A German court has signaled that people affected by data leaks could be due compensation, in a closely-watched case involving Facebook.

The country’s Federal Court of Justice (BGH) indicated in a preliminary assessment on Monday that losing control over personal data alone might be grounds for damages. The court will announce its judgment on 18 November.

The case, in the Sixth Civil Senate in Karlsruhe, involves tens of thousands of Facebook users suing Meta, alleging insufficient protection of their data due to "scraping" activities. A plaintiff from the Rhineland claims that after a data leak, he faced regular fraud attempts via email, SMS, and phone calls. Judge Stephan Seiters suggested that claimants could be eligible for non-material damages without needing to prove specific financial loss.

It stems from a 2021 data privacy incident when unknown individuals exploited Facebook’s friend search feature to collect sensitive information from over 533 million users, later published online. This data included phone numbers, emails, and birth dates and affected about six million people in Germany. Following the incident, Meta had to enhance its data protection measures and pay substantial fines.

Mass claims

Supported by consumer law firms and legal service providers, tens of thousands of Facebook users in Germany are now pursuing claims against Meta, creating a heavy workload for the courts. According to the German Federal Bar Association, thousands of cases remain pending in lower and appellate courts. Meta has consistently dismissed these claims, arguing that there was no violation of the General Data Protection Regulation (GDPR) and that the plaintiffs did not suffer any direct damage.

Facebook is represented by Freshfields Bruckhaus Deringer, which is handling the large number of cases with its Mass Claim Unit under the leadership of Martin Mekat. According to the law firm, it has obtained more than 6,000 first and second instance judgements dismissing claims, which would correspond to a success rate of over 85%.

However, WBS Legal, representing the plaintiffs, disputes these figures, pointing to around 250 successful judgments on its website.

The specific proceedings are being conducted by WBS partner Christian Solmecke. He expects that the BGH judgment will exert enormous pressure on all companies to take data protection even more seriously in future, “especially as the courts from other European countries will certainly also take note of this BGH decision and decide accordingly”, he said. “This day is therefore a very good day for data protection in the EU!”

Alongside the Cologne-based firm, Kraus Ghendler Ruvinskij (Cologne), CLLB (Munich), Dr. Stoll & Sauer (Lahr), and Rightmart (Bremen) are also representing many plaintiffs in cases against Meta.

The BGH also took the case as an opportunity to test the new possibility of the so-called ‘leading decision procedure’, which was only created in October in order to relieve the courts in mass proceedings. This procedure allows courts to address key legal questions affecting numerous lawsuits, even when appeals are withdrawn for reasons of procedural tactics or due to a settlement.

This is what happened in the scraping case. At the beginning of October, a decision date had to be canceled because Meta had apparently reached an agreement with the plaintiffs shortly beforehand. As a result, thousands of cases remained in limbo and a possible limitation period for claims at the end of the year drew closer.

How much is a data protection breach worth?

On Monday, the BGH leaned in favor of consumer rights, emphasizing that the right to informational self-determination and data privacy protection had been violated. Plaintiff lawyer Solmecke therefore now sees greater opportunities for those affected by the Facebook data leak to claim up to €1,000 in non-material damages,

German courts have previously awarded damages in such cases inconsistently, often considering the extent of the claimant’s distress from data misuse.

In the current case, the Bonn Regional Court initially awarded the plaintiff only €250 at first instance. So far, awards in Facebook scraping cases have ranged from €50 to €1,000.

Legal service providers and plaintiff law firms argue that high compensation claims are justified by the loss of data control, even if no direct harm occurred. Recently, the European Court of Justice (ECJ) also ruled in a Bulgarian case that a temporary loss of control over personal data is sufficient to claim non-material damages.