💷 The cost of a GDPR breach


In today’s email:

  • Lorries are getting longer

  • Interest rates don’t want to stop rising

  • Qualify as a lawyer without any uni debt

  • Law firms asking their partners for money

  • Help the Netherlands by watching a livestream of fish

  • How much you can get if you’re a victim of a GDPR breach

If you take just one thing from this email…

GDPR is an EU regulation which applies to all 27 EU member countries. But there’s usually scope for national courts to interpret these themselves meaning that the rules can be applied differently in different countries. Wherever they’re applied more strictly is usually worse for companies as it becomes harder (read: more expensive) to comply.


I qualified as a lawyer having gone down the ‘traditional’ legal career path of graduating from university and - eventually - getting a training contract.

One big down side of this route is you’re often saddled with a lot of uni debt at the end. I’ve been working for 2.5 years and haven’t even made a dent in mine!

This means the ‘traditional’ route isn’t a viable option for everyone to take and, as a result, it contributes to the lack of diversity in the legal profession.

That's why I'm excited for today's sponsor, Gowling WLG.

They're offering a scheme that allows you to qualify as a lawyer without the need for a university degree and the accompanying financial burden (more on that below).

It's important to create alternative pathways into legal careers to ensure that the legal profession represents a wider range of perspectives and experiences.

P.S. If you’re from a law firm and are interested in reaching 6,700 aspiring lawyers to spread the word about any schemes you run, drop me an email!

- Idin


💷 The cost of a GDPR breach

What’s going on here?

The Court of Justice of the European Union (CJEU) - the European Union’s top court - has decided a case that has a big impact in the world of personal data and the right to compensation under Article 82 General Data Protection Regulation (GDPR) - which pretty much every company should care about.

What was the case about?

The case was about the Austrian postal company called Österreichische Post.

They’d collected information on people's political affiliations without telling them and used an algorithm to create profiles for targeted advertising during elections.

But one Austrian citizen who hadn't agreed to this data collection (let’s call him Bob) found out and made a complaint. He said that the political party which the algorithm had attributed to him was insulting and damaging to his reputation.

Bob claimed €1,000 in compensation for ‘nonmaterial damages’ (meaning damage which didn’t have a financial impact on him - in this case damage to his reputation), but the lower Austrian courts rejected his claim.

It went to the Austrian Supreme Court which then essentially asked the CJEU:

  1. whether any violation of GDPR (however small) should allow someone to claim compensation,

  2. whether you can only claim for serious breaches, and

  3. how courts should determine the amount of compensation for a GDPR claim like this.

Does any violation of GDPR (however small) allow someone to claim compensation?

The CJEU said no - not necessarily.

The GDPR requires three conditions to be met:

  1. an infringement,

  2. damage suffered, and

  3. a causal link between the two.

So an “infringement” alone isn’t enough to give someone a right to claim compensation (as you’ll also need the two other bits).

Can you only claim for serious breaches?

The CJEU said no - they wanted to keep the door open for people to bring claims for non-financial damage that weren’t serious (like the person in this case who only suffered damage to his reputation).

The Court thought allowing claims for non-serious breaches would give people the best quality of data protection.

How should compensation for GDPR breaches be calculated by courts?

The GDPR doesn't have any guidelines on how to assess damages, so national courts have been told to use their own rules to figure out how much compensation is payable for GDPR breaches.

As long as those rules follow EU law principles, they're good.

However, the CJEU made it clear that the purpose of Article 82 is to give data subjects full and effective compensation for the harm they've suffered.

Why should law firms care?

Law firms should care because this ruling will affect their clients who deal with their users’ personal data (which in 2023 is probably every single one of their clients).

It’s a bit unclear whether companies should be happy or sad as a result of this case.

In a way, it’s good for companies because the decision says that any breach of GDPR doesn’t automatically give someone the right to compensation.

BUT because the judgment also leaves the door open for people to claim for nonmaterial breaches (like damage to their reputation) there’s a chance that people can claim for things they previously couldn’t.

Nonetheless, it means companies need to really tighten up on how they’re dealing with data to make sure they’re compliant with GDPR - and commercial law firms can advise them in the following ways:

  • 🕵️ GDPR compliance assessments: Law firms can conduct comprehensive assessments of their client’s data processing activities

  • 📜 Draft GDPR-compliant policies and notices: Lawyers will assist in drafting clear privacy policies and data protection notices

  • 🤝 Contract review: Commercial lawyer can ensure contracts with third-party data processors are GDPR-compliant

  • 🚨 Data breach response planning: Data protection lawyers will develop and implement data breach response plans that comply with GDPR requirements

And if a dispute ever does arise against a company…

  • ⚖️ Legal representation: Litigators can provide legal representation and defence in regulatory investigations and litigation related to GDPR non-compliance.

So, did Bob get his €1,000 in the end?

It doesn’t look like he has yet but it’s now up to the Austrian court of appeal to interpret the judgment itself.

They’ll have to decide whether Bob gets his €1,000 or not.


Qualify as a solicitor completely debt free (in fact, you'll get paid) - that’s a Brum-believable offer

If you're looking to become a qualified lawyer, the Birmingham apprenticeship scheme from Gowling (a global law firm based in the UK and Canada) can get you there.

The scheme offers an alternative route to the traditional path to qualification (you know - uni, debt, SQE, more debt, training contract...). This way, you'll get paid while studying and doing real work for Gowling's clients.

You won't be a guinea pig - the firm's run this scheme since 2015. The first cohort is about to qualify with first-class honours degrees from the University of Law.

You'll also be with others who've gone through it before - successful applicants will join a community of 30 apprentices to support them through the scheme.

Who can apply?

You don’t need to have studied any particular subjects - just:

  • 🧠 a sharp mind,

  • 💪 a can-do attitude, and

  • 📚️ a willingness to learn.

Join Gowling’s team of over 1,400 legal professionals working globally and take your first steps towards becoming a qualified lawyer.

* This is sponsored content


It! was! great! to! meet! you! at! the! open! day!


  • 💸 Withers (a global law firm headquartered in London) has asked some of its partners to contribute up to £41,000 each to the firm. Supposedly it’s not because of the current economic situation - they made the decision two years ago as part of trying to give their partners more of a stake in the business (lucky them). Withers recently posted their financial results, showing that their profit fell slightly. Maybe they're trying to shore up their finances a bit by getting their partners to chip in.

  • 🚛 The UK government has given the green light to using longer lorries on the country's roads. They say it'll help businesses be more efficient and cut down on emissions as you can fit 15% more stuff in each lorry. The government reckons that using these longer lorries will result in about £1.4 billion of economic benefits. But not everyone is happy - some campaigners are worried that the larger tail swing could be dangerous for pedestrians and cyclists.

  • 📈 The Bank of England is expected to raise interest rates for the 12th consecutive time to try to control inflation, which currently stands above 10%. The Bank rate is predicted to go up from 4.25% to 4.5%, the highest level in 14 years. The decision would have an impact on borrowers and savers. Here’s our summary of the impact of interest rate changes.


  • 😃 Emoji: This AI emoji finder gives you the perfect emoji for anything you need (try it by typing in the name of your favourite book).

  • 🐠 Fishy: This is really cool - the Netherlands is livestreaming this canal and asking the internet to ring the doorbell when you see a large amount of fish so they can open up the dam to let the fish migrate.

  • 🌍️ News: If you’re after apolitical, jargon-free news from around the world, you’re in luck! Join 35,000+ readers who start their day with International Intrigue. 100% free.*

* This is an affiliate link. It's free to join for you and if you sign up through us, we will receive a small commission.


  • 👥 Community for aspiring lawyers: If you're struggling with motivation for law firm applications, check out FlowHuddle - a supportive online community, hosting remote co-working sessions, expert office hours and in-person meet-ups.

  • 📕Commercial awareness journal: Check out this journal that we've created alongside the team from The Lawyer Spot. It gives your a simple three-step structure to improve your commercial awareness in a high-quality physical notebook.

  • 📣 Advertise with us: If you're looking to reach an engaged audience of over 6,700 aspiring lawyers, drop us an email.

How did you find today's newsletter?

Login or Subscribe to participate in polls.