Court case 9 U 34/21 – Court Ruling (Germany, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court dismissed a claim for compensation after a Mastercard data breach. The court found that the plaintiff did not prove Mastercard failed to protect her data or respond to her access request. This case shows that individuals must provide evidence of a company's wrongdoing to claim damages under GDPR.
What happened
A court dismissed a compensation claim related to a Mastercard data breach due to lack of evidence of wrongdoing.
Who was affected
A member of Mastercard's loyalty program whose personal data was hacked and published online.
What the authority found
The court ruled that the plaintiff failed to prove Mastercard violated GDPR by not protecting her data or responding to her access request.
Why this matters
This ruling emphasizes the need for individuals to prove a company's failure to comply with GDPR when seeking compensation. It highlights the importance of evidence in data protection claims.
GDPR Articles Cited
The plaintiff, a member of Mastercard’s loyalty program, sought compensation after her personal data got hacked from the Mastercard network and then published online. The claim was based on two cases of apparent non-compliance with GDPR: (1) the defendant not granting right of access Article 15 GDPR; (2) not implementing appropriate technical and organizational measures to prevent a data breach (Article 32 GDPR). Does the plaintiff have a right to compensation according to Article 82(1) GDPR and does Article 82(3) GDPR stipulate a reversal of the burden of proof so that the onus is on the controller to show that it has not acted wrongly? The Higher Regional Court dismissed the claim as it considered the appeal to be without merit. The Higher Regional Court maintained that every individual that has suffered material or non-material damages is entitled to receive compensation from the controller for the damage suffered Article 82(1) GDPR. However, for the controller to be held liable a breach of duty by the controller must have occurred. Furthermore, it is imperative that the damage suffered, is not merely attributable to a processing of personal data during which a violation of the GDPR has occurred. Yet, the Court did not identify the aforementioned breach of duty by the controller. That is for the reason that the defendant neither violated Article 15 GDPR by not responding within the set limits nor did the plaintiff show that the defendant did not implement appropriate technical and organizational measures as provided for by Article 32 GDPR. The Court held that the GDPR does not change the fact that the burden of proof to show that a breach of duty has occurred must be borne by the plaintiff. Citing the Austrian Supreme Court the Higher Regional Court Stuttgart maintained that EU law does not contain any specific rules on the burden of proof. Hence, the onus is on the claimant to show and prove the prerequisites for the claim. Only when it has been shown by the
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 9 U 34/21 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 9 U 34/21 - Germany (2021). Retrieved from cookiefines.eu
Last updated: