- Enforcing jurisdiction
- Germany · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Court case 16 U 45/23 – Court Ruling (Germany, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A German court ruled on a case involving a social network where user data was scraped. The court found that while there was a GDPR infringement, the user did not suffer damages, which is significant for understanding the implications of data scraping.
What happened
User data was scraped from a social network, leading to a legal challenge.
Who was affected
The user whose data was scraped was affected by this incident.
What the authority found
The court held that there was a GDPR infringement, but no damages were awarded to the user.
Why this matters
This case illustrates the challenges in proving damages in data protection cases. It serves as a reminder for users to be cautious about their data on social platforms and for companies to enhance their data security measures.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 19 March 2026.
Processing notes: authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject has used an account in a social network operated by the controller. Upon registration, the data subject voluntarily entered his mobile phone number. As a default setting, a user profile could be found through the search function by entering the user's phone number, even if the number was not made visible for the person searching for the number. Furthermore, the social network included a contact import function that allowed users to import contacts from their smartphone and thus find other users among his phone contacts. To avoid being searchable for other users through one’s phone number, the user had to open and change the settings of the social network. The described functions made it possible to search for automatically generated phone numbers on the platform. If a generated number matched a user’s profile, the profile was shown. Thus, the scrapers knew that the number was really existing and in use and could link this number to the other data the data subject made public on the platform. Starting from January 2018, unknown persons obtained large amounts of account data and matching phone numbers, including the account data of the data subject. In 2021, these data could be found on the internet. The controller confirmed to the data subject in September 2021 that according to their information personal data of the data subject (the user ID, first and last name, and gender) were scraped from the platform. With his lawsuit, the data subject claimed, inter alia, non-material damages from the controller. The court held that, in the case at hand, despite an infringement of the GDPR there was no damage. The possibility of scraping user data from the platform amounted to processing of personal data under Article 4(2) GDPR. The court held, that the availability of the phone numbers for scraping does not fall under Article 6(1)(b) GDPR since this data processing is not strictly necessary for the performance of the contract between the parties. The data p
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 16 U 45/23 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
31 October 2024
Authority
DPA LGKrefeld
About this data
Cite as: Cookie Fines. Court case 16 U 45/23 - Germany (2024). Retrieved from cookiefines.eu
Last updated: