Deutsche Wohnen SE – Court Ruling (Germany, 2021)

The DPA of Berlin fined Deutsche Wohnen SE for violating Article 5(1)(c) and Article 5(1)(e) GDPR, because the DPA found that the company did not delete old data of tenants in a sufficient way. Deutsche Wohnen SE processed personal data like proof of identity, work, salary and creditworthiness, as well as data about health insurance, social insurance and tax within the framework of business activities. The Deutsche Wohnen SE did not agree with the DPA's decision and brought the action before court. The Court held that the fine notice was not valid. The fine notice was enacted against the Deutsche Wohnen SE as a legal entity under private law which is represented by its management. The Court, however, found that a legal entity can't be the subject of a fine procedure. According to the Court, only a natural person could commit an administrative offence in a reproachable way, while the legal entity just could be a secondary party, to which the actions of its representatives or board members are attributable. The DPA, on the contrary, held the opinion that a legal entity and a natural person can be treated in the same way in Administrative Offences Law. Furthermore, the fine notice did not mention the board member who committed or omitted the relevant action by name, nor contained it information about time and scene of the administrative offence or on what the reproach is supported. Therefore, the fine notice also cannot be reinterpreted into a separate decision according to § 30 (4) OWiG without having to adjust the fine procedure.