The European Court of Justice (CJEU) has announced two important rulings which clarify its stance on data protection laws. The General Data Protection Regulation came into effect in 2018, but the lack of clarity in some of its wording has led to it being interpreted in different ways. This has, unsurprisingly, provoked a plethora of court cases in recent years.
As a result, the CJEU has clarified the legislation to try and avoid further disputes in the future. In particular, the first of its rulings has explained more accurately if and when an individual can sue for compensation in the event that their data has been mishandled. The second ruling concentrates on how data must be presented when an individual asks a company for a copy of their personal information. We’ll cover both topics in greater detail below.
No Minimum Threshold for Personal Harm
The first CJEU ruling concerns itself with compensation in the event of a data breach. First of all, it makes it clear that no one has an automatic right to receive such remuneration. Instead, they must prove some personal harm has taken place as a direct result of the breach. Having said that, the CJEU has confirmed that this personal harm has no minimum threshold.
What that means in practice is that any type of negative emotion caused by a data breach could be grounds for suing the company in question with success. Alarm, anxiety and stress could all be construed as sufficient to receive compensation. In this particular respect, it appears as though the UK may diverge from Brussels. That’s because a UK judge recently ruled that personal harm “must reach a threshold of seriousness to be eligible for compensation” in a long-running court case against Google.
“Faithful and Intelligible Reproduction”
Meanwhile, the second ruling relates to the format in which individuals can expect to receive a copy of their data. In this instance, the CJEU concluded that all companies must provide anyone who asks for a copy of their personal information with a “faithful and intelligible reproduction” of the data. This is to allow them to make sure that a) the data is accurate and b) it is being used in the lawful and agreed-upon manner.
This should have major repercussions for platform workers. Self-employed individuals offering their services to companies like Ola and Uber have found themselves unable to receive their information in full, with the companies citing security concerns. Although the judge stressed that each instance would be judged on its own merits, this ruling – along with another prospective directive aimed at protecting platform workers’ rights – is certainly good news going forwards.
Taking Back Control of Your Data
While both of these rulings from the CJEU are intended to clarify the wording of their legislation and offer better protection for individual users against the corporations collecting and harvesting their data, neither are fool-proof nor ironclad. Indeed, the best way to take back control of your personal information is to remove it from the internet altogether.
Of course, the world wide web has been around for several decades now, which could make the process of minimising your digital footprint an extremely challenging one. For that reason, contracting the services of third-party companies like Incogni, who specialise in providing data removal services, could make sense. Incogni can send out dozens of opt-out requests on your behalf on a continual basis, meaning data brokers have less access to your personal information.
Data protection in general and GDPR in particular are extremely sensitive subjects right now. The CJEU’s clarification on its legislation is welcome, but there is still plenty more that worried individuals can do to safeguard their personal information online.
