[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9g4SwXftA1hBpARvGlzhZyCLwXRcooxf2S2wwEmhSQo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"ed1240b8-90ca-4271-b6ae-72848c8c85a2","gdpr-violation-sharing-personal-data-via-facebook-message-ruled-unlawful","57388f57-3450-497e-84fc-dfdf1bf4a788","GDPR Violation: Sharing Personal Data via Facebook Message Ruled Unlawful","A Dutch court ruled that sharing a personal data extract through a Facebook message constituted a loss of control over that data, violating core GDPR principles including lawfulness of processing, data integrity, and security. The fundamental failure was the use of an insecure, consumer-grade social media platform to transmit sensitive personal information, regardless of the intended legal purpose. This matters because once personal data is shared via a platform like Facebook, the data subject loses control, and the organisation loses the ability to ensure confidentiality, integrity, or access restrictions. The case illustrates that good intentions — such as using data for legal proceedings — do not override the obligation to use appropriate, secure transmission channels. Organisations must treat the method of data sharing as equally important as the decision to share.","**Immediate actions:**\n- Establish and enforce a policy prohibiting the use of personal social media platforms (e.g., Facebook, WhatsApp) for transmitting personal data.\n- Audit all current data-sharing practices to identify instances where personal data may be transmitted via insecure or consumer-grade channels.\n\n**Long-term improvements:**\n- Implement approved, encrypted data-sharing channels (e.g., secure email with TLS, encrypted file transfer portals) as the only sanctioned methods for sharing personal data.\n- Develop a Data Sharing Policy that defines acceptable tools, recipient verification procedures, and minimum security standards for each category of personal data.\n- Conduct regular GDPR-focused training for all staff, specifically covering lawful data transfer methods and the risks of informal communication tools.\n\n**Detection & Compliance measures:**\n- Implement Data Loss Prevention (DLP) controls to detect and block transmission of personal data through unauthorised channels.\n- Maintain an audit log of all data sharing activities involving personal data to support accountability and regulatory investigation if required.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 5(1)(f) — Integrity and confidentiality principle","GDPR Article 6 — Lawfulness of processing","GDPR Article 25 — Data protection by design and by default","GDPR Article 32 — Security of processing","NIST SP 800-53 SC-8 — Transmission Confidentiality and Integrity","NIST SP 800-53 AC-3 — Access Enforcement","CIS Control 3 — Data Protection","CIS Control 14 — Security Awareness and Skills Training","ISO\u002FIEC 27001:2022 A.5.33 — Protection of records","ISO\u002FIEC 27001:2022 A.8.24 — Use of cryptography",{},"published","2026-07-06T08:20:37.767951+00:00","2026-07-06T08:20:37.464+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Rb._Noord-Nederland_-_C\u002F_18\u002F189406\u002FHA_ZA_19-6&diff=52064&oldid=51992","rb-noord-nederland-c-18-189406-ha-za-19-6-a03715","Rb. Noord-Nederland - C\u002F 18\u002F189406\u002FHA ZA 19-6",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[51],{"slug":52,"name":53,"problem":54},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]