Damage relevant within the meaning of Article 82 GDPR and in connection with german law is not alone measured by what happens to the data after a violation of data protection or who ultimately took note of it.
Rather, decisive is the subjective loss of control suffered by the violated party as a result of the unauthorized processing of their data. This loss of control must be assessed not from the perspective of the recipient, but from the perspective of the violated party.
According to the current case law of the German Federal Court of Justice (BGH), the mere loss of control over personal data is sufficient to constitute intangible damage within the meaning of Art. 82 (1) GDPR (BGH, NJW 2025, 1656 para. 15). The German Federal Court of Justice has clarified that intangible damage also includes anxiety, stress, and loss of comfort and time (BGH, NJW 2025, 1656 para. 8).
The decision emphasizes that it is not necessary for the data to have actually been misused or made public for damage to have occurred. Rather, the fact that the violated party can no longer determine the use of their data themselves is sufficient.
In addition, the sensitivity of the violated party must be assumed to be as it actually is (BGH, NJW 2023, 983, 985 para. 25).
The party who violated data protection cannot claim that someone else would have reacted less sensitively. Even in the case of intagible damage, such as loss of control over personal data, the individual burden is decisive. If the violated party experiences particularly severe emotional distress as a result of the data processing, this must be taken into account when assessing the damages.
The former case law regarding intangible damage is clear: Due to the psychological predisposition of a violated party, the basic principle applies that the violating party is also liable for psychological malfunction if there is sufficient certainty that the psychologically induced deficits would not have occurred without the damaging event (OLG Schleswig, BeckRS 2024, 5395 para. 31 et seq.).
The attribution of such damages does not fail because the violated party is particularly susceptible to damage as a result of physical or mental dispositions, because the violating party is not entitled to be treated as if they had affected a person who was previously healthy (OLG Schleswig, BeckRS 2024, 5395 para. 32).
