Core expertise
Further services
Podcast
Datenschutz-Puls: what matters in data protection law, every two weeks.
Focus industries
Further industries
Industries
Your industry is not listed? We advise across all sectors.
About us
Information
Podcast
Datenschutz-Puls: what matters in data protection law, every two weeks.
Datenschutz-Puls · 1 October 2026
Chatbot inputs as special category data under Art. 9 GDPR, a Federal Court of Justice (BGH) ruling on injunctive relief for data protection breaches and the dispute between Anthropic and the US Department of Defense. Plus smart glasses, cameras in the operating theatre and a multi-million fine against BBVA. With lawyer Eugen Kopachewski and Dr Georg Schröder.
The Federation of German Consumer Organisations (vzbv) brought an action against Snap because the “My AI” chatbot integrated into Snapchat analysed users’ inputs for personalised advertising. The Regional Court of Cologne upheld the claim: Users share sensitive data with chatbots, and processing these prompts for the purpose of selecting advertisements constitutes the processing of special categories of personal data.
An online shop automatically transmitted IP addresses and usage data to external servers via third-party services without obtaining consent. The Federal Court of Justice held that the GDPR does not exhaustively govern claims for injunctive relief. Such a claim may also be derived from Sections 823(1) and 1004 of the German Civil Code (BGB) in conjunction with the general right of personality.
The U.S. Department of Defense sought to use Anthropic’s Claude for “all lawful purposes.” Anthropic refused to waive its usage restrictions, particularly those relating to fully autonomous lethal weapons systems and the mass surveillance of U.S. citizens. The D.C. Circuit subsequently upheld Anthropic’s classification as a supply chain risk.
The German Data Protection Conference has established nationwide guidelines for the use of smart glasses: Responsibility lies with the person wearing the glasses. The household exemption under Art. 2 GDPR does not apply once third parties outside the family context are recorded.
A private clinic operated cameras in its operating rooms that transmitted live footage of everyone present, without providing information or obtaining consent. The clinic justified the practice on the grounds of supporting surgical procedures, workflow planning and hygiene. The Austrian Data Protection Authority found that these purposes did not justify the processing of health data. Explicit consent is required.
The Italian Data Protection Authority imposed a fine of €5,508,000 on a bank. A customer had disabled advertising in the banking app but continued to receive it for several months due to a technical synchronisation error. Customer service failed to properly address the complaint and provided incorrect information.
An unauthorised individual gained access to an LMU IT system and retrieved master data from the student enrolment system. Changes to the data were prevented, and the affected system was immediately taken offline. The university faced criticism for informing those affected only three days later.
An attacker used a legitimate government email domain with technically valid authentication to submit fraudulent information requests, which Revolut employees processed as genuine requests. A substantial amount of customer data was disclosed.
In September 2026, OpenAI disclosed a series of security and control incidents and once again paused the training of its most powerful models. The decision followed an incident in which a model managed to reach an external chatbot via a DNS resolver despite operating within an isolated environment.
We do not use tracking or marketing cookies. Only your choice is stored. External media such as the Apple Podcasts player are loaded only with your consent, in which case your IP address is transmitted to Apple. You can change your choice at any time via "Cookie settings" in the footer.
