Part 6 -168 and 169 Compensation

168 Compensation for contravention of the GDPR

  • This section has no associated Explanatory Notes

  • (1) In Article 82 of the GDPR (right to compensation for material or non-material damage), “non-material damage” includes distress.

  • (2) Subsection (3) applies where—

  • (a) in accordance with rules of court, proceedings under Article 82 of the GDPR are brought by a representative body on behalf of a person, and

  • (b) a court orders the payment of compensation.

  • (3)The court may make an order providing for the compensation to be paid on behalf of the person to—

  • (a) the representative body, or

  • (b) such other person as the court thinks fit.

 

  • 169 Compensation for contravention of other data protection legislation

  • This section has no associated Explanatory Notes

  • (1) A person who suffers damage by reason of a contravention of a requirement of the data protection legislation, other than the GDPR, is entitled to compensation for that damage from the controller or the processor, subject to subsections (2) and (3).

  • (2) Under subsection (1)—

  • (a) a controller involved in processing of personal data is liable for any damage caused by the processing, and

  • (b) a processor involved in processing of personal data is liable for damage caused by the processing only if the processor—

  • (i) has not complied with an obligation under the data protection legislation specifically directed at processors, or

  • (ii) has acted outside, or contrary to, the controller’s lawful instructions.

  • (3) A controller or processor is not liable as described in subsection (2) if the controller or processor proves that the controller or processor is not in any way responsible for the event giving rise to the damage.

  • (4) A joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities are determined in an arrangement under section 58 or 104 is only liable as described in subsection (2) if the controller is responsible for compliance with the provision of the data protection legislation that is contravened.

  • (5) In this section, “damage” includes financial loss and damage not involving financial loss, such as distress

Any person who has suffered material or non-material damage as a result of an infringement of the GDPR shall have the right to receive compensation from the controller or processor for the damage suffered.