notebooksbilliger.de sues to reduce GDPR fine from 10.4 million to 900,000 euros

Contents

It was one of the highest German GDPR fines to date. At the end of 2020, the then Lower Saxony State Commissioner for Data Protection (LfD) Barbara Thiel imposed a fine of around 10.4 million euros on the electronics retailer notebooksbilliger.de. The company immediately lodged an objection against the notice, and the legal proceedings began. The Higher Regional Court (OLG) Celle has now made a final decision that notebooksbilliger.de only has to pay 900,000 euros into the state treasury.

What happened? As early as March 2017, more than a year before the General Data Protection Regulation (GDPR) came into force, the state data protection authority had received a complaint concerning allegedly unlawful video surveillance at the Sarstedt-based company notebooksbilliger.de. This was followed by an exchange between the authority and the company over several years. In particular, the company argued that there were acute cases of large-scale gang theft on the company premises and that video surveillance was therefore necessary.

Indeed, later, around 2023, criminal convictions of four former employees of the electronics retailer for serious gang theft occurred, with the theft of 96 laptops and 18 smartphones being proven. Whether this proof was achieved by evaluating video recordings from the cameras is not apparent from the documents available to us.

Cameras in the customer area

However, the fine notice from December 2020 shows that cameras filmed, for example, “areas inviting lingering (seating areas) in the sales rooms”. They also filmed publicly accessible zones of the outdoor area with seven cameras, sales and workrooms, and parts of the outdoor area used as a break area with 81 cameras. Technical and organizational measures for the required blurring were missing. Furthermore, the recordings were sometimes kept for 60 days, thus exceeding the legally permitted period.

The LfD had derived the amount of the fine from Art. 83 GDPR. According to this, data protection supervisory authorities in the EU can impose fines of up to 20 million euros or, “in the case of an undertaking, up to 4% of its total worldwide annual turnover in the preceding financial year” for serious infringements. For the period from January to December 2019, the LfD determined sales revenues of 735,842,390.61 euros for notebooksbilliger.de and derived a fine framework of up to 29,433,695.62 euros (four percent) from this, of which it used about one-third.

Public Prosecutor's Office takes over

After notebooksbilliger.de's objection, the supervisory authority transferred the proceedings to the Public Prosecutor's Office in Hanover. The reason for this lies in the Administrative Offences Act (OWiG), which data protection supervisory authorities in Germany must follow. If objections are raised against their decisions, the Public Prosecutor's Office takes over the case – the authorities can only watch. Because the fine notice exceeded 100,000 euros, it did not go to the local court but directly to the Regional Court (LG) of Hanover.

The LG Hanover with its decision of May 6, 2024 (Ref. 128 OWi-LG 5301 Js 114949/21 (1/21)) reduced the fine from 10.4 million to 700,000 euros. Although it largely confirmed the course of events, it assessed the violations as less serious than the supervisory authority. A large part of the video recordings were deleted without being reviewed, and the electronics retailer was very cooperative during the proceedings leading up to the fine notice. The LfD had always declined an on-site inspection that was offered multiple times. In addition, according to the LG Hanover, the GDPR was new law in 2019 and 2020, resulting in “a certain legal uncertainty”.

However, the LG Hanover used a different method for determining the fine than the LfD in 2020: As was customary at the time, it used a framework recommended by the Conference of Independent Data Protection Authorities of the Länder (DSK). It is based almost exclusively on a company's annual turnover. The LG now used the “Guidelines on the calculation of administrative fines” of the European Data Protection Board (EDPB), adopted in May 2023. According to the LG, these are to be preferred.

For violations of minor severity, as in the present case according to the court, the LG calculated a maximum fine of only 2,943,369.56 euros for notebooksbilliger.de. It also determined the electronics retailer's revenues for 2019 and arrived at a profit margin of only 1.8 percent. According to the EDPB guidelines, this results in a maximum fine of only 2,207,527.17 euros. This framework was to be applied to about one-third due to mitigating circumstances, resulting in the aforementioned 700,000 euros. These were deemed “effective, proportionate, and sufficiently deterrent”.

“Moderate Increase”

The Public Prosecutor's Office in Hanover, in turn, filed an appeal against the fine amount with the Higher Regional Court (OLG) of Celle, demanding a fine of at least five million euros. With its decision of December 18, 2025 (Ref. 3 ORbs 113/25), which is available to heise online, the OLG Celle increased the fine to 900,000 euros, which it described as a “moderate” increase.

In its reasoning, the OLG considers it legally flawed that the LG believed that fine frameworks should be applied cautiously shortly after the GDPR came into force. This view finds “support neither in the law nor in the relevant guidelines.” Furthermore, a possible reputational damage to the company “cannot be decisive in any case.”

In Lower Saxony, Denis Lehmkemper took office as the State Commissioner for Data Protection in September 2023 and has continued to handle this procedure since then. He expressed satisfaction with the outcome to heise online: “This case concerned unlawful video surveillance of employees on a large scale. We are pleased that the court followed our arguments, as companies have a high responsibility towards their employees and cannot infringe upon their personality rights indefinitely.” However, he added that the reduction of the fine amount shows “that German courts apply the fine framework established in Union law very cautiously in their own sentencing decisions.”

(hob)