IT projects

On 19 September 2025, the Higher Administrative Court of North Rhine-Westphalia ruled that the City of Cologne may not make special use permits for outdoor dining at Brüsseler Platz subject to a closing time of 22:00. The court thereby overturned the previous ruling to the contrary by the Cologne Administrative Court.

In its judgment of 12 May 2026 – 4 UKl 3/25, the Higher Regional Court of Hamm ruled that the responses provided by a chatbot are to be attributed to its user as the user’s own conduct. If such responses breach competition law provisions, this therefore constitutes a separate breach of competition law by the user.

This episode features Prof. Frauke Rostalski, Professor of Criminal Law, Criminal Procedure, Philosophy of Law and Comparative Law at the University of Cologne, and a member of the German Ethics Council. First (03:02), the discussion turns to the draft bill on strengthening civil and criminal law protection against digital violence. What gaps in criminal liability does the draft bill close? Subsequently (10:24), reference is made to areas where freedom of expression is coming under increasing pressure. Rostalski describes her observation of a “vulnerability of discourse” and, from minute 15:54, reports on the climate of discourse at universities. The discussion then (17:48) turns to criminal law as a means of defence for a resilient democracy, for example through the withdrawal of the right to stand for election in cases of incitement to hatred. In this context, the discussion also turns (from 22:10) to the report by the Federal Office for the Protection of the Constitution classifying the AfD as “confirmed right-wing extremist”. The podcast concludes with a positive outlook on the discourse on freedom of expression.

First, Dr Stefan Brink and Prof Niko Härting (00:33) discuss the new data deletion policies for the Siri chat function (Apple) and the WhatsApp messaging service (Meta). From minute 09:59, the decision of the Lüneburg Administrative Court of 29 April 2026, ref. 1 A 85/24, is discussed. The town of Buchholz had published a call for a demonstration against right-wing extremism. The AfD was also mentioned in this context. The local branch of this party unsuccessfully challenged this. Last but not least (20:25), Niko and Stefan discuss the recently published activity report by the Federal Data Protection Commissioner. From minute 29:10 onwards, they highlight in particular the sections on surveillance by the intelligence services. Does the BND have a flawless data deletion routine?

Episode 44 of the Data Navigator podcast focuses on FRAND in the Data Act – specifically, the conditions under which data owners must disclose IoT data to third parties and what they are permitted to charge for this. Martin Schirmbacher and Hubertus von Rönne explain the details of the new legal framework. The starting point is the familiar triangle: a user (e.g. a wind farm operator) instructs the manufacturer (e.g. Vestas) to send operational data directly to a third party (e.g. the start-up Turbit). To this end, a contract must be concluded between the manufacturer and the third party (see Art. 8 Data Act), and remuneration is governed by Art. 9 DA, all on FRAND terms. The user, however, may request the data free of charge. Martin and Hubertus go through in detail which costs the manufacturer is permitted to charge (provision costs, onboarding, margin where applicable, and investment costs – though the latter, for example, not vis-à-vis SMEs), which billing models the Commission’s draft guidelines provide for, and what ‘non-discriminatory’ means in practice. Key principle: The value of the data itself must not be priced. The conclusion: Remuneration issues will develop differently depending on the sector. At present, progress is often still stalling on fundamental issues: What data is actually being shared, and how should it be categorised? The call remains: producers, users and data recipients must come together within their respective sectors and also discuss the terms of data provision.

On 26 March 2026, the Bundestag passed the Act Implementing the Data Regulation (DADG), which was published in the Federal Law Gazette on 29 May. Germany has thus – albeit with a significant delay – established the national legal framework required of Member States under the EU Data Act. Below, we provide an overview of the background, content and penalty provisions of the new Act.

AI has long been used in many areas within organisations: in HR, marketing, software development, customer service, legal, procurement and management. Whilst this often promises significant efficiency gains or better results, it is not uncommon for it to be accompanied by shadow AI, unclear tool approvals, data protection risks, copyright issues and uncertainty amongst staff. At the same time, legal regulation is becoming more concrete. The AI Regulation not only requires an assessment of legal risks but also mandates, depending on the risk class, documented decisions, robust processes, clear roles and AI expertise within the organisation.