GDPR Damages Claims in German Courts

GDPR damages claims: the legal basis

GDPR damages claims are based on Article 82(1) of the General Data Protection Regulation (GDPR): any person who has suffered material or non-material damage as a result of an infringement of the Regulation has the right to receive compensation from the controller or processor. Controllers are liable for damage caused by processing that infringes the GDPR; processors are liable where they have not complied with their specific obligations or acted outside the controller's lawful instructions (Article 82(2)).

A controller or processor is exempt only if it proves that it is not in any way responsible for the event giving rise to the damage (Article 82(3)). German courts hear thousands of such claims each year, from individual access-request disputes to mass claims after data breaches and scraping incidents.

For companies, GDPR damages claims have become a significant litigation risk. Individual awards are often modest, but the number of potential claimants after a data incident can be very large, legal tech providers and law firms solicit claimants actively, and consumer associations can bring collective actions. Understanding what German courts require — infringement, damage, causation — is key to managing exposure. The answers also shape how companies design their security, their responses to data subject requests and their communication after incidents, because each of these influences whether claims arise and how much they are worth.

Three requirements: infringement, damage, causation

The Court of Justice of the European Union (CJEU) has clarified the requirements in a series of judgments since 2023. In its judgment of 4 May 2023, Österreichische Post, C-300/21, it held that a mere infringement of the GDPR is not sufficient for a claim: the claimant must show actual damage and a causal link. At the same time, there is no threshold of seriousness — national courts may not require that non-material damage reach a certain level of severity.

Later judgments confirmed that fear of misuse of personal data can constitute non-material damage if it is well-founded, that the claimant bears the burden of proving damage, and that compensation serves to compensate, not to punish.

The BGH scraping judgment: loss of control as damage

The leading German decision is the Federal Court of Justice's (Bundesgerichtshof, BGH) judgment of 18 November 2024 – VI ZR 10/24, concerning the scraping of data from a social network. Unknown third parties had used a contact import function to match randomly generated phone numbers to user profiles and harvested public profile data of around 533 million users. The claimant demanded non-material damages for annoyance and loss of control over his data. The court of appeal had rejected the claim because the claimant had not shown psychological impairment beyond the loss of control.

The BGH had designated the case as a lead decision procedure under the new § 552b of the Code of Civil Procedure, designed to give guidance in mass litigation, and then decided on the merits.

According to the BGH press release, following CJEU case law, even the mere and short-term loss of control over one's personal data as a result of a GDPR infringement can be non-material damage; neither concrete misuse of the data nor other additional noticeable negative consequences are required. The BGH remanded the case and indicated that, under the circumstances, there were no legal objections to assessing compensation for the mere loss of control in the order of EUR 100.

It also noted that the default setting of the search function to "everyone" was unlikely to comply with the data minimisation principle.

Typical GDPR damages claims in Germany

German courts deal with GDPR damages claims in several recurring constellations:

• Data breaches and cyber attacks: claims for loss of control and fear of misuse after hacking or ransomware incidents, often in large numbers.
• Scraping and platform practices: claims against social networks and online services.
• Access requests: employees and customers claim damages for late or incomplete answers to access requests under Article 15 GDPR — often as leverage in employment or commercial disputes.
• Credit agencies and scoring: claims related to unlawful credit data entries or automated decisions.
• Employee data: claims for unlawful monitoring, disclosure of health data or transfers within groups.
• Marketing and tracking: claims for unsolicited marketing emails or tracking without consent.
• Data transfers: claims based on transfers to third countries without adequate safeguards, often following regulatory decisions against the controller.

Employment courts are particularly active, because employees often combine data protection claims with other claims: the Federal Labour Court has dealt with claims based on Article 82 GDPR in employment relationships, and employees regularly add such claims in dismissal proceedings. See our insight on employee data protection after the CJEU.

Material damage, injunctions and other remedies

Material damage — financial loss such as costs of replacing cards, fraud losses, lost income or costs of legal advice — is compensable if proven. In practice, most claims concern non-material damage, but data breaches involving payment data or identity documents can lead to concrete financial losses. Claimants often combine damages claims with claims for injunctions against further processing, deletion, information about the data processed and recipients, and declarations that the controller is liable for future damage. In the scraping case, the BGH allowed both a declaratory claim for future damage and an injunction concerning use of the claimant's phone number without consent to proceed.

Jurisdiction and limitation

Data subjects can sue a controller or processor in the courts of the Member State where it has an establishment or, alternatively, where the data subject has its habitual residence, unless the controller is a public authority acting in the exercise of its public powers (Article 79(2) GDPR).

Foreign companies offering services to German users can therefore be sued in Germany. Within Germany, claims of consumers are brought before the local or regional courts depending on the value, and employees bring claims before the labour courts. GDPR damages claims are subject to the regular three-year limitation period running from the end of the year in which the claimant learned of the infringement and the damage; see our insight on limitation periods.

Mass claims and collective redress

After large data incidents, claimants are often organised by law firms or legal tech platforms, sometimes with litigation funding. Consumer associations can bring injunction actions and, since 2023, redress actions under the Consumer Rights Enforcement Act (VDuG), which allow registered consumers to obtain compensation in one procedure. Data protection claims are suited to collective treatment where the infringement is uniform and damages are standardised, as the BGH's EUR 100 benchmark suggests. See our insights on redress actions under the VDuG and litigation funding.

How courts assess the amount

Within the framework set by the CJEU and the BGH, courts consider the type and sensitivity of the data, the duration and extent of the loss of control, the likelihood of misuse, actual consequences such as spam, phishing attempts or identity misuse, and the claimant's individual circumstances. Health data, financial data and identity documents generally weigh more heavily than names or email addresses. The controller's degree of fault is not a factor in the amount of compensation, because Article 82 GDPR does not serve a punitive function. Claimants who rely on standardised pleadings without individual facts frequently fail to prove more than the minimum, while well-documented individual cases can lead to higher awards.

Defence strategy for companies

1. Challenge the infringement: document security measures and legal bases; Article 32 GDPR requires appropriate, not perfect, security, and the CJEU has held that a breach by third parties does not in itself prove that measures were inappropriate.
2. Contest damage and causation: require claimants to substantiate their loss of control or other consequences individually; template pleadings often lack individual facts.
3. Use the exoneration defence where possible: show that the company is not in any way responsible for the event.
4. Manage access requests: many claims arise from late or incomplete responses — robust processes prevent them.
5. Coordinate mass claims: consider lead cases, settlement programmes and insurance coverage.
6. Align with regulatory proceedings: statements to authorities and courts must be consistent; see our insight on GDPR fines in Germany.

Insurance and incident response

Cyber insurance policies often cover defence costs and sometimes damages payments for third-party claims after data incidents. Companies should check notification requirements, sub-limits and coverage for mass claims, and whether the policy covers claims arising from processors' incidents as well as their own. Good incident response — fast containment, accurate notifications to authorities and data subjects, and clear communication — reduces both the number of claims and the damages courts award, because it limits the loss of control and the grounds for fear of misuse. See our insight on incident response after a cyber attack.

Practical checklist after a data incident

• Preserve evidence of the security measures in place and of the incident's cause, including logs and forensic reports.
• Assess which data categories and how many data subjects are affected, and whether and for how long loss of control occurred.
• Notify the supervisory authority within 72 hours where required and inform data subjects where the risk is high.
• Prepare template responses for claimant letters, access requests and media inquiries.
• Inform insurers promptly, check coverage for third-party claims and agree on defence counsel.
• Monitor the market for claim aggregators and prepare for collective proceedings, including the possibility of a VDuG redress action by a consumer association.

How TRW & Co helps with GDPR damages claims

We defend companies against individual and mass GDPR damages claims in civil and labour courts, including claims after data breaches, scraping incidents and disputes over access requests. Our work covers defence strategy and pleading templates for high volumes, lead-case management, settlement programmes and coordination with insurers and supervisory authorities. We also help companies prevent claims through data subject request processes and incident response planning. See our page on GDPR and data protection or contact us.