Germany: Update: Judgment on Non-Material Damages for Loss of Control over Personal Data

759206041

By Philipp Adelberg, Verena Grentzenberg & Jan Pohle on December 12, 2024

Posted in EU privacy, General Data Protection Regulation

In its judgement of November 18, 2024 (case number VI ZR 10/24) the German Federal Court of Justice (Bundesgerichtshof – “BGH”) clarified key legal issues regarding claims for damages under Article 82 GDPR in the event of a mere loss of control of personal data in the Facebook scraping complex. This blog post presents the recently published reasons for the judgement and is an update of our blog post ‘Germany: Judgment on Non-Material Damages for Loss of Control over Personal Data’.

The judgment is based on a personal data breach concerning the social network Facebook. In April 2021, data from over 500 million users was made public on the internet. This data was collected by unknown third parties using scraping. To collect the data these third parties were using the search function for phone numbers which, by default, allowed unrestricted access to public profiles based on phone numbers (including where the profile owner had decided not to publish the telephone number).

In summary, the BGH has ruled in favour of the existence of non-material damages due to a mere loss of control of personal data and has therefore provided some clarity to the previously inconsistent German case law. In particular, the decision clarified whether non-material damages due to loss of control can be claimed; what requirements must be met to substantiate such claims; and how such damages are to be measured.

Claims for damages

In its judgment, the BGH states that a claim under Article 82(1) GDPR requires the following:

An infringement of the GDPR;
A material or non-material damage to the data subject; and
A causal link between the infringement and the material or non-material damage.

In particular, BGH’s judgment looks at the question of whether the plaintiff suffered non-material damage in the specific case. The plaintiff claimed non-material damages for the anger and fear as a result of the loss of control over his personal data.

In its judgment, the BGH takes a broad interpretation of the term ‘non-material damage’. With reference to the case law of the ECJ (e.g. ECJ, judgment of 4 October 2024 – C-200/23, para. 145, 156 in conjunction with 137 – Agentsia po vpisvaniyata) and Recital 85 of the GDPR, the BGH ruled that the mere loss of control over personal data due to an infringement of the GDPR is sufficient to constitute non-material damages. According to the BGH, this applies even if there has been no specific misuse of the affected data to the detriment of the data subject or other noticeable negative consequences. Such consequences would only intensify an already existing damage.

Furthermore, the BGH clarifies the basic conditions for the assertion of a claim for non-material damage under the GDPR and civil procedural law. It was the plaintiff’s obligation to provide substantial evidence for damages in the specific form of loss of control over personal data and to prove the causal link. That means that the plaintiff had to present facts which, in conjunction with a legal provision, are suitable and necessary to justify the existence of the respective claim deriving from Article 82(1) GDPR. For this, the plaintiff can even use standardised text modules in written submissions, provided that these still demonstrate that the plaintiff is personally affected by the incident. The BGH considers the following circumstances, as presented by the plaintiff, to be sufficient to cause the damage:

Loss of control over leaked personal data (with respect to his cell number, the plaintiff stated that he always passed on this number consciously and purposefully and did not make it accessible to the public randomly and without reason)
State of significant unease and concern about possible misuse of personal data (increased mistrust regarding emails and calls from unknown numbers, receiving contact attempts via text messages and emails by unknown senders)

Further motions

Regarding the plaintiff’s motion for action of acknowledgment of future material and non-material damages deriving from the incident, the BGH states that the mere possibility of future damages is sufficient to grant such motion (this is in line with settled German case law).

The plaintiff also asserted injunctive relief. Insofar as he sought an order that prevents Facebook from making his personal data accessible to unauthorized third parties via software for importing contacts without taking the necessary measures to do so according to the state of the art, the BGH considered this application to be procedurally inadmissible. The reason for this was that the claim was unspecific in several respects – for example, it partly only re-phrased security requirements of the GDPR. However, the BGH deemed the plaintiff’s further application to be admissible. This application was aimed at preventing Facebook from further processing the plaintiff’s telephone numbers on the basis of consent given by him, since, in the plaintiff’s opinion, this consent was invalid due to a lack of transparency. The court of appeal will have to rule on this application again. Interestingly, the BGH also stated that consent is the only lawful basis that could be considered for processing of phone numbers for the search function.

Furthermore, the BGH ruled that the plaintiff had no further right of access according to Article 15(1) GDPR against the defendant. The plaintiff claimed a right of information regarding the specific recipients of the data. Since this was not possible because the defendant had no knowledge of the specific recipients of the data, the BGH ruled that the plaintiff had no right of access in this regard.

BGH on amounts of non-material damages

In accordance with the principle of procedural autonomy, the modalities for calculating the amount of non-material damage are determined by the national rules governing the scope of financial compensation. Limited by the principle of equivalence and effectiveness, the application in Germany is governed by Section 287 German Civil Procedure Code (Zivilprozessordnung – “ZPO”). Article 82 GDPR only has a compensatory function and not a deterrent or punitive function. Therefore, the severity or number of infringements is irrelevant for the calculation of damages. Instead, the respective court must consider the sensitivity of the data concerned, the typical appropriate use, the type of loss of control, the possibility of regaining control and existing psychological damage. As a result, the BGH suggested that the court of appeal awards damages in the amount of EUR 100.

In general, however, it can be inferred from the BGH’s statements that the BGH also considers double-digit (but likely not single digit) amounts to be potentially appropriate, albeit taking into account the respective circumstances of the individual case.

Conclusion

The BGH’s judgment is a landmark for future similar cases due to the relatively low amount as a result of damages. The courts of lower instance will in all likelihood concur with the BGH’s opinion. It remains to be seen to what extent other supreme federal courts will follow the opinion of the BGH. The German Federal Social Court (Bundessozialgericht – “BSG), the federal court of appeal for social security cases, for example, seems to take the position in a judgment which is not yet publicly accessible that the mere formulaic assertion that the plaintiff had suffered a “loss of control” as a result of being left in the dark about the processing of his personal data to be insufficient to justify a claim under Article 82(1) GDPR.