The Federal Court of Justice (BGH) has issued a ruling in the Facebook scraping case.

This landmark ruling stems from an incident in April 2021. At that time, unknown individuals had published data belonging to approximately 533 million Facebook users from 106 countries online. The perpetrators had obtained this data by exploiting a friend-finding feature on the social network that allowed profiles to be found using phone numbers that were not intended to be public. By entering randomly generated phone numbers, the perpetrators were able to obtain matches and harvest the corresponding data.

The Federal Court of Justice (BGH) used this method—known as “scraping”—as an opportunity to make use of the new option of issuing a landmark decision for the first time. The landmark decision has no formal binding effect and also has no impact on the specific appeal proceedings on which it is based. However, it serves as a guideline and orientation for the lower courts and the public regarding how the legal issues should have been decided. This contributes to legal certainty and, at the same time, relieves the courts of the burden of handling further lawsuits.

The Federal Court of Justice (BGH) does clarify that a specific instance of misuse of the data to the detriment of the affected party need not yet have occurred for damage to be established. However, it does not specify at what point the loss of control itself occurs. In this specific case, the Federal Court of Justice only had to decide whether the actual access to user data on Facebook constituted damage. This assessment may vary depending on the specific circumstances of each case. It should be noted that the loss of control is a fact. Whether this loss exists must be assessed on a case-by-case basis.

Regarding the loss of control, the BGH stated that the plaintiff was not required to specify in detail to which other persons he had disclosed his data. In any case, it is sufficient for him to state that he did not publish the data publicly. Furthermore, it is sufficient for the plaintiff to make clear his state of unease and grave concern regarding the possible misuse of his data. In the present case, the plaintiff had stated that he had developed “increased distrust regarding emails and calls from unknown numbers and addresses,” as he had been receiving irregularreceived occasional unsolicited contact attempts via text message and email. He would also have had to address the “data leak,” investigate the facts of the matter, seek information from the defendant, and take further measures himself.

The Federal Court of Justice (BGH) concluded that, in light of the BGH’s most recent case law, the appellate court would have found that the plaintiff suffered non-pecuniary damage as a result of the scraping incident —whether solely in the form of a loss of control as such or, in addition, in the form of the alleged psychological impairments. The court identified the following as the most important points:

If damage is established solely as a loss of control over personal data, without any further proven damages, the court must, when assessing the damages, take into account the sensitivity of the data in question (see Art. 9(1) GDPR), its typical use, the nature and duration of the loss of control, and the possibility of regaining control. A possible point of reference for determining damages could be the hypothetical effort required to regain control, for example through measures such as changing a phone number.

It is doubtful whether setting damages at “possibly only a single-digit amount” would be compatible with the principle of effectiveness. However, the Federal Court of Justice (BGH) would have no qualms about setting compensation for the loss of control in a case like this at approximately 100 euros. If the affected party asserts psychological impairments that go beyond the general inconveniences of a loss of control, the court must hear the party in order to make the appropriate findings. In such cases, a higher compensation amount must be set than in cases involving a mere loss of control.

It can be assumed that this decision will bring about a significant shift in scraping proceedings. The previous ratio of more than 6,000 first- and second-instance judgments fullydismissing the claims (just under 85%) will very likely shift in the opposite direction, as the threshold for proving non-pecuniary damages has now been significantly lowered. We will, of course, keep you up to date on our portal!

 

Sources