Legal News

Clarity on processing sensitive data and right to compensation under EU GDPR (Krankenversicherung Nordrhein)

Published on: 13 February 2024

Table of contents

  • What are the practical implications of this case?
  • What was the background?
  • What did the court decide?
  • Case details

Article summary

EU Law analysis: In this judgment, the Court of Justice clarified the scope of processing sensitive data under Article 9(2)(h) of the EU GDPR. In particular that an employer could process an employee's health data in its capacity as a medical service provider of a health insurance fund. In addition, it was clarified that Article 9(3) cannot be interpreted in a way which prevents colleagues of the employee from accessing such data. In respect of compensation, the court concluded that damages under Article 82 of EU GDPR have a compensatory rather than a punitive function. The court also established a liability regime whereby the controller's fault is presumed unless the controller proves that the event which caused the damage is not attributable to him on the basis that this was supported by a contextual interpretation of the EU GDPR. Written by Gabbie Savage, solicitor at Fieldfisher LLP.

Popular documents