Deutsche Wohnen SE – Court Ruling (Germany, 2021)

On 30 October 2019, the Berlin Data Protection Authority (DPA) fined Deutsche Wohnen SE 14,500,000 € for violating Article 5(1)(e) and Article 25(1) of the GDPR, as the company's archive system was structurally unable to delete unnecessary data. Deutsche Wohnen, a publicly listed real estate enterprise managing around 163,000 housing units and 3,000 commercial units through its subsidiaries, processed tenants' personal data, including proof of identity, health and social insurance information, tax data, and details of previous tenancies. The DPA, on its own initiative, conducted an inspection and found that the controller's subsidiaries were storing tenants' personal data without ensuring the ability to delete data that was no longer necessary. The DPA initially ordered Deutsche Wohnen to delete the data by the end of 2017, but the company claimed deletion was impossible due to technical and legal reasons. It argued that the old data would need to be migrated to a compliant system that met statutory retention requirements. Despite an ongoing exchange between the company and the DPA, a follow-up inspection in 2020 revealed no substantial progress in rectifying the GDPR violations. The DPA then issued a penalty order, citing that, from 25 May 2018 to 5 March 2019, Deutsche Wohnen had deliberately failed to take measures to enable the deletion of unnecessary data. The authority also imposed further fines for the continued storage of personal data relating to at least 15 tenants. Deutsche Wohnen appealed the decision, and on 18 February 2021, the Regional Court of Berlin overturned the DPA’s decision, arguing that under German law (specifically Paragraph 30 of the Law on Administrative Offences, OWiG), only natural persons could be subject to administrative fines, not legal entities. The Court held that while the actions of representatives could be attributed to the legal entity, there was no evidence of individual responsibility among Deutsche Wohnen’s representatives.