Compensation

Case nos. BS-14485/2025-HJR, BS-14653/2025-HJR, BS-15152/2025-HJR and BS-16195/2025-HJR

Judgment delivered on 19 December 2025

A,
B,
C
and
D

vs.

Gladsaxe Municipality

Intervener for Gladsaxe Municipality: 
Local Government Denmark – KL

At the end of November 2018, the finance department of Gladsaxe Municipality carried out its halfyearly check of the calculations forming the basis of inter-municipal reimbursement. For the purposes of the check, a spreadsheet was prepared containing information on approx. 20,000 citizens. An employee saved the spreadsheet on a laptop that was later stolen from the city hall. The Municipality reported to the Danish Data Protection Agency that the theft constituted a personal data breach. The affected citizens, including A, B, C and D, were informed of the security breach.  

The issue to be considered by the Supreme Court was whether A, B, C and D were entitled to compensation under Article 82 of the General Data Protection Regulation (GDPR). The main question was whether they had proven that they had suffered damage covered by Article 82, and whether the damage was a result of the Municipality’s processing of their personal data in the spreadsheet or the security breach caused by the theft of the laptop. 

A, B, C and D explained that the Municipality’s processing of their personal data in the spreadsheet and the security breach had resulted in fear and other negative feelings. There was no information to suggest that the spreadsheet on the laptop stolen in 2018 had come to the knowledge of unauthorised third parties or that the information in the spreadsheet had been misused. 

The Supreme Court found that the fear and other negative feelings referred to by A, B, C and D could not be considered well-founded in view of the nature of the spreadsheet and the circumstances of the theft of the laptop. Apart from their own explanations, no evidence was produced to support that they had suffered damage as a result of the Municipality’s processing of their personal data in the spreadsheet or the security breach. 

Accordingly, the Supreme Court found that A, B, C and D had not proven that they had suffered damage covered by Article 82 of the GDPR as a result of the Municipality’s processing of their personal data in the spreadsheet or the security breach caused by the theft of the laptop.

The Supreme Court agreed that Gladsaxe Municipality should be acquitted of the compensation claims.

The High Court had reached the same conclusion.