First damages under the AVG: risk of a 'claims culture'?

You may have already heard or read about it. In May this year, for the first time since the introduction of the General Data Protection Regulation (AVG), the District Court of Overijssel awarded damages for unlawful (in violation of the AVG) processing of personal data. Good example follows, as the District Court of Amsterdam recently awarded a second damages award because the AVG had not been complied with in that situation either. Does this mean that the doors have been opened for damages claims due to violation of the AVG? And how might this development affect your organization?

Overijssel District Court

In this matter, the data subject had submitted Wob requests to the municipality of Deventer. Because it appeared that this data subject had also submitted similar requests to other municipalities, the municipality of Deventer wanted to share information with the other municipalities about how they had dealt with the data subject's Wob requests. In sharing that information, personal data of the data subject were also shared. According to the court, the sharing of the data subject's personal data with the other municipalities was unlawful, causing the data subject to suffer immaterial damage. Intangible damage - unlike material damage - does not refer to damage to the body or property, but to damage suffered by a data subject due to, for example, (mental) pain or grief. This immaterial damage, the court said, represented a value of 500 euros.

That the court awarded damages is extraordinary. Especially since this type of case usually involves immaterial damages. How can you prove causality between the illegality and the immaterial damage suffered? That is difficult to prove and express in monetary terms. However, to substantiate the damages, the court referred to the provisions of the AVG: the loss of control over personal data and its (unlawful) dissemination, makes for damages. The 'loss of control' over personal data is, as this ruling also shows, easier to prove than the immaterial damage suffered. Indeed, the AVG already assumes that (immaterial) damage has been suffered when a data subject loses control over his or her personal data.

Does this ruling then provide more opportunities for those involved to claim damages?

Amsterdam Court

So it seems. A few months later, the Amsterdam court also awarded damages to a data subject for the unlawful processing of personal data. The case was as follows. An employee was employed by an employer X. After some time she became unfit for work due to burnout symptoms. Some time later, the employee joined another employer, employer Y. Employer Y did not know that the employee was registered as sick with the UWV. Employer Y received a letter from the UWV about a year after joining the company, informing it that the employee had been sick for a year and a half. This communication came as a complete surprise to employer Y: after all, it had not been involved at all in reporting this employee sick.

The court considered that the UWV had improperly shared sensitive data with employer Y. Although no medical data was included in the letter, the letter involved sensitive data about the employee. In addition, the employee had not given the UWV permission to share these sensitive data with employer Y. So again, this was a so-called "loss of control" over personal data. The damage the employee had suffered as a result was "real and non-negligible," the court said. This judgment resulted in the employee being awarded damages in the amount of 250 euros.

Claim culture?

You may be thinking: if the amounts awarded are so low, why all the fuss (and this blog)? In the case of individual damages, the amount payable is indeed negligible. But what you may be forgetting is that it is often not just one affected person. In many cases, multiple data subjects are affected by unlawful processing (for example, all your employees and temporary/subcontracted workers or all your customers).

The AVG therefore makes it possible to institute collective proceedings, provided that Dutch law provides for that possibility. Under it, a body, organization or association (non-profit) - on behalf of a large group of data subjects - can claim compensation for (immaterial) damages.

Currently, it is not yet possible under Dutch law to claim damages through a collective action. This should soon be changed by the Law on Settlement of Mass Damages in Collective Action (WAMCA).

If those affected then join forces, that innocent 250 or 500 euros (times a hundred or a thousand) can suddenly become a nasty sum after all. Combined with the fact that the threshold for awarding such damages seems to be lower since the entry into force of the AVG, this could potentially lead to many class actions in the future - and thus possibly to a claims culture. Time will tell what the actual impact of the WAMCA will be.

Resume

In any case, collective action law is in full swing and will soon offer more opportunities for data subjects to claim damages when organizations fail to comply with the AVG. Your organization should therefore take the possibility of collective actions seriously into account in the future. Will you therefore ensure that your organization pays sufficient attention to the AVG?