Compliance with the EU's General Data Protection Regulation
(GDPR) has long been a complicated, arduous task, but compliance
officers can always start with one universal driver: your
company's GDPR risk keeps going up.
The European Court of Justice (ECJ) reminded everyone of that
point at the end of 2023, when the court made a landmark ruling
about when corporate organizations can face liability for GDPR
infractions. In short, the ruling gives data privacy regulators
more discretion to impose fines for GDPR violations – which
means companies have all the more reason to get their GDPR
compliance programs right.
We can start with the case itself and how it came to pass. It
involves a German property company, Deutsche Wohnen. In 2019 German
privacy regulators fined Deutsche Wohnen €14.5 million for
keeping tenants' personal data longer than was necessary, which
violates Article 6 of the GDPR.
