Lübeck Regional Court: Liability of the controller under Art. 82 GDPR in the event of a data leak

January 7, 2025

Categories:

Data protection in Germany

In a ruling dated October 4, 2024, the Regional Court of Lübeck dealt extensively with the Liability in accordance with Art. 82 General Data Protection Regulation (GDPR) in the event of data protection violations. The decision contains key principles on the imputability of unlawful data processing, on the interpretation of the concept of damage and on the possibilities of exculpation for data controllers. The central question was under what conditions a controller is liable for infringements that are attributable to the actions of a processor or sub-processor.

Data leak from sub-processor

The defendant, operator of a music streaming platform in Europe, had transferred customer data to a processor, which in turn worked together with a sub-processor. However, there was no agreement between the processor and the sub-processor pursuant to Art. 28 GDPR. GDPR required agreement.

After the defendant terminated the cooperation with its processor, a data leak occurred at the sub-processor in which personal data were stolen and subsequently published on the darknet. The data concerned included first and last name, user name, date of birth, email address, data on the use of the D. service, gender, language and country. The UserID, i.e. a sequence of numbers assigned by the defendant, which is individually assigned to individual users, was also affected.

The plaintiff, a user of the defendant's streaming platform, claimed non-material damages and argued that it was afraid of its data being misused due to the data leak. In addition, the publication of the data on the darknet was considered an independent violation of their right to Informational self-determination to be assessed.

Reading tip: BSI updates minimum standards for logging cyber attacks

Court: Unlawful data processing pursuant to Art. 82 GDPR to be interpreted broadly

Attribution of the responsible party to infringement
The court found that the concept of participation in unlawful data processing under Art. 82 GDPR should be interpreted broadly. It is sufficient that the Responsible persons in the sense of a conditio sine qua non was involved in the series of events that led to the act that caused the damage. "The concept of participation in unlawful data processing according to the GDPR does not necessarily require that the Responsible persons itself was directly involved in the process that ultimately caused the damage", according to the Regional Court.

In the present case, the court considered the defendant to be involved in the unlawful transfer of data to a data processor that was not subject to sufficient obligations. The lack of a contract pursuant to Art. 28 para. 4 GDPR justified the unlawfulness of the data transfer.

Possibility of exculpation of the person responsible
According to Art. 82 para. 3 GDPR a responsible party can exculpate themselves by proving that they are not at fault. However, the court emphasized that this also applies to its own contribution to the cause. The defendant was unable to prove that the transfer of the data to the processor was not its fault. In particular, it was negligent, personal data without sufficient examination of the recipient's data protection obligations.

"If the surrender was made negligently, the person responsible is liable. Responsible persons even if he was not directly involved in the event that caused the damage," the judges concluded.

Definition of damage and compensability of immaterial damage
The court followed the previous case law of the European Court of Justice (ECJ), according to which non-material damage within the meaning of Art. 82 GDPR could also lie in the justified concern of a possible misuse of data. There is no de minimis limit. The plaintiff's fears and concerns - for example about phishing attacks - were recognized as compensable immaterial damage.

Furthermore, the court found that the publication of personal data on the darknet constituted an independent damage. This violation of the right to Informational self-determination was deemed to be a loss of control over the company's own data, giving rise to damages.

Assessment of damages
The court awarded the plaintiff compensation for pain and suffering in the amount of 350 euros. In doing so, it took into account the publication of sensitive personal data and the resulting anxiety. On the other hand, no significant financial loss had been incurred and the data had only allowed limited conclusions to be drawn about the plaintiff's person.

Responsible persons bear an increased risk of Liability

The judgment of the Regional Court of Lübeck clarifies the strict requirements of the GDPR to the responsibility of companies in the Processing of personal data. The expansion of the concept of participation and the extensive attribution of actions by third parties, including those contrary to instructions, increase the liability risks for Responsible persons considerable.

The recognition of immaterial damage in the form of fears and worries as well as the categorization of the loss of control over personal data as an independent loss mark a further step in the development of the Liability according to Art. 82 GDPR. This makes it necessary for companies to implement comprehensive technical, organizational and contractual measures in order to comply with data protection obligations and minimize liability risks.

Source: Judgment of the Regional Court of Lübeck (15 O 216/23) dated 04.10.2024

Do you need support in optimizing your data protection processes? We are at your disposal. Contact us and we will develop customized solutions for you in the following areas Data protection and Compliance.

Get in touch with us:
Phone: +1 (954) 852-1633
E-Mail:info@2b-advice.com

Now new: the intelligent Ailance™ chatbot

Answers to your questions about data protection & Compliance and Ailance™ solutions at the click of a button. This is now possible thanks to the new Ailance™ chatbot.