{"id":16548,"date":"2021-04-15T10:38:53","date_gmt":"2021-04-15T09:38:53","guid":{"rendered":"https:\/\/www.rosello-mallol.com\/?p=16548"},"modified":"2021-04-15T10:38:55","modified_gmt":"2021-04-15T09:38:55","slug":"data-leaks-do-i-have-the-right-to-compensation","status":"publish","type":"post","link":"https:\/\/www.rosello-mallol.com\/en\/data-leaks-do-i-have-the-right-to-compensation\/","title":{"rendered":"Data leaks: Do I have the right to compensation?"},"content":{"rendered":"\n

Data leaks have become regular news in our every-day lives. In the last few days alone, the news has been full of the data leak on Facebook<\/a> (more than 500 million affected worldwide, 11 million Spaniards) or LinkedIn<\/a> (also more than 500 million affected). <\/p>\n\n\n\n

The figures are really huge and statistics show that over the years, these data leaks caused by computer attacks or the negligence of companies are increasing.<\/p>\n\n\n\n

What rights do I have if I am affected by data leaks?<\/strong><\/h2>\n\n\n\n

If your data has been exposed by any of the service providers you use, you should know that according to current regulations, they must assess whether or not you should be informed of the incident. Therefore, this notification is not always compulsory: only in the most serious cases (for example, exposure of passwords or situations that could lead to cases of theft or the usurpation of user identity). <\/p>\n\n\n\n

Therefore, it is highly likely that your personal data has been leaked and you are unaware of such, because the provider believes that the situation is not serious enough to notify you.<\/p>\n\n\n\n

If you suspect that your data might have been affected, which is more likely, for example in the two cases cited as massive data leaks, you can always file a complaint with the Spanish Data Protection Agency which, among others and if it believes it justified, will ask the company for explanations regarding the security measures adopted and why those affected were not informed of the incident. <\/p>\n\n\n\n

Ultimately, the Spanish Data Protection Agency may sanction the controller, but it is important for you to know that, in this case, this is an administrative penalty, a fine, that the company must pay, if considered responsible, to the Spanish Data Protection Agency but that you, as the affected party, will not receive any compensation.<\/p>\n\n\n\n

\"Data<\/figure>\n\n\n\n

Can I be compensated?<\/strong><\/h2>\n\n\n\n

The answer is clearly yes and this is what Art. 82 of the GDPR states:<\/p>\n\n\n\n

“Any person who has suffered material or immaterial damages as a result of an infringement of this Regulation, shall have the right to receive compensation from the person in charge or the person in charge of the treatment for the damages suffered.”<\/em><\/p>\n\n\n\n

According to this article (which already existed in the previous regulation), any person who has suffered economic or moral damage due to a leak of their data can request compensation in the competent courts. <\/p>\n\n\n\n

As always in damages law, it will be the injured party that must prove said damages, which can be relatively easy to quantify if they are financial (for example, if the data leak has involved a subsequent fraud), but things get complicated in the case of moral damage.<\/p>\n\n\n\n

It is common for reported data leaks to be limited, in most cases to not-particularly sensitive data: telephone numbers, email addresses or simulated data, so financial damages, should they occur, would in theory be minimal, and moral damage would be very difficult to prove. <\/p>\n\n\n\n

As we say, sometimes financial damages go beyond the value of the \u201cstolen\u201d data itself, but can have consequences if scams are committed with that data. Thus, it seems complicated in practice for a single individual to initiate a high-cost judicial procedure with an uncertain result due to a data leak without there being evident and provable damages beyond the value of the data itself. <\/p>\n\n\n\n

Collective actions, likewise, which might seem a good solution in this case, have not been seen in our jurisdiction in this area either, as the regulations reserve them for groups of consumers and users and are used to protect a superior good such as, in this case, the market<\/p>\n\n\n\n

Other countries, such as the USA, have an advantage where class actions and even arbitration proceedings are very common in cases of data leaks.<\/p>\n\n\n\n

In summary:<\/strong><\/h3>\n\n\n\n

If you have been affected by a data breach or think you might have been:<\/p>\n\n\n\n