Lawyer for privacy litigation: GDPR lawsuits and fines

Data protection lawsuits, proceedings before authorities and damages under the General Data Protection Regulation (GDPR)

Quick start: what is your matter about?

Your contact: Jean Paul P. Bohne, LL.M., MM

Partner, Fachanwalt für IT-Recht (certified specialist lawyer for IT law) and Fachanwalt für Urheber- und Medienrecht (certified specialist lawyer for copyright and media law). Together with Dominik Skornia and Andreas Buchholz.

Send privacy litigation enquiry

What happens after your enquiry?

After your enquiry, we will get back to you within 24 hours on working days. The first contact is free of charge. Before any costs arise, we will expressly point this out to you.

1. A short description is enough. Briefly describe what has happened and which deadlines are running. Helpful are letters of claim, hearings or notices, a short chronology and statements already made.
2. Receipt and initial sorting. We assess the enquiry on the basis of the project described, the documents and the apparent goal. Deadlines and dates should be clearly recognisable.
3. Suitable starting point and cost range. We clarify whether an initial consultation, a service package or a specific mandate is the next step. As soon as the scope of the review is clear, we tell you the cost range – before work begins.

When you need us

These constellations often mark the transition from preventive data protection work to contentious data protection practice.

For prevention and set-up

If the matter still concerns precautionary structuring rather than a dispute or proceedings, the more obvious entry points at ITMR are in particular data protection law, the data protection audit, the data protection impact assessment and the data processing agreement.

Typical cases from our privacy litigation practice

The following constellations are abstracted and simplified. How a case turns out always depends on the facts, documentation and communication already made.

What you will have at the end

When data protection becomes a proceeding

Privacy litigation regularly begins where a data protection issue has to be defended or enforced against claimants, authorities or courts. Internal organisation is then no longer enough.

In practice, data protection disputes are rarely isolated. They often begin with a security incident, an escalated data subject request, internal disagreements about roles and responsibilities, a press enquiry, a tip-off from the market or a complaint to the authority.

If the case then tips into a letter of claim, a hearing, fine proceedings or legal action in court, the focus shifts from prevention to managing the proceedings.

This is particularly delicate for companies because data protection conflicts almost always affect several levels at the same time: legal department, management, information security, communications, HR, product and external service providers. This is exactly where it is decided whether a case is contained or develops into a costly, reputation-sensitive dispute.

Decisive in the first phase

What makes sense is the clearest picture of the situation, not the fastest statement. This includes the following questions:

• Which processing is affected and which categories of data are at issue?
• Which company is acting and what documentation exists?
• What information has already been provided?
• Are authority, employment, contract or reputation issues running alongside civil claims?

Which proceedings and conflict situations fall under privacy litigation

The term does not denote a single basis for a claim. It means contentious practice at the interface of data protection law, litigation, contact with authorities, evidence work and commercial risk management.

Place of jurisdiction: Under Section 44 BDSG (opens in a new tab), actions by data subjects against controllers or processors can be brought at the place of an establishment. They are also possible at the habitual residence of the data subject.

Important distinction

The preventive design of data protection structures remains a separate advisory area. For governance, set-up and tightening, the more obvious pages at ITMR are in particular data protection law, the data protection set-up, the data protection audit, the data protection impact assessment and the data processing agreement.

Typical mistake in companies

Data protection disputes are often recognised as procedural cases too late. Anyone who treats a letter from an authority, an access request with escalation potential or a wave of similar claims merely as a standard compliance topic often produces unnecessary contradictions, gaps in evidence and communication damage.

What counts in the first 72 hours

In acute data protection disputes, the decisive mistakes are often made very early. The first 72 hours therefore often shape the entire further course of the proceedings. After a data breach, the notification deadline of, where feasible, 72 hours under Art. 33 GDPR (opens in a new tab) also applies.

What matters immediately

• Deadlines: letters of claim, hearings by authorities, service of court documents and internal escalation windows must be prioritised immediately.
• Preservation of evidence: logs, tickets, approvals, technical reports and states of communication must not be lost or carelessly overwritten.
• Documentation: roles, decisions, the state of the facts and statements already made must be reliably brought together.
• Communication line: statements to the authority, data subjects, service providers, the press and internally must not contradict each other.
• Internal escalation: management, the legal function, information security, product, HR and external advisers must be cleanly coordinated.

What often causes harm

Problematic are premature apologies, documentation smoothed over after the fact, unverified blame on service providers, isolated technical answers without legal classification and parallel communication by several units without a common line. Especially in data breach and authority cases, this often unnecessarily weakens the later scope for defence.

Damages under Article 82 General Data Protection Regulation: not automatic, but a serious liability risk

Claims under Art. 82 GDPR (opens in a new tab) are regularly the central lever in privacy litigation. After data breaches, misdirected mailings, access disputes or unlawful disclosure, they can quickly turn into serial claims.

Anyone confronted with damages claims should neither reflexively reject them nor give in prematurely. In CJEU, C-300/21, Österreichische Post (opens in a new tab), the Court of Justice of the European Union clarified that a mere infringement of the General Data Protection Regulation is not sufficient in itself.

An infringement, material or non-material damage and a causal link are required. At the same time, there is no rigid de minimis threshold on which companies could rely. Further guidance is provided by CJEU, C-340/21, Natsionalna agentsia za prihodite (opens in a new tab).

In practice, therefore, very specific questions arise: What damage is actually alleged? What is the loss of control supposed to consist of? How robust is causation? What technical and organisational measures actually existed, what was documented and what communication has already taken place externally?

It is often precisely at these points that it is decided whether an individual case becomes an expensive serial situation.

Helpful official sources

• General Data Protection Regulation on EUR-Lex (opens in a new tab)
• Court of Justice of the European Union, C-300/21, Österreichische Post (opens in a new tab)
• Court of Justice of the European Union, C-340/21, Natsionalna agentsia za prihodite (opens in a new tab)

Defence mistakes that are often avoidable

• Confusing a mere legal infringement with demonstrable damage
• Inconsistent statements to claimants, the authority and the court
• Securing logs, tickets, approvals and technical reports too late
• Settlement decisions without considering the risks of multiplication and copycat claims

Of particular further relevance at ITMR are GDPR damages, the article on the case law overview on Article 82 General Data Protection Regulation, the analysis of misdirected salary data and the article on the nature and extent of damages.

Access requests under Article 15 General Data Protection Regulation as a trigger for later proceedings

Many data protection proceedings begin with an access request rather than a lawsuit. It becomes problematic when the request has been wrongly prioritised, answered incompletely or strategically underestimated.

Especially in conflict-laden situations, the right of access under Art. 15 GDPR (opens in a new tab) is often also used as a means of pressure. It then serves to prepare a damages claim, as an instrument in employment disputes or as leverage in ongoing contract and competition disputes. This does not make handling it inadmissible, but considerably riskier.

For companies, what is decisive is whether deadlines, identity verification, data sources, third-party references and grounds for restriction are under control. Anyone who responds in an unstructured way, discloses content too broadly or remains obviously incomplete regularly worsens their later position towards claimants and data protection supervisory authorities.

Handling should therefore be closely interlinked with documentation and procedural strategy.

What should be checked early

• which company or organisation is the controller
• which data stocks, systems and service providers are affected
• whether third-party rights, trade secrets or other restrictions are affected
• whether the request remains isolated or is already recognisably aimed at follow-on proceedings

ITMR deep dives

• Data protection access
• Can an access request be abusive?
• Trade secret protection
• NDA / confidentiality

Data protection supervisory authority, orders and fine proceedings

Data protection proceedings before authorities require a different pace than ongoing compliance work. Responses, supplementary submissions and statements often shape the further course early on.

Letters from a data protection supervisory authority often concern more than mere obligations to provide information. They may concern cooperation, statements, inspection of files, audit measures, erasure orders, prohibitions, questions about security measures or the preparation of a fine under Art. 83 GDPR (opens in a new tab).

For companies, it is decisive that responses are consistent, documentable and strategically thought through. Under Section 41 BDSG (opens in a new tab), the provisions of the Gesetz über Ordnungswidrigkeiten (German Act on Regulatory Offences) apply mutatis mutandis to fine proceedings, unless the BDSG provides otherwise.

This applies in particular if, alongside contact with the authority, civil claims, press enquiries, employee conflicts or problems with service providers are also at issue. Then an isolated data protection perspective is not sufficient. What is needed is a line that cleanly brings together documentation, organisational structure, technology, responsibilities and external communication.

Official guidance for proceedings

• European Data Protection Board: Guidelines 04/2022 on the calculation of fines (opens in a new tab)
• Bundesdatenschutzgesetz (German Federal Data Protection Act) on gesetze-im-internet.de (opens in a new tab)
• Help with proceedings before the supervisory authority
• Case law overview on fines

Particularly risky

• premature statements without a complete reconciliation of the facts
• corrected or subsequently “smoothed over” documentation
• contradictory statements between technology, management and the legal function
• underestimated consequences for later civil proceedings

Data breaches, serial claims and evidence: what data protection proceedings depend on in practice

In data breaches and other disputes, privacy litigation is often decided by the quality of the technical and organisational follow-up. The abstract legal question then takes a back seat.

After a personal data breach, several paths regularly run at the same time: internal investigation, securing traces, risk assessment, communication with service providers, notification to the authority under Art. 33 GDPR (opens in a new tab), possible notification of data subjects under Art. 34 GDPR (opens in a new tab) and preparation for later claims.

Anyone who does not document this process in a structured way worsens their position in almost every follow-on conflict.

With serial claims, there is the added factor that a response rarely remains an individual case. Statements on cause, scope, protective measures or responsibility often have repercussions for further claims, complaints and possible proceedings.

That is why, already in the early phase, an interplay of emergency help with data breaches, cybersecurity, compliance and procedural management is needed.

Official guidance for incident situations

• European Data Protection Board: Guidelines 9/2022 on personal data breach notification (opens in a new tab)
• Help with data breaches
• Cybersecurity law & IT security

Useful to prepare for the initial assessment

• letters of claim, hearings, notices and notes on deadlines
• chronology of the incident including internal and external communication
• record of processing activities, contracts, allocation of roles and policies
• technical reports, logs, tickets, approvals and information on service providers
• notifications, access responses or statements already sent

How ITMR supports privacy litigation mandates

The focus is on a robust procedural strategy, clean preparation of the facts and commercially sensible decisions. Reactive case-by-case communication alone is not enough for this.

Suitable for professional mandates

This page is aimed at companies, entrepreneurs, founders, start-ups, agencies, platform operators, investors, decision-makers, executives, professionals, rights holders and public figures in a business-related or reputation-sensitive situation. The typical logic of individual consumer law mandates is not the focus.

Early classification often saves the cost of mistakes

Whether a letter of claim, access dispute, data breach, hearing, risk of a fine or ongoing proceedings: the earlier the facts, documentation and communication line are put in order, the better unnecessary escalations can be avoided.

Key terms in privacy litigation

Privacy litigation

Contentious data protection practice before courts, authorities and against claimants.

Non-material damage

Non-pecuniary damage, such as a comprehensible loss of control over one's own data, which can be compensable under Art. 82 GDPR.

Causation

The causal link between infringement and damage. It must be present for a claim under Art. 82 GDPR.

Access request

A data subject's request for information about the processing of their data under Art. 15 GDPR.

Datenpanne (data breach)

A personal data breach that can trigger notification obligations under Art. 33 GDPR.

Hearing

An opportunity to comment to the supervisory authority before it takes a measure.

Serial claims

Many similar claims after an incident that require a central response line.

The terms serve as orientation. The statutes and the case law in the individual case are decisive.

Provisions and sources

The following sources support the statements on this page. Union law (EU) and German law (DE) are marked separately.

Articles on data protection lawsuits and damages

These articles deal with the claims and risks that privacy litigation proceedings are usually about.

Frequently asked questions on privacy litigation

The answers do not replace a review of the individual case. In data protection proceedings, risk and scope for defence often depend on deadlines, documentation, quality of evidence and communication already made.

Contacts for privacy litigation at ITMR