GDPR Compensation and Injunctive Claims Expire After Three Years
The Regional Court of Duisburg (LG Duisburg) ruled on November 8, 2024 (Case No.: 2 O 31/24) that claims for damages under the General Data Protection Regulation (GDPR) are subject to the standard limitation period and therefore expire after three years. This decision clarifies the limitation periods for GDPR-related compensation claims.
What Was the Case About?
The plaintiff had entered into a mobile phone contract with a telecommunications provider. As part of this contract, personal data was transmitted to a credit agency. The plaintiff viewed this as a GDPR violation and, under Article 82 GDPR, demanded non-material damages of at least €4,000 as well as an injunction against further data transmissions. She had been aware of the issue since 2020.
Court Decision
The LG Duisburg dismissed the lawsuit on the grounds that the claims were time-barred. The court found:
- General Limitation Rules: GDPR claims are subject to the general limitation rules of the German Civil Code (BGB).
- Three-Year Limitation Period: The limitation period is three years, starting at the end of the year in which the claim arose and the claimant became aware of the circumstances giving rise to the claim.
- Plaintiff’s Knowledge: The plaintiff had knowledge of the relevant circumstances upon signing the contract or shortly thereafter. She was aware that applying for and executing the contract involved reporting data to a credit agency, as stated in the contract and related privacy notices.
- Limitation Period Expired: Even if the plaintiff had only become aware in July 2020, the limitation period would have ended on December 31, 2023. Filing the lawsuit on January 8, 2024, could not interrupt the expiration.
Practical Implications
The ruling has the following practical consequences:
- Need for Timely Action: Affected individuals must assert their GDPR claims promptly, or they risk losing enforceability due to expiration.
- Legal Certainty for Businesses: Companies now have clarity on GDPR-related limitation periods, allowing them to adjust risk assessments and internal processes accordingly.
- Importance of Clear Privacy Notices: The ruling emphasizes the necessity for businesses to provide transparent and clear privacy notices, as these can determine when the limitation period begins.
Exception: Right to Information
It should be noted that, according to a ruling by the Local Court of Chemnitz (AG Chemnitz) from November 22, 2024 (Case No.: 16 C 1063/24), the right to information is not subject to any limitation period and can be asserted indefinitely.
Summary
The LG Duisburg has ruled that claims for damages under the GDPR are subject to a three-year limitation period under the BGB. This decision is significant for both affected individuals and businesses, as it confirms the applicability of standard German limitation rules to GDPR claims. Affected parties should assert their rights in a timely manner, while companies can plan around these deadlines. The ruling also highlights the importance of transparent communication and clear privacy notices.
