Court case 6 C 1.24 – Court Ruling (Germany, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The data subject was employed by the German Federal Financial Supervisory Authority (BaFin), the public authority responsible for supervising banks, financial service providers, and insurance companies. He worked as a case officer in a specialised unit dealing with serious financial misconduct, including organised crime and terrorism financing. Due to their work, employees in this unit regularly issue binding decisions, conduct on-site inspections, and may appear as witnesses in criminal proceedings, which makes them identifiable to affected persons. Because several employees in this unit had been threatened in the past, the data subject’s home address had been blocked from disclosure in the population register for many years. When the blocking period expired, he applied for a renewal. The local registration authority refused the request on the ground that no individual threat against the claimant had been demonstrated. The lower administrative court dismissed the data subject’s appeal against the authority’s decision, while the Higher Administrative Court ordered the renewal after the data subject also appealed the first instance court’s decision. The registration authority appealed to the Federal Administrative Court. The Court dismissed the appeal and confirmed that the blocking of the address had to be granted. The Court held that an address may be blocked where there are objectively verifiable facts showing that disclosure could endanger a person’s life, health, personal freedom, or similarly protected interests. This requires an individualised risk assessment, but it does not require that the applicant has already been personally threatened. Risks arising from a specific professional activity may suffice, particularly where other persons performing essentially the same tasks have been subjected to threats or attacks. In this case, the Court had to find a balance between the public’s right to transparency of information, and the employee’s right to privacy an
GDPR Articles Cited
The data subject was employed by the German Federal Financial Supervisory Authority (BaFin), the public authority responsible for supervising banks, financial service providers, and insurance companies. He worked as a case officer in a specialised unit dealing with serious financial misconduct, including organised crime and terrorism financing. Due to their work, employees in this unit regularly issue binding decisions, conduct on-site inspections, and may appear as witnesses in criminal proceedings, which makes them identifiable to affected persons. Because several employees in this unit had been threatened in the past, the data subject’s home address had been blocked from disclosure in the population register for many years. When the blocking period expired, he applied for a renewal. The local registration authority refused the request on the ground that no individual threat against the claimant had been demonstrated. The lower administrative court dismissed the data subject’s appeal against the authority’s decision, while the Higher Administrative Court ordered the renewal after the data subject also appealed the first instance court’s decision. The registration authority appealed to the Federal Administrative Court. The Court dismissed the appeal and confirmed that the blocking of the address had to be granted. The Court held that an address may be blocked where there are objectively verifiable facts showing that disclosure could endanger a person’s life, health, personal freedom, or similarly protected interests. This requires an individualised risk assessment, but it does not require that the applicant has already been personally threatened. Risks arising from a specific professional activity may suffice, particularly where other persons performing essentially the same tasks have been subjected to threats or attacks. In this case, the Court had to find a balance between the public’s right to transparency of information, and the employee’s right to privacy an
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 6 C 1.24 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 6 C 1.24 - Germany (2025). Retrieved from cookiefines.eu
Last updated: