The Berlin data protection authority issued 269 warnings, seven warnings and four orders to private and public bodies in 2022, according to the current activity report presented by the new data protection officer, Meike Kamp. The total sum of fines imposed in 2022 amounted to 716,575 euros. The highest fine issued was at 525,000 euros to an online retailer, which had used an internal controller who was also the managing director of two service companies, resulting in a conflict of interest with the company data protection officer.
The report also highlighted fines issued against unauthorized inquiries at the job center and police, and against a credit agency that had stored 13 incorrect birth dates for a complainant. Moreover, there were fines directed against corona test centers and unauthorized database queries by employees of job centers and police officers. The authority initiated 18 proceedings against law enforcement officers in 2022, penalizing several cases in which police officers used information obtained on the job for private purposes.
In addition, the report criticized various data breaches, especially in apps and web services and the sending of messages by doctor’s offices to the “wrong people,” which could have dire consequences. Private individuals contacted the supervisory authority with a complaint or a request for advice in a total of 4,445 cases in 2022, a decrease as compared to the previous year’s peak of the fight against the pandemic.
The report also indicated the number of reported data breaches, which were attributed to attacks with malware or vulnerabilities. The report advised the State Office for Immigration (LEA) to refrain from searching cell phones, particularly those of asylum seekers, as the high effort involved in viewing the data obtained was not commensurate with the success of the measures.
In conclusion, the report shows that the Berlin data protection authority is doing a remarkable job in enforcing data protection laws in the city. The decrease in the number of reported data breaches and the number of complaints shows that data protection awareness in the public and private sectors is gradually improving.
