Review of GDPR fines and data breaches 2022

453 penalty notices were issued by the German state data protection authorities in 2022. The highest of these was imposed on BREBAU GmbH amounting to EUR 1.9 million. In addition, a total of 21.170 data breaches were reported under Art. 33 of the GDPR. The total amount of German fines increased compared to the previous year, but the number of fine notices fell slightly behind the previous year.

Review of GDPR fines and data breaches 2021

373 fines were issued by German data protection authorities in 2021. The highest of these was imposed on Vattenfall (901 Thousand EUR). In addition, a total of 13.890 data breaches were reported under Art. 33 GDPR. Both the combined sum of fines and the number of data breach notifications fell far behind the previous year.

Bundesrat passes TTDSG

On the 20th of May, the Bundesrat passed the "Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei Telemedien" (TTDSG, Engl.: "Data Protection and Privacy in Telecommunications and Telemedia Act"). It will come into force on the 1st of December 2021.

EU Commission publishes new standard contractual clauses

EU Commission publishes new standard contractual clauses for the legitimisation of data transfers to third countries.

Update "Schrems II": Supervisory authorities begin review of data transfers.

With the "Schrems II" ruling, the ECJ had determined that the transfer of personal data to the USA may no longer take place on the basis of the so-called Privacy Shield. Since then, numerous questions have arisen about third-country transfers to the USA and other third countries that do not have an adequate level of data protection. Now the data protection supervisory authorities have begun a coordinated review of data transfers across countries.

Review of GDPR fines and data breaches 2020

The data protection authorities of Germany’s federal states issued 283 fines in 2020, three of which ran into the millions – including the highest ever imposed in Germany to date as a result of violations of the General Data Protection Regulation (GDPR): a fine of around €35.3 million issued to H&M. All in all, however, the fines are much lower and they relate to natural persons or small enterprises. In addition, a total of 8,943 data breaches in accordance with Article 33 GDPR were reported.

Spying affair in the Federal Ministry of Health: Sentences reduced by the Federal Court of Justice.

In a 2019 case before the Berlin Regional Court, Christoph H. and Thomas Bellartz were sentenced to fines and prison terms for hacking into email accounts belonging to the Ministry of Health. In the appeal proceedings, the Federal Court of Justice (BGH) determined that the fact that the security measures that were bypassed were easy to circumvent did not affect the criminal nature of the offense.

Bonn Regional Court Reduces Million-Euro Fine Against 1&1 to 900,000 Euros

The Bonn Regional Court confirmed that 1&1 Telecom had violated Article 32 of the GDPR, but reduced the fine to 900,000 euros.

ECJ Ruling on Schrems II

The European Court of Justice has declared Decision 2016/1250 on the Privacy Shield invalid. With regard to the application of the standard contractual clauses, supervisory authorities are required to prohibit data transfers if compliance with the clauses cannot be ensured.

Federal Court of Justice Ruling on the Planet 49 Case

The Federal Court of Justice clarifies: The use of advertising cookies is permitted only with consent. Pre-checked opt-in boxes do not constitute valid consent.