Review of GDPR fines and data breaches 2025

German data protection agencies released at least 249 fines with a total sum of 46.9 mil. EUR in 2025. 45 mil. EUR of this were handed out to Vodafone by the BfDI. The total amount of fines went down; the sum total rose significantly.

General Court on the EU-U.S. Data Privacy Framework.

The General Court confirms that the shortcomings identified in the Schrems II ruling have been addressed and that the EU-U.S. Data Privacy Framework provides an adequate level of protection. Objections raised against the Data Protection Review Court (DPRC) and the mass collection of data by U.S. intelligence agencies are not upheld.

Review of GDPR fines and data breaches 2024

266 fines were issued by German data protection supervisory authorities in 2024, the highest of which was in the high six-figure range against a service provider. Both the number of German fines and the total amount decreased compared to the previous year. The number of data protection violations pursuant to Art. 33 GDPR is also declining.

The Federal Court of Justice (BGH) has issued a ruling in the Facebook scraping case.

In its ruling against Meta, the Federal Court of Justice (BGH) held that non-pecuniary damages can arise even from brief losses of control resulting from a violation of the GDPR.

Video Evidence in Court – The Federal Court of Justice Provides Clarity.

The Federal Court of Justice has ruled that video recordings made secretly are inadmissible as evidence if less intrusive means were available.

Landmark Decisions for the Practice of Imposing Fines

The European Court of Justice (ECJ) has issued two rulings that will significantly facilitate the work of supervisory authorities and, as a result, may advance the enforcement of sanctions.

Review of GDPR fines and data breaches 2023

357 fines were issued by German data protection supervisory authorities in 2023, the highest of which was a seven-figure fine against an unknown company In addition, a total of 24.749 data breaches were reported in accordance with Art. 33 GDPR. Both the number of German fines and the total amount decreased compared to the previous year.

BayLDA is inspecting apps and websites

The Bavarian State Office for Data Protection Supervision is currently reviewing apps and websites for compliance with data protection regulations. In doing so, it pays particular attention to the consent banners (“cookie” banners) on these sites.

ECJ ruling strengthens citizens' rights - data leaks can lead to compensation for damages

Victims of cybercrime are now entitled to non-material damages following the ECJ's landmark judgement. Furthermore, companies now have the burden of proof.

ECJ makes decision in proceedings against Deutsche Wohnen SE

The ECJ rules in the Deutsche Wohnen SE case, clarifying the issue of no-fault fines.