Court case Az. VI ZR 396/24 – Court Ruling (Germany, 2025)

The controller is a music streaming service, which used an external processor until December 2019. At the time of termination of the contract, the processor informed the controller that all the personal data it was processing would be deleted. The controller never followed up on this communication to conduct the appropriate checks. It was discovered that the processor actually did not delete the data until 2023, and that from 2022 the users data were sold on the darknet. The controller informed the data subjects as soon as it knew about the incident. One of the data subjects affected sought compensation for immaterial damages. The Regional Court dismissed the claim, which was confirmed by the Court of Appeals. The court did establish that the controller failed to comply with its obligations to carefully monitor its processor. Still, they also reasoned that the data subject did not suffer any immaterial damages as a result of it. It assessed that receiving spam emails cannot account as a damage, and that fears and anxiety are normal everyday feelings that cannot amount to damages, especially after 2 years from the data breach. The rationale was that the further away from the event, the lower the probability of an actual damage occurring. Moreover, the fear was also resulting from the fact that the data subject was also hacked before in an unrelated incident, so no causal link could be established. The data subject filed an appeal to the Federal Court of Justice. The court upheld the appeal, and sent the judgement back to the court of appeals for it to award appropriate damages to the data subject. The court explained that a claim for damages under Article 82(1) needs, cumulatively, 1. A GDPR breach 2. The existence of an immaterial damage 3. A causal link between damage and breach. The breach of the controller’s obligations under Article 28 and Article 32 GDPR had already been established previously. Establishing the damage was more complicated. The court explained how the CJEU had already established that a claim for damages under Article 82 is admissible for infringements of Article 32 GDPR. The court of appeals’ finding that no immaterial damages were found did not take this into account. First of all, the data subject suffered a loss of control over their data, which was then misused (as it was sold on the darknet), which has to be construed as a immaterial damage. Legislation also pointed in this direction: Recital 146 GDPR affirms that “damage” must be interpreted broadly - a mere GDPR breach is not sufficient, it has to cause damage. Case law also affirmed that mere loss of control over one’s data as a result of a GDPR breach is sufficient. Other GDPR recitals also confirmed this, more specifically Recitals 75 and 85, reporting loss of control as a possible damage, even if no specific misuse follows from it. In any case, the fact that there was a misuse of the data subject’s data leaves no doubt about the presence of a damage. The misuse, in particular, was the unauthorised transfer to third parties, in the form of selling the data subject’s data on the darknet. It followed that the fears and anxieties of the data subject were not hypothetical but well founded; Thus, immaterial damage can be assumed at least from the point where the data subject’s data was sold on the darknet. In general, the court explained that the requirement for demonstrating fear of data misuse must not be excessive – the more plausible the misuse, the lower the requirements for fear of data misuse. The court of appeals erroneously assumed a threshold that cannot be applicable. Finally, the presence of a causal link cannot be dismissed because of previous hacking to the detriment of the data subject. The court agrees with the data subject that compensation for immaterial damages should be awarded, and refers the case back to the court of appeals.