Missing anonymization of court decisions in a state legal database: Liability risks according to the Hamburg Regional Court
In its judgment of June 16, 2025 (Ref. 324 O 278/23), the Hamburg Regional Court established key guidelines regarding liability for violations of personal rights when publishing court decisions in a state legal database. The decision was issued in the context of a lawsuit in which the incomplete anonymization of personal data in a freely accessible state-managed database was objected to.
Background: Practices for publishing court decisions
In Germany, there is considerable public interest in the transparent publication of court decisions. Such publications serve the purpose of ensuring the comprehensibility of the judiciary and strengthening trust in the independence of the justice system. Legal requirements, including Section 169 of the Courts Constitution Act (GVG) and the General Data Protection Regulation (GDPR), however, impose strict limits: the personal rights of the parties named in the decisions and affected third parties must be strictly protected. This is regularly ensured by the anonymization of personal data.
Legal standards: Duties and responsibilities of the publishing entity
With the present judgment, the Hamburg Regional Court confirms that the operator of a state legal database has an independent obligation to carefully anonymize decisions. If the publication of sensitive personal data occurs due to insufficient anonymization, this may constitute a violation of general personal rights, in particular the right to informational self-determination.
Due diligence requirements and technical data protection
The reasoning emphasizes that the duty of care places very high demands. The publishing entity—in this case a public-law body—not only bears responsibility for obvious personal information (such as names and addresses), but must also consider hidden and indirect identification risks. These include, for example, combinations of case numbers, specific case scenarios, or detailed descriptions that could allow conclusions to be drawn about those involved.
The court also explicitly points out that technical and organizational measures are required to effectively implement the necessary level of protection. Even a single publication of insufficiently anonymized decisions may constitute a significant intrusion upon personal rights and thus give rise to liability claims.
Legal liability consequences in the case of anonymization deficiencies
Cease-and-desist, information, and, if applicable, claims for damages
According to the Hamburg Regional Court, the affected person is fundamentally entitled to have personal information removed and to prevent further publications in a non-anonymized form. The decision also refers to information rights regarding the scope and recipients of the published information.
A particular feature is the potential liability for non-material damages under Art. 82 GDPR, provided the publication involves data processing within the meaning of the General Data Protection Regulation and personal rights were infringed. Similarly, there are civil law claims for injunctive relief and removal pursuant to Sections 823, 1004 BGB (analogous).
Responsibility and organizational fault
Another key point is whether there is organizational fault if sufficient mechanisms for anonymization have not been established. The court emphasizes that the focus is not on individuals but on the proper structure and controls within the institution.
Distinction from editorial press
To protect press freedom pursuant to Article 5 of the Basic Law, it is clarified that public-law databases managed by state authorities do not fall under the media privilege of the GDPR. This leads to stricter requirements for the data processing controller compared to journalistically/editorially operated companies.
Practical impact of the decision
For institutions that publish decisions—particularly the judiciary and related authorities—the consistent implementation of internal anonymization guidelines becomes even more important. Private actors involved in publishing court decisions must also adhere to high standards of due diligence.
Outlook: Consequences for the digitalization of the judiciary
Digitalization is progressing inexorably in the legal sector. The Hamburg Regional Court’s decision underscores the need to consistently take data protection issues and personal rights into account in all digitalization initiatives within the justice system. The development of technical anonymization tools and regular review of publication processes are essential for a legally compliant and transparent approach to court decisions.
The full decision of the Hamburg Regional Court can be read at urteile.news [source]. The proceedings are legally concluded. Further clarification by the highest courts could refine the requirements in the future.
