Deutsche Wohnen SE – Court Ruling (Germany, 2021)

On 30 October 2019, the Berlin Data Protection Authority (DPA) fined Deutsche Wohnen SE 14,500,000 € for violating Article 5(1)(e) and Article 25(1) of the GDPR, as the company's archive system was structurally unable to delete unnecessary data. Deutsche Wohnen, a publicly listed real estate enterprise managing around 163,000 housing units and 3,000 commercial units through its subsidiaries, processed tenants' personal data, including proof of identity, health and social insurance information, tax data, and details of previous tenancies. The DPA, on its own initiative, conducted an inspection and found that the controller's subsidiaries were storing tenants' personal data without ensuring the ability to delete data that was no longer necessary. The DPA initially ordered Deutsche Wohnen to delete the data by the end of 2017, but the company claimed deletion was impossible due to technical and legal reasons. It argued that the old data would need to be migrated to a compliant system that met statutory retention requirements. Despite an ongoing exchange between the company and the DPA, a follow-up inspection in 2020 revealed no substantial progress in rectifying the GDPR violations. The DPA then issued a penalty order, citing that, from 25 May 2018 to 5 March 2019, Deutsche Wohnen had deliberately failed to take measures to enable the deletion of unnecessary data. The authority also imposed further fines for the continued storage of personal data relating to at least 15 tenants. Deutsche Wohnen appealed the decision, and on 18 February 2021, the Regional Court of Berlin overturned the DPA’s decision, arguing that under German law (specifically Paragraph 30 of the Law on Administrative Offences, OWiG), only natural persons could be subject to administrative fines, not legal entities. The Court held that while the actions of representatives could be attributed to the legal entity, there was no evidence of individual responsibility among Deutsche Wohnen’s representatives. Thus, the company could not be fined. The Berlin Public Prosecutor’s Office appealed this decision. The Kammergericht Berlin, the referring court, is now called upon to rule at final instance. The KG Berlin decided to suspend proceedings and referred the following preliminary questions to the CJEU: (1) Is Article 83(4) to Article 83(6) GDPR of the GDPR to be interpreted as incorporating into national law the functional concept of undertaking and the functionary principle associated with Articles 101 and 102 TFEU, with the consequence that, by extending the principle of legal entity on which Paragraph 30 of the OWiG is based, a fine procedure may be conducted directly against an undertaking and the penalty is not imposed on the determination of a person identified by a natural and identified person: if applicable, a fully tort, committed administrative offence is required? (2) If the answer to Question (1) is in the affirmative, must Article 83(4) and Article 83(6) GDPR be interpreted as meaning that the undertaking must have culpably committed the infringement mediated by an employee (see Article 23 of Council Regulation (EC) No 1/2003 of 16 December 2002 implementing the rules on competition laid down in Articles 81 and 82 of the Treaty), or is an objective breach of duty attributable to the company ("strict liability") already sufficient in principle for a fine of the company?