Liability for data breaches under Article 82 GDPR in Germany and Spain

Laburpena

This article analyzes the current interpretation of civil liability under Article 82 GDPR for non‑material damages in data‑breach cases. It starts from the case law of the Court of Justice of the European Union (CJEU) and examines recent jurisprudence in Germany and Spain. A central focus lies on the concept of “loss of control”: while the German Federal Court of Justice treats proven loss of control as non‑material damage per se, the article argues that a coherent reading of the CJEU’s harm‑based approach still requires the data subject to demonstrate additional actual negative effects (such as fear or anxiety). The author then examines how this question interacts with Spain’s moral‑damage doctrine and established case law on honor and privacy. It then explores the policy implications of an overly broad concept of non‑material damage for the data economy and the functioning of the courts, particularly in the context of automated mass claims. Ultimately, the article advocates a model in which Article 82 GDPR remains focused on individual compensatory redress, while structural enforcement against large‑scale infringements is primarily carried out by supervisory authorities to avoid abusive and excessive strategic litigation.