OLG München - 36 U 1054/25 e
Court orders social network operator to stop unlawful data processing and pay €1,500 in damages.
A German court has ruled that an Irish social network operator unlawfully processed personal data collected via its business tools on third-party websites and apps. The court ordered the company to cease this processing, erase existing data, and pay the data subject €1,500 in non-material damages, finding no lawful basis for the data collection and processing.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Irish social network operator?
Get an email when a new story names Irish social network operator, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA German appellate court (OLG München) found that an Irish social media operator had no lawful basis for collecting and processing personal data through business/tracking tools embedded on third-party websites and apps — a practice commonly associated with pixel tracking and similar technologies. This ruling underscores that passive, large-scale data harvesting without a valid legal basis (consent, legitimate interest, or contract) violates the GDPR, and courts are increasingly willing to award non-material damages to individuals. The €1,500 damages award, while modest, signals that Article 82 GDPR claims are actionable and scalable. Organizations deploying third-party tracking tools must ensure each data flow has a documented lawful basis before deployment, not after enforcement action.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.