Wrongful Data Linking and the Right to Compensation under GDPR

Abstract

This legal case study examines the wrongful linking of personal data to a debt-collection case and the resulting questions of data accuracy, lawfulness, accountability and compensation under the General Data Protection Regulation (GDPR). It analyses the distinction between the underlying debt dispute and the independent legality of personal-data processing, with particular attention to Articles 5, 6, 24 and 82 GDPR. The study considers relevant case law of the Court of Justice of the European Union, including C-300/21 Österreichische Post, C-340/21 Natsionalna agentsia za prihodite and C-590/22 PS, and examines when loss of control over personal data, uncertainty concerning their use and justified fears of misuse may constitute non-material damage. The paper also discusses the 2026 CSDD data-security incident as part of the broader Latvian data-protection risk context, while expressly distinguishing that incident from the individual debt-collection case. It concludes with a structured assessment of a EUR 2,500 compensation claim and a practical evidence matrix for establishing infringement, damage and causation.