The Federal Court of Justice in Germany ruled on Monday that users of the social network Facebook, whose data were exposed in a “scraping” incident in April 2021, may be entitled to compensation.

The claim arose from a suit against Meta, the operator of Facebook, in which a plaintiff sued the company for failing to take sufficient security measures to prevent his information from being exploited by unknown third parties. The incident affected around 533 million Facebook users from 106 countries.

The court, ruling on revision (appeal), partially accepted the plaintiff’s claims for compensation for non-material damage. The revision succeeded in claims for declaration of liability for future damages, an injunction against using his telephone number without his consent, and compensation of his pretrial legal costs. Reversing the appeals court’s reasoning, the Federal Court ruled that the plaintiff had a legitimate interest in the declaration of liability for future damages since the possibility of future damages exists under the circumstances of the case.

Initially, the plaintiff had been awarded damages of €250 by the regional court under Article 82(1) of the General Data Protection Regulation (GDPR), with the rest of the claim being dismissed. On appeal at the higher regional court, the entire claim was dismissed along with the plaintiff’s cross-appeal. This was because the plaintiff had not adequately demonstrated psychological impairment beyond the loss of control, and the court held that mere loss of control was not sufficient to constitute non-material damage under Article 82(1) GDPR.

The Federal Court decided that under Article 82 paragraph 1 of the GDPR, even the mere and short-term loss of control over one’s personal data as a result of a violation of the GDPR can constitute non-material damage. The Court also provided guidance on the assessment of non-material damage and explained why there were no legal objections to assessing the compensation for the mere loss of control at a level of €100.

The matter has been referred back to the Court of Appeal for a new hearing and decision, where the Court of Appeal will need to examine, among other things, whether the plaintiff had given effective consent to Facebook’s data processing, and whether Facebook’s default searchability setting of “all” complied with the principle of data minimization.