Rb. Noord-Nederland - C/ 18/189406/HA ZA 19-6
Dutch court rules Facebook message disclosure of personal data breaches GDPR.
The District Court of the Northern Netherlands ruled that disclosing personal data via a Facebook message constitutes a loss of control over that data and violates GDPR articles related to data integrity, lawfulness of processing, and security. The case involved a company that shared a personal data extract through a Facebook message for legal proceedings.
AI summary of the linked source. Not reviewed by an editor. How this works
Run NDC MEDIA GROUP E.G?
Get an email when a new story names NDC MEDIA GROUP E.G, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Dutch court ruled that sharing a personal data extract through a Facebook message constituted a loss of control over that data, violating core GDPR principles including lawfulness of processing, data integrity, and security. The fundamental failure was the use of an insecure, consumer-grade social media platform to transmit sensitive personal information, regardless of the intended legal purpose. This matters because once personal data is shared via a platform like Facebook, the data subject loses control, and the organisation loses the ability to ensure confidentiality, integrity, or access restrictions. The case illustrates that good intentions — such as using data for legal proceedings — do not override the obligation to use appropriate, secure transmission channels. Organisations must treat the method of data sharing as equally important as the decision to share.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.