German court rules Facebook users are entitled to compensation for 2021 data leak

In a significant legal development, Germany’s Federal Court of Justice (BGH) ruled on Monday that Facebook users whose data was illegally accessed in 2018 and 2019 are eligible for compensation following the massive 2021 data breach that exposed the personal information of millions. The ruling marks a pivotal moment in ongoing litigation against Meta, Facebook’s parent company, after thousands of German users sought damages for insufficient data protection.

The BGH decision overturns a lower court ruling in favor of Meta, setting a precedent for future compensation claims in cases involving the loss of control over personal data. The court stated that individuals whose data was exposed in the breach do not need to prove any specific financial losses to be eligible for compensation.

The mere loss of control over personal data was deemed sufficient grounds for damages, with compensation expected to be around €100 ($106) per affected individual.

The case stems from the 2021 leak, during which over half a billion Facebook users’ personal information, including phone numbers and email addresses, was scraped by cybercriminals using a vulnerability in Facebook’s “friend search” feature. The breach affected approximately six million German users. While Meta has disputed the claims, arguing that no hacking occurred and that Facebook’s systems were not breached, the court ruled that Facebook’s failure to adequately protect user data is grounds for compensation.

In its ruling, the BGH directed a Cologne court to reconsider the case in light of these findings, focusing on whether Facebook’s terms of use were clear and whether users gave informed and voluntary consent for their data to be used. Meta had previously rejected compensation claims, insisting that the plaintiffs had not demonstrated concrete financial harm. However, the court’s decision emphasizes that losing control over personal data can be considered a violation deserving of compensation.