Dr. Sebastian Meyer, LL.M.
Lawyer and Notary in and for Bielefeld
Certified Specialized Attorney in information technology law (IT-Recht)
Data Protection Auditor (TÜV)
![[Translate to English:] Laptop](/fileadmin/_processed_/c/1/csm_referendare_guetersloh_f658b7d1e5.jpg)
Newsletter data protection
Newsletter data protection 12/2025
Last month saw some important news on the political front. On November 17, 2025, the Council of the European Union adopted an amendment to the GDPR to improve cooperation between supervisory authorities, which will result in, among other things, a strengthening of data subjects' rights. Last month, the European Commission also presented a digital package aimed at promoting innovation in the fields of artificial intelligence (AI) and data protection, as well as reducing administrative burdens on businesses. The introduction of so-called European Business Wallets will digitize data protection processes and interactions within the EU in the future, and a digital omnibus will simplify regulations on AI, cybersecurity, and data.
In our focus topic, we examine the data protection requirements that companies face when GPS tracking company vehicles and explain what a data protection-compliant arrangements could look like. We also report on rulings by the Federal Court of Justice (BGH) and the Administrative Court of Berlin (VG Berlin) on the concept and requirements of data protection responsibility. Both courts referred to the case law of the ECJ, which has already commented on the term defined in Art. 4 No. 7 GDPR on several occasions. The BGH now had to deal with the question of whether employees can also be controllers. In its ruling, the BGH answered this question in the negative, so that it can generally be assumed that companies are liable for data protection violations committed by their employees. An exception is made in the case of employee excess. We already explained what is meant by employee excess and what the consequences are in our October main topic. In contrast, the Administrative Court of Berlin dealt with joint responsibility in the context of advertising campaigns. Even if the advertiser determines the purpose of the data processing, according to the Administrative Court of Berlin, the company that carries out the advertising campaign with its own personal address data and in its own procedure is solely responsible for determining the means of processing.
If you have any feedback on this newsletter or questions relating to the topics covered in the newsletter, please send us an email at datenschutz@brandi.net. You can also find further contact details on our homepage.
Topic of the month / December 2025
GPS tracking of company vehicles
Companies regularly provide company vehicles to some of their employees, such as managers or field staff. This may be done as a special token of appreciation, as a monetary benefit, or for specific purposes such as business trips or the transport of work equipment.
This can lead to data protection pitfalls if these vehicles are equipped with global positioning system transmitters (hereinafter “GPS transmitters”), as is common in newer vehicle models ex works, so that their location can be tracked via an app or other means.
It is often overlooked that the material scope of the General Data Protection Regulation (GDPR) applies when personal data is stored in a file system or is to be processed wholly or partly by automated means (Art. 2 (1) GDPR). According to Art. 4 No. 1 GDPR, data is personal if it relates to an identified or identifiable natural person (hereinafter referred to as “data subject”); it is sufficient if the data subject can be identified directly or indirectly, in particular by assignment to an identifier such as location data. GPS tracking initially only records data on the location of the GPS transmitter. However, as soon as a company vehicle is assigned to specific employees or a limited group of people, the location data becomes personal. This location data can thus be used to draw conclusions about the whereabouts and driving behavior of the respective employee. This can result in a comprehensive movement profile of the employee.
If company vehicles are equipped with GPS transmitters and companies have access to this (personal) data, they are therefore obliged to find a viable legal basis for processing this data and to comply with the principles for processing personal data in accordance with Art. 5 (1) GDPR.
Newsletters as direct marketing
In its ruling of November 13, 2025, the ECJ dealt with the relationship between the ePrivacy Directive and the GDPR. Specifically, it addressed the question of under what conditions a newsletter constitutes direct marketing and whether its distribution must be based on a legal basis in accordance with Art. 6 (1) GDPR. The ECJ answered the latter question in the negative (ECJ, decision dated 13.11.2025 – Ref.: C-654/23).
The judgment was preceded by proceedings between Inteligo Media SA and the Romanian supervisory authority. Inteligo Media SA is the publisher of an online press medium that provides information about changes in the law. In order to access additional content, users can open a free user account, for which they are asked to provide their email address. In addition to accessing additional articles, users automatically receive a newsletter informing them about new articles on the website, unless they object to this when creating their account (known as “opt-out”). Users only gain access to all articles upon payment. Since the users had not given their express consent to receive the newsletter, the supervisory authority imposed a fine on the company.
In principle, according to Art. 13 (1) of the ePrivacy Directive, the prior consent of the recipient is required for the sending of emails for the purposes of direct marketing. However, an exception applies if the sender has obtained the recipient's email address “in connection with the sale of a product or service,” the advertising concerns similar products or services, and the recipient has the option to object to the sending of the email. Since the sending of the newsletter serves to promote articles that may be subject to a charge (namely when the user has used up their quota of free articles) and thus serves a commercial purpose, the Court of Justice considers this to be a case of direct marketing. The ECJ also considered the other requirements to be met. The existence of a legal basis under the GDPR was not necessary, as the ePrivacy Directive establishes specific obligations in this respect within the meaning of Article 95 GDPR.
This view of the ECJ can certainly be seen as a certain softening of the previously very strict interpretation, according to which, due to the reference to a “sale,” there always had to be a contract for consideration for the advertising of customers by email.
Transfer of positive data to credit agencies is lawful
In its ruling of October 14, 2025, the Federal Court of Justice ruled that the transfer of positive personal data to a credit agency may be justified by the interest in fraud prevention (Federal Court of Justice, decision dated 14.10.2025 – Ref.: VI ZR 431/24).
The defendant, a telecommunications company, transmitted positive data from customers to SCHUFA Holding AG after the conclusion of so-called postpaid mobile phone contracts. The data transmitted consisted of the master data required for identity verification and information on whether a contractual relationship had been established or terminated. Due to this action by the defendant, the plaintiff asserted a claim for injunctive relief and reimbursement of expenses for a warning letter.
After the Regional Court of Düsseldorf dismissed the action and the Higher Regional Court of Düsseldorf rejected the appeal against this decision, the Federal Court of Justice has now also dismissed the appeal as unfounded. In the opinion of the Federal Court of Justice, the transfer of data can be based on Art. 6 (1) (f) GDPR. According to this, processing is permissible if it is necessary to safeguard the legitimate interests of the controller or a third party, unless the interests or fundamental rights of the data subject prevail. The transfer of data served the purpose of fraud prevention; which is a legitimate interest, as shown in Recital 47 of the GDPR. Neither milder, equally effective means of achieving the purpose nor an unreasonable interference with the fundamental rights of the data subject are apparent. Unlike negative data, the positive data in question is also not sensitive data.
Employees are generally not controllers
In its ruling of October 7, 2025, the Federal Court of Justice emphasized that employees are generally not controllers within the meaning of the GDPR (Federal Court of Justice, decision dated 7.10.2025 – Ref.: VI ZR 294/24). The BGH refers to several decisions of the European Court of Justice (ECJ) in which the ECJ ruled that the employees of the controller regularly act on the basis of instructions from the controller and are therefore subordinate to the controller (e.g., ECJ, decision dated 11.04.2024 – Ref.: C-741/21).
The decision is in line with previous national and European case law on data protection liability. For companies, this means, among other things, that as controllers within the meaning of Art. 4 No. 7 GDPR, they are generally liable for data protection violations committed by their employees. Cases of employee excesses are an exception. We discussed the conditions under which such employee excesses occur and the consequences thereof in the October main topic of our newsletter.
Users of parking violation apps must pixelate recognizable individuals
In its ruling of September 9, 2025, the Dresden Higher Regional Court decided that users who upload images via a parking violation app must pixelate recognizable individuals. (Higher Regional Court of Dresden, decision dated 9.09.2025 – Ref.: 4 U 464/25).
The defendant photographed a vehicle that was parked in a no-parking zone and posted the photo on the parking violation app “weg.li.” The photo showed not only the time, location, and vehicle details, but also the clearly recognizable passenger (the plaintiff) sitting in the vehicle.
By taking and uploading the photo, the defendant decided on the purposes and means of data processing and was therefore also responsible for data protection. The app operators, on the other hand, processed the photo exclusively on behalf of the defendant. In the opinion of the Higher Regional Court, the data processing could not be based on the performance of public tasks pursuant to Art. 6 (1) (e) GDPR, which would have had to be assigned to the controller by a legal act. The defendant's legitimate interest in maintaining legal peace and investigating criminal offenses was countered by the passenger's right to his own image. After all, the passenger had been photographed without his knowledge in a parked vehicle and thus not in a public space. Furthermore, photographing vehicle occupants who are not drivers is not necessary for reporting parking violations or for evidentiary purposes. On the contrary, it would have been possible for the defendant to report the parking violation without referring to a specific person, for example by choosing a different perspective, a considerable distance, or by subsequently pixelating the passenger.
The defendant must now delete the photo, pay damages of 100 euros to the plaintiff, and reimburse the plaintiff's pre-trial legal fees.
Mira Husemann
Research Associate
No joint responsibility between advertisers and address traders
On October 14, 2025, the Berlin Administrative Court ruled that there is no joint responsibility under Art. 4 No. 7, Art. 26 (1) sentence 1 GDPR (VG Berlin, decision dated 14.11.2025 – Ref.: 1 K 74/24).
The plaintiff – a revue theater in Berlin – wanted to reach people who were not yet customers with a Christmas advertising campaign. It commissioned an address dealer to send out the advertising and provided it with the design of the advertising letter and target group characteristics. The address dealer then selected recipients from its own address database and according to its own so-called lettershop procedure. One recipient then filed a complaint with the competent supervisory authority, which issued a warning to the revue theater on the assumption of joint responsibility.
The Administrative Court rejected joint responsibility, referring to the case law of the European Court of Justice, according to which a company must actually influence the decision on the purposes and means of processing in its own interest in order to be jointly responsible. The revue theater had indeed determined the purpose of the data processing with its specifications, and its pursuit of economic profit also constituted a self-interest. However, the revue theater had no possibility of influencing the means of data processing. All data processing was carried out by the address dealer according to the lettershop procedure it had developed and using its own database. There was no organizational involvement on the part of the revue theater. As a result, in the opinion of the Administrative Court, only the address dealer was responsible under data protection law and the warning issued by the supervisory authority was therefore unlawful.
Mira Husemann
Research Associate
Digital Omnibus to dismantle digital regulation
On November 19, 2025, the EU Commission published a digital package that includes a so-called Digital Omnibus, a strategy for the Data Union, and the introduction of European Business Wallets (press release of19.11.2025). The aim is to promote innovation and reduce administrative costs for businesses.
A digital omnibus is intended to simplify existing regulations for artificial intelligence, cybersecurity, and data. The application of regulations for high-risk AI systems is to be linked to the availability of support tools. Furthermore, a single entry point is to enable the uniform reporting of cybersecurity incidents; previously, companies had to report incidents under different laws. To promote innovation, specific provisions of the Data Protection Regulation and the AI Regulation are to be amended and access to data improved. The rules on cookie banners are also to be modernized, allowing users to consent with a single click and save cookie preferences in operating systems.
The strategy for the data union includes measures to unlock high-quality data for AI by expanding access to this data. The introduction of measures such as an anti-leakage toolbox, safeguards for sensitive non-personal data, and guidelines for assessing the fair treatment of EU data abroad is also intended to strengthen Europe's data sovereignty.
Finally, the Commission proposed the introduction of a European Business Wallet. This is intended to digitize processes and interactions within Europe, leading to a reduction in administrative burdens and costs. Annual savings of 150 billion euros are expected.
Mira Husemann
Research Associate
Improving cooperation between data protection authorities
The Council of the EU has adopted an amendment to the GDPR, which it had already agreed upon in June with representatives of the Commission and Parliament. This revision is intended in particular to improve cooperation between national data protection authorities (press release of17.11.2025).
The background to this is the current system of cooperation between national data protection authorities. These authorities are obliged to cooperate in enforcing the GDPR when a cross-border data protection complaint is lodged. However, the competent national authority is responsible for leading the investigation. As a result, many cases are piling up at the Irish Data Protection Commission (DPC) in particular, as many digital companies such as Google and Meta have their European headquarters in Ireland.
An essential part of the changes is the harmonization of the requirements for the admissibility of cross-border complaints. In addition, the rights of complainants are to be strengthened, the cooperation procedure between data protection authorities simplified, and binding deadlines for investigations introduced.
Fine for transferring data to a third country
The Croatian data protection authority has imposed a fine of 4.5 million euros on a telecommunications company for transferring personal data to a third country (press release of14.11. 2025).
The telecommunications company transferred personal data of its customers and employees — including copies of identity cards and certificates of good conduct — to a processor in the third country of Serbia without a legal basis or protective measures. The processor is part of the telecommunications company's group of companies and is responsible for managing the software. This gave it unrestricted access to the entire database, which stored information on 847,862 customers. Between April 2020 and December 2022, the data transfer was still based on standard contractual clauses. After this date, there were no longer any standard contractual clauses between the parties, nor is there an adequacy decision by the EU Commission for Serbia. The company did not carry out a risk assessment and ignored the data protection officer's comment. As a result, the data transfer violated the provisions of Art. 44 in conjunction with Art. 46 (1) GDPR, which requires the implementation of appropriate safeguards for transfers to third countries. In addition, the customers concerned were not informed about the data transfer to third countries in accordance with Art. 13 (1) (f) GDPR. Furthermore, the processor had not taken sufficient protective measures, which the telecommunications company should have verified in accordance with Art. 28 (1) GDPR.
Mira Husemann
Research Associate
Fine for adding customers to a WhatsApp group
The Spanish Data Protection Agency (AEPD) has imposed a fine of 30.000 euros on THE RED KIWI for disclosing data by adding customers to a WhatsApp group (press release of14.11.2025).
The company, which operates in the healthcare sector, had added all 90 of its customers to a WhatsApp group in order to advertise aesthetic services. This meant that the names and numbers, as well as the health data of the customers, were visible to each other. The data protection authority became aware of the data protection violation as a result of a complaint from a customer and assessed the action as a violation of the principle of integrity and confidentiality under Article 5 (1) (f) of the GDPR, according to which personal data must be processed with an appropriate level of security and, in particular, must be protected against unauthorized or unlawful processing.
Mira Husemann
Research Associate
Fine for failure to report incorrect transmission of health data
The Polish data protection authority imposed a fine of 40.000 PLN on a medical center that failed to report a data protection breach to the competent supervisory authority (press release of27.10.2025).
An employee of the medical center accidentally sent a refund confirmation to the wrong patient. The document contained the name, account number, address, and health data, including information about prenatal diagnostics. The center believed that the incident could not violate the rights or freedoms of any natural person and failed to report it to the supervisory authority or the patient concerned. In the opinion of the data protection authority, the incident constituted a violation of the integrity and confidentiality of personal data due to the possible inference about the patient's state of health and posed a high risk of personal and discriminatory consequences. Consequently, it was necessary to report the incident to the supervisory authority and the patient concerned. The president of the supervisory authority, Mirosław Wróblewski, emphasized that reporting data protection violations was an effective measure for improving the security of personal data processing.
Mira Husemann
Research Associate