- Enforcing jurisdiction
- Germany · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Restaurant operator – €50,000 Fine (Germany, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A restaurant operator in Germany was fined €50,000 for misusing customer data collected during the pandemic. The restaurant required visitors to provide personal information for contact tracing but later used that data for marketing without proper consent. This case highlights the need for transparency in how customer data is used.
What happened
A restaurant operator was fined for unlawfully using customer data collected for contact tracing for promotional purposes.
Who was affected
Restaurant visitors who provided their personal information for contact tracing.
What the authority found
The authority ruled that the restaurant unlawfully processed email addresses for advertising without obtaining proper consent.
Why this matters
This ruling emphasizes the necessity for businesses to clearly communicate how they will use customer data and obtain consent for any additional uses. Companies should ensure compliance with data protection laws to avoid penalties.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 12 March 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA of Brandenburg has imposed a five-figure fine on a restaurant operator. During the Corona pandemic, the operator had required restaurant visitors to fill out forms with their name, address, telephone number and e-mail address for the purpose of contact tracing as required by law. However, there was no legal requirement to collect the e-mail address. Visitors were further required to check a box stating that they agreed to be contacted by the restaurant. However, the restaurant subsequently used the email addresses to send a promotional newsletter. During its investigation, the DPA found that the processing of the email address for advertising purposes was unlawful due to the fact that the requirements for giving effective consent were not met. After all, it was not clear to the data subjects that the restaurant intended to use the e-mail address for advertising purposes. The restaurant operator also failed to inform the data subjects of their right to withdrawal.
Related Enforcement Actions (1)
Other enforcement actions involving Restaurant operator in DE
Details
Fine Date
1 January 2022
Authority
Bundesbeauftragter für den Datenschutz
Fine Amount
€50,000
About this data
Cite as: Cookie Fines. Restaurant operator - Germany (2022). Retrieved from cookiefines.eu
Last updated: