The Federal Court of Justice (Bundesgerichtshof, BGH) has announced that it intends to issue a landmark ruling in the form of a key decision in litigation over claims for damages following the massive Facebook data leak discovered in 2021. The VI Civil Senate, which is responsible for claims arising from the General Data Protection Regulation (GDPR), makes use of a completely new legal option. According to provisions introduced on October 24 in the German Code of Civil Procedure (ZPO), the Federal Court of Justice can elevate an appeal case pending before it to a main decision case, if the appeal raises legal questions whose decision is important for numerous procedures.

Anzeige

Tens of thousands of Facebook users around the world have sued parent company Meta for mining personal data. The controversial technology is used to automatically read publicly accessible data en masse from websites or open interfaces (APIs) and process it on a large scale. In the case of personal data, this is prohibited under the GDPR without the explicit consent of the data subject. The cases before the Federal Court of Justice concern that around 533 million records with personal information of Facebook users from 106 countries appeared online in 2021.

Previously, unknown third parties had taken advantage of the fact that Facebook allowed, depending on the user’s search settings, to locate a profile through its phone number. Using automated tools, they uploaded phone numbers on a large scale through the network operator’s contact import function, merged them with publicly accessible information linked to a user account, and then accessed this data. The Irish data protection authority, DPC, fined Meta 2022 €265 million as a result of the incident.

Anxiety, stress, loss of comfort and time.

In Germany, plaintiffs argued before several state courts that Meta had not adopted sufficient security measures to prevent the exploitation of contact tools. They are entitled to compensation for non-material damage due to the inconvenience suffered and the loss of control over their own data. They had suffered anxiety, stress, loss of comfort and loss of time.

Meta is also obliged to compensate for all future material and non-material damages and to issue a cease and desist statement. The defendant rejected the claims made because there was no violation of the GDPR. The plaintiffs had also not suffered any demonstrable causal damage.

Often agreements instead of sentences

The higher regional courts evaluated claims for damages differently and several appeals ended up before the Federal Court of Justice (ref. file: VI ZR 22/24, VI ​​ZR 7/24 as well as VI ZR 10/24 and VI ZR 186/24). Meta then tried to avoid Supreme Court rulings: the American group offered the plaintiffs out-of-court settlements, which they accepted. Until now the BGH had its hands tied.

However, the new provisions of the ZPO now allow Karlsruhe judges to make a decision on legal issues, even if an appeal has already been dismissed on procedural grounds. This is intended to allow rapid clarification by the higher court despite the withdrawal of appeals for tactical reasons or due to an agreement. A corresponding landmark ruling should then have a signal effect, especially for other possible lawsuits.

The Cambridge Analytica scandal sends its regards

with the corresponding enhanced appeal procedure VI ZR 10/24The VI Civil Senate now wants to clarify, for example, whether the default setting of Meta to “everyone” when implementing the contact import function constitutes a violation of the GDPR. It will also be examined whether the mere loss of control over the data extracted and now linked to the mobile telephone number of the data subject concerned is sufficient to justify non-material damage within the meaning of the Regulation, and what form compensation could take. The Federal Court of Justice has scheduled an oral hearing for November 11, 2024.

The intense disputes surrounding Facebook date back to the Cambridge Analytica scandal that broke out in 2018. In 2019, 419 million relevant data records also appeared on the Internet. Meta sued companies such as Voyager Labs and Bright Data, specialized in scraping, in California in early 2023. The parent company of Facebook and Instagram accuses them of creating tens of thousands of fake profiles on Facebook alone and of collecting publicly visible data on the social network’s users on a large scale, thus spying on those affected and the service. Bright Data responded with a countersuit, as the public data on the platforms is not owned by Meta. Furthermore, the company itself had used the services of Bright Data.

(nie)