GDPR Violation: Sharing Personal Data via Facebook Message Ruled Unlawful
Written by AI from the linked story. Not reviewed by an editor. How this works
A Dutch court ruled that sharing a personal data extract through a Facebook message constituted a loss of control over that data, violating core GDPR principles including lawfulness of processing, data integrity, and security. The fundamental failure was the use of an insecure, consumer-grade social media platform to transmit sensitive personal information, regardless of the intended legal purpose. This matters because once personal data is shared via a platform like Facebook, the data subject loses control, and the organisation loses the ability to ensure confidentiality, integrity, or access restrictions. The case illustrates that good intentions — such as using data for legal proceedings — do not override the obligation to use appropriate, secure transmission channels. Organisations must treat the method of data sharing as equally important as the decision to share.
Tactical Insight
Immediate actions
- Establish and enforce a policy prohibiting the use of personal social media platforms (e.g., Facebook, WhatsApp) for transmitting personal data.
- Audit all current data-sharing practices to identify instances where personal data may be transmitted via insecure or consumer-grade channels.
Long-term improvements
- Implement approved, encrypted data-sharing channels (e.g., secure email with TLS, encrypted file transfer portals) as the only sanctioned methods for sharing personal data.
- Develop a Data Sharing Policy that defines acceptable tools, recipient verification procedures, and minimum security standards for each category of personal data.
- Conduct regular GDPR-focused training for all staff, specifically covering lawful data transfer methods and the risks of informal communication tools.
Detection & Compliance measures
- Implement Data Loss Prevention (DLP) controls to detect and block transmission of personal data through unauthorised channels.
- Maintain an audit log of all data sharing activities involving personal data to support accountability and regulatory investigation if required.