GDPR fine in court: 900,000 euros

Two fines of 900,000 euros instead of millions

Two of the best-known German GDPR fines have shrunk to a fraction of their original size in court. The Berlin data protection commissioner had imposed around 14.5 million euros on Deutsche Wohnen SE; a Berlin court reduced this to 900,000 euros. The Lower Saxony data protection authority demanded around 10.4 million euros from notebooksbilliger.de, and the final figure here is also 900,000 euros. That is not an acquittal: both courts confirmed the infringements and simply did the maths differently from the authorities.

Deutsche Wohnen: tenant data not deleted

Berlin Regional Court I handed down its ruling on 9 June 2026 (case number 526 OWi LG 1/20). The allegation: the housing group had failed to reconfigure its IT system in good time so that former tenants' data would be deleted within the applicable periods. The archive still contained salary statements, bank statements and identity card documents, even though they were no longer needed once the tenancy agreement had ended. The court saw this as an intentional breach of the principles of data minimisation and storage limitation: data may only be stored for as long as it is needed. The period in question ran from 25 May 2018 to 5 March 2019.

The road to the ruling was a long one. The fine was issued in October 2019. The Regional Court discontinued the proceedings in 2021 because no specific member of management could be identified as responsible. The Higher Regional Court referred the question to the European Court of Justice, which made it clear in December 2023 that an authority may penalise a company even if it cannot prove an infringement against any individual manager personally. The Regional Court then had to hear the case again. The ruling is not yet final; both sides can lodge an appeal on points of law.

notebooksbilliger.de: 81 cameras on site

For the electronics retailer from Sarstedt, the issue was video surveillance. 81 cameras covered sales and work areas as well as an outdoor area used for breaks, with a further seven cameras covering publicly accessible zones. Some of the footage was kept for 60 days, and there was no technical pixelation. The company cited organised theft on the company premises. That was real: in 2023, four former employees were convicted, with the theft of 96 laptops and 18 smartphones proven. None of this changed the infringement, because the authority found blanket surveillance of employees without any specific cause, and the courts ultimately agreed.

The then state data protection commissioner imposed around 10.4 million euros at the end of 2020. Hannover Regional Court reduced the amount to 700,000 euros in May 2024. The public prosecutor's office appealed on points of law against this and demanded at least five million euros. Celle Higher Regional Court raised the fine to 900,000 euros by order of 18 December 2025 (case number 3 ORbs 113/25), in its own words a "moderate" increase. No further appeal is available against this order.

The difference between 10.4 million and 900,000 euros lies in the method of calculation. The authority used the German supervisory authorities' model, which is based almost exclusively on annual turnover. With turnover of around 736 million euros, this produced a range of up to 29.4 million euros, four per cent of turnover. The authority applied around a third of that.

The courts instead turned to the European Data Protection Board's guidelines from 2023. Because the company had a return on sales of only 1.8 per cent in 2019, there was first a reduction to around 22 million euros. Then the gravity of the infringement came into play, and both instances classified it as low. For low gravity, the guidelines provide for a maximum of ten per cent of the maximum amount. What remained was an upper limit of around 2.2 million euros, of which the Regional Court applied roughly a third in view of mitigating circumstances. The Higher Regional Court expressly endorsed this approach. It rejected only one of the Regional Court's considerations as legally flawed: the idea that the range of fines should be applied with restraint shortly after the GDPR came into force. There was no basis for this either in the legislation or in the guidelines. It therefore raised the fine to 900,000 euros.

What persuaded the courts to be lenient

In both cases, the companies' conduct counted. Deutsche Wohnen had brought in external auditors, consultants and IT specialists to bring the group's systems into line with the GDPR. The infringements fell within the regulation's introductory phase. The Berlin chamber also pointed out to the authority that it had itself had difficulties with the new legal framework. The presiding judge summed it up by saying that the infringement appeared "in a milder light". In the chamber's view, the company could nonetheless have got things moving more quickly.

In the notebooksbilliger.de case, what counted was that the company had been very cooperative up until the fine was issued and had promptly remedied every point of criticism. Most of the footage had been deleted without anyone having viewed it. The Lower Saxony commissioner Denis Lehmkemper welcomed the fact that the court had followed the authority's arguments. At the same time, he said, the reduction showed that German courts apply the range of fines under EU law "very cautiously".

What this means for companies

The first lesson is uncomfortable. A fine can be challenged, but an objection costs years. Deutsche Wohnen has been waiting for a final outcome since 2019; in the notebooksbilliger.de case it took around five years. Anyone taking this route needs patience and would do well to weigh the costs of the proceedings against the potential saving.

The second lesson concerns the amount. Since the Celle order, it is settled that courts may apply the European guidelines and that the gravity of the infringement counts for more than turnover. That pushes the range down considerably even where turnover runs into the hundreds of millions. The bonus for the GDPR's early years, by contrast, rests on shaky ground: the Berlin chamber granted it, the Higher Regional Court rejected precisely that reasoning. Anyone still operating today without a deletion policy, or with cameras in the break area, should not rely on it.

The third lesson is the most favourable: cooperation pays off. Both courts gave credit for the fact that the companies had cooperated, brought in specialists and remedied the shortcomings. The argument that the authority must first identify a culpable manager has been off the table since 2023. The company is liable as such. A deletion policy for customer and tenant data, and a review of every camera to see whether it is really needed, are therefore cheaper than any set of proceedings.

Conclusion

Both courts confirmed the infringements and merely corrected the authorities' maths: the gravity of the infringement counts for more than turnover, cooperation reduces the amount, and in the Higher Regional Court's view the GDPR's early years are no basis for a discount. And 900,000 euros is still 900,000 euros. For companies, a deletion policy that works is cheaper than working through the courts.