- Enforcing jurisdiction
- Germany · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Unknown Company – €50,000 Fine (Germany, 2019)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An unknown company was fined for not being transparent about who was handling personal data requests. They let an external company manage these requests without clear communication to users. This matters because it shows that companies must be clear about who is responsible for data processing.
What happened
The unknown company allowed an external service provider to handle data access requests without proper identification.
Who was affected
Individuals whose personal data requests were managed by the external company.
What the authority found
The authority found that the company violated transparency requirements and did not have a written contract with the external provider.
Why this matters
This ruling serves as a reminder that companies must clearly communicate who is processing personal data and ensure proper agreements are in place with third parties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 12 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data controller had engaged an external company to carry out the duties of access to data according to Art. 15 GDPR. However, the engaged company conducted the correspondence with the data subjects under its own logo and in English language, so that it was not apparent to the data subjects who was responsible for the data processing. As a result, the data controller infringed the principle of transparency laid down in Art. 12 GDPR and did not sufficiently fulfil its obligations to provide information in accordance with Art. 15 GDPR. In addition, the data protection supervisory authority found that no written contract for data processing had been concluded between the data controller and the external company, thus constituting a further breach of Art. 28 (9) GDPR.
Related Enforcement Actions (0)
No other enforcement actions found for Unknown Company in DE
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
1 January 2019
Authority
Bundesbeauftragter für den Datenschutz
Fine Amount
€50,000
About this data
Cite as: Cookie Fines. Unknown Company - Germany (2019). Retrieved from cookiefines.eu
Last updated: