Deutsche Bahn Fernverkehr AG – Court Ruling (Germany, 2025)

Court Ruling
DPA OLGFrankfurtamMain10 July 2025Germany
final
Court Ruling

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

From October 2023 to December 2024, Deutsche Bahn Fernverkehr AG, the national railway company of Germany (controller), offered certain low-cost tickets ('Sparpreis' and 'Super Sparpreis') exclusively in digital form. To purchase these tickets—via app, telephone, or at the counter—data subjects were required to provide either an email address or a mobile phone number to receive a digital ticket or order number. The purchase was not possible via the ticket machines. A consumer protection organisation filed a claim before the Higher Regional Court Frankfurt (OLG Frankfurt am Main), requesting a cease and desist order, arguing that the controller processed personal data without a valid legal basis. The court held that the controller violated Article 5(1)(a) GDPR for processing personal data without a valid legal basis by requiring data subjects to provide an email address or mobile phone number in order to purchase the discounted tickets. First, it found that the controller failed to obtain freely given consent under Article 6(1)(a) GDPR since it did not offer an equivalent alternative for purchasing the ticket without providing personal data. Therefore, data subjects were not able to make a genuine and free choice, and therefore the consent could not be considered valid. The court referred to judgment [https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1 C-252/21 ECJ] in which it confirmed that consent is invalid when it is tied to the performance of a service without an alternative. The court also highlighted that the controller held a dominant market position in long-distance rail transport in Germany. This market power reinforced the lack of voluntariness in the purported consent, as data subjects had no reasonable alternative to using the controller’s services. Second, the court held that the data processing is not justified under Article 6(1)(b) GDPR, processing of contract data. It held th

GDPR Articles Cited

Art. 5(1)(a) GDPR
Art. 6(1) GDPR
Decision AuthorityOLG Frankfurt am Main
Full Legal Summary

From October 2023 to December 2024, Deutsche Bahn Fernverkehr AG, the national railway company of Germany (controller), offered certain low-cost tickets ('Sparpreis' and 'Super Sparpreis') exclusively in digital form. To purchase these tickets—via app, telephone, or at the counter—data subjects were required to provide either an email address or a mobile phone number to receive a digital ticket or order number. The purchase was not possible via the ticket machines. A consumer protection organisation filed a claim before the Higher Regional Court Frankfurt (OLG Frankfurt am Main), requesting a cease and desist order, arguing that the controller processed personal data without a valid legal basis. The court held that the controller violated Article 5(1)(a) GDPR for processing personal data without a valid legal basis by requiring data subjects to provide an email address or mobile phone number in order to purchase the discounted tickets. First, it found that the controller failed to obtain freely given consent under Article 6(1)(a) GDPR since it did not offer an equivalent alternative for purchasing the ticket without providing personal data. Therefore, data subjects were not able to make a genuine and free choice, and therefore the consent could not be considered valid. The court referred to judgment [https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1 C-252/21 ECJ] in which it confirmed that consent is invalid when it is tied to the performance of a service without an alternative. The court also highlighted that the controller held a dominant market position in long-distance rail transport in Germany. This market power reinforced the lack of voluntariness in the purported consent, as data subjects had no reasonable alternative to using the controller’s services. Second, the court held that the data processing is not justified under Article 6(1)(b) GDPR, processing of contract data. It held th

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Related Cases (0)

No other cases found for Deutsche Bahn Fernverkehr AG in DE

This is the only recorded case for this entity in this jurisdiction.

Details

Ruling Date

10 July 2025

Authority

DPA OLGFrankfurtamMain

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. Deutsche Bahn Fernverkehr AG - Germany (2025). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: