In a recent ruling of the District Court of Rotterdam, the court awarded immaterial damages of €2,500 to a data subject whose medical data had been stored and processed for 10 years (!) in violation of privacy law by the College of B&W of the Municipality of Rotterdam (hereinafter: "the College"). That compensation of €2,500 was awarded is quite extraordinary. Never before have Dutch courts awarded such high damages under the AVG. After all, a request for immaterial damages is generally not awarded quickly. This is because the alleged immaterial damages must be substantiated with concrete information. This proves difficult in practice.
Although Article 82 AVG gives a right to compensation for the actual non-material damage suffered in the event of a breach of the AVG, the regulation does not specify how this damage is to be calculated or determined. Member States thus have the opportunity to make rules on this themselves, provided that these rules take into account the principles of equivalence and effectiveness. Here it is important that, in line with recital 146 AVG, the controller or processor must compensate any damage that someone may suffer as a result of a breach of the AVG. The concept of 'damage' must therefore be interpreted broadly.
In the Netherlands, connection is sought with civil compensation law: Section 6:106 of the Civil Code. Based on this, immaterial damage resulting from a violation of the AVG can qualify as "an impairment of the person. This is in any case the case if the person concerned has suffered mental injury. Specifically, this means the following:
The person claiming "an impairment of the person" will have to cite sufficiently concrete data from which it can follow that, in connection with the circumstances of the case, mental injury has occurred. In that case, it must be possible to establish by objective standards the existence of mental injury; or
The person concerned must show that the nature and seriousness of the norm violation entail that the relevant adverse consequences thereof for the injured party are so obvious that an impairment of the person can be assumed.
Moreover, under current Dutch law, it is not the case that every violation of a fundamental right results in an impairment of the person.
In recent years, immaterial damages have already been awarded several times by a court in connection with privacy violations. That this possibility exists is therefore not new. The Administrative Law Division (hereinafter "the Division") further specified the scope of that possibility in the ruling of April 1, 2020. The Division deemed it reasonable to award a sum of €500 for (i) providing, without consent and (ii) without knowledge, medical data containing (iii) strictly confidential personal data of the person concerned. This resulted in mental injury, which is also referred to as "loss of control over personal data.
Since this concerned special personal data, namely data concerning health, it was obvious, according to the Division, that the provision would lead to adverse consequences for the person concerned. It also took into account that there was no justification for the provision of the data, the data ended up with a small group of professionals charged with secrecy, and attempts were made to undo the provision of the data after it was sent.
Moreover, on the same day, the Division rejected a request for immaterial damages due to a lack of evidence regarding the alleged harm suffered.
In the decision of the Rotterdam District Court the court found that in the case at hand, the college had kept the privacy-sensitive personal data for a period of ten years. Given the duration of the breach and the fact that the data subject had attempted to destroy her data several times, the court found it sufficiently plausible that immaterial damage had been suffered. This seems a contrast to previous rulings, such as those of the Division, in which requests for compensation were rejected because the articulated immaterial damage was insufficiently substantiated with concrete data or, on the contrary, were awarded but on the basis of more concrete information.
For the amount of damages, the court referred to the judgment of April 1, 2020, in which, as mentioned, in the opinion of the Division a compensation of €500 was considered fair for a short-term unlawful processing of medical data. Considering that in the present case the medical data were unlawfully stored and processed for a period of ten years, the court considered €2,500 appropriate.
The aforementioned ruling may also have an impact on claims for damages under the Act on the Settlement of Mass Damage in Collective Action ("WAMCA"), which came into force on January 1, 2020. Indeed, in the case of a large-scale infringement that can be qualified as 'affecting the person' and involving many people, it is quite conceivable that a mass claim will be initiated on behalf of injured parties, for example on the basis of the WAMCA. The ruling of the Rotterdam District Court could possibly result in more mass claims being initiated, as it seems easier to get a claim awarded in certain cases.
The European Court will soon consider the scope of Article 82 AVG following preliminary questions from Austria. Although this case is expected to have a significant impact on future damages claims under the AVG, the exact impact is currently unclear.
So although it remains to be seen how judges will deal with the Rotterdam judgment and the possible outcome of the European Court in the future, for now at least a solid basis seems to have been established for claiming substantial amounts of damages for breach of the AVG. Municipalities, but also companies that process large amounts of (sensitive) personal data (over a long period of time), are thereby at risk, also in view of the WAMCA, of having to pay substantial amounts of damages now that the bar has been set at €2,500 for the first time. In addition, this ruling provides a basis for the question of when adverse consequences are so obvious that an impairment in person can be assumed.
