Hostname: page-component-76d6cb85b7-hqrjx Total loading time: 0 Render date: 2026-07-10T06:36:59.884Z Has data issue: false hasContentIssue false
  • English
  • Français

Regulation in the Making: The Governance Effects of Civil Liability in EU Digital Regulation

Published online by Cambridge University Press:  10 July 2026

Dominik Dworniczak Open the ORCID record for Dominik Dworniczak [Opens in a new window]
Dominik Dworniczak*
Affiliation:
Faculty of Law, Universität Zürich, Zürich, Switzerland Department of Private Law, Paris Lodron Universität Salzburg, Salzburg, Austria
*
Email: dominik.dworniczak@ius.uzh.ch
Rights & Permissions [Opens in a new window]

Abstract

This article argues that civil liability in EU digital regulation does more than enforce regulatory duties or compensate damage arising from regulatory breaches: it also produces governance effects by specifying regulatory duties and (re)allocating regulatory risks between market actors. Drawing on regulatory theory and examples from the case law of the Court of Justice and national courts in the fields of data protection, online platform regulation and competition law, the article demonstrates how these duty-specifying and risk-allocating effects emerge through the very structure of compensation claims: damage, unlawfulness and causation.

Keywords

civil liabilitydigital governanceEU digital regulationregulatory theory

Information

Type
Articles
Information
European Journal of Risk Regulation , First View , pp. 1 - 17
Creative Commons
Creative Common License - CCCreative Common License - BY
This is an Open Access article, distributed under the terms of the Creative Commons Attribution licence (https://creativecommons.org/licenses/by/4.0/), which permits unrestricted re-use, distribution and reproduction, provided the original article is properly cited.
Copyright
© The Author(s), 2026. Published by Cambridge University Press

I. Introduction

The nature and primary function of civil liability,Footnote 1 as well as its role as a private enforcement mechanism, have long been debated.Footnote 2 However, the emergence of EU digital regulation – amid the growing relevance of the digital sphere in contemporary societies – has reframed those debates. Recent scholarship has increasingly examined the compliance-policing effects of civil liability under these new regulatory regimes.Footnote 3 Far less attention has been paid to its further governance effects, namely to how the very structure of compensation claims contributes to the specification of regulatory duties and the allocation of regulatory risks.

This article argues that, in fundamental-rights-based regimes characterised by decentralised enforcement – such as EU digital regulationFootnote 4 – compensation claims do more than enforce regulatory duties. It is precisely through, rather than beyond, the conditions of civil liability, namely damage, unlawfulness and a causal link between them,Footnote 5 that such claims generate governance effects for the regulatory framework as a whole, extending beyond compliance-policing.Footnote 6 They do so by specifying the content of regulatory duties and by shaping the allocation of regulatory risks among market actors.Footnote 7 This does not, however, imply that civil liability is primarily a regulatory instrument,Footnote 8 nor that such governance effects are necessarily desirable. On the contrary, the structural role of compensation claims carries significant risks. This article therefore examines how the governance effects of civil liability arise within EU digital regulation and situates them within their broader regulatory context.

The article proceeds as follows: Section II reconstructs the shared premise underlying enforcement-based and compensation-centred accounts of civil liability. Section III moves beyond that premise by introducing the concept of “regulation in the making” and explaining why EU digital regulation provides a particularly salient example. Section IV demonstrates how compensation claims specify regulatory duties and allocate regulatory risks through the conditions of liability: damage, unlawfulness and a causal link between them. Section V addresses the pertinent risks associated with these governance effects. Section VI summarises the argument and reflects on the advantages of the “private law grammar” for analysing the governance effects of enforcement practice.

II. From enforcement and compensation to governance effects

The relationship between civil liability and regulation has long been examined, whether in Micklitz’s concept of regulatory private law,Footnote 9 Collins’s theory of contract as regulationFootnote 10 or Wagner’s emphasis on the behavioural effects of tort law on market actors.Footnote 11 More recent contributions focus specifically on the interaction between EU digital regulation and civil liability. This is particularly evident in data protection law, notably in the debate surrounding Article 82 of the General Data Protection Regulation (GDPR),Footnote 12 and, to a lesser extent, in online platform regulation, including discussions concerning actions for damages under Article 54 of the Digital Services Act (DSA).Footnote 13 Increasing attention has likewise been paid to civil liability in competition law, particularly since the right to compensation resulting from infringements of Articles 101–102 TFEU is now codified in Article 3(1) of the Damages Directive.Footnote 14 It is therefore unsurprising that the Digital Markets Act (DMA),Footnote 15 although it does not contain an explicit framework for private enforcement, despite proposals to that effect,Footnote 16 has been analysed from the perspective of compensatory claims as a mechanism of private enforcement.Footnote 17 This strand of scholarship – emphasising private enforcement through civil liability – will be referred to here as the enforcement-based account of civil liability.

The growing emphasis on the instrumental role of civil liability in relation to public law (and, by extension, regulatory regimes) remains controversial. It may be regarded as challenging the intrinsic orientation of private law. Attributing public functions to civil liability risks moving towards a statist conception of market ordering.Footnote 18 Similarly, theories that conceive civil liability primarily as a mechanism for shaping market behaviour have been criticised for obscuring what is frequently considered its central function: the compensation of damage, with other effects remaining secondary or merely auxiliary.Footnote 19 This perspective will be referred to here as the compensation-centred account of civil liability.

Nevertheless, both positions rest on a shared premise. The enforcement-based account conceives civil liability primarily as an ex post mechanism for policing compliance with predetermined regulatory duties. On this view, the relevant regulatory instrument defines the content of those duties and civil liability merely ensures their observance.Footnote 20 The compensation-centred account, by contrast, regards redress as civil liability’s primary aim. Even this approach, however, often presupposes that regulatory duties are predetermined, with the function of civil liability confined to compensating damage resulting from their breach.Footnote 21 Both accounts therefore assume that the content of regulatory duties is derivative of pre-existing rules: civil liability either enforces those duties or compensates for damage resulting from their infringement.Footnote 22

This shared premise is, however, open to reconsideration. There is no need to reject the compensatory function of civil liability, to endorse a purely enforcement-based account, or to claim that enforcement practice based on actions for damages replaces legislation or that regulation is inherently indeterminate. Rather, the argument is that regulatory instruments, particularly in fundamental-rights-based regimes characterised by decentralised enforcement, provide a framework within which the content of duties is progressively specified through enforcement practice (“regulation in the making”).Footnote 23

III. EU digital regulation and regulatory theory

1. Regulation by enforcement, responsive regulation and experimentalist governance

Unlike the enforcement-based and compensation-centred accounts analysed in the preceding section, regulatory theory proceeds from the premise that regulatory duties cannot be exhaustively predetermined at the moment of enactment. This premise has been most systematically developed in the literature on regulatory governance, notably in discussions of regulation by enforcement, responsive regulation and experimentalist governance.

Developed primarily in the US literature, the concept of “regulation by enforcement” explains how regulatory agencies rely on administrative adjudication, litigation in federal courts or informal settlement negotiations to engage in gap-filling and incremental rule articulation.Footnote 24 Through adjudication, agencies reduce regulatory errors, respond to unforeseen situations or emergencies and signal how regulatory standards will be applied in practice.Footnote 25 At the same time, regulation by enforcement has raised concerns regarding informational limits, case-specific policymaking and broader questions of fairness and legitimacy.Footnote 26

Responsive regulation, on the other hand, advances a broader model of governance centred on the conditions that trigger regulatory intervention and the forms that such intervention may take. Regulation is conceived as adaptive to industry structure, actor motivations and patterns of conduct. Regulatory authority is not confined to public actors; public policy may also be mediated through public interest groups, unregulated competitors, or even regulated firms themselves.Footnote 27 In such a model, private disputes cannot be understood as merely bilateral. They are often embedded in organisational structures and may carry implications that extend beyond the immediate parties, even where legal reasoning simplifies them into doctrinal categories for adjudicative purposes.Footnote 28

Experimentalist governance, developed in the context of EU law, adds a further dimension. It structures regulation around four core elements: the joint establishment of regulatory goals by Member States and EU institutions; the delegation of discretion to lower-level units to pursue those goals; regular reporting and monitoring of performance; and the periodic revision of goals, metrics and procedures in light of (enforcement) experience.Footnote 29 Courts in this framework may generate enforcement innovation, although they may also disrupt coordinated public enforcement where private litigation diverges from collective problem-solving strategies.Footnote 30 All this depends largely on the institutional capacity of civil courts to engage in problem-solving approaches rather than merely performing the traditional function of awarding compensation.Footnote 31

Despite their differences, all three approaches share a central premise: regulatory duties are further specified in enforcement practice. This presupposes a degree of regulatory indeterminacy: whether in the criticised enforcement discretion exercised by agencies through adjudication (regulation by enforcement); in adaptive responses to new market phenomena and in the recognition that private disputes carry systemic consequences, even where doctrinal reasoning reduces them to bilateral categories for adjudicative purposes (responsive regulation); or, in the context of compensation claims, in the discretion exercised by civil courts in pursuing regulatory goals, potentially generating enforcement innovation (experimentalist governance). “Regulation in the making” captures this shared commitment of regulatory theory: that is, the progressive specification of regulatory duties through enforcement practice.Footnote 32

2. EU digital regulation as regulation-in-the-making

EU digital regulation provides a particularly compelling example of regulation in the making for several reasons. First, recent regulatory instruments such as the GDPR, the DSA and the DMA introduce fully harmonised regulatory duties across the European Union.Footnote 33 At the same time, many of these duties are embedded in a fundamental-rights-based regulatory architecture.Footnote 34 The coexistence of fully harmonised duties and their grounding in fundamental rights invites their further specification, particularly through the Court of Justice.Footnote 35

Secondly, although EU digital regulation frequently takes the form of regulations rather than directives and is therefore directly applicable across the Member States,Footnote 36 enforcement remains, with exceptions such as the regime applicable to Very Large Online Platforms (VLOP) and Very Large Online Search Engines (VLOSE) under the DSA or gatekeepers under the DMA, embedded in national institutional contexts.Footnote 37 This means that, notwithstanding fully harmonised duties, national institutional particularities are likely to influence enforcement practice, if not render it path-dependent.

Thirdly, EU digital regulation has been adopted in the context of rapidly evolving technologies and business models: in other words, under conditions of law-fact uncertainty.Footnote 38 In such a setting, what regulation delivers on the ground will often depend on how duties are enforced under conditions different from those prevailing at enactment.Footnote 39

Finally, EU digital regulation operates within a politically sensitive environment shaped by global trade tensions, strategic economic policy and questions of technological sovereignty.Footnote 40 The direction and intensity of enforcement, in particular public enforcement, therefore depend not only on legislative design but also on institutional will and political prioritisation.

The combination of fully harmonised regulatory duties, a rights-based regulatory framework, decentralised enforcement architecture, law-fact uncertainty and a politically sensitive environment demonstrates why EU digital regulation provides a salient illustration of regulation in the making. In such a context, the effects of compensation claims pursued on the basis of these regulatory instruments cannot be reduced either to compliance-policing, as suggested by the enforcement-based account, or to the compensatory function emphasised by the compensation-centred account of civil liability. The shared premise underlying both accounts does not adequately capture the structural features of EU digital regulation, nor does it fully explain the role of civil liability therein. It is rather the concept of regulation in the making that provides the appropriate analytical background for understanding the further governance effects of civil liability. Effects which, as the following section demonstrates, extend beyond compliance-policing to the specification of regulatory duties and the allocation of regulatory risks.

IV. Reflexive interaction between compensation claims and regulatory duties

The governance effects of civil liability are intrinsically linked to the very structure of the compensatory claim. This section examines the three core elements of traditional civil liability doctrine: damage (and compensation), unlawfulness and causation. It analyses how each element operates within regulatory contexts, drawing on examples from data protection, online platform regulation and competition law. In doing so, it demonstrates how civil liability contributes to the progressive specification of regulatory duties in enforcement practice and, conversely, how those regulatory duties shape the internal structure of the liability conditions themselves.

1. Damage: normative construction of protected interests

a. Normative damage

Although national civil codes and EU regulatory instruments typically refrain from defining damage,Footnote 41 it may be understood, in general terms, as a negative modification of the injured party’s legally protected sphere.Footnote 42 Such a formulation implies that damage is not defined in the abstract, but in light of the concrete case and the protected interests at stake.Footnote 43

Where damage is defined by reference to the legally protected sphere, that sphere depends on what the applicable legal framework, including regulatory instruments, prescribes.Footnote 44 A regulatory duty may therefore provide the normative basis for recognising damage in a particular case.Footnote 45 Conversely, the ex post recognition of a negative modification of the injured party’s interests may shape the understanding of what counts as legally protected under the applicable regulatory regime. In this way, the recognition of damage may contribute to the further specification of the regulatory duty upon which that protected interest rests.Footnote 46

Under the GDPR, the evolving concept of damage becomes particularly visible in cases involving non-material damage arising from data protection infringements. Such damage has, so far, been further specified through concepts provided by the GDPR, such as identity theft,Footnote 47 reputational harm,Footnote 48 or fear of loss of control over personal data – even where the consequences are not fully ascertainable at the moment of the wrongful act. In particular, the fear of loss of control has been reconstructed as compensable damage in light of the regulatory objectives of the GDPRFootnote 49 and on the premise that, irrespective of its seriousness, each proven impairment must be compensated in accordance with those objectives.Footnote 50 A similar reliance on regulatory objectives is evident where the Court of Justice has made clear that distinctions between physical injury and non-material damage are incompatible with the objectives of the GDPR, which require that all damage be fully and effectively compensated.Footnote 51

A different configuration emerges in national case law under the DSA. The German Regional Court of Berlin (Landgericht Berlin) considered a case in which a non-governmental organisation sought access to information pursuant to Article 40(12) DSA from a platform designated as a VLOP.Footnote 52 The refusal of the VLOP to provide the requested access to information occurred shortly before federal and European Parliament elections. In order to establish jurisdiction under Article 7(2) of the Brussels Ia Regulation, the court relied on Article 54 DSA and recognised that the failure to provide regulatory access to information could constitute damage. Crucially, the absence of a prima facie quantifiable economic loss did not preclude recognition of damage suffered by the recipients of the service – in this case, a group of researchers.Footnote 53

The concept of damage under Article 82 GDPR, as well as under Article 54 DSA, demonstrates how regulatory duties of data controllers or processors, including compliance measures designed to prevent such non-material damage, and of VLOPs, such as the obligation to provide access to information, are further specified by reference to the concepts employed in the respective regulatory instruments. In determining what counts as damage, courts delineate the scope of the legally protected sphere. In this sense, the concept of damage under EU digital regulation may be described as “normative damage”:Footnote 54 it does not merely consist in a factual negative modification of an interest; rather, it is defined through the regulatory objectives that structure the protected interest.Footnote 55

The governance effects in the form of regulatory specification via the concept of damage depend on their transferability – for instance through repeated case law. This is particularly likely in the context of the case law of the Court of Justice, especially since damage under the GDPR has been recognised as an autonomous concept of EU law and reaffirmed in subsequent decisions.Footnote 56

Recent developments in national case law nevertheless point to a different approach. The case law of the German Federal Court of Justice (BGH), subsequently followed by lower courts, can be interpreted as an expansive reading of the Court’s case law on the autonomous concept of damage, adopted without seeking further guidance through a preliminary reference.Footnote 57 Whereas the Court of Justice requires proof of damage,Footnote 58 the BGH has considered a proven loss of control over personal data sufficient in itself to constitute damage, without requiring additional proof of non-material damage such as fear or distress.Footnote 59 The BGH’s approach both extends and follows the Court’s reasoning. It extends it insofar as the mere loss of control was not the direct subject of the cases decided by the Court of Justice. At the same time, the approach draws support from the Court’s obiter dicta.Footnote 60 Even where the Court’s case law is not straightforwardly transferable to national courts, as illustrated by the BGH judgment, the development reflects the normative character of damage under the GDPR: the loss of control over personal data is treated by national courts as damage in itself, even in the absence of any further identifiable “factual” or “natural” damage.Footnote 61

Whether similar developments will emerge under Article 54 DSA remains uncertain. The wording of the provision – which refers not only to Union law but also to national law and has been described in the literature as an “imperfect liability rule”Footnote 62 – may open the door to diverging interpretations. This possibility is reinforced by the manner in which the Regional Court of Berlin has interpreted the concept of compensation in its recent case law.

b. Compensating normative damage

The concept of normative damage is mirrored in the concept of compensation, particularly where compensation responds to damage that is normatively defined through the regulatory framework.Footnote 63 Whereas compensation-centred accounts of civil liability typically frame compensation in interpersonal terms, within regulatory contexts it cannot be reduced to a purely bilateral corrective mechanism.Footnote 64 From this perspective, compensation is not detached from the regulatory framework that defines the protected interest. Rather, it is shaped by the regulatory objectives underlying the duty whose breach gave rise to liability. Compensation therefore reflects not only the factual damage suffered but also the normative structure of the legally protected interest.

The reliance on the concept of normative damage to determine the appropriate form of compensation does not automatically transform compensation into a deterrence-based instrument in a strong incentive-oriented sense.Footnote 65 In the context of the GDPR, the Court of Justice has clearly emphasised that the calculation of compensation cannot be based on criteria applicable to administrative fines, since compensation remains, by definition, compensatory.Footnote 66 A similar exclusion of a punitive character can be observed in competition law in the context of the Damages Directive, which applies, inter alia, to infringements of Article 102 TFEU and may, as some commentators argue, also become relevant in the context of the DMA.Footnote 67 The Damages Directive expressly rejects overcompensation and punitive damages,Footnote 68 even where the Court of Justice’s case law has not entirely been uniform on this point.Footnote 69 The concept of compensation therefore remains grounded in corrective justice, albeit within a regulatory framework that informs what constitutes full and effective compensation.

The case law further illustrates what it means for compensation to be “full and effective.” The Court has clarified that the assessment of what constitutes full and effective compensation is largely left to national courts, subject to the principles of effectiveness and equivalence.Footnote 70 For example, in the context of data protection infringements, it has indicated that non-pecuniary remedies, such as an apology, may satisfy this requirement.Footnote 71 Similarly instructive is the reasoning of the Regional Court of Berlin, which, without explicitly grounding its analysis in the regulatory objectives of the DSA, stated that natural restitution (namely, the belated provision of access to information) may constitute full and effective compensation.Footnote 72

The form of compensation remains closely connected to the regulatory framework within which the damage is defined. In this respect, case law may generate a distinct governance effect relating to what counts as “full and effective” compensation. Whereas the concept of damage contributes to specifying the content of regulatory duties, the concept of compensation – in particular with regard to its effectiveness – affects the allocation of regulatory risks through the form and extent of redress. It makes a difference whether apologies or belated provision of information suffice as full and effective compensation, or whether a pecuniary award – and, if so, in what amount – is required.

2. Unlawfulness as specification of regulatory duties

The specification of regulatory duties takes place in particular through the determination of unlawfulness.Footnote 73 In regulatory contexts, it is typically established through non-compliance with a prescribed regulatory duty. The assessment of unlawfulness therefore requires the reconstruction of that duty to articulate the applicable standard of conduct. In doing so, adjudication simultaneously clarifies the corresponding right of the injured party that the duty is designed to protect.Footnote 74

In certain legal systems the requirement of fault or negligence constitutes an additional and independent condition of liability, whereas under EU law fault is structurally integrated into the concept of unlawfulness.Footnote 75 In this respect, the Court of Justice has clarified that civil liability under the GDPR is formally fault-based, yet is accompanied by a reversal of the burden of proof: the data controller or processor must demonstrate that it is not in any way responsible for the event giving rise to the damage.Footnote 76 Although this does not amount to strict liability in a formal sense,Footnote 77 the broad formulation (“not in any way responsible”) means that, once a regulatory duty has been breached, unlawfulness will typically be established unless the defendant successfully proves that it bears no responsibility for the infringement at all.Footnote 78

The type of liability under a regulatory regime may itself result in distinct governance effects. By shifting the burden of proof,Footnote 79 the defendant is given the opportunity to demonstrate compliance, and this may shape how courts further specify regulatory duties. The choice between fault-based and strict liability reallocates risk, in particular where the defendant is afforded the opportunity to demonstrate that it is not in any way responsible for the infringement, whereas under strict liability the defendant’s standard of conduct is not decisive.

The determination of unlawfulness provides further specification of regulatory duties. Under data protection law, in assessing whether a data controller acted lawfully, the Court of Justice has meticulously examined whether appropriate technical and organisational measures were implemented in the processing of personal data.Footnote 80 The Court has also clarified the obligations of persons acting under the authority of the controller. Such persons may process personal data only on instructions from the controller, unless required to do so by Union or Member State law. The Court has emphasised that failure on the part of a person acting under the authority of the controller does not automatically exempt the controller from liability.Footnote 81 Likewise, in situations involving cybercriminal conduct or external attacks, the question arises under which conditions such events interrupt responsibility or fall within the controller’s sphere of risk. The assessment cannot rely solely on the views of supervisory authorities but requires judicial determination of compliance with the regulatory framework.Footnote 82 More recently, the Court has further specified the right of access under Article 15 GDPR in the context of a preliminary reference addressing damage arising from an infringement of that right.Footnote 83 National case law likewise reveals instances in which regulatory duties have been further specified, particularly with regard to the requirements of data protection by design and by default, often with explicit reference to the regulatory objectives underlying those duties.Footnote 84

Under the DSA, in proceedings before the Regional Court in Berlin, the court determined what a VLOP was required to provide under Article 40(12) DSA, namely access to information for a group of researchers.Footnote 85 This required clarification of the content and scope of the platform’s regulatory obligations. Notably, the court also assessed the claimant’s conduct in facilitating compliance. The determination of unlawfulness thus depended on reconstructing a standard of regulatory behaviour applicable to both parties. The case therefore illustrates that the specification of regulatory duties may involve relational standards of cooperation, rather than being confined to unilateral obligations of the defendant.Footnote 86

Such developments – namely, the further specification of the required standard of conduct in order to establish unlawfulness – are not unique to EU digital regulation. Comparable dynamics have long been observable in product liability. National courts have interpreted the legislative framework in order to define the threshold of defectiveness and the corresponding standard of safety expected from producers, in some instances articulating a more demanding standard of care than that explicitly prescribed by product safety legislation.Footnote 87 For example, the Austrian Supreme Court developed a judicial threshold of product safety that was not expressly specified in the statutory framework. This is particularly evident in the doctrine of post-market monitoring duties (Produktbeobachtungspflicht),Footnote 88 which entails an obligation to monitor products after they have been placed on the market and, where risks become identifiable, to provide appropriate warnings.Footnote 89 Similarly, regulatory authorisation (e.g., pharmaceutical approval of a medicinal product) does not automatically preclude liability where the accompanying instructions for use prove inadequate.Footnote 90

A broader question therefore arises: do courts merely apply the regulatory instrument as enacted, or do they articulate a standard of care specific to the assessment of civil liability? Put differently, may conduct that is formally permissible under public regulation nevertheless give rise to a right to damages? One possible view is that private law develops standards of conduct that are distinct from and may in practice exceed those provided in public regulation.Footnote 91 Another, more systemic, view is that private law adjudication further specifies the regulatory duties themselves. Although it is true that the determination of unlawfulness is principally grounded in the regulatory framework,Footnote 92 judicial determinations of unlawfulness (particularly where they extend beyond the literal wording of the regulatory provision) may further specify the regulatory duty and thereby influence the regulatory regime as a whole. On this account, civil adjudication does not create a parallel standard, but specifies the content of the regulatory duty itself, and thereby produces the corresponding governance effects beyond compliance-policing.

3. Causation as attribution of regulatory risk

Causation constitutes the third structural element of civil liability. Whereas damage and unlawfulness concern the scope and content of the regulatory duty, causation determines to whom and under what conditions responsibility for regulatory breaches is attributed.Footnote 93

Under data protection law, and in line with the general principles of liability under EU law,Footnote 94 it is firmly established that a causal link must be demonstrated between the damage and the infringement. However, to date, the Court of Justice has not comprehensively developed a doctrine of causation.Footnote 95 The GDPR nevertheless provides for a specific rule of attribution in multi-actor settings, namely the joint liability of controllers and processors (Article 82(4) GDPR). This reflects a legislative choice to facilitate attribution in complex data-processing structures to shift compliance burdens towards those actors better positioned to manage data risks. However, it does not eliminate the need to establish causation in the first place.Footnote 96 Rather, once the conditions of liability are met, it simplifies the claimant’s position by allowing recovery from any responsible actor.Footnote 97 Under the DSA, Article 54 likewise contains no specific rules on causation and, unlike the GDPR, does not regulate joint liability among providers of intermediary services. Responsibility for attribution therefore falls primarily within national law.Footnote 98

The analysis of causation becomes considerably more complex in the context of the DMA and competition law. Although the Damages Directive does not, in principle, apply to the DMA,Footnote 99 the latter appears to follow a competition law logic.Footnote 100 For this reason, it is justified to consider competition law as a reference point. In competition law, the Court of Justice established in Manfredi the requirement of a causal link between the infringement and the damage. At the same time, it left the detailed regulation of causation largely to national law, subject to the principles of effectiveness and equivalence.Footnote 101 With the introduction of the Damages Directive, adopted in response to the limited practical effectiveness of compensation claims in competition law, no comprehensive doctrine of causation was introduced.Footnote 102 However, the Directive contains several structural mechanisms designed to facilitate proof.Footnote 103 These include the right to disclosure of relevant evidence from defendants or third parties, as well as access to evidence contained in the files of competition authorities. Moreover, the Directive introduces a rebuttable presumption that cartel infringements cause harm.Footnote 104 Recent case law on the Damages Directive has, however, further clarified the distinction between evidentiary facilitation and the substantive requirement of proving a causal link. In particular, it has emphasised the plausibility threshold required for the disclosure of evidence, sharply distinguishing it from the requirement of establishing causation.Footnote 105

More generally, causation is not merely a technical requirement linking unlawful conduct and damage. Considered in isolation, it may not specify regulatory duties in the same direct manner as damage or unlawfulness. Nevertheless, whether in the context of controllers and processors, online platforms or gatekeepers, the requirement of causation determines to which regulated entities an infringement will be attributed and who will ultimately bear the consequences of regulatory breaches.

Causation produces governance effects by distributing regulatory risks among market actors. This allocation of risk constitutes the central governance effect of causation. In the absence of specific EU rules in this respect, and subject to the principles of effectiveness and equivalence, these effects are most likely to manifest themselves at the national level – unless and until the Court of Justice engages more directly with questions of causation.

V. The pertinent risks

The preceding analysis has not sought to displace the compensatory function of civil liability or to advocate civil liability as a standalone regulatory instrument. Nor does it deny that civil liability may, in certain contexts, contribute to the enforcement of predetermined regulatory duties. The argument advanced here is structural: it concerns how private law operates within regulatory frameworks and how civil liability participates in shaping rights-based regulatory regimes. Recognising these governance effects, however, requires equal attention to the structural risks of compensation claims.

To begin with, civil adjudication proceeds through case-based reasoning. Courts decide concrete disputes between specific parties, and the specification of regulatory duties emerges incrementally. In legal systems lacking a strong doctrine of precedent, such developments may remain granular and episodic. Interpretative advances may vary across jurisdictions and over time, raising concerns about fragmentation and the absence of coordinated specification of regulatory duties. Governance effects may therefore remain uneven rather than systematic.Footnote 106

Civil proceedings also operate under informational constraints, not only due to increasing technological complexity and the resulting law-fact uncertainty,Footnote 107 but also because courts depend on party presentation and lack the investigative powers typically available to regulatory authorities. Even where disclosure mechanisms exist, as under the Damages Directive, they remain embedded in adversarial procedure: it is for the parties to request, present and substantiate evidence, and the burden of proving damage and causation does not shift to the court. In complex digital markets characterised by significant informational asymmetries, the specification of regulatory duties through private litigation may therefore occur without access to the broader technical and market-wide knowledge available to public enforcers.Footnote 108

A further concern relates to institutional allocation of authority and democratic legitimacy. The articulation of regulatory duties is conventionally understood as the task of the legislator or, where delegated, of regulatory authorities. When civil courts interpret and specify regulatory standards in private disputes, they inevitably participate in shaping their normative content. Although such interpretative activity is intrinsic to adjudication, the governance effects of private litigation may raise questions about the appropriate balance between legislative design and judicial specification of regulatory duties.Footnote 109

Finally, the shape of governance effects depends on who brings damages claims and under what conditions. The justice system is not equally accessible to all affected actors. Litigation costs, informational asymmetries and structural power imbalances may limit the capacity of individuals to pursue claims against major market participants, particularly VLOPs under the DSA and gatekeepers under the DMA. At the same time, well-resourced actors may strategically employ private litigation to advance particular interpretations of regulatory duties.Footnote 110 Enforcement may therefore become selective and asymmetrical, generating compliance pressures that are not necessarily aligned with broader regulatory coordination, as the Google Fonts case illustrates.Footnote 111 Collective redress mechanisms may mitigate some of these concerns, yet their effectiveness remains uncertain, particularly as they are often limited under EU law to consumer claims and not specifically designed to enforce compensation claims.Footnote 112

The risks analysed above do not negate the governance effects of civil liability identified in the preceding sections. Rather, they show that these effects are contingent upon a range of institutional and structural conditions. The paper has thus far advanced only a limited claim: that the governance effects of compensation claims should be considered by legislators and regulatory authorities – particularly when assessing the systemic consequences of policy choices, including impact assessments, the articulation of regulatory objectives and the design of enforcement architecture.

VI. Conclusions

Civil liability in the context of regulatory regimes cannot be reduced to either extreme – neither a pure enforcement mechanism nor a purely interpersonal corrective device. Governance effects beyond compliance-policing emerge from the reflexive interaction between the very structure of compensation claims and the regulatory framework.

The analysis demonstrates that each of the conditions of civil liability carries distinct governance effects. The concept of damage cannot be reduced to a negative modification of a predetermined legally protected interest. Instead, by recognising specific interests as legally protected in light of regulatory objectives, it provides the normative basis for specifying the content of regulatory duties. The concept of compensation, albeit intrinsically linked to that of damage, yields a distinct governance effect. Beyond the mere remedying of individual harm, the manner in which its “full and effective” character is defined affects the allocation of regulatory risk through both the form and the extent of redress. The specification of regulatory duties manifests itself, above all, in the determination of unlawfulness. Unlawfulness requires a reconstruction of the applicable duty to define the relevant standard of conduct, simultaneously clarifying the corresponding rights of the injured party. Finally, the condition of causation goes beyond the mere technical requirement of linking unlawful conduct to damage. Although it may not specify regulatory duties as directly as damage or unlawfulness, it determines which regulated entities must ultimately bear the consequences of regulatory breaches. Consequently, causation influences the allocation of regulatory risk.

The grammar of private law brings more to the regulatory landscape than is often acknowledged.Footnote 113 Concepts such as regulation by enforcement and responsive regulation resonate with the structural features of private law adjudication, which inherently involves contextual specification and principled balancing. Even experimentalist approaches, which emphasise the periodic revision of goals, metrics and procedures in light of enforcement experience, are not conceptually incompatible with private law’s capacity to refine standards through case-based development.

This is particularly significant in the context of EU digital regulation, for the reasons analysed above. The issue is not only enforcement or compensation for regulatory breaches, but also the formation of compliance standards. Recognising the governance effects of civil liability does not transform it into public regulation, nor does it dissolve into pure instrumentalism. Rather, pursuing compensation claims allows for mediation between the abstraction of regulatory instruments, the bird’s-eye perspective of public enforcement authorities and attention to the individual litigant. In doing so, civil liability contributes to the ongoing (re)construction of regulatory regimes in digital markets: regulation in the making.

Acknowledgments

The author would like to thank the participants of the ETL Lecture Series at the Institute for European Tort Law (Vienna, Austria) for their comments and the engaging discussion following the presentation of an earlier version of this article on 27 February 2026. The author is also grateful to Prof. Bernhard Koch (University of Innsbruck) for his helpful feedback on an earlier version of this article, offered during the author’s research stay at the Institute of Civil Law, University of Innsbruck, undertaken as part of a re:constitution Fellowship in March 2026.

Competing interests

The author has no conflicts of interest to declare.

References

1 For three general accounts of civil liability: instrumentalist approaches, accounts grounded in moral duty (corrective justice), and accounts based on the recognition of wrongs (civil recourse theory), see SA Smith, “Recognizing Wrongs by John CP Goldberg and Benjamin C Zipursky” (2021) 71(3) University of Toronto Law Journal 415, 423. For details on the deterrent function of civil liability as a form of instrumentalism within the law-and-economics tradition, see J Arlen, “Economics of Tort Law” in F Parisi (ed), The Oxford Handbook of Law and Economics, vol 2 (Oxford, Oxford University Press 2017) pp 86–87. For a brief summary of the discussion in the German-speaking literature, see LD Loacker, “Abschied vom Ausgleich? Ein Kontrapunkt” (2021) (2) HAVE 170.

2 For a summary of the common law debate, with particular emphasis on the advantages of private enforcement through compensation claims, see JM Glover, “The Structural Role of Private Enforcement Mechanisms in Public Law” (2012) 53 William and Mary Law Review 1137, 1177–8. For an overview of the classic arguments, see MA Cohen and PH Rubin, “Private Enforcement of Public Policy” (1985) 3 Yale Journal on Regulation 167. In European tort law scholarship, the focus on behavioural effects (Verhaltenssteuerung) of tort law is particularly associated with G Wagner, “Prävention und Verhaltenssteuerung durch Privatrecht – Anmaßung oder legitime Aufgabe?” (2006) 206 AcP 352.

3 E.g., see T Bauermeister and S Schwamberger, Private Enforcement im Digitalen Binnenmarkt (Tübingen, Mohr Siebeck 2025); JI Ruiz Peris and C Estevan de Quesada (eds), Compensation of Damages in Digital Markets (Barcelona, Editorial Atelier 2025).

4 A Bradford, Digital Empires: The Global Battle to Regulate Technology (Oxford, Oxford University Press 2023) pp 119–34.

5 This structure is reflected in the Court’s GDPR case law, where damage, an infringement and a causal link between them constitute the conditions for compensation (Case C-300/21, Österreichische Post, EU:C:2023:370, para. 32; Case C-655/23, Quirin Privatbank, EU:C:2025:655, para. 56). A similar structure is emphasised in EU competition law (Case C-286/24, Meliá Hotels International, EU:C:2026:49, para. 58). This does not exclude additional conditions of civil liability under national law such as fault, as is the case, for example, under Austrian law (see H Koziol, Haftpflichtrecht (4th edn, Vienna, Jan Sramek Verlag 2020) A Rz 21-34).

6 The effects of tort law on the broader regulatory framework have also been discussed in this journal, see DA Kysar, “The Public Life of Private Law: Tort Law as a Risk Regulation Mechanism” (2018) 9 European Journal of Risk Regulation 48. For the distributional and instrumental effects of tort law, even where such effects are not necessarily its primary function, see P Cane, “Tort Law as Regulation” (2002) 31 Common Law World Review 305, 329–30.

7 These governance effects operate both at the level of conduct rules under the applicable regulatory framework and at that of protected interests, from which duties of care may emerge even where they are not expressly articulated in that framework. This distinction can, for example, be found in Art. 2:101(1)(b)-(c) PEL Liab Dam (see C von Bar (ed), Principles of European Law: Non-Contractual Liability Arising out of Damage Caused to Another (PEL Liab Dam) (Munich, Sellier. European Law Publishers 2009) p 303). For the purposes of this article, the focus is on the former, rather than on duties of care derived from general liability clauses.

8 Even if one were to argue that, under EU law, tort law often serves broader regulatory and enforcement purposes, rather than primarily the compensatory one, see M Wissink, “Overview” in H Koziol and R Schulze (eds), The Tort Law of the EC (Vienna, Springer 2008) pp 345–6.

9 Notably, see HW Micklitz, “The Visible Hand of European Regulatory Private Law: The Transformation of European Private Law from Autonomy to Functionalism in Competition and Regulation” (2009) 28 Yearbook of European Law 3. For remedies in regulatory private law as a form of “managing enforcement,” see HW Micklitz, “The Transformation of Enforcement in European Private Law: Preliminary Considerations” (2015) 23 European Review of Private Law 491, 502.

10 E.g. see H Collins, Regulating Contracts (Oxford, Oxford University Press 2002).

11 Wagner (n 2). For the most recent account of the preventive function of civil liability, further expanding on Wagner’s account and illustrating it with examples from data protection law, see F Berner, “Prävention durch zivilrechtliche Haftung – eine Reevaluation” (2025) 225 AcP 1053.

12 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) [2016] OJ L 119/1. For private enforcement under the GDPR, e.g. see W Wurmnest and M Gömann, “Comparing Private Enforcement of EU Competition and Data Protection Law” (2022) 13 Journal of European Tort Law 154; V Janeček and CT Santos, “The Autonomous Concept of “Damage” According to the GDPR and Its Unfortunate Implications: Österreichische Post” (2024) 61 Common Market Law Review 531.

13 Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services and amending Directive 2000/31/EC (Digital Services Act) [2022] OJ L 277/1. Art. 54 has been mostly discussed in doctrinal commentaries, e.g. see R Müller-Terpitz, “Artikel 54 Entschädigung” in R Müller-Terpitz and M Köhler (eds), Digital Services Act: DSA. Gesetz über digitale Dienste (Munich, CH Beck 2024); F Wilman, SL Kaléda and PJ Loewenthal, The EU Digital Services Act. A Commentary (Oxford, Oxford University Press 2024) pp 370–1; B Raue, “Article 54. Compensation” in F Hofmann and B Raue (eds), Digital Services Act. Article-by-Article Commentary (Munich, Oxford, Baden-Baden, Beck/Hart/Nomos 2025).

14 Directive 2014/104/EU on certain rules governing actions for damages under national law for infringements of the competition law provisions of the Member States and of the European Union [2014] OJ L 349. As codification of Art. 101–2 TFEU, see Case C-253/23, ASG, ECLI:EU:C:2025:40, para. 64.

15 Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector (Digital Markets Act) [2022] OJ L 265/1.

16 E.g. see R Podszun, “Private Enforcement and Gatekeeper Regulation: Strengthening the Rights of Private Parties in the Digital Markets Act” (2022) 13 Journal of European Competition Law & Practice 254, 263–6. For details on how private enforcement against digital gatekeepers operates under German antitrust law, see JU Franck, “Damages Actions against Digital Gatekeepers for Breaches of EU Antitrust Law and the DMA: A German Perspective” in R Peris and de Quesada (n 3) pp 109–12.

17 In EU competition law, the Court of Justice has explicitly recognised that actions for damages contribute to the effective enforcement of competition rules and to the attainment of the objectives of EU competition policy, see Joined Cases C-295/04 to C-298/04, Manfredi, EU:C:2006:461, para. 91; Case C-453/99, Courage v Crehan, EU:C:2001:465, para. 27. The Court has emphasised the deterrent and behavioural effects of such actions, discouraging anticompetitive conduct, see Case C-21/24 Nissan Iberia EU:C:2025:659, para. 53. More generally, the right to seek compensation forms part of the system ensuring the effective enforcement of EU competition law, see Case C-557/12 Kone EU:C:2014:1317, para. 63. At the same time, actions for damages are frequently characterised primarily as a form of private enforcement, see Case C-605/21 Heureka Group EU:C:2024:324, para. 61; Case C-57/21 RegioJet, EU:C:2023:6, para. 52.

18 A Beever, Freedom under the Private Law (Cheltenham, Edward Elgar 2023) pp 283–8.

19 E.g. see H Koziol, “Punitive Damages: Admission into the Seventh Legal Heaven or Eternal Damnation? Comparative Report and Conclusions” in H Koziol and V Wilcox (eds), Punitive Damages: Common Law and Civil Law Perspectives (Vienna, Springer 2009) pp 289–292. From a comparative perspective, see H Koziol, Grundfragen des Schadenersatzrechts aus rechtsvergleichender Sicht (Vienna, Jan Sramek Verlag 2014) pp 819–820.

20 For an example of such an approach to liability under EU digital law and beyond, see L Hornkohl, “Schadensersatzansprüche wegen Verstößen gegen Verhaltensnormen des digitalen Binnenmarktrechts” (2024) 28 EuZW 941, 943 (rechtsdurchsetzende Ausrichtung) and 949 (rechtsdurchsetzende Wirkung).

21 Rather, tort law may itself be influenced by regulatory law, while compensation remains based on the infringement of the regulatory instrument, see M Lukas, “The Function of Regulatory Law in the Context of Tort Law – Conclusions” in C Kissling, WH van Boom and M Lukas (eds), Tort and Regulatory Law (Vienna, Springer 2008) p 463.

22 With exceptions, e.g., see Kysar (n 6).

23 This has been present in continental legal theory already for some time, e.g. see J Esser, Vorverständnis und Methodenwahl in der Rechtsfindung: Rationalitätsgarantien der richterlichen Entscheidungspraxis (Kronberg/Ts, Scriptor Verlag 1972) pp 65–8, emphasising that the standards guiding judicial decision-making are not merely predetermined but are partly reconstructed in the process of application of law. The present argument nevertheless suggests that digital regulation introduces additional dynamics, see Section III, 2., below.

24 C Brummer, Y Yadav and D Zaring, “Regulation by Enforcement” (2022) 96 Southern California Law Review 1297, 1303.

25 Ibid. 1318–21, 1331.

26 Ibid. 1331–6.

27 I Ayres and J Braithwaite, Responsive Regulation: Transcending the Deregulation Debate (Oxford, Oxford University Press 1992) p 4; J Braithwaite, Restorative Justice and Responsive Regulation (Oxford, Oxford University Press 2002) p 29. This perspective is particularly relevant given that tort law, as Cane observes, is concerned not only with the position of the injured party but also with the conduct of the wrongdoer, which aligns with the logic of responsive regulation, see Cane (n 6) 330.

28 Braithwaite (n 27) 243–4. For a similar account (“public life of civil adjudication”), see MA Loth, “The Civil Court as Risk Regulator: The Issue of its Legitimacy” (2018) 9 European Journal of Risk Regulation 66, 74–5.

29 CF Sabel and J Zeitlin, “Learning from Difference: The New Architecture of Experimentalist Governance in the EU’ in CF Sabel and J Zeitlin (eds), Experimentalist Governance in the European Union: Towards a New Architecture (Oxford, Oxford University Press 2010) p 3.

30 Y Svetiev, Experimentalist Competition Law and the Regulation of Markets (Oxford, Hart 2020) pp 147–8.

31 Ibid., 158.

32 Similarly in the general doctrine of tort law, though this view has been criticised by Cane, see Cane (n 6) 313 (courts as standard setters).

33 Although there is an exception under Art. 6 DMA, where the Commission may further specify the regulatory duties of the designated gatekeepers. For further details, see P Larouche and A de Streel, “The European Digital Markets Act: A Revolution Grounded on Traditions” (2021) 12 Journal of European Competition Law & Practice 542, 556 (described as a semi-dynamic approach).

34 See Bradford (n 4). More generally, see C Cauffman and C Goanta, “A New Order: The Digital Services Act and Consumer Protection” (2021) 12 European Journal of Risk Regulation 758, 759 and M Husovec, Principles of the Digital Services Act (Oxford, Oxford University Press 2024) p 9.

35 Husovec, for example, suggests that the Court of Justice will likely further interpret this provision in light of the principle of effectiveness, see Husovec (n 34) 428ff.

36 Regulations, in contrast to directives, do not necessarily require cooperation between EU and national levels. For details on the view that directives necessarily contain some cooperative elements, see M Klamert, “What We Talk About When We Talk About Harmonisation” (2015) 17 Cambridge Yearbook of European Legal Studies 360, 364–5, 371.

37 For the regulatory regime for the VLOPs, see Section 5 DSA. For details on the role of national Digital Services Coordinators under the DSA, see Husovec (n 34) 420–8. Under the DMA, the situation is somewhat more complex. Although gatekeepers are supervised by the Commission, national competition authorities may initiate investigations under national competition law. This may lead to certain inconsistencies in enforcement. For further details, see G Monti, “Procedures and Institutions in the DMA” (Centre on Regulation in Europe 2022) Issue Paper, 12, 25–6.

38 AI Muchmore, “Uncertainty, Complexity, and Regulatory Design” (2016) 53 Houston Law Review 1321, 1347–51.

39 More generally on regulatory design under conditions of uncertainty, see Charles F Sabel, GB Herrigel and PH Kristensen, “Regulation under Uncertainty: The Coevolution of Industry and Regulation” (2018) 12 Regulation & Governance 371.

40 For examples, see Bradford (n 4) 234–70. This has also been reflected in debates concerning the scope of regulatory duties in the recent proposal for a Digital Omnibus Regulation. Although this proposal concerns the simplification of the digital legislative framework (European Commission, Proposal for a Digital Omnibus Regulation, COM(2025) 837 final, 1–3), it does not specifically address private enforcement.

41 W Wurmnest, Grundzüge eines europäischen Haftungsrechts: eine rechtsvergleichende Untersuchung des Gemeinschaftsrechts (Tübingen, Mohr Siebeck 2003) p 224. With the notable exception of Austria, see § 1293 ABGB. For the definition of “legally relevant” damage in the DCFR, VI-2:101(1)(a)-(c). By contrast, the concept of damage is not defined under the GDPR, as emphasised by the Court of Justice in Österreichische Post (n 5) para. 45.

42 Not only immediate loss but also the loss of possible profits may be compensated, as emphasised by the Court of Justice in Manfredi (n 17) para. 95. See also Case C-312/21, Tráficos Manuel Ferrer, ECLI:EU:C:2023:99, para. 34. Similarly, see Wurmnest (n 41) 272-273.

43 U Magnus, “Comparative Report on the Law of Damages” in U Magnus (ed), Unification of Tort Law: Damages (Alphen aan den Rijn, Kluwer Law International 2001) pp 190–191. On the types of damage, see Ibid., 191–4.

44 For this idea, see in particular Lukas (n 21) 463, arguing that the regulator can determine which types of damage should be compensable.

45 This is clear from the third sentence of Recital 146 GDPR, which expressly calls for an interpretation of the concept of damage, within the meaning of the Regulation, that “fully reflects the objectives of this Regulation” (Österreichische Post (n 5) para. 47). This also implies that the regulatory duty does not necessarily provide a normative basis for compensating damages arising under national law, see Case C-590/22, PS (Incorrect Address), ECLI:EU:C:2024:536, para. 48.

46 For an example where tort law brings about an ex post specification of the duty of care, albeit without a focus on the specification of regulatory duties, see Wagner (n 2) 437.

47 Joined Cases C-182/22 and C-189/22, Scalable Capital, ECLI:EU:C:2024:531, paras. 52–7.

48 Quirin Privatbank (n 5), para. 64.

49 Case C-340/21, Natsionalna agentsia za prihodite, ECLI:EU:C:2023:986, paras. 81–5 (recognising fear as a form of non-material damage). Similarly, see Case C-456/22 Gemeinde Ummendorf, ECLI:EU:C:2023:988, para. 22. This does not mean, however, that damage need not be proven, see Case C-200/23, Agentsia po vpisvaniyata, ECLI:EU:C:2024:827, para. 156 (concerning the temporary loss of control over personal data following publication in a commercial register).

50 Österreichische Post (n 5) paras. 49, 51.

51 Scalable Capital (n 47), para. 39.

52 LG Berlin II, 41 O 140/25. For a similar judgment that has not yet been published, see Democracy Reporting International, “Berlin Court Rules X Must Release Data to DRI for Research on Hungarian Elections” (17 February 2026) <https://democracy-reporting.org/en/office/EU/news/berlin-court-rules-social-media-platform-x-must-release-data-to-dri-for-research-on-hungarian-elections> (last accessed 8 June 2026).

53 For further discussion of this case, see D Holznagel, “Berlin Court Rules on Art 40(12) DSA – With Broader Lessons for Private Enforcement of the DSA” (CR-online.de Blog, 12 February 2025) <https://www.cr-online.de/blog/2025/02/12/berlin-court-rules-on-art-4012-dsa-with-broader-lessons-for-private-enforcement-of-the-dsa/> (last accessed 8 June 2026). A similar decision has very recently been reached in another case, although not based on the DSA but on national law transposing the E-Commerce Directive. In that case, the Austrian Supreme Court (OGH) addressed the concept of damage in relation to the right to information (Auskunftsrecht) under §13(3) E-Commerce-Gesetz (ECG) to establish jurisdiction under Art. 7(2) Brussels Ia Regulation. In this context, damage was similarly derived from the statutory right to information rather than as “natural” damage (see OGH, 18 December 2025, 6 Ob 186/25h).

54 On this point, see also Janeček and Santos (n 12) 542. For further details on the concept of normative damage in German doctrine, see von Bar (n 7) 317–18. For an example of normative damage based on the infringement of personality rights, see N Jansen, “Konturen eines europäischen Schadensrechts” (2005) 60 JuristenZeitung 160, 170. In a similar vein, rights in tort law may be analysed as the “correlatives of a duty,” even when Jansen emphasises that rights in tort law and unjustified enrichment cannot simply be reduced to such correlatives, see N Jansen, “The Idea of Legal Responsibility” (2014) 34 Oxford Journal of Legal Studies 221, 241–2. Whereas the doctrine of normative damage remains largely controversial, it may nevertheless be recognised where, inter alia, the statute specifically identifies the addressee of the correlated duty or the wrongdoer, see D Medicus, “Normativer Schaden” (1979) 4 Juristische Schulung 233, 239.

55 The concept of damage under Art. 82 GDPR has essentially been interpreted in light of the regulatory objectives of the Regulation, see Österreichische Post (n 5) para. 48.

56 Österreichische Post (n 5) para. 44; Quirin Privatbank (n 5) para. 55.

57 BGH, judgment of 18 November 2024, VI ZR 10/24 (Facebook Scraping-Fall); subsequently cited, inter alia, by OLG Schleswig, 5 U 59/23 (5 April 2025) and OLG Sachsen-Anhalt, 9 U 88/23 (26 June 2025); further confirmed by BGH, VI ZR 396/24 (11 November 2025).

58 Case C-687/21, MediaMarktSaturn, ECLI:EU:C:2024:72, paras. 62–9; PS (Incorrect Address) (n 45) para. 35. EU law has long recognised that compensation presupposes actual damage rather than merely potential damage (sicherer Schaden), see Wurmnest (n 41) 319.

59 BGH, VI ZR 10/24, Rz 31. Where loss of control cannot itself be demonstrated, further proof of non-material damage may be required (Rz 32).

60 Natsionalna agentsia za prihodite (n 49) para. 82; Agentsia po vpisvaniyata (n 49) para. 145.

61 This reasoning is closely linked to national doctrinal traditions on the concept of normative damage, in particular in German doctrine, see fn 54, above, and may also be related to the concept of damage per se in English common law, see von Bar (n 7) 322.

62 Raue (n 13) 949 Rz 1, 950 Rz 6.

63 It may therefore be argued that, where the concept of compensation “for the damage suffered” under EU law operates as an autonomous concept (Agentsia po vpisvaniyata (n 49) para. 139), the determination of “full and effective compensation” remains governed by national law.

64 As argued by John Braithwaite in his account of responsive regulation, see Section III.1, above.

65 The Court has repeatedly emphasised that compensation under EU law is complementary to other forms of enforcement and does not pursue a punitive function, although it may have a deterrent effect, see Case C-667/21, Krankenversicherung Nordrhein, ECLI:EU:C:2023:1022, para. 85. This approach has also been reflected in national case law, see BGH, VI ZR 10/24, Rz 25, 96-97.

66 Case C-741/21, juris GmbH, ECLI:EU:C:2024:288, paras. 55–64 (data protection law).

67 J Kindl, “Prospects for Concurrent Private Enforcement of the DMA and Article 102 TFEU” (2024) 12 Journal of Antitrust Enforcement 241, 244–5.

68 Recital 13 Damages Directive. The compensation must be full and effective, but should not jeopardise the effective application of Art. 101 and 102 TFEU, which often involves complex factual and economic analysis (in the context of tort law’s punitive function), see ASG (n 14) para. 74.

69 The Court has further acknowledged that damages actions may generate deterrent effects comparable to financial penalties, see Tráficos Manuel Ferrer (n 42) para. 42; Case C-163/21, PACCAR and Others, ECLI:EU:C:2022:863, para. 56.

70 Österreichische Post (n 5) paras. 54–9; Manfredi (n 17) paras. 92 and 98; Krankenversicherung Nordrhein (n 65) para. 83; Scalable Capital (n 47) para. 33.

71 Case C-507/23, Patērētāju tiesību aizsardzības centrs, ECLI:EU:C:2024:854, para. 37.

72 Whether such an approach effectively advances the regulatory objectives remains a separate question, for two reasons. First, the access to information was granted only after the election, and it therefore remains unclear how such belated access could meaningfully compensate the claimant. Second, one might envisage alternative forms of compensation, such as notional licence fees corresponding to the value of comparable data sets. The Court has recognised that such forms of compensation may be compatible with Union law, a position that had already been suggested in the literature (e.g., see Wurmnest (n 41) 241). It nevertheless remains questionable whether such compensation would satisfy the requirement of full and effective compensation.

73 Unlawfulness remains conceptually distinct from the damage itself, as confirmed in Österreichische Post (n 5) para. 42; juris GmbH (n 66) para. 46. This is not altered by evidentiary presumptions such as Art. 17(2) Damages Directive, which, at the end, do not eliminate the conceptual distinction between the damage and the infringement.

74 In tort law more generally, liability for the breach of a statutory rule often serves to clarify the corresponding right or legally protected interest of the injured party which the rule is designed to protect, see C van Dam, European Tort Law (2nd edn, Oxford, Oxford University Press 2013) pp 293–6. Violations of statutory duties may lead to forms of strict or quasi-strict liability, although in some legal systems this effect is mediated through mechanisms such as a reversal of the burden of proof with regard to negligence, see Ibid., 295–6.

75 Wurmnest (n 41) 343–5.

76 Krankenversicherung Nordrhein (n 65), paras. 93–104.

77 This form of liability may nevertheless still be characterised as fault-based, since it ultimately relies on a standard of conduct, see P Cane, “Responsibility and Fault: A Relational and Functional Approach to Responsibility” in P Cane and J Gardner (eds), Relating to Responsibility: Essays for Tony Honoré on His Eightieth Birthday (Oxford, Hart 2001) p 102.

78 Krankenversicherung Nordrhein (n 65) para. 103; Case C-687/21 MediaMarktSaturn (n 58) para. 52. In Agentsia po vpisvaniyata (n 49) paras. 161–4, the Court emphasised that liability cannot arise where the event giving rise to the damage is not attributable to the defendant. This has likewise been reflected in national case law, see BGH, VI ZR 10/24, Rz 21.

79 Natsionalna agentsia za prihodite (n 49) para. 69.

80 Ibid., paras. 71 and 74 in connection with paras. 22–47. See also MediaMarktSaturn (n 58) paras. 42–5.

81 juris GmbH (n 66) paras. 47–54.

82 Agentsia po vpisvaniyata (n 49) paras. 165, 168–76.

83 Case C-526/24, Brillen Rottler, EU:C:2026:216, paras. 46–55 (the damage arising from the infringement of the right to access) and paras. 21–45 (the right to access).

84 BGH, VI ZR 10/24, Rz 87–91.

85 In another cited case, the Austrian Supreme Court addressed the concept of damage in relation to the right to information (Auskunftsrecht) under the E-Commerce-Gesetz, see fn 53, above.

86 LG Berlin II, 41 O 140/25. This is particularly significant in light of Art. 54 DSA, which refers not only to Union law but also to applicable national law. One might therefore argue that civil liability under this provision could, similarly to the GDPR, take the form of fault-based liability, depending on the structure of the relevant national doctrine. However, unlike under the case law concerning the GDPR, the provision contains no indication of a reversed burden of proof.

87 For a discussion of the relationship between product regulation and product liability, see Willem H. van Boom, “On the Intersection between Tort Law and Regulatory Law – A Comparative Analysis” in van Boom, Lukas and Kissling (n 21) 423–4, 436–9.

88 OGH 6 Ob 215/11b, 13 September 2012.

89 OGH 5 Ob 127/23x, 21 August 2023.

90 OGH 4 Ob 19/24h, 22 October 2024, in particular Rz 51.

91 In his analysis of unlawfulness under § 823(1) BGB, Jansen emphasises the role of statutory provisions that establish specific duties, see N Jansen, “Das Problem der Rechtswidrigkeit bei § 823 Abs. 1 BGB” (2002) 202 AcP 517, 538–539. His account distinguishes between lawfulness derived from statutory norms and the determination of unlawfulness under tort law.

92 Lukas (n 21) 463.

93 Liability arises only where responsibility for breaching the regulatory duty is attributable to the defendant; conversely, where the defendant is not in any way responsible for the event giving rise to the damage, liability does not arise, see Natsionalna agentsia za prihodite (n 49) para. 70. “Attributable” refers to the defendant having played a role in the causal history of the injury, see Jane Stapelton, “Unpacking Causation” in Cane and Gardner (n 77) 183–5. This has been illustrated in recent case law concerning the conduct of the data subject. The Court has clarified that the causal link may be broken where the data subject’s conduct constitutes the determining cause of the damage. Such conduct may include a decision taken by the affected person, provided it was not obligatory (Brillen Rottler (n 83) para. 65).

94 Wurmnest (n 41) 159–88; Wurmnest and Gömann (n 12) 174–5.

95 C Lombardi, Causation in Competition Law Damages Actions (Cambridge, Cambridge University Press 2019) p 51.

96 The causal link between the damage and the infringement needs to be nevertheless provided, e.g., see MediaMarktSaturn (n 58), para. 61. Confirmed very recently in Brillen Rottler (n 83) para. 66.

97 The existence of joint liability does not dispense with the requirement of establishing a causal link; it operates only at the level of allocation once liability has been established, particularly in situations of defendant indeterminacy (Lombardi (n 94) 192). However, in mass tort contexts where causation remains uncertain, the relationship between potential wrongdoers may become decisive for whether the victim is compensated at all (B Koch, “Multiple Tortfeasors in Mass Tort Cases” in WH van Boom and G Wagner (eds), Mass Torts in Europe: Cases and Reflections (Berlin, de Gruyter 2014) pp 188–9).

98 As Wurmnest and Gömann observe in the context of data protection law, see Wurmnest and Gömann (n 12) 175.

99 For instance, the burden of proof may constitute a significant obstacle for claimants. Although the Damages Directive alleviates this burden through various evidentiary mechanisms and presumptions, these rules do not apply to actions based on the DMA, nor does the DMA contain comparable provisions. As a result, much of the relevant information remains in the hands of gatekeepers and the claimants must still establish the conduct, the damage and the causal link between them, see AC Witt, “The Digital Markets Act – Regulating the Wild West?” (2023) 60 Common Market Law Review 625, 658.

100 The DMA is often described as occupying an ambivalent position within EU competition law. It is characterised as part of the broader competition law framework, yet designed primarily to ensure speed and procedural efficiency, without allowing gatekeepers to justify prima facie abusive conduct, see F Bostoen, “Understanding the Digital Markets Act” (2023) 68 The Antitrust Bulletin 263, 265. P Larouche and A de Streel describe the DMA as a “lost child” of competition law (Larouche and de Streel (n 33) 545).

101 Manfredi (n 17) para. 64, ASG (n 14) para. 62.

102 For details on causation in competition law damages actions, see Lombardi (n 95) 191–7, in particular 192. See also K Havu, “Causation and Damage: What the Directive Does Not Solve and Remarks on Relevant EU Law” in M Strand, V Bastidas Venegas and MC Iacovides (eds), EU Competition Litigation: Transposition and First Experiences of the Damages Directive (Oxford, Hart 2019) pp 191–2.

103 Meliá Hotels International (n 5) para. 42; PACCAR and Others (n 69) para. 59 (“the infringer knows what he has done”).

104 Under Art. 17(2) Damages Directive. See also Tráficos Manuel Ferrer (n 42) para. 44.

105 Meliá Hotels International (n 5) paras. 77–83. The Court also recognised the concept of plausibility as an autonomous concept of EU law, see para. 75 of the same judgment.

106 As underlined, for example, by K Pistor and C Xu, “Incomplete Law” (2003) 35 NYU Journal of International Law and Politics 931, 1012. See also S Burbank, S Farhang and H Kritzer, “Private Enforcement” (2013) 17 Lewis & Clark Law Rev. 637, 667–9.

107 Muchmore (n 38).

108 Brummer, Yadav and Zaring (n 24) 1331–4. For a similar argument, see Franck (n 16) 112.

109 For a summary of the literature on this argument, see Burbank, Farhang and Kritzer (n 106) 670–1. For the view that introducing a private right to compensation may enhance the overall legitimacy of the regulatory framework under the DSA, see Husovec (n 34) 473. For the argument that private enforcement may increase democratic participation, see LP Norris, “The Promise and Perils of Private Enforcement” (2022) 108 Virginia Law Review 1483, 1509–16.

110 Ibid., 1530–34.

111 For further details, see J Merane and A Stremitzer, Automated Private Enforcement: Evidence from the Google Fonts Case (Center for Law & Economics Working Paper Series 4/2025) available at <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5202414> (last accessed 8 June 2026).

112 Art. 1–2 of the Directive (EU) 2020/1828 on representative actions for the protection of the collective interests of consumers stipulate that the Directive establishes rules ensuring a representative action mechanism for the protection of consumers’ collective interests and that such actions may be brought against traders for infringements of the Union law provisions listed in Annex I which harm, or may harm, those interests. Even where national law provides for certain forms of opt-out class actions, it remains uncertain whether such mechanisms would prove effective in practice for damages claims arising, for example, under the DMA. For an illustration from German law, see Franck (n 16) 113.

113 For the “grammar of private law,” see OO Cherednychenko, “Rediscovering the Public/Private Divide in EU Private Law” (2020) 26 European Law Journal 27, 31–32, emphasising its ex post functioning through the identification of a breach of the applicable standard, its focus on the individual claimant and its grounding in relational justice.