Hamburg uses AI to draft privacy complaint correspondence

According to PPC Land, Hamburg’s data protection commissioner (HmbBfDI) uses LLMoin, a chatbot built around an OpenAI model, to draft correspondence concerning complaints. An authority case study dated November 5, 2026 reportedly describes its assessment of the safeguards and subsequent internal adoption. The backdrop is a growing workload: the authority reportedly received 4,220 complaints in 2025, up 62% on the previous year, without a corresponding increase in staffing. Use is limited to files with standard confidentiality requirements; data requiring a high level of protection remains excluded.

In PPC Land’s account, the authority bases processing on Article 6(1)(e) GDPR, concerning public-interest tasks, together with the relevant German provisions. Internal rules require officials to read the entire file, develop their legal assessments independently and check every draft. The system may help formulate and structure texts, but may neither decide complaints nor perform legal assessments that determine the outcome. Safeguards include filters, system instructions, controlled contextual information, adversarial testing and staff training.

PPC Land reports that the authority, interpreting EDPB Opinion 28/2024, assumes the model is probably not anonymous and considers the measures against extracting personal data potentially incorporated unlawfully during training sufficient in this particular case. The article also reports, through the case study, the German data protection conference’s (DSK) position: blocking an output with filters does not amount to erasure under Article 17 GDPR. This interpretation binds neither other authorities nor courts and does not constitute general approval for businesses. The conclusions remain based on the journalistic account, without direct verification of the primary documents.