Facebook – Court Ruling (Germany, 2023)

The data subject was a Facebook user. While using the service, the data subject provided different personal information, including their city of residence, “relationship status” (both publicly visible on their Facebook profile) and phone number (not immediately visible on the platform). However, according to the privacy settings selected at the moment of the facts, the phone number could be used by a third person to find the data subject’s profile on Facebook. Accordingly, information relating to the data subject could be linked to their phone number by anyone in possession of such a number. In 2021, unknown “third parties” automatically combined telephone numbers and matched them with Facebook profiles thanks to the above-mentioned function. In this way, telephone numbers could be assigned to identified users. This resulted in a data breach concerning 533 million people in 106 different countries. The data subject lamented that since then they received anonymous calls and a huge amount of spam. This entailed negative psychological consequences for them. Thus, the data subject asked for €1,000 in non-material damages under Article 82 GDPR. The controller replied that data scraping - which is not hacking - does not entail a violation of the GDPR by the controller, as no mandatory security measures where circumvented. In Facebook’s view, third parties merely had access to publicly available information. The court rejected the request for damages under Article 82 GDPR. Pursuant to this provision, any data subject has the right to receive compensation for material or non-material damages whenever their rights under the GDPR were infringed by a controller or processor. In assessing the oral declarations of the data subject, the court held that the data breach, despite annoying, did not seriously harm the data subject. As a matter of fact, the data subject was only concerned about the possibility that their data could be misused in the future. According to the court, such a concern was too general to give rise to non-material damages. In the words of the judges, the data subject did not spend any “sleepless night” because of the data breach. As further evidence of the limited impact of the data breach on the data subject’s life, the court pointed out to the fact that the user did not change their Facebook setting after the events. In addition, the court argued that the causal link between controller’s conduct and damage could not be proved. As the data subject was active on other social networks, the court held that that the spam and the anonymous calls may originate from facts other than the Facebook’s data breach.