You probably won't find direct proof any more than you will find direct proof of any random VPN selling your data, it's just a given that commercial entities are liable to sell financially valuable data, and a list of all traffic, every website you visit and every service you use, tied to a specific identity is certainly financially valuable. Being in the EU doesn't change this; in fact the EU explicitly required that ISPs retain your identifying data with the Data Retention Directive, and though this was struck down after 8 years in court, many individual national governments immediately moved to impose similar requirements. I don't know if Germany was one of them but unless Germany has a specific privacy directive that goes beyond EU law I would see zero reason to place any trust in an ISP. In fact even if there was a law that's still not a reason to trust an ISP, because privacy laws are violated constantly; the most trustworthy source by far is a party acting opposite to the government, who has been investigated by the government and proven not to log the data that the government wants.