ABSTRACT
Our internet activity produces vast amounts of personal data which is collected by online tracking ecosystems, at scale, often in violation of the General Data Protection Regulation (GDPR). Against this background, this paper explores whether ‘loss of control over personal data’, which is a typical characterisation of harms suffered by individuals due to illegal online tracking, amounts to compensable harm under the GDPR’s Article 82. It shows that (1) English (but not only English) courts seem currently unable to accommodate the idea that ‘loss of control over personal data’ would be compensable under the GDPR. (2) This makes the GDPR’s Article 82 ineffective vis-à-vis some of the most prevalent data protection harms. (3) Drawing on data protection, privacy, tort and EU law materials, this paper identifies four main arguments behind the current laws restrictive approach to compensation for ‘loss of control over personal data’ and shows that the law, when read carefully, in fact permits an alternative approach-one which makes compensation claims for loss of control over personal data caused by illegal online tracking more likely to succeed. (4) Ultimately, this paper shows that the GDPR can compensate both individual and mass loss of control over personal data caused by illegal online tracking.
Janeček, Václav, Loss of Control over Personal Data as GDPR Damage (August 22, 2024).
Leave a Reply