The Federal Court of Justice (BGH) has ruled in a case of large-scale data theft at Facebook that those affected must meet comparatively low requirements to claim damages. The Sixth Civil Senate ruled that it is sufficient for users to prove they were victims of the incident. Proof of misuse of the stolen data or specific impairments such as fear or concern is not necessary (Ref. VI ZR 10/24).

The verdict has a signaling effect for thousands of similar cases in regional and higher regional courts in Germany. For the first time, the Federal Court of Justice used the new lead decision procedure to clarify fundamental legal questions. This could set the course for future data protection lawsuits.

Presiding Judge Stephan Seiters emphasized that damages remain limited in cases of mere loss of control over personal data. In this case, he mentioned 100 euros as possible compensation. The final clarification of the data protection violation and the amount of damages is now up to the Higher Regional Court of Cologne, which must hear the case again.

In April 2021, data of 533 million Facebook users from 106 countries were published online. The perpetrators exploited a friend search function in the social network. After the incident, numerous affected parties filed lawsuits, which were often dismissed in the first instance.

The parent company of Facebook, Meta, emphasized that there was no data protection breach as the systems had not been hacked. According to Meta, over 6,000 cases have been won so far, corresponding to a success rate of over 85 percent. The stock of Meta Platforms fell slightly on Monday on NASDAQ by 0.31 percent to $552.38.