Judgment on data protection fine: Deutsche Wohnen gets off lightly

A recent court ruling in Germany has significantly reduced a substantial data protection fine issued against the housing company Deutsche Wohnen SE. While the court upheld that the company indeed violated GDPR provisions, the penalty was drastically lowered from €14.5 million to just under €1 million. This outcome highlights the complexities in enforcing data privacy regulations and determining appropriate financial penalties. The core of the violation involved Deutsche Wohnen's use of an archive system that lacked the capability to delete outdated personal data of its tenants. This system retained sensitive information, including salary slips, employment contracts, tax, social security, and bank statements, for extended periods without proper justification for retention. The Berlin Commissioner for Data Protection and Freedom of Information initially imposed the hefty fine due to these breaches of GDPR principles. The court acknowledged that Deutsche Wohnen acted intentionally regarding the data processing violations. However, the significant reduction in the fine was influenced by the company's efforts to engage external experts to adapt its IT systems to GDPR requirements. The court also considered that the violations occurred during the introductory phase of GDPR and that data protection authorities themselves faced challenges in adapting to the new legal landscape.