BGH strengthens claims for damages after Facebook data theft

In the legal dispute over claims for damages resulting from data theft on Facebook, the Federal Court of Justice has strengthened the position of those affected. This decision has far-reaching implications for numerous lawsuits before regional and higher regional courts.

Victims of the extensive data theft at Facebook can now assert claims for damages with comparatively minimal requirements. It is sufficient to prove that they were affected by the incident. It is neither necessary to prove the misuse of the data nor do those affected have to prove that they were particularly adversely affected by the incident.

The Federal Court of Justice (BGH) has made use of the new option of leading decision proceedings for the first time. This supreme court decision is now of great significance for thousands of similar cases at regional and higher regional courts in Germany. However, the presiding judge of the sixth civil senate, Stephan Seiters, emphasized that the damages awarded for a mere loss of control could not be excessive. Seiters cited an amount of 100 euros as an example. The lower court, the Higher Regional Court (OLG) of Cologne, had rejected the claim for damages. This decision was overturned by the BGH, and the case was remanded to the Higher Regional Court of Cologne for further clarification. The Higher Regional Court must now further investigate the facts of the case, which had previously been omitted due to the blanket rejection of claims.

Personal data of 533 million users surfaced on the Internet

In April 2021, data from approximately 533 million Facebook users from 106 countries was published online. The perpetrators had accessed the data via the "Find Friends" function by entering random phone numbers and accessing users' personal information if matches were found. The published connection data includes first and last names, country, gender, phone number, and, in some cases, employer.

Following the incident, numerous lawsuits were filed, most of which have so far been unsuccessful in state and higher regional courts. Facebook's parent company, Meta, consistently defended itself by claiming the lawsuits were unfounded. After last week's hearing, the company's lawyers emphasized that the incident did not constitute a data breach and that Facebook's systems had not been hacked.