The CSDD cyber incident is no longer only about stolen data and IT security — it is becoming a test of financial liability. The Directorate has received around 1,400 incident-related submissions, including compensation claims.
A publicly reported claim seeks €10,000 on behalf of a person whose leaked data included their precise home address. However, this is an individual demand, not compensation awarded by a court or a standard applicable to every affected person. The 1,400 submissions also do not represent 1,400 approved compensation claims.
When does a right to compensation arise under the GDPR?
Article 82 of the General Data Protection Regulation provides a right to compensation for material or non-material damage. Three connected elements are required:
- an infringement of the GDPR;
- material or non-material damage actually suffered by the person;
- a causal link between the infringement and that damage.
The Court of Justice of the European Union has ruled that non-material damage does not have to reach a predetermined minimum level of seriousness. However, an infringement alone is not sufficient — the affected person must demonstrate its consequences. A genuine fear that personal data may be misused can also constitute non-material damage when it is substantiated and linked to the incident.
Will the State Data Inspectorate award compensation?
No. The State Data Inspectorate can determine whether a data protection infringement has occurred, but it does not set or pay compensation. According to LSM, high-priority investigations generally take between four and nine months in practice.
An affected person can first submit a claim to the organisation that processed the data. If no agreement is reached, the dispute may be taken to court, where every claim must be assessed individually.
Can the claims cost more than the cyberattack itself?
Yes, that risk exists. The total cost of a data breach is not limited to restoring IT systems. Financial exposure may include:
- technical investigation, system restoration and security improvements;
- legal, customer support and incident administration costs;
- possible regulatory decisions and penalties;
- settlements or court-awarded compensation;
- litigation expenses and reputational losses.
The €10,000 requested by one person cannot simply be multiplied by all 1,400 submissions. Nevertheless, even rejected claims require employee time, legal analysis, evidence and a formal response. In a large incident, claim administration and litigation may therefore become some of its most expensive consequences.
What should businesses learn from the CSDD case?
- Minimise retained data: information should not be stored for longer than necessary for its defined purpose.
- Preserve evidence of security controls: a company should be able to demonstrate how risks were assessed and controls were regularly tested.
- Include compensation claims in the incident plan: there should be a defined process for receiving, assessing and responding to submissions.
- Review cyber insurance: investigation costs, legal defence and data-subject claims should each be checked separately in the policy.
Frequently asked questions
Does a data breach automatically create a right to compensation?
No. An infringement, actual damage and a causal link between them must be demonstrated.
Can anxiety about the misuse of stolen data constitute damage?
Yes. Substantiated fear of possible misuse may be recognised as non-material damage.
Does the €10,000 claim determine the amount payable in other cases?
No. It is the amount requested by one person. The basis and value of every claim must be assessed individually.
For the fraud and misuse risks arising from the stolen data, see our earlier article: CSDD data breach and cyberattacks in Latvia.
Sources: LSM, Latvian State Data Inspectorate and the General Data Protection Regulation.
This article is for informational purposes and does not replace individual legal advice.
Comments
No comments yet. Yours could be the first!
Add a comment