{"id":18863,"date":"2024-03-15T12:45:39","date_gmt":"2024-03-15T11:45:39","guid":{"rendered":"https:\/\/www.rosello-mallol.com\/?p=18863"},"modified":"2024-04-13T07:37:16","modified_gmt":"2024-04-13T06:37:16","slug":"compensation-for-moral-damages","status":"publish","type":"post","link":"https:\/\/www.rosello-mallol.com\/en\/compensation-for-moral-damages\/","title":{"rendered":"Compensation for moral damages: Art. 82 GDPR"},"content":{"rendered":"\n

Is compensation due to a breach of the GDPR possible?<\/h2>\n\n\n\n

Requesting compensation due to a breach of the data protection regulation is absolutely possible<\/strong>, as indicated in Art. 82 of the GDPR. In fact, citizens are becoming increasingly aware of this right and are requesting it more frequently, at least with regards to enquiries made to the firm.<\/p>\n\n\n\n

What is the difference between requesting compensation and reporting to the Spanish Data Protection Agency (AEPD)?<\/h2>\n\n\n\n

There\u2019s a big difference. Compensation <\/strong>consists of requesting a restitution due to a breach of the data protection regulation that may have a financial or moral effect on someone. It is requested through the ordinary courts and, logically, can only be requested by the party affected by the breach.<\/p>\n\n\n\n

The purpose of reporting <\/strong>to the AEPD, however, is to indicate that a company or enterprise has breached the GDPR and results in the imposing of a fine or, where appropriate, a warning. Unlike compensation, in this case the amount of the penalty (if financial) is paid to the Government authorities. Another significant difference is that it does not have to be the party affected that files proceedings
with the AEPD or with an independent data protection authority.<\/p>\n\n\n\n

Examples <\/strong>of a breach of the GDPR that do not necessarily involve direct damages
may include not having a Record of Processing Activitie<\/strong><\/a>s<\/strong><\/a>, which is undoubtedly an
obligation of the GDPR but would not often cause actual damages to those
affected.<\/p>\n\n\n\n

From whom and when can data protection compensation be claimed?<\/h2>\n\n\n\n

Art. 82 of the GDPR is clear in so much as compensation can be requested from \u201ccontrollers or processors<\/strong>\u201c. Therefore, the claim can be made to any enterprise or company involved in data processing.<\/p>\n\n\n\n

Despite this general indication, the same art. 82 GDPR<\/a><\/strong> states that the controller may be liable when it infringes the GDPR and, however, the processor may only be liable when it infringes obligations that the GDPR specifically directs at processors or when it has acted outside or contrary to the instructions of the
controller.<\/p>\n\n\n\n

What type of damages may be subject to data protection compensation?<\/h2>\n\n\n\n

Compensation must be considered a reparation or indemnity for the damage caused. There are generally two types of damages subject to compensation: financial <\/strong>or economic damages or moral <\/strong>damages. As well as the criteria indicated, the damage must be proven, which is not always a simple feat and, in
practice, calls for proof that the damage is real.<\/p>\n\n\n\n

Financial damages<\/strong> are infringements of the GDPR that affect the assets of the person affected. The most commonplace of these, for example, is having been included in a file of defaulters without any justification, where this has led to financial damages for the person affected. Financial or economic damages can be proven more easily than moral damages.<\/p>\n\n\n\n

Moral damages<\/strong>, however, are more difficult to prove and require that the person affected proves, in the words of case law: \u201cmental or spiritual anguish that may cause certain behaviour, activities or even results in the individual, whether involving direct or immediate aggression on material assets or whether the
attack affects extrapatrimonial wealth or the personality\u201d. To this end, any psychological report that proves the suffering caused to the affected person will be necessary or, at least, highly recommended.<\/p>\n\n\n\n

What if my company is in breach?<\/h2>\n\n\n\n

In the case of the company or enterprise causing the damages, (1) check and, where appropriate, update your data protection protocols as soon as you become aware of the claim, (2) if the damages are caused by a security incident, apply the requirements of the GDPR and (3) listen to the claim and analyse whether it actually has any grounds and, if so, analyse how to minimise the risk or damages caused.<\/p>\n\n\n\n

If you need more information about data protection, contact us!<\/p>\n\n\n\n

\n
\n

<\/p>

    <\/ul><\/div>\n
    \n
    \n<\/fieldset>\n