Berlin Data Protection Commissioner Imposes €14.5 Million Fine For GDPR Infringement

On 30 October 2019, the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit) ("Berlin DPA") issued a €14.5 million administrative fine against the real estate company Deutsche Wohnen SE for infringements of the GDPR.

Facts

During an on-site inspection in June 2017, the Berlin DPA found that the company was storing personal data belonging to its tenants in an archive system. This archive system did not allow for the deletion of stored data which was no longer required. In some cases, tenants' personal data was being stored without considering whether storage was permitted or even required. Furthermore, in some cases, outdated tenants' private information was stored, even if it failed to satisfy the criteria for which it was originally collected. The Berlin DPA noted that the stored data included tenants' personal and financial details, such as salary certificates, self-disclosure