In our blog on the right to immaterial damages under the AVG, we discussed the judgment of the Court of Justice of the European Union ("Court") in UI v. Österreichische Post. In this ruling, the Court clarified that the AVG provides a ground for compensation for immaterial damages, but not every violation of the AVG leads to a right to compensation. In this blog, we discuss Dutch case law on immaterial damages due to a data breach of special or sensitive personal data.

Intangible damages under the AVG

Article 82 AVG provides that both material and immaterial damages are eligible for compensation. Compensation for immaterial damages is particularly interesting, as an AVG breach often does not cause direct property damage, but can cause emotional or psychological damage.

In our blog about the right to immaterial damages under the AVG, we discussed that Dutch case law regarding immaterial damages following an AVG infringement is in line with Section 6:106 of the Dutch Civil Code and the EBI judgment. Based on the EBI judgment, for compensation of immaterial damages, there must be mental injury which must be determined according to objective standards. Other factors, such as the seriousness of the breach of standards and the consequences for the injured party, may also play a role in assessing the damages.

Case types in Dutch case law

Several judgments have been rendered in the Netherlands on compensation for immaterial damages following an AVG breach. Several case types can be identified from the existing case law. We will discuss these case types in separate blogs:

• feeling unsafe due to data breach;
• anxiety and stress due to data breach; and
• data breach of special or sensitive personal data - this blog.

Case law on data breach of special or sensitive personal data

Rb. plaintiff v. Stichting Hogeschool van Arnhem en Nijmegen 

On Oct. 4, 2023, the Gelderland District Court ruled that the Arnhem Nijmegen University of Applied Sciences (HAN) must pay compensation of €300 to a former student. The personal data, including medical information about his study delay, had come into the hands of a third party after a data breach.

In 2022, the Arnhem Nijmegen University of Applied Sciences suffered a hack. Because of this hack, some of the personal data, which were on the server of the University of Applied Sciences, came into the hands of a hacker. Among the data were those of a former student, an alumnus of the college and plaintiff in this case. He was seeking damages from the college for failing to ensure an adequate level of protection to protect his personal data. As a result, both general personal data, including name, address and contact information, and special personal data, namely the (medical) reason for his study delay had been captured by the hacker.

The Gelderland court concluded that the leaking of the plaintiff's general personal data was not grounds for awarding damages. After all, the leaking of this data had not resulted in damages, according to the court. However, the leaking of special personal data, the personal circumstances, of this same plaintiff does give grounds for awarding damages. After all, according to the court, these special personal data are pre-eminently data that it is not desirable for them to become public. It is important to note that the claimant was already reluctant to share his medical data with the university in the first place. Because his medical records have now been leaked, the plaintiff's trust has, in the court's words, "suffered a major blow. The fact that a hacker was able to view this data and then distribute it is sufficient, according to the district court, to assume damages. The college was therefore ordered to pay damages to the former student in the amount of €300.

Rb. plaintiff v. Municipality of Oldambt 

That the nature of the personal data leaked is important in the question of whether or not immaterial damages are awarded is also evident from a ruling by the District Court of Northern Netherlands. In this case, the BSN number, e-mail address and telephone number of the person concerned were (unlawfully) disclosed several times by the municipality of Oldambt. Although, in the opinion of the court, the party involved in this case did not sufficiently substantiate that he had suffered psychological damage, nonetheless immaterial damages were awarded. Because of the sensitive nature of the leaked personal data, especially the BSN number, identity fraud is lurking. With this consideration, without explicitly substantiating it, the court seems to believe that the sensitive nature of leaked data may be sufficient for awarding immaterial damages. The individual is awarded damages of €500 for the immaterial damages he suffered.

Conclusion

Article 82 AVG provides that both material and immaterial damages are eligible for compensation. In our blog on the right to immaterial damages under the AVG , we already discussed that Dutch case law regarding immaterial damages following a data breach is in line with Section 6:106 of the Dutch Civil Code and the EBI judgment. In this blog, we saw how case law shows that immaterial damages are more likely to be awarded in case special or sensitive personal data are involved in the leak.

Want to know more?

Would you like to know more about immaterial damages for an AVG breach or do you have other questions regarding the protection of personal data? Then please feel free to contact Sven van Dooren or our team via our contact form.