[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLrVfVtP3bHHaYeG9SWAdXngjnczK4fGPWAzIVuLQnXU":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"3a40b81b-8d24-4c47-8609-f01b8680b883","OLG Celle - 5 U 129\u002F24","olg-celle-5-u-129-24-299c19","← Older revision Revision as of 09:55, 24 June 2026 Line 12: Line 12: |ECLI=ECLI:DE:OLGCE:2025:0320.5U129.24.00 |ECLI=ECLI:DE:OLGCE:2025:0320.5U129.24.00 |Original_Source_Name_1= |Original_Source_Name_1=NI-VORIS |Original_Source_Link_1= |Original_Source_Link_1=https:\u002F\u002Fvoris.wolterskluwer-online.de\u002Fbrowse\u002Fdocument\u002F6ec81d84-4c97-4623-81b7-42549912d076 |Original_Source_Language_1=German |Original_Source_Language_1=DE |Original_Source_Language__Code_1=German |Original_Source_Language__Code_1= |Date_Decided=20.03.2025 |Date_Decided=20.03.2025","The Higher Regional Court of Celle ruled that the mere loss of control over personal data due to a scraping incident constitutes non-material damage under Article 82(1) GDPR. This decision aligns with a previous ruling by the German Federal Court of Justice, emphasizing that data subjects do not need to prove a justified fear of misuse to claim damages. The court ordered the controller to pay €100 in damages and compensate for future material damages, while also reinforcing injunctions against further data disclosure.","German court rules data scraping loss of control is non-material damage under GDPR.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=OLG_Celle_-_5_U_129\u002F24&diff=51987&oldid=47334","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-06-24T09:55:45+00:00","2026-06-24T10:00:13.856115+00:00",7,[17],{"name":18,"type":19},"NI-VORIS","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":20,"icon":22,"name":23,"slug":24},null,"GDPR","gdpr",[26,31,33,38],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":46,"vendors":47},[],[],{"slug":49,"title":50,"body":51,"framework_refs":52,"framework_notes":64},"gdpr-liability-confirmed-data-scraping-alone-constitutes-non-material-damage","GDPR Liability Confirmed: Data Scraping Alone Constitutes Non-Material Damage","The OLG Celle ruling reinforces that organizations can be held financially liable under GDPR Article 82(1) simply because personal data was scraped and control over it was lost — no proven misuse is required. This lowers the threshold for data subjects to claim damages, significantly increasing legal exposure for any organization that fails to prevent unauthorized data harvesting. The case highlights that inadequate technical controls against scraping (such as rate limiting, bot detection, and API access controls) are no longer just best-practice gaps — they are compliance failures with direct financial consequences. Organizations must treat scraping prevention as a core data protection obligation rather than an optional hardening measure.",[53,54,55,56,57,58,59,60,61,62,63],"GDPR Article 82 – Liability and right to compensation","GDPR Article 25 – Data protection by design and by default","GDPR Article 32 – Security of processing","GDPR Article 33\u002F34 – Breach notification obligations","NIST SP 800-53 SI-10 (Information Input Validation)","NIST SP 800-53 AC-3 (Access Enforcement)","NIST SP 800-53 AU-6 (Audit Record Review, Analysis, and Reporting)","CIS Control 3 – Data Protection","CIS Control 13 – Network Monitoring and Defence","ISO\u002FIEC 27001:2022 Annex A 8.23 – Web filtering and API security","ENISA Guidelines on Personal Data Breach Notification",{}]