DPA case 221 C 578/22 – Violation Found (Germany, 2022)

The data subject was a costumer who participated in the loyalty programme of the controller. Through the programme, costumers had the opportunity to collect points from their purchases from partner companies. Each point granted by a partner company has a monetary value of a number of cents. On 5 September 2021, twelve of the data subject’s points were converted into a goods voucher. The data subject claimed that the points were redeemed by third parties without authorisation. There were no documented cyberattacks or data protection incidents at the controller on that day. Next to various claims under German Civil Law, the data subject sought damages from the controller for a breach of the General Data Protection Regulation (GDPR). The data subject claimed that the controller was a payment service provider within the meaning of the standard according to Article 823(2) BGB conjoined with Article 55(1) Payment Service Oversight Act (ZAG) and that the points of the defendant were electronic money. Therefore, the defendant would have been obliged to require two-factor authentication. Because the controller's security measures were not state-of-the-art and could not guarantee a high enough level of protection pursuant to Article 32(1) GDPR, the data subject claimed damages pursuant to Article 82(1) GDPR. The controller argued to the contrary that the customer loyalty programme did not constitute electronic money and thus did not require a stronger customer authentication. Consequently, it asserted that its loyalty programme guaranteed an adequate technical and organisational level or protection for the customers’ accounts within the meaning of Article 32(1) GDPR. The court rejected all the data subject's claims. To assess if the loyalty programme would have necessitated a two factor authentication and was therefore in breach of Article 31(1) GDPR, the court used German law to examine, firstly, whether the programme constituted a payment service and, secondly, wheth