Bahn app secretly passes on data
Millions of people use DB Navigator. What hardly anyone knows: The Deutsche Bahn app eagerly collects personal data – and passes it on. The users cannot defend themselves. That’s why the Digitalcourage association is now suing. The details.
Contents
Digitalcourage eV is suing Deutsche Bahn for tracking
It has been brewing for months. Now the time has come: The association Digitalcourage eV – represented by the Spirit Legal Fuhrmann Hense partnership of lawyers – has one Lawsuit filed against Deutsche Bahn.
Specifically, the data protection association accuses Deutsche Bahn of collecting personal data in DB Navigator and forwarding it to third parties. However, all users of the app do not have the opportunity to object to this data transfer. And that’s the crux of the matter.
The legal dispute surrounding Deutsche Bahn began in April 2022. At that time, security expert Mike Kuketz had in a blog post Significant data protection problems in DB Navigator discovered and complained about.
If the users decide to only accept “selected cookies” after installation, these are by no means essential technical functions and data for the operation of the app.
Personal data ends up with Adobe and Co.
The ten service providers who receive personal data from DB Navigator include Adobe Analytics (website analysis), Cross Engage (personalized marketing), Optimizeley (AB testing) and Easy Marketing GmbH (affiliate marketing).
These four companies alone and their areas of application clearly reveal that they are by no means urgently needed to operate the app. Nevertheless, users have no chance of excluding even one of the ten partners of Deutsche Bahn.
Or to put it another way: anyone who wants to use the DB Navigator, for example to buy tickets or check arrival times, automatically agrees to the transfer of personal information to third parties, some of which are US companies.
Deutsche Bahn reassured: Data transfer does not violate the GDPR
Deutsche Bahn also takes a position on the lawsuit. in the corresponding statement it says for example:
When using DB Navigator, no customer data is passed on to third parties. All service providers that DB works with on DB Navigator are contractually bound, do not act in their own interest and strictly according to DB’s instructions and are therefore not third parties within the meaning of the GDPR.
And further:
All technology providers listed in the DB Navigator in the “required” category process data exclusively for the purposes of ensuring the diverse functions and stability of the app for more than two million customers every day. No identifying personal information is processed, only pseudonymised data, which is isolated to the individual provider as anonymous data content. None of the providers is able to use the data elsewhere or even for their own marketing purposes. A cross-website or cross-app tracking of customers with these cookies is not possible.
Attorney expects verdict in a year
The following trial will show whether and to what extent Deutsche Bahn is successful with its defense strategy. Plaintiff’s attorney Peter Hense calculates opposite Netzpolitik.org with the fact that the procedure is completed within one year. For him, the starting position is clear.
The personal data passed on includes, among other things, information as to whether children are traveling with you, where the journey starts and where it ends.
The fact alone that data on minors is passed on to US companies is questionable. The judges are now deciding how questionable.
Also interesting:
