German housing giant fined £12.5m for GDPR violations

The firm’s archive system held onto highly sensitive data from bank statements to health insurance records

German property company Deutsche Wohnen has been hit with a staggering data protection fine for hanging onto a treasure trove of personal and financial data of former and current housing tenants.

The firm was fined 14.5 million (approximately 12.5 million) after German data protection investigators found it had been holding information in an archival system from which it was impossible to delete records.

This highly sensitive data, which belonged to former and current tenants, included salary information, extracts from employment and training contracts, tax and health insurance records, as well as bank statements.

This data was stored in the system on an indiscriminate basis, according to German data protection authorities, and without appropriate consents. There was also no legally-defined basis for collecting and storing the data.

Deutsche Wohnen was found to have violated the General Data Protection Regulation (GDPR) under Article 25 (1), which covers the need for businesses to ensure they're adhering to data protection principles such as data minimisation. The firm also violated Article 5, which related to the core ethical principles related to processing data.

Businesses are instructed under GDPR not to keep personal data beyond the legally-established reasons they have identified, and for a period no longer than is required in order to carry out the processing.

Related Resource

Trends in modern data protection

A comprehensive view of the data protection landscape

Download now

The German property firm was first warned about its archive system in 2017, according to the data regulator, and requested to change its archiving system as a matter of urgency.

Although the firm changed the archive system in March 2019, the changes still did not establish a lawful basis for storing the personal data and GDPR proceedings were launched, spanning the period between May 2018, when GDPR came into force, and this point.

The initial financial penalty was actually much higher, at roughly 28 million (24 million) based on the firm's annual turnover at more than a billion euros. GDPR fines can fall anywhere in the order of 20 million, or up to 4% of a firm's annual turnover, depending on the severity of the violation.

This initial fine represented 2.8% of the firm's turnover but was reduced because the company had actually taken concrete steps towards correcting its data storage mechanisms, and co-operated with regulators during the process.

IT Pro approached the property giant for its response to the GDPR fine.

Featured Resources

BIOS security: The next frontier for endpoint protection

Today’s threats upend traditional security measures

Download now

The role of modern storage in a multi-cloud future

Research exploring the impact of modern storage in defining cloud success

Download now

Enterprise data protection: A four-step plan

An interactive buyers’ guide and checklist

Download now

The total economic impact of Adobe Sign

Cost savings and business benefits enabled by Adobe Sign

Download now

Recommended

ICO to relax GDPR enforcement during coronavirus economic downturn
General Data Protection Regulation (GDPR)

ICO to relax GDPR enforcement during coronavirus economic downturn

16 Apr 2020
The NHS teams up with Apple and Google on coronavirus tracking app
privacy

The NHS teams up with Apple and Google on coronavirus tracking app

14 Apr 2020
Health sites are 'unlawfully' sharing medical data with Facebook and Google
data protection

Health sites are 'unlawfully' sharing medical data with Facebook and Google

7 Apr 2020
Supreme Court rules Morrisons was not liable for 2014 data breach
data protection

Supreme Court rules Morrisons was not liable for 2014 data breach

1 Apr 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
The Xbox Series X shows how far the cloud still has to go
Cloud

The Xbox Series X shows how far the cloud still has to go

25 Sep 2020