Berlin: Facebook users in Germany impacted by data breaches in 2018 and 2019 are entitled to compensation, according to a ruling by Germany’s Federal Court of Justice (BGH) on Monday.
The court emphasized that the loss of control over personal data constitutes grounds for damages, even without evidence of specific financial losses. This decision paves the way for thousands of Facebook users to demand compensation from Meta for failing to adequately protect their data.
Background and Legal Challenges
The case revolves around a 2021 data breach where unknown third parties accessed user accounts by exploiting the Facebook friend search feature. The breach, reportedly affecting six million people in Germany, involved sensitive data obtained by guessing phone numbers.
Initially, a lower court in Cologne dismissed claims related to the breach. However, the BGH has now mandated a re-examination, indicating that users are eligible for damages, albeit modest.
The plaintiff in the case sought €1,000 ($1,056) in compensation, but the court deemed €100 a reasonable sum in cases lacking proof of financial loss.
Legal Considerations
The BGH has tasked the lower court with evaluating whether Facebook’s terms of use were transparent and whether users voluntarily consented to their data being used. This inquiry could set a precedent for how data privacy laws are enforced in Germany and the European Union.
Meta, the parent company of Facebook, has resisted compensation claims, arguing that affected users have failed to demonstrate tangible damages.
A Meta spokesperson criticized the BGH’s decision, stating it contradicted recent rulings by the European Court of Justice (ECJ), which they claim is the highest authority on such matters.
Also Read | Tesla Rises on Reports of Federal Self-Driving Regulations Under Trump Team
“Similar claims have already been dismissed 6,000 times by German courts, with a large number of judges ruling that no claims for liability or damages exist,” the spokesperson said. “Facebook’s systems were not hacked in this incident, and there was no data breach.”
Implications for Data Protection
This landmark ruling could embolden individuals across Europe to seek compensation for data breaches, even in cases where financial losses are not apparent. As regulators and courts grapple with the complexities of data privacy, the decision reinforces the importance of transparent terms and voluntary user consent.
