Court case 62 O 88/23 – Court Ruling (Germany, 2024)

The data subject is a client of the controller that operates two social media platforms which allow users to create their own profile and share it with friends. The controller earns money through personalised ads which are tailored to the user’s behaviour. Upon registration, the user provides the controller with their full name, their date of birth and gender. Additionally, the user is asked to enter their phone number and e-mail address. On the registration page, the new user is informed that by clicking the “Register now” button they consent to the controller’s terms and conditions and they can learn about the collection, sharing, and processing of personal data in the data guidelines of the controller. In these guidelines and in the social media portal’s help section users are being informed that the controller offers the users a personalised experience and state-of-the-art technology to ensure secure and functional operation for everyone. Additionally, the terms and conditions include detailed information about the processing of personal data and why they are necessary for personalising the contents shown to the user. The data subject accepted these terms and conditions that were subsequently changed during the time they used the platform. At first, the controller based its processing on Article 6(1)(b) GDPR. Since 5 April 2023, the controller informed the users the processing was done under Article 6(1)(f) GDPR and offered a possibility to object to the processing. Starting from 3 November 2023, the controller then introduced a consent model. It gave the data subject one of the three following options: either consent to the processing of their personal data for advertising, subscribe to the ad-free version, or leave the platform by deleting the account after possibly obtaining a copy of their data. On 8 November 2023, the data subject consented to the processing of their data for advertising purposes. The data subject filed a lawsuit with the Regional Court Aschaffenburg (Landgericht Aschaffenburg – LG Aschaffenburg) and claimed, inter alia, access to their personal data processed by the controller as well as non-material damages of an amount in the discretion of the court but at least €1,500. The court dismissed the data subject’s claim for access to their personal data because, respectively, the controller either already provided the information that fall under Article 15 GDPR, or the claimed information (i.e. the frequency of processing of the data) did not fall into the scope of Article 15 GDPR. The information that the controller needed to provide had been mainly provided by the data protection guidelines. According to Article 82(2) GDPR there are three eligibility criteria: a processing of personal data which is unlawful under the GDPR; a damage suffered; and a causal connection between the unlawful processing and the damage. The claim for non-material damages under Article 82(1) GDPR was dismissed by the court. The court held that it did not have to decide about whether the controller had violated Article 6 GDPR or Article 15 GDPR because the data subject had not provided sufficient evidence for having suffered a non-material damage. The court recalled that the right to compensation is not limited to severe cases of infringements of the GDPR. However, an infringement of the GDPR in itself does not constitute a non-material damage. An only individually noticeable inconvenience is not sufficient. Despite the broad scope, there has to be a suffered damage according to Recital 146, which required an objectively comprehensible and factually existing damage. This is necessary to avoid solely abstract, non-real consequences. The data subject had not demonstrated to the court a sufficient impact on their personal concerns that were causally linked to the processing by the controller. The loss of control over their personal data, as claimed by the data subject, and the claimed discomfort caused by the processing of their personal data for marketing purposes were found to be not specific enough. The bad feeling about contributing to a business model of the controller that the data subject dislikes did not constitute a damage. The court further held that the statement of the data subject was inconsistent. On the one hand, the data subject alleged discomfort and a negative feeling while on the other hand, they were not willing to pay for the ad-free subscription model to get rid of the advertisement in total and also of the negative feeling. The court furthermore referred to CJEU - C-252/21 and recalled that a monopoly of a social network itself did not automatically render the data subject’s consent invalid. Rather, the users had a freedom of choice when provided with the possibility of paying an appropriate amount of money for an equivalent alternative that does not include such processing of personal data. The controller had implemented this judgement by implementing their consent model with an alternative that included paying a fee. The court concludes that the data subject’s reluctance towards the processing could not have been that great if they chose to consent rather than to pay the fee.