What the court actually decided

On 9 June 2026 the 26th Grand Criminal Chamber of the Regional Court Berlin I, case 526 OWi LG 1/20, reduced a fine the Berlin data protection authority had imposed on the property group Deutsche Wohnen in October 2019. The original penalty was about 14.5 million euros, one of the largest GDPR fines ever issued in Germany. The court set the final figure at 900,000 euros.

This was not an acquittal. The chamber found that the company had intentionally breached the data minimisation and storage rules of Article 5 GDPR by holding former tenants identity and payment records long after any legal need had passed. The judgment is not yet final and both sides may still appeal. What changed was not the finding of a violation but the scale of the consequence.

Why the number fell so far

The reduction rests on a principle the Court of Justice of the European Union set out on 5 December 2023: a GDPR fine may be imposed only where the breach was committed with fault, and the amount must stay proportionate. The Berlin court weighed that the violations fell in the early phase of the regulation, when regulators themselves were still adapting, and that the company had engaged external auditors, consultants and IT specialists and invested in modernising its systems.

So the documented effort to comply became the decisive lever on the penalty. The same conduct a regulator can read as too slow, a court can read as good faith under difficult conditions. The gap between 14.5 million and 900,000 was not a sharper lawyer. It was a record of diligence that already existed before the dispute began.

Why this matters before August

From 2 August 2026 the enforcement regime of the EU AI Act begins to apply, with fines that can reach 35 million euros or 7 percent of worldwide turnover. The authorities applying it draw on the same European framework the Berlin court just used: fault as a precondition, proportionality, and credit for demonstrated diligence. The first AI fines will be set the way this one was.

For an owner or a family office the lesson is narrow and concrete. The number in a regulator notice is an opening figure, not a settled one, and what moves it is the evidence you can produce of governance that was already in place. That evidence is built in calm periods and documented as you go, not assembled once an inquiry has started.

Read next: The EU Is Rewriting the GDPR  ·  Your AI Bill No Longer Has a Ceiling