LG Gießen - 5 O 195/22
| LG Gießen - 5 O 195/22 | |
|---|---|
 | |
| Court: | LG Gießen (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 82(1) GDPR |
| Decided: | 03.11.2022 |
| Published: | |
| Parties: | |
| National Case Number/Name: | 5 O 195/22 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | REWIS (in German) |
| Initial Contributor: | julia_kraemer |
The Regional Court Gießen held that no damages under Article 82(1) GDPR were awarded for the web-scraping of publicly accessible personal data, as the claim was unfounded and the mere infringement of the GDPR is not sufficient to claim non-material damages.
English Summary
Facts
The data subject registered at a platform which required her to enter her e-mail address, her name, birthday and gender. Additionally, she entered her phone number, which was an optional disclosure. The default option of the platform disclosed the information to any person that has the data subject’s e-mail address or phone number. Between 2018 and 2019, a third-party collected the relevant information via web-scraping or scraping. Scraping is defined by the court as an automated procedure that collects public information. The third party created lists with potential phone numbers to detect if numbers could be associated with users who did not change the default options of the platform. This allowed the third party, even though the phone number was not available to every user on the platform, to connect the accessible information of the data subject with her phone number. In April 2021, the third party published the scraped information.
The data subject filed an action against the platform, claiming that the latter did not take any security precaution to prevent the personal data form being scraped, for instance by means of a security captcha. The data subject ordered the defendant to pay non-material damages. The defendant argued that the scraping did not constitute a data protection breach because only publicly accessible profile information had been accessed.
Holding
The court held that the action is admissible but unfounded. The data subject is not entitled to the payment of non-material damages pursuant to Art. 82(1) GDPR. According to the wording of the provision, the damage must be "suffered", from which it follows that the damage must actually have occurred and not merely be feared. Admittedly, the concept of damage is to be interpreted broadly according to Recital 146 GDPR. However, according to the court, a mere infringement of the provisions of the GDPR is not sufficient to be able to be able to claim non-material damages but concrete damage must be proven. The data subject has not sufficiently demonstrated the existence of concrete, immaterial damage, which also includes fears, worries, stress and loss of comfort. Furthermore, considerable doubts about the plaintiff's state of mind as stated in the application arise for the court from the fact that the mobile phone number was entered voluntarily since it was not required for the registration to the platform. Additionally, the rest of the personal data was publicly accessible.
On the basis of the above, the question of whether and to what extent the defendant had violated the GDPR was irrelevant.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
facts The plaintiff asserts claims based on alleged violations of the General Data Protection Regulation (GDPR). He is a user of the X platform; the defendant is the provider of the same on the territory of the European Union. As part of the registration, the plaintiff gave his first name, last name, date of birth and gender. Providing a cell phone number is optional, but the plaintiff also provided this. The following passage was also found on the registration page: "By clicking on register [...] you agree to our terms of use. Our data policy explains how we collect, use and share your data”. For further details, reference is made to the registration figure (page 8 of the file). The data usage guidelines contain, among other things, information on which of the information provided by the user is always publicly accessible - namely name, profile and cover pictures, networks, gender, username and user -ID - and the statement that publicly available information can be seen by anyone, including people outside of the defendant's platform. The defendant provides its platform users with explanations as to what is public information and what information is public, and how the user can specify , who can see the information provided by him in addition to the public information (so-called target group selection) and who can find him using his e-mail address or his telephone number, if he has provided an e-mail address or telephone number on the platform can (so-called searchability settings) are available. If the user does not select a target group, the accessibility of his information that goes beyond the public information depends on the standard setting, after which friends of the user can see the further information. If the user does not adjust the searchability settings, the default setting is that everyone who has the user's email address or phone number will see the user's profile if the email address or phone number is provided has, find. The plaintiff had not made any changes to the searchability settings at the time of the scraping incident, so the default setting was active. Between January 2018 and September 2019, third parties used automated processes to collect a large amount of the public information available on the defendant's platform (so-called scraping ). In addition, the scrapers created lists of possible phone numbers and uploaded them to the platform's contact importer to determine if the uploaded phone numbers were linked to a user's account. The contact importer, if one of the uploaded phone numbers was linked to the account of a user who had provided their phone number and had not changed the default searchability settings, gave this information, i.e. the fact that the phone number and account were linked, to the scrapers The scrapers then added the phone number associated with the account to the publicly available information from the user's profile. In April 2021, the scraped records of over 500 million users and the phone numbers associated with those records were made freely available for download. This also included the always publicly accessible information of the plaintiff's profile and the telephone number linked to his account. The plaintiff first requested information about the data relating to the plaintiff on the defendant's platform via his legal representative. In a letter dated July 18, 2022, the defendant's attorneys-in-fact sent the plaintiff's attorney-in-fact instructions on how to inspect the information he had stored on the defendant's platform and how to use it. For the details in this regard, reference is made to Annex B16 (Annex B 16 to the brief of September 21, 2022, brief of July 18, 2022 there p. 7). The plaintiff claims that the defendant did not take any security precautions to prevent his data being tapped to prevent. No measures have been taken to prevent automated number queries, e.g. using a security captcha. The fact that an automated mass query was possible represents a security gap for which the defendant is responsible. The plaintiff suffered a significant loss of control over his data. He suffers from great discomfort and worries because he fears abuse. With his complaint served on the defendant on July 4th, 2022, the plaintiff requests: 1. the defendant is sentenced to pay the plaintiff a reasonable amount of immaterial damages, the amount of which is at the discretion of the court, but at least EUR 1,000.00 plus interest since pendency at a rate of 5 percentage points above the base rate.2. Only in the event that the claim for 1) is granted, will it be determined that the defendant is basically obliged to compensate the plaintiff for all future damage that the plaintiff suffers from the unauthorized access of third parties to the data archive of the defendant, the according to the defendant, took place in 2019, have arisen and/or will arise.3. The defendant is sentenced to avoid a fine of up to EUR 250,000.00 to be enforced by the court for each case of infringement, alternatively to their legal representative (director), or to imprisonment to be enforced on their legal representative (director). to refrain from doing so for up to six months, or up to two years in the event of a recurrence, a. to make personal data of the plaintiff's side, namely telephone number, [...]ID, surname, first name, gender, state, country, city, relationship status, accessible to unauthorized third parties via software for importing contacts, without the security measures possible according to the state of the art to prevent the exploitation of the system for purposes other than establishing contact,b. to process the telephone number of the plaintiff's side on the basis of a consent obtained by the defendant because of the confusing and incomplete information, namely without clear information that the telephone number can still be used by using the contact import tool even if it is set to "private". the authorization for this is not explicitly denied and, if the [...] app is used, the authorization is also explicitly denied here,4. The defendant is sentenced to provide the plaintiff with information about personal data relating to the plaintiff which the defendant is processing, namely which data could be obtained from the defendant by which recipient and at what time by scraping or by using the contact import tool,5. The defendant is ordered to pay the plaintiff pre-trial legal fees of EUR 354.62 plus interest since pendency of five percentage points above the base rate. The defendant requests that the lawsuit be dismissed. The defendant claims that the scraping does not constitute a data protection violation There was no breach of security, since "only" publicly available profile information of the plaintiff was accessed and no specific security measures or access authorizations were circumvented or overcome. There was no unauthorized disclosure of or access to the plaintiff's data. In addition, the defendant cannot be accused of a security gap, since the link created between the plaintiff's telephone number and his user account can only be traced back to the plaintiff's searchability setting at the time. The defendant also claims that it is unable to disclose the recipients of the "scraped" data.
