Compensation awarded for data breach: Dutch Employee Insurance Agency must pay 500 euros to victim

The Dutch Employee Insurance Agency must pay compensation of 500 euros to a woman who says she has suffered damage due to a data breach. It is one of the few damages ever awarded for that fact.

The fine was imposed earlier this month imposed by the court in The Hague. This concerns an amount of 500 euros that is borne by the UWV, the Employee Insurance Agency, which is responsible for, among other things, paying benefits.

The fine revolves around a data breach in which a woman became a victim. In 2021, the UWV sent five letters intended for the woman to the wrong address. Misdirected letters are a common occurrence at the institute; In recent years, this turned out to be the most common data breach at the UWV. The UWV acknowledges that it sent the letters incorrectly and also reported this to the Dutch Data Protection Authority.

The woman claimed to have suffered damage as a result of the data breach and demanded compensation from the UWV. The institute then offered 250 euros in compensation. According to the woman, that was not nearly enough; she then demanded damages of 3,000 euros. When the UWV rejected this, the woman went to court because of the amount.

The woman stated that the 250 euros offered by the UWV ‘is disproportionate to the fears and depressions she has had to endure’. The letters contained, among other things, medical data, but also ‘procedural notes’. Because the woman did not receive these letters, she exceeded certain deadlines, which are not further specified in the judgment. These excesses caused the woman to have anxiety attacks. A psychologist for the woman confirmed that she ‘seems to suffer from cognitive overload when tension increases, with difficulty thinking and keeping an overview’.

The judge states in the judgment that it is clear that the woman indeed suffered non-material damage as a result of the incident. “The data breach has had a negative impact on her health and therefore on the recovery of her disability.” Therefore, compensation of 500 euros is ‘fair and appropriate’, the judge said.

The ruling is striking because it is one of the first times that compensation has been paid out as a result of a data breach. Under the GDPR, victims are not automatically entitled to this, but such compensation can be enforced through the courts. However, this requires that damage has actually been suffered. That is complicated to prove. It is becoming increasingly easier to claim such compensation through other rulings. Earlier this year, the European Court of Justice made an important ruling on this. The Court stated that no ‘threshold value’ is necessary for a claim for damages.

2023-10-13 12:11:41
#UWV #pay #euros #compensation #data #breach