BGH - VI ZR 144/23
German court rules GDPR doesn't preclude national injunctions for unlawful data transfers.
A German Federal Court of Justice (BGH) decision clarifies that the GDPR does not prevent member states from offering national legal remedies, such as injunctions, to prohibit unlawful personal data transfers to third parties. This ruling stems from a case where an online store operator embedded third-party features, leading to user data being transferred. The court found that a data subject could pursue an injunction under national law, even if GDPR rights alone might not suffice.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GDPR?
Get an email when a new story names GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe German Federal Court of Justice clarified that embedding third-party features (e.g., social plugins, analytics scripts) in an online store can constitute an unlawful personal data transfer, exposing operators to national injunctions beyond standard GDPR enforcement. The root issue is that many organizations integrate third-party components without fully assessing the data flows they introduce, effectively outsourcing data processing decisions to external vendors. This matters because GDPR compliance is not a ceiling — member states can layer additional legal remedies on top, amplifying liability. Organizations that treat third-party embeds as a purely technical decision, rather than a legal and privacy one, risk injunctive action that can force immediate removal of critical site features.