On November 18, 2024, the Federal Court of Justice made its decision in the lead decision procedure on the so-called “scraping case” (judgment of November 18, 2024, file no.: VI ZR 10/24).
As a reminder, the case involved a Facebook data leak from 2018 and 2019, in which unknown perpetrators extracted personal data from millions of users and published it on the Darknet (see our post from November 13, 2024).
The Federal Court of Justice has now strengthened the position of Facebook users in the dispute over claims for damages.
According to the decision of the Federal Court of Justice, the mere and short-term loss of control over one's own personal data as a result of a violation of the GDPR should be sufficient to be able to assert a claim for intangible compensation. The person concerned only has to prove in a specific individual case that a loss of control has actually occurred. It is therefore not necessary to prove the specific misuse of the data or noticeable negative consequences for the person concerned.
However, the reasons for the verdict also make it clear that the compensation for mere loss of control over data cannot be very high. From the point of view of the Federal Court of Justice, a compensation claim of manageable 100 euros is appropriate. For higher compensation, proof of a specific impairment is required.
The matter has now been referred back to the Cologne Higher Regional Court for a new negotiation and decision.
In view of the large number of people affected by data leaks and the possibility of similar incidents in the future (not only on social networks), the decision has far-reaching significance. It represents an important step towards clarifying the legal responsibility of companies when handling user data. At the same time, the ruling sets new standards for examining intangible compensation claims for GDPR violations.
However, companies still have options to defend themselves against lawsuits for intangible damages. The instance courts must always decide on a case-by-case basis whether a loss of control has actually been proven and to what extent damage can be awarded. In addition, there is still legal uncertainty for other cases.
We would be happy to advise you on implementing practicable data protection compliance or on court proceedings in connection with claims for damages due to GDPR violations.
