14.5 million Euro fine in Berlin due to missing deletion periods

In Berlin, the highest fine imposed to date in Germany since the GDPR came into force was imposed on Deutsche Wohnen SE – the largest private real estate owner in Berlin.
The reason for the high fine is the lack of deletion periods for some sensitive tenant data. The following collected data, such as salary statements, self-disclosure forms, tax, social and health insurance data and account statements, could not be deleted.
In the opinion of the authority, Wohnen SE violated the principles of privacy by design and default as well as the principle of storage limitation. As the deficiency had already been criticised by the authorities in 2017 and was still not corrected in March 2019, the Berlin data protection officer had to resort to harder means and impose a deterrently high fine. Furthermore, the authority imposed further fines of between 6,000 and 17,000 euros in 15 individual cases against the company due to the inadmissible storage of personal data of tenants.

So far, the fine decision has not been legally binding and Deutsche Wohnen SE has already announced that it will take action against the fine notice.
The authorities would like to remind other companies of their obligation to delete data and strongly recommend that a deletion concept be drawn up. 

Please feel free to contact us at any time if we can support you at this point. We look forward to your message!