Article 82
Right to compensation and liability
Chapter 8
|
Remedies, Liability and Penalties
|
đ 3 min read
1. Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.
2. Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.
3. A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.
4. Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject.
5. Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2.
6. Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in Article 79(2).
Understanding This Article
Article 82 is GDPR's core compensation mechanism, establishing strict liability for data protection violations with broad remedies for data subjects. This transforms data protection from mere regulatory compliance into enforceable private rights with real financial consequences.
The inclusion of "non-material damage" (paragraph 1) is revolutionary. Traditional tort law often limits compensation to tangible economic losses. Article 82 recognizes that privacy violations cause dignitary harms, emotional distress, loss of control, and reputational damage even without financial losses. Courts have awarded compensation for anxiety, loss of privacy, distress from unauthorized data disclosure, and violations of dignityâexpanding damages beyond traditional economic harm models.
The liability framework (paragraph 2) differentiates controllers and processors. Controllers bear primary liability for all processing under their control. Processors face narrower liabilityâonly for violating processor-specific obligations (Articles 28-32) or acting beyond/contrary to controller instructions. This reflects their different roles and responsibilities under GDPR.
Paragraph 3's reversed burden of proof is powerful. Controllers/processors are presumed liable once a violation is establishedâthey must prove they're "not in any way responsible" to avoid liability. This is stricter than typical negligence standards requiring plaintiffs to prove fault. Organizations must demonstrate they took all reasonable measures and the harm was genuinely unpreventable despite their compliance efforts.
Joint and several liability (paragraph 4) protects data subjects when multiple parties are involved. Rather than proving each party's individual contribution to harm, data subjects can recover full compensation from any responsible party. This is particularly valuable when one party is judgment-proof or insolventâdata subjects aren't left uncompensated. The liable parties then sort out contributions among themselves (paragraph 5).