Compensation claims under the GDPR unpicking the latest EU and English case law and looking ahead

Despite some arguments raised that this is an unfair discrepancy between competition and data protection law, the UK Government has not been persuaded to add any GDPR amendments to the UK Data Protection and Digital Information Bill No2 (currently at Committee stage in the House of Commons) on GDPR compensation and the UK regime looks set to stay the same for the foreseeable future.

Conclusion

Whilst a level of proportionality seems to be emerging in the regime for compensation claims under the GDPR, and there are now significant tests to be met to establish a claim, the prospect of parties trying to bring class actions for compensation in the EU remains real.  Businesses should continue to monitor the landscape and ensure their GDPR compliance programs mitigate the risks of such claims being brought, alongside the risk of other enforcement actions from data protection authorities.  GDPR fines and other enforcement actions remain a greater area of risk as there is a clearer and more established framework for their execution.