Millions of Facebook users affected – When is there compensation for data leaks? The BGH's first key decision is approaching

In the Facebook data leak from 2021, user names, dates of birth, email addresses, telephone numbers and personal information such as the relationship status of 6 million Germans were leaked onto the dark web – a gateway for criminals! That is why WBS.LEGAL represents tens of thousands of Facebook users in order to obtain non-material damages for them in accordance with Art. 82 GDPR.

First BGH key decision

The BGH was originally scheduled to hear two of our Facebook data leak cases on October 8th. Now that this hearing date has been cancelled, we welcome the scheduling of a new hearing date as soon as possible on November 11th, so that there is finally legal certainty for all affected consumers (BGH, VI ZR 10/24).

In addition, our procedure will be the first leading decision procedure by the Federal Court of Justice nationwide. The law was recently published in the Federal Law Gazette and came into force today on October 31st. The lead decision procedure gives the Federal Court of Justice the new opportunity to clarify the relevant legal questions in a lead decision for a large number of pending, similar individual lawsuits. The decision will therefore be in completely new territory.

As a lawyer and partner at the Cologne media law firm WBS.LEGAL, Christian Solmecke specializes in advising the Internet and IT industry. In recent years, he has steadily expanded the firm's Internet law/e-commerce area and supports numerous media professionals, Web 2.0 platforms and app developers. In addition to his work as a lawyer, Christian Solmecke is a multiple author and, as the founder of the cloud-based law firm software Legalvisio.de, he is also a successful LegalTech entrepreneur.

The specific case

In the specific case, our client affected by the data leak sued Facebook, among other things, for damages. In the first instance, the Bonn regional court awarded the person concerned 250 euros in damages because he had suffered compensable damage as a result of the loss of control over his data (ref. 13 O 125/22). The Cologne Higher Regional Court (OLG) then partially changed the first instance judgment in the appeal proceedings and dismissed the lawsuit in its entirety (ref. 15 U 67/23). The Federal Court of Justice will now decide in principle in the key decision procedure whether Meta has violated the GDPR through the data leak. He must then assess whether the loss of control over the data accessed in the data leak triggers compensable damage. In addition, the BGH will decide whether Meta must also be liable for future damages resulting from the data leak.

The previous case law and our argument

So far, many German courts have already agreed with our legal opinion that Facebook did not sufficiently protect the data from hackers and therefore owes those affected compensation. You can find an (excerpt) list of successful procedures here.

The Dresden Higher Regional Court has recently made a positive judgment and awarded our client damages (ref. 4 U 480/24). The Oldenburg Higher Regional Court had also already made three positive judgments (ref. 13 U 108/23; 13 U 89/23; 13 U 109/23). This is how it looks, for example: B. also the Frankfurt Regional Court – which also awarded our clients 1000 euros for this reason and also obliged Facebook to compensate for all potential future damages that could still occur (case no. 2-27 O 194/22). Numerous other courts such as the Munich Regional Court, the Darmstadt Regional Court and the Verden Regional Court have awarded our clients 1000 euros in damages (case no. 6 O 11754/23, no. 30 O 2/22, no. 2 O 115/22).

BGH will make consumer-friendly decisions in line with the ECJ

In some cases, some OLGs (including OLG Cologne and OLG Stuttgart as lower courts for the overturned BGH decisions) currently see this differently. These courts all recognize misconduct on the part of Facebook. The Stuttgart Higher Regional Court also derives a fundamental obligation to pay compensation from this. Ultimately, however, they place disproportionately high demands on the damage that a consumer must demonstrate. They argue that the loss of control over one's own data alone is not enough to justify a claim for damages.

In our opinion, this is incompatible with the consumer-friendly case law of the European Court of Justice (ECJ). In various judgments (in particular C-300/21; C-340/21; C-741/21; C-590/22; C-182/22; C-189/22) the court decided the following:

1. In order to claim compensation under the General Data Protection Regulation (GDPR), those affected do not have to prove that their data was actually passed on illegally or that data theft actually led to identity theft or fraud.
2. Fears, anxieties and worries as well as the actual loss of control over your own data are enough to assume damage.
3. There is no “significantity threshold” when it comes to compensation, so the damage does not have to be of a certain severity in order to be compensable.
4. The concept of damage must be viewed broadly because the GDPR is intended to adequately protect the rights of those affected.
5. The amount of compensation should be so high that it can fully and effectively compensate for the damage suffered; after all, the GDPR has a “compensatory function” here.

And in a recent ruling from October 4, 2024, the ECJ once again expressly decided that the loss of control over data published in violation of data protection alone constitutes compensable damage. However, those affected do not have to provide evidence of additional concrete adverse consequences (Case C-200/23).

Another interesting aspect that the ECJ recently emphasized: the damage caused by breaches of personal data protection is by its nature no less serious than bodily harm. This is actually self-evident, but the ECJ had to emphasize this again because the German court making the reference had tried to minimize possible claims for damages from those affected.

A trend among German courts, which the ECJ further counteracted with this renewed clarification. However, the case law is currently extremely inconsistent. The courts currently do not (yet) know how to interpret European law and how to interpret the current judgments of the ECJ mentioned above. There is therefore an urgent need for clarification before both the BGH and the ECJ. Important questions such as the clarification of whether those affected have a future injunction against Meta are currently before the ECJ and have not yet been finally decided there. There is also a lack of uniformity in the courts regarding the amount of correct compensation. Here the verdicts vary between 50 euros and 1000 euros.

In our opinion, this is completely incomprehensible, as in most cases the facts are absolutely identical. We are now all the more excited about the BGH’s assessment. The Federal Court of Justice published the specific legal questions to be clarified in a press release.