Damages for Illegal Online Tracking (special track)

Cyberspace Conference Online Panel (Special Track)

Monday, 29 November 2021, 6pm to 8pm CET (Prague, Czechia)

Damages for Illegal Online Tracking

The exploitative practices around online tracking point to some alarming trends. If too much of our personal data ends up in the hands of companies, we risk the rise of plutocracy. If too much data ends up in the hands of governments, we risk the rise of authoritarianism. Either way, these practices directly threaten not only individual privacy but also the functioning of open, tolerant and liberal societies.

One way to prevent these risks is to give efficient legal remedies to those who are subjected to unlawful data collection. The good news is that collection and processing of personal data without the data subject’s consent is explicitly pronounced illegal in many countries around the world. It is problematic, however, that the relevant laws currently do not efficiently redress the harms caused by unlawful data collection. On the one hand, we know that data collection deprives the wronged person of his or her control over this data, but on the other hand, we do not know how to remedy such loss.

Take, for example, the EU General Data Protection Regulation (the GDPR). Art 82 of the GDPR gives the right to compensation to all individuals harmed as a result of GDPR violations. According to the GDPR, loss of control over personal data is a recognised category of harm, but no judgment has yet clarified what ‘loss of control over personal data’ exactly means and how such damage can and should be assessed in monetary terms. As a result, data collection harms remain largely unremedied and the rogue data collectors are bound to pay for their misconduct only when (if at all) they are fined by a public authority.

Indeed, questions of whether and when loss of control over personal data amounts to compensable damage and when an individual can bring an action for damages for illegal online tracking are now intensely debated (e.g., Lloyd v Google (UK, 2019), Brown & Ors v Google & Ors (US, 2020), Avis Autovermietung (EU, 2020), Österreichische Post (EU, 2021), VB v Natsionalna agentsia za prihodite (EU, 2021)). The assessment of damages in these cases could easily reach billions of euros (€) in compensation, which is significantly more than any GDPR fine issued so far.  It is thus not surprising that new lawsuits keep arising in this regard (e.g., TikTok or YouTube). It may even be expected that actions will be brought against public officials and states for illegal online surveillance (see, e.g., US v Moalin & Ors (US, 2020), Big Brother Watch & Ors v the United Kingdom (Europe, 2021)). These examples show a trend towards much wider recognition of harms caused by unlawful and exploitative data collection practices.

If properly developed, damages could offer a highly civilised, yet powerful defence against online intrusions of privacy. This is because damages awards would turn such intrusions into a costly and therefore unattractive business for the perpetrators. At the same time, a clear prospect of damages awards in these cases would encourage more citizens to defend their privacy against illegal data collection and this would be good for our personal and political freedoms generally.


This special panel, comprising experts from the EU, UK, and US, will discuss issues around illegal online tracking such as:

  • what constitutes reparable damage in these situations,
  • who is to be held liable for that damage,
  • how the damage is to be quantified and how damages are to be assessed,
  • what non-legal means of protection could prevent the damage,
  • what pragmatic or procedural obstacles make it impracticable for the injured party to bring a lawsuit.

Everyone with interest in the topic is welcome to attend.



Václav JANEČEK (chair)
Masaryk University and University of Oxford | Twitter | LinkedIn

University of Nottingham | Twitter

Drexel University and UC Berkeley | LinkedIn

Radboud University | Twitter | LinkedIn


Schedule (all times in CET, Prague, Czechia):

6.00pm to 6.15pm. Informal welcome chat. Online arrival.

6.15pm to 7.45pm. Panel discussion and open Q&A.

7.45pm to 8.00pm. Facilitated networking.


How to attend?

Link to the live session will be published here few days before the event.


Registered attendees will receive a direct link via email. Attendance at this special event is free of charge.

The session will be hosted on MS Teams (no installation required).