LG Aschaffenburg - 62 O 88/23

LG Aschaffenburg - 62 O 88/23
Court:	LG Aschaffenburg (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 82(1) GDPR Article 82(2) GDPR Article 15(1) GDPR
Decided:	26.08.2024
Published:	08.10.2024
Parties:
National Case Number/Name:	62 O 88/23
European Case Law Identifier:
Appeal from:
Appeal to:
Original Language(s):	German
Original Source:	Gesetze-Bayern (in German)
Initial Contributor:	la

A court held that the bad feeling about contributing to the business model of a social media platform does not constitute a non-material damage under Article 82 GDPR.

English Summary

Facts

The data subject is a client of the controller that operates two social media platforms which allow users to create their own profile and share it with friends. The controller earns money through personalised ads which are tailored to the user’s behaviour. Upon registration, the user provides the controller with their full name, their date of birth and gender. Additionally, the user is asked to enter their phone number and e-mail address.

On the registration page, the new user is informed that by clicking the “Register now” button they consent to the controller’s terms and conditions and they can learn about the collection, sharing, and processing of personal data in the data guidelines of the controller.

In these guidelines and in the social media portal’s help section users are being informed that the controller offers the users a personalised experience and state-of-the-art technology to ensure secure and functional operation for everyone. Additionally, the terms and conditions include detailed information about the processing of personal data and why they are necessary for personalising the contents shown to the user.

The data subject accepted these terms and conditions that were subsequently changed during the time they used the platform. At first, the controller based its processing on Article 6(1)(b) GDPR. Since 5 April 2023, the controller informed the users the processing was done under Article 6(1)(f) GDPR and offered a possibility to object to the processing. Starting from 3 November 2023, the controller then introduced a consent model. It gave the data subject one of the three following options: either consent to the processing of their personal data for advertising, subscribe to the ad-free version, or leave the platform by deleting the account after possibly obtaining a copy of their data.

On 8 November 2023, the data subject consented to the processing of their data for advertising purposes.

The data subject filed a lawsuit with the Regional Court Aschaffenburg (Landgericht Aschaffenburg – LG Aschaffenburg) and claimed, inter alia, access to their personal data processed by the controller as well as non-material damages of an amount in the discretion of the court but at least €1,500.

Holding

The court dismissed the data subject’s claim for access to their personal data because, respectively, the controller either already provided the information that fall under Article 15 GDPR, or the claimed information (i.e. the frequency of processing of the data) did not fall into the scope of Article 15 GDPR. The information that the controller needed to provide had been mainly provided by the data protection guidelines.

According to Article 82(2) GDPR there are three eligibility criteria: a processing of personal data which is unlawful under the GDPR; a damage suffered; and a causal connection between the unlawful processing and the damage.

The claim for non-material damages under Article 82(1) GDPR was dismissed by the court. The court held that it did not have to decide about whether the controller had violated Article 6 GDPR or Article 15 GDPR because the data subject had not provided sufficient evidence for having suffered a non-material damage.

The court recalled that the right to compensation is not limited to severe cases of infringements of the GDPR. However, an infringement of the GDPR in itself does not constitute a non-material damage. An only individually noticeable inconvenience is not sufficient. Despite the broad scope, there has to be a suffered damage according to Recital 146, which required an objectively comprehensible and factually existing damage. This is necessary to avoid solely abstract, non-real consequences.

The data subject had not demonstrated to the court a sufficient impact on their personal concerns that were causally linked to the processing by the controller. The loss of control over their personal data, as claimed by the data subject, and the claimed discomfort caused by the processing of their personal data for marketing purposes were found to be not specific enough.

The bad feeling about contributing to a business model of the controller that the data subject dislikes did not constitute a damage.

The court further held that the statement of the data subject was inconsistent. On the one hand, the data subject alleged discomfort and a negative feeling while on the other hand, they were not willing to pay for the ad-free subscription model to get rid of the advertisement in total and also of the negative feeling.

The court furthermore referred to CJEU - C-252/21 and recalled that a monopoly of a social network itself did not automatically render the data subject’s consent invalid. Rather, the users had a freedom of choice when provided with the possibility of paying an appropriate amount of money for an equivalent alternative that does not include such processing of personal data. The controller had implemented this judgement by implementing their consent model with an alternative that included paying a fee.

The court concludes that the data subject’s reluctance towards the processing could not have been that great if they chose to consent rather than to pay the fee.

Comment

Even though the damage claim was dismissed due to the data subject’s failure to demonstration the existence of damages, the court states in an obiter dictum that the dominant market power of the controller itself does not invalid the consent since the data subject had a viable alternative by paying for the subscription model. However, the court does neither mention the prohibition of coupling laid down in Article 7(4) GDPR nor the relevant EDPB opinion.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

Title:
No justification for damages in the event of disapproval of the use of data for personalized advertisements
Chain of standards:
GDPR Art. 15, Art. 82 Para. 2
Principles:
1. When assessing the non-material damage, it must also be taken into account that the deterrent effect intended by Art. 82 GDPR can only be achieved by paying significant compensation for the person making the claim, especially if there is no commercialization. A general exclusion of minor cases is not compatible with this, so that the obligation to reimburse non-material damages is not limited to serious damages. (para. 42 - 44) (editorial principle)
2. A possible violation of data protection law as such does not, in itself, justify a claim for damages for data subjects - despite the lack of a minor limit. The infringement must in any case have led to a specific violation of the personal rights of the data subjects. In this respect, the violation of the provisions of the GDPR is not the same as the occurrence of damage. Rather, the person affected must have suffered a noticeable disadvantage and there must be an objectively comprehensible, actual impairment of personal interests. (para. 45) (editorial guideline)
3. The person affected's uneasy feeling of participating in a business model of the obligor with which they do not agree does not constitute damage within the meaning of the GDPR, especially not if the obligor provides the person affected with a (paid) alternative to the business model disapproved of by the person affected. (paras. 54 – 57) (editorial guideline)
Keywords:
Admissibility of the action, international jurisdiction, subject-matter jurisdiction, specificity of the claim, right to information, claim for damages, need for legal protection
Source:
GRUR-RS 2024, 25535

 
Tenor

1. The action is dismissed.

2. The plaintiff must bear the costs of the legal dispute.

3. The judgment is provisionally enforceable against security in the amount of 110% of the amount to be enforced.

4. The value in dispute is set at €7,000.00.

Facts

1
The plaintiff asserts claims against the defendant for damages, information and deletion due to alleged violations of the General Data Protection Regulation (GDPR).

2
The plaintiff is a user of the F. platform, which is provided by the defendant. The defendant's services enable users to create personal profiles for themselves and share them with friends. The plaintiff uses F. in particular to get in touch with other people, according to its own statements, primarily with relatives in Hungary.

3
The defendant finances itself, among other things, with advertising revenue generated from placing personalized advertisements that are tailored to the user behavior of the network users.

4
When registering with F., the prospective user provides their first and last name, date of birth and gender. They are also asked to provide their cell phone number or email address (Appendix B 8). The registration page also contains the following passage:

"By clicking on "Register", you agree to our terms of use. Our data policy tells you how we collect, use and share your data."

5
Both the terms of use and the data policy were linked on the registration form and could be viewed before the registration process was completed. During the relevant period, 4 versions of the F. Terms of Use were in effect (Appendix B 9). In the help section or in the data policy, F. users are informed that they can use controls to make their accounts more secure, set their advertising preferences, view or download their F. data, or delete their account at any time. Overall, users are informed of the scope of the services offered by the defendant and the conditions for using them. The F. Terms of Use generally indicate that the defendant agrees to offer users a personalized experience, to protect and support its community, and to use and develop advanced technologies to provide safe and functional services for all and to improve its services (see Appendix B 9, Section 1, "Services we offer"). The F. terms of use also contain detailed information on how the defendant uses personal data and why this data is needed to personalize the content displayed to users (see Appendix B 9, Section 1 "Services we offer" and Section 2 "How our services are financed").

6
When registering with I. , another platform of the defendant, the prospective user provides their first and last name, date of birth and gender. In addition, they are asked to provide their mobile phone number or email address (Appendix B 10). The registration page also contains the following passage: "By clicking on "Register", you agree to our terms of use. Our data policy tells you how we collect, use and share your data." Both the terms of use and the data policy were linked on the registration form and could be viewed before the registration process was completed. During the relevant period, 5 versions of the I. terms of use were in effect (Appendix B 11). The I. terms of use also contain detailed information on how I. uses personal data and why this data is needed to personalize the content displayed to users (see Appendix B 11 under the headings "The I. service" and Section 2 "How our service is financed").

7
The plaintiff agreed to these terms of use from F. The defendant initially informed its users that the processing of personal data for the purpose of placing personalized advertising was based on Art. 6 Para. 1b) GDPR, as it was necessary to fulfill the contract (Appendix B1 9-12, B 21). Users had to accept the terms to use Instgram or F. Since April 5, 2023, the defendant has informed its users that the data processing was based on Art. 6 Para. 1f) GDPR and offered users the opportunity to declare an objection to the data processing (B 22-24). This was clearly pointed out.

8
The defendant began introducing the consent model in Europe on November 3, 2023. Users were asked via in-product notices to either consent to the defendant's use of their data for advertisements on F. /I. or to subscribe to the ad-free F. /I. version. In the second case, the defendant does not use the user data for advertising. Finally, users are free to choose neither option and instead leave F. or I. by deleting their account(s), whereby users are able to download their account information beforehand (see Annexes B 28 and 29). The data protection policy was updated accordingly (Annex B 21) and a consent mask was generated (Annex B 22). On November 8, 2023, the plaintiff consented to the defendant's use of their data for advertising purposes (Annex B 31). At the oral hearing, the plaintiff was not open to a paid subscription.

9
On April 8, 2023 (Appendix B 26), the plaintiff demanded information, damages and an injunction out of court. On March 9, 2023, the defendant (KGR4) drafted a letter in which the defendant's representatives informed the plaintiff's law firm that, in response to a series of essentially identical letters written on behalf of a number of different represented clients, they did not see themselves in a position to answer them within the statutory period under Art. 12 Para. 3 Sentence 1 GDPR. A response within the three-month period was planned. On October 9, 2023 (Appendix B 27), the defendant sent another response.

10
The plaintiff initially requested under the claim in item 3 that the defendant be instructed to refrain from processing personal data of the creditor side, such as telephone number, F. ID, surname, first name, gender, federal state, country, city, relationship status and usage behavior for advertising purposes without obtaining the consent of the creditor side or fulfilling the statutory authorization requirements, on pain of a fine of up to EUR 250,000.00 to be determined by the court for each case of infringement, or alternatively a detention order to be enforced on its legal representative (director), or a detention order to be enforced on its legal representative (director) for up to six months, or up to two years in the event of a repeat offense.

11
In a written submission dated February 7, 2024, he amended the application and otherwise declared it to be settled. In this respect, unless there is a consensus on the matter, it should be determined that the action has been resolved insofar as the defendant has been instructed to refrain from the continued processing of personal data in the sense of the data stored in the user profile of the plaintiff (“profile data” such as telephone number, F. ID, surname, first name, gender, federal state, country, city, relationship status) for advertising purposes without consent. The defendant has agreed to the plaintiff’s declaration of partial settlement (written statement dated April 15, 2024). In the statement of claim, the plaintiff states that he uses F. and I.

12
The plaintiff finally requests:

1.

The defendant is instructed to provide the plaintiff with information about the personal data concerning the plaintiff that the defendant processes in connection with the personalized advertising, namely:

2.

The defendant is ordered to pay the plaintiff non-material damages as compensation for data protection violations, the amount of which is left to the discretion of the court but should not be less than EUR 1,500, plus interest at a rate of 5 percentage points above the base interest rate since the case was filed.

3.

The defendant is ordered to disclose the personal data collected between May 25, 2018 and November 6, 2023 on the plaintiff's usage behavior.

4.

The defendant is ordered to pay the plaintiff pre-trial legal costs of EUR 713.67 plus interest since the case was filed at a rate of 5 percentage points above the base interest rate.

13
The defendant requests

14
Firstly, she cannot find an I. account of the plaintiff with the information provided so far. She therefore denies the use.

15
The claims for damages and injunctions are inadmissible because they lack the specificity required under Section 253 Paragraph 2 No. 2 of the Code of Civil Procedure.

16
She believes that the data collection and processing was lawful and that a right to information - insofar as it exists - has been fulfilled. There is no claim for damages because there have been no violations of the GDPR. In addition, no actual damage that can be compensated for has been demonstrated. There are no claims for injunctive relief because there have been no specific violations of the GDPR. The right to deletion is unfounded, especially since the plaintiff has consented to the processing in question.

17
She is not responsible for Wh.-A.; the Wh.-A. service is provided by Wh.-A. for users in Europe, including users in Germany. I. Limited (“Wh.-A. I.”), a company under the law of the Republic of I. with its registered office in D., I. (Appendix B7)

18
For further details of the facts and status of the dispute, reference is made to the written submissions exchanged together with the attachments and - with regard to the hearing of the plaintiff - to the minutes of July 29, 2024.

Reasons for the decision

19
The admissible action is unfounded and therefore unsuccessful.

20
The action is admissible.

21
I. In particular, the Aschaffenburg Regional Court has international, local and subject-matter jurisdiction (for the following, for example, LG Stuttgart judgment of January 26, 2023 - 53 O 95/22, GRUR-RS 2023, 1098 para. 27 ff.).

22
The international jurisdiction of German courts follows from Art. 6 para. 1, Art. 18 para. 1 of the Brussels I Regulation.

23
An exclusive place of jurisdiction according to Art. 24 of the Brussels I Regulation is not apparent. According to Art. 18 para. 1 alternative 2 of the Brussels I Regulation, a consumer's action against the other contractual partner can be brought either before the courts of the Member State in whose territory this contractual partner is domiciled, or, regardless of the domicile of the other contractual partner, before the court of the place where the consumer - in this case the plaintiff - is domiciled - in this case: in the Federal Republic of Germany.

24
The international jurisdiction of German courts also follows from Art. 79 para. 2 of the GDPR, the temporal, material and spatial scope of application of which is open.

25
The Aschaffenburg Regional Court has local jurisdiction. This follows, on the one hand, from Article 18 paragraph 1 alternative 2 of the Brussels I Regulation, and, on the other hand, from Article 79 paragraph 2 sentence 2 of the GDPR.

26
The subject-matter jurisdiction arises in any case from Section 39 of the Code of Civil Procedure, since the defendant negotiated the main issue without complaint.

II. Specificity of the claim under 2)

27
The lack of specificity of the claim and the grounds for the claim must be taken into account ex officio (BGH, judgment of January 17, 2023 - VI ZR 203/22, NJW 2023, 1361 para. 14). In principle, a claim is sufficiently specific if it specifies the claim raised by quantifying it or describing it in such a way that the scope of the court's decision-making authority is clearly delimited, the content and extent of the substantive legal force of the requested decision are recognizable, the risk of the plaintiff's (possible partial) defeat is not passed on to the defendant through avoidable inaccuracy and any compulsory enforcement is not burdened with a continuation of the dispute in the enforcement proceedings. The claim is open to interpretation, whereby the grounds for the claim must also be used (Zöller-Greger, ZPO, 34th edition, § 253 marginal no. 13).

28
It can be seen from the statement of claim that the payment request is based on a coherent, albeit long-term, but self-contained factual situation that is described in terms of time in the facts of the case.

29
Since in claims for compensation for non-material damages, in view of the assessment by the court at its reasonable discretion, there is generally no need - and as here - to quantify the claim for performance (cf. established case law since BGH, judgment of December 13, 1951 - III ZR 144/50, BGHZ 4, 138, juris Rn. 7), it is also sufficient for the plaintiff to estimate its idea of the amount of compensation to be awarded uniformly at a minimum amount.

30
III. The amendment to the application to item 3 declared in the written submission of February 7, 2024, insofar as it has not been declared settled, is, in the opinion of the court, relevant within the meaning of Section 263 of the Code of Civil Procedure, since the subject matter of the dispute can essentially be used and the aspect of the plaintiff's newly granted consent under data protection law can thus also be settled.

31
I. The claim under point 1 is unfounded. The plaintiff has no further right to information against the defendant. The plaintiff's original right to information under Article 15 GDPR has already partially expired pursuant to Section 362 Paragraph 1 of the Code of Civil Procedure. In part, the request for information asserted by the plaintiff is not covered by the scope of Article 15 GDPR.

32
The right to information arises from Article 15 Paragraph 1 a), c) GDPR. According to this, the data subject has the right to request confirmation from the controller as to whether personal data concerning him or her is being processed; if this is the case, he or she has, among other things, a right to information about this personal data and the purposes of processing, the categories of personal data that are processed and the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations.

33
These eligibility requirements are basically met. The defendant is the controller within the meaning of the regulation, the plaintiff is the data subject. It is also undisputed between the parties that the plaintiff's personal data was processed.

34
a) (Application number 1a): The plaintiff's claim to information about the personal data concerning the plaintiff, which the defendant processes in connection with the personalized advertising, has already been fulfilled in accordance with Section 362 (1) of the German Civil Code (BGB). As was undisputedly stated in the answer to the complaint dated December 18, 2023, the information about which personal data the defendant processes was provided in the data protection policy under the headings "What information do we collect?"; "How do we use this information?"; "How is your information shared on meta products or with integrated partners?"; "How long do we keep your information?"; "How do we transmit information?"; and "How do we respond to legal inquiries, how do we comply with applicable law and how do we prevent damage?" (see Appendix B 12). Under the heading "How do we use your information?", the defendant explains how it uses the information it collects to provide a personalized experience, including in the form of personalized advertising (see Appendix B 12;), and under the heading "What is our legal basis for processing your information? What are your rights?", it also explains the rights of users.

35
b) (Application No. 1b): With regard to the plaintiff's question under No. 1b), as to how often the above-mentioned data were processed, the defendant rightly points out that this information on the frequency of data processing does not fall within the scope of Art. 15 GDPR.

36
c) (Application number 1c - g): The plaintiff's question on numbers 1c) - 1g) regarding the forwarding of data to third parties for advertising purposes was answered by the defendant in a reply letter dated October 9, 2023 (Appendix B 27) by stating that, as part of the processing in dispute, the defendant does not pass on any information to advertisers for advertising purposes that personally identify users unless the user has consented to the forwarding of his data to a specific advertiser (B 27 pdf page 4). This answers these questions and the right to information is thus fulfilled within the meaning of Section 362 Paragraph 1 of the German Civil Code, whereby any inaccuracy in the content is irrelevant. Reference is made to the following statements by the Federal Court of Justice (BGH, judgment of 3 September 2020 – III ZR 136/18 GRUR 2021, 110, 114, marginal no. 43): “The claim is fulfilled if the information provided represents the entire amount owed in accordance with the debtor’s declared intention (cf. BGH NJW 2014, 3647 marginal no. 17). If the information is provided in this form, any incorrectness of its content does not prevent it from being fulfilled (cf. BeckOK BGB/Lorenz § 259 Rn. 12 [Std.: 1.5.2020]; Erman/Artz, BGB, 15th ed., § 260 Rn. 16 a; MüKoBGB/Krüger, 8th ed., § 259 Rn. 24, § 260 Rn. 43; Staudinger/Bittner/Kolbe, BGB, new edition 2019, § 259 Rn. 32; see also RGZ 100, 150, 152). The suspicion that the information provided is incomplete or incorrect cannot give rise to a claim to an accounting to a greater extent, but merely leads to a claim to an affidavit of the completeness of the information provided in accordance with Section 260 II BGB (e.g. BGH GRUR 1958, 149 [150] – Bleicherde, and GRUR 1960, 247 [248] – Krankenwagen; Erman/Artz, Section 260 Rn. 16 a; Staudinger/Bittner/Kolbe Section 259 Rn. 32). Essential for the fulfilment of the right to information is therefore the - possibly implied - declaration by the person obliged to provide information that the information is complete (cf. BGH NZFam 2015, 68 para. 18)."

37
d) (application number 1h): The right to information under number 1 h) is unfounded due to a lack of passive legitimacy. The operator of Wh.-A. is not the defendant, but Wh.-A. I. Limited in D. (cf. Annex B 7). In addition, the defendant has stated that it does not process any data from European Wh.-A. users for the purpose of personalized advertising (page 15 of the statement of defence).

38
II.1. In particular, the plaintiff has no right to compensation for non-material damages pursuant to Art. 82 Para. 1 GDPR.

39
According to Art. 82 Para. 1 GDPR, any person who has suffered material or non-material damage due to a violation of the GDPR has a right to compensation for damages against the controller or the processor. According to Art. 4 No. 7 GDPR, the controller in this sense is any natural or legal person, public authority, institution or other body that alone or jointly with others decides on the purposes and means of processing personal data. The defendant is the controller.

40
It is irrelevant whether the defendant has actually violated Art. 6 or 15 GDPR. This is because the plaintiff has not proven that it has actually suffered non-material damage.

41
The principles developed within the framework of Section 253 of the German Civil Code apply to the non-material damages claimed here; the investigation is the responsibility of the court in accordance with Section 287 of the Code of Civil Procedure (BeckOK-DatenschutzR/Quaas, 43rd Ed. 1.2.2023, GDPR Art. 82 Rn. 31). Claims for damages under Article 82 Paragraph 1 GDPR must be examined individually (KG Berlin, decision of February 17, 2023 - 10 U 146/22). The criteria of Art. 83 Paragraph 2 GDPR can be used for the assessment, for example the nature, severity and duration of the violation, taking into account the nature, scope or purpose of the processing in question and the categories of personal data affected.

42
It must also be taken into account that the intended deterrent effect can only be achieved by paying significant compensation for the person making the claim, especially if there is no commercialization. A general exclusion of minor cases is therefore not compatible (BeckOK-DatenschutzR/Quaas, 43rd Ed. 1.2.2023, GDPR Art. 82 Rn. 31). The obligation to reimburse non-material damages is therefore not limited to serious damages (LG Aachen judgment of 10.2.2023 - 8 O 177/22, GRUR-RS 2023, 2621 Rn. 74 with further references). This was recently confirmed by a decision of the ECJ, according to which compensation for non-material damage within the meaning of Art. 82 (1) GDPR cannot be made dependent on the damage caused to the data subject having reached a certain degree of significance (ECJ, judgment of May 4, 2023, C-300/21, Celex No. 62021CJ0300, para. 43 ff. - juris; cf. Mörsdorf/Momtazi, JZ 2023, 564, 566).

43
According to the recitals of the European Charter of Fundamental Rights, the concept of damage is to be interpreted broadly (see Recital No. 146, even if it is not defined in more detail in the GDPR). Claims for damages are intended to deter and make further violations unattractive (Kühling/Buchner/Bergt, 4th ed. 2024, GDPR Art. 82 para. 17). In addition, the persons affected should receive full and effective compensation for the damage suffered. The deterrent effect of the compensation is particularly emphasized, which is intended to be achieved in particular through its amount. According to Recital No. 75, non-pecuniary damage can occur in particular through discrimination, identity theft or fraud, damage to reputation, loss of confidentiality of personal data subject to professional secrecy or social disadvantages (LG Aachen judgment of February 10, 2023 - 8 O 177/22, GRUR-RS 2023, 2621 para. 75 with further references).

44
A general exclusion of minor damages is not justifiable in light of these considerations (cf. LG Essen judgment of 10.11.2022 – 6 O 111/22, GRUR-RS 2022, 34818 para. 72 ff.). This is also derived from Article 4 (3) TFEU, which requires member states to impose effective sanctions for violations, as this is the only way to ensure effective enforceability of EU law and thus also of the GDPR (LG Munich I, judgment of December 9, 2021, case no.: 31 O 16606/20, BKR 2022, 131, marginal no. 38; LG Essen judgment of November 10, 2022 - 6 O 111/22, GRUR-RS 2022, 34818, marginal no. 74).

45
However, a possible violation of data protection law as such does not in itself justify a claim for damages for data subjects. In any case, the infringement must also have led to a specific violation of the personal rights of the persons concerned (LG Aachen judgment of February 10, 2023 - 8 O 177/22, GRUR-RS 2023, 2621, marginal no. 77). The violation of the provisions of the GDPR is not the same as the occurrence of damage. A serious violation of personal rights is not required. On the other hand, however, compensation for pain and suffering is still not to be awarded for every essentially imperceptible impairment or for every merely individually perceived inconvenience. Rather, the person concerned must have suffered a noticeable disadvantage and it must be an objectively comprehensible, actual impairment of personal interests (LG Aachen judgment of February 10, 2023 - 8 O 177/22, GRUR-RS 2023, 2621, marginal no. 77 with further references).

46
Recitals 75 and 85 list some of the possible harms, including identity theft, financial loss, reputational damage, but also the loss of control over one's own data and the creation of unlawful personality profiles. Recital 75 also mentions the mere processing of a large amount of personal data of a large number of people. Although the damage is to be understood broadly, it must also have been actually "suffered" (Recital No. 146), that is, "tangible", objectively comprehensible and actually occurred, in order to exclude merely abstract impairments that have not actually occurred (LG Essen judgment of 10.11.2022 - 6 O 111/22, GRUR-RS 2022, 34818 para. 76; LG Aachen judgment of 10.2.2023 - 8 O 177/22, GRUR-RS 2023, 2621 para. 78).

47
These principles were recently confirmed by a decision of the ECJ; According to this, the mere violation of the provisions of the GDPR is not sufficient to justify a claim for damages (ECJ, judgment of May 4, 2023, C-300/21, Celex No. 62021CJ0300, paras. 28-42 - juris). This is because the separate mention of "damage" and "violation" in Art. 82 Para. 1 GDPR would be superfluous if the legislator had assumed that a violation of the provisions of the GDPR would in any case be sufficient to justify a claim for damages (ECJ, judgment of May 4, 2023, C-300/21, Celex No. 62021CJ0300, para. 34 - juris). The ECJ also states (ECJ, judgment of 4 May 2023, C-300/21, Celex No. 62021CJ0300, paras. 35-37 - juris):

48
The above literal interpretation [is] confirmed by the context in which this provision is inserted. Article 82(2) of the GDPR, which specifies the liability regime, the principle of which is laid down in paragraph 1 of that article, adopts the three conditions for the emergence of the right to compensation, namely processing of personal data in violation of the provisions of the GDPR, damage caused to the data subject and a causal link between the unlawful processing and that damage.

49
This interpretation is also confirmed by the explanations in recitals 75, 85 and 146 of the GDPR. Firstly, recital 146 of the GDPR, which specifically concerns the right to compensation provided for in Article 82(1) of that Regulation, refers in its first sentence to ‘damage caused to a natural person as a result of processing that is not in compliance with this Regulation’. Secondly, recitals 75 and 85 of the GDPR state that ‘the risks … may arise from processing of personal data that could result in … damage’ and that ‘a breach of the protection of personal data … may result in … damage’ respectively. This means, firstly, that the occurrence of damage in the context of such processing is only potential, secondly, that a violation of the GDPR does not necessarily lead to damage, and thirdly, that a causal connection must exist between the violation in question and the damage suffered by the data subject in order to justify a claim for damages."

50
This is agreed (see also LG Traunstein judgment of May 17, 2024, 9 O 898/23, enclosure B1).

51
Measured against these principles, the plaintiff has not demonstrated a sufficiently noticeable impairment of personal interests for which there are indications that it could be causally attributed to the data processing at issue here for the purpose of placing personalized advertising and the related information behavior.

52
The plaintiff claims that a loss of control over her personal data has occurred, which is to be regarded as significant non-material damage within the meaning of Section 82 GDPR (page 17 of the file). It should also be taken into account that the right to information under Article 15 GDPR is of considerable relevance for the further enforcement of claims arising from the data protection violation in dispute and that the plaintiff's right to exercise its legitimate (compensation) claims is restricted as a result of the inadequate information. Even if no independent damage is to be assumed as a result of the inadequate information on the part of the defendant, the damage that already existed has in any case been significantly intensified as a result. She was also unable to understand specifically how her data had been used by the defendant for targeted advertising (page 17 of the file).

53
These statements are too general and do not indicate to what extent the alleged loss of control represents damage that goes beyond a mere negative consequence.

54
The plaintiff stated this in the statement of claim using text blocks:

"The plaintiff always found the use of her personal data for the purposes of advertising aimed at her personally unpleasant. She felt that she was being watched when using the defendant's social network, but could not do without it, as this would have meant breaking off contact with numerous friends and acquaintances. The plaintiff not only had a bad feeling as soon as she learned about the way the defendant processed her data, but also felt very angry about the defendant's unexpected behavior in order to maximize its own profits." (Page 10 of the file)

55
The plaintiff's bad feeling about participating in a business model of the defendant with which he does not agree does not in itself constitute damage. The defendant states in the statement of defense that the F. and I. platforms are provided to users free of charge. The defendant's ability to provide users with its current services free of charge depends on advertising revenue. This business model is not unusual. For example, free newspapers and free-to-air private television channels have a similar business model: They try to attract readers or viewers through their high-quality content, who are then presented with relevant advertising based on the demographic characteristics/interests of the target group.

56
In his personal hearing, the plaintiff stated that he found it brazen that he was expected to pay for the use of F. if he did not want personalized advertising. He was no longer with I. (which confirms the defendant's statement) and he wanted compensation because he had a bad feeling and that his data would be deleted. That is not enough.

57
In addition, the plaintiff's statement on the impairments suffered is also contradictory. On the one hand, the plaintiff wants to claim non-material damage from the targeted advertising. On the other hand, the plaintiff is not prepared to pay in the subscription model from November 2023 so that he no longer receives advertising. It is therefore not credible when the plaintiff's lawyers argue on the one hand that the plaintiff feels impaired by personal advertising, and on the other hand that the plaintiff later agreed to this because he is not prepared to pay for this discomfort to no longer occur.

58
It is also incomprehensible when the plaintiff argues that he practically has to be with F. in order to keep in touch with his family in Hungary. Hungary is in the European Union, there are letters, telephones, emails, and text messages. There is no obligation to communicate via F.

59
The ECJ has ruled that the plaintiff's dominant position on the market for online social networks does not in itself exclude the possibility that users of such a network can effectively consent to the processing of their personal data by this operator within the meaning of Art. 4 No. 11 of this Regulation (ECJ (Grand Chamber), judgment of 4 July 2023 - C-252/21 (Meta Platforms Inc. et al./Federal Cartel Office), GRUR 2023, 1131). According to the ECJ, the user's freedom is protected if an equivalent alternative is offered for a reasonable fee that does not involve such data processing operations (GRUR 2023, 1131, 1143, para. 150). This freedom was implemented by the defendant with the introduction of the consent model and the possibility of taking out a paid ad-free subscription. The plaintiff decided against the ad-free subscription and agreed to receive personalized advertising. His aversion to personalized advertising cannot therefore be that great.

60
2. The same applies to any claim under Sections 280 (1), 253 (2) of the German Civil Code; the damage required for this is lacking.

61
III. The claim under point 3 is inadmissible and unfounded.

62
1. The claim under point 3 is already inadmissible because it lacks a need for legal protection. The need for legal protection exists if the person seeking legal advice has a legitimate interest in seeking legal assistance, i.e. cannot achieve his goal in a simpler, cheaper way.

63
The application aims to delete his personal data deposited with the defendant. The goal pursued with the application can easily be achieved without the courts having to make any effort by deleting the plaintiff's user account with the defendant, so there is no need for legal protection.

64
2. The third claim is also unfounded. The plaintiff is not entitled to have his data deleted in accordance with Art. 17 GDPR.

65
On November 8, 2023, the plaintiff expressly consented that the defendant may continue to use information from accounts for advertising purposes. The requirements for the right to deletion in accordance with Art. 17 Para. 1 b) GDPR are therefore not met, in any case, because consent has been given.

66
IV. The secondary claims share the fate of the main claim.

67
V. 1. The decision on costs is based on Sections 91 Paragraph 1, 91 a Paragraph 1, Sentence 1 of the Code of Civil Procedure.

68
The original claim under No. 3 in the statement of claim has been unanimously declared to be settled, so that according to Section 91 a of the Code of Civil Procedure, the judgment on costs must be decided at the discretion of the court, taking into account the current state of affairs and the dispute.

69
The original claim under No. 3 was already inadmissible because it was too vague.

70
According to Section 253 Paragraph 2 No. 2 of the Code of Civil Procedure, the infringement to be avoided must be described as precisely as possible (Greger in: Zöller, Code of Civil Procedure, 35th edition 2024, Section 253 of the Code of Civil Procedure, marginal no. 13b). "Such applications are only sufficiently specific if the prohibition set out in the application is concrete and unambiguous or if the plaintiff's factual submissions clearly indicate to which specific conduct the injunction is limited. In addition, if such an application is to be admissible, the facts must be essentially undisputed and disagreements between the parties may only relate to the legal qualification of a specific conduct that is in itself undisputed" (BGH, GRUR 2015, 1235, para. 10 with further references).

71
The court agrees with these statements. The (prohibition) set out in the application partly repeats the wording of Art. 6 para. 1 GDPR and is not sufficiently concrete and unambiguous. In particular, there is no specific description of the impermissible conduct that the defendant should refrain from according to the application. The enforceability of the application also requires an explanation of which specific data is involved whose processing is to be prohibited (cf. OLG Dresden decision of April 21, 2021 - 4 W 239/21, GRUR-RS 2021, 10287, marginal no. 10).

72
2. The ruling on provisional enforceability arises from Section 709 of the Code of Civil Procedure.

73
3. The value in dispute was to be set at EUR 7,000.00.

74
The claim for information asserted in claim no. 1 is to be valued at EUR 500.00. The value in dispute for claim no. 2 arises from the (minimum) amount of damages presented by the plaintiff in the amount of EUR 1,500.00.

75
The value in dispute of the injunction applications under item 3 is to be determined as a non-pecuniary subject matter of the dispute on the basis of the plaintiff's interest affected, whereby the circumstances of the individual case must be taken into account in accordance with Section 48 (2) Sentence 1 GKG. It can be assumed that, in accordance with Section 23 (3) Sentence 2 RVG, if there are insufficient indications of a higher or lower interest, a value in dispute of €5,000 is to be assumed. Even if the overall structure of the valuation of non-pecuniary subject matters of dispute must not be lost sight of when determining the value in dispute (cf. BGH, decision of November 26, 2020; III ZR 124/20, para. 11), it seems appropriate, taking into account all the circumstances of the present individual case (cf. Section 48 (2) Sentence 1 GKG), to resort to the legal concept of the general value provision of Section 23 (3) Sentence 2 RVG. The court also considers the above-mentioned injunction applications to be a single unit in terms of value. The partial amendment of the claim has not increased the value in dispute (cf. Greger in: Zöller, Civil Procedure Code, 35th edition 2024, § 263 ZPO, marginal no. 11 a).