[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhKDRQ51oT7HF6y2O_XABGq-8sRwd4Rv--slykV_ELCA":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":126},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"d51b87a2-52a4-4dcd-9d80-3e032f2e03ab","OLG München - 36 U 1054\u002F25 e","olg-munchen-36-u-1054-25-e-32167a","← Older revision Revision as of 13:27, 28 July 2026 (One intermediate revision by the same user not shown) Line 76: Line 76: }} }} A court held that a social network platform operator unlawfully processed personal data collected through its business tools on third-party websites and apps, and ordered it to cease the processing, erase existing personal data and pay the data subject €1,500 in non-material damages. A court held that the operator of a social media platform unlawfully processed personal data collected through its business tools on third-party websites and apps, and ordered it to cease the processing, erase existing personal data and pay the data subject €1,500 in non-material damages. == English Summary == == English Summary == === Facts === === Facts === The Data Subject had used a social network platform operated by the Controller, an Irish company, since 2013. The Controller provided “Business Tools” to third-party website operators and app providers. These tools enabled the Controller to obtain data concerning how users interacted with third-party websites and apps, including information about page visits, purchases and advertisements clicked. The data subject had used a social media platform operated by the controller, an Irish company, since 2013. The controller provided “Business Tools” to third-party website operators and app providers. These tools enabled the controller to obtain data concerning how users interacted with third-party websites and apps, including information about page visits, purchases and advertisements clicked. In November 2023, the Data Subject requested that the Controller recognize that the processing of his personal data was contrary to the parties’ contract, erase or anonymize the personal data, provide access to the personal data and pay compensation. In November 2023, the data subject requested that the controller recognize that the processing of his personal data was contrary to the parties’ contract, erase or anonymize the personal data, provide access to the personal data and pay compensation. The Data Subject subsequently brought an action before the Regional Court of Munich II, seeking a declaration that the parties’ user contract did not permit the processing, cessation of the processing of personal data collected through the Business Tools on third-party websites and apps, restriction of further processing, erasure or anonymization of previously collected data and at least €5,000 in non-material damages. The relevant data included direct and indirect identifiers, such as his name, contact details, IP address and internal identifiers, as well as website URLs, visit times, app names and information about his interactions with websites and apps. The data subject subsequently brought an action before the Regional Court of Munich II, seeking a declaration that the parties’ user contract did not permit the processing, cessation of the processing of personal data collected through the Business Tools on third-party websites and apps, restriction of further processing, erasure or anonymization of previously collected data and at least €5,000 in non-material damages. The relevant data included direct and indirect identifiers, such as his name, contact details, IP address and internal identifiers, as well as website URLs, visit times, app names and information about his interactions with websites and apps. The Regional Court of Munich II dismissed the action, holding that the declaratory and erasure or anonymization claims were inadmissible, the cessation claims were legally unavailable and the damages claim had not been sufficiently substantiated. In relation to the damages claim, it found that the Data Subject had not identified specific third-party websites or apps through which his personal data had been processed. The Data Subject accordingly appealed to the Higher Regional Court of Munich. The Regional Court of Munich II dismissed the action, holding that the declaratory and erasure or anonymization claims were inadmissible, the cessation claims were legally unavailable and the damages claim had not been sufficiently substantiated. In relation to the damages claim, it found that the data subject had not identified specific third-party websites or apps through which his personal data had been processed. The data subject accordingly appealed to the Higher Regional Court of Munich. === Holding === === Holding === The Higher Regional Court of Munich partially upheld the appeal. The Higher Regional Court of Munich partially upheld the appeal. First, the court held that the Controller processed the Data Subject’s personal data under Articles 4(1) and 4(2) GDPR by receiving data transmitted through its Business Tools, associating it with a user account and storing it. The Data Subject was not required to identify every website, app or individual transmission because the relevant information was principally within the Controller’s knowledge and it was sufficiently probable that he had been affected. First, the court held that the Controller processed the data subject’s personal data under [[Article 4 GDPR|Articles 4(1)]] and [[Article 4 GDPR|4(2) GDPR]] by receiving data transmitted through its Business Tools, associating it with a user account and storing it. The data subject was not required to identify every website, app or individual transmission because the relevant information was principally within the controller’s knowledge and it was sufficiently probable that he had been affected. Second, referring to CJEU C‑40\u002F17 concerning the broad interpretation of “controller”, the court held that the Controller was a joint controller under Articles 4(7) and 26 GDPR for the collection and transmission of the personal data. It controlled the programming of the Business Tools and participated in determining the purposes and means of processing. Allocating certain obligations to third-party website and app operators did not remove its responsibility. Second, referring to [[CJEU - C-40\u002F17 - Fashion ID|CJEU C‑40\u002F17]] concerning the broad interpretation of “controller”, the court held that the controller was a joint controller under [[Article 4 GDPR|Articles 4(7)]] and [[Article 26 GDPR|26 GDPR]] for the collection and transmission of the personal data. It controlled the programming of the Business Tools and participated in determining the purposes and means of processing. Allocating certain obligations to third-party website and app operators did not remove its responsibility. Third, referring to CJEU C‑252\u002F21, the court held that the Controller had not established a lawful basis for the processing of the personal data. The processing was not justified by consent under Article 6(1)(a), contractual necessity under Article 6(1)(b), a legal obligation under Article 6(1)(c), a public-interest task under Article 6(1)(e), or legitimate interests under [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. Accordingly, the court held that the controller's processing infringed Articles 5(1)(a), 5(1)(b), 5(1)(c) and 6 GDPR. Third, referring to [[CJEU - C-252\u002F21 - Meta Platforms and Others (General terms of use of a social network)|CJEU C‑252\u002F21]], the court held that the controller had not established a lawful basis for the processing of the personal data. The processing was not justified by consent under [[Article 6 GDPR|Article 6(1)(a)]], contractual necessity under [[Article 6 GDPR|Article 6(1)(b)]], a legal obligation under [[Article 6 GDPR|Article 6(1)(c)]], a public-interest task under [[Article 6 GDPR|Article 6(1)(e)]], or legitimate interests under [[Article 6 GDPR#1f|Article 6(1)(f) GDPR]]. Accordingly, the court held that the controller's processing infringed Articles [[Article 5 GDPR|5(1)(a), 5(1)(b), 5(1)(c)]] and [[Article 6 GDPR|6 GDPR]]. Relying on CJEU C‑655\u002F23, the court granted an injunction against future unlawful processing under German law. It also ordered restriction pending erasure under Article 18(1)(b) and erasure under [[Article 17 GDPR#1d|Article 17(1)(d) GDPR]]. The court upheld the dismissal of the separate declaratory claim and also rejected anonymization of the website and app interaction data. Relying on [[CJEU - C-655\u002F23 - Quirin Privatbank|CJEU C‑655\u002F23]], the court granted an injunction against future unlawful processing under German law. It also ordered restriction pending erasure under [[Article 18 GDPR|Article 18(1)(b)]] and erasure under [[Article 17 GDPR#1d|Article 17(1)(d) GDPR]]. The court upheld the dismissal of the separate declaratory claim and also rejected anonymization of the website and app interaction data. Finally, relying on BGH VI ZR 10\u002F24, the court awarded €1,500 under [[Article 82 GDPR#1|Article 82(1) GDPR]] for the Data Subject’s loss of control over his personal data. Finally, relying on [[BGH - VI ZR 10\u002F24|BGH VI ZR 10\u002F24]], the court awarded €1,500 in non-material damages under [[Article 82 GDPR#1|Article 82(1) GDPR]] for the data subject’s loss of control over his personal data. == Comment == == Comment ==","A German court has ruled that an Irish social network operator unlawfully processed personal data collected via its business tools on third-party websites and apps. The court ordered the company to cease this processing, erase existing data, and pay the data subject €1,500 in non-material damages, finding no lawful basis for the data collection and processing.","Court orders social network operator to stop unlawful data processing and pay €1,500 in damages.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=OLG_M%C3%BCnchen_-_36_U_1054\u002F25_e&diff=52518&oldid=52504","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-07-28T13:27:23+00:00","2026-07-28T14:00:07.957551+00:00",7,[17,20],{"name":18,"type":19},"Irish social network operator","vendor",{"name":21,"type":22},"Business Tools","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":49,"vendors":125},[50,79,108],{"slug":51,"name":52,"problem":53,"products":54},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"slug":80,"name":81,"problem":82,"products":83},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":109,"name":110,"problem":111,"products":112},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[113,119],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":114,"product_name":115,"url":117,"description":118},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":121,"url":123,"description":124},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":127,"title":128,"body":129,"framework_refs":130,"framework_notes":142},"german-court-orders-social-network-to-cease-unlawful-third-party-data-collection-and-pay-damages","German Court Orders Social Network to Cease Unlawful Third-Party Data Collection and Pay Damages","A German appellate court (OLG München) found that an Irish social media operator had no lawful basis for collecting and processing personal data through business\u002Ftracking tools embedded on third-party websites and apps — a practice commonly associated with pixel tracking and similar technologies. This ruling underscores that passive, large-scale data harvesting without a valid legal basis (consent, legitimate interest, or contract) violates the GDPR, and courts are increasingly willing to award non-material damages to individuals. The €1,500 damages award, while modest, signals that Article 82 GDPR claims are actionable and scalable. Organizations deploying third-party tracking tools must ensure each data flow has a documented lawful basis before deployment, not after enforcement action.",[131,132,133,134,135,136,137,138,139,140,141],"GDPR Article 6 – Lawfulness of processing","GDPR Article 13\u002F14 – Transparency and information obligations","GDPR Article 17 – Right to erasure","GDPR Article 82 – Right to compensation and liability","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 30 – Records of processing activities","NIST Privacy Framework PR.DS-P1 – Data processing policies","NIST SP 800-53 PT-1 – Personally Identifiable Information Processing and Transparency Policy","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)","ITIL Service Design – Information Security and Privacy Management",{}]