In our blog on the right to immaterial damages under the AVG, we discussed the judgment of the Court of Justice of the European Union ("Court") in UI v. Österreichische Post. In this ruling, the Court clarified that the AVG provides a ground for compensation for immaterial damages, but not every violation of the AVG leads to a right to compensation. In this blog, we discuss Dutch case law on immaterial damages due to anxiety and stress caused by a data breach.

Intangible damages under the AVG

Article 82 AVG provides that both material and immaterial damages are eligible for compensation. Compensation for immaterial damages is particularly interesting, as an AVG breach often does not cause direct property damage, but can cause emotional or psychological damage.

In our blog about the right to immaterial damages under the AVG, we discussed that Dutch case law regarding immaterial damages following an AVG infringement is in line with Section 6:106 of the Dutch Civil Code and the EBI judgment. Based on the EBI judgment, for compensation of immaterial damages, there must be mental injury which must be determined according to objective standards. Other factors, such as the seriousness of the breach of standards and the consequences for the injured party, may also play a role in assessing the damages.

Case types in Dutch case law

Several judgments have been rendered in the Netherlands on compensation for immaterial damages following an AVG breach. Several case types can be identified from the existing case law. We will discuss these case types in separate blogs:

• feeling unsafe due to data breach;
• anxiety and stress due to data breach; - this blog
• data breach of special or sensitive personal data.

Case law on stress and anxiety complaints due to data breach

Rb. plaintiff v. Municipality of Heemskerk

Stress and anxiety complaints in themselves are not considered grounds for damages just like that, according to a ruling by the District Court of North Netherlands. The claimant allegedly suffered these complaints after a data breach at the municipality of Heemskerk. This data breach had occurred after the claimant had filed a notice of objection with the municipality, which involved a hearing and advisory committee. Her physical file was sent by the college to the members of the hearing and advisory committee. However, in sending it, something went wrong. One of the members of the committee had not received the file, resulting in a data breach for failure to send data correctly.

In this case, there was no evidence that claimant's data ended up with third parties. Nor has the claimant experienced identity fraud or received any suspicious letters, emails or phone calls. Accordingly, the request for damages is denied. Indeed, according to the court, the claimant has not sufficiently substantiated that she suffered mental injury.

Rb. claimant/UWV

In a ruling court Amsterdam ruled that Article 82 AVG should be interpreted in such a way that the mere fact that the damage is relatively small in size cannot be a ground for rejecting any claim to it.

According to the court, anxiety and stress following an AVG breach can also be objectively limited. However, this would only play a role in determining the amount of damages. In this case, the UWV had improperly shared information about the claimant's burnout with her new employer. Her new employer was not yet aware of this burnout. The data breach was limited to claimant and her new employer. In addition, the data breach did not cause plaintiff to lose her job, so the anxiety and stress must have been limited, according to the court. However, the court does award damages, but limits them to an amount of €250.

What is interesting in comparison with the decision of the District Court of Northern Netherlands is that the court in this case did assume by objective standards, based on the specific circumstances, that there was psychological damage. In this respect, the seriousness of the breach of standards and the consequences for the injured party seem to be decisive. In the case with the Municipality of Heemskerk, there was no evidence that data had ended up with third parties. Nor did it concern special or sensitive personal data. This contrasts with the case with the Amsterdam District Court, where the data did end up with a third party, the new employer, and also involved special, medical, personal data. That immaterial damages are more likely to be awarded in the event that special or sensitive personal data are involved in the leak, we also saw in our blog on data breaches of special or sensitive personal data.

Conclusion

Article 82 AVG provides that both material and immaterial damages are eligible for compensation. In our blog about the right to immaterial damages under the AVG , we already discussed that Dutch case law regarding immaterial damages following a data breach is in line with Section 6:106 of the Dutch Civil Code and the EBI judgment. In this blog, we saw that having anxiety and stress complaints plays a role in assessing whether there is a right to immaterial damages. Thereby, the seriousness of the breach of standards and the consequences for the injured party seem to be decisive for the court to assume by objective standards that there is psychological damage.

Want to know more?

Would you like to know more about immaterial damages for an AVG breach or do you have other questions about privacy law? Then feel free to contact Sven van Dooren or our team via our contact form.