Compensation for data breach

Compensation for data breach

A hacker stole personal data of (former) students of the University of Applied Sciences of Arnhem and Nijmegen (HAN). One of them held the institution liable. The court partly agrees with him.

Email addresses, social security numbers and notes on disabilities and political affiliations… it is some of the data of 530 thousand people that a hacker captured from the HAN. The institution refused to pay the hacker a ransom, after which the data were put online. On 1 September 2021, the HAN reported the leak.

One of the former students held HAN liable for the damage he suffered due to the hack. He demanded one thousand euros compensation. Having his medical data on the street eats away at him and makes him less likely to share data with social workers now. His trust has been damaged.

300 euros
The HAN did not respond to his claim. During the hearing, HAN did not want to elaborate specifically on how the former student’s personal data were secured. It only indicated the general measures taken to secure personal data.

The subdistrict court ruled Wednesday that the student should receive compensation of 300 euros. This is less than he demanded because the damage he suffered was within limits; the leak of his “general personal data” did not cause any damage as yet but the leak of his medical records did.

The leak exposed the medical records of 2,087 students with a functional impairment. If they also receive compensation, it will cost the college over EUR 600.000. (HOP, PvT)