German Federal Court Expands GDPR Enforcement: National Injunctions Now Permissible for Unlawful Data Transfers
Written by AI from the linked story. Not reviewed by an editor. How this works
The German Federal Court of Justice (BGH) ruled that individuals can pursue injunctive relief under national law against unlawful personal data transfers, even where GDPR does not explicitly provide for such a remedy. This decision clarifies that GDPR's enforcement mechanisms are not exhaustive, meaning organizations now face an expanded legal landscape of liability beyond direct GDPR sanctions. Companies transferring personal data to third parties without a lawful basis risk not only regulatory fines but also civil injunctions brought by affected individuals. This ruling matters because it significantly raises the stakes for non-compliant data sharing practices, particularly in cross-border or third-party transfer scenarios. Organizations that have relied on GDPR compliance alone as their legal shield must now reassess their exposure to national civil law claims.
Tactical Insight
Immediate actions
- Conduct an urgent audit of all third-party personal data transfer agreements to verify lawful bases under GDPR Articles 6 and 44-49.
- Establish a legal review process for any new or ongoing data sharing arrangements to assess exposure under both GDPR and applicable national civil law.
Long-term improvements
- Implement a comprehensive data mapping program to maintain a living record of all personal data flows, recipients, and legal justifications.
- Develop and enforce a formal Third-Party Data Transfer Policy that includes contractual safeguards, Data Processing Agreements (DPAs), and Standard Contractual Clauses (SCCs) where required.
- Embed privacy-by-design principles into product and service development to minimize unnecessary personal data transfers to third parties.
Detection & response measures
- Establish a Privacy Incident Response Plan that specifically addresses scenarios involving unlawful data transfers and potential injunctive relief claims.
- Monitor legal developments across EU member states to ensure compliance programs adapt to evolving national interpretations of GDPR obligations.