CJEU case C‑456/22 Gemeinde Ummendorf – CJEU Judgment (European Union, 2023)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
The Court of Justice of the European Union ruled on how non-material damages under GDPR should be interpreted. They decided that national laws can't add extra conditions to the GDPR's requirements for claiming damages. This means that even a short-term loss of control over personal data could qualify for damages if the GDPR conditions are met.
What happened
The CJEU clarified that Article 82(1) GDPR does not allow national laws to add extra conditions for claiming non-material damages.
Who was affected
Individuals whose personal data was briefly exposed online by the Municipality of Ummendorf.
What the authority found
The Court of Justice ruled that non-material damages under GDPR require an infringement, damage suffered, and a causal link, without needing additional conditions from national law.
Why this matters
This ruling emphasizes that GDPR's criteria for damages are self-contained and not subject to national interpretations. Website operators should understand that even minor breaches could lead to claims if they meet GDPR's criteria.
GDPR Articles Cited
In June 2020 the Municipality of Ummendorf published meeting minutes and a judgement by the Administrative Court of Sigmaringen on their website. The meeting minutes contained the names of a data subject and the judgement their names and address of domocile. Interestingly, the names of the other parties within the judgement had already been redacted by the municipality before uploading it to their website. The data subject claimed damages under Article 82(1) GDPR and argued that no minimum threshold should be applied. The municipality argued that Article 82(1) requires proof of noticeable disadvantage and objective comprehensible impairment of personal interests. For a non-material damage to exist, they argued that the deminimis threshold must be exceeded. The case was appealed to the Ravensburg Regional Court who reffered one question to the CJEU: 1) Does Article 82(1) GDPR require noticeable disadvantage and comprehensible impairment of personal interests from the data subjest, or is the mere short-term loss of control over their personal data for a few days which did not have a noticeable consequence sufficient for non-material damages? The CJEU decided that Article 82(1) GDPR has its own definition under EU Law and that this definition overrides national legislation. Other conditions for establishing liability, such as in this case the tangible nature of the damage or the objective nature of the infringement, cannot be added. First, non-material damages under the GDPR require three cumilative conditions (para 14): 1) The existence of the infringement of the GDPR 2) damage that has been suffered and 3) a causal link between that damage and infringement (see [https://gdprhub.eu/index.php?title=CJEU_-_C-300/21_-_%C3%96sterreichische_Post_AG C-300/21 - Österreichische Post AG] and C‑340/21 - Natsionalna agentsia za prihodite). Second, Article 82(1) GDPR does not reference national law which means that a member state's definitions of non-material damages bey
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (0)
No other cases found for CJEU case C‑456/22 Gemeinde Ummendorf in EU
This is the only recorded case for this entity in this jurisdiction.
Details
Judgment Date
1 January 2023
Authority
Court of Justice of the European Union
GDPRhub ID
gdprhub-cjeu-7549About this data
Cite as: Cookie Fines. CJEU case C‑456/22 Gemeinde Ummendorf - European Union (2023). Retrieved from cookiefines.eu
Last updated: