It's annoying when a letter is sent to the wrong address. It becomes problematic if it is a tax return and the wrong recipient also opens the letter by mistake. The ECJ addressed various legal aspects in its ruling of 20.06.2024 (Case C-590/22).
Tax consultant sends tax return to wrong address
Two former clients of a tax consultancy firm have filed a lawsuit. Although they informed their tax advisor of the change of address, the tax return for 2019 was sent to the old address. The new resident had opened the envelope by mistake and then informed the two of them.
In the original proceedings, the two plaintiffs brought an action before Wesel Local Court for compensation for non-material damage pursuant to Art. 82 (1) GDPR. They have quantified the damage allegedly caused by the disclosure of their personal data to third parties at EUR 15,000.
The Wesel Local Court decided to stay the proceedings and referred several questions to the ECJ for a preliminary ruling.
Basis for claims for damages under the GDPR
In its decision, the ECJ (Third Chamber) addressed key aspects of Art. 82, which regulates the right to compensation in the event of infringements of the GDPR.
Link tip: ECJ judgment Case C-590/22
The main points of the judgment are:
Basis for claims for damagesA mere breach of the GDPR is not sufficient to justify a claim for damages. The data subject must prove that they have suffered material or non-material damage as a result of the infringement. However, damage does not have to reach a certain level of severity in order to be eligible for compensation.
Intangible damageThe mere fear that personal data has been unlawfully disclosed may be sufficient to justify a claim for compensation for non-material damage, provided that this fear and its negative consequences are duly proven.
Assessment of damagesThe criteria provided for the setting of fines under Article 83 GDPR are not applicable to the assessment of damages under Article 82. The claim for damages is not intended to fulfill a deterrent function, but merely to provide full and effective compensation for the actual damage suffered.
National legislationWhen assessing damages, infringements of national provisions that relate to the protection of personal data but do not serve to specify the provisions of the GDPR are not to be taken into account.
Reading tip: ECJ ruling on data retention
The ECJ ruling emphasizes the need for data protection violations to cause demonstrable damage in order to lead to claims for damages. A mere breach of the GDPR is not sufficient.