Supervisory authorities do not automatically have to impose fines for data protection violations. Rather, they have discretionary powers under the General Data Protection Regulation (GDPR) to remedy any shortcomings identified. This is the result of a recent ruling by the European Court of Justice (ECJ) (case no.: C-768/21 of 26/09/2024).

In this case, a savings bank employee had accessed a customer's data without authorisation and without informing the customer. The savings bank's data protection officer was unable to recognise any risk to the customer because the employee had neither copied nor saved the data. The savings bank also took disciplinary action against the employee and informed the state data protection officer. The customer concerned also contacted him. When the state data protection officer, after hearing the savings bank, also deemed no further measures necessary, the customer filed a lawsuit and wanted to oblige the state data protection officer to impose a fine on the savings bank.

The Wiesbaden Administrative Court referred the case to the ECJ for clarification. The court has now clarified once again that no penalties can be imposed if all necessary measures are taken promptly after becoming aware of the breach in order to prevent a repeat data protection breach. According to the ECJ's press release, the authorities„ discretion is “limited by the need to ensure a consistent and high level of protection of personal data within the clearly enforceable legal framework of the GDPR". Whether the State Data Protection Commissioner has complied with these limits must now be decided again by the Wiesbaden Administrative Court.

The contact person for all questions relating to data protection and access to information in our practice is Rechtsanwalt Dr Dominik Lück.