Datenschutz-Puls 26/10/26

I. Court Decisions

Frankfurt am Main Regional Court: No Publication of Private Property Areas on Google Earth - 24.09.2026

rv.hessenrecht.hessen.de/…

• The court prohibited Google from continuing to display aerial images of an occupied property in Frankfurt on Google Earth and Google Maps because the images also showed the garden area, which is not visible from the street.
• The judges found that this constituted an infringement of the right to privacy and considered the high-altitude images, taken without the knowledge of those affected, to amount to covert surveillance.
• The judgment is not yet final. In 2020, the Itzehoe Regional Court had ruled in Google's favour.

Aachen Regional Court: Google Liable for Incorrect AI-Generated Summaries - 24.09.2026

itm.nrw/…

• In preliminary injunction proceedings, the court prohibited Google from disseminating false claims about a doctor based in Aachen through its “AI Mode”, after the AI had attributed allegations and investigations to him that actually concerned another person.
• According to the court, Google generates its own statements through its AI and is therefore responsible for them, rather than merely referring to third-party content.
• The liability exemptions under the Digital Services Act do not apply because Google generates the AI summaries itself and does not merely refer to third-party content.

Charlottenburg Local Court: No Right of Access to System Logs - 30.09.2026

gesetze.berlin.de/…

• The claimant made bank transfers to fraudsters and subsequently requested that her bank disclose extensive system logs and extracts from its internal monitoring systems for anti-money laundering and fraud detection.
• The Local Court held that there was no right of access under Article 15 GDPR because the request had not been made for the purpose of exercising data protection rights.
• “Pre-trial discovery”, which is not provided for under German civil procedural law, cannot be obtained indirectly through the GDPR.

II. Fines and Regulatory Authorities

Norwegian Data Protection Authority: Fine Imposed on Xandr - 10.10.2026

datatilsynet.no/…

• The Norwegian Data Protection Authority (Datatilsynet) imposed a fine of NOK 92 million (approximately EUR 8.6 million) on Microsoft-owned advertising technology provider Xandr, the highest fine in the authority's history.
• Between July 2018 and April 2020, Xandr operated real-time advertising auctions within a dating app and potentially disclosed user data to thousands of recipients.
• The advertising consents obtained by the dating app were invalid. As a joint controller with the dating app, Xandr was required to verify the validity of those consents.

Italian Data Protection Authority: Fine for the Use of Health Data - 02.10.2026

gpdp.it/…

• The Italian Data Protection Authority (GPDP) imposed a fine of EUR 7 million on a company that had created a database containing health information relating to approximately one million individuals. The data had only been pseudonymised, rather than anonymised.
• The authority identified several shortcomings, including the absence of a legal basis and adequate information for patients, the lack of defined retention periods, and the absence of a data protection impact assessment.
• It is essential to carefully assess whether data can genuinely no longer be used to identify individuals when supposedly aggregated data is incorporated into statistical databases.

EDPB: Statement on Smart Glasses - 13.10.2026

edpb.europa.eu/…

• Smart glasses resemble ordinary eyewear, making recordings difficult to detect. Their microphones may also capture background conversations.
• The GDPR household exemption applies only to purely personal or household activities, such as sharing content with family or friends. It does not apply where content is published on public social media profiles or where the devices are used for professional, political or official purposes. In such cases, users are subject to the GDPR.
• The EDPB recommends data protection by design, including measures such as data minimisation, on-device processing and geofencing, and has announced further statements on the subject.

III. Legislation and News

Financial Penalty Against Meta: Cambridge Analytica Scandal - 21.10.2026

tagesschau.de/…

• The case relates to the Cambridge Analytica scandal: a personality test developed by a third-party company collected data from approximately 87 million profiles worldwide, which was subsequently transferred to consulting firm Cambridge Analytica for the purpose of creating political advertising. Approximately 87 million Facebook user accounts were affected. Facebook tolerated these practices and made misleading statements regarding data protection.
• In 2019, the FTC had already imposed a USD 5 billion fine in connection with the Cambridge Analytica scandal. A further 48 US states reached a nationwide settlement with Facebook totalling USD 500 million, while New Mexico pursued its own legal action.
• The New Mexico court assessed USD 5,000 per violation. However, instead of imposing the calculated amount of USD 212 billion, the judge ordered a financial penalty of USD 25 billion. Meta has announced that it will appeal the decision.

PHP2Shell: Vulnerability in a Core Technology of the Internet - 21.10.2026

heise.de/…

• Around 70% of server-side web applications are written in the PHP programming language. A security vulnerability that had existed for more than 20 years has now been discovered: attackers can create an unstable state on the target system, preventing it from correctly identifying injected malicious commands. In the worst case, an attacker may gain complete control of a server.
• Web server operators should promptly install the patches provided by the PHP vendor to address the vulnerability.
• The implications for data protection will only become clear over time, for example as information emerges about which databases may have been accessed.

European Commission: Investigation into Anthropic and OpenAI under the EU AI Act - 14.10.2026

euronews.com/…

• The EU AI Office has issued its first formal request for information to OpenAI and Anthropic as part of the enforcement of the EU AI Act.
• The request follows two incidents in the summer of 2026, in which an OpenAI agent is reported to have escaped its testing environment and hacked Hugging Face, while an Anthropic model is reported to have gained access to systems belonging to three external organisations. The authorities are seeking information in particular on security measures, external assessments and the monitoring of model usage.
• AI governance is therefore continuing to gain momentum. From 2027/2028, providers and deployers of high-risk AI systems will be subject to extensive requirements relating to risk management, data quality and documentation.