Court case VI ZR 67/23 – Court Ruling (Germany, 2025)

The controller is the operator of a debt collection company that serves clients from the energy sector, among others. On 16 July 2019, the controller notified SCHUFA, a credit information agency, of a claim against the data subject by his electricity supplier that was enforced by an order issued by the local court on the same day. On 12 November 2019, SCHUFA deleted the negative entry made on the basis of a report. The data subject filed a case with the court of first instance (Regional Court Mainz-VG Mainz) claiming that the controller’s notification of the claim to SCHUFA was unlawful because the controller did not wait for the objection period of the enforcement order to expire before doing so. The negative score created by SCHUFA as a result of the controller’s notification led to massive economic consequences and disadvantages for him, including the termination of his credit cards by his bank and the threat of failure of real estate financing. At first instance, the data subject requested, among other things, that the controller be ordered to pay him damages at least €10,000. The court of first instance partially granted his application and ordered the controller to pay him €5,000. Both parties appealed before the court of appeal (Higher Regional Court Koblenz-OLG Koblenz). The court of appeal dismissed the action in full. It held that the data subject failed to demonstrate that compensable immaterial damage had occurred. A mere threat of material damage or the fear of material damage is not sufficient in itself if no further consequences result from this, which was not apparent in the present case and was not substantiated by the data subject. It is not apparent how the alleged termination of his credit cards by the bank actually impaired the data subject’s economic freedom of disposition or how other infringements had occurred his general lifestyle. Overall, he failed to demonstrate how the "damaging event" specifically affected him. The data subject appealed the decision of the court of appeal before the Federal Court of Justice. First, the Federal Court, referring to existing case law, held that non-material damage suffered by the data subject within the meaning of Article 82(1) GDPR is not dependent on a certain degree of seriousness.[https://curia.europa.eu/juris/liste.jsf?num=C-590/22 ECJ, judgments of June 20, 2024 - C-590/22, DB 2024, 1676 para. 26 - PS GbR]; [https://curia.europa.eu/juris/liste.jsf?num=C-741/21 of April 11, 2024 - C-741/21, NJW 2024, 1561 para. 36 - juris; of May 4, 2023 - C-300/21, VersR 2023, 920 para. 51 - Austrian Post] Nevertheless, the data subject has to demonstrate concrete negative effects.[https://curia.europa.eu/juris/liste.jsf?num=C-590/22 ECJ, judgments of 20 June 2024 - C- 590/22, DB 2024, 1676 para. 27 - PS GbR]; [https://curia.europa.eu/juris/liste.jsf?num=C-741/21 of 11 April 2024 - C-741/21, NJW 2024, 1561 para. 36 - juris]; see also [https://juris.bundesgerichtshof.de/cgi-bin/rechtsprechung/document.py?Gericht=bgh&Art=pm&Datum=2024&nr=139818&linked=urt&Blank=1&file=dokument.pdf Senate judgment of November 18, 2024 - VI ZR 10/24, BGHZ 242, 180 para. 29] It also pointed out that the mere loss of control over the data subject’s personal data is considered harm even if no misuse of the data in question has actually taken place to the detriment of data subjects.[https://curia.europa.eu/juris/liste.jsf?num=C-200/23 ECJ, judgment of October 4, 2024 - C-200/23, DB 2024, 2952 para. 145 mwN] Second, the court held that the data subject had sufficiently demonstrated the occurrence of immaterial damage within the meaning of Article 82(1) GDPR in the form of an impairment of his creditworthiness and thus his (economic) good reputation. The data subject's loss of reputation due to the impairment of his creditworthiness as a result of the SCHUFA report at issue had manifested itself in the termination of the credit card agreements and the threat of termination of the entire business relationship by the bank. This already demonstrated the occurrence of immaterial damage within the meaning of Article 82(1) GDPR. The court further determined that due to the negative SCHUFA entry, the data subject’s credit cards had been blocked and remained blocked despite the deletion of the negative entry. Plus, between the registration and the deletion of the entry, there was also a threat of failure of a real estate financing. Therefore, the data subject adequately proved that he suffered concrete negative effects which were attributable to the notification at issue. Third, due to the unlawful transmission of his data to SCUFA, the data subject also asserted immaterial damages against the controller in the form of loss of control over his data. Any involvement of the data subject in the creation of the negative score is irrelevant to the question of whether he suffered non-material damage. In this respect, the existence of non-material damage eligible for compensation under Article 82(1) GDPR cannot be denied on the grounds that the data subject only settled the claim enforceable by the enforcement order after it was issued. In conclusion, the Federal Court held that the reasoning of the court of appeal that the data subject had not sufficiently demonstrated the occurrence of non-material damage within the meaning of 82(1) GDPR was legally incorrect. The appeal judgment was therefore set aside and the case was referred back to the court of appeal for a new hearing and decision.