BGH Scraping Ruling: Loss of Control as Damage

What the BGH scraping ruling decided

In the BGH scraping ruling of 18 November 2024 (VI ZR 10/24), the Federal Court of Justice held that the mere loss of control over one's personal data as a result of a breach of the General Data Protection Regulation (GDPR) can constitute non-material damage under Article 82(1) GDPR. Neither concrete misuse of the data nor any other noticeable negative consequences for the person concerned is required. The court indicated that, in the circumstances of the case, compensation of around EUR 100 for the mere loss of control would not raise legal concerns.

The decision, summarised in the court's press release No. 218/2024, concerned the 2021 Facebook scraping incident in which data of about 533 million users from 106 countries were published online.

The BGH scraping ruling is significant for two reasons. Substantively, it lowers the threshold for GDPR damages claims in Germany, aligning German courts with the CJEU's case law that rejects a de minimis threshold. Procedurally, it was the first case designated for the new lead-judgment procedure at the Federal Court of Justice, introduced to deal with mass proceedings. For companies that suffer data breaches, the ruling makes claims by large numbers of affected individuals more likely, even if each claim is small. It also matters for companies that are not platforms: any controller holding customer, employee or patient data can face the same type of claim after a breach, whether caused by hacking, misconfiguration or scraping.

The facts: the Facebook scraping incident

The defendant operates the social network Facebook. Depending on users' searchability settings, the platform allowed profiles to be found using a telephone number. Unknown third parties exploited this by entering randomly generated number sequences on a large scale via the contact import function, matching telephone numbers to user accounts and harvesting the publicly visible data of those accounts. In April 2021, data of about 533 million users were published on the internet. The claimant's user ID, first and last name, workplace and gender were among them, now linked to his telephone number.

The claimant argued that the platform had not taken adequate security measures to prevent misuse of the contact tool. He claimed compensation for non-material damage because of annoyance and loss of control over his data, a declaration of liability for future damage, an injunction and information. The Regional Court of Bonn awarded EUR 250 under Article 82(1) GDPR and otherwise dismissed the claim. On appeal, the Higher Regional Court of Cologne dismissed the claim entirely, holding that mere loss of control was not damage and the claimant had not shown psychological impairment beyond it.

Holdings of the BGH scraping ruling

The claimant's appeal on points of law was partly successful. Relying on the CJEU's interpretation of Article 82(1) GDPR, the BGH held that even a brief loss of control over personal data resulting from a GDPR infringement can be non-material damage. It is not necessary that the data has been misused to the detriment of the person concerned, nor that other noticeable negative consequences have occurred. Where a claimant alleges further harm, such as anxiety, that harm can increase the compensation but must be shown.

The court also allowed the claims for a declaration of liability for future damage, since future damage was possible in the circumstances, for an injunction against using the claimant's telephone number beyond his consent, and for pre-trial legal costs.

It referred the case back to the Higher Regional Court, with two indications. First, the default setting of searchability to "everyone" probably did not comply with the principle of data minimisation, although the court of appeal still had to examine whether the claimant had validly consented. Second, on the assessment of damages under § 287 of the Code of Civil Procedure, compensation for mere loss of control could, in the circumstances, be set at around EUR 100.

The first lead-judgment procedure

By order of 31 October 2024, the BGH designated the appeal as a lead-judgment procedure (Leitentscheidungsverfahren) under the newly introduced § 552b of the Code of Civil Procedure. The instrument allows the BGH to decide legal questions relevant to a large number of proceedings even if the parties withdraw or settle the appeal, a tactic that had previously prevented the court from deciding contested questions in mass litigation. In this case, the appeal was not withdrawn, and the court decided by ordinary judgment after an oral hearing on 11 November 2024. Nevertheless, the designation signalled the court's intention to provide guidance for thousands of pending scraping cases.

For defendants in mass litigation, the lead-judgment procedure reduces the scope for avoiding precedent by settling individual appeals. Lower courts can stay similar proceedings pending a lead decision, which can accelerate the resolution of large dockets once the BGH has spoken.

The link to the CJEU's case law

The BGH scraping ruling builds on a series of CJEU judgments on Article 82 GDPR. The CJEU has held that a mere infringement of the GDPR does not by itself give rise to a right to compensation, that damage must be shown, but that there is no threshold of seriousness for non-material damage.

The CJEU has also recognised that the fear of possible misuse of data following a breach can be non-material damage, and that loss of control over data can constitute damage. Compensation under Article 82 serves a compensatory, not a punitive, function. National courts determine the amount under their own procedural rules, which in Germany means an estimate under § 287 ZPO.

The BGH applied these principles consistently. By naming a figure of around EUR 100 for mere loss of control, it gave lower courts a reference point, while leaving room for higher amounts where claimants prove additional harm, such as specific misuse, spam calls or identity theft attempts that can be traced to the breach.

Scraping, platform design and security obligations

The facts of the case illustrate a typical scraping risk. The data harvested was in principle visible to other users, but the platform's contact import function allowed automated matching of telephone numbers to profiles on a massive scale. The BGH scraping ruling suggests that controllers must consider such misuse scenarios when designing features and default settings.

Under Article 25 GDPR, controllers must implement data protection by design and by default, so that by default only personal data necessary for each specific purpose are processed and personal data are not made accessible to an indefinite number of persons without the individual's intervention. Under Article 32 GDPR, security measures must be appropriate to the risk, which includes protection against automated abuse of legitimate functions.

In practice, this means measures such as rate limiting, detection and blocking of automated queries, restrictive default visibility settings, careful design of search and import features and regular penetration testing. Platforms and other services that allow users to find each other by identifiers such as telephone numbers or e-mail addresses should assess whether those functions can be abused for enumeration attacks. Where scraping is detected, controllers must assess whether it constitutes a personal data breach requiring notification to the supervisory authority within 72 hours under Article 33 GDPR and possibly communication to affected individuals under Article 34 GDPR.

Defending GDPR damages claims after the BGH scraping ruling

The low threshold for damage does not mean that every claim succeeds. Claimants must still prove a GDPR infringement, that their own data were affected and that the infringement caused the loss of control. Defendants can contest each element: whether the controller's measures were appropriate at the relevant time, whether the claimant's data was already publicly available through the claimant's own choices, whether consent covered the processing, and whether the alleged additional harm is credible and causally linked. Template pleadings used in mass claims often contain generic allegations that do not withstand scrutiny in individual cases.

The amount of damages is another lever. With around EUR 100 as a reference for mere loss of control, the economics of individual claims change, and courts may scrutinise claims for higher amounts more closely. Cost risk under German procedural rules, where the losing party bears statutory fees, influences both sides. Defendants should monitor how lower courts apply the BGH's guidance and adapt settlement and litigation strategies accordingly, while ensuring consistency across jurisdictions where similar claims are pursued.

Consequences for companies

The decision affects every controller processing personal data at scale. First, security measures and privacy-friendly default settings under Article 25 GDPR are not only regulatory requirements but also the basis of civil liability. Second, the threshold for damages claims is low, so claims are viable for mass claim providers, especially when combined with declarations for future damage and injunctions. Third, collective redress under the Consumer Rights Enforcement Act allows consumer associations to bundle claims, which may become more attractive after the ruling.

Companies should also consider the interaction with fines. Supervisory authorities can impose fines for the same breaches, and following the CJEU's Deutsche Wohnen judgment, fines can be addressed directly to the company if negligence is shown. A coordinated approach to regulatory proceedings and civil claims, including consistent factual positions, is essential. Insurance should be reviewed as well: cyber policies often cover breach response costs and third-party claims, but conditions on notification, consent to settlements and exclusions for regulatory fines vary, and the number of potential claimants after a large breach can exhaust limits quickly.

How TRW & Co helps

We advise companies on data security, privacy by default and breach response, and we defend them against GDPR damages claims, including mass claims and collective actions. We assess exposure after incidents, coordinate notifications to authorities and data subjects, and develop litigation strategies for large dockets. Our work connects with our GDPR and collective actions practices; see also our notes on GDPR damages claims, data breach notification and the Deutsche Wohnen fines judgment. Please contact us to discuss your exposure. This briefing is general information, not legal advice.