View source for BayLfD (Bavaria) - 221 C 578/22

== English Machine Translation of the Decision ==
The decision below is a machine translation of the German original. Please refer to the German original for more details.

<pre>
facts
The plaintiff demands from the defendant the retransfer of [...] points and damages for violation of the GDPR and the ZAG. The customer [...] loyalty program points is a multi-partner customer loyalty program. The bonus program is free. The participating [...] users have the opportunity to collect so-called points for their purchases from partner companies. The [...] partner companies grant customers who purchase their goods or services and use the program [...] discounts in the form of monetary [...] points. The defendant is the operating company of the program. Each [...] user receives a [...] card for collecting [...] points in the shops of participating partner companies. For this purpose, the card is [...] scanned when paying at the checkout and the partner company automatically credits the customer with the points [...] granted for the respective purchase. In the case of orders placed online, the points are collected when the [...] customer number is entered during the ordering process. The partner companies decide individually how [...] many points a user receives as a discount for a specific purchase. Each point awarded by a Loyalty Merchant has a monetary value of X cents. [...] points can, among other things, be exchanged for bonuses or vouchers. Each [...] user can manage their [...] Points view points. The personal data of the users that can be viewed are: salutation, title, first and last name, postal address, e-mail address, telephone and/or mobile phone number and date of birth. With regard to the purchases, users can see [...] from which partner company they received or redeemed how many points and when. The plaintiff is a customer of the defendant with the customer number [...]. The conditions for participation in the [...] program regulate the following, among other things:[...]The plaintiff was able to log into his customer account by entering the card number in conjunction with his date of birth and postal code. Alternatively, he could verify himself by entering the card number and a four-digit PIN. The PIN always consists of a four-digit number combination. The defendant implemented a documented information security management system. The operation of the data center was regularly audited by independent third parties. On September 5th, 2021, 12....[...] points of the plaintiff were converted into a [...] goods voucher. The point account of the plaintiff with the card number was [...] affected, which has meanwhile been blocked by the defendant. A voucher was [...] generated in the [...] app. On the day in dispute, there were no documented cyber attacks or data protection incidents on the defendant's premises. The plaintiff claims that the 12....[...] points redeemed on September 5th, 2021 for the creation of the vouchers were redeemed without authorization by third parties. The plaintiff never made his access data available to third parties and he himself did not redeem [...] any points online for a goods voucher on September 5th, 2021. Otherwise he did not authorize the payment order. The plaintiff is of the opinion that he has claims for the retransfer of the [...] points according to § 675u S. 2 BGB and §§ 675m S. 1, 2810 Para. 1 BGB. In this respect, the defendant is a payment service provider within the meaning of the standard. Furthermore, such a claim exists according to Section 823 Paragraph 2 BGB in conjunction with Section 55 Paragraph 1 No. 2 in conjunction with 1 Sentence 2 No. 5 ZAG. The plaintiff asserts that Section 55 (1) ZAG is a protective law within the meaning of Section 823 (1) BGB. The issue of the [...] customer card is the issue of payment instruments within the meaning of Section 1 Sentence 22 No. 5 ZAG. The plaintiff asserts that the [...] points of the defendants are e-money. Therefore, the defendant is obliged to demand two-factor authentication. The customer does not receive [...] the points free of charge. The respective customer receives a discount from the retailer during the payment process in the amount of the bonus points achieved. Instead of deducting the discount amount from the purchase price, the customer instructs the retailer to pay them the excess amount as a points credit. The points are issued by the defendant and managed for the customers. A breach of data protection by the defendant can also be seen in the fact that the defendant neglects the minimum requirements for strong customer authentication. When selecting and using the personalized security features, the defendant decided to implement a simple authorization system, which falls short of the security standards of state-of-the-art systems. As a result, the plaintiff lost control of his personal data. The plaintiff asserts that the minimum requirements set by the defendant for the password to be chosen by the customer are unsuitable. A minimum length of 10 characters is considered state of the art. Restricting the usable characters to numbers does not belong to the state of the art. The defendant's previous security precautions were not suitable for guaranteeing a level of protection corresponding to the state of the art. Therefore, there is a claim for damages according to Art. 82 Para. 1 DSGVO. The plaintiff requests: The defendant is sentenced, the plaintiff 12....points, with a value of € [xxx] on their account held with the defendant with the card number. The defendant is ordered to pay the plaintiff an amount of at least € 4,500.00 plus interest therefrom at a rate of 5 percentage points above the base interest rate since pendency. The defendant is ordered to pay the plaintiff its costs to pay €818.72 for out-of-court representation. The defendant requests that the lawsuit be dismissed. The defendant claims that the technical processing of data is based on common and recognized security guidelines that the Federal Office for Information Security specifies. The [xxx] voucher was not redeemed. The defendant also submits that the points debited were credited to the plaintiff on October 7th, 2021. The [xxx] customer loyalty program is not e-money. Strong customer authentication in the form of two-factor authentication therefore does not have to be implemented. The defendant grants an appropriate technical and organizational level of protection for the customer login account within the meaning of Art. 32 Para. 1 DSGVO. The defendant claims that neither the ZAG nor § 675 ff. BGB are applicable in the present case. To supplement the facts, reference is made to all written pleadings of the parties together with attachments, as well as to the minutes of the oral hearing of June 30th, 2022.
</pre>