Data protection lawsuit against Deutsche Bahn (DB)

The civil rights organization Digitalcourage has filed a lawsuit against Deutsche Bahn. It claims that Deutsche Bahn's "DB Navigator" app would collect users' data without their consent.

You can find out everything there is to know about this here.

Reproach of the civil rights organization Digitalcourage

The "DB Navigator" app helps users find the right train connections, find out about schedule changes and delays, and buy tickets digitally.

During an investigation of the Deutsche Bahn (DB) app, the civil rights organization Digitalcourage came across violations of data protection law. Immediately after starting, the app would establish several connections to third-party providers. This was done without prior query via a so-called cookie banner. The third-party providers to whom a connection is established in this way can then access the user's device. Among these third-party providers is also the analysis and tracking service "Adobe Analytics".

The connection to such third party providers may only be made with the consent of the user.

According to the organization's investigation, tracking cookies would even continue to be set in the "DB Navigator" app if the user selected the "Allow only required cookies" option. In addition to "Adobe Analytics", tracking services such as "Optimizely" or "Google Crashlytics" were also used.

The civil rights organization Digitalcourage sees this as a "clear violation of applicable law" and has now filed a lawsuit against DB after setting an unsuccessful deadline. The organization has also explained the reasons in a Statement of claim summarized.

Even the Stiftung Warentest wrote on the app: "So with the Navigator, there is critical data sending behavior because superfluous data is being sent."

Defense of Deutsche Bahn

DB, on the other hand, still considers itself to be in the right. After an initial request from the civil rights organization Digitalcourage to refrain from tracking, DB declared that it did not want to change anything.

DB vehemently rejects the criticism. It emphasized that customer data is secure. The use of cookies complies with data protection regulations. In a Press release DB explained: "When using DB Navigator, no customer data whatsoever flows to third-party providers. All service providers with whom DB cooperates on DB Navigator are contractually bound, do not act in their own interest and strictly according to DB's instructions, and are therefore not third parties within the meaning of the GDPR."

The criticized use of cookies is exclusively for securing the functions and stability of the app. The civil rights organization Digitalcourage did not take up the offer of a professional exchange.

Outlook

It remains to be seen how the Frankfurt am Main Regional Court will judge the matter.

Tracking services are always the basis for data protection disputes. However, open source projects such as Signal and Co. show that it is also possible without tracking.

Do you need support in the privacy-compliant design of your website, app, etc.? Our team of experts will be happy to assist you. If required, we can also provide an external data protection officer. Contact us without obligation here!