a private individual (plaintiff) – Court Ruling (Germany, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a private individual could not prove they suffered harm from a company's use of their personal data for marketing. The court emphasized that claims for damages must be supported by evidence of actual harm. This case highlights the challenges individuals face when seeking compensation for privacy violations.
What happened
A court ruled that a private individual could not demonstrate harm from a company's marketing use of their personal data.
Who was affected
A private individual who objected to their personal data being used for marketing was affected.
What the authority found
The court found that the individual did not provide sufficient evidence to support their claim for damages under GDPR.
Why this matters
This case illustrates the difficulties individuals may encounter when trying to claim damages for privacy violations. Businesses should be aware that users can challenge data practices, and they should maintain clear records of consent and data use.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The data subject, a private individual, objected to the controller’s processing of their personal data. The controller, a commercial entity, had collected and processed the data subject’s personal data for marketing and profiling purposes. The data subject sent an email to the controller objecting to such a “processing or use” of his data to which the controller failed to respond The data subject claimed that the processing was unlawful and requested its cessation under Article 17(1)(d) GDPR. The data subject claimed that, when he receives messages of this nature, it gives rise to an uneasy feeling that personal data has been disclosed to unauthorized persons, precisely because the data was unlawfully used. The data subject had to deal with unwanted advertising and the origin of the data, creating a quite stressful impression of loss of control. Moreover, the controller initially did not respond after the infringement, which, from the data subject’s perspective, constituted yet another disregard of him. The controller argued that its processing was justified under Article 6(1)(f) GDPR as a legitimate interest. The lower courts had differing views on whether the processing met GDPR standards. The court stated, that a claim for non-material damages cannot be denied on the grounds that the harm does not exceed a certain severity threshold. However the court found, that the data subject did not sufficiently demonstrate that he suffered non-material damage at all. The court stated that the CJEU had clarified in several judgements that a mere infringement of the provisions of the GDPR is not sufficient to establish a claim for damages; rather, as an independent prerequisite, actual damage (caused by the infringement) must also be demonstrated by the data subject. The court elaborated that once the loss of control is established this itself constitutes the non-material damage, and there is no need for further distinct or additional concerns or anxieties on the
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for a private individual (plaintiff) in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. a private individual (plaintiff) - Germany (2025). Retrieved from cookiefines.eu
Last updated: