The Federal Court of Justice has recently ruled that managing directors can have a claim for their personal data to no longer be publicly visible in the commercial register.

A. Why this decision is important for many clients

We are repeatedly asked: Do my private address and my original signature really have to be visible to everyone in the commercial register? This is precisely what the Federal Court of Justice (BGH) addressed in its decision of 18 February 2026 (II ZB 2/25). The case concerns managing directors whose private addresses and handwritten signatures were accessible online in commercial register filings – and who wanted to defend themselves against this.

B. What was the case about in concrete terms?

In the filings for the formation of, and changes to the shareholdings in, a GmbH & Co. KG, the private addresses and original signatures of the managing directors appeared. These documents were available free of charge in the electronic commercial register via the joint register portal of the German Länder – in practice, accessible worldwide.

The parties argued that they held many valuable corporate stakes and saw a real risk of becoming victims of crime, because criminal actors could massively harvest register data and create profiles of natural persons. Their request was therefore simple and practical: replacement of the documents with versions showing the business address and a “signed” notation instead of the original signature.

C. May the register court simply delete or replace such data?

The lower courts (register court and Higher Regional Court of Hamburg) essentially said: No, because similar data on the managing directors can be found in other register documents anyway – replacing individual documents would therefore achieve nothing.

The BGH clearly rejected this view. It held:

•             Private addresses and handwritten signatures are personal data within the meaning of the GDPR.

•             Entering, storing and providing them online in the commercial register constitutes data processing, for which the register court is responsible.

•             There is no general obligation to store over-obligatory (i.e. not legally required) personal data permanently in the register file.

D. Your right to be “forgotten” in the commercial register

A key point for users is the right to erasure under Article 17 GDPR:

•             You can withdraw consent you have previously given for the processing of your data – and the BGH recognises that a request for erasure or replacement of documents can at the same time be understood as a withdrawal of consent.

•             “Erasure” does not only mean deleting data in the system, but any form of rendering the information unreadable – for example by replacing the document with a cleansed version.

•             Importantly, even if your data still appears in other register files, your claim remains. Every reduction in the number of places from which the data can be retrieved lowers the risk of misuse.

In other words: you may proceed selectively and, for example, request cleansing only for certain companies or certain types of documents.

E. What the law actually requires – and what it does not

Many queries revolve around the question: “Isn’t there something in the German Commercial Code saying that everything must remain as originally filed?” The BGH is very clear here:

•             Where shareholders are legal entities, the commercial register must show the company name, legal form and registered office – not the names, private addresses or signatures of the managing directors.

•             Private addresses and original signatures are therefore over-obligatory data which the legislator has consciously not made mandatory for registration.

•             A supposed general “principle of data retention”, under which once-filed documents must remain permanently available and unchanged, cannot be derived from register law.

In conformity with EU law, the BGH interprets section 9 of the Commercial Code to mean that the register file contains the currently valid documents – older originals containing personal data can be moved to the register record, which is less publicly accessible.

F. What notaries and companies can do in practice

For practice – and for the many questions we receive – two points are particularly user-friendly:

•             Notaries are allowed to prepare electronic copies in excerpted form and to black out or “white out” personal data such as private addresses or original signatures before submitting documents to the register.

•             Filings need only match the original in substance, not visually. It is therefore sufficient to indicate signatures as text (“signed [name]”) instead of making the handwritten signature publicly visible.

Register courts, for their part, can replace documents in the register file: the original, personal-data-heavy document is moved to the register record; the cleansed version showing the business address and “signed” notation takes its place and the replacement is recorded.

G. Our conclusion for clients and readers

From a client’s perspective, the decision can be boiled down to a clear message:

•             No, your private address and handwritten signature do not necessarily have to remain permanently in the freely accessible commercial register if the law does not require them.

•             Yes, under the GDPR you have an effective right to erasure or replacement, even selectively and even where the data still appears elsewhere.

•             And yes, notaries and register courts have the legal and technical means to design register documents in a privacy-friendly way and to clean up existing records.

If you ask us: “Can I ensure that my private address or signature is no longer visible to everyone on the internet?”, then after this BGH decision the answer is: In many cases, yes – and we will work with you to assess whether and how this can be enforced in your specific case.

Do you have questions about data protection in your company? Contact us – we are here to help.

Jüdemann Rechtsanwälte

The post corporate law – right to be forgotten – commercial register bgh appeared first on Jüdemann Rechtsanwälte.

Key Legal Issues
The core legal questions were whether the storage and evaluation of GPS tracking data in the employment context is permissible and whether employee consent can serve as a legal basis for such processing. Another issue was whether financial incentives, such as a salary increase, could influence the voluntariness of consent.

Court’s Reasoning
The court dismissed the company’s claim and upheld the orders of the data protection authority. It found that the long-term storage of GPS data for purposes such as efficiency improvement, theft prevention, and evidence preservation was not necessary and thus disproportionate under the GDPR. The court argued that storage of data was not the least intrusive means to achieve these purposes, as live tracking would suffice for short-term coordination and route optimization. For theft prevention, access to the live location in specific cases was deemed sufficient.

Storing location data for evidence preservation was also not justified, as it was not suitable for proving service delivery. The court emphasized that general, preventive monitoring without specific suspicion is impermissible. Storage of personal data for control or evidence purposes requires a concrete, documented initial suspicion.

On Consent in Employment Relationships
The court examined in detail whether employee consent could justify the data processing. According to Section 26(2) of the German Federal Data Protection Act (BDSG) and Article 6(1)(a) GDPR, consent is only valid if it is given voluntarily. The court referred to established case law of the Federal Labour Court, which holds that due to the hierarchical relationship in employment, true voluntariness of consent can rarely be assumed.

Financial Incentives and Voluntariness
However, the court explicitly left open whether a financial incentive—such as a salary increase—might, in an individual case, be sufficient to render consent voluntary. The court noted that it did not need to decide whether a financial benefit such as a salary increase could make consent voluntary, and thus effective. This leaves open the possibility that, under certain circumstances—such as a significant financial benefit—the voluntariness of consent could be assumed despite the inherent dependency in the employment relationship. The court, however, cautioned that even in such cases, the strict requirements for voluntariness and transparency of consent must be observed, and a case-by-case assessment would be necessary.

Guiding Principles (Leitsätze)

Long-term storage of GPS tracking data for monitoring employees in the logistics sector is disproportionate and violates the GDPR unless there is a specific reason.
Live tracking of vehicles may be permissible if it is limited to what is strictly necessary and no long-term storage occurs.
Employee consent to the storage and evaluation of GPS data is generally not a valid legal basis in the employment context, as it is usually not given voluntarily.
The court leaves open whether a significant financial incentive, such as a salary increase, could in individual cases render consent voluntary and thus effective.
Companies must fully inform employees about GPS tracking in accordance with Article 13 GDPR.
Storage of personal data for control or evidence purposes requires a concrete, documented initial suspicion.
Detailed Reasoning and Assessment
The VG Wiesbaden’s judgment is a significant addition to case law on employee data protection. It underlines that the requirements for the lawfulness of monitoring measures in employment are strict. Courts demand a rigorous assessment of necessity and proportionality for each individual measure. The storage of GPS data over a long period is only permissible in exceptional cases, such as when there is a specific suspicion of misconduct and storage is necessary for evidence preservation.

The court’s discussion of consent is particularly relevant. While consent under the GDPR is generally a valid legal basis for processing personal data, there are serious doubts about its voluntariness in employment due to the structural imbalance between employer and employee. The court follows the restrictive approach of case law and supervisory authorities, according to which consent in employment is only genuinely voluntary in rare exceptional cases.

By explicitly leaving open whether a financial benefit such as a salary increase could make consent voluntary, the court points to the need for a case-by-case assessment. It acknowledges that voluntariness is not categorically excluded if the employee receives a substantial benefit. However, it remains unclear how significant the financial incentive would need to be and how the balancing of interests would be conducted in practice. Companies wishing to rely on such consent must therefore carefully document that consent was truly voluntary and given without pressure or coercion. They must also ensure that employees have an unrestricted right to withdraw consent at any time and that there are no negative consequences for refusal or withdrawal.

Practical Implications for Companies
For companies, the judgment means that they should be extremely cautious when using GPS tracking systems. Storing location data beyond the moment of live tracking is generally impermissible. Obtaining consent is only a viable legal basis in the employment context in rare exceptional cases. Companies should therefore primarily rely on other legal bases, such as Section 26(1) BDSG (necessity for the employment relationship) or Article 6(1)(f) GDPR (legitimate interest), always subject to a strict proportionality assessment.

Conclusion
The VG Wiesbaden has set a high bar for the data protection-compliant use of GPS tracking in the employment context. The storage of location data is only permissible in narrowly defined exceptional cases. Employee consent is generally not a valid legal basis, although the court leaves open whether a significant financial benefit, such as a salary increase, could make consent voluntary in individual cases. Companies are therefore well advised to proceed with great care when introducing and using GPS tracking systems and to seek legal advice if in doubt.

Note:
Jüdemann Rechtsanwälte advise companies comprehensively on all data protection matters, particularly on the data protection-compliant design of GPS tracking and other monitoring measures in the employment context.

The post Data Protection: GPS Tracking VG Wiesbaden, Judgment of 17 January 2022 – 6 K 1164/21.WI appeared first on Jüdemann Rechtsanwälte.

No prohibition of utilization of evidence for EncroChat data. EncroChat, an end-to-end encrypted messenger used on owned Kypto phones, was probably originally intended to protect celebrities from hacks of their phones. Through constant promotional efforts, the service became successful – the result was that the phones and messenger service were also used by other, not so prominent, people, including members of organized crime to plan and carry out criminal activities. In 2020, Interpol opened investigative proceedings against the network. The Lille prosecutor’s office in France succeeded in penetrating the EncroChat server by technical means and decrypting the communications handled through it. This led to numerous investigations against users. Since the measures taken by the French investigators could have been illegal according to German understanding, the question arose as to whether the data obtained was thereby subject to a prohibition on the use of evidence. This was affirmed in part by the courts of first instance. The higher regional courts, including the Berlin Appellate Court, have essentially come to the conclusion that there is no such prohibition.

The Berlin Appellate Court has recently ruled that the data obtained via the allegedly tap-proof communication service “EncroChat” can be used. Previously, the criminal court had taken the view that the defendant’s chat communication, which the prosecution relied on as decisive evidence, was not suitable for legal reasons to prove the defendant’s guilt; it could not be used in German criminal proceedings. The collection of this data – by the French investigating authorities – was unlawful (in relation to the defendant) and the encroachment on fundamental rights that it entailed was therefore not justified. The unlawfulness resulted from the fact that the data had been obtained in violation of Directive 2014/41/EU of the European Parliament and of the Council of April 3, 2014, on the European Investigation Order in Criminal Matters (hereinafter: Directive EEA) and of the regulations issued for its implementation in the Law on International Mutual Assistance in Criminal Matters (IRG). The measure was also unlawful because the qualified suspicion required under §§ 100a and 100b of the Code of Criminal Procedure did not exist when it was ordered and carried out. The violation of Article 31 of the EEA Directive assumed by the Criminal Division was so important that it outweighed the state’s interest in prosecution.

The Berlin public prosecutor’s office filed an immediate appeal against the decision of the criminal division. The Appellate Court granted the appeal.  Like other courts before it, the Appellate Court affirmed the usability of the data. This was justified, among other things, by the fact that the data had previously been effectively obtained under French law. The fact that the order for the investigative measures carried out by the French authorities did not appear to meet the requirements that would have to be met under German law for monitoring Internet-based data exchange and telecommunications did not prohibit the exploitation of the findings obtained from this according to the overall assessment to be made.

Fragen zu Encro-Chat? Kontaktieren Sie uns!

Rechtsanwalt Kai Jüdemann

Specialist lawyer for criminal law / specialist lawyer for copyright and media law

The post No prohibition of utilization of evidence for EncroChat data (KG of 30.08.2021 – 2 Ws 93/21) appeared first on Jüdemann Rechtsanwälte.