Newsletter data protection 07/2026

In its judgement of January 22, 2026, the Hamburg Administrative Court ruled that the Hamburg data protection authority was not entitled to oblige Google to remove certain search results that appeared when searching for the intervener’s name (Hamburg Administrative Court, decision dated 22.01.2026 – Ref.: 17 K 2480/23).

The court proceedings were preceded by a request from the intervener to have the results removed. She had initially contacted Google and subsequently the Hamburg Data Protection Supervisory Authority because pornographic, sexualised and other web spam content was displayed when searching for her name. After the intervener deemed the search engine operator’s efforts to be insufficient, and the discussions between Google and the supervisory authority also failed to produce the desired result, the supervisory authority formally prohibited Google from displaying the search results in question when searching for the intervener’s name. Google challenged this decision in court.

The Administrative Court (VG) of Hamburg deemed the supervisory authority’s decision to be unlawful, as, in the court’s view, the legal basis put forward by the supervisory authority under Article 58 (2) (f) and (g) of the GDPR was insufficient for this purpose. Under this provision, a supervisory authority may, in principle, require the erasure of personal data and the restriction of processing. However, in the court’s view, these powers do not allow it to impose an abstract and proactive filtering obligation on a search engine operator. The Hamburg Administrative Court refers in this regard to the case law of the European Court of Justice, according to which delisting can only be required in relation to specifically identified content. The Hamburg supervisory authority, however, had not limited its order to specifically named websites, but had instead described abstract generic characteristics. Google would therefore first have had to identify the websites in question itself. In the court’s view, the right to be delisted does not encompass precisely such a proactive obligation to delist. Accordingly, the supervisory authority was also unable to impose such an obligation. 

In its judgement of June 9, 2026, the Berlin Regional Court I reduced a fine of 14,500,000 euros imposed by the Berlin Data Protection Commissioner (Bln BDI) on the housing association Deutsche Wohnen SE to 900,000 euros (Berlin Regional Court I, decision dated 09.06.2026 – Ref.: 526 OWiG LG 1/20, press release of 09.06.2026).

In 2019, the Berlin Data Protection Authority (Bln BDI) imposed a fine of 14,500,000 euros on Deutsche Wohnen SE – the highest GDPR fine at the time – as the property group was using an archiving system that contravened data protection regulations – in which tenants’ personal data was stored despite the processing purpose no longer applying – and which had already been criticised by the authority in 2017. The amount of the fine was justified on the grounds that, despite the two-year transition period leading up to the GDPR coming into force on May 25, 2018 and the protracted supervisory proceedings, Deutsche Wohnen SE had failed to adapt the group’s IT system in good time. We reported on the fine notice at the time in our December 2019 newsletter.

As expected, the property group lodged an appeal against the fine notice. After the proceedings before the Regional Court were discontinued by order of February 18, 2021 due to a procedural obstacle, the Berlin Court of Appeal referred the case to the ECJ on appeal, asking whether a company’s liability for a fine requires culpable misconduct on the part of a specifically identified individual and whether such liability is based on fault. In its judgment of December 5, 2023, the ECJ ruled that a principle of imputation is unknown in European data protection law and answered the first question referred in the negative (ECJ, decision dated 05.12.2023 – Ref.: C-807/21). However, it held that liability is fault-based.

The case was therefore referred back to the Regional Court, which subsequently found that Deutsche Wohnen SE was at fault with regard to the breach of the principles of data minimisation and storage limitation. After all, it would have been technically possible and reasonable for the property group to delete the sensitive data of former tenants in good time. However, when calculating the fine, account must be taken of the fact that the company had engaged external auditors, consultants and IT specialists to adapt its IT systems, and that the data protection infringements were limited in time of the introductory phase of the GDPR.

Following the pronouncement of the judgement, the property group’s legal representatives remarked “that it is possible to successfully defend oneself in court against decisions by data protection authorities and other supervisory authorities under the EU Digital Rights Acts”.

The judgement is not yet final.

In a judgement dated May 20, 2026, the Karlsruhe Regional Court ruled that, in principle, there is no obligation to use end-to-end encryption in business email correspondence (Karlsruhe Regional Court, decision dated 20.05.2026 – Ref.: 8 O 266/25).

The claim was brought by a married couple who had entered into a contract of sale for gold bars with the defendant. The claimants initially received an invoice by email which, whilst visually similar to the original invoice subsequently sent by post, had been altered in key respects. In particular, the bank details and the IBAN to which payment was to be made had been changed. The plaintiffs therefore transferred the purchase price to an account that did not belong to the defendant. Consequently, the gold bars were not delivered. It was agreed that the details on the invoice had been falsified. It remained unclear at what stage the invoice had been tampered with: possibilities included alteration by a third party in the defendant’s IT system, in the recipients’ postbox, or during the communication process. The claimants continued to demand delivery of the gold bars; in the alternative, they sought damages for breach of an ancillary obligation under the sales contract and under Article 82 of the GDPR. In the claimants’ view, the invoice should only have been transmitted in encrypted form.

The Regional Court dismissed not only the claim for delivery but also the claims for damages asserted. A contractual claim for damages was ruled out simply because there was no agreement between the parties on the use of end-to-end encryption. Nor, in the court’s view, was there a claim for damages under data protection law arising from Article 82 of the GDPR. Firstly, the scope of application of the GDPR did not apply, as no personal data relating to the claimants had been processed. Only the defendant’s bank details, which did not relate to a natural person, had been altered and thus processed. In the court’s view, the protective purpose of Article 82 (1) of the GDPR was therefore not affected in this case. Furthermore, no general obligation to use end-to-end encryption could be inferred from the GDPR. It is true that, under Article 24 of the GDPR, the controller must implement appropriate security measures. However, when weighing up the relevant factors, the security expectations of the business community must also be taken into account. End-to-end encryption is not generally expected in business transactions due to the associated effort involved and has not become widely established.

The Regional Court of Karlsruhe has thus reached a different conclusion to the Higher Regional Court of Schleswig, which, in a separate case, had held that there was an obligation to use end-to-end encryption. We had already discussed that ruling in the main topic of our newsletter issued in June last year.

The State Data Protection Commissioner for Lower Saxony has published FAQs on artificial intelligence (FAQs on Artificial Intelligence, as at March 2026). These FAQs highlight the legal aspects that must be taken into account when using AI. In addition to data protection requirements, the FAQs also address the provisions of the AI Regulation.

Among other things, it answers fundamental questions, such as those concerning the risk levels set out in the AI Regulation for AI systems or the distinction between providers and operators of AI systems. The FAQ also contains practical guidance, for example on how to prevent data published on websites from being used to train AI models, or how to ensure that the use of AI does not breach the ban on automated decision-making.

Since June 19, 2026, businesses that conclude distance contracts with consumers via websites, online forms, booking pages or apps must provide a digital withdrawal function (‘Withdrawal Button’, Section 356a of the German Civil Code (BGB)). The aim of the new regulation is to make it just as easy for consumers to withdraw from an online contract as it is to conclude one.

The key requirements include, amongst others:

• Clearly visible labelling of the function
• Ease of location and accessibility on the online user interface
• Constant availability throughout the withdrawal period
• Implementation of a two-step procedure:
  • Collection or confirmation of the information required for withdrawal
  • Submission via a clearly labelled confirmation function
• Immediate transmission of an acknowledgement of receipt, including the content of the withdrawal and the date and time, via the communication channel chosen by the consumer.

In addition to the technical implementation, the withdrawal policy must also be amended. Consumers must be informed of the existence and location of the withdrawal function. If the withdrawal function is not provided correctly, the standard withdrawal period is extended from 14 days to 12 months and 14 days. Furthermore, fines and warnings may be imposed in the future. Companies that conclude online contracts with consumers therefore need to take action to implement the new requirements in good time. Where data processing in connection with the new cancellation button goes beyond existing functions or serves new purposes, the privacy policies on websites may also need to be amended. The Brandi Team will be happy to advise and assist with the implementation of the new requirements as required.

On April 17, 2026, the Italian Data Protection Authority (GPDP) imposed fines totalling 12,501,000 euros on the companies Poste Italiane S.p.A. and PostePay S.p.A. This was due to the use, in breach of data protection regulations, of a security solution in apps operated by the companies within the group, which, in particular, processed information relating to apps installed on or running on users’ devices (press release of 17.04.2026).

Users – customers of the postal companies – were asked to grant access to their device’s usage data in order to detect potentially harmful software. If permission was not granted, restrictions on app usage were threatened. The GPDP regarded this as a significant intrusion, as installed or running apps could potentially reveal information about sensitive aspects of users’ lives, such as health, finances, political or religious beliefs, or sexual orientation. 

The authority did not accept the reference to requirements concerning the security of payment services and fraud prevention as sufficient justification. In the GPDP’s view, there was no legal basis under Article 6 of the GDPR for the specific processing in question; furthermore, it criticised breaches of transparency obligations, ‘privacy by design’, the obligation to carry out a data protection impact assessment, as well as requirements relating to data processing on behalf of others, security and storage limits. 

On February 19, 2026, the Croatian Data Protection Authority (AZOP) imposed a fine of 100,000 euros on a property agency because, amongst other things, staff had received insufficient training in the handling of personal data. No harm to data subjects was established (press release of 19.02.2026).

In the authority’s view, the estate agency had failed to implement adequate training and supervisory measures for its staff and, consequently, had not put in place sufficient technical and organisational measures in accordance with Article 32 (4) of the GDPR. Under this provision, controllers must ensure that their staff, who have access to personal data, process it only on the controller’s instructions. Although the estate agency had carried out staff training, this was done irregularly and to an insufficient extent.

Furthermore, 11,887 agreements containing customers’ personal data from the years 2010 to 2019 were stored in the company’s archive, even though the purpose of processing no longer applied; the authority regarded this as a breach of Article 5 (1) (e) of the GDPR. In connection with these agreements, 914 copies of identity documents and bank cards were retained without a legal basis under Article 6 (1) of the GDPR. The AZOP regarded the managing director’s statement that no copies of bank cards were made as indicative of a lack of oversight over the estate agency’s processing activities, as well as insufficient awareness and a lack of training among staff.

Due to inadequate protection of health data, the French data protection authority (CNIL) has imposed a fine of five million euros on IQVIA OPERATIONS FRANCE (press release of 28.05.2026).

The company conducts studies focusing on specific diseases or treatment methods, for which it draws on two health databases. The health databases were authorised by the CNIL and subject to several conditions designed to minimise the data protection risks for data subjects and to safeguard their rights. Following several complaints, the CNIL carried out investigations and concluded that the personal data had only been pseudonymised – and not anonymised. As each patient had been assigned an individual identifier, it was possible to trace their medical history. Overall, the CNIL deemed the risk that data subjects could be identified to be too high.

Given the sensitive nature of the health data and the fact that tens of millions of individuals were affected, the fine was set at 5,000,000 euros. Furthermore, the authority ordered that remedial measures must be taken within six months, with a fine of 10,000 euros for each day of delay.