In a recent decision that could have far-reaching implications for data protection litigation, the Federal Court of Justice in Germany has ruled that users of Facebook, whose data were exposed in a data scraping incident in April 2021, may seek compensation. This ruling marks a pivotal moment in holding digital platforms accountable for data security breaches.
The case involved a plaintiff who sued Meta, the operator of Facebook, claiming the company did not implement adequate security measures, resulting in his personal information being exploited by third parties. The breach is reported to have impacted approximately 533 million Facebook users across 106 countries. More details of the ruling can be found on the Federal Court of Justice’s official announcement.
Initially, a regional court ordered damages of €250 under Article 82(1) of the General Data Protection Regulation (GDPR), addressing non-material damage. However, an appeal led to the dismissal of the entire claim owing to insufficient evidence of psychological harm. The Federal Court, upon revision, partially upheld the plaintiff’s claims, recognizing the plaintiff’s interest in a declaration of liability for prospective damages.
The court’s interpretation of Article 82(1) GDPR was notable, asserting that even the temporary loss of control over personal data could justify claims of non-material damage. It concluded that a compensation of €100 for the loss of control was suitable, offering valuable judicial guidance on assessing non-material damage in such cases.
The case now returns to the Court of Appeal for further examination, particularly focusing on the effectiveness of the plaintiff’s consent to Facebook’s data processing practices and the default settings compliance with the GDPR’s data minimization principle.
This decision could potentially influence other legal systems interpreting similar data protection issues and suggests a stricter scrutiny on how tech corporations handle user data. The complete article is accessible through JURIST – News.