Court case 7 A 170/24 – Court Ruling (Germany, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled on a case involving a firearms authority that failed to respond properly to a person's requests about their personal data. The court found that the authority did not meet the deadlines for providing information as required by law. This ruling emphasizes the importance of timely responses to data access requests.
What happened
The firearms authority did not respond adequately to a person's requests for access to their personal data.
Who was affected
The individual holding a hunting license and firearms ownership card was affected by the authority's lack of response.
What the authority found
The court found that the firearms authority violated the legal requirements for responding to data access requests under GDPR.
Why this matters
This ruling highlights the obligation of authorities to respond promptly to personal data requests, reminding organizations to prioritize compliance with data access laws.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A firearms authority (the controller) sent the holder of a hunting license and a firearms ownership card (the data subject) information required under Articles 13 and 14 GDPR after the permits granted to the data subject had been transferred to it from another authority. The data processed by the controller included the name, date of birth, and contact information of the data subject. The data subject objected to the use of their home address for mailing letters in February 2024. In March, they requested the restriction of processing under Article 18(1)(d) GDPR. As the controller did not respond, the data subject repeated this request in April 2024 and made an access request under Article 15 GDPR. The data subject repeated the access request in June 2024 and criticised the controller for the failure to meet the deadline set forth in Article 12(3) GDPR. The data subject filed a lawsuit in July 2024, stating the controller had infringed Article 12(3) GDPR - this lawsuit has already been subject to a court decision. In August 2024, the controller provided the data subject certain information. The data subject maintained this information was incomplete and requested access to all their data processed by the controller. The data subject then filed another lawsuit in August, where they claimed the controller should to supplement the information provided - this lawsuit has also already been subject to a court decision. In a third lawsuit - subject to the decision at hand filed in October 2024 before the Administrative Court Osnabrück - the data subject claimed the information they requested access to on 21 August 2024 had not yet been provided to them and should have been provided by September 2024. The controller maintained the repeated access requests had been excessive. The court held that the lawsuit was well founded and stated that controller had failed to take action on the data subject’s access request within the one-month period required by Article 12(3) GDPR. T
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 7 A 170/24 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 7 A 170/24 - Germany (2026). Retrieved from cookiefines.eu
Last updated: