German Courts Reshape Data Protection Landscape: Google Liable for AI Summaries, Schufa Scores Curbed, and Fines Slashed for Cooperation
20.06.2026 - 15:26:51 | boerse-global.de
Google must take responsibility for false statements its artificial intelligence generates in search results, a Munich district court ruled in late May 2026 (case reference 26 O 869/26). The judges classified the company's "AI Overviews" as independent statements by the provider, not as neutral links to third-party content. Since users are not expected to fact-check these summaries themselves, the court placed full liability on the operator.
The decision lands at a time when German and European courts are churning out rulings that recalibrate how data protection law interacts with business operations, consumer rights, and emerging technology.
Deutsche Wohnen’s Fine Falls by 93 Percent
In one of the most dramatic examples of how cooperation pays off, Deutsche Wohnen saw its privacy penalty slashed from €14.5 million to €900,000 by the Berlin district court in June 2026. The Berlin data protection authority welcomed the outcome despite the steep reduction. Key factors: the company’s willingness to cooperate and its implementation of a compliant data management system after the initial deficiencies came to light.
Schufa: Consumer Information Rights Likely Narrowed
On 18 June 2026, Germany’s Federal Court of Justice (BGH) heard a case about what consumers can demand from Schufa under Article 15(1)(h) of the GDPR. The judges signalled they would likely overturn a ruling by the Dresden Higher Regional Court that had granted broad information rights. Their preliminary view: a comprehensive right to information only applies where automated decision-making takes place. Simply calculating a credit score does not necessarily qualify.
A final decision is scheduled for 21 October 2026. Separately, Schufa is developing a more transparent scoring model set to replace the current standard by the end of 2028, and a new legal framework for scoring procedures is expected as early as November 2026.
EuGH: Fair Trial Trumps Absolute Data Protection
On 18 June 2026, the European Court of Justice (case C-484/24) clarified that a violation of the GDPR during data collection does not automatically make evidence inadmissible. The right to a fair hearing outweighs an absolute approach to data protection. That means companies and employers can still use information obtained in a privacy-infringing manner in court — provided the proportionality test is met. For particularly sensitive data, however, the court demands strict scrutiny, including mandatory anonymisation or redaction before sharing with third parties.
Sweeping Rulings on Spam, Review Portals, and 6G
Germany’s BGH also tightened rules on unwanted advertising emails (case VI ZR 109/23). While recipients retain the right to demand that unsolicited commercial emails cease, automatic compensation for non-material damages does not follow. Proving individual harm is required, and a single email normally fails to meet that threshold.
In Cologne, the Higher Regional Court (case 15 W 55/26) sided with operators of review portals against a doctor who wanted a note about a defamatory, deleted review removed. The court held that the public’s legitimate interest in transparency about complaint volumes outweighs the individual’s interest in having the deletion notice vanish.
At the 111th Data Protection Conference in Stuttgart in mid-June 2026, regulators warned about future tracking capabilities in 6G radar functions that can peer through walls. They demanded "privacy by design" implementation. Meanwhile, the data protection commissioner of Rhineland-Palatinate criticised his own state’s fine authority: speed-camera photos from already-closed cases had been used illegally for further investigations.
