Right to compensation
If data subjects have suffered material or immaterial damages as a result of a violation of the General Data Protection Regulation, they are entitled to compensation. Data controllers are liable for damage caused by unlawful data processing. Exemption from liability is only possible if data controllers can prove that they are not responsible for the damage.
Legal proceedings for damages may take place either in the EU member state where the data controller is headquartered or where the data subject has his habitual residence.
In Germany, there is currently no possibility of obtaining compensation with the help of non-profit organisations. While consumer centres (Verbraucherzentralen), for example, have a right of collective redress with which they can enforce the collective interests of consumers in certain legal areas, this does not include claims for damages (see also Right to sue).
Article 82 GDPR (Right to compensation and liability)
1. Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.
2. Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.
3. A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.
4. Where more than one controller or processor, or both a controller and a processor, are involved in the same processing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each controller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data subject.
5. Where a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage suffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in the same processing that part of the compensation corresponding to their part of responsibility for the damage, in accordance with the conditions set out in paragraph 2.
6. Court proceedings for exercising the right to receive compensation shall be brought before the courts competent under the law of the Member State referred to in Article 79(2).
Source: Regulation (EU) 2016/679 (see also recitals 146 and 147)
Article 79(2) GDPR (Right to an effective judicial remedy against a controller or processor)
Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.
Source: Regulation (EU) 2016/679
