- Enforcing jurisdiction
- Germany · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Court case 19 O 147/22 – Court Ruling (Germany, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A court ruled that a Facebook user could not claim damages after their phone number was publicly visible and later misused. This decision highlights the responsibility users have for their own privacy settings.
What happened
The court rejected a request for damages from a Facebook user whose phone number was publicly visible and later used for spam.
Who was affected
A Facebook user who experienced spam and unwanted calls after their phone number was scraped from their profile.
What the authority found
The court found that the user did not suffer a breach of duty by Facebook, as the phone number's visibility was a choice made by the user.
Why this matters
This case underscores the importance of users managing their privacy settings on social media platforms to protect their personal information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 20 March 2026.
Processing notes: authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject was a computer scientist and Facebook user. While using Facebook's social media services, the data subject provided several mandatory personal data, including their first name, last name and sex.. These data points, including the system generated "Facebook ID", were publicly visible by default on the user profile. In addition the data subject added his mobile phone number. The mobile phone number was also visible by default but the user could change the visibility in the settings. The data subject limited the visibility to the "target group search“ setting, but left the searchability option for his mobile phone number visible. In 2021, unknown “third parties” published data, that has been scraped from the website in 2019. The data subject lamented that since then he received anonymous calls and spam emails. This entailed negative psychological consequences for him. Thus, the data subject asked for €500 in non-material damages under Article 82 GDPR. The controller replied that data scraping - which is not hacking - does not entail a violation of the GDPR by the controller, as no mandatory security measures where circumvented and the plaintiff made an informed decision to voluntarily share their phone number on the site. The court rejected the request for damages under Article 82 GDPR. The court held that there was no breach of duty by the controller that could trigger damages. The publication of the mobile phone number wasn‘t mandatory and the data subject had the (unused) option to hide the phone number on their profile. The court was of the opinion, that the controller did not breach its duty to adequately protect the personal data of users in accordance with Article 32 GDPR. The controller was not obliged to take protective measures to prevent the collection of already publicly accessible information. The controller also did not violate the principle of "privacy by default" enshrined in Articles 24 and 25(2) GDPR. It was undisputed that only th
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 19 O 147/22 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
10 March 2023
Authority
DPA LGBielefeld
About this data
Cite as: Cookie Fines. Court case 19 O 147/22 - Germany (2023). Retrieved from cookiefines.eu
Last updated: