Denmark's Supreme Court Increases Data Breach Compensation to DKK 30,000
On Monday, the Supreme Court of Denmark ruled that Hillerød Municipality must pay DKK 30,000 to a woman whose personal data had been unlawfully disclosed. This decision marks a significant increase from the initial compensation of DKK 2,500 awarded by the High Court. Jan Trzaskowski, a professor of data protection law at Aalborg University, noted that this ruling will likely serve as a guideline for future GDPR cases, emphasizing the seriousness of such breaches.
The case involved a couple from Hillerød Municipality, where in 2019, the municipality mistakenly shared sensitive information with the man's ex-wife. This included details about the man's financial situation and the mental health condition of the woman he is currently married to, which the ex-wife later used in a legal matter against her former husband.
The Supreme Court's ruling on August 24 awarded the woman DKK 30,000 for the breach of GDPR, marking the first instance in Denmark where compensation was granted under Article 82 of the GDPR due to a data breach. While both the woman and her husband sought a total of DKK 55,000 in compensation, the court determined that only the woman was entitled to the increased amount, although it acknowledged that both parties' rights to privacy had been violated.
The Supreme Court also ruled that the man would not have to pay any legal costs, which he had been ordered to do following the Eastern High Court's decision. The court's findings reinforced the notion that breaches of this nature must be taken seriously, and Tyge Trier, the lawyer representing the couple, expressed satisfaction with the outcome, highlighting the importance of the ruling for both public and private sector organizations.
The Danish Data Protection Agency commented that this ruling will have implications for future cases regarding compensation for non-material damage under data protection laws, although compensation amounts will still depend on the specific circumstances of each case.
