Enforcement · Data Protection Authority of Hamburg EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Facebook Germany GmbH: Insufficient involvement of data protection officer

Whereas Facebook Ireland had appointed a data proteciton officer for all group companies located in the EU, this appontment was not notfied to the DPA Hamburg, competent for Facebook Germany GmbH.

€51,000 Fine
Facebook Germany GmbH
GERMANY
Art. 37 GDPR
Supervisory Authorities Social Media Notified Body Reporting and Notification Obligations Article 19 GDPR - Notification of Rectification, Erasure or Restriction Telecommunications
Jan 1, 2019 Source datenschutz-hamburg.de

Full text

Whereas Facebook Ireland had appointed a data proteciton officer for all group companies located in the EU, this appontment was not notfied to the DPA Hamburg, competent for Facebook Germany GmbH. The fine was calculated on the basis of the turnover of the German branch (EUR 35 million). Relevant factors for the calculation were i.a. that the omitted notification was immediately made up for, Facebook acted negligently and did not violate the duty to appoint a data protection officer but only the notification obligation.

Industry: Media, Telecoms and Broadcasting

How it connects

References

Related across sources

Guidelines 10/2020 restrictions under Article 23 GDPR Guidelines ·EDPB Oct 13, 2021 GDPR Subject-Matter and Objectives Right to Restriction Data Portability
Guidelines 04/2022 calculation of administrative fines under the GDPR Guidelines ·EDPB May 24, 2023 Fines Notified Body Reporting and Notification Obligations Supervision
Guidelines 01/2021 Examples regarding Personal Data Breach Notification Guidelines ·EDPB Jan 3, 2022 Notification Obligation Data Breaches Personal Data
Opinion 28/2022 Europrivacy criteria of certification regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 (GDPR) Opinion ·EDPB Oct 10, 2022 Certification Notified Body Reporting and Notification Obligations Accountability
Opinion 2/2026 EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( EDPB, EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus) Opinion Feb 11, 2026 Notified Body Reporting and Notification Obligations Notification Obligation Data Breaches
Opinion 2/2026 Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision EDPB - EDPS JOINT OPINION 2 /2026 On the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus) Adopted on 1 0 February… Opinion ·EDPS Feb 11, 2026 Notified Body Reporting and Notification Obligations Direct Marketing Data Breaches
Related documents