- Enforcing jurisdiction
- Germany · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
paydirekt GmbH – Complaint Upheld (Germany, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Hesse DPA upheld a complaint against paydirekt GmbH for processing sensitive data without a legal basis. This is important because it shows that payment service providers must be careful about the data they collect. Companies should only gather necessary information to protect user privacy.
What happened
Paydirekt GmbH processed health-related and sexual life data without a valid legal basis.
Who was affected
A customer who used paydirekt GmbH for online purchases and whose sensitive data was processed.
What the authority found
The DPA found that paydirekt GmbH lacked a legal basis for processing certain personal data, violating GDPR requirements.
Why this matters
This case serves as a reminder for payment service providers to minimize data collection and ensure they have a valid reason for processing personal information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 19 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject purchased eye drops, skin care products, and other similar products from on online pharmacy website, as well as items from an online sex shop website. The data subject used the online payment service of Paydirekt GmbH (the controller) when paying for the online purchases. The controller stored data regarding the items purchased, along with the amount of money spent and the date of the transactions. The data subject filed a complained with the Hesse DPA (HBDI) in which she argued that the controller violated Article 5(1) GDPR and Article 9(1) GDPR by processing health-related data and data relating to her sexual life without a legal basis - specifically by storing the information on the individual items purchased. Moreover, the data subject argues that the controller was in violation of Article 25(1) GDPR by processing data that were not needed for the provision of the payment services (i.e. data minimisation). The DPA identified four purposes for the processing of information on the individual items purchased by the data subject carried out by the controller: # To show the information to the user when making a purchase 2. For fraud prevention 3. To offer the user a history of their transactions 4. To provide the information for the payment service customer support The DPA found that the controller did not have a legal basis for the processing for the 3rd and 4th purposes. However, the DPA found that the controller had a legitimate interest in processing the personal data for the 1st purpose, as it served the interest of the controller to minimise the number of mid-transaction cancellations made by customers. Furthermore, the DPA found that the controller had a legitimate interest in processing such personal data for the 2nd purpose, since processing was done in the interest of all parties involved. Next, the DPA held that the data relating to the items purchased from the online sex shop were not sensitive data within the meaning of Article 9(
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (1)
Other enforcement actions involving paydirekt GmbH in DE
Details
Decision Date
22 July 2022
Authority
DPA HBDI
About this data
Cite as: Cookie Fines. paydirekt GmbH - Germany (2022). Retrieved from cookiefines.eu
Last updated: