The highest German court recently rendered a judgment on the right to non-material damage pursuant to Article 82 of the GDPR in connection with a scraping incident. The Court held that ‘loss of control’ over personal data as such is sufficient to claim non-material damages.[1]
Facts
In early April 2021, personal data of approximately 533 million Facebook users from 106 countries were disseminated publicly on the internet. Unauthorized third parties had used Facebook's Contact Import tool, with which a Facebook profile can be found on the basis of a telephone number. This function is normally used for finding friends; the tool searches a person’s address book for telephone numbers, links these numbers to Facebook profiles and proposes them as friends. The unauthorized third parties entered random series of digits into this tool on a large scale, and then ‘scraped’ publicly visible profile information associated with these telephone numbers. This scraping incident affected the claimant in the case at issue. His user ID, first and last name, place of work, gender and telephone number were published on the dark web. The claimant maintained that Meta had taken insufficient security measures to prevent the tool from being abused. He believed to be entitled to compensation of non-material damage caused by the inconvenience he experienced and the loss of control over his data.
Course of the Proceedings
In the first instance proceedings, the Court (partially) allowed the claimant’s claim and awarded the claimant EUR 250 in compensation pursuant to Article 82 (1) GDPR. On appeal, the Court of Appeal denied the claim in its entirety, arguing that the mere loss of control as such did not constitute damage. The claimant should have proven that the loss of control had caused non-material damage, but had not substantiated this. Although the claimant had argued to experience fear, concerns and inconvenience, he had failed to submit concrete evidence that these emotions existed. In this connection, the Court of Appeal referred specifically to the UI/Österreichische Post judgment of the European Court of Justice (‘ECJ’).[2] In addition, the claimant was deemed to have proven insufficiently that the publication of his telephone number after the scraping incident actually led to a loss of the control he exercised previously over this telephone number.[3]
Highest Court
The claimant subsequently took the case to the highest German court. With reference to the ECJ’s NAP judgment[4], this court held that the mere and temporary loss of control over one’s own personal data as a result of an infringement of the GDPR may constitute non-material damage within the meaning of the standard.[5] There does not have to be any specific abuse of these data to the detriment of the data subject, nor any other appreciably negative consequence.
The highest court went on to consider that the person concerned ‘naturally’ had to prove that he or she had suffered such a loss. As soon as this evidence is furnished – in other words, as soon as the loss of control is established – this alone will constitute the non-material damage, and no special fears or concerns of the data subject will be required. In the opinion of the highest court, such fears or concerns could only aggravate or increase the non-material damage that occurred.[6]
Even if a loss of control cannot be proven, a person’s well-founded fear that his personal data will be abused by third parties as a result of an infringement of the GDPR is sufficient to warrant a claim for damages. This fear, including its negative consequences, must be substantiated properly.[7]
In the case at issue, the data subject only had to demonstrate that, and how, he had been affected by the scraping incident and what consequences this had had for him.[8]
In the case at issue, this resulted in the conclusion that there are no legal objections to award the claimant EUR 100 in compensation for the mere loss of control.[9]
A striking detail is that the highest court ‘assumed’ there had been an infringement of the GDPR, since the Court of Appeal had given no opinion on this. An infringement of the GDPR is a strict condition for a right to compensation to exist. The highest German court referred the case back to the Court of Appeal, with instructions the Court of Appeal has to follow regarding its adjudication of this condition.[10]
Brief Analysis
Let us look at what the ECJ has said exactly about ‘loss of control’ over personal data.
In the NAP judgment, the ECJ held the following:
“Furthermore, the first sentence of recital 85 of the GDPR states that ‘a personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data (…). It is apparent from that illustrative list of types of ‘damage’ that may be suffered by the data subjects that the EU legislature intended to include in those concepts, in particular, the mere ‘loss of control’ over their own data, as a result of an infringement of that regulation, even if there had been no misuse of the data in question to the detriment of those data subjects.”[11]
Referring to the GDPR, the ECJ observed that the mere ‘loss of control’ must be classified under the concept of ‘non-material damage’. This is the line that the highest German court appears to follow. However, in the NAP judgment the data subject did rely concretely on ‘fear of future abuse of his data by third parties’. The ECJ then pointed out that a person concerned by an infringement of the GDPR which had negative consequences for him or her is required to demonstrate that those consequences constitute non-material damage within the meaning of Article 82 of the GDPR.[12] This seems to indicate that the mere ‘loss of control’ does not automatically result in a right to compensation.
In the MediaMarktSaturn judgment, the ECJ chose an even more subtle approach, and held that loss of control ‘is’ not (by definition) non-material damage, but that it may cause non-material damage:
“Furthermore, on the basis of considerations of a literal, systemic and teleological nature, the Court held that the loss of control of the personal data for a short period of time may cause the data subject ‘non-material damage’, within the meaning of Article 82(1) of the GDPR, giving rise to a right to compensation, subject to that person demonstrating having actually suffered such damage, however minimal, bearing in mind that the mere infringement of the provisions of that regulation is not sufficient to confer a right to compensation on that basis (…)”[13]
This means that a right to compensation will only exist if the ‘loss of control’ has caused non-material damage.
In both the NAP judgment and the MediaMarktSaturn judgment, the key question was whether the fear of possible abuse of personal data may constitute non-material damage. The ECJ held that it is up to the data subject to prove that such non-material damage exists. The next step is for the national courts to examine whether there is well-founded fear.
In fact, the highest German court seems to conclude that the loss of control automatically leads to compensation of non-material damage. This interpretation is at odds with the line adopted by the ECJ, but also shows how the national courts struggle with this fragile line[14] between (in this case) loss of control as the trigger for compensation, and the existence of actual damage as a result thereof.
[1] Bundesgerechtshof, 18 november 2024, VI ZR 10/24
[2] ECJ, 4 May 2023, C-300/21, ECLI:EU:C:2023:370 (UI/Österreichische Post).
[3] OLG Köln, 7 December 2023, 15 U 67/23, paragraph 49.
[4] ECJ, 14 December 2023, case C-340/21 (VB vs Natsionalna agentsia za prihodite), paragraph 82.
[5] Bundesgerechtshof, 18 november 2024, VI ZR 10/24: “Nach der für die Auslegung des Art. 82 Abs. 1 DSGVO maßgeblichen Rechtsprechung des EuGH kann auch der bloße und kurzzeitige Verlust der Kontrolle über eigene personenbezogene Daten infolge eines Verstoßes gegen die Datenschutz-Grundverordnung ein immaterieller Schaden im Sinne der Norm sein.”
[6] Bundesgerechtshof, 18 november 2024, VI ZR 10/24, par. 31.
[7] Bundesgerechtshof, 18 november 2024, VI ZR 10/24, par. 32.
[8] Bundesgerechtshof, 18 november 2024, VI ZR 10/24, par. 36.
[9] Bundesgerechtshof, 18 november 2024, VI ZR 10/24
[10] Bundesgerechtshof, 18 november 2024, VI ZR 10/24, par. 22 en 85.
[11] ECJ, 14 December 2023, case C-340/21 (VB vs Natsionalna agentsia za prihodite), paragraph 82.
[12] ECJ, 14 December 2023, case C-340/21 (VB vs Natsionalna agentsia za prihodite), paragraph 84.
[13] ECJ, 25 January 2024, case C-687/21, ECLI:EU:C:2024:72, para. 66.
[14] Opinion of Attorney General M. Campos Sánchez-Bordona, delivered on 6 October 2022, case C‑300/21 (UI vs Österreichische Post AG), see footnote 43: “The emotional consequences linked to loss of control over data, such as fear or anxiety regarding what may happen with such data, are derived from, but not identical to, the loss”.
