[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fni9BrC6htTygqDnxDxq5wmTRxd77Z9nbob_AT64fMHw":3},{"article":4,"iocs":47},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":24,"category":25,"article_tags":29},"91759ca8-5d13-43d3-a920-1b2e9ed3bf4b","OLG München - 36 U 1054\u002F25 e","olg-munchen-36-u-1054-25-e-53f01f","Created page with \"{{COURTdecisionBOX |Jurisdiction=Germany |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=OLG München |Court_Original_Name=Oberlandesgericht München |Court_English_Name=Higher Regional Court Munich |Court_With_Country=OLG München (Germany) |Case_Number_Name=36 U 1054\u002F25 e |ECLI= |Original_Source_Name_1=OpenJur |Original_Source_Link_1=https:\u002F\u002Fopenjur.de\u002Fu\u002F2550972.html |Original_Source_Language_1=German |Original_Source_Language__Code_1=DE |Original_So...\" Show changes","A German court has ruled that a social media platform operator unlawfully processed personal data collected via its 'Business Tools' on third-party websites and apps. The court ordered the operator to cease this processing, erase existing data, and pay the data subject €1,500 in damages. The ruling clarifies the platform's role as a joint controller under GDPR for data collected through these tools.","German court orders social media platform to stop unlawful data processing and pay €1,500.","Help OLG München - 36 U 1054\u002F25 e: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Latest revision as of 06:34, 27 July 2026 view source Shravan (talk | contribs)40 edits Tag: submission [1.0] (No difference) Latest revision as of 06:34, 27 July 2026 OLG München - 36 U 1054\u002F25 e Court: OLG München (Germany) Jurisdiction: Germany Relevant Law: Article 4 GDPR Article 5 GDPR Article 6 GDPR Article 17 GDPR Article 18 GDPR Article 26 GDPR Article 82 GDPR §§ 1004(1), 823(1) German Civil Code (BGB) Decided: 26.06.2026 Published: Parties: Data Subject versus Social Media Platform Operator National Case Number\u002FName: 36 U 1054\u002F25 e European Case Law Identifier: Appeal from: Landgericht München II11 O 4629\u002F23 Appeal to: Unknown Original Language(s): German Original Source: OpenJur (in German) Initial Contributor: Shravan A court held that a social network platform operator unlawfully processed personal data collected through its business tools on third-party websites and apps, and ordered it to cease the processing, erase existing personal data and pay the data subject €1,500 in non-material damages. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The Data Subject had used a social network platform operated by the Controller, an Irish company, since 2013. The Controller provided “Business Tools” to third-party website operators and app providers. These tools enabled the Controller to obtain data concerning how users interacted with third-party websites and apps, including information about page visits, purchases and advertisements clicked. In November 2023, the Data Subject requested that the Controller recognize that the processing of his personal data was contrary to the parties’ contract, erase or anonymize the personal data, provide access to the personal data and pay compensation. The Data Subject subsequently brought an action before the Regional Court of Munich II, seeking a declaration that the parties’ user contract did not permit the processing, cessation of the processing of personal data collected through the Business Tools on third-party websites and apps, restriction of further processing, erasure or anonymization of previously collected data and at least €5,000 in non-material damages. The relevant data included direct and indirect identifiers, such as his name, contact details, IP address and internal identifiers, as well as website URLs, visit times, app names and information about his interactions with websites and apps. The Regional Court of Munich II dismissed the action, holding that the declaratory and erasure or anonymization claims were inadmissible, the cessation claims were legally unavailable and the damages claim had not been sufficiently substantiated. In relation to the damages claim, it found that the Data Subject had not identified specific third-party websites or apps through which his personal data had been processed. The Data Subject accordingly appealed to the Higher Regional Court of Munich. Holding The Higher Regional Court of Munich partially upheld the appeal. First, the court held that the Controller processed the Data Subject’s personal data under Articles 4(1) and 4(2) GDPR by receiving data transmitted through its Business Tools, associating it with a user account and storing it. The Data Subject was not required to identify every website, app or individual transmission because the relevant information was principally within the Controller’s knowledge and it was sufficiently probable that he had been affected. Second, referring to CJEU C‑40\u002F17 concerning the broad interpretation of “controller”, the court held that the Controller was a joint controller under Articles 4(7) and 26 GDPR for the collection and transmission of the personal data. It controlled the programming of the Business Tools and participated in determining the purposes and means of processing. Allocating certain obligations to third-party website and app operators did not remove its responsibility. Third, referring to CJEU C‑252\u002F21, the court held that the Controller had not established a lawful basis for the processing of the personal data. The processing was not justified by consent under Article 6(1)(a), contractual necessity under Article 6(1)(b), a legal obligation under Article 6(1)(c), a public-interest task under Article 6(1)(e), or legitimate interests under Article 6(1)(f) GDPR. Accordingly, the court held that the controller's processing infringed Articles 5(1)(a), 5(1)(b), 5(1)(c) and 6 GDPR. Relying on CJEU C‑655\u002F23, the court granted an injunction against future unlawful processing under German law. It also ordered restriction pending erasure under Article 18(1)(b) and erasure under Article 17(1)(d) GDPR. The court upheld the dismissal of the separate declaratory claim and also rejected anonymization of the website and app interaction data. Finally, relying on BGH VI ZR 10\u002F24, the court awarded €1,500 under Article 82(1) GDPR for the Data Subject’s loss of control over his personal data. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Munich Higher Regional Court, Final Judgment of June 26, 2026 - 36 U 1054\u002F25 e Source: openJur 2026, 7116 Rkr: AmtlSlg: Judgment and reformulated as follows: 1 I. Upon the plaintiff's appeal, the judgment of the Munich II Regional Court of February 27, 2025, Case No. 11 O 4629\u002F23, is partially amended. 2 1. The defendant is ordered, under penalty of a fine to be determined by the court for each instance of non-compliance, up to €250,000.00, or alternatively, detention to be served on its legal representative or detention to be served on its legal representative for up to six months, and in the case of repeated offenses up to two years, to refrain from publishing the following personal data of the plaintiff on third-party websites and apps outside the defendant's networks: 3 a) on Personal data of the plaintiff generated by third-party websites and apps, whether transmitted directly or in hashed form, i.e., 4 - Plaintiff's email address 5 - Plaintiff's telephone number 6 - Plaintiff's first name 7 - Plaintiff's last name 8 - Plaintiff's date of birth 9 - Plaintiff's gender 10 - Plaintiff's city 11 - External IDs of other advertisers (referred to by M. Ltd. as \"external ID\") 12 - Client's IP address 13 - Client's user agent (i.e., collected browser information) 14 - M. Ltd.'s internal click ID 15 - M. Ltd.'s internal browser ID 16 - Subscription ID – Lead ID – anon id _ 17 and the following personal data of the plaintiff 18 b) on websites 19 - the URLs of the websites including their subpages 20 - the time of the visit 21 - the \"referrer\" (the website from which the user came to the current website), 22 - the buttons clicked by the plaintiff on the website, and 23 - other data referred to by M. as \"Events,\" which document the plaintiff's interactions on the respective website 24 c) in third-party mobile apps 25 - the name of the app, and 26 - the time of the visit 27 - the buttons clicked by the plaintiff in the app, and 28 - the data referred to by M. as \"Events,\" which document the plaintiff's interactions in the respective app 29 to be processed using M. Business Tools. 30 2. The defendant is ordered to cease further processing all personal data listed under point 1, which has already been processed by the defendant since May 25, 2018, under penalty of a fine of up to €250,000.00 to be determined by the court for each instance of non-compliance, or alternatively, imprisonment of up to six months, or in the case of repeated violations, up to two years, until the deletion claim is satisfied after the final and binding conclusion of the proceedings, and in particular, not t","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=OLG_M%C3%BCnchen_-_36_U_1054\u002F25_e&diff=52504&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-07-27T06:34:51+00:00","2026-07-27T08:00:12.71692+00:00",7,[18,21],{"name":19,"type":20},"Social Media Platform Operator","vendor",{"name":22,"type":23},"Business Tools","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":24,"icon":26,"name":27,"slug":28},null,"Policy","policy",[30,35,40,42],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":41},{"id":24,"icon":26,"name":27,"slug":28},{"category":43},{"id":44,"icon":26,"name":45,"slug":46},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]