Compensation for damages as a result of privacy violation
Damage compensation for privacy violation
A breakthrough: Courts have imposed damages for privacy violations under the General Data Protection Regulation (GDPR). Earlier we saw that the Dutch Data Protection Authority issued fines to companies that violated the GDPR, but that compensations are also imposed is new.
Damage compensation to the municipality of Deventer
The first compensation under the GDPR has been imposed on the municipality of Deventer. What was going on?
A citizen made several Wob requests to the municipality of Deventer. These are requests that require a government agency to provide information about its actions.
The citizen had made such requests to various government agencies. In response to the Wob requests, the government agencies wanted to exchange information with each other on how to deal with the requests. In that context, the municipality of Deventer has shared various personal data of the citizen concerned in an email to about 50 other government agencies. The citizen then asked for an overview of the purpose of the processing of personal data and a complete list of all recipients of his personal data.
The municipality refuses to send an overview of all recipients of the personal data. The man appeals against the decision of the municipality. He also claims damages for violating his right to privacy.
Compensation for damages under the GDPR
The court of Overijssel subsequently ruled that the citizen had been affected in person because of loss of control over his personal data. Due to the distribution of personal data, there was a violation of his privacy. The judge therefore ordered the municipality to pay damages of € 500,00. That’s a breakthrough. Never before have damages been awarded under the GDPR.
UWV must pay employee compensation
The UWV benefits agency has also been ordered to pay €250,00 in damages for wrongfully reporting to the new employer that the employee had a burnout. That is the sharing of privacy data (without any legal basis) and thus a violation of the GDPR.
You can find the judgement of the court of Amsterdam here: https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBAMS:2019:6490
Lawyer specialized in privacy law; compensation of damages under the GDPR
Paying damages under the GDPR is a breakthrough. Although the amounts are still relatively low, in the case of serious violations with major damage as a result, these amounts can increase considerably. If you believe that you have suffered damage due to a privacy violation or if there is a threat of legal proceedings against your organization for privacy violation, please contact Mr. Lisa Jie Sam Foek, privacy lawyer (including about compensation under the GDPR).