Court decision · 5 December 2023
Deutsche Wohnen SE v Staatsanwaltschaft Berlin
Case C-807/21, ECLI:EU:C:2023:950 · Court of Justice of the European Union (Grand Chamber)
What it means for your code
You cannot push retention or deletion failures onto a single engineer's mistake; the organisation is answerable for what its systems do.
What happened
A property company was fined for keeping tenants' documents longer than necessary. German law required the authority to attribute the breach to an identified natural person acting for the company.
What was decided
A fine may be imposed on a company without first identifying a natural person who committed the infringement, and covers processing carried out by anyone acting for the company. A fine still requires the infringement to have been committed intentionally or negligently.
The legal test applied
- A fine may be imposed on a legal person without identifying a natural person who acted
- The company answers for processing carried out by anyone acting in the course of its business
- Liability still requires wrongful intent or negligence
What would have changed the outcome
- A breach the organisation could not have been aware of, despite adequate governance, is not negligent
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.