Facebook Inc. – Court Ruling (Germany, 2023)

The data subject was a Facebook user. According to the privacy settings selected at the moment of the facts, their phone number could be used by a third person to find the data subject’s profile on Facebook, even if the phone number itself was not public. Accordingly, information relating to the data subject could be linked to their phone number by anyone in possession of such a number. In 2021, unknown “third parties” automatically combined telephone numbers and matched them with Facebook profiles thanks to the above-mentioned function. In this way, telephone numbers could be assigned to identified users. This resulted in a data breach concerning 533 million people in 106 different countries. The data subject lamented that since the data breach they received phishing emails and calls. In light of the loss of control over their personal data, the data subject claimed damages under Article 82 GDPR. The Court of first instance rejected the data subject’s claim. The data subject appealed the decision before the Higher Regional Court of Hamm (Oberlandesgericht Hamm – OLG Hamm). The court upheld the first instance judgement. The court clarified that a claim under Article 82 GDPR requires the existence of three necessary elements: the violation of a GDPR provision, an actual damage affecting the data subject, and a causal link between violation and damage. Concerning the first element, the court preliminary pointed out the fact that the burden of proof concerning the non-existence of a violation is on the controller. This conclusion can be drawn on the basis of Article 5(2) GDPR, which imposes on the controller the obligation to prove compliance with GDPR. The court also ruled out that the controller could rely on any valid legal basis for the processing. The linking function provided by Facebook was neither necessary for the performance of the contract (Article 6(1)(b) GDPR), nor could be based on legitimate interest of the controller (Article 6(1)(f) GDPR). Conse