In a decision on immaterial damages under Article 82 of the EU General Data Protection Regulation (GDPR), the Higher Regional Court of Dresden, Germany (case number 4 U 940/24), set out important monitoring and auditing obligations of controllers with respect to their processors.
The controller (defendant) operates an online music
Continue Reading Germany: Monitoring and auditing obligations of controllers with respect to their processors
On April 9, 2025, the coalition agreement of the future German Federal Government, consisting of the three German parties CDU, CSU and SPD, was published. The document entitled “Responsibility for Germany” contains several plans, including some that may fundamentally change the German data protection supervisory authority structure and that aim to ease the regulatory burden
Continue Reading Germany: New government plans to centralize data protection supervision and reduce regulation for small and medium-sized companiesIf employers and works councils agree on ‘more specific rules’ in a works agreement regarding the processing of employees’ personal data in the employment context (Art. 88 (1) GDPR), these must take into account the general data protection principles, including the lawfulness of processing (Art. 5, Art. 6 and Art. 9 GDPR), according to the
Continue Reading Germany: Works agreements cannot legitimate inadmissible data processing.
On November 18, 2024, the German Federal Court of Justice (Bundesgerichtshof – “BGH”) made a (to date unpublished) judgment under the case number VI ZR 10/24 regarding claims for non-material damages pursuant to Art. 82 GDPR, due to the loss of control over personal data.
The judgment is based on a personal
Continue Reading Germany: Judgment on Non-Material Damages for Loss of Control over Personal Data
Summary
In its judgement of 11 July 2024 (C-757/22), the European Court of Justice (‘ECJ’) ruled that the violation of a controller’s information obligations under Art. 12 and 13 GDPR, can be subject to a representative action under Article 80(2) GDPR.
Facts of the case
Meta Platforms Ireland Limited (“
Continue Reading Europe/Germany: Right to bring collective action for violations of information obligations under GDPR
