Privacy torts remain poor relations of European Union (EU) data protection law. The Data Protection Directive’s rules on compensation for damages caused by intrusions of privacy remained largely unchanged in the General Data Protection Regulation (GDPR) that is preoccupied with administrative measures against the violators of its rules more than with arming the victims of privacy infringements with effective and efficient rules on privacy torts. This article addresses the issue of the underutilization of the right of private action under EU data protection law by identifying deficiencies of the rules on damages contained in both the Directive and the Regulation and arguing for their reinforcement with provisions on statutory damages. In search for guidance, it looks into the application of statutory damages in intellectual property (IP) law, their potentially punitive effect and, on the basis of the privacy case law of the European Court of Human Rights, offers indications of possible amounts of the statutory damages being proposed.