[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fygnn-ffzCu02eUYuQrFjup8O2AKgbagz1xKuF0Gm6q0":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":127},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"05a27855-6d28-43b1-9a91-65d1e6205258","OLG München - 36 U 1054\u002F25 e","olg-munchen-36-u-1054-25-e-68b49b","Standardised court name ← Older revision Revision as of 14:07, 29 July 2026 Line 63: Line 63: |Party_Link_3= |Party_Link_3= |Appeal_From_Body=Landgericht München II |Appeal_From_Body=Landgericht München II (Germany) |Appeal_From_Case_Number_Name=11 O 4629\u002F23 |Appeal_From_Case_Number_Name=11 O 4629\u002F23 |Appeal_From_Status= |Appeal_From_Status=","The Higher Regional Court of Munich (OLG München) partially upheld a data subject's appeal against a social media platform operator for unlawful processing of personal data collected through Business Tools deployed on third-party websites and apps. The court held that the platform's processing of the data subject's personal data (including IP addresses, identifiers, visit times, and interaction data) violated the GDPR and the user contract, ordering cessation of processing, data erasure, and €1,500 in non-material damages. The ruling clarifies that data subjects need not identify every specific third-party website or app where their data was processed to substantiate GDPR violation claims.","German court rules social media platform unlawfully processed user data via Business Tools, orders €1,500 damages.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=OLG_M%C3%BCnchen_-_36_U_1054\u002F25_e&diff=52558&oldid=52518","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-07-29T14:07:52+00:00","2026-07-29T16:00:09.247099+00:00",7,[17,20],{"name":18,"type":19},"Business Tools","technology",{"name":21,"type":22},"Social Media Platform Operator","vendor","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":23,"icon":25,"name":26,"slug":27},null,"GDPR","gdpr",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[21],{"controls":47,"vendors":126},[48,77,100],{"slug":49,"name":50,"problem":51,"products":52},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"slug":78,"name":79,"problem":80,"products":81},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[82,87,94],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":83,"product_name":84,"url":85,"description":86},"falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":89,"url":92,"description":93},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":95,"product_name":96,"url":98,"description":99},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"slug":101,"name":102,"problem":103,"products":104},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[105,113,118],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":114,"product_name":115,"url":116,"description":117},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",[],{"slug":128,"title":129,"body":130,"framework_refs":131,"framework_notes":144},"munich-court-orders-1500-damages-for-unlawful-tracking-via-social-media-business-tools","Munich Court Orders €1,500 Damages for Unlawful Tracking via Social Media Business Tools","The OLG München ruling highlights the significant legal risk of deploying third-party 'Business Tools' (such as tracking pixels and SDKs) on websites and apps without ensuring GDPR-compliant data processing practices. The social media platform collected sensitive behavioral data—including IP addresses, identifiers, visit times, and interaction data—without a lawful basis, violating both GDPR and the user contract. This case matters because it confirms that individuals do not need to pinpoint every specific website or app where their data was misused to successfully claim damages. Operators and platform providers share accountability for how Business Tools process personal data across the web ecosystem, making diligent vendor and tool governance essential.",[132,133,134,135,136,137,138,139,140,141,142,143],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 6 – Lawful basis for processing","GDPR Article 7 – Conditions for consent","GDPR Article 17 – Right to erasure","GDPR Article 82 – Right to compensation and liability","GDPR Article 28 – Data processor obligations","NIST Privacy Framework PR.DS-P1 – Data processing policies","NIST SP 800-53 PT-1 – Personally Identifiable Information Processing and Transparency","CIS Control 3 – Data Protection","CIS Control 12 – Network Infrastructure Management","ISO\u002FIEC 27001 A.18.1 – Compliance with legal and contractual requirements","ITIL Service Design – Information security management",{}]