BGH - VI ZR 144/23
German Federal Court of Justice rules national law can supplement GDPR for data transfer injunctions.
The German Federal Court of Justice has ruled that national laws can provide remedies for unlawful personal data transfers, even if the GDPR is considered exhaustive. This decision overturns a lower court's ruling that national law could only be used if explicitly permitted by the GDPR. The court emphasized that such national remedies can enhance data subject protection.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPR?
Get an email when a new story names GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe German Federal Court of Justice ruled that national laws can independently provide remedies for unlawful personal data transfers, even where the GDPR is considered an exhaustive framework. This challenges a common assumption that GDPR pre-empts all national-level data protection remedies, creating a more complex compliance landscape for organizations operating in Germany. The ruling reinforces that data subject protections can be layered — GDPR sets a floor, not a ceiling. Organizations that assumed GDPR compliance alone would shield them from national legal liability now face exposure on an additional legal front. This matters because it increases both litigation risk and the operational burden of maintaining compliant data transfer practices.