Wave of lawsuits foreseeable: 5,000 euros in damages due to Meta Business Tools

Meta Platforms is to pay 5,000 euros in damages to a German Facebook user. The reason is the Meta Business Tools embedded in countless websites and apps. These collect personal data that Meta compiles for user profiling. According to the Regional Court of Leipzig, Meta is in massive breach of European data protection law and is making billions in profits from personalized advertising. An average Facebook user is entitled to 5,000 euros in damages for this (case no. 05 O 2351/23).

"Every user is individually identifiable to Meta at all times as soon as they visit the third-party websites or use an app, even if they have not logged in via the Instagram and Facebook account," summarizes a press release from the Leipzig Regional Court. "Without exception, Meta Ireland (the Meta Platforms branch in the EU, note) sends the data to third countries worldwide, in particular to the USA. There, it analyzes the data to an extent unknown to the user."

The processing of personal data is "particularly extensive", involves "potentially unlimited amounts of data" and results in the "almost complete monitoring of the user's online behavior". According to a ruling by the European Court of Justice (ECJ), this leads to a feeling of continuous surveillance of one's entire private life. And for this, those affected would be entitled to non-material damages under European law.

The ECJ ruling C-252/21, issued in 2023, is probably part of a legal dispute between the data group and the German Federal Cartel Office. In case C-300/21 ("Österreichische Post"), the ECJ recognized that the GDPR does not set a materiality threshold for damages, but that there must be a causal link between the infringement and the damage. The German Federal Court of Justice

Higher than usual

While other German courts have so far relied on national law against violations of personal rights, the 5th Civil Chamber of the Leipzig Regional Court refers exclusively to Article 82 of the European General Data Protection Regulation (GDPR). It thus arrives at a significantly higher amount of damages than previously usual in Germany: 5,000 euros. By way of comparison, the Regional Court of Stuttgart awarded EUR 300 in a similar case in February (case no. 27 O 190-23). The German Federal Court of Justice has deemed EUR 100 to be appropriate compensation for loss of control over one's own data due to unauthorized scraping of Facebook profiles (case no. VI ZR 10/24); on this basis, the Federation of German Consumer Organizations (vzbv) is organizing a joint lawsuit by German users against Facebook.

Meta Platforms can and will probably appeal against the current ruling from Leipzig in order to prevent an expensive wave of lawsuits by tens of thousands of Germans. The 5th Civil Chamber in Leipzig is well aware that such a development is quite foreseeable: its ruling could lead to many Facebook users filing lawsuits without explicitly stating their individual damages. However, it is precisely through private actions before civil courts that the GDPR can be effectively enforced, beyond the work of data protection authorities.

Legal points of attack

The original text of the decision from July 4 is not yet available. The court's press release (which should be treated with caution with regard to legal details) suggests potential points of attack. For example, the court refers to Meta Platforms' high advertising revenues in the three-digit billion range and emphasizes that the financial value of comprehensive personal profiles in data processing markets is enormous. It remains unclear what these facts have to do with the severity of the non-material damage suffered by the plaintiff.

Incidentally, the regional court did not ascertain the specific non-material damage and the causal link with the GDPR infringement. It did not question the plaintiff because it was of the opinion that he could only talk about a "generally rather diffuse feeling of data loss and uncertainty". "The court therefore bases its minimum compensation of EUR 5,000 on the general concern of the attentive and reasonable 'average' data subject within the meaning of the GDPR." Whether the plaintiff is affected on average remained unsubstantiated.

At the same time, Meta must attempt to fight the judgment in principle and not just in terms of the amount. Even a reduction in damages to a tenth would encourage tens of thousands of Germans to seek compensation for their losses. heise online has invited Meta Platforms to comment.

(ds)