With judgment dated May 4, 2023, in case 300-21, the CGUE stated that the right to compensation for damages as a consequence of a breach concerning personal data is subject to three cumulative conditions: (i) a violation of the GDPR; (ii) a material or immaterial damage caused by such violation (regardless of its importance or seriousness); (iii) a causal link between the damage and the violation