Hamburg Court Pauses Facebook Data Leak Case and Asks EU Court to Rule on Collective Claims
Meta description: Hamburg’s higher court has stayed a Facebook data leak case, referring key questions on collective claims and jurisdiction to the European Court of Justice; 30,000 users joined.
Hamburg court suspends proceedings in Facebook data leak lawsuit
The Hanseatic Higher Regional Court in Hamburg has halted a major case over the Facebook data leak and asked the European Court of Justice to clarify whether a national consumer association may pursue a collective claim under EU data protection rules. The lawsuit, brought by Germany’s Verbraucherzentrale Bund on behalf of affected users, challenges Meta for alleged unlawful harvesting of personal data in 2018–2019. The referral suspends further litigation while the court awaits guidance on legal admissibility and jurisdictional questions.
The stay follows months of procedural exchange in which the court signalled it needed European-level clarification before determining whether the consumer association’s representative action can seek damages under Article 82 of the GDPR. Lawyers for Meta contest the admissibility of the claim and argue that the Hamburg court lacks international and territorial competence because Meta’s European headquarters is based in Ireland.
Judge proposed quick settlement, Meta declined to accept terms
During earlier hearings the presiding judge proposed a pragmatic settlement intended to resolve claims quickly and limit litigation costs, suggesting a payment of €200 to each claimant. The proposal was framed as a simple remedy that could spare parties a lengthy and expensive legal battle and mitigate reputational damage for the company.
Meta’s legal team did not accept that proposal, and the court subsequently signalled it would seek a preliminary ruling from the European Court of Justice if no agreement were reached. The judge urged Meta to weigh public image considerations against protracted litigation, but the case has now moved into the formal referral process to the EU court.
Key legal questions referred to the European Court of Justice
Hamburg’s written referral sets out detailed questions for the European Court of Justice about whether a national consumer association can bring a model declaratory action to pursue GDPR-based individual compensation claims on behalf of a large group of data subjects. The court is also asking the EU tribunal to clarify which national courts are competent to hear such representative actions and how national procedures interact with the GDPR’s remedies regime.
The issue is legally novel in the context of data protection, and the OLG’s 16‑page order frames the matter as one likely to affect the broader development of EU law. Depending on the ECJ’s answers, German courts may either regain the power to continue the collective proceeding or face limits on representative claims seeking damages for data breaches.
Scope of the scraping incident and prior enforcement action
The dispute stems from automated “scraping” in 2018 and 2019 that combined publicly accessible Facebook contact-import data with other identifying information, producing a dataset of roughly 533 million global accounts and about six million accounts in Germany. The data assembled reportedly included names, genders, locations and telephone numbers, which later appeared in the dark web in April 2021.
Regulators have already taken action: the Irish Data Protection Commission imposed a significant fine on Meta for related shortcomings, and German courts have issued individual awards in comparable cases. A decision by Germany’s Federal Court of Justice in November 2024 established that the mere loss of control over personal data can suffice to justify compensation under the GDPR, a development that underpins many current claims.
How affected users can participate and the state of registrations
The Verbraucherzentrale Bund’s representative action has attracted thousands of potential claimants; roughly 30,000 Facebook users had registered with the federal claims register by the end of last week. Affected individuals can check their exposure through public online services and add themselves to the court’s registers without paying fees, preserving the possibility of future compensation if the collective suit proceeds.
Because the Hamburg court’s referral interrupts ordinary timetables, the stay has the side-effect of interrupting limitation periods for potential claims. Consumer advocates say that procedural suspension may therefore protect the legal positions of many affected users while the ECJ considers the broader questions.
Potential wider impact on data-protection litigation across Europe
Legal experts caution that the ECJ’s ruling could have repercussions far beyond this single case, shaping whether consumer groups or associations in other member states can pursue coordinated claims for GDPR damages. If the court recognises a broad right for representative actions, regulators and litigants may see a rise in collective proceedings against large tech platforms; if it narrows such avenues, injured data subjects could remain reliant on individual lawsuits across different jurisdictions.
The complexity of cross-border corporate structures, with many tech companies operating through European subsidiaries located in Ireland, adds further jurisdictional strain and may prompt additional referrals in comparable disputes. The European Court of Justice often consults member states and delivers rulings intended to harmonise interpretation of EU law, which can extend the time needed to reach a definitive answer.
The Hamburg court expects months rather than weeks before receiving the ECJ’s preliminary ruling, and it warned that even a favourable jurisdictional decision would not necessarily end the procedural hurdles; additional questions about how to frame and substantiate the collective claim could require further clarification at the EU level.
The path ahead therefore remains uncertain: the ECJ’s decision will determine whether the Verbraucherzentrale Bund’s representative action can proceed in Hamburg and will likely influence how future GDPR damages claims are handled across the European Union.
