[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fysX3lgDgaAxICAiViUwOUKbyPcQe2ahnSZpIOojHPxI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"20d5d5d0-f7cf-470e-9402-9c92c2b46bdd","german-court-orders-social-network-to-cease-unlawful-third-party-data-collection-and-pay-damages","d51b87a2-52a4-4dcd-9d80-3e032f2e03ab","German Court Orders Social Network to Cease Unlawful Third-Party Data Collection and Pay Damages","A German appellate court (OLG München) found that an Irish social media operator had no lawful basis for collecting and processing personal data through business\u002Ftracking tools embedded on third-party websites and apps — a practice commonly associated with pixel tracking and similar technologies. This ruling underscores that passive, large-scale data harvesting without a valid legal basis (consent, legitimate interest, or contract) violates the GDPR, and courts are increasingly willing to award non-material damages to individuals. The €1,500 damages award, while modest, signals that Article 82 GDPR claims are actionable and scalable. Organizations deploying third-party tracking tools must ensure each data flow has a documented lawful basis before deployment, not after enforcement action.","**Immediate actions:**\n- Audit all third-party tracking pixels, SDKs, and business tools currently embedded on your websites and apps to verify a documented lawful basis exists for each data flow.\n- Suspend or disable any data collection mechanisms lacking a valid GDPR legal basis (consent, contract, or legitimate interest) until compliance is confirmed.\n\n**Long-term improvements:**\n- Implement a formal Data Protection Impact Assessment (DPIA) process for any tool that collects personal data on third-party surfaces before deployment.\n- Establish a consent management platform (CMP) to capture, store, and respect user consent signals in line with ePrivacy and GDPR requirements.\n- Maintain a continuously updated Record of Processing Activities (RoPA) that maps every third-party data collection tool to its legal basis and data retention policy.\n\n**Detection & governance measures:**\n- Deploy automated website scanning tools (e.g., cookie crawlers) to detect undeclared trackers or pixels introduced via updates or third-party scripts.\n- Assign a Data Protection Officer (DPO) or privacy counsel to review and approve new business tool integrations before go-live.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 6 – Lawfulness of processing","GDPR Article 13\u002F14 – Transparency and information obligations","GDPR Article 17 – Right to erasure","GDPR Article 82 – Right to compensation and liability","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 30 – Records of processing activities","NIST Privacy Framework PR.DS-P1 – Data processing policies","NIST SP 800-53 PT-1 – Personally Identifiable Information Processing and Transparency Policy","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)","ITIL Service Design – Information Security and Privacy Management",{},"published","2026-07-28T14:20:36.064309+00:00","2026-07-28T14:20:35.92+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=OLG_M%C3%BCnchen_-_36_U_1054\u002F25_e&diff=52518&oldid=52504","olg-munchen-36-u-1054-25-e-32167a","OLG München - 36 U 1054\u002F25 e",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":45,"name":46,"slug":47,"description":48,"color":49},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[52,56,60],{"slug":53,"name":54,"problem":55},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":57,"name":58,"problem":59},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":61,"name":62,"problem":63},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]