- Enforcing jurisdiction
- Germany · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Deutsche Bahn Fernverkehr AG – Court Ruling (Germany, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Deutsche Bahn Fernverkehr AG required customers to provide personal information to buy discounted tickets, which the court ruled was not allowed. The court found that customers were not given a real choice, violating their rights. This decision highlights the importance of obtaining valid consent when collecting personal data.
What happened
Deutsche Bahn Fernverkehr AG processed personal data without a valid legal basis by requiring customers to provide an email address or mobile phone number to purchase discounted tickets.
Who was affected
Customers who wanted to buy low-cost tickets from Deutsche Bahn were affected by the requirement to provide personal information.
What the authority found
The court ruled that Deutsche Bahn violated GDPR by not obtaining valid consent, as customers had no alternative to providing personal data for ticket purchases.
Why this matters
This ruling emphasizes that companies must ensure they have valid consent for data collection, especially when offering services. Other businesses should review their practices to avoid similar issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 19 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
From October 2023 to December 2024, Deutsche Bahn Fernverkehr AG, the national railway company of Germany (controller), offered certain low-cost tickets ('Sparpreis' and 'Super Sparpreis') exclusively in digital form. To purchase these tickets—via app, telephone, or at the counter—data subjects were required to provide either an email address or a mobile phone number to receive a digital ticket or order number. The purchase was not possible via the ticket machines. A consumer protection organisation filed a claim before the Higher Regional Court Frankfurt (OLG Frankfurt am Main), requesting a cease and desist order, arguing that the controller processed personal data without a valid legal basis. The court held that the controller violated Article 5(1)(a) GDPR for processing personal data without a valid legal basis by requiring data subjects to provide an email address or mobile phone number in order to purchase the discounted tickets. First, it found that the controller failed to obtain freely given consent under Article 6(1)(a) GDPR since it did not offer an equivalent alternative for purchasing the ticket without providing personal data. Therefore, data subjects were not able to make a genuine and free choice, and therefore the consent could not be considered valid. The court referred to judgment [https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1 C-252/21 ECJ] in which it confirmed that consent is invalid when it is tied to the performance of a service without an alternative. The court also highlighted that the controller held a dominant market position in long-distance rail transport in Germany. This market power reinforced the lack of voluntariness in the purported consent, as data subjects had no reasonable alternative to using the controller’s services. Second, the court held that the data processing is not justified under Article 6(1)(b) GDPR, processing of contract data. It held th
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Deutsche Bahn Fernverkehr AG in DE
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
10 July 2025
Authority
DPA OLGFrankfurtamMain
About this data
Cite as: Cookie Fines. Deutsche Bahn Fernverkehr AG - Germany (2025). Retrieved from cookiefines.eu
Last updated: