The Federal Court of Justice decided that even a brief loss of control over one’s data can amount to damage, and that financial losses do not need to be proven.

The ruling in the test case could have a bearing on thousands of other cases currently before the German courts.

In 2018 and 2019, unknown third parties gained access to Facebook users’ data – including names, gender and in some cases places of work – by entering random phone numbers in the search function.

It is no longer possible to do this.

In 2021 the data of 533 million Facebook users affected worldwide was then distributed online.

The case before the Federal Court of Justice in Karlsruhe, southwest Germany, involved a victim who is claiming damages of at least €1,000 (US$1,060) from Facebook parent company Meta.

But, while the court found in favour of compensation, it said an amount of around €100 would be more appropriate.

The case was originally unsuccessful in a lower court in Cologne.

Monday’s ruling means the case will be sent back to the Cologne court, which must now decide on the case again, taking the federal court’s assessment into account.

In its ruling, the federal court noted that Meta’s default settings when it came to search options were likely to have breached some data protection rules.

The lower court will also have to examine whether affected Facebook users had given consent for their data to be processed, the Karlsruhe court said.

But Meta said it was “confident” the Cologne tribunal would again rule in the online giant’s favour.

“Similar claims have already been rejected over 6,000 times by the German courts, with multiple judges ruling that there were no valid claims for liability or damages,” a company spokesperson said in a statement.