A Glance at Material and Non-Material Damage Claims in the EU and Egypt

by

 Yassin Abdalla Abdelkarim       &      Bence Kis Kelemen

CyJurII Founder and Director          CyJurII Theorist

on 28 September 2026

Introduction

In the past decade, the international community has started to pay closer attention to privacy rights and specifically the protection of personal data. Suffice it to mention the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, adopted in 1981 under the aegis of the Council of Europe, which entered into force in 1985. In 2018, an amendment treaty was also adopted to this convention, but this has not yet entered into force. Another critical instrument was the Charter of Fundamental Rights in the European Union, adopted in 2000, which, in its Article 8, has expressis verbis declared the protection of personal data as a fundamental right protected, in contrast with the European Convention on Human Rights, adopted in 1950, which only protected personal data through the right to private and family life as enshrined in Article 8 of the convention. This has been confirmed by the European Court of Human Rights in the Leander v. Sweden case in 1987.

When it comes to the legal order of the European Union, the Charter of Fundamental Rights, as primary law (Treaty on the European Union, Article 6(1)), is the cornerstone of the privacy protection system. Still, the European Union has adopted one of the most influential secondary legislations in the 21st century, the General Data Protection Regulation (GDPR) in 2016 (applicable since 2018). The GDPR gives clear principles for processing personal data, such as purpose limitation, and it also recognizes lawful legal bases for processing personal information, such as consent, legitimate interests, or the performance of a contract. In contrast to its predecessor, the Data Protection Directive, it is directly applicable in all Member States, with the same legal force as national acts or parliament or similar legislation; it does not require, nor allow for, a national transposition mechanism (as confirmed for regulations in, inter alia, C-34/73 Fratelli Variola S.p.A. v Amministrazione italiana delle Finanze).

The GDPR in Article 82 creates a right to claim compensation and a liability for processors and controllers for violations of the regulation. It is imperative to underline that this right is independent from any national legislation serving as a basis for compensation, for instance, in case of violation of personality rights. This has been confirmed, among others, by the Kúria (Supreme Court of Hungary - Pfv.IV.20.003/2024/13. para. [46]). The GDPR clearly states that anyone who has suffered damage resulting from the violation of the GDPR shall have the right to receive compensation from the controller or processor for the damage suffered. This applies to material and non-material damages equally (Article 82(1)). According to the GDPR, controllers will always be liable; in contrast, processors shall only be liable if they have not complied with obligations of the GDPR specifically directed to them or where they have acted outside or contrary to lawful instructions of the controller, with whom they are in a contractual relationship (Article 82(2)). Exemption from liability is possible, but only if the processor or the controller can show that they are not in any way responsible for the event giving rise to the damage (Article 82(3)). There are other identifiable rules in Article 82; they are not necessary to address in a short Insight.

Regarding Egypt's legal framework for privacy in cyberspace, it is primarily constituted by the Constitution of 2014, the Anti-Cybercrime Law (Law No. 175 of 2018), the Personal Data Protection Law (Law No. 151 of 2020), and the Telecommunications Regulation Law (Law No. 10 of 2003). Article 57 of the Constitution of 2014 provides that private life is inviolable and that correspondence, communications, telephone calls, and other forms of communication shall be confidential and may not be confiscated or monitored except by a judicial warrant. Article 54 guarantees personal liberty. The Personal Data Protection Law of 2020 represents a significant legislative development, establishing definitions, processing conditions, data subject rights, and a supervisory authority — the Personal Data Protection Centre — under the Ministry of Communications and Information Technology.

In practice, however, the Egyptian privacy framework operates in an environment significantly shaped by national security legislation. The Anti-Cybercrime Law grants broad powers to the National Telecommunications Regulatory Authority (NTRA) to order website blocking, and to prosecutors and courts to order the interception and monitoring of digital communications in the context of cybercrime investigations. The Emergency Law (Law No. 162 of 1958), which was in continuous force for much of the period between 1981 and 2021, historically provided a parallel legal basis for surveillance that effectively superseded constitutional guarantees. The interplay between the constitutional privacy norm, the PDPL's civil protections included in the Personal Data Protection Law, and the security apparatus's operational powers creates a multi-layered and sometimes contradictory normative environment. Furthermore, the Personal Data Protection Law presents in Chapter 14 a criminal / administrative liability for violating the data subject’s right to protection of personal data to enhance this protection. We would like to point out that Article 39 specifically mentions “the right of the aggrieved party to claim compensation”, which is not affected by the criminal / administrative provisions enshrined in Chapter 14 of the law. Furthermore, Article 49 of the law also provides for financial settlement, but interestingly not to the victims of the offence, but to the treasury of the state. In contrast, in practice, plaintiffs tend to utilize the basic rules of compensation for damages included in the Egyptian Civil Law No. 131/1948 along with the rules included in the Criminal Procedures Code on the accompanying civil law suit which permits victims of any criminal act to seek temporary compensation from the criminal circuit to relief the damages caused by the act. 

Sampling the case law of the Court of Justice of the European Union

In turn, we are going to sample through some of the–in our opinion–most iconic decisions of the Court of Justice of the European Union (CJEU) in cases where it needed to interpret Article 82 of the GDPR.

Let’s begin with C-340/21 VB v. Natsionalna agentsia za prihodite. This preliminary ruling procedure, has been initiated by the Supreme Administrative Court of Bulgaria in 2021. In a nutshell, according to the facts of the case, the Bulgarian National Revenue Agency, acting as a personal data controller, had been a victim of a cyber attack, in which millions of persons’ personal data had been published on the internet. Some of the affected individuals have launched legal claims for compensation against the Bulgarian authority, for alleged non-material damages suffered due to the fear that their personal data might be misused.

The CJEU has made several important clarifications as to the interpretation of the GDPR in this case. First, the CJEU has determined that an exemption from liability applies if the damage cannot be attributed to the controller. In the understanding of the CJEU, if cyber criminals, acting as third parties, gain access to personal information, said attribution will not take place. Meaning that the involvement of third-party hackers, for instance, would exempt the controllers from liability. However, in case the controller has breached its own data protection obligations, and that made the access by third parties possible, this exemption does not apply. At all times, the burden of proof is on the controller to show that its security measures were appropriate, and only in case there is no causal link between the breach of obligation from the controller and the damage suffered can the exemption be reapplied. It is imperative to underline that controllers should take care of the necessary information and data security obligations, and only in case their actions were not appropriate, and damage occurs as a consequence of such failure, does the liability burden the controller. This means that if there is a cyber attack, there is no automatic exemption from liability, nor is there an automatic determination of liability.

The CJEU also clarified in this case that there is no severity threshold when it comes to damages, and in the case of non-material damages, the fear that someone’s personal data might be misused by third parties, and the loss of control over said personal data, might be sufficient to find damages. Regarding this issue, it should also be noted that the fear in question might be substantiated, meaning baseless claims on fear, in our opinion, would not be sufficient to determine damages.

The second case I wish to address is C-590/22 AT and BT v PS GbR and Others. In this case, the Local Court of Wesel, Germany, has requested a preliminary ruling. This case is a classic case of misdirected mail. The applicants in this situation asked the main respondent, a tax consultancy firm, to draw up their tax return for 2019. The main respondent company has sent out the drafted documents to the wrong address, where the letter was opened by accident. Later, the letter was handed to other persons as well, and finally, the applicants were able to collect it. The applicants believed that they had suffered non-material damage as a result of this data protection incident.

In its judgment, the CJEU reinforced that the violation of the GDPR in and of itself is insufficient for claiming compensation. Damage needs to be proved by the claimant, but that damage does not need to reach a certain degree of seriousness. The CJEU also had to deal with the problem that, in this case, it could not be proven whether the disclosure of personal data to third parties actually occurred or not; the fear and its proven negative consequences can be enough for claiming compensation.

Sampling Egyptian case law

Egyptian courts have addressed digital privacy in several significant contexts. In the litigation arising from the NTRA's 2017 blocking of over 400 news and civil society websites, including Mada Masr and Al-Jazeera, Egyptian administrative courts issued inconsistent rulings, while some panels questioned the adequacy of procedural safeguards; no definitive judicial invalidation of the blockings was achieved, reflecting the broader deference of administrative courts to security determinations. The Supreme Constitutional Court has affirmed, in general terms, the constitutional right to privacy of correspondence (see, e.g., SCC Case No. 82 of Judicial Year 21), but has not squarely adjudicated the constitutionality of the Anti-Cybercrime Law's surveillance provisions.

The prosecution and conviction of several bloggers and social media users under the Anti-Cybercrime Law for content deemed to threaten national security, including the case of activist Alaa Abd El-Fattah, whose mobile phone was seized and analysed in proceedings before the Emergency State Security Court, has foregrounded the relationship between digital privacy, due process, and freedom of expression. Human Rights Watch and Amnesty International have documented systematic practices of coercive access to detainees' digital devices, raising grave concerns about the compatibility of Egyptian practice with the constitutional guarantee in Article 57.

Conclusions

The fundamental distinction between the two frameworks lies in the normative status and institutional operationalization of privacy rights. In the EU system, privacy and data protection are codified as judicially enforceable fundamental rights with direct horizontal and vertical effect, backed by a supranational court whose jurisdiction cannot be ousted by Member State legislation. This means that data subjects may use administrative bodies, civil and criminal litigation to enforce their fundamental rights. In Egypt, the constitutional text is relatively progressive on its face, but the absence of a fully independent constitutional review mechanism with robust enforcement powers, combined with the operational primacy of security legislation, means that the privacy right functions more as a programmatic declaration than an immediately enforceable individual guarantee. It is important to underline that there is no legal provision in the Egyptian data protection law equal or similar to Article 82 of the GDPR, but the general rules of compensation in the Civil Law and Criminal Procedures Code dominate the field. While the European Union’s legal regime, as well as individual Member State laws provides for an expressly regulated right to seek compensation, which is codified in a single body of law, in this case the GDPR, the Egyptian data protection law only mentions in passing the possibility of seeking compensation for the aggrieved party, but the regulatory logic is rather punitive, meaning that the law rather creates misdemeanours and fines attached to them, then to create a specific avenue for gaining financial compensation by data subjects. Case law follows this logic as well. In the EU, we have multiple available cases, where the Court of Justice of the European Union has dealt with financial compensation for violation of privacy rights. At the same time, in Egypt, this field is underdeveloped, and cases as shown above are restricted to general privacy related issues, but not financial compensation.

The bottom line here is that financial compensation for privacy violations is possible in the EU as well as in Egypt, but the Egyptian legal system and case law is still lagging behind in this specific field and depends mainly on the basic rules of compensation in the Egyptian Civil Law and Criminal Procedures Code.

Declaration on funding

The research was supported by Egyetemi Kutatói Ösztöndíj Program (Hungary).