Data Protection Compensation Claims

The Right to Compensation

Direct Answer: Article 82 states that any person who has suffered material or non-material damage as a result of an infringement has the right to receive compensation from the controller or processor.

Material damage means financial loss, for example from fraud after a breach. Non-material damage includes distress and reputational harm. Where more than one party is responsible, each can be liable for the whole amount, though they can recover contributions from each other.

Why Proof of Damage Matters

In Lloyd v Google, the Supreme Court held that loss of control of personal data alone, without proof that each person suffered damage or distress, did not give a right to compensation, and it stopped a large representative action from proceeding on that basis. In practice, claimants need evidence of what harm they actually suffered, and low-level distress claims may be worth modest amounts and can be difficult to justify economically.

Practical Steps

Keep the breach notice and any communications, record any fraud, costs and the effect on you, and consider whether to complain to the organisation and to the Information Commissioner first. Group claims exist in some cases, but each claimant must still show their own loss, so consider carefully who you instruct and on what terms.