OLG Celle - 5 U 129/24
German court rules data scraping loss of control is non-material damage under GDPR.
The Higher Regional Court of Celle ruled that the mere loss of control over personal data due to a scraping incident constitutes non-material damage under Article 82(1) GDPR. This decision aligns with a previous ruling by the German Federal Court of Justice, emphasizing that data subjects do not need to prove a justified fear of misuse to claim damages. The court ordered the controller to pay €100 in damages and compensate for future material damages, while also reinforcing injunctions against further data disclosure.
AI summary of the linked source. Not reviewed by an editor. How this works
Run NI-VORIS?
Get an email when a new story names NI-VORIS, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe OLG Celle ruling reinforces that organizations can be held financially liable under GDPR Article 82(1) simply because personal data was scraped and control over it was lost — no proven misuse is required. This lowers the threshold for data subjects to claim damages, significantly increasing legal exposure for any organization that fails to prevent unauthorized data harvesting. The case highlights that inadequate technical controls against scraping (such as rate limiting, bot detection, and API access controls) are no longer just best-practice gaps — they are compliance failures with direct financial consequences. Organizations must treat scraping prevention as a core data protection obligation rather than an optional hardening measure.