In the Real Estate sector, DPAs from 10 different countries have so far imposed 17 fines on data controllers, including real estate management companies and homeowner associations, with a total fine volume of around EUR 476,000.
The type of violations in this sector is somewhat out of line with the other sectors covered in this report, the majority of which are due to insufficient technical and organisational measures to ensure information security and insufficient legal basis for data processing. In the Real Estate sector, however, most of the fines are due to non-compliance with general processing principles (9 out of 16, i.e. over 50% of the fines in this sector), in particular with the principles of data minimisation (Art. 5 (1) c) GDPR) and purpose limitation (Art. 5 (1) b) GDPR).
Let's take a closer look:
- Until 24 February 2021, the most exceptional fine in this sector was the EUR 14.5 million penalty issued against Deutsche Wohnen SE (ETid-98 & ETid-99) which also ranked under the top 10 of all fines imposed under the GDPR so far. According to the supervisory authority, the company used an archiving system for the storage of personal data of tenants that did not provide for the possibility of removing data that was no longer required. On 24 February 2021, however, Berlin Regional Court dismissed the fine against Deutsche Wohnen SE due to procedural errors. According to the Court, fines could be imposed on companies only in the case of verifiable errors by their representatives or other natural persons, but not for misconduct of the legal entity itself. In the Court's view, it was not sufficiently substantiated that a natural person had violated data protection laws in the case of Deutsche Wohnen. On 3 March 2021, the Berlin Public Prosecutor's Office, in agreement with the supervisory authority, filed an appeal against the decision of the Regional Court. A final decision is still pending at time of writing this report.
- In several cases (9 of the 16 fines), fines between EUR 500 and EUR 29,500 have been imposed on homeowner associations and housing companies for unlawful use of CCTV systems, in particular due to: (1) insufficient security measures to restrict access to the recordings in the systems to authorised persons, (2) coverage of the public space in front of buildings (e.g. also recording pedestrians), (3) recording of the staircase inside an apartment building while simultaneously monitoring the front door of a resident and therefore capturing the inside of the resident's apartment when the door was opened, (4) insufficient information about the use of CCTV systems, (5) use of CCTV systems that also recorded sound and therefore tenants' conversations and, finally, (6) publication of still images extracted from CCTV systems.
In the Real Estate sector, special attention must be paid to general processing principles when collecting and processing data of tenants or using technical measures to protect buildings and assets against damage to property, theft or other detrimental effects.
The exceptional fine against Deutsche Wohnen SE is currently suspended, but it remains to be seen how the case will proceed following the public prosecutor's appeal.