Deutsche Bahn Fernverkehr AG – Court Ruling (Germany, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Higher Regional Court in Frankfurt ruled against Deutsche Bahn for requiring customers to provide personal information to buy discounted tickets. This matters because it shows that companies can't force users to share personal data without offering alternatives. The court's decision reinforces the need for valid consent in data processing.
What happened
Deutsche Bahn required customers to provide an email address or phone number to purchase discounted tickets, violating data protection rules.
Who was affected
Customers trying to buy discounted tickets from Deutsche Bahn were affected.
What the authority found
The court held that Deutsche Bahn violated GDPR by processing personal data without valid consent, as no alternative purchasing method was offered.
Why this matters
This ruling highlights the importance of offering genuine choices to customers when collecting personal data. Companies must ensure that consent is freely given and not tied to the provision of services, especially when they hold significant market power.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
From October 2023 to December 2024, Deutsche Bahn Fernverkehr AG, the national railway company of Germany (controller), offered certain low-cost tickets ('Sparpreis' and 'Super Sparpreis') exclusively in digital form. To purchase these tickets—via app, telephone, or at the counter—data subjects were required to provide either an email address or a mobile phone number to receive a digital ticket or order number. The purchase was not possible via the ticket machines. A consumer protection organisation filed a claim before the Higher Regional Court Frankfurt (OLG Frankfurt am Main), requesting a cease and desist order, arguing that the controller processed personal data without a valid legal basis. The court held that the controller violated Article 5(1)(a) GDPR for processing personal data without a valid legal basis by requiring data subjects to provide an email address or mobile phone number in order to purchase the discounted tickets. First, it found that the controller failed to obtain freely given consent under Article 6(1)(a) GDPR since it did not offer an equivalent alternative for purchasing the ticket without providing personal data. Therefore, data subjects were not able to make a genuine and free choice, and therefore the consent could not be considered valid. The court referred to judgment [https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1 C-252/21 ECJ] in which it confirmed that consent is invalid when it is tied to the performance of a service without an alternative. The court also highlighted that the controller held a dominant market position in long-distance rail transport in Germany. This market power reinforced the lack of voluntariness in the purported consent, as data subjects had no reasonable alternative to using the controller’s services. Second, the court held that the data processing is not justified under Article 6(1)(b) GDPR, processing of contract data. It held th
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Deutsche Bahn Fernverkehr AG in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Deutsche Bahn Fernverkehr AG - Germany (2025). Retrieved from cookiefines.eu
Last updated: