There has recently been a huge rise in litigation regarding claims for non-material damages following breaches of data privacy (Article 82(1) GDPR) in Germany. Given the lack of rulings by the highest courts on many unanswered legal questions on Article 82(1) GDPR, national courts often rely on precedents. Our Noerr GDPR Damages Tracker shows you at a glance how the case law on non-material damages following a data privacy breach is evolving.

Overview of case law on non-material damages following a data privacy breach

Our Noerr GDPR Damages Tracker, available at www.gdprdamages.com and www.damagestracker.com (currently in German only), shows you at a glance the case law of German courts on non-material damages under Article 82(1) GDPR.

A few trends are already visible in case law:

In the past, claims for damages following breaches of data privacy were initially rarely enforced. After a decision by the Federal Constitutional Court in early 2021, however, claimant-friendly case law has been established on non-material damages following data privacy breaches.

Many current decisions by German courts show a very broad concept of damages eligible for compensation. Exclusion of liability for minor damage is often no longer considered. Some courts even find that damage has occurred if the person affected simply felt uncomfortable, afraid or anxious.

The courts are broadly in agreement that when calculating the compensation-amounts for a damage, the compensation must be complete and effective. A growing proportion of decisions are also pointing to a necessary deterrent function of the claim for damages. Corresponding judgments, some awarding damages of up to €5,000 per claim, may encourage more and more people to file claims for damages following data privacy breaches in future.

Questions referred to the CJEU

The Court of Justice of the European Union (CJEU) will shortly clarify some outstanding legal questions as part of the pending referral questions on Article 82(1) GDPR (see examples here and here). In particular, the CJEU will decide whether minor damage can be compensated and whether the claim for damages is also intended to have a deterrent effect.

If the CJEU confirms the broad understanding of certain German courts, this could trigger a mass filing of claims for damages for data privacy breaches.

Risk of mass proceedings

Private legal service providers see the opportunity for a new, lucrative business model in non-material damages claims after data privacy breaches. Data privacy breaches often affect a large number of people equally. This results in potential mass claims, for which collective enforcement makes sense. Legal service providers can probably build on their experience from other mass proceedings such as cartel damages, the diesel issue or the withdrawal issue in consumer loan agreements.

Besides, data leaks and other data privacy breaches have long been events of general interest. Media reporting on these topics focus the attention of a broad section of the public on possible data privacy breaches and can push affected persons into the arms of private legal service providers.

Collective redress will therefore probably also become relevant in the area of data privacy law in the future. The potential new class action and group action models will increase the risk for companies further.

Data privacy litigation at Noerr

Given the rising tide of litigation, it is more important than ever for companies to tackle the challenges, opportunities and risks of data protection litigation early on and strategically. Our well coordinated teams of acknowledged market experts can support them with this.

Our Noerr 360° approach offers you holistic advice to make sure that (in the best-case scenario) you avoid breaching data privacy in the first place. We advise clients rapidly and with legal security on prevention, such as introducing robust data privacy governance, or in designing legally compliant processing activities. But even if worst comes to worst, we assist our clients in defending against official orders and dealing with damage claims. Given the high profile of data privacy breaches in the media, we also offer support with reputation management and the strategic use of PR with the help of our partners.

Link: Noerr GDPR Damages Tracker