The Bremen data protection authority ('the Bremen Commissioner') published, on 3 March 2022, a press release on its decision, in which it imposed a fine of €1.9 million to BREBAU GmbH, for violations regarding legal basis and transparency under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR').

Background to the decision

In particular, the Bremen Commissioner noted that BREBAU had processed data on more than 9,500 prospective tenants.

Findings of the Bremen Commissioner

The Bremen Commissioner found that the abovementioned data had been processed without a legal basis. In addition, the Bremen Commissioner outlined that, for example, information about hair styles, body odour, and personal appearance is not necessary for the conclusion of tenancies. Furthermore, the Bremen Commissioner found that more than half of the cases involved data that is particularly protected under the GDPR, such as information on skin colour, ethnic origin, religious affiliation, sexual orientation, and state of health, which were also unlawfully processed. Moreover, the Bremen Commissioner stated that BREBAU had also deliberately thwarted requests from data subjects for transparency about the processing of their data.

Outcomes

As a result, the Bremen Commissioner imposed a fine of €1.9 million on BREBAU, noting that given the extraordinary depth of the violation of the fundamental right to data protection, a significantly higher fine would have been appropriate; however, since BREBAU had cooperated comprehensively in the supervisory procedure, endeavoured to minimise the damage, clarified the facts on its own, and ensured that such violations would not be repeated, the amount of the fine was significantly reduced.

You can download the press release, only available in German, here.