[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fni9BrC6htTygqDnxDxq5wmTRxd77Z9nbob_AT64fMHw":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":123},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"91759ca8-5d13-43d3-a920-1b2e9ed3bf4b","OLG München - 36 U 1054\u002F25 e","olg-munchen-36-u-1054-25-e-53f01f","Created page with \"{{COURTdecisionBOX |Jurisdiction=Germany |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=OLG München |Court_Original_Name=Oberlandesgericht München |Court_English_Name=Higher Regional Court Munich |Court_With_Country=OLG München (Germany) |Case_Number_Name=36 U 1054\u002F25 e |ECLI= |Original_Source_Name_1=OpenJur |Original_Source_Link_1=https:\u002F\u002Fopenjur.de\u002Fu\u002F2550972.html |Original_Source_Language_1=German |Original_Source_Language__Code_1=DE |Original_So...\" Show changes","A German court has ruled that a social media platform operator unlawfully processed personal data collected via its 'Business Tools' on third-party websites and apps. The court ordered the operator to cease this processing, erase existing data, and pay the data subject €1,500 in damages. The ruling clarifies the platform's role as a joint controller under GDPR for data collected through these tools.","German court orders social media platform to stop unlawful data processing and pay €1,500.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=OLG_M%C3%BCnchen_-_36_U_1054\u002F25_e&diff=52504&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-07-27T06:34:51+00:00","2026-07-27T08:00:12.71692+00:00",7,[17,20],{"name":18,"type":19},"Social Media Platform Operator","vendor",{"name":21,"type":22},"Business Tools","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":49,"vendors":122},[50,79,105],{"slug":51,"name":52,"problem":53,"products":54},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"slug":80,"name":81,"problem":82,"products":83},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":101,"product_name":102,"url":103,"description":104},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":106,"name":107,"problem":108,"products":109},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[110,116],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":112,"url":114,"description":115},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":117,"product_name":118,"url":120,"description":121},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":124,"title":125,"body":126,"framework_refs":127,"framework_notes":138},"german-court-orders-social-media-platform-to-cease-unlawful-third-party-data-collection-via-business","German Court Orders Social Media Platform to Cease Unlawful Third-Party Data Collection via Business Tools","A German appellate court found that a social media platform acted as a joint controller under GDPR when its 'Business Tools' (e.g., tracking pixels, SDKs) collected personal data from third-party websites and apps without a lawful basis. The root cause is a failure to establish transparent, compliant data processing agreements and obtain proper consent before collecting data across external properties. This matters because businesses embedding such tools on their own sites may unknowingly become co-liable for GDPR violations, exposing themselves to regulatory action and civil damages. The €1,500 damages award signals that courts are willing to enforce individual data subject rights, raising the financial stakes for non-compliance significantly.",[128,129,130,131,132,133,134,135,136,137],"GDPR Article 4(7) – Definition of Controller","GDPR Article 26 – Joint Controllers","GDPR Article 6 – Lawfulness of Processing","GDPR Article 82 – Right to Compensation and Liability","GDPR Article 35 – Data Protection Impact Assessment","NIST Privacy Framework PR.CO-P3 – Data Processing Transparency","NIST SP 800-53 PT-1 – Privacy Policies, Agreements, and Terms of Use","CIS Control 3 – Data Protection","CIS Control 12 – Network Infrastructure Management","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)",{}]