Court case 6 O 190/21 – Court Ruling (Germany, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a real estate company was not liable for damages after losing a USB stick with personal data. The court found no proof of harm to the couple whose data was lost. This case highlights the importance of proving actual damage in data loss claims.
What happened
A real estate company lost a USB stick containing personal data of a couple seeking financing, but the court found no damages were owed.
Who was affected
The couple who provided personal and financial documents to the real estate company for financing purposes.
What the authority found
The court decided there was no concrete evidence of harm to the couple, so the company did not owe damages despite losing the USB stick.
Why this matters
This case shows that courts require clear evidence of harm before awarding damages for data loss. Businesses should ensure secure handling of personal data and be prepared to demonstrate the absence of harm if a loss occurs.
GDPR Articles Cited
The data subject and his wife applied to the controller for real estate financing. For this purpose, they provided the controller with documents in various ways, including by e-mail and via a file transfer link. Also, they were given (an unencrypted) USB stick which they dropped into the controller's letterbox. This USB stick contained copies of identity documents, tax documents, data on existing properties, the advised property as well as other documents which were supposed to prove the financial capacity of the data subject and his wife. In the end, no contract was concluded. The controller returned the USB stick to the couple per letter. However, the USB stick never arrived. Hence, the data subject's wife contacted the controller because of the alleged loss of the USB stick. The controller initiated a "lost and found order", but this was unsuccessful. The data subject asserted non-material claims for damages against the controller in connection with the alleged loss of a USB stick containing his, and his wife's personal data. Hence, he requested the controller to pay damages in the amount of €25,000 on the basis of Article 82 GDPR. The controller refused payment. Subsequently, a claim for payment of €30,000 was brought before the court. The Court dismissed the action as unfounded and held that the data subject is not entitled to the asserted non-material claim for damages against the controller, although it was undisputed that the controller had not notified the DPA about the loss of the USB stick. The Court held that the data subject did not sufficiently substantiate that he and his wife suffered concrete non-material damage. The Court found that the defendant violated Article 34(2) GDPR, because he only informed the data subject of the alleged data loss. However, the information obligations of Article 34 GDPR provide, beyond the mere information about the data loss itself, that the information and measures mentioned in Article 33(1)(b) to Article 33(1)(d) GDP
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 6 O 190/21 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 6 O 190/21 - Germany (2021). Retrieved from cookiefines.eu
Last updated: