The dissertation examines liability for damages and the right to compensation under the General Data Protection Regulation (GDPR) of the European Union. The first aim has been to clarify the legal meaning of the provisions on liability in the GDPR and to achieve a better understanding of the extent to which national tort law can be applied in this context. The dissertation also has a comparative aim, specifically to examine how the liability regime under the GDPR relates to the tort law traditions in the Member States, particularly Swedish law.

The dissertation thoroughly addresses the basis of liability and the interpretation of Article 82(2) and (3). It begins with an analysis of the concepts of controller, joint controller, and processor, as well as the scope of their responsibilities and the nature of their obligations. The dissertation then analyzes the case law from the Court that specifically concerns the basis of liability. It is concluded that the rule of reversed burden of proof for negligence in the GDPR is similar to those in some legal systems but differs somewhat from what usually applies in certain other legal systems.

Based on an analysis of the jurisprudence from the Court, it is concluded that the concept of damage in the GDPR is not particularly different from what generally applies in the Member States. However, the fact that even less serious non-material damages are compensated represents a difference from what applies in some Member States. Based on case law and an analysis of the protective purposes of data protection, the dissertation attempts to identify criteria for what constitutes compensable non-material damage within the meaning of the GDPR.

It is suggested that causation should be determined based on the criteria applied in the national tort law of the Member States, provided that the principles of equivalence and effectiveness are respected. From a comparative perspective, it is noted that the concept of factual causation is perceived similarly and should not lead to problematic differences between Member States, even though the requirement for causation is applied somewhat differently. How the burden of proof is distributed according to the GDPR is similar to what applies in some member states but differs from what is the case in other Member States. The dissertation also examines issues such as the scope of liability and to what extent national doctrines in this respect can be applied.

Since the GDPR lacks rules on how to assess the amount of compensation, national law should be applied in this regard. The case law of the Court and what the principles of equivalence and effectiveness require in this context are analyzed in the dissertation. It is noted that the case law of the Court leaves national courts a fairly wide margin of discretion to apply national law when determining the amount of compensation. The levels of award for non-material damage must be the same as for similar claims under national law. For the compensation to be full and effective, the levels must be differentiated for different types of cases, and the consequences suffered by the data subject in the individual case must be taken into account.