Image: MDart10 / shutterstock.com
Anyone who shares their personal data online trusts that companies will handle it with care. But what happens when that’s exactly what goes wrong? Does a company have to pay if sensitive information is accidentally sent to the wrong person—even if no financial damage results? This is precisely the question at the heart of a high-profile case involving the career portal Xing, which ultimately reached the Federal Court of Justice (BGH) and is even set to be heard by the European Court of Justice (ECJ).
One click—and confidential information ends up in the wrong hands
It all started with a mistake during a job application process. A recruiter sent a message via Xing that was actually intended for one applicant. However, it was received by another user with the same name. The problem: The message contained confidential information about the application, including details about salary expectations and the job search.
The wrong recipient actually knew the intended applicant from the same industry. He forwarded the message to him and asked whether it had indeed been meant for him. For the person involved, this was more than just a minor mishap. After all, information about an ongoing job application is among the most personal data there is. Many employees want to avoid, above all, having colleagues, former employers, or competitors find out about it.
The applicant therefore not only demanded that such an incident not be repeated in the future; he also demanded 2,500 euros as compensation for the non-pecuniary damages he suffered.
When does damage actually occur?
This is exactly where the fascinating legal debate begins. With a damaged car or a broken smartphone, it’s easy to quantify the damage. When it comes to personal data, however, things are much more complicated.
The plaintiff argued that the actual problem was not merely the loss of data. Rather, at least one other person had now obtained confidential information that was never intended for third parties. He also feared that this information could be disseminated further or used against him in a competitive business context.
The key question, therefore, is: Is the uneasy feeling of having lost control over one’s personal data sufficient? Or must a specific disadvantage be demonstrable?
These very issues have been the focus of courts across Europe for years.
Why the Federal Court of Justice is referring the matter to the European Court of Justice
The Federal Court of Justice has not yet issued a final ruling in this case. Instead, it referred several questions regarding the interpretation of the General Data Protection Regulation to the European Court of Justice.
Among other things, this involves the following points:
- Can an affected individual require a company to refrain from committing a similar data protection violation in the future?
- When, exactly, is there non-pecuniary damage?
- Aren't worries, troubles, and uncertainty enough already?
- Does the degree to which the company is at fault for the error play a role in determining the amount of potential damages?
These questions are so important because the General Data Protection Regulation applies throughout Europe. Differing national rulings would lead to significant legal uncertainty in the long term. That is why the European Court of Justice should develop uniform standards.
Previous rulings by the European Court of Justice have already made it clear that not every GDPR violation automatically results in monetary compensation. At the same time, however, the Court also emphasizes that an actual loss of control over personal data can certainly constitute compensable damage. Where exactly the line is drawn remains a matter for future case law.
What does this mean for consumers and businesses?
For consumers, this case demonstrates one thing above all: Personal data is no longer a minor issue. Even a seemingly minor lapse in caution can have far-reaching consequences—especially when job applications, health data, or other sensitive information are involved.
Companies, for their part, should view this case as a warning sign. Data protection doesn’t end with a privacy policy on the website. It also includes everyday work processes, internal controls, and careful checks when sending messages. In the worst-case scenario, a single incorrectly selected recipient can trigger lengthy legal proceedings.
Regardless of how the European Court of Justice ultimately rules on the outstanding issues, one thing seems certain: The requirements for handling personal data will continue to increase. At the same time, it is becoming increasingly clear that courts will not automatically impose heavy fines for every data protection violation. The specific circumstances of each individual case remain the decisive factor.
Data protection is more than just a tedious formality
This case vividly illustrates just how fine the line can be between a minor lapse in judgment and a serious loss of trust. For those affected, it’s often not just a matter of a few hundred or thousand euros. What matters far more is whether they can trust that their personal information will truly remain private.
Many companies still treat data protection as nothing more than a tedious checklist. As long as nothing goes wrong, hardly anyone pays it any attention. It’s only when confidential data accidentally ends up in a stranger’s inbox that a frantic response ensues. Anyone who collects personal data assumes responsibility—and this responsibility must not be taken seriously only when courts or authorities come knocking. At the same time, however, data protection must not become a business model in which every minor mistake automatically leads to high compensation claims. Striking the right balance between effective protection and sound judgment will continue to occupy the courts for many years to come.
Have you discovered an error in your data? Get legal assistance and potentially seek compensation. Contact us today!
to the lawyerAt a fixed price of 169 EURO (gross)
