Risk and fundamental rights infringements as a form of ‘damage’ per Article 82 GDPR

There is a lot of uncertainty about the meaning of 'damage' in Article 82 of the General Data Protection Regulation (GDPR). It is challenging to define damage for GDPR infringements because of the nature of personal data and because of personality harms. The severity test commonly used to assess compensation for damage to personality rights is not suitable for GDPR infringements. This article proposes a solution by arguing and demonstrating the application of established fundamental rights norms and risk evaluation techniques to harms caused by GDPR infringements under Article 82 of the GDPR.