Facebook data leak: BGH treats loss of control as damage

In what is known as scraping, unknown persons used Facebook's contact import function: using randomly generated telephone numbers, they matched numbers to user profiles and extracted publicly visible data. The data of around 533 million users was affected. In the claimant's case, his name, user ID, place of work and gender were linked to his telephone number.

In its judgment of 18.11.2024 – VI ZR 10/24, the BGH (Federal Court of Justice) held that the mere and brief loss of control over one's own personal data as a result of an infringement of the GDPR can in itself constitute non-material damage within the meaning of Art. 82(1) GDPR. Neither a specific misuse of the data nor any additional noticeable negative consequences need to be proven. A person who sets out the loss of control does not have to substantiate any particular fears or concerns.

As to the amount, the BGH indicated that a sum in the region of 100 euros may readily be appropriate for the mere loss of control. Where there are additional specific consequences, a higher amount may be considered.

The judgment does not concern Facebook alone. It gives everyone affected by a data leak a basis for claiming damages, even if they cannot prove that their data was misused. However, you must set out the loss of control yourself: your data must actually have come into the hands of third parties. The mere possibility is not sufficient.