- Enforcing jurisdiction
- Germany · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Company – €525,000 Fine (Germany, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A German company was fined €525,000 for a conflict of interest involving its data protection officer. The officer was also managing director of two service companies that processed data for the same company. This ruling emphasizes the need for clear separation of roles in data protection.
What happened
A company was fined for having a data protection officer who had conflicting interests.
Who was affected
The subsidiary of a Berlin-based e-commerce group that failed to appoint a compliant data protection officer.
What the authority found
The DPA ruled that the company violated GDPR rules by not addressing the conflict of interest after a prior warning.
Why this matters
This case highlights the importance of having independent data protection officers. Companies should ensure that their data protection practices comply with regulations to avoid significant fines.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 6 March 2026.
Processing notes: authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA of Berlin has imposed a fine of EUR 525,000 on the subsidiary of a Berlin-based e-commerce group. The company had appointed a data protection officer, who however was also the managing director of two service companies that processed personal data on behalf of the very same company for which they acted as data protection officer. These service companies are also part of the group to which the e-commerce company belongs. The DPA considered this to be a conflict of interest and found a violation of Art. 38 (6) GDPR. The DPA had already issued a warning to the company in 2021 due to the conflict of interest. When a new inspection this year revealed that no new data protection officer had been appointed, the DPA imposed the fine.
Related Enforcement Actions (0)
No other enforcement actions found for Company in DE
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
20 September 2022
Authority
Bundesbeauftragter für den Datenschutz
Fine Amount
€525,000
Enforcement Tracker ID
ETid-1398
About this data
Cite as: Cookie Fines. Company - Germany (2022). Retrieved from cookiefines.eu
Last updated: