OGH: Legal Protection Coverage for Data Breaches

Jul 7, 2023 Benn-Ibler Rechtsanwälte

The Austrian Supreme Court (Oberster Gerichtshof, hereinafter OGH) has clarified that even non-material damages may be covered by a legal expenses insurance policy under the General Conditions for Legal Expenses Insurance 2017 (Allgemeine Bedingungen für die Rechtsschutzversicherung ARB 2017)

In the original case, the plaintiff had purchased a hardware wallet via an online store. In 2020, two cyber-attacks were launched against the wallet manufacturer during which customer data was stolen and published on an Internet forum (i.e., the plaintiff’s first and last name, address, telephone number, and email address). As a result, the plaintiff received an increased number of spam calls and emails, which made her feel rather uneasy. Also, there was a realistic chance of identity theft.

Consequently, the plaintiff sought coverage from her legal expenses insurance to enforce her claims for non-material damages and to establish liability for any material damages against the wallet manufacturer. The plaintiff claimed that the wallet manufacturer had breached their contractual collateral duty to ensure that their online store operated error-free and without security loopholes.

Pursuant to Art. 23.2.1 ARB 2017, the General Contractual Legal Protection module covers (among other things) the protection of legal interests arising from other contracts under the law of obligations relating to movable property. The assertion of and defense against claims for pure financial loss arising from the breach of contractual obligations and going beyond the interest in performance or arising from the breach of pre-contractual obligations shall also be deemed to be the safeguarding of legal interests arising from contracts under the law of obligations.

The insurance company denied coverage: Coverage for immaterial damages was excluded, the company argued.

The OGH, however, affirmed the insurance coverage.

Art 23.2.1 ARB 2017 covers claims for damages due to breach of secondary contractual obligations. However, contrary to the view of the insurance company, it does not follow from the second sentence of this provision that immaterial damages are excluded. Rather, it only clarifies that mere pecuniary losses are also covered by contractual legal protection.

The General Contract Legal Protection module therefore also covers the prosecution of non-material damages due to data protection violations by the contractual partner.

OGH 7 Ob 25/23m (24.05.2023)