Germany's highest court recently issued a ruling on the right to immaterial damages under Article 82 of the AVG, in connection with a scraping incident. The court ruled that "loss of control" over personal data is sufficient on its own to claim immaterial damages.
In early April 2021, personal data of about 533 million Facebook users from 106 countries was publicly distributed on the Internet. Unauthorized third parties had used Facebook's Contact Import tool, which allows a Facebook profile to be found by phone number. This feature is normally used to search for friends, searching phone numbers from someone's address book, to which Facebook profiles are then linked and presented as friends. The unauthorized third parties widely entered random number strings into this tool and then "scraped" publicly visible profile information associated with these phone numbers. This scraping incident affected the plaintiff in the present case. His user ID, first and last name, workplace, gender and phone number were published on the dark web. According to plaintiff, Meta allegedly did not take sufficient security measures to prevent the tool from being misused. He believes he is entitled to compensation for immaterial damages due to the inconvenience he suffered and the loss of control over his data.
At first instance, the court granted the plaintiff's claim (in part) and awarded the plaintiff damages of EUR 250 under Art. 82 (1) AVG. On appeal, the court rejected the claim in its entirety. According to the court, the mere loss of control did not in itself constitute damages. The plaintiff would have had to prove that the loss of control had caused immaterial damages. The substantiation for this was lacking. Admittedly, plaintiff had alleged fear, worry and discomfort. However, according to the court, plaintiff had failed to present concrete evidence of the existence of these emotions. In this regard, the court specifically referred to the UI v. Österreichische Post judgment of the Court of Justice of the European Union ("CJEU").(1) Also, the claimant would not have provided sufficient evidence that the disclosure of its telephone number after the scraping incident actually resulted in a loss of the control it previously exercised over this telephone number.(2)
The plaintiff then went to the highest German court. This ruled, citing the CJEU's NAP judgment,(3) that the mere and temporary loss of control over one's own personal data as a result of a violation of the AVG could constitute immaterial damage within the meaning of the standard.(4) It is not necessary for there to be a specific misuse of these data to the detriment of the data subject, nor is any other additional appreciable negative consequence required.
The height court then considers that the person in question must "obviously" prove that he or she suffered such a loss. Once this proof is made, that is, once the loss of control has been established, this in itself constitutes the intangible harm and no particular fears or concerns on the part of the individual are required. Such fears or worries could only aggravate or increase the immaterial damage that has occurred, the supreme court said.(5)
Even if a loss of control cannot be proven, a person's well-founded fear that their personal data will be misused by third parties as a result of a violation of the AVG is sufficient to justify a claim for damages. The fear, including its negative consequences, must be duly substantiated.(6)
In the present case, the individual was only required to show that and in what way he was affected by the scraping incident and how it affected him.(7)
This leads to the conclusion that in the present case there are no legal objections to award compensation of EUR 100 for the mere loss of control.(8)
Salient detail: the supreme court "assumes" there was a violation of the AVG, as the court had left that in the middle. A violation of the AVG is a hard condition for entitlement to damages. The highest German court referred the case back to the court and gave the court directions that should be taken into account with regard to that assessment.(9)
Let's see exactly what the CJEU has said about "loss of control" over personal data.
In the NAP judgment, the CJEU ruled as follows:
"Furthermore, recital 85, first sentence, AVG states that "[e]ach personal data breach, if not addressed in a timely and appropriate manner, may result in physical, material or immaterial harm to natural persons, such as loss of control over their personal data (...) This illustrative list of "harm" that data subjects may suffer shows that the Union legislature intended to include among those concepts, in particular, the mere "loss of control" over their own data as a result of a breach of this Regulation, even if no concrete misuse of the data in question to the detriment of those persons has occurred."(10)
Citing the AVG, the CJEU notes that the mere "loss of control" should be subsumed under the concept of "non-material damage. This is the line that the highest German court seems to follow. However, in the NAP judgment, the data subject did invoke a concrete 'fear of future misuse of his data by third parties'. The CJEU then emphasized that a person affected by a breach of the AVG with negative consequences for him must prove that those consequences constitute immaterial damage within the meaning of Article 82 of the AVG. (11) This seems to indicate that the mere "loss of control" does not automatically lead to a right to compensation.
In the MediaMarktSaturn judgment, the CJEU takes an (even) more nuanced approach and considers that loss of control does not "is" (by definition) immaterial damage, but that loss of control can cause immaterial damage:
"Furthermore, based on both literal and systemic and teleological considerations, the Court has held that the loss of control over personal data for a short period of time may cause the data subject 'non-material damage' within the meaning of Article 82(1) AVG for which a right to compensation exists, provided that the data subject proves that he has actually suffered such damage, however minimal, recalling that a breach of the provisions of this regulation is not in itself sufficient for the award of a right to compensation (...)"(12)
So only if the "loss of control" has caused immaterial damage, then there is a right to compensation.
The central issue in both the NAP and MediaMarktSaturn judgments was whether the fear of possible misuse of personal data' can constitute immaterial damage. The CJEU considered that it is for the data subject to prove the existence of such immaterial damage. It is then up to the national court to determine whether the fear is well-founded.
In fact, the highest German court seems to rule that loss of control automatically leads to compensation for immaterial damages. This interpretation is at odds with the line set out by the CJEU, but also shows how national courts struggle with this in practice thin line (13) between (in this case) loss of control as the trigger of compensation and the existence of actual damage as a result.
CJEU May 4, 2023, C-300/21, ECLI:EU:C:2023:370 (UI v. Österreichische Post).
OLG Köln, Dec. 7, 2023, 15 U 67/23, para. 49.
CJEU, Dec. 14, 2023, Case C-340/21 (VB v. Natsionalna agentsia za prihodite), para. 82.
Federal Court, November 18, 2024, VI ZR 10/24: "Nach der für die Auslegung des Art. 82 Abs. 1 DSGVO maßgeblichen Rechtsprechung des EuGH kann auch der bloße und kurzzeitige Verlust der Kontrolle über eigene personenbezogene Daten infolge eines Verstoßes gegen die Datenschutz-Grundverordnung ein immaterieller Schaden im Sinne der Norm sein."
Federal Court, Nov. 18, 2024, VI ZR 10/24, para. 31.
Federal Court, Nov. 18, 2024, VI ZR 10/24, para. 32.
Federal Court, Nov. 18, 2024, VI ZR 10/24, para. 36.
Federal Court, Nov. 18, 2024, VI ZR 10/24, https://juris.bundesgerichtshof.de/cgi-bin/rechtsprechung/document.py?Gericht=bgh&Art=en&Datum=Aktuell&anz=1.&pos=0&nr=139661&linked=pm&Blank=1
Federal Court, Nov. 18, 2024, VI ZR 10/24, paras. 22 and 85.
CJEU, Dec. 14, 2023, Case C-340/21 (VB v. Natsionalna agentsia za prihodite), para. 82.
CJEU, Dec. 14, 2023, Case C-340/21 (VB v. Natsionalna agentsia za prihodite), para. 84.
CJEU, January 25, 2024, Case C-687/21, ECLI:EU:C:2024:72. para 66.
Conclusion of Attorney General M. Campos Sánchez-Bordona, Oct. 6, 2022, Case C-300/21 (UI v. Österreichische Post AG), see footnote 43: "Emotional consequences associated with the loss of control over data, such as fear of or concern about what might happen to the data, result from the loss, but are not identical to it."
