Court case 15 U 108/23 – Court Ruling (Germany, 2023)

The Higher Regional Court of Cologne (Oberlandesgericht Köln, OLG Köln) decided on appeal on case 28 O 138/22 by the Regional Court of Cologne (Landgericht Köln, LG Köln). In the appealed judgment, the LG Köln ruled that, in order for a claim for damages under Article 82 GDPR to arise, the mere annoyance and suffering of emotional discomfort do not suffice. The data subject in that case, was a Facebook user whose personal data were disclosed as a consequence of a major data breach in 2019. The data subject appealed the decision by the LG Köln, restating his initial arguments and seeking again damages for loss of control over his personal data and emotional discomfort as a consequence thereof. On 07 December 2023 the OLG Köln pronounced its judgment. The OLG declared the appeal admissible. The court ascertained that there had indeed been several GDPR violations by the controller, and went on to assess whether they could give rise to the award of immaterial damages under Article 82 GDPR also in light of [https://gdprhub.eu/index.php?title=CJEU_-_C-300/21_-_%C3%96sterreichische_Post_AG CJEU in C-300/21.] The court held that even if the plaintiff did lose control over his data as they had been published in the darknet, in connection with his name and against his will, this, in turn, does not suffice to constitute an immaterial damage. Citing [https://gdprhub.eu/index.php?title=CJEU_-_C-300/21_-_%C3%96sterreichische_Post_AG CJEU C-300/21], the OLG ruled that the fact that there is no threshold that defines the existence of a damage, still does not mean that the person affected by a GDPR infringement is exempted from proving the negative consequences of the damage. In the present case, the OLG held that the plaintiff only proved the “negative consequence” suffered but not the immaterial damage itself. Hence, the plaintiff failed to prove that the loss of control over his personal data constitutes an immaterial damage and thus remains a merely abstract loss of control. The OLG also considered that Recitals 75 and 85 merely state that a loss of control over one’s personal data may potentially result in a non-material damage but they do not provide a specific definition of what constitutes an immaterial damage. Further, as regards the claim of the plaintiff that he suffered from anxiety, fear and discomfort following the data breach, the OLG also held that the plaintiff failed to credibly prove that he was actually physically and psychically suffering. The OLG reiterated that this does not mean that it is introducing a minimum threshold for damages, against the wording of [https://gdprhub.eu/index.php?title=CJEU_-_C-300/21_-_%C3%96sterreichische_Post_AG CJEU C-300/21], but that damage must at least be objectively determined. Similarly, the court held that the plaintiff failed to show how he suffered damages from the spam emails and SMS he received or how he employed time and effort he put in dealing with the loss of control over his data. Further, the court declared all other claims brought by the plaintiff either inadmissible or unfounded, thus confirming the decision of the LG Köln of 31 May 2023.