🧑⚖️📵 The Baden-Baden Regional Court is currently focusing its attention on the protection of personal data in the age of social media. A customer who was contacted privately on social media by an employee after purchasing a television led to a landmark decision. The court ruled that the use of customer data on private communication devices is impermissible.
🔙 The incident began when the customer purchased a TV and a wall mount in June 2022. After she returned the wall mount, she mistakenly received an inflated refund. The company contacted the customer through an employee’s private social media account to resolve the issue. The customer filed a lawsuit to obtain information about the use of her data and to prohibit its use on private devices.
🔜Initially, the lawsuit was dismissed because employees are not „recipients“ pursuant to Article 15(1)(c) of the GDPR, according to the reasoning.However, the right to information under Article 15 of the GDPR also extends to recipients or categories of recipients. The Baden-Baden Regional Court confirmed this in its ruling on August 24, 2023, ruling that the company must disclose the names of the employees who violated the regulations.The court also prohibited employees from using customer information on private devices.Although employees are not normally considered recipients, it follows that this only applies if the data is processed in accordance with company instructions.
👩💻 The ruling highlights that data protection is essential. Customers have the right to know who is accessing their data, and companies must ensure that personal data is adequately protected.
📢 The message is that business communications must not be made via private channels in order to comply with the data protection provisions of the GDPR. The use of business accounts on social media platforms is therefore essential for data protection-compliant communication with the customer.
