Art. 11 (7) DGA:

"The provider of data intermediation service shall put in place adequate technical, legal and organisational measures in order to prevent transfer or access to nonpersonal data that is unlawful under Union law or national law of the relevant Member State."