[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxaMe-Ux_5L_MoglkZTI07kCoCsvs85EK_1xGlXQITLA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48},"58d8285b-a663-435d-aa51-2a8b8ee99960","bgh-ruling-third-party-embeds-can-trigger-national-injunctions-under-gdpr","39569c91-a9e1-4b4a-a285-c7105bcee4fb","BGH Ruling: Third-Party Embeds Can Trigger National Injunctions Under GDPR","The German Federal Court of Justice clarified that embedding third-party features (e.g., social plugins, analytics scripts) in an online store can constitute an unlawful personal data transfer, exposing operators to national injunctions beyond standard GDPR enforcement. The root issue is that many organizations integrate third-party components without fully assessing the data flows they introduce, effectively outsourcing data processing decisions to external vendors. This matters because GDPR compliance is not a ceiling — member states can layer additional legal remedies on top, amplifying liability. Organizations that treat third-party embeds as a purely technical decision, rather than a legal and privacy one, risk injunctive action that can force immediate removal of critical site features.","**Immediate actions:**\n- Audit all third-party scripts, widgets, and embeds currently deployed on public-facing web properties to identify unauthorized or undisclosed data transfers.\n- Implement a consent management platform (CMP) that blocks third-party calls until valid user consent is obtained.\n- Review and update your Privacy Policy and cookie notices to accurately reflect all third-party data recipients.\n\n**Long-term improvements:**\n- Establish a formal Third-Party Risk Assessment process that evaluates privacy and data transfer implications before any new integration is approved.\n- Maintain a continuously updated Data Processing Agreement (DPA) with every third-party vendor that receives personal data.\n- Adopt a Privacy by Design approach so that data minimization and transfer restrictions are evaluated at the development stage, not after deployment.\n\n**Detection & monitoring measures:**\n- Deploy network traffic monitoring or browser-side telemetry to detect unexpected outbound data transfers to third-party domains.\n- Schedule quarterly reviews of third-party integrations against current regulatory requirements and vendor compliance status.\n- Establish an internal legal\u002Fprivacy escalation path so development teams can flag potential cross-border data transfer issues before they go live.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 44 – Transfers to Third Countries","GDPR Article 26 – Joint Controllers","GDPR Article 28 – Processor Obligations \u002F DPAs","GDPR Article 13\u002F14 – Transparency and Information Obligations","NIST Privacy Framework PR.DS-P1 – Data Processing Ecosystem Risk Management","NIST SP 800-53 SA-9 – External Information System Services","CIS Control 12 – Network Infrastructure Management","CIS Control 15 – Service Provider Management","ISO\u002FIEC 27701 – Privacy Information Management","ITIL Service Design – Supplier Management Process","published","2026-09-22T10:21:31.648005+00:00","2026-09-22T10:21:31.555+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=BGH_-_VI_ZR_144\u002F23&diff=53132&oldid=53131","bgh-vi-zr-144-23-b419f2","BGH - VI ZR 144\u002F23",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":43,"name":44,"slug":45,"description":46,"color":47},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[]]