BGH - VI ZR 144/23
German Federal Court rules national law can supplement GDPR for data transfer injunctions.
The German Federal Court of Justice has ruled that claims for injunctive relief under national law against unlawful personal data transfers violating GDPR are permissible. The court overturned a lower court's decision, stating that GDPR remedies are not exhaustive and national legal avenues can be pursued. This decision allows individuals to seek injunctions against repeated data transfers to third parties, even without explicit GDPR opening clauses.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPR?
Get an email when a new story names GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe German Federal Court of Justice (BGH) ruled that individuals can pursue injunctive relief under national law against unlawful personal data transfers, even where GDPR does not explicitly provide for such a remedy. This decision clarifies that GDPR's enforcement mechanisms are not exhaustive, meaning organizations now face an expanded legal landscape of liability beyond direct GDPR sanctions. Companies transferring personal data to third parties without a lawful basis risk not only regulatory fines but also civil injunctions brought by affected individuals. This ruling matters because it significantly raises the stakes for non-compliant data sharing practices, particularly in cross-border or third-party transfer scenarios. Organizations that have relied on GDPR compliance alone as their legal shield must now reassess their exposure to national civil law claims.