CJEU: Initial Clarifications Regarding GDPR Violations

Article published on July 6, 2023, in Option Droit & Affaires -here.

The civil liability of data controllers for GDPR violations has long been a little-discussed topic in France, due to a lack of sufficient clarification regarding the conditions under which it applies. The CJEU has begun to fill this gap by clarifying that a violation of the GDPR is not sufficient to automatically trigger a right to compensation, while leaving open the question of the threshold of severity required for compensable non-pecuniary damage. It is therefore against this backdrop of persistent uncertainty that the French reform of class actions is taking place, the outcome of which could profoundly transform the landscape of personal data litigation.