GDPR Damages Claims: Quantitative Overview on Court decisions

When data protection law is violated, affected persons may seek compensation. To facilitate this, the EU legislator explicitly introduced claims for non-material damages (“emotional damages”) in the General Data Protection Regulation (GDPR). However, determining the damages amount is difficult, because non-material damages do not require an actual loss of damages. This is a risk for companies as they often cannot foresee the amounts of damages which they are liable for.

However, in Germany, there are already thousands of court proceedings in which individuals claimed non-material damages, hundreds of which have been published. As it is cumbersome to look through all of these judgements, we collected data on 255 judgements published in journals (ranging from 2018 to August 2023) and used quantitative methods to get insights of the judgements. The study shows the extent to which German courts allow or reject claims and the factors on which these decisions depend.

The charts below present some of the findings. For those, who are interested in deeper analyses, may also read the article on the study linked below.

1. Granted and rejected cases

Most notable, only about 25% of claims brought are successful, i.e. in ¾ of cases brought the claim for damages is entirely rejected.

2. Amounts claimed and amounts Awarded

Damages claimed reach from 10€ to 30.000€, with an average of approx. 5200€.
Amounts awarded reach from 25€ to also 30.000€, however, the mean is only 3.300€. This already may be an indication that many claimants claim much more than is actually awarded.

This is supported by the finding, that in approximately 2/3 of cases the court only awarded 40% of less of the sum claimed.

3. Affected Data

One of the key criteria for the amount of damages awarded should be the affected personal data. And indeed, the data collected from the judgements indicates that the more sensitive the data is, the higher the average damages awarded. E.g. when a user ID/customer number was affected damages are considerably low. However, where data was affected that we classified as “sensitive” (such as the content of a hard drive), damages could be significant.

Download full article