Germany: Compensation for Facebook data breach victims

Millions of German Facebook users whose data was illegally obtained and leaked in a major security breach are eligible for compensation, Germany’s Federal Court of Justice (BGH) ruled on Monday.
The court in the southwestern city of Karlsruhe, Germany’s highest court for civil cases, said that the basic loss of control over data online was grounds for damages — without plaintiffs having to prove any specific financial losses, misuse of the data or even that they have been particularly concerned.
The BGH declared its ruling to be a guideline decision, meaning it can serve as a precedent for thousands of cases currently going through German courts.
The case revolved around a so-called “scraping” operation in 2018 and 2019 when unknown perpetrators accessed the data of millions of Facebook users via a loophole in the social network’s search function.
At the time, users could be identified by entering their phone numbers into the search bar. Using automated searches for millions of randomly generated telephone numbers, hackers were able to access the data of around 533 million users, which they then leaked in April 2021.
In the specific BGH case in Karlsruhe, the complainant had demanded at least €1,000 ($1,056) in compensation from Facebook parent company Meta.
The higher regional court in the western city of Cologne originally rejected his claim, but will now be obliged to revisit the case and take into account the ruling of the BGH.
While the plaintiff is unlikely to be awarded €1,000 in damages, the BGH did suggest that it would consider a sum nearer €100 to be appropriate.
Meta, which has previously refused to pay compensation on the grounds that those affected had not been able to prove any concrete damages, is remaining bullish.
A spokeswoman claimed the BGH’s ruling was “inconsistent with the recent case law of the European Court of Justice,” the European Union’s highest court.
“Similar claims have already been dismissed 6,000 times by German courts, with a large number of judges ruling that no claims for liability or damages exist,” she said. “Facebook’s systems were not hacked in this incident and there was no data breach.”
mf/msh (Reuters, dpa)