Enforcing jurisdiction
Germany · Geography does not establish applicable law.
Confirmed applicable legislation
Privacy topics

CJEU case C-807/21 Deutsche Wohnen – CJEU Judgment (Germany, 2023)

CJEU Judgment
Court of Justice of the European Union5 December 2023Germany
final
CJEU Judgment

CJEU judgment — not a DPA enforcement action

This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.

The Court of Justice ruled on a case involving Deutsche Wohnen, a real estate company, regarding its handling of tenant data. The court found that Deutsche Wohnen failed to properly manage personal data, which is crucial for tenant privacy. This ruling sets a precedent for how companies must handle personal data responsibly.

What happened

Deutsche Wohnen was found to have improperly stored tenant personal data.

Who was affected

Tenants whose personal data was managed by Deutsche Wohnen.

What the authority found

The Court held that Deutsche Wohnen did not comply with GDPR requirements for data management and erasure.

Why this matters

This ruling emphasizes that companies must have strict data management practices in place to protect personal information and avoid penalties.

Recorded legal citations
Automatically processed
Art. 83(4) GDPR
Art. 83(5) GDPR
Art. 83(6) GDPR
View original scraped data
Art. 83(4) GDPR
Art. 83(5) GDPR
Art. 83(6) GDPR

Original imported citations before automated processing; the processing history does not establish independent verification.

Decision AuthorityCJEU
Reviewed AuthorityKG Berlin (Germany)

Source checks

Secondary-source text retrieved.

Automated check recorded — 21 March 2026.

Processing notes: national law identified.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

DW is a listed real estate company and indirectly holds around 163,000 housing units and 3,000 commercial units. The owners of these units are subsidiaries (holding companies) of DW and lease the units to other companies in the group (service companies). DW is only in charge or the central management. DW and the group of companies which it manages process the personal data of the tenants of said units. In 2017, the Berlin DPA informed DW during an on-the-spot inspection that companies within its group were storing personal data in a potentially infringent filing system. The DPA could not tell if it the storage was necessary nor if there were safeguards to ensure the erasure of data which was no longer required. DW told the DPA that it would move data to a more compliant database but this never materialised in practice. In 2019, the DPA fined DW €14,385,000 for intentional infringement of Article 5(1)(a), (c) and (e) and of Article 25(1) GDPR. The DPA found that DW intentionally failed to take the measures needed to allow personal data relating to tenants to be regularly erased or to check whether they had erroneously been stored. It also stated that DW had continued to store the personal data of at least 15 named tenants where such storage was not necessary. DW appealed this decision to Berlin's Regional Court. The court stated that the imposition of a fine on a legal person is regulated by national law (Paragraph 30 of the OWiG).The Act on Regulatory Offences: https://www.gesetze-im-internet.de/englisch_owig/index.html As a requirement for the imposition of the administrative fine against a legal person, German law requires that the original infringement shall be attributed to a natural person that is responsible for the legal person's compliance with the law. The Public Prosecutor's Office in Berlin filed an appeal with Berlin's Higher Regional Court. The Court observed that the limited liability regime of legal persons under national law is incompatible with

Outcome

CJEU Case

A judgment or Advocate General opinion in a case before the Court of Justice of the European Union.

Related Cases (0)

No other cases found for CJEU case C-807/21 Deutsche Wohnen in DE

This is the only recorded case for this entity in this jurisdiction.

Details

Judgment Date

5 December 2023

Authority

Court of Justice of the European Union

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. CJEU case C-807/21 Deutsche Wohnen - Germany (2023). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: