Court of Justice 26 October 2023, C-182/22 and C-189/22 (JU and SO v Scalable Capital GmbH.)

Also known as

In joined Cases C‑182/22 and C‑189/22, Advocate General Collins opines that the theft of personal data by unknown third parties does not, in itself, constitute 'identity theft' within the meaning of recitals 75 and 85 of Regulation (EU) 2016/679 (GDPR), as identity theft requires an additional act of misuse or concrete preparatory steps to impersonate the data subject. However, the Advocate General advises that such theft may nonetheless give rise to a right to compensation for non-material damage under Article 82(1) GDPR, provided the three cumulative conditions are satisfied: an infringement of the GDPR, actual damage suffered, and a causal link between the infringement and that damage. The opinion further clarifies that mere possession of identifying data without any (mis)use does not create a presumption of identity theft, and that compensation under Article 82(1) GDPR is purely compensatory in character, excluding punitive damages, with non-material damage assessed on a case-by-case basis without a de minimis threshold.AI