x.com/airkatakana/status/2110370702515999229
1 correction found
having the agents sue non-compliant firms for damages
GDPR non-compliance alone does not automatically create a damages claim. Under Article 82, a claimant must show actual material or non-material damage caused by the breach.
Full reasoning
This claim misstates how GDPR compensation works in Europe.
Under Article 82 GDPR, a person does not get damages merely because a company was "non-compliant." The Court of Justice of the EU has held that mere infringement of the GDPR is not sufficient to create a right to compensation. A claimant must show (1) an infringement, (2) actual material or non-material damage, and (3) a causal link between the two.
The UK ICO's public guidance says the same thing in plainer language: you may claim compensation if you have suffered damage as a result of a data-protection breach, and if you fail to demonstrate damage or distress, the court will not award compensation.
So the post's framing — that one can simply identify "non-compliant firms" and sue them "for damages" as an automated income strategy — is legally inaccurate. Non-compliance may support a regulatory complaint or an enforcement issue, but damages are not automatic and require proof of harm caused by the breach.
2 sources
- Court of Justice of the European Union press release on Case C-300/21 (Österreichische Post)
"Mere infringement of the GDPR does not give rise to a right to compensation." The case concerns Article 82(1) GDPR and whether infringement alone is enough; the Court said it is not.
- Taking your case to court and claiming compensation | ICO
"The GDPR gives you a right to claim compensation from an organisation if you have suffered damage as a result of it breaking data protection law." The ICO also states: "if you fail to demonstrate you have suffered damage or distress, the court will not award you compensation."