CJEU case C-185/25 Waldfelber – CJEU Judgment (European Union, 2026)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
The Court of Justice of the European Union ruled on a case involving a school headteacher who refused to share information about a teacher's reputation. The court decided that the headteacher had to provide access to the data subject's personal information. This ruling highlights the importance of transparency and the right to access personal data.
What happened
A school headteacher denied a request for access to personal data regarding a teacher's reputation.
Who was affected
The teacher whose reputation was discussed and who requested access to the information.
What the authority found
The court held that the headteacher must provide the requested personal data under GDPR.
Why this matters
This decision reinforces the right of individuals to access their personal data and emphasizes the obligation of organizations to be transparent about data processing. It serves as a reminder for educational institutions to comply with data access requests.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The headteacher of a primary school in Austria was in charge of organising mandatory continuing training programmes for teachers at the school. The training programmes were provided by a University, which supplied schools with organisational staff known as programme coordinators. The data subject was proposed by the University as the coordinator for an upcoming training programme at the school. After being informed of this proposal, the headteacher asked a teacher about the data subject’s reputation in a face-to-face conversation. The teacher expressed a negative opinion about the data subject. The headteacher then sent an email from his professional email address, using a school computer and a designated server, to an employee of the University. In the email, he requested that another programme coordinator be assigned. He referred to the information obtained from the third party, according to which the data subject allegedly opposed the public school system and was in constant dispute with the relevant education authority. When the data subject became aware of the email, he requested access under Article 15 GDPR. In particular, he asked for the identity of the third party who had provided the information, as well as a copy of the personal data concerning him processed in the email. The headteacher refused to provide this information. He argued that he had not possessed or stored personal data concerning the data subject and had merely expressed concerns about the proposed appointment. The data subject brought legal proceedings. The first instance court dismissed the claim, and the appeal court upheld that decision. The courts found that the headteacher had acted as an executive officer of the legal entity governing the school. They also held that the means of processing, including the professional email address, server and computer, had been prescribed to him. Therefore, they considered that he could not be treated as a controller under the GDPR. The appeal court a
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (0)
No other cases found for CJEU case C-185/25 Waldfelber in EU
This is the only recorded case for this entity in this jurisdiction.
Details
Judgment Date
18 May 2026
Authority
Court of Justice of the European Union
About this data
Cite as: Cookie Fines. CJEU case C-185/25 Waldfelber - European Union (2026). Retrieved from cookiefines.eu
Last updated: