Enforcement · Data Protection Authority of Hamburg EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Kolibri Image Regina und Dirk Maass GbR: Insufficient data processing agreement

Please note: According to our information this fine has been withdrawn in the meantime.

€5,000 Fine
Kolibri Image Regina und Dirk Maass GbR
GERMANY
Art. 28 GDPR
Controllers Processors Processing Supervisory Authorities Processing Agreement
Dec 17, 2018 Source heise.de

Full text

Please note: According to our information this fine has been withdrawn in the meantime. Kolibri Image had send a request to the Data Protection Authority of Hessen asking how to deal with a service provider who does not want to sign a processing agreement. After not answering Kolibri Image in more detail, the case was forwarded to the locally responsible Data Protection Authority of Hamburg. This Authority then fined Kolibri Image as controller for not having a processing agreement with the service provider. Kolibri Image has stated that they will challenge the decision in front of court since they are of the opinion that the service provider does not act as a processor.

Industry: Industry and Commerce

How it connects

References

Related across sources

Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines ·EDPB Jul 7, 2021 Controllers Processors IP Address
Opinion 22/2024 certain obligations following from the reliance on processor(s) and sub-processor(s) A dopted 1 Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub - processor(s) Adopted on 7 October 2024 Adopted 2 Executive summary The… Opinion ·EDPB Oct 9, 2024 Processors Controllers Processing Agreement
C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems C-311/18 (Schrems II) CJEU Jul 16, 2020 Privacy Shield Processing Agreement International Transfer
C-807/21 Deutsche Wohnen SE v Staatsanwaltschaft Berlin C-807/21 (Deutsche Wohnen) CJEU Dec 5, 2023 Fines Public Authority Processors
Opinion 25/2025 BOX Group — processor BCRs Polish SA ·Opinion ·EDPB Oct 7, 2025 International Transfer Processors Codes of Conduct
Opinion 34/2023 Cerner Group — processor BCRs Hesse SA (Germany) ·Opinion ·EDPB Dec 20, 2023 International Transfer Processors Codes of Conduct
Related documents