Validated topics from research, threat analysis, law and case law – explained for practitioners and decision-makers.
Judgment of 18 Nov 2024. The Federal Court of Justice held: Temporary loss of control over one's own data after a scraping incident already constitutes non-material damage under…
Judgment of 14 Dec 2023. After a hack of the Bulgarian tax authority, the CJEU clarified: A successful hack does not per se prove incapacity, but the company bears the full burden…
Landmark judgment on Post AG, which had calculated citizens' political affinities. The CJEU clarified: There is no de minimis threshold for damages under Art. 82 GDPR. But: A pure…
Judgment of 7 Dec 2023. When banks and landlords make credit decisions largely dependent on the SCHUFA score, even creating the score falls under the ban on automated individual…
Judgment on the Lithuanian anti-corruption law. Publishing asset and interest declarations of office holders on the internet violates the GDPR principle of proportionality.
The Federal Court of Justice clarified duties under § 675v BGB. Banks must refund unauthorized transfers unless the customer is chargeable with gross negligence. Merely entering a…
If fraudsters use social engineering to activate a second Push-TAN app on a stranger's smartphone, the bank is liable if its approval process has security gaps.
Judgment on LinkedIn. Platform operators may erect technical barriers (rate limiting, captchas, IP blocks) to prevent external bots from mass-harvesting user profiles.
Judgment in the Federal Cartel Office vs. Meta dispute. Competition authorities may, when assessing market abuse, examine whether a group violates the GDPR (merging WhatsApp and…
The Federal Court of Justice clarified: The right of access under Art. 15 GDPR is to be interpreted broadly and covers not only master data but also internal emails, phone notes…
The CJEU held: The 'right to a copy' means not only a summary in a table but a claim to a faithful reproduction of excerpts or documents when that is needed for understanding.
Judgment of 27 Sep 2024 (case no. 310 O 227/23). A photographer sued the AI association LAION over downloading his photo for a training dataset. The court dismissed the claim…
Courts awarded hotel guests damages after a data leak because credit-card numbers and CVV codes ended up on the darknet and customers had to block and monitor their cards.
Whoever installs WhatsApp on a smartphone and consents to address-book access transmits contact data of uninvolved third parties to servers in the USA unsolicited. Without the…
Judgment on a classifieds platform for car sales. Tax authorities may not demand all user data of a platform without cause and in blanket fashion; information requests must be…