Privacy Ticker

August 2026

+++ FEDERAL LABOUR COURT: NO GDPR RIGHT TO A COMPLETE COMPLIANCE REPORT +++ DÜSSELDORF ADMINISTRATIVE COURT: COMPANY BEARS BURDEN OF PROVING CONSENT TO MARKETING EMAILS +++ NETHERLANDS: FINE OF APPROX. EUR 825 MILLION AGAINST UBER FOR AUTOMATED DECISION-MAKING +++ CNIL: AGENTIC AI HEIGHTENS RISKS TO PERSONAL DATA +++ BFDI: CENTRAL COOKIE MANAGERS INSTEAD OF COOKIE BANNERS +++

+++ FEDERAL LABOUR COURT: NO GDPR RIGHT TO A COMPLETE COMPLIANCE REPORT +++

The Federal Labour Court has ruled that a person who is the subject of an internal compliance investigation is basically not entitled to receive a complete copy of the investigation report under Article 15(1) and (3), first sentence, GDPR. A law firm had conducted a compliance investigation into a senior employee. The final reports contained allegations made against her, the names and statements of whistleblowers and witnesses, assessments by the law firm and, in part, additional legal analysis and advice to the client. The employee had requested complete copies of the reports (see our blog post from March 2026). In the Court’s view, however, the right of access under Article 15 GDPR generally covers the personal data contained in a document, rather than the document as a whole. Legal analysis was not information about the data subject; it reflected the controller’s assessment of the legal position. A complete copy was also not necessary for the employee to verify the lawfulness of the processing and exercise her rights. The rights of third parties, the protection of confidential sources and trade secrets also had to be taken into account. The employee's appeal was therefore dismissed.

To the judgment of the Federal Labour Court (dated 16 April 2026, 8 AZR 169/25, in German)

+++ DÜSSELDORF ADMINISTRATIVE COURT: COMPANY BEARS BURDEN OF PROVING CONSENT TO MARKETING EMAILS +++

The Düsseldorf Administrative Court dismissed a company's lawsuit challenging a data protection warning issued for sending unsolicited promotional emails The complainant had repeatedly received advertising at his private email address and denied ever having consented. The company relied on a double opt-in process, but could produce neither the confirmation email nor the wording of the consent declaration. According to the Court, Article 7(1) GDPR required the controller to demonstrate that the data subject had given valid consent. If it could not do so, consent had to be treated as not having been given, or as invalid. Merely recording the email address, an IP address and a date, together with a double opt-in IP address and date, was insufficient. There was no necessary link between the IP address and the email address, and the records revealed neither the content nor the scope of any consent. The processing of the email address and the sending of the advertising were therefore unlawful because valid consent had not been established.

To the judgment of the Düsseldorf Administrative Court (dated 27 July 2026, 29 K 9714/24, in German)

+++ NETHERLANDS: FINE OF APPROX. EUR 825 MILLION AGAINST UBER FOR AUTOMATED DECISION-MAKING +++

The Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), has fined Uber Technologies Inc. approximately EUR 825 million. Uber used software to monitor drivers’ conduct and customer ratings. If the system detected suspected fraud or a driver fell below predefined rating thresholds, the driver’s account was automatically suspended temporarily; persistently low ratings resulted in permanent deactivation, in each case without further human review. Those affected consequently lost their income through the platform. The AP found that this infringed the prohibition on solely automated decision-making under Article 22 GDPR. Uber had also failed to provide drivers with sufficient information about the automated processes. Uber has since discontinued the practices and has challenged the fine. The fine represents approximately 1.85% of Uber’s reported worldwide annual turnover for 2025 of around EUR 44.5 billion; the maximum under the GDPR is 4%.

+++ ITALY: EUR 1.7 MILLION FINE FOLLOWING SOCIAL ENGINEERING ATTACKS +++

The Italian data protection authority, the Garante per la Protezione dei Dati Personali (GPDP), has fined Wind Tre S.p.A. approximately EUR 1.7 million. Attackers had telephoned employees at two retail outlets, posing as support technicians, and used social engineering to gain access to company systems. Personal data relating to more than 365,000 customers were exfiltrated; for 41,359 individuals, the data also included payment method information. The GPDP identified shortcomings in the management of access credentials and digital certificates, as well as inadequate security testing. More thorough checks would have identified the relevant vulnerabilities. The authority found infringements of the principles of integrity and confidentiality and of the GDPR security requirements, and ordered additional safeguards.

To the GPDP announcement (dated 16 July 2026, in Italian)

To the GPDP decision (dated 14 May 2026, in Italian)

+++ ITALY: EUR 460,000 FINE FOR EXCESSIVE RETENTION OF EMPLOYEE EMAILS AND LOG DATA +++

The GPDP has also fined Piaggio & C. S.p.A. EUR 460,000. Two former employees had complained that the company accessed messages in their individually assigned business email accounts during their employment and later used emails in disciplinary proceedings. The GPDP’s investigation found that the contents of business email accounts and technical log data had been retained for extended periods. This had enabled detailed monitoring of the employees’ activities. The authority identified infringements of the principles of lawfulness, transparency, purpose limitation and storage limitation, as well as the rules governing employee data processing. The company had also failed to respond to the data subjects’ access requests within the applicable time limit.

To the GPDP decision (dated 18 June 2026, in Italian)

+++ CNIL: AGENTIC AI HEIGHTENS RISKS TO PERSONAL DATA +++

The French data protection authority, the Commission Nationale de l’Informatique et des Libertés (CNIL), and the French AI and Digital Council have published a joint paper on agentic artificial intelligence. Agentic AI systems could independently perform multi-step tasks, access numerous connected data sources and interact with other applications. Persistent memory and continuously enriched user profiles could substantially increase the volume of data processed and create data flows across multiple services that were difficult for users to understand. This could also complicate the allocation of data protection responsibilities and increase the risks associated with automated decision-making. The paper identifies enhanced transparency about the actions of AI agents, technical control and oversight mechanisms, and human approval for particularly critical decisions as possible safeguards.

To the CNIL announcement (dated 20 July 2026, in French)

To the joint paper by the CNIL and CIANum (July 2026, in French)

+++ BFDI: CENTRAL COOKIE MANAGERS INSTEAD OF COOKIE BANNERS +++

The German Federal Commissioner for Data Protection and Freedom of Information (BfDI) has published survey findings and recommendations on central cookie managers. According to the BfDI, conventional cookie banners often failed to achieve informed consent because many users did not understand the technologies involved or reflexively dismissed banners as a result of information overload and “cookie fatigue”. Central cookie managers could allow users to set differentiated privacy preferences once for multiple websites. Those preferences should be binding on websites, eliminating the need for additional cookie banners. Official recognition of such services could build trust. The BfDI advocates using the EU Digital Omnibus reform initiative (see Privacy Ticker November 2025) to establish clear and workable rules for cookie managers across the EU.

To the BfDI survey findings and recommendations (August 2026, in German)

Beiten Burkhardt Rechtsanwaltsgesellschaft mbH is a member of ADVANT, an association of independant law firms. Each Member Firm is a separate and legally distinct entity, and is liable only for its own acts or omissions. This privacy ticker was created in cooperation with the ADVANT partner law firms Nctm and Altana.

EDITOR IN CHARGE
Susanne Klein, LL.M. | Rechtsanwältin
©Beiten Burkhardt
Rechtsanwaltsgesellschaft mbH

BB-Datenschutz-Ticker@advant-beiten.com
www.advant-beiten.com

Please note: If you no longer wish to receive information, you can unsubscribe at any time.

Imprint

Beiten Burkhardt Rechtsanwaltsgesellschaft mbH
Ganghoferstraße 33, 80339 München
Registered unter HR B 155350 at the Regional Court Munich / VAT Reg. No. DE-811218811

Tel.: +49 89 35065-0, Fax: +49 89 35065-123 | E-Mail: munich@advant-beiten.com
Here you will find our complete imprint: www.advant-beiten.com/imprint 
and our privacy policy: www.advant-beiten.com/en/privacy-protection.

View in Browser