[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjk8FM6bkw0ERDuuLrh-D19rhBDJN2fALK2P0fJoaeTY":3},{"article":4,"iocs":39,"watch_terms":40,"solutions":41,"lesson":44},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"39569c91-a9e1-4b4a-a285-c7105bcee4fb","BGH - VI ZR 144\u002F23","bgh-vi-zr-144-23-b419f2","English Summary ← Older revision Revision as of 08:02, 22 September 2026 Line 93: Line 93: === Facts === === Facts === The operator of an online store (the controller) had embedded third-party features in its websites. As a result of this practice, the data of users accessing the website (the data subjects) was stored on servers operated by third parties. A data subject who had ordered goods from the controller's online store argued that his name, address, IP address, and numerous pieces of usage data from the ordering process had been unlawfully transferred to third parties. The data subject filed a lawsuit requesting an injunction to stop these transfers of personal data. The operator of an online store (the controller) had embedded third-party features in its website. As a result of this practice, the data of users accessing the website (the data subjects) was stored on servers operated by third parties. A data subject who had ordered goods from the controller's online store argued that his name, address, IP address, and numerous pieces of usage data from the ordering process had been unlawfully transferred to third parties. The data subject filed a lawsuit requesting an injunction to stop these transfers of personal data. The court of first instance dismissed the lawsuit on the grounds that it was inadmissible due to a lack of specificity. It also held the lawsuit was without merit. The data subject appealed this decision. The court of first instance dismissed the lawsuit on the grounds that it was inadmissible due to a lack of specificity. It also held the lawsuit was without merit. The data subject appealed this decision. Line 105: Line 105: First, the court stated that the court of appeals had correctly found the lawsuit admissible. The requirement of sufficient specificity was met, as it was unambiguous which conduct of the controller was to be prohibited. The data subject was undoubtedly seeking legal protection to prohibit the controller from designing websites in a way that leads to unlawful transfers of personal data to third parties. First, the court stated that the court of appeals had correctly found the lawsuit admissible. The requirement of sufficient specificity was met, as it was unambiguous which conduct of the controller was to be prohibited. The data subject was undoubtedly seeking legal protection to prohibit the controller from designing websites in a way that leads to unlawful transfers of personal data to third parties. Second, the court held that the claim for injunctive relief could not be denied on the merits. It found that the court of appeals had been incorrect in assuming that a claim for an injunction regarding the unlawful transfer of personal data was precluded under national law because the provisions of the GDPR are exhaustive. The court referred to the CJEU's decision in the case C-655\u002F23 Quirin Privatbank, where the CJEU held that the GDPR does not prevent Member States from providing a legal remedy requiring the controller to refrain from further unlawful processing on a national level. (margin number 52). The court emphasised such remedies may improve the level of protection for data subjects. Second, the court held that the claim for injunctive relief could not be denied on the merits. It found that the court of appeals had been incorrect in assuming that a claim for an injunction regarding the unlawful transfer of personal data was precluded under national law because the provisions of the GDPR are exhaustive. The court referred to the CJEU's decision in the case [[CJEU - C-655\u002F23 - Quirin Privatbank|C-655\u002F23 ''Quirin Privatbank'']]'','' where the CJEU held that the GDPR does not prevent Member States from providing a legal remedy requiring the controller to refrain from further unlawful processing on a national level See [[CJEU - C-655\u002F23 - Quirin Privatbank|CJEU - C-655\u002F23 - ''Quirin Privatbank'']], margin number 52. . The court emphasised such remedies may improve the level of protection for data subjects. It could therefore not be ruled out that the plaintiff could be entitled to an injunction under national law. Moreover, it could not be assumed that the data subject could have achieved their objective of preventing unlawful transfers of their personal data to third parties by asserting any of the data subject rights provided for in the GDPR, particularly the right to erasure laid down in [[Article 17 GDPR|Article 17 GDPR]]. It could therefore not be ruled out that the plaintiff could be entitled to an injunction under national law. Moreover, it could not be assumed that the data subject could have achieved their objective of preventing unlawful transfers of their personal data to third parties by asserting any of the data subject rights provided for in the GDPR, particularly the right to erasure laid down in [[Article 17 GDPR]]. == Comment == == Comment ==","A German Federal Court of Justice (BGH) decision clarifies that the GDPR does not prevent member states from offering national legal remedies, such as injunctions, to prohibit unlawful personal data transfers to third parties. This ruling stems from a case where an online store operator embedded third-party features, leading to user data being transferred. The court found that a data subject could pursue an injunction under national law, even if GDPR rights alone might not suffice.","German court rules GDPR doesn't preclude national injunctions for unlawful data transfers.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=BGH_-_VI_ZR_144\u002F23&diff=53132&oldid=53131","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-22T08:02:02+00:00","2026-09-22T10:00:09.101293+00:00",7,[17,20],{"name":18,"type":19},"GDPR","product",{"name":21,"type":19},"Quirin Privatbank","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":22,"icon":24,"name":25,"slug":26},null,"Policy","policy",[28,32,37],{"category":29},{"id":30,"icon":24,"name":18,"slug":31},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":33},{"id":34,"icon":24,"name":35,"slug":36},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":38},{"id":22,"icon":24,"name":25,"slug":26},[],[18,21],{"controls":42,"vendors":43},[],[],{"slug":45,"title":46,"body":47,"framework_refs":48,"framework_notes":59},"bgh-ruling-third-party-embeds-can-trigger-national-injunctions-under-gdpr","BGH Ruling: Third-Party Embeds Can Trigger National Injunctions Under GDPR","The German Federal Court of Justice clarified that embedding third-party features (e.g., social plugins, analytics scripts) in an online store can constitute an unlawful personal data transfer, exposing operators to national injunctions beyond standard GDPR enforcement. The root issue is that many organizations integrate third-party components without fully assessing the data flows they introduce, effectively outsourcing data processing decisions to external vendors. This matters because GDPR compliance is not a ceiling — member states can layer additional legal remedies on top, amplifying liability. Organizations that treat third-party embeds as a purely technical decision, rather than a legal and privacy one, risk injunctive action that can force immediate removal of critical site features.",[49,50,51,52,53,54,55,56,57,58],"GDPR Article 44 – Transfers to Third Countries","GDPR Article 26 – Joint Controllers","GDPR Article 28 – Processor Obligations \u002F DPAs","GDPR Article 13\u002F14 – Transparency and Information Obligations","NIST Privacy Framework PR.DS-P1 – Data Processing Ecosystem Risk Management","NIST SP 800-53 SA-9 – External Information System Services","CIS Control 12 – Network Infrastructure Management","CIS Control 15 – Service Provider Management","ISO\u002FIEC 27701 – Privacy Information Management","ITIL Service Design – Supplier Management Process",{}]