2,500 euros in damages: EuGD obtains first judgment for victim of data leak
Successful lawsuit against Scalable Capital
Munich, December 21, 2021. Major success for EuGD Europäische Gesellschaft für Datenschutz (https://eugd.org): A consumer supported by the Munich-based company was awarded compensation for the first time for non-material damage he suffered as a result of a data breach at the online asset management company Scalable Capital. The Munich Regional Court considered a data protection breach by Scalable Capital to be proven. As a result of the data leak, user data records with address and ID data, but also tax and securities account information of more than 33,000 people, including those of the plaintiff, had been stolen and made accessible to third parties.
In addition to compensation for the non-material damage, which in the specific case was due among other things to the loss of the data, the plaintiff had also successfully claimed compensation for possible future material damage. This includes the cost of replacing the passport or other future material damages due to the misuse of his data.
Lawsuit exposes Scalable Capital’s failings
In the course of the proceedings, Scalable had to admit that due to a data hack at a former service provider of Scalable Capital, a security vulnerability had occurred in the access to the cloud environment of the FinTech company. The court considered this vulnerability to be avoidable and thus a breach of the GDPR and awarded the plaintiff non-material damages in the amount of € 2,500 for the theft of his personal identity and financial data. In addition, Scalable has to compensate the plaintiff for all future material damages resulting from the data theft.
Judgment with signal effect – further lawsuits to follow
Attorney Daniel Raimer, who filed the lawsuit, states, „We now finally have a judgment from a regional court awarding non-material damages following a data breach in a data leak.“ Thomas Bindl, founder of EuGD, adds, „This is a milestone for us as a company as well as for data protection in Germany and throughout Europe. The ruling sends a clear signal to consumers: they now know that they can enforce the rights given to them by the GDPR. Without the excellent work of the law firms Raimer and Spirit Legal, this success would not have been possible. Companies will hopefully realize with this ruling that they need to do more in the future to protect their users‘ data.“
Attorney Dr. Diana Ettig from the law firm Spirit Legal, who represented the plaintiff in court, adds, „This landmark decision gives claims under Article 82 GDPR the importance that the European legislator intended them to have: The guarantee of adequate compensation for material as well as immaterial damages.“ Peter Hense, partner at the law firm Spirit Legal, summarizes the ruling and its consequences: „Anyone who negligently handles customer data and fosters identity theft by criminals through failure in IT security must of course compensate for the damage that has already been caused. But they must also be compensated for the damage that will occur in the future.“
Scalable Capital may appeal the ruling. In addition, however, another lawsuit is pending against the Munich-based company. The legal basis on which the claims for damages were asserted is Article 82 of the GDPR. In addition to compensation for material damages, the GDPR, as part of European data protection law, expressly provides for compensation for immaterial damages in the event of data protection infringements.
About EuGD
EuGD Europäische Gesellschaft für Datenschutz mbH (EuGD), founded in February 2019, is the operator of the portal EuGD.org,which supports consumers in the enforcement of legal claims arising from breaches of the General Data Protection Regulation (GDPR). The Munich-based company is already helping several thousand consumers to claim damages without incurring any costs of their own. Currently, with EuGD’s support, more than a dozen legal proceedings are underway in Germany against companies such as Amazon, Scalable Capital and Mastercard before regional and higher regional courts and the Federal Court of Justice. In one case against Facebook, a constitutional complaint is pending before the Federal Constitutional Court.
Further information at https://eugd.org
Images:
Dr. Diana Ettig (Spirit Legal)
Peter Hense (Spirit Legal)
Daniel Raimer