{"id":100083,"date":"2025-09-09T08:36:02","date_gmt":"2025-09-09T07:36:02","guid":{"rendered":"https:\/\/www.ictrechtswijzer.be\/?p=100083"},"modified":"2025-11-12T12:29:52","modified_gmt":"2025-11-12T11:29:52","slug":"can-i-claim-damages-for-anxiety-and-stress-after-a-data-breach","status":"publish","type":"post","link":"https:\/\/www.ictrechtswijzer.be\/en\/kan-ik-een-schadevergoeding-eisen-voor-angst-en-stress-na-een-datalek\/","title":{"rendered":"Can I claim compensation for anxiety and stress after a data breach?"},"content":{"rendered":"

Yes, the Court of Justice of the European Union has confirmed that negative feelings such as fear, stress or dissatisfaction following a breach of your personal data can entitle you to compensation. The mere fear of misuse of your data or loss of control may suffice, without having to prove a minimum threshold of severity. This significantly lowers the threshold for victims of data breaches.<\/p>\n\n\n\n

The facts: an out-of-control job application<\/h2>\n\n\n\n

The case that led to the judgment of 4 September 2025<\/a> (Case C-655\/23, IP v. Quirin Privatbank AG) was remarkably straightforward. An applicant, IP, negotiated his wage terms with Quirin Privatbank. An employee of the bank accidentally sent a message rejecting his wage demands and a counterproposal to the wrong person via a professional social network. This third party happened to know the applicant from a previous work experience and forwarded the message to him.<\/p>\n\n\n\n

The applicant felt humiliated and was concerned that this confidential information would circulate in his professional circle, which could put him at a competitive disadvantage in the future. He went to court and demanded two cases:<\/p>\n\n\n\n

    \n
  1. A ban for the bank from making another such mistake in the future.<\/li>\n\n\n\n
  2. Compensation of \u20ac1,000 for the moral damage suffered (stress, humiliation, fear).<\/li>\n<\/ol>\n\n\n\n

    The German courts were divided. The first judge granted both claims, but on appeal ruled that the \"humiliation\" was not severe enough to qualify as damages. Ultimately, Germany's highest federal court referred the issue to the European Court of Justice<\/p>\n\n\n\n

    The decision of the Court of Justice<\/h2>\n\n\n\n

    On 4 september 2025, the Court handed down a ruling that significantly strengthens the rights of victims of data breaches. The essence of the decision can be summarized in four points:<\/p>\n\n\n\n

    1. Qualifying negative feelings as \"moral harm\"<\/strong> The Court held that the term \"non-material damage\" in Article 82(1) of the General Data Protection Regulation (GDPR)<\/a> should be interpreted broadly. Negative feelings such as fear, anxiety, annoyance, displeasure or humiliation may suffice. While the victim must prove that these feelings are a direct result of the GDPR breach, there is no minimum threshold. Thus, even minor, but proven, moral damages are eligible for compensation.<\/p>\n\n\n\n

    2. The severity of the fault is irrelevant to the amount of compensation<\/strong> The Court clearly states that compensation under Article 82 GDPR has an exclusively compensatory function. The aim is to fully compensate the victim for the damage suffered, not to punish the company. Therefore, the degree of fault of the controller (was it intentional or mere negligence?) should not play a role in determining the amount of compensation. Compensation is based solely on the extent of the proven harm to the victim.<\/p>\n\n\n\n

    3. A ban for the future is not a GDPR right, but can be done through national law<\/strong> The GDPR itself does not explicitly provide a right for an individual to seek a preventive injunction through the courts against a company to repeat a breach. However, the Court stated that the GDPR does not prevent member states from <\/strong>to provide such a remedy in their own national legislation. In Belgium, for example, it could be argued that such a prohibition could possibly be requested through article 18, second paragraph Judicial Code<\/a> .<\/p>\n\n\n\n

    4. An injunction and damages are separate<\/strong> A preventive injunction and compensation serve completely different purposes. The injunction is preventive (future-oriented), while compensation is compensatory (aimed at repairing damage already suffered). Therefore, obtaining an injunction can never reduce or replace financial compensation.<\/p>\n\n\n\n

    Legal analysis and interpretation<\/h2>\n\n\n\n

    This judgment is perfectly in line with previous case law of the Court (such as the case of \u00d6sterreichische Post, C-300\/21<\/a>), but refines and confirms the principles. The trend is unmistakable: protecting the individual and strengthening their rights under the GDPR is key.<\/p>\n\n\n\n

    The clear separation between the compensatory function of Article 82 GDPR (compensation for the victim) and the punitive function of Article 83 GDPR (administrative fines imposed by the regulator) is legally crucial. Thus, a company can be hit twice: a high fine from the Data Protection Authority<\/a> as well as compensation claims from aggrieved citizens. The intent or negligence of the company is only relevant to the amount of the fine, not the individual compensation.<\/p>\n\n\n\n

    The most significant shift for legal practice is the focus on proving damages. Whereas previously the discussion was often about whether feelings such as \"fear\" could constitute harm, the focus will now be on the question: has the victim sufficiently demonstrated that he\/she actually experienced this fear as a result of the infringement? It is up to the national courts to assess this on a case-by-case basis.<\/p>\n\n\n\n

    What this specifically means<\/h2>\n\n\n\n

    For victims (data subjects):<\/strong><\/p>\n\n\n\n