Court case 23 O 10931/20 – Court Ruling (Germany, 2021)

The controller operates a social network and an online platform. The data subject created a customer account there using his law firm e-mail address. In July 2020, the data subject demanded damages from the controller because of an alleged data protection incident from January 2019 on the website to his e-mail address. The controller replied, telling the data subject that it did not own the website. Therefore, it informed the data subject how and via which URL he could view and download a complete copy of the data stored about him within his user account. The data subject claimed that the URL links sent by the controller were useless because they showed “page not found” when called. The data subject sought damages for an alleged data breach. He claimed that the defendant did not answer his request for information. The data subject had initially claimed that his data was stolen from his account as part of a hack in February 2019. In 2021, the data subject submitted that a data protection incident regarding his e-mail address was no longer at stake, but rather his account on the platform. He alleged that he lost control of his data as a result of the breach of his right to information and the data leak made possible by system errors. According to him, this amounted to an immaterial damage to be valued at least € 4,500 due to the seriousness of the data protection violation. Before the court, the data subject requested to order the controller to pay him € 6,650 plus interest. The controller submitted that it fulfilled its information obligations under the GDPR. It argued that its information system was customary in the market. Furthermore, the data subject no longer responded to the notification of the links. In addition, the controller denied a data protection incident concerning the plaintiff's e-mail address. The Regional Court of Munich rejected the data subject's claim. It held that the mere allegation that damage has occurred due to the loss of control over data is not sufficient to establish non-material damages. First, the court established that the controller had sufficiently provided access pursuant to Article 15 GDPR by sending the URL links. In the court proceedings, it could not be confirmed that the page could not be accessed. The court confirmed that the electronic provision of personal data on the account is explicitly allowed by the GDPR as Recital 63 GDPR states that, where possible, the controller should be able to provide remote access to a secure system that would allow data subjects direct access to their personal data. Second, the court held that the data subject had not sufficiently shown to have suffered any measurable and compensable damage. It did not follow the data subject's submission that, since his e-mail address had been stolen, the thieves would thus have had access to all contacts stored under this email, in particular client contacts, which could have been sold on the Darknet in addition to his own e-mail address. While it did acknowledge that the data subject may have been affected by a large-scale hack of which the controller had not informed him, the data subject had not submitted sufficient proof of that claim. The court clarified that non-material damages can be compensated pursuant to Article 82 GDPR. However, the data subject had not submitted that, for example confidential client data was accessed. Furthermore, the data subject's e-mail address was not secret and could easily be accessed by third parties. The data subject had limited his argument to the damage consisted in the loss of control over his data which was not sufficient to establish a measurable non-material damages.