Latham & Watkins Successfully Defends Volkswagen in GDPR Trial
On June 10, 2025, an important multi-year case concerning the interpretation of the EU General Data Protection Regulation (GDPR) concluded. The Hanover District Court acquitted Volkswagen AG of all allegations of potential GDPR violations. It overturned a €4.3 million fine imposed by the competent data protection authority, the state commissioner for data protection of Lower Saxony. On June 10, 2025, an appeal against the District Court’s acquittal was withdrawn, concluding the proceedings before the Celle Higher Regional Court. Thus, the acquittal by the Hanover Regional Court is final.
The multi-year proceedings began with the state commissioner for data protection imposing a GDPR fine, accusing Volkswagen AG of violating its transparency obligations towards employees during its previous collaboration with a US monitor. According to the authority’s interpretation, Volkswagen AG had shared personal data without providing the information required under the GDPR. In contrast, the Hanover District Court assessed the data protection information provided by Volkswagen AG as comprehensively transparent and in accordance with the GDPR. Employees had already been repeatedly and sufficiently informed about the processing of their data. Additional individual notifications in specific cases were not required.
The Hanover Regional Court overturned the imposed fine and acquitted Volkswagen AG of all allegations of potential GDPR violations. Subsequently, the Hanover Public Prosecutor's Office, at the state commissioner for data protection's request, initially filed an appeal.
In a parallel proceeding, the Hanover Administrative Court on June 5, 2025, confirmed three formal reprimands issued by the state commissioner for data protection of Lower Saxony and overturned two. This first-instance decision is not final. The reprimands concerned alleged minor errors in the implementation of the GDPR from 2019. The reprimands upheld by the Administrative Court related to individual cases from the monitorship that have no relevance to the present. One of the confirmed warnings concerned the same allegations as the fine proceedings. The Hanover Regional Court ruled entirely differently from the Hanover Administrative Court, rejecting alleged violations of information obligations under the GDPR. This position is now final and legally binding.
Aside from the complex interpretation questions regarding data protection transparency obligations, all courts agreed that Volkswagen AG was generally permitted to share data with the monitor and that Volkswagen AG had implemented the GDPR comprehensively and correctly during the monitorship. Although the Hanover Administrative Court held a different position on the interpretation of GDPR transparency requirements than the Hanover Regional Court, it also clarified in its oral judgment that even if a GDPR violation were assumed, at most a warning would have been appropriate as the most severe sanction.
"The proceedings before the Celle Higher Regional Court are now concluded and the acquittal is now final and legally binding. This acquittal underscores the importance of careful data protection compliance. When companies implement the GDPR and other EU Digital Acts, this provides a strong basis for successful later defense in disputes or trial," says Tim Wybitul, data law partner at Latham & Watkins.
The Latham team was led by Frankfurt data law partner Tim Wybitul, with associates Isabelle Brams and Clemens Ganz. Advice was also provided on white collar matters by Munich partner Thomas Grützner; and on regulatory matters by Frankfurt counsel Joachim Grittmann.