The Data Protection Supervisory Authority for the state of
Berlin (Die Berliner Beauftragte für Datenschutz und
Informationsfreiheit, "Supervisory
Authority") recently issued a fine for GDPR
violations against Germany's second largest housing company
Deutsche Wohnen SE ("DW") for retaining
personal data without legal justification. The amount of the fine,
EUR 14.5m, is the highest issued
by a German Supervisory Authority for data protection infringements
so far and the first to be in the millions. Germany is thus
following the trend of increasing fines set by other EU Member
States' authorities, such as the UK, France and Austria in
particular.
What happened?
The fine was issued for alleged violations of the data
protection principles of Art. 5 GDPR and the data protection by
design principle of Art. 25(1) GDPR occurring between May 2018 and
March 2019. DW used an archiving system to store its tenants'
personal data that did not provide for an option to delete
