Reparations for immaterial damage under the GDPR: A new context
Written by Giorgos Arsenis*
A court in Austria sentenced a company to 800 Euros of compensation-payment towards a data-subject, for reasons of immaterial (emotional) harm, according to article 82 of the GDPR (General Data Protection Regulation). The verdict is not in force yet, since both parties have appealed the decision, but in case the verdict will remain unchanged in the second instance, then the company might be facing a mass lawsuit, where about 2 million data-subjects are involved.
The case has gained momentum since its outcome will constitute a legal paradigm, upon which future cases will be based. But let’s take a step back and have a broader look at this verdict and the consequences this application of article 82 might have towards the justice systems of other members of the European Union.
Profiling
The fact that a Post Office gathers and saves personal data of its customers is nothing new. But after a data-subject’s request, it was revealed that Austria’s Post, allegedly, evaluated and stored data that concerned the political preferences of approximately 2 million of its clients.
The said company used statistical methods such as profiling, aiming to estimate the level of affinity of a person towards an Austrian political party (e.g. significant possibility of affinity for party A, insignificant possibility of affinity for party B). According to media, it appears that none of the customers had provided their consent for this processing activity and in certain cases that information was acquired by further entities.
Immaterial harm has a price
The local court of Feldkirch in Voralberg, a confederate state of Austria bordering with Lichtenstein, where the hearing took place in the first instance, ruled that the sheer feeling of distress sensed by the claimant due to the profiling he was subjected to without his consent, constitutes immaterial harm. Therefore, the accuser was awarded 800 Euros, from the 2.500 Euros he claimed initially.
The court acknowledged that the political beliefs of a person are a special category of personal data, according to article 9 of GDPR. However, it also acknowledged that every situation perceived as unfavorable treatment, cannot give rise for compensation claims based on moral damages. Nevertheless, the court concluded that in this case, fundamental rights of the data-subject had been violated.
The calculation of the compensation was based on a method that applies in Austria. In line with that method, the court took two main elements into account: (1) that political opinions are an especially sensitive category of personal data and (2) that the processing activity was conducted without the awareness of the data-subject.
And now?
The verdict is no surprise. Article 82 § 1 of the GDPR clearly foresees compensation payment for immaterial harm. However, with 2,2 million data-subjects affected from this processing activity and simply by doing the math, what derives is the amount of 1,7 billion Euros. Certain is, that if the court of appeal confirms the decision, there will be a plethora of similar cases for litigation. This is the reason why already, in neighbouring Germany, many companies specialize in cases like this.
The Independent Authority
After the decision of the local court in Feldkirch in the beginning of October 2019, towards the end of the same month (29.10.2019) the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), announced that an administrative sanction of 18 million Euros was imposed to the Austrian Postal Service. Beyond political beliefs, the independent authority detected more violations. Via further processing, evidence about the frequency of package deliveries or residence change were obtained, which were used as means for direct-marketing advertisement. The Austrian Postal Service, which by half belongs to the state, reported that it will take legal action against this administrative measure and justified the purpose of the processing activities as legitimate market analysis.
What makes the verdict distinctive
The verdict in Feldkirch shows that the courts are able to impose fines for certain “adversities” caused by real or hypothetical violations of personal data.
Unlike the independent authority, that imposed the administrative sanction due to multiple violations of the GDPR-clauses, the local court in Feldkirch focused on the ‘disturbance’ sensed by the complainant.
The complainant simply stated that he ‘felt disturbed’ for what happened, i.e. without pleading a moral damage resulting from the processing activity, such as defamation, copyright abuse or harassment by phone calls or emails. The moral damage was induced by the fact that a company is processing personal data in an unlawful manner.
You can find the decision here.
* Giorgos Arsenis is an IT Consultant και DPO. He has long-standing experience in IT Systems Implementation & Maintenance, in a number of countries in Europe. He has been active for agencies and institutions of the EU and in the private sector. He is qualified in servers, networks, scientific modelling and virtual machine environments. Freelancer, specializes on Information Security Management Systems and Personal Data Protection.
Digital Sources:
Homo Digitalis at Freedom Not Fear 2019
On 8th-11th November, the annual conference of European digital rights organizations, Freedom Not Fear 2019 was held in Brussels.
We are very happy that our organization was represented in the conference by the following members: Mr Lefteris Chelioudakis, Mr Konstantinos Kakavoulis, Ms Anastasia Karagianni, Ms Mariliza Baka, Ms Emilia Givropoulou, Mr Yiannis Konstantinidis and Mr Nikos Ioannidis.
In fact, Homo Digitalis was pleased to host a workshop on the state of digital rights in Greece and regarding the Facebook Content Moderation Center, which operates in Athens, as recently revealed.
Ms Emilia Givropoulou was also pleased to have a talk with German MEP Patrick Brayer on European legislation and practice on terrorist content.
Finally, members of Homo Digitalis visited the European Parliament and discussed with MEPs on human rights regulation in the modern digital age.
Homo Digitalis has been an avid supporter of Freedom Not Fear 2019.
We are setting our meeting for next year!
Homo Digitalis at Larisa Music School
On November 5, 2019 Homo Digitalis was invited by the Parents-Guardians Association of the Music School of Larisa.
Homo Digitalis’s members: Mr Konstantinos Kakavoulis, Ms Anastasia Karagianni and Mr Anastasios Arabatzis gave a speech to parents and students of secondary and high school regarding cyberbullying and digital footprint.
Homodigitalis’s Interlocutor at the event was Mr Dimitris Liovas, Informatics and New Technologies Officer of Secondary Education level of Larisa.
We are delighted to be invited by the Parents-Guardians Association and would like to thank for the excellent organisation of the event. Special thanks to the Leader of the Parents-Guardians Association, Mr Antonios Sotiriou.
This was the first event taken place outside Athens. Stay tuned, as there are more to come!
Homo Digitalis’s Participation and Speech at the Second Meeting of the CEPS Artificial Intelligence & Cyber Security Working Group
Homo Digitalis had the great honor and pleasure to attend and give a speech at the second meeting of the Center for European Policy Studies (CEPS) Working Group on Artificial Intelligence and Cybersecurity.
CEPS is a well-known think tank with high research activity and influence on European Union issues. Our organization was represented by Mr Lefteris Chelioudakis.
In our speech, we focused our attention on the “Ethics Guidelines for Trustworthy Artificial Intelligence” published in April 2019 by the European Commission’s High- Level Expert Group on Artificial Intelligence. (AI HLEG).
In particular to this, we set forth our observations on four (4) of the requirements set by the Expert Group on Reliable Artificial Intelligence, namely “Human agency and oversight”, “Privacy and Data governance”, “Transparency” and “Diversity, non -discrimination and fairness”.
We would like to thank the Head of the Working Group, Mr Lorenzo Pupillo, and his Rapporteur, Mr Stefano Fantin, for their kind invitation.
You can find out more about the event and its schedule here.
Complaint submission to the European Commission regarding Law 4624/2019
On October 24, 2019, Homo Digitalis following the complaint dated on 5/30/2019, lodged a new complaint to the European Commission for non-compliance with EU law, this time regarding the provisions of the Law 4624/2019 on personal data and namely with the provisions of Directive 2016/680 and Regulation 2016/679 (Reference No CHAP(2019)03059).
Through our complaint we aim to highlight the provisions of the Law 4624/2019, which draws attention on the protection of personal data subject’s rights in Greece. The intention is to improve these provisions through a direct legislative amendment.
However, we are anticipating with great interest the relevant Opinion of the Personal Data Protection Authority regarding the provisions Law 4624/2019. We would like to mention here that earlier on the 20th of September 2019 Homo Digitalis and the Consumer Association “The Quality of Life” addressed a joint request to the DPA in order the Authority to issue a legal opinion regarding the newly adopted Law 4624/2019.
You can find the full text of our complaint to the European Commission here and the registration of the complaint lodging here.
Homo Digitalis signs International Declaration for the cessation of using facial recognition technology
These days the 41st International Conference of Commissioners for the Protection of Private Life and Personal Data (ICDPPC) is being held.
In this context, the Organization Electronic Privacy Information Center – EPIC has published an International Declaration by calling for the cessation of facial recognition technology.
Our organization, along with other organizations, such as Privacy International, Access Now, Algorithmic Justice League, Digitalcourage e.V. etc., and individuals have singed this Declaration.
The context of the Declaration calls, inter alia, the States to suspend the use of facial recognition technology for mass surveillance purposes, and to adopt the necessary legal rules, technical standards and ethical guidelines, in order to cooperate in the future, also further develop and use such technology, with the respect of privacy, the protection of personal data and the prohibition of discrimination.
You can sign the Declaration either as individual or as organization here.
Our organization has been involved in similar activities in the past, such as the signing of the International Guidelines for Artificial Intelligence published by EPIC at the same conference in 2018. Indeed, last year we were pleased to attend that conference.
Homo Digitalis for Facebook's Content Moderation Center in newspaper “Kathimerini”
Today, Giannis Papadopoulos in the Sunday’s “Kathimerini” newspaper analyzes the “sanctuary” of Facebook in Greece and the managers – censors of inappropriate content and its collaboration with Teleperformance Greece.
For the first time Facebook acknowledges in a public statement the cooperation with Teleperformance Greece and the content moderators’ status of employment in our country.
Mr Konstantinos Kakavoulis comments on behalf of Homo Digitalis the secrecy surrounding Facebook services in our country.
As he mentions, “One issue is how those who do this job here are selected, based on what level of knowledge. He is also concerned about the possibility of making the wrong decisions under pressure and the basis for training an artificial intelligence system that will do the job for Facebook in the upcoming years. “
You can read the whole article in Greek here.
Homo Digitalis participates in PERSONA Project
We are particularly delighted to announce, as on a basis of a proposal from the VUB University of Brussels and the d.pia.lab (Brussels Laboratory on Data Protection and Privacy Impact Assessments), that Homo Digitalis is now member of the Advisory Committee of PERSONA Project.
PERSONA Project is an innovative research project, with a duration period of 30 months, which is financially supported by the European Union in the context of Horizon 2020 programme.
PERSONA’s research team includes 11 operators, who represent 9 European States plus Israel. VUB University acts as the coordinator of the project.
The aim of PERSONA is to create a specific designed, unified method for impact assessment and to assess a range of technological tools used at the borders of states to identify people, considering ethical, legal and regulatory aspects, the right to privacy and data protection, the principle of non-discrimination and other social matters.
The Advisory Committee will monitor the project and ensure that it will be compliant with all the ethical, legal and social requirements.
Homo Digitalis’s Mr Konstantinos Kakavoulis will represent our organisation in the Committe.
Homo Digitalis on meeting regarding the implementation of the Directive on Intellectual Property
In June 7, 2019, the Directive (EU) 2019/790 of the European Parliament and of the Council of 17 April 2019 on copyright and related rights in the Digital Single Market and amending Directives 96/9/EC and 2001/29/EC was entered into force. As it has been repeatedly pointed out, the Directive contains multiple problematic aspects.
At this point, the EU member states –Greece among them- now have two years, i.e. until June 7, 2021, to implement this Directive into their own national legislation.
Civil society organisations around Europe, that operate within the digital rights sector, have gathered in Warsaw between the October 11 and 13, 2019 in order to find ways to strenghten the protection of freedom of speech and the dissemination of information.
The meeting was organized by Wikimedia, Communia and the Polish organisation Centrum Cyfrowe and 25 EU member states took part in it.
Sole representative of Greece was Homo Digitalis. Mr Konstantinos Kakavoulis visited Warsaw in order to attend the meeting on our behalf.
We wholeheartedly thank the organizers for this exquisite meeting.
Please stay tuned, and keep up to date with the latest news regarding the implementation of the Directive in our country.