Berlin Regional Court Drastically Reduces Million-Euro Fine Against Deutsche Wohnen

A Milder Light on the Violation

Despite the significant reduction, the court maintains its fundamental criticism of the company's approach. "It would have been possible from the court's perspective for the Deutsche Wohnen Group 'to get it on the way more quickly,'" said Trost. The company had also acted "culpably," as it had not taken the obligation to regularly delete data seriously enough.

After approximately three months of proceedings, the prosecution had requested a fine of 7.3 million euros and stated in its closing argument that Deutsche Wohnen had made efforts "too late and insufficiently." A two-year transition period had also been granted. The court ultimately fell well below this request and imposed only 900,000 euros — a reduction of 13.6 million euros compared to the original notice.

Deutsche Wohnen itself had pleaded for acquittal, arguing that the stored data had already been "truncated," meaning blocked and secured against unauthorized access, during the relevant period. The company also pointed out that it had invested millions in modernizing the archive system before the period named in the notice. The judges were only partially convinced by these objections.

A Long Road Through the Courts

Procedurally, the case has already been a legal rollercoaster: In 2021, the Berlin Regional Court had initially overturned the authority's notice and terminated the proceedings due to a procedural obstacle, because the authority had not named a specifically responsible person for the alleged violation. The prosecution filed a complaint, and the Berlin Court of Appeals referred the question to the European Court of Justice (ECJ).

In December 2023, the ECJ ruled that data protection authorities may impose fines against companies even if they have not identified an administrative offense committed by a natural person in a leading position. At the same time, the ECJ made clear: "A fine may only be imposed against a company if the violation was committed 'culpably.'" The Regional Court has now applied these guidelines.

Signal Effect for Fine Practices

The judgment is not yet final (case number 526 OWiG LG 1/20). Deutsche Wohnen is a subsidiary of the DAX-listed housing company Vonovia. Observers consider the decision groundbreaking for the future fine practices of German data protection authorities, as the ECJ standard was applied in full to a major proceeding for the first time.

Data protection experts see a double message in the judgment: On the one hand, it confirms that GDPR violations can be punished even without naming a natural responsible person; on the other hand, it sets clear limits on the amount of such penalties. While the authority had originally sought to enforce one of Germany's highest GDPR fines, the amount ultimately imposed is comparatively low.

Deutsche Wohnen announced that it would await the written reasoning before deciding on possible further steps. The Berlin data protection authority also left open whether it would file an appeal. It therefore remains to be seen whether the legal dispute over the handling of tenant data will go into another round.

Regardless of the outcome, the case has a signal effect: It illustrates how difficult it is for supervisory authorities to prove specific breaches of duty against large corporations, and at the same time strengthens the position of affected companies that can point to cooperative behavior and technical solutions.