Municipality must pay compensation after a data breach

A data breach can result in not only a fine from the Dutch Data Protection Authority for an organization, but also compensation for the affected party. In the event of a privacy violation, a data subject can be compensated for non-material damage (such as anxiety and stress), even if there is no concrete financial damage. The amounts are often modest per person, but increase rapidly in the case of major breaches.

We previously wrote about the fines that the Dutch Data Protection Authority can impose and warned that victims can also claim compensation. That happened when the municipality of Oldambt was faced with a data breach.

What went wrong?

The municipality of Oldambt offered a plot of land for sale. An interested buyer, a hobby shooter who wanted to build a private shooting range there, applied for an environmental permit and was required to provide personal data. Municipalities typically use two versions of a document in this process: an internal version (including telephone number and BSN) and a public version without that sensitive data. Something went wrong: an employee accidentally published the internal version — including the BSN and telephone number — online.

The injured party is demanding compensation

The person involved learned of the leak from a journalist and was furious: anyone with malicious intentions could now see that he possessed weapons and where he could be found. As a result, he stated that he had to take security measures and no longer dared to work safely. He demanded over 15,000 euros in compensation. The municipality acknowledged the error, reported the data leak to the Dutch Data Protection Authority (AP), and removed the article, but rejected the high claim.

What did the judge rule?

The judge ruled that the municipality had violated the GDPR and was liable for damages. However, the municipality was not required to pay the claimed material damages (such as security costs): the data breach was quickly closed after the report, and the data subject had personally cooperated in publicity linking him to the location — those consequences were at his own expense. The District Court of Northern Netherlands (ECLI:NL:RBNNE:2021:106) did, however, award compensation of 500 euros for non-material damages, such as feelings of anxiety and stress; both parties bore their own legal costs.

Why this is important for your organization

Even though the municipality managed to avoid substantial compensation, it was indeed liable for damages. In the event of a data breach, therefore, there is the threat not only of a fine from the Dutch Data Protection Authority (AP), but also of compensation to the affected parties. While this may not be excessive per person, in the case of a leak involving the data of dozens or hundreds of people — and certainly if data is actually misused — the claims and associated legal costs mount up significantly.

Frequently Asked Questions

Can someone claim compensation after a data breach?

Yes. In the event of a privacy violation, a data subject can claim compensation, including for non-material damage such as anxiety or stress, separate from any potential fine imposed by the AP.

Do I always get reimbursed large amounts?

Not necessarily. Per person, the amounts are often modest, and material damage is only reimbursed if it is sufficiently established and attributable to the leak. With major leaks, however, it does add up.

What should I do in the event of a data breach?

Close the leak as quickly as possible, assess whether reporting to the AP (and potentially the parties involved) is mandatory, and document your actions. Acting quickly and carefully limits both fines and damage claims.

Avoid fines and damage claims

A data breach can affect any organization. The privacy experts at MKB Juristen help you get your privacy in order and respond effectively to a breach. View our expertise in privacy and data protection or schedule a free intake consultation .