1.9 million Euro fine against Brebau GmbH
Processing of extremely sensitive data of prospective tenants without legal basis.
| fineID | Date | Fine | Recipient | Country | Infringement | href | Land |
|---|
Fine details
BREBAU GmbH is a housing construction company based in Bremen and a wholly owned subsidiary of the City of Bremen.
According to the data protection authority in charge (LfDI), the company processed more than 9,500 data of prospective tenants without any legal basis. Amongst other things, this included recording information about their hair style, body odour and personal appearance. In more than half of the cases, even special categories of personal data within the meaning of Article 9(1) of the GDPR, which enjoy special protection under the GDPR, were processed. In particular, information on skin colour, ethnic origin, religious affiliation, sexual orientation and health status was processed unlawfully.
Furthermore, the company deliberately prevented requests from data subjects for transparency about the data processed by BREBAU.
The LfDI considered the incident a serious violation of the fundamental right to data protection and therefore imposed the fine on the basis of Art. 83 DSGVO.
According to the LfDI, the severity of the data protection violation would have justified a much higher fine. However, since BREBAU GmbH cooperated fully in the data protection supervisory procedure, endeavoured to minimise the damage and took internal measures to ensure that such incidents do not occur again, the amount of the fine was reduced considerably.
Two executives were dismissed in consequence of the incident.
