Court case 14 O 472/23 – Court Ruling (Germany, 2025)

The data subject, a user of a popular music streaming service (the controller), sued the controller after her personal data (such as her name, email address, and usage preferences on the platform) was exposed in the darknet. After the controller's service provider (the processor) mishandled the data by transferring it to an unsecured environment it was accessed by hackers and published on the darknet. The contract between the controller and the processor concluded in 2020 while the breach occurred in 2022 affecting data sets dated back until 2019. The incident was reported to the French DPA (CNIL) in November 2022 but individual notifications were sent out only in early 2023. The contract had specific requirements for maintenance of adequate security measures and data deletion. The controller admitted that a data breach occurred but claimed it was caused by actions outside their control and post termination of the contract and that they relied on the announcement made by the processor that all their data would be deleted. They also argued that former employees of the processor mishandled the data after the service contract was terminated. The data subject argued that the breach led to significant distress. She noticed an increase in phishing and spam emails targeting her and reported that the breach caused anxiety, sleep disturbances, and a lot of time spent securing her online accounts and changing passwords. The data subject also raised concerns that the controller failed to provide timely information about the breach. The company advised users to change their passwords as a precaution but did not give the data subject the full information she had a right to under GDPR, particularly regarding what specific data was affected and who accessed it. The court held that the controller failed to properly monitor its data processor's compliance with data protection obligations according to Article 28 GDPR, especially concerning the deletion of personal data. The controller did not request confirmation of the actual deletion of data within the required 21-day period after contract termination. This failure led to potential data security risks and ultimately contributed to a hacking incident. The data processor only sent a vague announcement of deletion, not a formal, detailed confirmation. The controller should have obtained written confirmation of data deletion and could have followed up with further checks, such as an on-site inspection, but did not do so. The court held that Under Article 82(1) GDPR, compensation is available for both material and immaterial damage, and while the data subject did not present material damage, she successfully claimed immaterial damage due to the loss of control over her personal data. In line with previous rulings - especially the BGH's lead decision in the Facebook scraping case the court found that the mere loss of control over the data constitutes an immaterial damage. The court assessed this immaterial damage to be compensated by €100 concluding that this amount was reasonable and sufficient and rejecting higher compensation based on psychological harm, as the data subject did not provide sufficient evidence of psychological impairments, such as anxiety or sleep disorders, beyond the loss of control. General concerns about spam or phishing were considered part of this loss of control, and the court noted that the data subject failed to substantiate her claims with medical evidence, ultimately limiting compensation to €100. The court also determined that the controller must compensate any future material damages. This is based on the fact that the data subject’s right to control their personal data has been violated and is still at risk of further misuse, meaning the potential for future harm is real and not just hypothetical. The court also clarified that this includes future non-material damages, which may not be foreseeable at this point but are part of the ongoing harm caused by the breach.