Sensitive data, consent, association actions and AI labelling: what companies must consider when using an AI chatbot in customer contact.

Frankfurt Regional Court (2-03 O 388/25): Google may not show 3D aerial images of an inhabited property without being asked. The personality right covers the whole property; deletion was denied.

A PHP security vulnerability is not yet a data breach but calls for prompt action: duties under the GDPR and the BSI Act and the responsibility of the management.

Since 11 September 2026, manufacturers' reporting obligations under Art. 14 CRA have applied – including to products already on the market. What companies need to organise now.

Regional Court of Hanau (case no. 7 O 37/24): Time-based billing and operational control by the client make the software development contract a service contract – with consequences for fees, burden of proof and employment law.

Administrative Court of Düsseldorf (judgment of 27 July 2026 – 29 K 9714/24): E-mail address, sign-up IP and DOI IP are not sufficient proof of consent under Art. 7(1) GDPR.

Higher Regional Court of Hamm (judgment of 12 May 2026 – 4 UKl 3/25) and Regional Court of Hamburg (order of 23 September 2025): Deployers adopt the output of their AI as their own and are liable for errors.

Register data are read out and aggregated automatically. Those who structure filings in a data-minimising way avoid later deletion proceedings and misuse risks.

CJEU (judgment of 19 March 2026 – C-526/24): Even a first-time access request can be excessive if it serves only to provoke claims for damages.