A couple of developments on data protection damages: one from the EU which indicates that the likely direction of travel for the block’s highest court is that there’s no entitlement to compensation under the GDPR without showing harm which is more than “mere upset”; and the other from the UK which assessed damages for a personal data breach with no privacy implications at £250. Continue reading