BGH - VI ZR 67/23

BGH - VI ZR 67/23
Court:	BGH (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 82(1) GDPR
Decided:	13.05.2025
Published:
Parties:
National Case Number/Name:	VI ZR 67/23
European Case Law Identifier:
Appeal from:	OLG Koblenz (Germany) 12 U 2194/21
Appeal to:	Unknown
Original Language(s):	German
Original Source:	BGH (in German)
Initial Contributor:	Le

The Federal Court of Justice held that the impact on the data subject's creditworthiness and the loss of control over their data were deemed immaterial damages. The case was referred back to the previous instance for a decision on the merits.

English Summary

Facts

The controller is the operator of a debt collection company that serves clients from the energy sector, among others.

On 16 July 2019, the controller notified SCHUFA, a credit information agency, of a claim against the data subject by his electricity supplier that was enforced by an order issued by the local court on the same day. On 12 November 2019, SCHUFA deleted the negative entry made on the basis of a report.

The data subject filed a case with the court of first instance (Regional Court Mainz-VG Mainz) claiming that the controller’s notification of the claim to SCHUFA was unlawful because the controller did not wait for the objection period of the enforcement order to expire before doing so. The negative score created by SCHUFA as a result of the controller’s notification led to massive economic consequences and disadvantages for him, including the termination of his credit cards by his bank and the threat of failure of real estate financing.

At first instance, the data subject requested, among other things, that the controller be ordered to pay him damages at least €10,000. The court of first instance partially granted his application and ordered the controller to pay him €5,000. Both parties appealed before the court of appeal (Higher Regional Court Koblenz-OLG Koblenz).

The court of appeal dismissed the action in full. It held that the data subject failed to demonstrate that compensable immaterial damage had occurred. A mere threat of material damage or the fear of material damage is not sufficient in itself if no further consequences result from this, which was not apparent in the present case and was not substantiated by the data subject. It is not apparent how the alleged termination of his credit cards by the bank actually impaired the data subject’s economic freedom of disposition or how other infringements had occurred his general lifestyle. Overall, he failed to demonstrate how the "damaging event" specifically affected him.

The data subject appealed the decision of the court of appeal before the Federal Court of Justice.

Holding

First, the Federal Court, referring to existing case law, held that non-material damage suffered by the data subject within the meaning of Article 82(1) GDPR is not dependent on a certain degree of seriousness. Nevertheless, the data subject has to demonstrate concrete negative effects. It also pointed out that the mere loss of control over the data subject’s personal data is considered harm even if no misuse of the data in question has actually taken place to the detriment of data subjects.

Second, the court held that the data subject had sufficiently demonstrated the occurrence of immaterial damage within the meaning of Article 82(1) GDPR in the form of an impairment of his creditworthiness and thus his (economic) good reputation. The data subject's loss of reputation due to the impairment of his creditworthiness as a result of the SCHUFA report at issue had manifested itself in the termination of the credit card agreements and the threat of termination of the entire business relationship by the bank. This already demonstrated the occurrence of immaterial damage within the meaning of Article 82(1) GDPR. The court further determined that due to the negative SCHUFA entry, the data subject’s credit cards had been blocked and remained blocked despite the deletion of the negative entry. Plus, between the registration and the deletion of the entry, there was also a threat of failure of a real estate financing. Therefore, the data subject adequately proved that he suffered concrete negative effects which were attributable to the notification at issue.

Third, due to the unlawful transmission of his data to SCUFA, the data subject also asserted immaterial damages against the controller in the form of loss of control over his data. Any involvement of the data subject in the creation of the negative score is irrelevant to the question of whether he suffered non-material damage. In this respect, the existence of non-material damage eligible for compensation under Article 82(1) GDPR cannot be denied on the grounds that the data subject only settled the claim enforceable by the enforcement order after it was issued.

In conclusion, the Federal Court held that the reasoning of the court of appeal that the data subject had not sufficiently demonstrated the occurrence of non-material damage within the meaning of 82(1) GDPR was legally incorrect. The appeal judgment was therefore set aside and the case was referred back to the court of appeal for a new hearing and decision.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

VI ZR 67/23
Leader,
Certified Copy
FEDERAL COURT OF JUSTICE
IN THE NAME OF THE PEOPLE
JUDGMENT Delivered on:
May 13, 2025
Judicial Officer
as Registrar
of the Registry
in the legal dispute
Plaintiff and Appellant,
vs.
GmbH, represented by the Managing Director
Defendant and Respondent,
2
The Sixth Civil Senate of the Federal Court of Justice, following the oral hearing
on May 13, 2025, by Presiding Judge Seiters, Judges
Dr. Oehler and Müller, Judge Böhm, and Judge Dr. Linder
Hereby ruled:
Upon the plaintiff's appeal, the judgment of the 12th Civil Senate of the
Koblenz Higher Regional Court of February 13, 2023, is set aside with regard to costs
and to the extent that the claim under item 4 (claim for
payment of damages) was dismissed. To the extent of the set aside, the case is remanded to the
Court of Appeal for a new hearing and decision, including on the costs of the appeal proceedings.
As a matter of law
Facts:
The plaintiff is suing the defendant, to the extent relevant to the appeal proceedings, for compensation for non-pecuniary damages resulting from a negative report submitted by the
defendant to Schufa Holding AG (hereinafter SCHUFA).
The defendant operates a debt collection agency that serves clients from the energy sector, among others. On July 16, 2019, she reported a claim against the plaintiff by the plaintiff's electricity supplier, which had been enforced by an enforcement order issued by the Hagen District Court on the same day, to SCHUFA. SCHUFA deleted the negative entry made as a result of the report on November 12, 2019.
3
3
The plaintiff claims that the notification of the claim enforced by the enforcement order to SCHUFA was unlawful because the defendant did not at least wait for the expiration of the objection period.
The negative entry created by SCHUFA as a result of the defendant's report led to massive economic consequences and disadvantages for him, some of which have continued to the present.
4 In the first instance, the plaintiff requested, among other things, that the defendant be ordered to pay him reasonable damages, the amount of which would be left to the court's discretion, but should be at least €10,000 plus interest (claim no. 4). The Regional Court partially granted this request and ordered the defendant to pay €5,000 plus interest. Both the plaintiff and the defendant have appealed against this decision, the plaintiff seeking an order that the defendant pay further damages of at least €5,000, and the defendant seeking a complete dismissal of the action. The Higher Regional Court dismissed the plaintiff's appeal and, following the defendant's appeal, dismissed the action in its entirety. With his appeal on points of law, which was granted by the Court of Appeal, the plaintiff continues to pursue his claim for damages. 5
Reasons for the Decision:
In justifying its decision, the Court of Appeal (ZD 2024, 41) stated, among other things, that, insofar as the plaintiff is seeking compensation for the damages he claims to have suffered as a result of the allegedly unjustified registration, it is not possible to discern any non-material damage that would require compensation under Article 82 (1) of the General Data Protection Regulation (GDPR). A violation of the General Data Protection Regulation does not, in itself, lead to non-material damage that must be compensated; rather, some kind of non-material damage must actually have occurred. However, the plaintiff has not sufficiently demonstrated this.
Insofar as the plaintiff claims that there was a threat of a real estate financing transaction failing, it should be noted that, fortunately, such damage apparently did not occur. A merely threatened or feared material damage by the affected party is not sufficient in itself if no further consequences arise, which is not apparent in this case and has not been substantiated by the plaintiff.
The alleged cancellation of credit cards by D. Bank and the resulting inconveniences for the plaintiff, as well as the "cancellation" of the initiated business relationship with another credit card provider, should not be denied, nor should the alleged fact that the termination of the entire business relationship with D. Bank and thus also the immediate maturity of the existing credit liabilities there have been imminent. However, with regard to the unavailability of the aforementioned credit cards, it is not clear whether and to what extent this circumstance actually affected the plaintiff's financial freedom of choice, i.e., whether he had, for example, additional credit cards that guaranteed his usual financial independence even during the "strained business relationship" with D. Bank (which lasted only a few weeks). It is also not clear, and the plaintiff has not substantiated it, whether and to what extent compromising and/or other personal rights-violating events occurred in the context of his general lifestyle as a result of the "loss" of the D. Bank credit cards. It is not overlooked that such restrictions
and/or impairments may have only been avoided because the
plaintiff, according to his own statements, has a solid, regular income
and lives in orderly and secure financial circumstances, and may have only been due to the absence of further consequences of the alleged violations of the General Data Protection Regulation in question, whereas a similar violation would have led to further impairments for persons in other life situations. However, the actual individual circumstances of the "injured party" must be taken into account for the question of whether compensable damage exists. The focus must be on the specific impact of the "damaging event" on him. In this respect, the plaintiff does not meet his burden of proof by arguing that the unauthorized disclosure of data was likely to significantly reduce his creditworthiness and impede his participation in economic life. The same applies to the plaintiff's claims that he invested approximately 20 hours in correspondence, telephone calls, etc. Regardless of the fact that this blanket claim lacks any substance, the specific circumstances that give the matter its own character must be taken into account in the present case. The alleged injustice that the plaintiff suffered, or could have suffered, as a result of the registration with SCHUFA does not result from the defendant having reported the enforced liability at all, but rather can be seen in the fact that the plaintiff was not given sufficient opportunity to counteract this measure because, according to his claim, he was not warned in advance and informed of the consequences. The fact that the "registerable" debit position came about at all, however, is not attributable to the defendant, but rather to the plaintiff, who only settled the claim after it had been enforced. 9 In this situation, it does not appear justifiable to consider every inconvenience
and effort as a claimable damage. The fact that in
cases of default in repaying liabilities, personal
annoyance and complications in relations with creditors and/or lending institutions can arise, with the consequence that resolving such a situation requires a certain degree of financial and/or time expenditure, represents a general risk of life, the management of which does not
already require a low-threshold compensation under the law of damages.
11.
10 These considerations do not stand up to review under the law of appeal.
Based on the reasoning of the appeal court, the plaintiff's claim against the defendant for compensation for non-material damages pursuant to Art. 82 GDPR cannot be denied. The sole assumption underlying the appeal judgment, namely that the plaintiff had not sufficiently demonstrated the occurrence of non-material damage within the meaning of Article 82 (1) GDPR as a result of the defendant's alleged violation of the Regulation when reporting the claim against the plaintiff to SCHUFA, is legally incorrect. 11 1. In the absence of a reference in Article 82 (1) GDPR to the domestic law of the Member States, the term "non-material damage" is to be defined autonomously under EU law within the meaning of this provision (established case law,
ECJ, judgments of June 20, 2024 - C-590/22, DB 2024, 1676, para. 31 - PS GbR;
7
of January 25, 2024 - C-687/21, CR 2024, 160, para. 64 - MediaMarkt-Saturn; of
May 4, 2023 - C-300/21, VersR 2023, 920, paras. 30 and 44 - Österreichische Post).
According to Recital 146, sentence 3 of the GDPR, the concept of damage should be interpreted broadly, in a manner that fully complies with the objectives of this Regulation. However, according to the case law of the Court of Justice, a mere violation of the provisions of the General Data Protection Regulation is not sufficient to establish a claim for damages; rather, the occurrence of damage (as a result of this violation) is required – as an independent prerequisite for a claim (established case law, see ECJ, judgments of June 20, 2024 – C-590/22, DB 2024, 1676, para. 25 – PS GbR; of April 11, 2024 – C-741/21, NJW 2024, 1561, para. 34 – juris; of May 4, 2023 – C-300/21, VersR 2023, 920, para. 42 – Österreichische Post; see also Senate judgment of November 18 2024 - Vl ZR 10/24, BGHZ 242, 180 para. 28).
12 The Court has further stated that Article 82(1) GDPR precludes a
national rule or practice that makes compensation for non-material damage within the meaning of that provision dependent on the damage caused to the data subject reaching a certain degree of
gravity or significance (ECJ, judgments of 20 June 2024 - C-590/22, DB 2024, 1676 para. 26 - PS GbR; of 11 April 2024 - C-741/21, NJW
2024, 1561 para. 36 - juris; of 4 May 2023 - C-300/21, VersR 2023, 920 para. 51
- Österreichische Post). However, the Court also stated that, under Article 82(1) GDPR, this person is obliged to prove that he or she has actually suffered damage. The rejection of a materiality threshold
does not mean that a person affected by a breach of the General Data Protection Regulation that has had adverse consequences for them is exempt from proving that these consequences constitute non-material damage within the meaning of
Article 82 of that Regulation (ECJ, judgments of June 20, 2024 - C-590/22, DB 2024, 1676 para. 27 - PS GbR; of April 11, 2024 - C-741/21, NJW
8
2024, 1561 para. 36 - juris; see also Senate judgment of November 18, 2024 - VI ZR
10/24, BGHZ 242, 180 para. 29).
13 The exemplary list of "harm" that may be caused to data subjects contained in the first sentence of Recital 85 of the General Data Protection Regulation shows that the EU legislature intended the term "harm" to include, in particular, the mere "loss of control" over their own data as a result of a breach of the General Data Protection Regulation, even if there had been no actual misuse of the data in question to the detriment of those data subjects
(see ECJ, judgment of October 4, 2024 - 0-200/23, DB 2024, 2952 para. 145
with further references).
14 2. Accordingly, the Court of Appeal correctly assumed that the affected party seeking compensation for non-material damage must assert (and, if necessary, prove) that the violation of the General Data Protection Regulation has had negative consequences for them, constituting non-material damage. However, the appeal on the law rightly complains that the Court of Appeal placed excessive demands on the plaintiff's duty of substantiation in this regard.
15 a) Regarding the negative consequences of the defendant's SCHUFA report, which he contested, the plaintiff stated, among other things, that he relies on credit cards for his professional activities, without which he would be practically unable to act. However, due to the negative SCHUFA entry, his credit cards were blocked. The cancellation of his credit card issued by D. Bank was upheld despite the deletion of the negative entry. In his own credit score created by D. Bank, he was still reported as insufficiently creditworthy due to the negative SCHUFA entry.
9
The contract he had initially concluded with another provider for a new credit card was canceled due to a negative report from D. Bank. The termination of the entire business relationship threatened by D. Bank would have led to the due date of liabilities amounting to €67,000 and to wage garnishment. Between the entry and the deletion of the entry,
the collapse of a real estate financing deal had also threatened. 16 b) With this argument – which the appeal court assumed to be correct – the plaintiff has sufficiently demonstrated the occurrence of non-material damage within the meaning of Art. 82 (1) GDPR in the form of an impairment of his creditworthiness and thus his (economic) reputation (cf. Recitals 75 and 85 GDPR) (cf. Senate judgment of January 28, 2025 - VI ZR 183/22, ZIP 2025, 518, para. 12). Contrary to what the appeal court apparently assumes, he did not merely refer to the abstract suitability of the disclosed data to reduce his creditworthiness and hinder his participation in economic life, but rather, by referring to the termination of the credit card contracts and the threat of termination of the entire business relationship by D. Bank, he identified specific negative effects that, according to his claim, are attributable to the notification in dispute.
17 To the extent that the Court of Appeal considers the termination of the credit card agreements irrelevant, arguing that it is not clear whether and in what way this circumstance actually impaired the plaintiff's financial freedom, since he may have had additional credit cards that guaranteed his accustomed financial independence even during the "troubled business relationship" with D. Bank, the appeal rightly objects that this speculation, in violation of the principle of presentation of evidence, finds no support in the parties' established pleadings. Rather, the efforts described by the plaintiff to obtain replacement for the credit card agreements terminated by D. Bank speak against the assumption that the plaintiff was not dependent on D. Bank's credit cards to maintain his financial freedom. Furthermore, the appeal court's reasoning fails to recognize that, according to the plaintiff's submission, the plaintiff's loss of reputation due to the impairment of his creditworthiness as a result of the disputed SCHUFA report had already manifested itself in the termination of the credit card contracts and the threat of termination of the entire business relationship by D. Bank. This already constitutes the occurrence of non-material damage within the meaning of Article 82 (1) GDPR. 18 Further negative consequences due to the (threatened) terminations may
further exacerbate this damage, but were not necessary here to establish the requirements for a claim for damages under Art. 82 (1) GDPR (see, in this respect, the Senate judgments of November 18, 2024 - Vl ZR 10/24,
BGHZ 242, 180, para. 31; of February 11, 2025 - Vl ZR 365/22, juris, para. 15, regarding non-material damage within the meaning of Art. 82 (1) GDPR in the form of loss of control). For
the same reason, contrary to the opinion of the Court of Appeal, the occurrence of non-pecuniary damage cannot be denied on the grounds that the plaintiff did not substantiate whether and to what extent
compromising and/or other personal injury-infringement events occurred in the context of his general life as a result of the "loss" of the D. Bank credit cards.
19 c) Apart from that, by arguing that the defendant had improperly transmitted his personal data to a third party (here, SCHUFA) in violation of the General Data Protection Regulation, the plaintiff also alleged non-material damage in the form of the so-called loss of control over his data (cf. Senate judgments of January 28, 2025 - VI ZR 183/22, ZIP 2025, 518, para. 12; of February 11, 2025 - VI ZR 365/22, juris para. 16).
20 3. Contrary to the opinion of the appeal court, the existence of non-material damages compensable under Art. 82 GDPR cannot be denied on the grounds that the plaintiff only settled the claim established by the enforcement order after the order had been issued, which is why it is attributable to him that a "registerable" debit amount even arose. The appeal rightly points out in this respect that any possible involvement of the plaintiff in its occurrence is irrelevant to the question of whether the plaintiff suffered non-material damages.
Ill.
21 The appeal judgment was therefore set aside in its operative part, and the case was remanded to the appeal court for a new hearing and decision (Section 562 (1), Section 563 (1) Sentence 1 of the Code of Civil Procedure).
Seiters Oehler Müller
Böhm Linder
Lower courts:
Mainz Regional Court, decision of November 12, 2021 - 3 0 12/20 -
Koblenz Higher Regional Court, decision of February 13, 2023 - 12 U 2194/21 -
Certified:
, Legal Assistant
as Registrar of the Registry