Spam that could start a thousand lawsuits – POLITICO

Never spam a German lawyer.

That’s the moral of a story that starts with spam email and could end up opening the floodgates to billions of euros in compensation claims under EU data protection regulations.

It all started when a lawyer from Harz, in the highlands of Germany, sued a company for spam email marketing in 2018. When a local court ordered the company to stop sending him emails. emails in 2019, the lawyer appealed the decision, demanding compensation.

Now, a Federal Constitutional Court ruling has sent the case back to local judges, with an important message: it is not for you to decide whether the violation should be compensated. It is a question of European law.

The ruling means that lawyers at the Court of Justice of the European Union soon to wonder when a violation of Europe’s strict privacy code, the General Data Protection Regulation, must give rise to compensation. And this is because either the local court will refer the case to the Luxembourg court, or another case will do so before that because it will run up against the same issue that the German constitutional court has declared to be a matter for consideration by the highest court in the bloc. .

“This is a very relevant question,” said Tim Wybitul, a German lawyer at Latham & Watkins who has defended companies against thousands of data protection claims.

Currently, judges are dismissing many compensation claims because plaintiffs cannot prove that they were harmed by the violation. But that could be about to change.

“If the European Court of Justice were to decide that equally insignificant damage should be compensated, it will generate a huge business model for the plaintiffs’ lawyers,” Wybitul said.

A ruling from the EU’s highest court that any breach of the GDPR requires compensation would open the floodgates of the trial.

“It’s a multibillion euro issue ahead, because it would affect so many cases,” said Thomas Bindl, of the Europäische Gesellschaft für Datenschutz, a group that has launched several data protection claims, notably against Amazon, Mastercard and Marriott.

The wave to come

The momentum could be in favor of the applicants.

Prior to 2018, many EU jurisdictions did not allow people to seek compensation for data protection breaches that did not cause them financial harm. GDPR has changed that.

The EU has also finalized a new law called the Class Action Directive, which will strengthen the ability of consumers to bring data protection claims to court.

For data protection in particular, the European courts have obtained encouraging results.

Last year a German court awarded a claimant of € 5,000 because his former employer responded late to a request for data. In Austria, a judge ordered a company to pay € 500 in compensation for similar reasons, while in the Netherlands, courts have also ordered organizations to pay people for data protection breaches.

Data breach claims have also become de rigueur across the Channel, where a London court ruled last year that a case against Google tracing iPhone users could continue, overturning a lower court ruling and potentially broaden the scope of complaints that can be filed under data protection rules.

Data watchdogs also supported a lower threshold for payments. Dutch privacy regulator Aleid Wolfsen wrote last month: “Compensation should be the rule, not the exception” in data protection breaches.

“The good news is that the GDPR states that the responsible organization must compensate all material and immaterial damage in the event of a violation. There is usually little discussion when there is property damage. The loss or loss suffered is usually relatively easy to determine, ”Wolfson wrote.

“In the event of moral damage”, he added, “it is usually also necessary to prove that there is a situation in which there is a right to compensation”, which was more difficult to do.

And although the impact of the spam case is currently limited to Germany, it could be a harbinger of what will happen in the bloc, especially when the best judges in the EU are examining the issues. raised by the case.

“The ruling of the German Constitutional Court has no direct impact on other EU member states,” Wybitul said, but added that “it is not unlikely” that courts elsewhere in Europe come to similar conclusions.

“In a nutshell, the decision can make life easier for plaintiffs and lawyers. It is therefore more difficult for German judges to reject claims solely on the basis that the intangible damage allegedly suffered by the plaintiff is insignificant,” said said Wybitul.

You want more analyzes of POLITICS? POLITICS Pro is our premium intelligence service for professionals. From financial services to commerce, technology, cybersecurity and more, Pro delivers the real-time insights, in-depth insights and the scoops you need to stay ahead of the curve. E-mail [email protected] to request a free trial.