Data subject – Court Ruling (Germany, 2026)

The controller (the operator of multiple large social networking platforms) offered "Business Tools" that third-party website and app operators could integrate into their services. These tools transmitted visitors' personal data, such as identifiers, contact details, browsing information and interaction data, to the controller. The data subject had used the social network since 2021. He had not consented to the controller's use of personal data transmitted through these Business Tools. The data subject brought proceedings seeking, among other things, a declaration that the user contract did not permit the processing of such data, an injunction against further processing, restrictions on the use of already collected data, deletion or anonymisation of the data, and compensation under Article 82 GDPR. The first-instance court rejected the declaratory claim, partially granted an injunction concerning the storage of off-site data, and dismissed most of the remaining claims. Both parties appealed. The court distinguished between two types of processing: the collection of personal data on third-party websites and apps through the controller's Business Tools, and the storage and further processing of data after transmission to the controller. Regarding the collection of data on third-party websites and apps, the court found that the controller and the third-party website operators were joint controllers under Article 26 GDPR. The controller failed to prove that the data subject had consented. However, the court rejected the injunction request against the controller for this stage of processing because the immediate infringement resulted from the conduct of the third-party website operators. The controller had contractually required website operators to obtain a valid legal basis and had not breached any specific duties arising from Article 26 GDPR. Third, the court held that the controller unlawfully stored personal data received through the Business Tools. The controller argued that it processed the data for security and integrity purposes and relied on Article 6(1)(f) GDPR. However, the controller failed to explain which categories of data it processed, why the processing was necessary, how it was carried out, and how long the data were retained, so it failed to demonstrate a lawful basis for the storage of the data. The court therefore upheld the injunction prohibiting the controller from storing the specified personal data collected from third-party websites and apps. It also found a risk of repeated infringement because the controller had already engaged in the unlawful storage. Fourth, the court held that the data subject was entitled to restriction of processing under Article 18 GDPR. The controller had to preserve the already processed data, refrain from further use or disclosure, and retain them until the data subject requested deletion. Fifth, the court ordered the controller to delete the personal data that had been stored since 1 June 2021. Finally, the court awarded the data subject €500 in non-material damages under Article 82 GDPR for the unlawful processing of his personal data. However, it rejected the claim for higher compensation and did not award the requested pre-litigation legal costs.