German Court Rules Against Social Media Giant for GDPR Violations

The OLG Jena court found a major social media platform systematically violated fundamental GDPR principles by failing to respond properly to data access requests, processing personal data without legal basis through Business Tools, and unlawfully cross-linking sensitive browsing data to user profiles. The company also refused to honor users' erasure rights, demonstrating a complete disregard for data subject rights. This case highlights how inadequate data governance and privacy controls can lead to court-ordered remediation and significant legal exposure.

Tactical Insight

Immediate actions

Audit all data processing activities to ensure valid legal basis under GDPR Article 6
Implement automated systems to handle data subject access requests within 30-day timeframes
Cease all sensitive data processing that lacks explicit consent or other lawful basis

Long-term improvements

Establish comprehensive data mapping to track all personal data flows and cross-linking activities
Implement privacy-by-design principles in all business tools and tracking systems
Create regular GDPR compliance audits with external legal review

Governance measures

Train all staff on data subject rights and proper response procedures
Establish clear data retention and erasure policies with automated enforcement
Implement privacy impact assessments for all new data processing activities