Grzegorz Pobożniak, partner, Kubas Kos Gałkowski, Poland
Agnieszka Trzaska-Śmieszek, partner, Kubas Kos Gałkowski, Poland
Introductory Remarks - new legislation
One of main sanctions for infringement of personal data protection principles is liability for damages, stipulated in Article 82 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the European Union L 119, English edition, Legislation Volume 59, 4 May 2016, hereinafter referred to as the "GDPR").
Article 82 of the GDPR provides for claims for compensation for material and non-material damage resulting from a violation of the GDPR provisions by the administrator or data processor. This is a crucial mechanism of the private enforcement of GDPR, and every person whose data has been breached shall be entitled to act in accordance with said mechanism. Article 82 of the GDPR was discussed i.e. by the Court of Justice of the EU in the Judgment C-687/21 (Judgment of the Court of 25 January 2024, MediaMarktSaturn, C-687/21, EU:C:2024:72), where it was ruled that said Article contains the following prerequisites of responsibility:
- the existence of an infringement of that regulation,
- the existence of "damage" or "harm" which has been "suffered", and
- causal link between that damage and that infringement.
The most recent judgement of the CJEU in this regard is the Judgment of 11 April 2024, C-741/21, in case GP versus JURIS GMBH (hereinafter referred to as the "Judgement GP v Juris").
Immaterial damages claim for data breach in Poland
In Polish reality the risk of liability for damages for the GDPR breach was limited – as lengthy and quite bothersome proceedings failed to encourage individuals to file lawsuits. Moreover, identifying non-material damage with the so-called harm in the meaning of Polish regulations on the infringement of personal rights causes great difficulties in pursuing claims related to data leaks. However, the legal landscape shall be completely changed according to the new act that came into force on 29 August 2024. This is the Act of 24 July 2024 amending the Act on Pursuing Claims in Group Proceedings of 17 December 2009 (hereinafter referred to as “PCGP”), implementing the Directive (EU) 2020/1828 of the European Parliament and of the Council of 25 November 2020 on representative actions for the protection of the collective interests of consumers and repealing Directive 2009/22/EC adopted in 2020. This is quite a revolution in the Polish class action legal market.
A representative action for the protection of the collective interests of consumers in Poland takes the form of group proceedings regulated in the UDRPG and introduced in Poland in 2010, but with important changes resulting from the requirements of the Directive. Violation of the collective interests of consumers may manifest itself in a violation of the provisions of the GDPR.
Infringement of the GDPR may typically result in non-material damage (namely having a negative mental experience). In other jurisdictions, entities seeking compensation for non-material damage very often express only the feeling of discomfort resulting from, for example, losing control over their personal data. However, some concerns have been raised in Poland as to the applicability of the new legislation to immaterial damages suffered as the result of the GDPR infringement.
This is because there is no general definition of non-material damage in the Polish law system, and the Polish Civil Code specifies only the concept of seeking compensation for harm suffered as a result of violations of personal rights (Article 24, paragraph 1 in conjunction with Article 448, paragraph 1 of the Polish Civil Code).
Usually, a breach of the general data protection regulation resulting in unlawful destruction, loss of control, alteration, unauthorised disclosure may result in immaterial damage. Case in point: a person whose data has been stolen by the criminals may live in fear of having their data used for the purposes of unlawful transactions or presented in dishonest manner. This shall be regarded as immaterial damage and any entity suffering therefrom has the right to compensation, provided that the damage is proven. In the Polish legal system, as mentioned above, there is no general concept of immaterial damages. Only if personal interests (such as dignity, freedom of conscience, name or pseudonym, image, privacy of correspondence) are violated, courts of law are entitled to award compensation for immaterial damages. However, provisions providing for protection of personal interest are different from GDPR basis for claim, having its independent regime, namely article 24, paragraph 1 in conjunction with Article 448, paragraph 1 of the Polish Civil Code. The breach of the data protection regulation will not always result in the breach of provisions of personal interests. Therefore, referring to the Polish law on the protection of personal interests would lead to an unjustified narrowing of the scope of liability for damages for the breach of the data protection regulation and would, in fact, lead to the denial of the independent nature of this liability. Therefore, some cases of GDPR violations may remain beyond the scope of effective compensation claims only due to national regulations regarding the protection of personal rights. Such interpretation and application of Article 82 of the GDPR violates the above-mentioned principle of equivalence and effectiveness of EU law, also emphasized in the GP v Juris Judgment.
However, we believe that the regulation of Article 82 of the GDPR is autonomous in nature and it constitutes direct and independent ground for an enforcement of a claim for immaterial damages, producing independent and sufficient new grounds for such claims also in the Polish legal system. As the CJEU has explained: "The GDPR makes no reference to the law of the Member States as regards the meaning and scope of the terms set out in Article 82 […] in particular as regards the concepts of ‘material or non-material damage and of ‘compensation for the damage suffered’. […] for the purposes of the application of that regulation, as constituting autonomous concepts of EU law which must be interpreted in a uniform manner in all of the Member States."(Judgment of the Court of 4 May 2023, UI against ÖSTERREICHISCHE POST AG, C-300/21, EU:C:2023:370.)
Grounds for the liability for damages, referred to in Article 82 of the GDPR are based on an autonomous interpretation independent from the Member States. By no means does this provision regarding the meaning of damage in refer to regulations of Member States, and therefore it must be held as ruled by the CJEU: "according to settled case-law, the terms of a provision of EU law, such as Articles 24 and 32 of the GDPR, which makes no express reference to the law of the Member States for the purposes of determining its meaning and scope must normally be given an autonomous and uniform interpretation throughout the European Union, having regard, inter alia, to the wording of the provision concerned, to the objectives pursued by that provision and to its context". Thus, while directly applying the provision of Article 82 of the GDPR, the Member States’ court should construe non-material damage as it is understood in EU law and simultaneously it cannot invoke a different understanding of the concept of "non-material damage" in the national legal system, especially in situations wherein this could pose a risk of significantly reducing the grounds for liability by taking a very narrow approach to non-pecuniary damage.
In the CJEU’s jurisdiction, the concept of non-material damage is widely interpretated and the meaning of thereof is certainly autonomous. The modification of this interpretation by making a reference to the national provisions of the protection of personal interests is neither needed nor possible. While dealing with the meaning of non-material damage it is always challenging and quite problematic to prove “mental harm”, and evidence has to take a certain undisputable form (not every GDPR breach is resulting in immaterial damage). However, it does not change the fact that non-material damage has normative meaning based on the regulation of Article 82 of the GDPR and it is the common courts duty to make use thereof.
Is it possible to enforce a claim pursuant to Article 82 of the GDPR in group proceedings (representative actions) in Poland?
Class actions have been a part of the Polish legal system since 2010. The amended PCGP Act of 24 2024 July also refers to representative actions as a specific type of class action claim.
However, the legislator provides in detail that class actions may not be applied to cases concerning personal interests violations (with the exception of certain claims related to the violation of personal rights such as health or life) Nevertheless, as described above, the claim for compensation arising from Article 82 of the GDPR is an autonomous claim independent from domestic claims envisaged for the protection of personal interests. As aforementioned, we believe that claims under Article 82 of the GDPR should not be identified as equal to personal interests claims pursued under the national legal system.
Furthermore, due to the nature of group claims – it would be a perfect solution to GDPR infringements, as a massive breach of data protection law may lead to small but numerous damages, namely their individual enforcement is not "attractive" to the injured parties, bearing in mind the workload and commitment that must be put into an individual process and the limited compensation that a given individual may receive.
In is assumed in the Directive 2020/1828 that GDPR regulations constitute provisions which if violated may lead to the violation of collective consumers’ interests, which shall be protected in group proceedings (Article 2 paragraph 1 of the Directive in conjunction with point 56 of Annex 1). Pro-European interpretation of the law (the PCGP as amended in 2024 is designed to implement the Directive 2020/1828) leads to the conclusion that exclusion of personal interests claims from class action proceedings (Polish group proceedings) fails to exclude the possibility of pursuing claims resulting from other legal bases (Article 82 of the GDPR), even if the facts in a given case may sometimes involve an infringement of personal rights.
Summing up, the amended PCGP Act of 24 July 2024 is becoming a useful tool to pursue representative actions for protection of consumers’ interests under Article 82 of the GDPR, including immaterial damages claim as well. The new legislation provides a framework for such representative claims, making it much easier and more effective:
- the entities authorized to bring these class actions shall be the so-called authorized entities, i.e. consumer organizations that will be entered in the appropriate register, as well as the Financial Ombudsman within the scope of their "competencies",
- the case may be considered to be a group case even if there are differences between the actual situation of individual group members (consumers) - provided that their claims are based on the same legal basis;
- third party financing is admissible;
- exemption of the authorized entity from the obligation to pay the court fee for lawsuit;
- exemptions of the consumers (group members) from the obligation to bear the costs of proceedings;
- various facilitations, such as no deposits in this kind of class actions, the effectiveness of the proceedings is to be ensured by the mechanism for the disclosure of evidence by the defendant and severe penalties for failing to comply with the judgment.
To sum up, the PCGP allows enforcing claims from Article 82 in representative class actions and may be an effective tool of private enforcement. Following the example from other jurisdictions, it is expected that cases involving the protection of consumers. interests violated as a result of non-compliance with the GDPR through mass claims pursued in representative proceedings, shall become a reality in the Polish courts. Undoubtedly, administrators, especially those processing personal data on a mass scale, should take into account this new perspective of pursuing compensation claims against them.
For further information on this topic please contact Grzegorz Pobożniak or Agnieszka Trzaska-Śmieszek at Kubas Kos Gałkowski by telephone (+48 12 619 40 40) or email ([email protected] or [email protected]). The Kubas Kos Gałkowski website can be accessed at www.kkg.pl.