Enforcement · Data Protection Authority of Berlin EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Deutsche Kreditbank: Insufficient fulfilment of data subjects rights

The DPA of Berlin has imposed a fine of EUR 300,000 on Deutsche Kreditbank.

€300,000 Fine
Deutsche Kreditbank
GERMANY
Art. 5 GDPR Art. 15 GDPR Art. 22 GDPR
Personal Data Controllers Supervisory Authorities Insurance
May 31, 2023 Source datenschutz-berlin.de

Full text

The DPA of Berlin has imposed a fine of EUR 300,000 on Deutsche Kreditbank. A customer had filed a complaint with the DPA. The customer had submitted an application for a credit card to the bank, which was rejected in the course of an automated decision, despite the customer's good credit history and high income. The customer then requested an explanation of the reasons for the rejection of their application and the basis on which the automated decision was made. However, the controller refused to provide such information to him, which also made it difficult for the customer to appeal the decision. The DPA found that the controller violated its obligation to transparently inform the data subject about the decision upon request.

Industry: Finance, Insurance and Consulting

How it connects

References

All 6

Related across sources

Guidelines 07/2020 concepts of controller and processor in the GDPR Guidelines ·EDPB Jul 7, 2021 Controllers Processors IP Address
Guidelines 8/2022 identifying a controller or processor's lead supervisory authority Guidelines for identifying a controller or processor’s lead supervisory authority Guidelines ·EDPB Apr 17, 2023 Supervision Controllers Supervisory Authorities
SAN 3154/2026 National court annuls DPA sanction against KFC Spain over website privacy information In May 2021, a data subject lodged a complaint with the DPA against KFC Restaurants Spain, S.L.U., the controller, concerning the processing of personal data through its website.… Jul 16, 2026 Supervisory Authorities Personal Data Controllers
Opinion 9/2020 Reinsurance Group of America — processor BCRs Irish SA ·Opinion ·EDPB Apr 14, 2020 International Transfer Processors Codes of Conduct
BA-6S/221/2019 Court upholds €50,000 fine on Sociálna poisťovňa for sending sensitive data by ordinary Sociálna poisťovňa, the social insurance agency (the controller), processes applications for foreign invalidity pensions and forwards related documents to the social insurance… Jun 25, 2025 Integrity and Confidentiality Principle Personal Data Data Breaches
C-807/21 Deutsche Wohnen SE v Staatsanwaltschaft Berlin C-807/21 (Deutsche Wohnen) CJEU Dec 5, 2023 Fines Public Authority Processors
Related documents