Data protection: Fines without breach of duty?

The ECJ has sentenced the housing group Deutsche Wohnen to pay a fine, thereby sharing the view of data protectionists in a fundamental legal discussion. The problem was that the legal entity behind the group was to be held responsible without any evidence of a breach of duty under data protection law by a manager.

You can find out everything you need to know here.

Data protection authority: Fine against group

The responsible data protection supervisory authority had already imposed a fine of 14.5 million euros on the Group on November 30, 2023. The reason for this was a breach of the General Data Protection Regulation (GDPR). The Group had stored excessive tenant data.

The authorities imposed the fine on the legal entity running the company.

Regional court: Proceedings to be discontinued

The company then lodged an appeal with the Berlin Regional Court.

The Regional Court justified its decision by stating that data protection violations are considered administrative offenses under German law. Under German law, these can only be committed by natural persons, but not by legal entities.

The regional court also criticized "serious deficiencies" in the fine notice.

ECJ: Companies can be sanctioned

Ultimately, the European Court of Justice (ECJ) had to deal with the fundamental question of the extent to which a legal entity operating a company in Germany can be fined under data protection law without it being possible to establish that a natural person has committed an administrative offense.

The ECJ ruled as follows: For the company to be sanctioned directly, it would be sufficient for it to be established that employees of the company had committed a breach of data protection law. It is not necessary to identify the specific person involved. Nor does it have to be established that a manager has acted. Ultimately, the ECJ sees every breach by an employee as a failure of the company's internal supervision.

This fundamental decision will also be relevant in future fine proceedings and shows once again how important compliance with data protection regulations is for companies in every sector.

Do you need support in the area of data protection law? Our team of experts will be happy to help you. Please contact us here!