damage includes loss of control over personal data or uncertainty about whether those data were processed — provided it is shown, in particular, that the data subject actually suffered that damage and that the data subject’s conduct was not the determining cause of it.

Under Article 82(1) of Regulation 2016/679, non-material damage includes negative feelings such as fear or annoyance after personal data are transmitted without authorisation to a third party - even where those feelings stem from loss of control over the data, possible misuse of the data, or harm to reputation - provided that the data subject demonstrates those feelings and their negative consequences on account of the infringement of that regulation.

Article 82(1) of Regulation 2016/679 bars taking the controller's degree of fault into account when assessing the compensation payable for non-material damage under that article.

Article 82(1) of Regulation 2016/679 bars taking into account, in order to reduce or replace financial compensation for non-material damage, the fact that under national law the data subject has obtained an injunction, enforceable against the controller, prohibiting repetition of the infringement of that regulation.

A temporary loss of control over personal data can by itself amount to 'non-material damage' under Article 82(1) of Regulation 2016/679 where the data were made available online to the public in a Member State's commercial register, provided that the data subject shows that he or she actually suffered that damage, however minimal. 'Non-material damage' does not require proof of additional tangible adverse consequences.

An opinion of a Member State supervisory authority issued under Article 58(3)(b) of Regulation 2016/679 does not by itself exempt from liability under Article 82(2) the authority responsible for maintaining that Member State's commercial register, where that authority is a 'controller' within the meaning of Article 4(7).

A GDPR infringement alone is not 'damage' within the meaning of Article 82(1), read in the light of Article 8(1) of the Charter.

An apology may be sufficient compensation for non-material damage under Article 82(1), including where the situation existing before the damage cannot be restored - provided that the apology fully compensates the data subject for the damage suffered.

Under Article 82(1), the controller's attitude and motivation cannot be taken into account to reduce compensation below the damage actually suffered by the data subject.

1. Article 82(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that the right to compensation laid down in that provision fulfils an exclusively compensatory function, in that financial compensation based on that provision must allow the damage suffered to be compensated in full.

2. Article 82(1) of Regulation 2016/679

must be interpreted as not requiring that the severity and the possible intentional nature of the infringement of that regulation by the controller be taken into account for the purposes of compensation for damage under that provision.

3. Article 82(1) of Regulation 2016/679

must be interpreted as meaning that, when determining the amount of damages due in respect of the right to compensation for non-material damage, it is appropriate to consider that such damage caused by a personal data breach is not, by its nature, less significant than physical injury.

4. Article 82(1) of Regulation 2016/679

must be interpreted as meaning that, where damage is established, a national court may, where that damage is not serious, compensate for it by awarding minimal compensation to the data subject, provided that that compensation is such as to compensate in full for the damage suffered.

5. Article 82(1) of Regulation 2016/679, read in the light of recitals 75 and 85 of that regulation,

must be interpreted as meaning that the concept of 'identity theft', in order to be classified as such and to give rise to a right to compensation for non-material damage under that provision, implies that the identity of a person affected by a theft of personal data has actually been misused by a third party. However, compensation for non-material damage caused by the theft of personal data, under that provision, cannot be limited to cases where it is shown that that data theft subsequently gave rise to identify theft or fraud.

An infringement of the GDPR is not by itself enough to create a right to compensation under Article 82(1). The data subject must also establish damage caused by that infringement, but that damage need not reach any minimum degree of seriousness.

When determining the amount of compensation for damage under Article 82(1), it is not necessary to apply by analogy the criteria in Article 83 for setting administrative fines. That compensation right also does not need to have a dissuasive function.

When determining the amount of compensation for damage under Article 82(1), it is not necessary to take account of simultaneous infringements of national personal-data-protection provisions that are not intended to specify the rules of Regulation 2016/679.

An infringement of provisions of Regulation 2016/679 that confer rights on the data subject is not, by itself, "non-material damage" under Article 82(1), regardless of the degree of seriousness of the damage suffered by that person.

A controller is not exempt from liability under paragraph 3 of Article 82 of Regulation 2016/679 merely by claiming that the damage was caused by a failure by a person acting under the controller's authority within the meaning of Article 29 of that regulation.

When setting compensation under Article 82(1) of Regulation 2016/679, it is not necessary to apply mutatis mutandis the criteria for setting administrative fines in Article 83. It is also not necessary to take account of the fact that several infringements of that regulation concerning the same processing operation affect the person seeking compensation.

The right to compensation under Article 82(1), including for non-material damage, is compensatory, not punitive: the compensation must fully make good the damage actually suffered as a result of the GDPR infringement.

Article 82 does not require the severity of the controller's infringement to be taken into account when assessing compensation under that article.

To obtain compensation under Article 82(1) of Regulation 2016/679, a person must prove both an infringement of that regulation and that the infringement caused them material or non-material damage.

Non-material damage under Article 82(1) of Regulation 2016/679 does not exist merely because a document containing personal data was given to an unauthorised third party, where it is established that that third party did not become aware of the data, even if the data subject fears that the document may have been copied before it was recovered and that the data may later be disseminated or misused.

The right to compensation in Article 82(1) is compensatory, not punitive or deterrent: the award must fully compensate the damage actually suffered because of the GDPR infringement.

In an action for damages under Article 82, the controller bears the burden of proving that its security measures were appropriate under Article 32.

A controller is not exempt from paying compensation under Article 82(1) and (2) of Regulation 2016/679 merely because the damage was caused by unauthorised disclosure of, or access to, personal data by a 'third party' within the meaning of Article 4(10); in that case, the controller must prove that it was in no way responsible for the event that caused the damage.

Fear that third parties may misuse personal data, where that fear results from an infringement of Regulation 2016/679, can by itself constitute 'non-material damage' under Article 82(1).

Article 82(1) precludes national legislation or practice that imposes a 'de minimis threshold' for non-material damage caused by an infringement of the GDPR. But the data subject must still show that the consequences claimed amount to damage distinct from the mere infringement of the GDPR.

A mere infringement of Regulation 2016/679 does not by itself give rise to a right to compensation under Article 82(1).

Article 82(1) precludes national rules or practices that make compensation for non-material damage depend on the damage reaching a certain degree of seriousness.

To determine the amount of damages payable under Article 82, national courts must apply the domestic rules of each Member State on the extent of financial compensation, provided that the principles of equivalence and effectiveness of EU law are complied with.