Data protection because of Facebook scraping? Finally at the BGH!

The VI. Civil Senate, which is responsible for legal disputes regarding claims arising from the General Data Protection Regulation, will hear two appeals on October 8, 2024. Civil Senate will hear two appeals on October 8, 2024, in which the question arises as to what claims data subjects are entitled to whose data was obtained by unknown third parties in the course of scraping and disseminated on the internet.

VI ZR 22/24

The defendant operates the social network Facebook. At the beginning of April 2021, data from around 533 million Facebook users from 106 countries was publicly distributed on the internet. Unknown third parties had previously taken advantage of the fact that, depending on the searchability settings of the respective user, the defendant makes it possible for the user’s Facebook profile to be found using their telephone number. The unknown third parties used automated tools to upload telephone numbers on a large scale via the defendant’s contact import function, merged them, if they were linked to a user account, with the publicly accessible data linked there and then accessed this data (so-called scraping).

This scraping incident also affected the plaintiff’s data (user ID, first and last name, country and gender), which was also linked to his telephone number in this way. The plaintiff claims that the defendant did not take sufficient security measures to prevent the contact tools from being exploited. He is entitled to compensation for immaterial damages due to the annoyance he has suffered and the loss of control over his data. He had suffered anxiety, stress, loss of comfort and time. In addition, the plaintiff seeks a declaration that the defendant is obliged to compensate him for all future material and immaterial damages in this connection and claims injunctive relief and information from the defendant. The defendant rejected the asserted claims because there was neither a breach of the General Data Protection Regulation nor had the plaintiff suffered any causal damage.

The landgericht dismissed the action. On the plaintiff’s appeal, the Higher Regional Court found that the defendant is obliged to compensate the plaintiff for all future material and immaterial damages that he has suffered and/or will suffer as a result of unauthorized access by third parties to the defendant’s data archive. It also dismissed the plaintiff’s appeal. To the extent of the dismissal of the appeal, the plaintiff continues to pursue his originally asserted claims with the appeal allowed by the Court of Appeal.

VI ZR 7/24

In the case underlying these proceedings, another plaintiff claims that personal data (telephone number, Facebook ID, name, place of residence, country and employer) was scraped by unknown third parties and published on the darknet in the course of his use of the social network Facebook. He is seeking compensation for non-material damages because the defendant violated the General Data Protection Regulation in several respects and did not adequately protect his data. He has suffered a considerable loss of control over his data and remains in a state of great discomfort and concern about the misuse of his data. In addition, he seeks a declaration that the defendant is obliged to compensate him for all future damages in this connection and asserts further claims for injunctive relief and information.

The landgericht dismissed the action. The Higher Regional Court dismissed the plaintiff’s appeal against this decision. With the appeal allowed by the Court of Appeal, the plaintiff continues to pursue his claim.