ABSTRACT
This paper critically evaluates whether Article 82 of the GDPR provides an effective system for financial compensation to individuals who have suffered harm from breaches of their personal data. The research uses current CJEU case-law to demonstrate that, although liability provisions on the amount of compensation are being established, allowing each member state’s court to determine the amount of compensation to be awarded to victims of data breaches creates inconsistent levels of legal recourse for data breach victims throughout Europe. In particular, three major shortcomings are identified: Article 82 has only a compensatory (not deterrent) function with respect to breaches of privacy rights; the loss of control over one’s own data is unclearly defined in terms of what constitutes legally compensable damage; and there are insufficient avenues available to data breach victims to pursue collective action.
Abrokwa, Emmanuel Kwasi, Compensation for Data Breach Victims under Article 82 GDPR: A Critical Analysis (July 17, 2026).
Leave a Reply