Germany: Issued German DSK opinion on precedence of national law in data violations under EU GDPR

On 5 January 2023, the Conference of the Independent Data Protection Authorities of Germany (DSK) issued its "Opinion on fundamental issues concerning the sanctioning of data protection violations by companies - ECJ Case C-807/21". The case concerns a fine of EUR 14.5 million imposed on German real estate company Deutsche Wohnen by the Berlin Commissioner for Data Protection and the Freedom of Information under the EU General Data Protection Regulation (GDPR) regarding the alleged illegal retention of personal data of tenants by Deutsche Wohnen, which was overturned by the District Court of Berlin for failing to meet requirements under German national law. The Berlin Court of Appeal submitted questions to the European Court of Justice (ECJ) on 21 December 2021 to clarify whether Article 83 of the GDPR had listed all the requirements that a data protection authority must have to fine a private entity, or whether national laws can impose additional requirements. In the DSK's Opinion, conflicting provisions in Germany's national law were not applicable, noting that under EU law, an objective breach of obligations attributable to the company, including the case that its employees had committed a breach, is sufficient to impose a fine.