At the beginning of February I had the opportunity to give an explanation in the Lower House about our investigation into the Tax Administration's benefits affair. That brought me to an issue that we are regularly asked: people often suffer emotional damage as a result of the careless handling of personal data. Aren't victims then entitled to damages?
A relevant question, it seems to me, because the right to protection of personal data is among the most important freedom rights of this era. After all, in a society that is rapidly digitizing, this right also gives additional protection to many other fundamental rights and values. Such as the right to privacy, freedom of religion, fair elections and equal treatment. And with all the data being collected, profiling and opaque decision-making by algorithms lurk, with all the risks that this entails.
Violations of this particular fundamental right are therefore often violations squared. So if things then go wrong, as a victim yourself, you have more to gain from personal compensation, from restoration of rights, than from a fine that disappears into the treasury. Even though even those fines remain as important as ever.
The good news is that the General Data Protection Regulation (AVG) states that the organization responsible must compensate all material and immaterial damages for violations. If there is material damage, there is generally little discussion. Losses suffered or lost profits are usually relatively easy to establish. With intangible damages, you also generally have to prove a situation where there is an entitlement to damages. But how do you do that?
How do you prove the emotional impact of wrongful blacklisting, snooping on your medical records, or discrimination by an algorithm? How do you prove the frustration, uncertainty, anxiety, stress and grief it can cause? How do you prove a scratch on your soul?
Because those damages are obvious on the one hand, but difficult to assess on the other, the courts are now offering help: rightly and understandably so. Some examples:
Last year, the Raad van State was the first at the highest level to take an important step by ordering the Minister for Legal Protection to pay 500 euros in damages to a person for the unlawful processing/disclosure of medical data. 'Only' 500 euros, because the violation was quickly undone again and there were no other negative consequences.
In Austria, a court recently ordered a company to pay 500 euros in damages because the company had not promptly and fully complied with a person's request to see his/her personal data. The right of inspection is an important part of this fundamental right.
Recently, a district judge ordered a municipality to also pay 500 euros in damages. This because it had illegally posted a resident's BSN, mail address and phone number on its website.
Some time ago, the Supreme Court did rule that in the case of damages, there must be more than a "single" violation of a fundamental right. This is understandable, because if such a violation is truly accidental and no other fundamental rights or values are at stake, for example, then the victim probably experiences less or no frustration, uncertainty, fear or grief as a result. But with violations that are the result of careless or thoughtless behavior, or even gross misconduct or intent or affect more fundamental rights and values, it is obviously different. That is more, more serious and more intrusive than a "single" violation.
These rulings are not surprising, as the Dutch legislature itself long ago cited "violation of private life" as an example when introducing damages. What makes these rulings so nice and clear is that they confirm that the violation of the core of this right to freedom is in itself so serious that if there is a violation as a result of thoughtless or careless behavior, there is a right to damages anyway. Of course, the violation itself and who is liable for it must then still be proven.
These convictions in the Netherlands do (still) involve the processing of sensitive data, such as health data and the BSN. But I really wouldn't know why that would be different for other personal data. Especially if the violation is the result of careless or thoughtless action or if more fundamental rights or values are at stake. Violations involving other personal data are also qualified as equally serious offenses for a reason. Then it is hard to maintain that those breaches do not cause immaterial damage, isn't it?
Probably for that reason too, that Austrian court awarded damages for failure to expeditiously and fully implement the right of inspection for "ordinary" personal data. The right of inspection is an important part of this fundamental right. The difference between 'sensitive' and other personal data can, of course, be reflected in the amount of the damages.
In the case of sensitive data, the possible doubt about damages has now been removed. If judges are still hesitant about the legislature's intention in the case of violations involving "ordinary" personal data, the legislature would do well to (even) more clearly incorporate its earlier and already long-standing views on this into the law. For example, by explicitly stating that when those fundamental rights are violated, the right to damages is a legal fact if it is the result of thoughtless or careless behavior.
This could already be done in the bill that is going to enable paying with data - which increases the risks of violations - that is about to be introduced. Or, for example, in the Van Toorenburg et al. initiative bill, which aims to criminalize publication of images of victims. Victims have even more interest in legal redress than in a fine.
Finally, it is difficult to maintain that a scratch on a bicycle or a car does lead to compensation by default and that in a constitutional state this is not (yet) always automatically the case for scratches on the soul of the owner, caused by violating the highest valued interests, freedoms and autonomy of free and equal citizens. In that case, punitive damages should be the rule, not the exception.
