Can I claim compensation for a privacy breach?

The short answer

Article 82 of the General Data Protection Regulation (GDPR) gives you the right to claim compensation when an organization violates your privacy. This can be both material damage, such as financial losses due to identity theft, and immaterial damage such as stress, anxiety or reputational damage. The organization is liable unless it can prove that the breach was not attributable to them. You do not have to prove that the organization had intent - they can also be liable for negligence. The amount of compensation depends on the severity of the breach and the consequences for you.

What does the law say?

The GDPR contains specific rules about compensation for privacy breaches. Article 82 states that anyone who has suffered material or immaterial damage as a result of a breach of the GDPR has the right to compensation. The organization responsible for the data processing bears the burden of proof that it is not responsible for the breach. This means that the organization must demonstrate that the breach was beyond their control.

What should you watch out for?

When claiming compensation for a privacy breach, there are several important points to consider. You must be able to demonstrate that actual damage has occurred due to the privacy breach and that there is a link between the breach and your damage. Collecting evidence can be challenging, especially for immaterial damage such as stress or anxiety.

Example from practice

An online store is hacked and the personal data of 10,000 customers, including names, addresses and credit card information, is leaked. A customer subsequently becomes a victim of identity theft and suffers financial damage of €2,500. In addition, this person has a lot of stress and sleep problems due to the situation. The customer can claim both the material damage (€2,500) and immaterial compensation for the stress and anxiety from the online store. The store is liable unless it can prove that the hack was completely beyond their control and that they had taken all the right security measures.

What can you do?

If you think you are entitled to compensation for a privacy breach, you can take several steps.