What a German Court’s Ruling on a Public Facebook Profile Means for U.S. Data Brokers

A recent decision from a German labor court offers an interesting perspective on the use of personal information collected from publicly available social media profiles. While the case arose in the context of employment litigation, the court’s reasoning has broader implications for organizations that collect and use publicly available information, including U.S.-based data brokers.

The dispute arose after an individual pursuing a discrimination claim submitted an application for legal aid. In defending the lawsuit, the defendant reviewed the plaintiff’s publicly accessible Facebook profile and submitted screenshots from the profile in court filings.

The court concluded that the defendant’s use of the information was lawful under the GDPR. It found that the processing could be justified either as a measure connected to a pre-contractual relationship, such as responding to a job application, or based on the defendant’s legitimate interest in understanding who was suing it and evaluating assertions made in connection with the legal aid request.

At the same time, the court held that obtaining information from the plaintiff’s public Facebook profile triggered the transparency obligations of Article 14 GDPR. Because the information was collected indirectly from a third-party source rather than directly from the plaintiff, the defendant was required to provide notice of the processing and failed to do so.

Despite that violation, the plaintiff was unable to recover damages. According to the court, the plaintiff failed to demonstrate either material or non-material damages giving due to a loss of control over the information or the type of harm sometimes described in GDPR litigation as a reduction of an individual to a mere object of data processing.

A Useful Reference Point for U.S. Data Broker Laws

Although GDPR and U.S. privacy laws take very different approaches to personal information, the decision provides an interesting data point for companies that rely on publicly available information.

Many U.S. privacy laws contain exemptions or carveouts for “publicly available” information. Generally speaking, information may qualify as publicly available when it is lawfully obtained from government records, widely distributed media, or information that the consumer themselves has made available to the general public.

A company that collects and shares information that is strictly publicly available, would not qualify as a data broker with respect to that information. The Connecticut Data Privacy Act provides a more a more specific criterion. It excludes information posted on a publicly accessible website where the consumer has maintained a reasonable expectation of privacy, including by restricting access to a particular audience.

The German court’s analysis offers insight into what a relatively privacy-protective European court considers truly public conduct. The court essentially concluded that an individual who intentionally configures a Facebook profile for unrestricted public access has voluntarily surrendered substantial control over who may view the information and how opinions may be formed based on it.

Although, unlike under many U.S. privacy laws, publicly available information remains “personal data” under the GDPR, the decision suggests that courts may be less receptive to claims premised on loss of control where the individual themselves made the information available to an unlimited audience.

The court’s reasoning was particularly notable. Among other things, it emphasized that:

• Chose to make it public: Plaintiff autonomously chose to make personal data public in order to enable precisely what he now perceives as an infringement of his rights: that third parties can learn about him through the images, posts, personal data, preferences, etc., that he has publicly shared.

• Aligned and compatible with the original purpose: By creating a Facebook profile, he sent the message to the Facebook user community: “Look, this is me,” “Read my profile and form an opinion of me,” “Recognize that I am a digital creator and view my creations!” 

• No compensable loss of control. The plaintiff consciously relinquished control over the data at issue, and any resulting loss of control could not be attributed to the defendant’s conduct. The court emphasized that, by creating a Facebook profile, the plaintiff agreed to Meta’s terms and privacy practices, which include extensive tracking, profiling, advertising, analytics, and AI-related uses of personal information. The court also noted uses by the plaintiff’s Facebook followers. Against that backdrop, the court concluded that the plaintiff had voluntarily chosen to share information with an indeterminate audience and could not establish compensable damages based on a subsequent loss of control over that information.

What does this mean for Data brokers:

1. Public social media profiles may strengthen the argument that information is “publicly available.”

If a social media profile is intentionally configured for unrestricted public access, the decision suggests that courts may view the resulting information as having been voluntarily disclosed to the public. While U.S. privacy laws vary by jurisdiction, that reasoning may support arguments that certain information falls within exceptions for “publicly available” information.

2. Publicly available does not mean regulation-free.

Even where information is publicly available, organizations remain subject to transparency obligations. Under the GDPR, organizations relying on indirectly collected information generally must provide notice under Article 14 and, where relying on legitimate interests, satisfy the requirements of Article 6(1)(f), including providing the right to opt-out of the processing unless the controller’s interest overrides. Similarly, U.S. state privacy and data broker laws may require notice, registration, consumer rights disclosures, and opt-out mechanisms, depending on the jurisdiction and the nature of the processing.

3. An Article 14 violation does not automatically create damages.

The court found that the defendant should have provided an Article 14 notice, but nevertheless rejected the plaintiff’s damages claim. The decision is another reminder that, despite some early GDPR litigation theories, a violation of the GDPR does not automatically entitle a plaintiff to compensation. Plaintiffs still must prove that they suffered actual material or non-material damage and establish a causal connection between that damage and the alleged violation.