Recently there have been three rulings under the AVG where the calculation of damages was addressed. The question is under which rules the judges in those cases determined the damages. Based on the rules of the Court of Justice, or still according to Dutch law?
Article 82 of the General Data Protection Regulation (AVG) allows any person to claim (im)material damages from the controller or processor if damage is suffered on account of a breach based on European privacy laws. Recital 146 of the preamble belonging to the AVG adds, by way of explanation, that the concept of "damage" should be interpreted broadly in light of the case law of the Court of Justice of the European Union (EU), in a manner that does full justice to the purposes of the AVG. Somewhat cryptically, it continues: "This is without prejudice to any claims for damages for breaches of other rules in Member State (read, Dutch) law." "This is without prejudice" means that Dutch damages calculation rules could apply in addition to the ECJ rules. But then it would have to be other rules that lead to compensation. After all, the word "other" is explicitly used. However, if they are the same rules of damage calculation that underlie the infringement, then the ECJ case law should take precedence. If the same member state rules were applicable alongside the ECJ rules, the word "other" would not have been necessary here.
The first ruling is from the District Court of Overijssel.(1) Although the breach occurred under the Personal Data Protection Act (Wbp), the court assessed the claim for damages under the AVG. Earlier, the same court had found that there was a breach;(2) an e-mail containing the data subject's personal data had been sent to officials of another municipality, whereas, first, the information had been sent without the data subject's consent. Second, the information to the other officials could also have taken place without mentioning the data subject's personal data. The court considered proportionality and subsidiarity violated.
In proceedings about the data subject's claim for damages, the court considered that Article 82 of the AVG does not affect the fact that, for the award of damages, connection may, even must, be sought to the Dutch legal system, namely Article 6:106 in the Civil Code (WB). This article provides for compensation to be determined on an equitable basis if the data subject's honor or reputation has been harmed or his person has otherwise been affected. In doing so, the legislator has had in mind mental injury consisting of serious violations of privacy or other personality rights. In this case, the data subject's person was affected because he lost control over his personal data (see also recital 85 of the preamble to the AVG). Then, without further consideration, the court sets the damages in equity at €500 pursuant to Article 82 AVG in conjunction with Article 6:106 of the Dutch Civil Code, referring to the aforementioned recital 146.
The second decision is the ruling of the District Court of The Hague on the taking of references in a job application procedure by a member of the appointment committee of Leiden University, without the consent of the person concerned.(3) The job application code of the Dutch Association of Participation Companies (NVP) had been explicitly declared applicable by the university in the procedure. By not asking permission, the code had now been violated. The court found that Leiden University had acted negligently toward the individual. A separate procedure, the damage assessment procedure, was referred to for determining damages.
According to the court, the fact that the individual did not receive the coveted position does not constitute an injury. After all, the individual no longer responded to the request to continue the procedure. However, the carelessness of the university may still have caused the individual to suffer damages. Those damages remain to be determined. In what way the court will do that, whether under Dutch or European law, we will have to wait and see. The court has not yet considered that and has not yet ruled on it. So it remains to be seen how the court will rule here.
An order of the UWV to pay compensation to the person concerned in the amount of €250 concerned the third ruling. A ruling by the Amsterdam District Court.(4) This case involved an employee who had dropped out of her former employer due to illness. She had a burnout. During the second year of illness, however, she joined a new employer on the basis of a fixed-term employment contract. The new employer did not know about the breakdown due to that burnout. The UWV then sent a letter to the new employer with details of the employee's illness. This was at a very unfortunate time, namely when the new employer had to decide on the continuation of the fixed-term employment contract.
The court found that there had been a breach of personal data protection, in effect a data breach. Because of this breach, the data subject suffered real and non-negligible disadvantages, the court said. The interests in which the data subject was affected are precisely those that the AVG aims to protect. If the data subject has suffered damages in the process, those damages must be compensated. In doing so, the AVG has as its starting point (recital 146) that the concept of 'damage' must be interpreted broadly in light of the case law of the Court of Justice, "in a manner that does full justice to the objectives of that Regulation." Article 6:106(1) BW will have to be interpreted regulation-compliant to the extent necessary. A regulation-compliant interpretation of Article 6:106 BW implies that the person concerned is entitled to fair compensation for the damage. Even if that damage is minor, that is no ground to reject the claim for damages. The court found that the damage was minor because, although the person concerned had suffered a loss over her personal data, there was no negative consequence for her economic or social position (after all, she eventually obtained the extension of the fixed-term employment contract) and the time she had spent in suspense over the extension of the employment contract (over seven weeks) had been limited in time. This led to fair compensation of €250.
What can be concluded from the foregoing? Leaving aside the fact that the courts are struggling to properly justify compensation in equity, I think the Amsterdam court comes closest to the intent of the AVG's calculation of damages. This judge indicates that the concept of damages should be interpreted broadly. Although the judge still mentions the Section 6:106 of the Dutch Civil Code, this section must be interpreted according to the case law of the Court of Justice. With this, the Amsterdam District Court comes close to the intention of recital 146, belonging to Article 82 AVG. The court in Overijssel argues that Dutch law should still apply in addition to Article 82 AVG. I think that is an incorrect interpretation of recital 146.
By the way, what that interpretation of "in light of the case law of the Court of Justice" is is not clear from the recital. Apparently, judges are still struggling with that as well. In any case, it should demonstrate a broad interpretation of the concept of "damage" and there is already room for compensation if there is only a (minor) violation of the AVG. In case of a minor immaterial damage, without demonstrable material damage, compensation due to the breach should be determined according to fairness. This is a vague standard. Who knows, perhaps the expected ruling of the District Court of The Hague will bring more clarity. To be continued.
(1) ECLI:NL:RBOVE:2019:1827
(2) ECLI:NL:RBOVE:2018:2496
(3) ECLI:NL:RBDHA:2019:6145
(4) ECLI:NL:RBAMS:2019:6490
This article can also be found in the AVG file
