Berlin Regional Court overturns fine of millions against real estate company
Proceedings discontinued due to formal error
With the press release of November 5, 2019, the Berlin Data Protection Commissioner (BlnBDI) had still publicly reported on a fine of €14.5 million imposed on a real estate company for violations of the GDPR. However, this penalty notice was cancelled by the Berlin Regional Court in a decision dated February 18, 2021 (526 OWi LG) 212 Js-OWi 1/20 (1/20) and the proceedings were discontinued due to an impediment to proceedings.
According to the Berlin Regional Court, the penalty notice was issued in a procedure that is not provided for in the German Administrative Offenses Act (OWiG) and is therefore not permissible. The BlnBDI was not aware of this problem at the time of the decision on the fine and therefore took the view that a legal entity could be treated in the same way as a natural person in regulatory offence law and fined. According to the decision of the Berlin Regional Court, the supervisory authority would have had to establish in the course of the fine proceedings that a management person of the company had unlawfully and culpably committed a criminal or administrative offense. This act could then have been attributed to the legal entity in connection with the finding of breach of the duty of supervision. However, this did not happen in the supervisory authority’s fine proceedings and could not be made up.
Berlin public prosecutor’s office files complaint
The formal requirements for imposing a fine under the GDPR are highly controversial in literature and case law. As recently as November 2020, the Regional Court of Bonn took a different view and ruled that Art. 83 GDPR constitutes a sufficient legal basis for the direct liability of legal entities (judgment of 11.11.2020 – 29 OWi 1/20).
According to a press release by BlnBDI, the Berlin public prosecutor’s office has filed an appeal against the decision of the Berlin Regional Court. Consequently, it remains to be seen whether the discontinuation of the proceedings will stand and whether the case will be referred to the ECJ, if necessary.
Regardless of the outcome of the proceedings, it can in any case be assumed that the data protection supervisory authorities will not repeat the mistake made by BlnBDI.