German court says Facebook liable in data scraping case
n November 18, 2024, the Federal Court of Justice (Bundesgerichtshof) ruled on claims related to a data protection incident involving the social network Facebook. The case stemmed from a major data breach that occurred in April 2021, where the personal information of approximately 533 million Facebook users from 106 countries was publicly exposed online. The breach was facilitated by unknown third parties exploiting Facebook’s contact import feature, allowing them to match phone numbers with user accounts and scrape publicly available data.
The plaintiff, whose personal information was compromised, argued that Facebook failed to implement adequate security measures to prevent such misuse of its contact tool. He sought compensation for the emotional distress and loss of control over his personal data, as well as a declaration that Facebook should be liable for any future material and immaterial damages. The plaintiff also demanded that Facebook cease using his phone number without his consent and provide information regarding the incident.
Initially, the lower court partially upheld the plaintiff’s claims, awarding him €250 for immaterial damages. However, the appeals court dismissed the case, stating that mere loss of control over personal data did not constitute sufficient grounds for claiming immaterial damages under Article 82 of the General Data Protection Regulation (GDPR). The plaintiff’s assertion of psychological harm was deemed insufficiently substantiated by the appeals court.
Upon reviewing the case, the Federal Court of Justice found that the plaintiff’s claim for compensation for immaterial damages could not be dismissed based solely on the loss of control over personal data. The court emphasized that a brief loss of control could indeed represent an immaterial damage under GDPR. Furthermore, the court acknowledged the plaintiff’s interest in future damage claims and ordered the case to be sent back to the appeals court for further examination, particularly regarding the adequacy of Facebook’s data processing consent and the calculation of immaterial damages.
