At the heart of the case was the question of whether the platform operator is merely a „technical service provider“ that hosts third-party content, or whether it is itself responsible under data protection law? The ECJ's answer is clear: the operator of an online marketplace is the „controller“ within the meaning of the GDPR for the processing of personal data contained in user adverts. This applies in any case if the platform not only stores the data neutrally, but actively structures and commercially utilises the publication, for example by specifying the presentation, categorisation, duration and reach or through its own commercial purposes such as advertising. Precisely because the data is only „brought onto the Internet“ and made accessible to the public by the platform, it does not remain in a purely passive role.

What the ECJ derives from this is particularly far-reaching: For platforms, a mere „report-and-delete“ is not sufficient if their service typically harbours the risk of users posting sensitive data. The ECJ emphasises that data controllers must ensure the principles of lawful data processing and must therefore design technical and organisational measures in such a way that data protection violations are prevented as far as possible before publication. For „special categories“ of personal data (colloquially: sensitive data, such as data relating to sexual life), this means that publication is generally prohibited unless explicit consent or another narrowly defined exception pursuant to Art. 9 para. 2 GDPR has been obtained. Accordingly, the operator must provide processes that reliably safeguard these requirements before publication. 

The ECJ links this to very specific compliance consequences. The judgement shows that the platform operator cannot simply close its eyes to the problem of consent in the case of an anonymous advertising system. If the platform and advertiser jointly enable publication, the platform operator must be able to collect the identity of the advertiser and verify it within a suitable framework in order to make the responsibilities and evidence (in particular regarding consent for sensitive data) practically manageable. Furthermore, the ECJ clarifies that the liability privileges of e-commerce law (and the logic of „no general monitoring obligation“) do not override the obligations arising from the GDPR. Responsibility under data protection law and the obligation to take appropriate protective measures exist independently of this.

In practice, this is a paradigm shift: operators of classifieds portals, marketplaces and platforms with user-generated adverts need to rethink their product and moderation architecture, moving away from purely reactive processes towards risk-based precautions „by design“. The more likely a service is to be at risk of abuse (e.g. personals, personalised services, adult categories), the more likely it is that identity checks, pre-filters, staged approvals, consent workflows and robust verification processes will be required. At the same time, the risk of liability and fines increases because those affected can no longer only take action against the anonymous advertiser, but also directly against the platform operator under data protection law. 

Der Beitrag Zur Verantwortlichkeit von Online-Marktplätzen erschien zuerst auf DPL Consult Datenschutzagentur.

The Federal Court of Justice denied the law firm's right to information, thereby confirming the decisions of the lower courts. In the court's opinion, there was no „illegal content“ within the meaning of the relevant provision that would trigger an obligation to provide information. The decisive factor here was the distinction between statements of fact and value judgements: a criminal statement of fact requires that a statement be verifiable and provable and that it fulfils the elements of one of the criminal offences listed in Section 21 (2) TDDDG, such as insult, defamation or libel. The Federal Court of Justice found that the contested review in the present case could not be qualified as an objectively verifiable, factual statement, but rather as a subjective expression of opinion with a value judgement character. Insofar as it contained factual elements, these were inseparably linked to the evaluative impression that the user wanted to convey. In cases of ambiguous statements, the Federal Court of Justice ruled that, in case of doubt, the decision should be made in favour of freedom of expression. 

With this decision, the Federal Court of Justice has set the legal standards for determining when an operator of a digital platform is obliged to disclose a user's personal data. The court has made it clear that mere defamatory or subjective criticism alone is not sufficient to trigger an obligation to provide information. Only if there is clearly criminal content that fulfils the criteria set out in Section 21(2) of the TDDDG can the platform operator be obliged to disclose inventory data. As is usually the case, whether there is an obligation to disclose information is a question that must be decided on a case-by-case basis.  

In the past, the Federal Court of Justice (BGH) has already ruled that operators of review platforms are not obliged to delete content every time a complaint is made about defamatory content. With the current ruling, the BGH extends this case law to the identity of users. Their anonymity when rating companies is generally paramount, as long as the statements do not constitute any of the criminal offences listed in Section 21 (2) TDDDG. At the same time, the ruling also means that platform operators must establish legal review processes to assess complaints on a case-by-case basis to determine whether a review contains content that is relevant under criminal law. Operators should therefore, in their own interest, establish internal 

Der Beitrag Herausgabe von Nutzerdaten erschien zuerst auf DPL Consult Datenschutzagentur.

The judgement of 5 December 2023 concerned a very high fine imposed by the Berlin data protection authority on a large real estate company. The point of contention was not so much the underlying data protection offence as the legal basis for the sanction. Under German administrative offences law, the principle has long applied that a legal entity can only be fined if culpable conduct can be proven on the part of a specific manager. The ECJ has clearly rejected this view. It found that the GDPR's system of fines is autonomous under EU law and cannot be made dependent on national attribution rules. Rather, the decisive factor is whether an „undertaking“ within the meaning of EU law has committed a data protection offence. This concept of an undertaking is to be understood functionally and originates from EU antitrust law. It covers any economic entity, regardless of how many legally independent companies it consists of. A corporate group as a whole can therefore be the addressee of a fine without the need to prove individual fault on the part of a specific natural person.

This also touched on a second question that is particularly relevant in practice: What does the GDPR's fine limit of up to two or four per cent of annual global turnover refer to? The ECJ has clarified that this percentage can refer to the turnover of the entire company in a functional sense, i.e. the group turnover. The judgement of 2023 has thus opened the door to significantly higher fines and brought data protection sanctions law closer to antitrust law.

The ECJ ruling of 8 February 2025 follows on from this line and clarifies it further. This also concerned the interpretation of the term „undertaking“ in connection with the calculation of GDPR fines. The ECJ has confirmed its case law from December 2023 that the economic entity is decisive for determining the statutory upper limit. What is new is that the Court has made it even clearer that this approach follows from the GDPR itself, in particular from Recital 150, which states that the supervisory authorities have no discretion to limit the scope of fines to the individual subsidiary only if it is a group company. The functional concept of an undertaking is a binding standard, not merely an option.

The two judgements have significant practical consequences. Under the GDPR, it is not possible to isolate data protection risks to individual subsidiaries or to „outsource“ them organisationally. Violations at an operational level can have financial consequences that affect the entire group. This increases the pressure to establish group-wide data protection compliance structures, define clear responsibilities and enforce uniform standards. 

Der Beitrag Der Unternehmensbegriff der DSGVO erschien zuerst auf DPL Consult Datenschutzagentur.

In this ruling, the Federal Court of Justice clarified in particular that intangible damage may already exist if a data subject loses control over their personal data, even if this data has not been misused or no specific material disadvantage has occurred. This means that even the „mere and temporary“ loss of control over one's own data, for example because it is collected and published through scraping, can justify a claim for damages under Article 82 GDPR. The protection of personal data is an independent legal interest, the violation of which is considered worthy of protection regardless of any specific consequences. The focus in the assessment of claims for damages is therefore more on the protection of informational self-determination than on classic material consequences. 

At the same time, the Federal Court of Justice addressed the issue of calculating damages and clarified that, in individual cases, damages must be determined in accordance with the provisions on estimating damages (Section 287 of the German Code of Civil Procedure) , taking into account the special function of Article 82 GDPR as a compensation and indemnification standard. In similar cases, courts have considered compensation in the order of approximately €100 to be appropriate if the loss of control is purely technical and has no further serious consequences.

This ruling has significant implications for platform operators, social networks and digital service providers. Operators must be aware that data protection violations can result not only in administrative fines, but also in a multitude of civil law claims for damages, even if the data concerned has not been misused. This applies in particular to cases in which third parties can automatically read data due to vulnerabilities in the platform or insufficiently secured interfaces. Operators should therefore review and, if necessary, improve their security and data protection measures in order to prevent scraping attacks or similar data access and thus reduce the risk of claims for damages. For affected users, the decision strengthens their rights: the Federal Court of Justice expressly recognises that the mere loss of control over personal data can constitute damage that must be compensated under European law. 

Der Beitrag Schadensersatz bei „Scraping“ erschien zuerst auf DPL Consult Datenschutzagentur.

1. What data protection challenges arise when using AI?
   
   AI is based on large volumes of data that are analysed, processed or used to recognise patterns, make predictions or support decisions. This can also involve personal data such as name, address, health status or preferences. This harbours various risks for data protection:
   
   • Lack of transparency: AI users often do not know what data is collected about them, how their data is processed or who has access to it. This makes it difficult for them to exercise their rights to information, rectification or erasure or to withdraw their consent. 
     
   • Lack of control: Users generally have little influence on the type of data processing and its consequences. This is particularly problematic if the user data is used for a purpose other than that originally intended or if the data processing is contrary to the user's own interests. Discrimination and disadvantages can also occur due to faulty or biased algorithms. 
     
   • Lack of security: User data can be affected by hacking, theft or manipulation due to cyber attacks or human error. In the worst case scenario, this can lead to identity theft, blackmail or other damage to those affected.
     
     
2. What opportunities can AI have for data protection?
   
   In addition to data protection risks, the use of AI also harbours opportunities for data protection. AI can help to improve and strengthen data protection in the future.
   
   • Development of data protection-friendly technologies: There are various approaches to incorporating data protection into the development and application of AI. These include, for example, pseudonymisation, anonymisation, encryption, differential privacy or federated learning. These technologies can prevent the identifiability of data, increase data minimisation or strengthen user control.
     
   • Early prevention of data protection breaches: AI can be used to recognise potential data protection risks at an early stage and take appropriate countermeasures. For example, algorithms can be checked to see whether they generate discriminatory or unfair results. Or warning systems can be set up to indicate suspicious activities in good time.
     
   • Promoting data protection awareness: AI can also help to raise awareness of data protection among all stakeholders and create a data protection-friendly culture. Chatbots or virtual assistants can inform users about their rights or give them tips on how to protect their privacy. Data protection knowledge can be imparted through training or games.

(Note: This blog post was written by an AI)

Der Beitrag Künstliche Intelligenz – Risiken und Chancen für den Datenschutz erschien zuerst auf DPL Consult Datenschutzagentur.

1. For which infringements am I liable?
   
   It is sufficient for a data protection breach if your company stores, forwards, uses or otherwise processes data unlawfully. If your employee accidentally sends a message containing personal data of the data subject to the wrong person, this can lead to liability for damages.
   
   According to a ruling by the Cologne Higher Regional Court, the violation of data subjects' rights, such as the late provision of data information, can lead to liability if it causes a psychologically stressful situation for the data subject. Other courts, however, have rejected liability for damages due to delayed data disclosure.
   
   
2. For which damages am I liable?
   
   When it comes to compensation for material damage, the data subject must prove that he or she has suffered concrete damage. Such damage may be, for example, that a loan was not granted to him or her because of the data breach. If, in addition to or instead of concrete damage, the data protection breach leads to discrimination, loss of confidentiality, damage to reputation or other comparable social disadvantages, the payment of non-material damages, similar to compensation for pain and suffering, may also be considered. 
   
   
3. Does any "bad feeling" about the data breach already trigger liability?
   
   In its judgment of 4 May 2023 (C-300/21), the European Court of Justice (ECJ) ruled that the mere breach of the provisions of the General Data Protection Regulation is not in itself sufficient to give rise to a claim for damages. Rather, damage must have been suffered, whereby the ECJ left open what this may consist of. The concept of damage, in particular that of "non-material damage" within the meaning of Art. 82 GDPR, had to be given an autonomous and uniform Union law definition in view of the absence of any reference to the domestic law of the Member States. It follows from the recitals of the GDPR that "[t]he concept of damage ... shall be interpreted broadly in the light of the case-law of the Court of Justice in a manner fully consistent with the objectives of this Regulation". The ECJ concludes in its judgment of 4 May 2023 that the broad understanding of the term 'damage' chosen by the Union legislator would be contradicted if that term were limited to damage of a certain materiality. Contrary to some decisions of German courts, national rules which make compensation for non-material damage within the meaning of the GDPR dependent on the damage suffered by the data subject having reached a certain degree of materiality are not compatible with Union law. 
   
   As far as the amount of non-material damages is concerned, there has not been a clear classification by the courts so far. The Higher Regional Court of Cologne awarded a plaintiff a compensation claim in the amount of €500 because she was psychologically burdened with "stress and worry" about her economic position in a traffic accident case due to the delayed disclosure of data by her lawyer (judgment of 14 July 2022 - 15 U 137/21). The Regional Court of Darmstadt awarded the plaintiff damages for pain and suffering in the amount of €1000 for the accidental forwarding of job application data to a third party (judgment of 26.5.2020 - 13 O 244/19). The Regional Court of Cologne held that the one-time sending of a bank statement to an incorrect recipient was not sufficiently incriminating and dismissed the action (Regional Court of Cologne, judgment of 7.10.2020 - 28 O 71/20). 

As a rule of thumb, if concrete damage has occurred, the responsible party is liable unless he or she can exonerate him or herself. In the case of immaterial damage, the more the individual is affected by the data protection breach, the more likely it is that compensation for pain and suffering will be due.

Der Beitrag Schadensersatz und Schmerzensgeld bei Verstößen gegen die DSGVO erschien zuerst auf DPL Consult Datenschutzagentur.

The designation Data Protection Officer is not a job title. Rather, the data protection officer is the body that monitors data protection in the company and points out deficiencies in data protection law to the company management or makes recommendations for legally compliant data protection. The tasks of the data protection officer are defined in the GDPR (Article 39) expressly regulated:

Tasks of data protection officers at a glance

• The Data Protection Officer informs the company management about current data protection regulations and decisions of the supervisory authorities. 
• To the Central tasks of a data protection officer includes the long-term and regular monitoring of compliance with data protection regulations. It must be involved at an early stage in all issues relevant to data protection law. 
• The Data Protection Officer is available to data subjects and employees of the company in matters of data protection law. You can consult the data protection officer on all data protection issues.
• The Data Protection Officer is the contact person for supervisory authorities.

Der Beitrag Aufgaben und Pflichten von Datenschutzbeauftragten erschien zuerst auf DPL Consult Datenschutzagentur.

The General Data Protection Regulation allows the transfer of personal data to third countries under certain conditions. Thus, a data transfer to so-called safe third countries is permitted. In particular, these are countries for which the European Commission has adopted a so-called adequacy decision. These countries must have legal regulations that guarantee a level of data protection equivalent to that in the EU.

Which third countries are considered safe?

For the following third countries, for example, the EU Commission has adopted adequacy decisions so that data transfers to these countries are considered secure:

• Argentina
• Canada (commercial organisations only)
• Israel
• New Zealand
• Switzerland
• South Korea
• Japan
• United Kingdom
• USA (to certified companies)

A transfer of personal data to third countries without an adequacy decision, on the other hand, is only permissible under further conditions. 

This includes the prior precise analysis of the level of data protection in the respective third country as well as the conclusion of data protection contracts with the data recipients in the third country to ensure that the protection of the personal data transferred is guaranteed. The European Commission has provided so-called standard contractual clauses for this purpose. We advise you on the determination of the level of data protection in the third country and on the drafting of the standard contractual clauses that enable you to transfer personal data to third countries without an adequacy decision. 

Der Beitrag Internationaler Datenschutz: Was müssen Unternehmen beim internationalen Datentransfer beachten? erschien zuerst auf DPL Consult Datenschutzagentur.

Duty of cooperation of responsible persons

If personal data is stolen or destroyed, this must be reported to the competent supervisory authority without delay, at the latest within 72 hours (Article 33 (2) of the GDPR). As the data protection officer, we advise you on how to write the report and on the measures to be taken. 

Damage to reputation in the event of data protection violations

• The loss of customer data can lead to considerable damage, e.g. in the case of identity theft. Claims for damages of the customers are possible (Art. 82 GDPR).
• Far more devastating can be the damage to reputation after Disclosure of a covered-up data breach fail. Customers lose trust in companies if the whereabouts of their data are not openly communicated.
• Basically no security system is 100 % protected against hacker attacks. If sensitive data is misused by hackers, this will affect the company's reputation even after it has been properly reported.
• This makes it all the more important for a positive image of the company to communicate to the outside world that all possibilities are being exhausted in the IT and data protection area, to protect customer data and track breaches by hackers.

Do customers have to be informed about a data breach?

If, due to data loss, a Particularly high risk for the persons concerned arises, the aggrieved parties must be informed of the data breach according to Art. 34 GDPR.

Examples of sensitive personal customer data

• Data on the state of health
• Data on ethnic origin
• Data on criminal convictions
• Authentication data for e-mail box etc.

How do I report a data breach by hackers?

Data protection breaches must be reported to the competent GDPR supervisory authority in Hamburg or in the federal state where the breach occurred. Most authorities provide online forms for breach notifications. Pursuant to Art. 33 (3) of the GDPR, the following must be reported at least the following information be made:

• How many people are affected?
• What category of data is involved?
• Contact details of the data protection officer
• What consequences could the data loss have for your customers?
• What measures have been taken to address the problem?

Do not do without professional support

Companies that work with sensitive customer data cannot do without IT partners and data protection officers. At the latest at the first sign of a data breach, entrepreneurs should urgently consult an expert. The reputation of companies is only as good as their IT protection!

Der Beitrag Datenschutzpanne im Unternehmen – wie können Unternehmer sich schützen? erschien zuerst auf DPL Consult Datenschutzagentur.

What information can be collected via tracking cookies?

• Third-party providers use tracking cookies to determine which websites users visit and how they behave there.
• These information profiles are useful for shop providersIn this way, companies define their target group and pursue their interests.
• The data serve as Basis for personalised advertising, which in turn can generate further sales and revenue.

Data collectors in everyday life

The use of tracking cookies by third parties is widespread on the modern internet. For example 97 % of all commercial websites use Google cookies, for example. If personal data is collected in the process, users must be informed of this (Article 13 GDPR). In addition, the Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services (Telecommunications Digital Services Data Protection Act - TDDDG) stipulates that Users must give their consent before technically unnecessary cookies are set. We check your privacy policy for completeness and accuracy.

Conclusion: What you should bear in mind when setting tracking cookies

The embedding and use of tracking cookies is permissible if the user has consented and is informed about the collection of personal data in accordance with Article 13 of the GDPR. Even with "simple" cookies, this can involve quite a bit of effort: In order to Always keep your privacy policy up to date on your websitethe information on the cookies used must be correct. We support our customers in this.

Der Beitrag Tracking-Cookies Vor- und Nachteile: Segen oder Fluch für Unternehmer? erschien zuerst auf DPL Consult Datenschutzagentur.