# Company: Insufficient involvement of data protection officer

- Type: Enforcement
- Source: Data Protection Authority of Berlin
- Date: 2022-09-20
- Original: https://www.enforcementtracker.com/ETid-1398
- Canonical: https://overview.legal/posts/47513
- Topics: Notified Body Responsibilities and Operational Obligations, Supervisory Authorities, Processing Agreement, Law Enforcement, Personal Data, Scientific Panel Independence, Notified Body Independence

## Summary

The DPA of Berlin has imposed a fine of EUR 525,000 on the subsidiary of a Berlin-based e-commerce group. The company had appointed a data protection officer, who however was also the managing director of two service companies that processed personal data on behalf of the very same company for which they acted as data protection officer. These service companies are also part of the group to which the e-commerce company belongs. The DPA considered this to be a conflict of interest and found a vio

## Full text

The DPA of Berlin has imposed a fine of EUR 525,000 on the subsidiary of a Berlin-based e-commerce group. The company had appointed a data protection officer, who however was also the managing director of two service companies that processed personal data on behalf of the very same company for which they acted as data protection officer. These service companies are also part of the group to which the e-commerce company belongs. The DPA considered this to be a conflict of interest and found a violation of Art. 38 (6) GDPR. The DPA had already issued a warning to the company in 2021 due to the conflict of interest. When a new inspection this year revealed that no new data protection officer had been appointed, the DPA imposed the fine.

GDPR Articles: Art. 38 (6) GDPR
Industry: Industry and Commerce

---
Generated by overview.legal · https://overview.legal/posts/47513 · 2026-08-22