LEGAL PROTECTION OF THE RIGHT TO PERSONAL DATA AND LIABILITY FOR DAMAGES – BETWEEN THE NORMATIVE FRAMEWORK AND ACTUAL EFFECTIVENESS

Maida Bećirović-Alić; Tanja Varađanin

doi:10.5937/ptp2603109B

Authors

Maida Bećirović-Alić University of Novi Pazar, Department of Law, Novi Pazar, Serbia https://orcid.org/0000-0002-9738-6581
Tanja Varađanin University Business Academy in Novi Sad, Faculty of Law for Commerce and Judiciary in Novi Sad, Novi Sad, Serbia https://orcid.org/0000-0003-0070-3446

DOI:

https://doi.org/10.5937/ptp2603109B

Keywords:

protection of personal data, civil liability, compensation for damage, non-material damage, GDPR, effectiveness of legal protection

Abstract

The right to protection of personal data is one of the key modern human rights, the violation of which is becoming increasingly frequent amid intensive digitization and mass data processing. Although the normative framework, especially in the European legal space through the General Data Protection Regulation (GDPR, 2016), provides for the right to compensation for material and non-material damage due to the violation of this right, in practice, this raises the question of the real effectiveness of civil law protection for injured persons. The aim of this paper is to examine the scope and limitations of civil liability for the violation of the right to the protection of personal data, with special reference to the institution of compensation for non-material damages. The paper applies the normativelegal and comparative legal method, as well as an analysis of the relevant case law of the Court of Justice of the European Union, especially with regard to the interpretation of Article 82 of the GDPR (2016). Special attention is devoted to the consideration of the relationship between the violation of rights and the existence of legally relevant damage, as well as the problems of proving non-material damage in national legal systems. The research results indicate the existence of a normatively established, but in practice, often fragmented system of civil legal protection, in which uneven judicial practice and the absence of clear criteria for establishing the existence and amount of compensation for non-material damage reduce the real effectiveness of the right to compensation. In conclusion, the work points to the need for further harmonization of civil law institutes with the objectives of the right to protect personal data, in order to ensure complete and effective legal protection of injured subjects.

References

Van Alsenoy, B. (2016). Liability under EU data protection law: From Directive 95/46 to the General Data Protection Regulation. Journal of Intellectual Property, Information Technology and Electronic Commerce Law, 7(3), pp. 271–285

Andonović, S., & Prlja, D. (2020). Osnovi prava zaštite podataka o ličnosti [Basics of the right to protection of personal data]. Beograd: Institut za uporedno pravo

Citron, D. K., & Solove, D. J. (2018). Risk and anxiety: A theory of databreach harms. Texas Law Review, 96, pp. 737–786

Chatsuwan, C., Phromma,T., Surasvadi, N., & Thajchayapong, S. (2023). Personal data protection compliance assessment: A privacy policy scoring approach and empirical evidence from Thailand’s SMEs. Heliyon. 9 e20648, pp. 1–30, https://doi.org/10.1016/j.heliyon.2023.e20648

Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data [Konvencija o zaštiti lica u odnosu naautomatsku obradu ličnih podataka]. ETS No. 108, Council of Europe, Strasbourg, 28/01/1981.

Charter of Fundamental Rights of the European Union. (2012). Official Journal of the European Union, C 326

Convention for the Protection of Human Rights and Fundamental Freedoms [Evropska konvencija za zaštitu ljudskih prava i osnovnih sloboda]. ETS No. 5, Council of Europe, Rome, 4/11/1950.

Data Protection Directive [Direktiva o zaštiti podataka]. Directive 95/46/ EC of the European Parliament and of the Council of 24 October 1995. OJ L 281, 23/11/1995, pp. 31–50

Diligenski, A., Prlja, D., & Cerović, D. (2018). Pravo zaštite podataka GDPR [GDPR data protection right]. Beograd: Institut za uporedno pravo

General Data Protection Regulation (GDPR) [Opšta uredba o zaštiti podataka]. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. OJ L 119, 4/5/2016, pp. 1–88

Jašarević, S. (2018). Zaštita ličnih podataka zaposlenih u srpskom i evropskom pravu. [Protection of personal data of employees in the Serbian and European legislation]. Zbornik radova Pravnog fakulteta, Novi Sad, 43(2), pp. 293–310

Knetsch, J. (2022). The compensation of non-pecuniary loss in GDPR infringement cases. Journal of European Tort Law, 13(2), pp. 135–160

Krivokapić, D., Adamović, J., Tasić, D., Petrovski, A., Kalezić, P., & Krivokapić, Đ. (2019). Vodič kroz Zakon o zaštiti podataka o ličnosti i GDPR, tumačenje novog pravnog okvira [Guide to the Personal Data Protection Act and GDPR, interpretation of the new legal framework]. Beograd: Misija OEBS-a u Srbiji & SHARE Fondacija

Li, S. (2023). Compensation for non-material damage under Article 82 GDPR: A review of Case C-300/21. Maastricht Journal of European and Comparative Law, 30(3), pp. 335–345. DOI: 10.1177/1023263X231208835

Morić, Z., Dakic ,V., Djekic, D., & Regvart, D. (2024). Protection of Personal Data in the Context of E-Commerce. Journal of Cybersecurity and Privacy, 4(3), pp. 731–761. DOI: https://doi.org/10.3390/jcp4030034

Novović, M., & Bubalo, L. (2025). Toward a European tort law of data protection: The case law of the Court of Justice of the European Union and its impact on national tort laws. Pravni zapisi, 16(1), pp. 28–58. DOI: 10.5937/pravzap16–58123

Shavell, S. (1980). Strict liability versus negligence. Journal of Legal Studies, 9(1), pp. 1–25

Slijepčević, Lj. (2019). Privatnost i zaštita podataka o ličnosti kroz domaće i međunarodno pravo s osvrtom na korisnike Fejsbuka i interneta sa krivičnopravnog aspekta [Privacy and personal data protection in domestic and international law with reference to Facebook and Internet users from a criminal law perspective]. Novi Sad: Pravosudna akademija

Sekulić, M., & Grujić, G. (2020). Krivičnopravna zaštita ličnih podataka [Criminal law protection of personal data]. Glasnik Advokatske komore Vojvodine, 92(3), pp. 347‒362, DOI: 10.5937/gakv92-26404

Shi Yun (2022). Research on the Protection of Personal Data Rights - From the perspective of the application of privacy computing technology. BCP Social Sciences & Humanities, 18, pp. 470–481, DOI:10.54691/bcpssh.v18i.1148, pp. 470-481

Ustav Republike Srbije [Constitution of the Republic of Serbia]. Službeni glasnik RS, br. 98/06 i 115/21

Walree, T. F., & Wolters, P. T. J. (2020). The right to compensation of a competitor for a violation of the GDPR. International Data Privacy Law, 10(4), pp. 350–360

Zuković S., & Slijepčević, S. (2015). Roditeljska kontrola ponašanja dece na internetu i socijalnim mrežama [Parental control of children’s behavior on the Internet and social networks, in Teaching and Education]. Nastava i vaspitanje, 64(2), pp. 239–254

Zečević, L. M. (2025). Zaštita podataka o ličnosti u okvirima korporativnog upravljanja [Protection of personal data within the framework of corporate management]. Revija za evropsko pravo, 27(1), pp. 87–112

Zanfir-Fortune, G. (2020). Article 82 – Right to compensation and liability. In: Christopher, K., Hert, De P., & Papakonstantinou, V. (eds.), The EU General Data Protection Regulation (GDPR): A Commentary (pp. 1169–1185). Oxford: Oxford University Press

Zakon o obligacionim odnosima [Law of Obligations]. Službeni list SFRJ, br. 29/78, 39/85, 45/89 – odluka USJ i 57/89

Zakon o zaštiti podataka o ličnosti [Law on Personal Data Protection]. (2018). Službeni glasnik RS, br. 87/18