Court case 11 U 88/22 – Court Ruling (Germany, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a vaccination hub wrongly shared personal data of hundreds of people during the Covid-19 pandemic. The court found this data breach could lead to non-material damages, even if no direct harm was proven. This case highlights the importance of protecting personal data, especially sensitive health information.
What happened
A vaccination hub accidentally disclosed personal data of hundreds of people via email.
Who was affected
People whose vaccination data was shared without their consent.
What the authority found
The court decided that the vaccination hub unlawfully processed personal data, violating GDPR rules, and that a loss of control over data could justify non-material damages.
Why this matters
This decision emphasizes that companies must handle personal data carefully, as even accidental breaches can lead to claims for damages. Businesses should ensure robust data protection measures to avoid similar legal challenges.
GDPR Articles Cited
During the Covid-19 pandemic, a vaccination hub accidentally disclosed by email personal data of several hundred people, including their choice to adhere to the mass vaccination. One of the data subjects involved in this data breach asked the controller for non-material damages. They claimed that the violation posed significant risks to their fundamental rights. In particular, they stated to have received a phishing email from an alleged "European Consumer Protection Agency" aiming to steal their and other data subjects’ data from the vaccination hub’s previous email. The data subject also claimed that data could end up in the hands of violent anti-vaccination militants. Therefore, the data subject held to be entitled to non-material damages for an amount of €10,000 pursuant to Article 82 GDPR. In the first instance judgement, the controller stressed that the data subject made their own vaccination data publicly available on Facebook. Thus, no violation occurred with regards to their health data. Moreover, the controller claimed that Article 82 GDPR requires fault, whereas in the present case there was only slight negligence by an employee of the controller. In addition, the controller denied that the data subject suffered any negative consequence: the fundamental rights violations lamented were in fact just abstract and unlikely to happen. In any case, no causal link between such negative consequences and the controller’s conduct could be found. The controller also stressed that the definition of non-material damages under GDPR was unclear and several questions concerning the interpretation of Article 82 GDPR were currently pending before the CJEU. The Court of first instance found that Article 82 GDPR applied in the case at issue. The controller unlawfully processed personal data, including health data, and violated Articles 5(1)(f), 9 and 32 GDPR. A “loss of control” over personal data is sufficient to substantiate non-material damages in accordance with Articl
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Violations (1)
The cookie banner or cookie policy provides vague, incomplete, or unclear information about what cookies are used and why.
Art. 12, 13 GDPR
Related Cases (0)
No other cases found for Court case 11 U 88/22 in DE
This is the only recorded case for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
About this data
Cite as: Cookie Fines. Court case 11 U 88/22 - Germany (2023). Retrieved from cookiefines.eu
Last updated: