Court case 11 U 88/22 – Court Ruling (Germany, 2023)

During the Covid-19 pandemic, a vaccination hub accidentally disclosed by email personal data of several hundred people, including their choice to adhere to the mass vaccination. One of the data subjects involved in this data breach asked the controller for non-material damages. They claimed that the violation posed significant risks to their fundamental rights. In particular, they stated to have received a phishing email from an alleged "European Consumer Protection Agency" aiming to steal their and other data subjects’ data from the vaccination hub’s previous email. The data subject also claimed that data could end up in the hands of violent anti-vaccination militants. Therefore, the data subject held to be entitled to non-material damages for an amount of €10,000 pursuant to Article 82 GDPR. In the first instance judgement, the controller stressed that the data subject made their own vaccination data publicly available on Facebook. Thus, no violation occurred with regards to their health data. Moreover, the controller claimed that Article 82 GDPR requires fault, whereas in the present case there was only slight negligence by an employee of the controller. In addition, the controller denied that the data subject suffered any negative consequence: the fundamental rights violations lamented were in fact just abstract and unlikely to happen. In any case, no causal link between such negative consequences and the controller’s conduct could be found. The controller also stressed that the definition of non-material damages under GDPR was unclear and several questions concerning the interpretation of Article 82 GDPR were currently pending before the CJEU. The Court of first instance found that Article 82 GDPR applied in the case at issue. The controller unlawfully processed personal data, including health data, and violated Articles 5(1)(f), 9 and 32 GDPR. A “loss of control” over personal data is sufficient to substantiate non-material damages in accordance with Articl