Cookie Consent Court Rulings & CJEU Precedents
Browse court rulings and CJEU decisions related to cookie consent and ePrivacy law.
Data current as of 19 October 2026 · Updated daily
CJEU case C-604/22 IAB Europe
The case involves the Transparency & Consent Framework for online advertising, focusing on personal data processing compliance with GDPR, not specific cookie violations.
Societe.com
The case involved a failure to respond to a data erasure request, unrelated to cookies or consent mechanisms.
WetterOnline Meteorologische Services GmbH
The North Rhine Westphalia Consumer Protection Association ([https://www.verbraucherzentrale.nrw/ Verbraucherzentrale NRW]) claimed for an injunction against the use of cookie banners on [https://www.wetteronline.de/ wetteronline.de], a wesite operated by WetterOnline Meteorologische Services GmbH, the controller. The controller used a cookie banner to collect users' consent to not necessary cookies without providing a reject option on the first layer. The data subject could only refuse to give consent by clicking on the “Settings” button to reach the second layer, where they then had an “Accept all” button or a “Save” button. The cookie banner also had an “Accept & Close X” button in the top-right corner, on both first and second level. In a judgement dated 4 May 2023, the Regional Court of Cologne (Landgericht Köln, LG Köln) dismissed the action as it considered the claim of the Association to be too broad and claimed that it could not impose a specific cookie banner design on the controller. The Association appealed against this judgement to the Higher Regional Court of Cologne (Oberlandesgericht Köln, OLG Köln) and specified its claim. Firstly, the OLG Köln considered that the controller designed their cookie banner without an equivalent "reject option" either at the first or second layer. The OLG pointed out that the average user does not realise what the “Save” button represents - namely refusal to provide consent for the use of not necessary cookies. Therefore, the OLG decided that consent could not be regarded as freely given and sufficiently informed under Article 4(11) GDPR. Secondly, regarding the “Accept & Close X” button, the OLG considered that the “X” symbol is known to users as a way to close a window, but not to consent to the use of cookies. The average user would not be aware that this constitutes consent, even if the “Accept & Close” is located directly next to the “X” symbol. The OLG also noted that it was not easy for data subjects to recognize that the “Accept & Close” and the “X” symbol were one and the same button. Therefore, the OLG considered that this could not be regarded as unambiguous under Article 4(11) GDPR. With regard to these infringements, the OLG therefore ordered the controller to refrain from using such a cookie banner design and make sure that the banner includes a reject option equivalent to the accept option.
A Pakistani national, the plaintiff
A Pakistani national residing in Germany (the data subject) is suspected of having killed a person together with his brother and other persons in Pakistan, where he is wanted by warrant. This created an alert on the Schengen Information System (SIS) stating that he should be denied entry into the Schengen zone. The data subject upon travelling to Italy was arrested at the border to be extradited to Pakistan. Pakistan however, failed to submit an extradition document despite Italy's requests. Therefore, the arrest was revoked by the Italian Court of Appeal in Brescia. Based on this, the data subject argued that he was now innocent and requested the deletion of the alert on the SIS system under Article 17(1)(d) GDPR.This is because Article 53(1) Regulation (EU) 2018/1861 which governs the operation of the SIS system refers to the GDPR and allows data subjects to invoke their rights under it, even if they are not for example an EU national. The reason for the data subject invoking the GDPR is that Article 53(1) Regulation (EU) 2018/1861 which governs the operation of the SIS system, refers to the GDPR and allows data subjects to invoke their rights under it when their data is processed by the system. The Federal Police Headquarters of Germany rejected the request for deletion multiple times. The alert was lawful and according to national law, data of foreigners who are the subject of an alert for refusal of entry can be stored on the basis of public safety. The voiding of the arrest warrent in Italy could not be held to override this public safety. The extradition had failed for formal reasons rather than because the data subject was innocent. The arrest warrant issued by Interpol Pakistan had not been withdrawn and therefore, there was still a valid reason to hold the alert in the SIS system. The data subject appealed the decision to the German Court in Potsdam arguing, among other reasons, that his rights had been infringed and that the data should be deleted because it had been unlawfully processed. The court held that the data subject's request was unfounded and dismissed it. The requirements of Article 17(1)(d) GDPR are not met as the data was processed lawfully. First, data processing is only unlawful if there is neither the consent of the data subject nor any other legal basis for it. In this case, the Federal Police Headquarters has a legal basis under the Federal Police Act. This Act states that Member States shall keep an alert if the prescence of a third-country national constitutes a threat to public safety. There is a threat to public safety if there are reasonable grounds to suspect that a third-country national has committed a serious criminal offense. Second, the Court on the facts decided that there were reasonable grounds to suspect that the applicant was involved in a murder in Pakistan (a serious criminal offence). The warrant issued by Pakistan sufficiently individualises the data subject, substantiates the accusation with the time of the crime, the place of the crime, the victim and witnesses and therefore, justifies the conclusion that the suspicion in the data subject's case is well-founded. Third, there is no legal obligation on the Federal Police Headquarters to question the facts of the arrest warrant in Pakistan. The assumption of a threat to the public is based on an "individual assessment" by the Member State. When determining whether there is reasonable suspicion and thus a threat to public order, the authority has a broad scope of discretion.
Telekom Deutschland GmbH
The case involves the unlawful transfer of personal data to US-based companies through cookies without proper consent.
Criteo
Criteo placed tracking cookies without obtaining prior user consent and continued to collect cookies even after users had refused consent.
Garante per la protezione dei dati personali
The appellant in the present proceeding was an association which used an algorithmic system to objectively calculate the reputation rating of the natural and legal persons who created a profile (the data subjects) on their platform. The case stems from an investigation the Italian DPA had conducted on the appellant. At the end of the investigation, the Garante prohibited under [https://www.garanteprivacy.it/codice Article 154(1)(d) of the Italian Privacy Code] the mentioned data processing operations due to a breach of [https://www.garanteprivacy.it/codice Articles 2, 3, 11, 23, 24 and 26 of the Code]. The DPA decision was appealed by the company and ended up before the Italian Supreme Court, for three reasons. First, the appellant claimed that the previous instance did not adhere to well-established Supreme Court case-law on consent. Second, it highlighted that the math scheme of the algorithm was already available in the EU Patent Registry and easily recognizable. Lastly, the violation and wrongful application of [https://www.gazzettaufficiale.it/anteprima/codici/codiceCivile Article 41 of the Civil Code], [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 8(2) of the European Charter for Fundamental Rights], [https://www.garanteprivacy.it/codice Articles 13, 23, 26 of the Italian Privacy Code], as applicable at the time of the facts, and Article 7(4) GDPR with regards to the protection of the principle of economic initiative. The Supreme Court stated that the first two claims of the appellant had to be considered together as they were interrelated. It noted that the previous court had ruled that data processing by an algorithmic system could be considered transparent when the data subjects knew how the algorithm worked. Regardless of the explanation, the Supreme Court focused on the lawfulness of the processing and found that it is necessary for the data processing carried out by an algorithm to be subject to consent. This means that the data subjects had to give their consent freely for a specific data processing and that information on the data processing had to be provided on the basis of [https://www.garanteprivacy.it/codice Article 13 of the (now updated) Italian Privacy Code]. Therefore, because the data subjects were able to recognize the algorithm and the data processing, which was described to them by the appellant in an unambiguous and specific way, the Supreme Court repealed the judgment by the Court of Rome. Thus, it also found that it was not necessary to consider the third reason brought by the appellant.
Court case 33 Cdo 347/2023
The case focused on billing disputes and data retention obligations, not related to cookies or consent.
Garante per la Protezione dei Dati Personali
On 10 June 2021, the Italian DPA issued a €2,600,000 fine against the defendant, a delivery company, for unlawfully processing personal data of platform workers. The defendant appealed this decision to the Ordinary Court (Court). The Court annulled the decision of the DPA because although the decision was legitimate in terms of the violation found, the DPA's decision of the sanction was not. The Court found that the fine imposed by the DPA amounted to 7.29% of the defendant's turnover - significantly higher than the 4% parameter mentioned in Article 83(5)(a) GDPR and even higher than the average percentage (0.0019%) applied by the DPA to other sanctioned entities. Thus, the Court annulled the decision, without, however, modifying the amount of the sanction as the Court stated to not have this power under [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2011-09-01;150~art6 Article 10 of Legislative Decree No 150 of 2011]. The Italian DPA appealed this decision to the Italian Supreme Court. The main issue addressed by the Italian Supreme Court and brought by the DPA is the infringement or misapplication of Article 83 GDPR and [https://garanteprivacy.it/web/guest/codice Article 166 of the Italian Privacy Code], given that the sanction imposed was compliant with the provisions. The Supreme Court reiterated that Article 83 GDPR regulates the general conditions for imposing administrative sanctions, and each supervisory authority shall ensure that the administrative fines imposed are ‘in each individual case’ effective, proportionate and dissuasive. To be determined based on certain elements listed in Article 83(2) GDPR. The Supreme Court further noted that in the case of an intentional or negligent breach of several provisions of the GDPR, Article 83(3) GDPR requires that the maximum penalty shall not exceed ‘the amount specified for the gravest infringement’. In this perspective, the amount is set out in paragraphs 4 and 5 of Article 83 GDPR. Both present two types of administrative fines as alternative sanctions. Respectively, an ordinary penalty of up to €10,000,000 or a proportional one of up to 2% of the annual turnover and up to €20,000,000 or 4% of the annual turnover. The Supreme Court clarified that the second type of proportional fine (2% and 4%) does not aim to mitigate the amount provided by the ordinary penalty (€10,000,000 and €20,000,000). Instead, the percentage is to be used when it determines a higher penalty than the ordinary one. As can be easily deduced from the final phrase of the provision, "whichever is higher". According to the Supreme Court, this reasoning was completely omitted by the Court. It added that the Court also did not consider that the defendant’s annual turnover worldwide in 2019 amounted to €35,654,375. This means that the sanction did not exceed the maximum permissible penalty under Article 83 GDPR since it was lower than €20,000,000. In addition, regarding the statement by the Court asserting that the sanction was unlawful because it allegedly exceeded the average percentage applied in other cases, the Supreme Court noted that it did so without specifying which other instances it was referring to. The Supreme Court further assessed the Court's statement of not having the power to modify the amount of the sanction under [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2011-09-01;150~art6 Article 10 of Legislative Decree No 150 of 2011]. The Supreme Court ruled that the article read with [https://garanteprivacy.it/web/guest/codice Article 166 of the Privacy Code] leads to the assertion that even in disputes concerning personal data, the Court may annul all or part of the decision as long as the amount is not less than the minimum penalty. In light of the above, the Supreme Court approved the Italian DPA’s appeal.
CJEU case C-162/22 Lietuvos Respublikos generalinė prokuratūra
The Lithuanian Prosecutor General´s Office investigated one of its public prosecutors, who was found responsible of misconduct in its office. The research into the public prosecutor´s misconduct was authorised by a court order, allowing for the interception and recording of data transmitted over electronic communication. Following these findings, the Prosecutor General´s Office dismissed the public prosecutor from office. The public prosecutor contested the decision before the [https://administracinis.teismas.lt/ Regional Administrative Court (Vilniaus apygardos administracinis teisma)], which dismissed the claim due to the lawfulness of the criminal intelligence operations and process behind the data gathered. The controller then appealed the case to the [https://www.lvat.lt/ Supreme Administrative Court (Lietuvos vyriausiasis administracinis teisma)], as he alleged that the access by intelligence bodies to traffic data and actual content of electronic communications was such a serious interference with fundamental rights that access could only be granted to combat serious crime. The Supreme Administrative Court considered it apparent that [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC], together with [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 3]ePrivacy Directive 2002/58/EC thereof, extends the scope of that directive only to legislative measures requiring providers of electronic communications services to grant the competent national authorities access to data (as found in C-623/17 Privacy International). Moreover, it follows from [https://curia.europa.eu/juris/document/document.jsf?text=&docid=238381&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=22564108 C-746/18 Prokuratuur], that only actions to combat serious crime and measures to prevent serious threats to public security are capable of justifying serious interference with [https://eur-lex.europa.eu/eli/treaty/char_2012/oj Article 7 CFR and Article 8 CFR] (hereinafter: the Charter). However, the CJEU did not yet rule on the impact of the subsequent use of the data concerned on the interference with fundamental rights. The Supreme Administrative Court doubted whether such subsequent use constituted a serious interference with [https://eur-lex.europa.eu/eli/treaty/char_2012/oj Article 7 CFR and Article 8 CFR], and whether such use is justifiable only for the purposes of combating serious crime and preventing serious threats to public security. Thus, the Supreme Administrative Court of Lithuania referred to the CJEU the following preliminary question: - Whether [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC] precludes the use, in connection with investigations into corruption-related misconduct in office, of personal data relating to electronic communications retained, pursuant to an authorised order, by providers of electronic communications services and subsequently made available to the competent authorities to combat serious crime? The CJEU pointed out that the referring court only questions the subsequent use of personal data retained by electronic communication providers on the basis of [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) Directive 2002/58]. Thus, the data to be considered in this preliminary ruling decision is the data retained on the basis of [https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/05cd4e020f0a11e7b6c9f69dc4ecf19f?jfwid=32wf58e9 Article 65(2) of Lithuanian Law on Electronic Communications], which, together with [https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/05cd4e020f0a11e7b6c9f69dc4ecf19f?jfwid=32wf58e9 Annex I], requires electronic service providers to retain, generally and indiscriminately, traffic and location data relating to such communications for the purpose of combating serious crime. The CJEU considered that the subsequent use of traffic and location data relating to electronic communications, to combat serious crime, is only possible on two conditions: - retention of those data by providers of electronic communications services must be consistent with [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC]; and - access to those data granted to the competent authorities must be itself consistent with that provision. In C-793/19 SpaceNet and Telekom Deutschland, legislation allowing the pre-emptive retention of traffic and location data was considered not in line with EU law. However, legislation allowing for data retention under strict requirements to combat serous crime and prevent serious threats to public security was allowed under [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng ePrivacy Directive 2002/58/EC]. In light of these preliminary remarks, the CJEU started its analysis by stating that [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15 ePrivacy Directive 2002/58/EC] allows Member States to introduce exceptions to the obligations laid out in [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 5(1) ePrivacy Directive 2002/58/EC] for the safeguard of national security, defence and public security, and the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system. However, the CJEU considered that [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15 ePrivacy Directive 2002/58/EC] cannot expand excessively the exception to the principle of confidentiality and data storage present in [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 5 Directive 2002/58]. Thus, the CJEU reiterated that the objectives listed in [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC] is exhaustive. Once having established that no other objectives can be added to the ones laid out in [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15 ePrivacy Directive 2002/58/EC], the CJEU considered that there is a hierarchy behind the objectives according to their importance, which in turn needs to be balanced against the seriousness of the interference to an individual´s life it entails (C-140/20 Commissioner of An Garda Síochána and Others). The objective of safeguarding national security exceeds in importance the other objectives of [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15 Directive 2002/58] and, thus, can justify more serious interference with [https://eur-lex.europa.eu/eli/treaty/char_2012/oj Article 7 CFR and 8 CFR]. Differently, with regards to the objective of preventing, investigating, detecting and prosecuting criminal offenses, only actions to combat serious crime and serious threats to public security can justify a serious interference with [https://eur-lex.europa.eu/eli/treaty/char_2012/oj Article 7 CFR and Article 8 CFR]. Thus, deciding whether there is a justification to the limitations to [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 5 ePrivacy Directive 2002/58/EC, Article 6 ePrivacy Directive 2002/58/EC and Article 9 ePrivacy Directive 2002/58/EC] depends on the seriousness of the interference stemming from this limitation and on the importance of public interest objective pursued by that limitation in relation to its seriousness ([https://gdprhub.eu/index.php?title=CJEU_-_C-511/18_-_La_Quadrature_du_Net_and_Others C-511/18 La Quadrature du Net and Others]). This reasoning applies mutatis mutandis to the subsequent use of traffic of location data retained by providers of electronic communications services ex [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC]. In the case at hand, for the CJEU, the fact that the referring Supreme Administrative Court did not indicate any threat to public security in its documents, and that investigating a misconduct in office does not correspond to the objective of prosecuting and punishing criminal offenses, ex [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC], proves that investigations of misconduct in office does not fall within the category of combating serious crime. Therefore, the CJEU found that [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC], read in the light of [https://eur-lex.europa.eu/eli/treaty/char_2012/oj Article 7 CFR, Article 8 CFR, Article 11 CFR and Article 52(1) CFR], does not allow the use, in connection with investigations into corruption-related misconduct in office, of personal data relating to electronic communications which have been retained by providers of electronic communications services and which have subsequently been made available to the competent authorities for the purpose of combating serious crime.
The plaintiff in this case is a German Consumer Protection Association (Verbraucherzentrale Bundesverband e.V.), while the defendant is LinkedIn Ireland Unlimited Company, an Irish social media company operating throughout the EU and worldwide. The plaintiff found that the website of the defendant makes use of cookies and other technologies like fingerprinting that automatically process personal data and monitor users behavior for analytics and marketing purposes. In its privacy notice of 2018, the defendant clearly stated that it ignores “do not track” (DNT) signals on its users’ browsers. DNTs are a browser setting that users can decide to activate, to request websites not to track their online activities. The defendant claimed it would not react to DNT signals, as there was no established “DNT standard” yet. Firstly, the plaintiff claimed that the use of DNT signals constitutes an expression of the right to objection of users under Article 21(5) GDPR against processing activities carried out for marketing purposes under Article 6(1)(f) GDPR, and that the defendant should stop ignoring such signals as doing so constitutes an unfair commercial practice. Secondly, the plaintiff found that when a user decides to first set up a LinkedIn account, the “off-LinkedIn visibility” option is usually pre-activated, which means that personal data of users is shown on the defendant’s partner websites. This, according to the plaintiff constituted a violation of Article 6(1)(a) GDPR, Article 25(2) GDPR, third sentence and Article 4(11) GDPR as well as provisions of the German Federal Law against deceptive commercial practices ([https://www.gesetze-im-internet.de/uwg_2004/ Bundesgesetz gegen unlauteren Wettbewerb, UWG]). Further, the plaintiff asserted in this respect that the defendant wrongfully relied on Article 6(1)(f) GDPR as a legal basis and acted contrary to Article 5(1)(a) GDPR and Article 5(1)(c) GDPR. After the defendant rejected the plaintiff’s warning letter, the plaintiff brought an action before the LG Berlin under Article 79(2) GDPR. The LG held the action to be partially inadmissible, as the court considered the first claim to be too broad, since it lacked the description of a concrete infringement, which could then not be established. However, the court held that the initially unclear first claim of the plaintiff that the defendant should stop communicating to its users that it ignores DNT signals and does not consider it as an objection under Article 21(5) GDPR, was substantiated by an attached screenshot and thus concerned a concrete violation. The court held that this behaviour constituted an unfair commercial practice under the UWG. Further, the court agreed with the plaintiff that the use of a DNT signal constitutes an objection by automated means using technical specifications for the purposes of Article 21(5) GDPR. As regards the submission of the defendant that it does not consider DNTs as objections because there is no established standard about them yet, the court held that this is irrelevant to the question whether an objection is valid or not. As a consequence, the court found that the decision of the defendant to ignore DNTs constitutes a deceptive practice. As regards the second claim, the court held that the plaintiff was right in asking the defendant to refrain from automatically activating the “off-LinkedIn visibility” setting. By leaving the option pre-ticked, the defendant deceives the users as to their consumer right to decide whether or not they want their data to be accessible to the public, in particular to third party websites. In this way, the average users are deceived as they may think they gave consent to have the option activated, even though it is likely that users would not activate this option themselves if it wasn’t pre-ticked. The court further held, making reference to CJEU case C-673/17 - Planet49, that the pre-ticked option offered by the defendant cannot constitute a valid consent. The LG hence ordered the defendant to refrain from communicating to its users that it does not consider DNTs as an objection to processing and to deactivate the automatic “off-LinkedIn visibility” setting when users first set up an account.
Magdeburg Administrative Court
This judgement stemmed from an appeal against a decision of the Magdeburg Administrative Court. In the original proceeding, the applicant challenged the procedure for the election of the data protection commissioner for the German state Saxony-Anhalt. According to the applicant - a candidate for the same position - the election procedure was not transparent and thus contravened to the requirements set forth in Article 53(1) GDPR. In particular, the data protection commissioner was appointed under state law by the regional Parliament. Members of the parliamentary groups could make proposals but there was no mandatory public call for applications. Furthermore, the applicant stressed that Article 54(1)(c) GDPR establishes an obligation for all EU Member States to put in place a law to provide more legal clarity about the election procedures of the heads of the DPAs. The applicant asked the court to temporarily block the election procedures and refer the case to the CJEU, in order to check whether the principle of transparency was respected. The court of first instance rejected the claim. Therefore, the applicant appealed the decision before the Higher Administrative Court of Saxony-Anhalt (Oberverwaltungsgericht Sachsen-Anhalt - OVG Sachsen-Anhalt). The court found that the applicant's appeal was inadmissible. The court held that the applicant was not eligible to bring such a claim because there was no subjective rights involved. Article 53(1) GDPR establishes requirements which are in the public interest and they cannot be invoked by an individual. Incidentally and without delving into the merits, the court also noted that offices at state level have staff chosen through democratic elections by voters or indirectly by other electoral bodies. The court stressed how the procedure designed by the state law does not jeopardise transparency, as it is immediately clear which names are proposed and by whom. Moreover, the election by a parliamentary assembly is explicitly envisaged by the GDPR in Recital 121.
Court case 93 O 167/20
Plaintiff is the umbrella organization of the consumer advice centers in Germany. Defendant is a media company. The media company integrated about 18 third-party-cookies on its website like Double Click from Google. They relied this on Art. 6 (1) (f) GDPR. The company did not implement any information about that on their start page and linked to the privacy policy not before implementing and analyzing the cookies. These cookies enabled profiling via tracking across different platforms. The plaintiff sent a warning on 20 June 2019 which the defendant declined on 14 August 2019. The defendant implented in August 2019 an opt-in cookie banner and changed their privacy policy. The plaintiff is of the opinion that there is no legitimate interest of the defendant and neither the weighting up would turn out in favor of the defendant. The plaintiff criticizes the insufficient information and continues that the incorrect legal basis leads to the false imagination that it is allowed to implement cookies without consent. The defendant is of the opinion that it is necessary because they otherwise would not be able to implement their offers on their website free of cost and also the cookies were set by third parties. The court is of the opinion that browser settings allowing a transfer of data are no active consent for lack of a deliberate decision of the affected persons. Further the court held that the setting of cookies from third parties is attributable to the defendant as they were payed for that. The court does not follow the opinion of the defendant that the freedom of press includes the advertisement as there is a certain part of jounralistic work needed for Art. 85 GDPR.
Nationale Maatschappij der Belgische Sporen (NMBS)
This ruling of the Belgian court of appeal (Marktenhof) concerns the Belgian Railway company SNCB/NMBS (controller), a company with the Belgian state as its only shareholder. During the COVID-19 Pandemic, the controller was ordered by the Belgian government to start an initiative to promote train travel. On 13 October 2020, the controller emailed railway pass holders to inform them about the use cases of this travel pass and also provided COVID-19 related information. This e-mail resulted in GDPR related discussions on Twitter, specifically regarding the lack of the possibility to object. The Belgian DPA started an investigation on that matter and found that by not providing the possibility to opt-out of receiving similar emails, the controller violated Articles 12(2), 21(2) and 21(4) GDPR. Moreover, the DPA held that the controller violated Article 5(1)(a), 5(1)(c), 5(2), 6(1), 12(2), 21(2) and 21(4) GDPR. The controller was fined €10,000 (a summary of this decision is available on the [https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_71/2022 hub]) and decided to appeal the decision with the Appeal Court on the following grounds: First, the controller contested the applicability of the GDPR, considering that the e-privacy directive was applicable as lex specialis. Second, the controller stated Article 6 ECFR had been breached because it had not been able to comment on a piece of evidence. Third, the controller stated that the decision of the DPA was based on an inaccurate and incomplete representation of the facts. Among the others, the controller disputed the DPA’s definition of ‘Direct marketing’. It added that it had sent the e-mail in the first place because it was obligated to do so pursuant to the government's instruction. It had to provide COVID-19 related information and promote its full service as part of its public service obligation. Fourth, the controller argued that the DPA did not properly motivate the GDPR violations in the disputed decision. Fifth, the controller disputed the DPA's application of the national implementation of article 83(7) GDPR which enables the DPA to fine a public entity controller under certain conditions. Sixth, the controller stated that the DPA did not properly motivate its fine. First, the court held that both the GDPR and the e-privacy directive were applicable in this case. The court stated that Article 13(2) of the e-privacy directive, which covers the conditions for direct marketing, explicitly mentions that the GDPR should also be respected. Second, the court determined that there was indeed a piece of evidence on which the controller was not able to comment but it was not the main piece of evidence on which the DPA’s decision was based. Third, the court held that since the e-mail also included a hyperlink linking to promotional content, it was a form of direct marketing. The court also agreed with the DPA that promotional material for a government service can constitute direct marketing. Fourth, the court held that the DPA properly motivated the violations in the original decision. Fifth, the court rejected the controller’s argument regarding Article 83(7) GDPR, considering that the controller did not limit itself to its legal obligation by only providing the railway pass and sanitary information regarding COVID-19. Therefore, Article 83(7) GDPR was not applicable for the controller. Sixth, the court held that the DPA did not adequately consider the circumstances brought forward by the controller that could impact the amount of the fine. The court also considered several circumstances on its own initiative, namely that the communication had the main goal of providing safety from COVID-19 infections and the fact that the controller had been obligated by law to issue the travel pass. In conclusion, following point 6 of the appeal above, the court concluded that the fine was improperly motivated, not proportional and reduced it to a symbolic €1,00. It rejected all the other grounds for the appeal and therefore confirmed the original decision on the other grounds.
Verbraucherzentrale NRW e.V., Beratungsstelle Köln
The North Rhine-Westphalia Consumer Center brought an action against Telekom Deutschland GmbH, a German telecommunication company. The legal dispute before the District Court of Cologne concerned several points. First, the Consumer Center questioned the lawfulness of the controller's disclosure of personal financial data to credit ranking agencies, in particular SCHUFA Holding AG and CRIF Bürgel, in the context of the performance of mobile communication contracts. The controller provided these companies with personal data of its costumers in order to check their creditworthiness and prevent fraudolent behaviours. Second, the Comsumer Center doubted that the controller's privacy policy was GDPR compliant. Furthermore, in the opinion of the Consumer Center, the controller did not validly collect consent for the use of cookies on its website but rather relied on dark patterns in the cookie banners, that inevitably misled users. Finally, the transfers of customers' personal data to third countries - including the US - for analysis and marketing purposes violated GDPR. The Consumer Center claimed that when customers visited the controller's website, personal data like IP address and information about browser and device used by the visitor were transmitted to Google LLC. Therefore, the Consumer Center requested the court to order the controller: a) to refrain from transferring personal data to credit agencies, in particular SCHUFA Holding AG and CRIF Bürgel, when carrying out and/or executing mobile communication contracts. b) To refrain from using the privacy policy with regard to existing mobile communication contracts with consumers and from relying on such clauses for any future contracts. c) To bring the cookie banner design in compliance with the GDPR, especially by embedding an easy option not only to consent to cookies, but also to refuse them. d) To refrain from transferring personal data of consumers to third countries for advertising and marketing analysis purposes. The court held that the Consumer Center's request to order the controller not to transfer financial data to credit agencies was unfounded. According to the court, such a request for injunction was too broad. It is true that the disclosure in the past was unlawful, as the controller's legitimate interest to fight fraudolent behaviours could not override the data subjects' fundamental rights. However, a broad prohibition would inevitably affect future processing activities that may be effectively covered by the controller's legitimate interest. Furthermore, the court held that the privacy policy did not violate the GDPR. In its privacy policy the controller simply informed consumers about data transfers to third parties and countries, without any further legal effect. This document did not constitute a legally binding contract offered to customers by the controller, as the Consumer Center suggested. The court also held that the Consumer Center's claim with regard to the cookie banners was unfounded. On the outset, the court highlighted that according to Article 4(11) GDPR, consent shall be freely given, specific to the purposes, informed and unambiguous. At the same time, the court pointed out that the request was too broad and did not reflect the requirements established by the GDPR. According to the court, it was not possible to order the controller to implement a specific design for the cookie banner. With regard to data transfers to the US, the court upheld the Consumer Center's view. The court held that transfer of users' personal data to Google's servers in the US was not in compliance with Articles 44 and following GDPR. The court refered to the CJEU ruling in the Schrems II case, in which the CJEU invalidated the Commission's adequacy decision pursuant to Article 45 GDPR. Moreover, the court highlighted that in the present case it was not possible to rely on standard contractual clauses pursuant to Article 46(2)(c) GDPR either, as these were not able to ensure an adequate level of protection. Finally, the court ruled out the possibility that users' consent via a simple "accept all" button in the cookie banner could be interpreted as data subjects' explicit consent to the transfer of their personal data to third countries. As a matter of fact, the controller did not even mention Google as a recipient of data transfers to the US. Consequently, derogation under Article 49(1)(a) GDPR did not cover the processing at issue. In light of the above, the court held that data transfer to Google's servers in the US was unlawful and ordered the controller to stop the processing.
Data Privacy Stichting
This case concerns a class action filed by the Data Privacy Foundation, an organisations which pursues redress on behalf of victims of privacy intrusions in the Netherlands, against social media company Meta. The complaint filed by the foundation was directed at unlawful personal data processing practices by Meta, through their Facebook service. The three defendants in the lawsuit were three companies of the Meta group (Meta Platforms Inc; Meta Platforms Ireland Limited; and Facebook Netherlands BV). The complaint filed by the Foundation consists of four main issues. Firstly, the claim submitted that Meta infringed their transparency obligations in Articles 5, 12, 13 and 14 GDPR by failing to sufficiently inform users of a number of processing operations. Secondly, the Foundation submitted that Meta processed personal data in lack of a legal basis in violation of Article 6 GDPR. Thirdly, it was claimed that Meta unlawfully processed special categories of personal data (Article 9 GDPR). Fourth, and finally, Meta did not obtain valid consent for the use of cookies, tracking of surfing behavior, and app use outside the Facebook service – for advertising purposes – in violation of the Article 11.7a of the Dutch Telecommunications Act. Each of these issues, and the details of the claims made by the Foundation, will be discussed further below. Issue 1 – Transparency obligations The complaint filed by the Foundation detailed a number of ways through which Meta infringed its transparency obligations under the GDPR. Firstly, the controller did not inform data subjects about the disclosure of personal data to external developers who could process personal data for their own purposes. From 2010, Meta (then called "Facebook") introduced an API (Graph API 1.0) to allow other software developers to link their software to the Facebook service. This API makes it possible to exchange data and communicate between different software systems. Prior to the first use, permission was requested from the Facebook user. Subsequently, after obtaining the consent, data from both the Facebook user and friends of the Facebook user were collected by the third-party developer. The most well-known and used application of this API is the login function of the Facebook service, which is used to register with a third party. In 2015, a new version (Graph API 2.0) was introduced in which access to personal data of Facebook friends is no longer offered, subject to a transition period for developers who used the API before 2015. In principle, a forced migration to the 2.0 version applied after the transition period, but documents showed so-called 'whitelisted developers' could still use the 1.0 version after the transition period and could therefore still process data from Facebook friends. The foundation claimed that, throughout this period Meta did not, or at least did not clearly, inform the data subjects about such access granted to third party developers. Secondly, it was alleged that Meta did not inform the data subjects about the disclosure of personal data to third parties who subsequently disclosed personal data to other parties; in particular, these are the circumstances which led to the notorious Cambridge Analytica scandal. Thirdly, Facebook users had the option to secure their account by means of two-factor authentication, by providing their telephone number and receiving a login code. Facebook was accused of using these telephone numbers to send users personalised advertisements, without informing them in a clear and timely manner. Fourth, and finally, it was submitted that Meta did not provide sufficient information about the sharing of data with third parties as part of the “integration partnership program”. Meta had entered into a collaboration with integration partners in the past, with the aim of giving Facebook users access to the service on different devices, because there were no uniform applications available in the App store and Google Play store at that time. Through collaboration with external developers, an API was introduced to enable the partners to develop applications and functionalities for the Facebook service. Via this API, the partners also gained access to the personal data of the Facebook users and their friends. Issue 2 - Processing of personal data without a valid legal basis With regard to the processing of personal data for advertising purposes, the Foundation noted that Meta did not have a legal basis to carry out this processing. This case concerns processing which took place between 2010 and 2020, as the GDPR did not enter into force until 25 May 2018. A distinction must be made between the lawful basis for processing before and after this date. Before 25 May 2018, the relevant European legislation was the Data Protection Directive, implemented in Dutch domestic law through the Personal Data Protection Act WBP. Meta claimed that, during the former period, it relied on consent, contractual necessity and legitimate interest to process personal data for advertising purposes. After 2018, Facebook Ireland Ltd generally based such processing on contractual necessity (Article 6(1)(b)) and for some specific situations on consent (Article 6(1)(a)). Meta’s argument for using "contractual necessity" as a lawful basis was based on the assertion that the Facebook service is essentially a personalized service, which includes, as a core function, the provision of personalised content and advertisements. Meta also claimed that this was made clear by the Terms of Use. On the contrary, the Foundation argued that the personalisation of advertisements is not the reason why users signed up for the Facebook service. Furthermore, it cannot be argued that the core of the contract between users and Meta is personalized advertising, as it is clearly a social network. Issue 3 – Processing of special categories of personal data The Foundation claims that Facebook Ireland Ltd has violated Article 9 GDPR by processing special categories of personal data for advertising purposes outside the scope of the exemptions provided for in Article 9(2) GDPR. For example, a report of the Dutch DPA stated that in the period from 2012 to 2017, advertisers were offered the opportunity to select interests based on, among other things, "health", "Islam" and "pregnancy". Facebook refuted these accusations by stating that they only analysed the 'likes' of users and kept track of which advertisements the user clicked on. In their view, the categorisation as a result of this analysis did not constitute processing of special categories of personal data. In addition, Facebook stated that the categorisation associated with a particular profile cannot in any way guarantee that this information is correct. For example, someone who likes a page about pregnancy is not necessarily pregnant, so there can only be an indirect connection between the interest and the special personal data. Issue 4 – Cookie tracking and use of location data Finally, the Foundation claimed that Meta used third-party cookies to compile a profile based on users' surfing behavior in order to offer targeted advertisements. According to the Dutch legislation (Art. 11.7a of the Dutch law implementing the e-Privacy Directive), before one wishes to access information or to store information in a user's peripheral equipment, one must (i) clearly and completely inform the data subject; and (ii) obtain the consent of the user. The Foundation argued that Meta did not comply with its information obligations and the requirement to obtain valid consent. In response, Meta cited the Fashion ID judgment of the CJEU to defend the position that it is not obliged to comply with the requirements of Article 11.7a of the Dutch Law if it receives personal data via cookies on third-party websites, and that this obligation is applies to the operator/manager of the third party website. Firstly, regarding the initial issue of whether the foundation has a sufficient interest to bring the claim. Meta had argued that the case should be rejected due to 'absence of sufficient interest' on the part of the Foundation. According to Meta, the Foundation only invokes an alleged loss of control over personal data without making it clear why this could cause legal damage. However, a single infringement of a privacy right does not in itself lead to damage. Addressing this question, the court stated that, in principle, a sufficient interest is to be presumed and the court would be reluctant to rule that a sufficient interest does not exist. Accordingly, the court held that, in light of Article 6:106 of the Dutch Civil Code, if it is plausible that liability exists for damages or that unlawful action has been taken, then the court must assume that the plaintiff has an interest in bringing the claim. As a result, it was found that the Foundation has such a sufficient interest. The court then issued its judgement regarding each of the four issues which are central to this case. The fundamental assumption underlying the court's decision is that Meta, as the entity determining purposes and means of the processing, was the controller. Issue 1 – Transparency obligations With regards to the first claim made by the foundation (failure to inform data subjects of disclosure to third party developers) the court observed that Meta could not delegate or transfer their obligations of transparency to third-party developers. As a matter of fact, Meta installed a pop-up window for the purposes of providing information to data subjects. This pop up window was sufficient in informing data subjects that personal data was being shared with third party developers. However, Meta had not sufficiently informed data subjects as to the purposes of the processing. Furthermore, users were not sufficiently informed, when registering from an account, that external developers would be able to access their personal data when one of their friends downloaded a third party application. With regards to the second question, the court held that the transfer of personal data to Cambridge Analytica was not relevant for the assessment in these proceedings, since Meta had no influence or control in granting Cambridge Analytica access to the personal data. Meta was therefore not a data controller in the context of this processing. As for the third point (use of telephone numbers for personalised advertising) the court held that, as there was no legal basis for the processing of personal data including telephone numbers (see below), the Foundation no longer had an independent interest in a declaratory judgement concerning whether or not Facebook fulfilled its obligation to provide information in this regard. This question was therefore no longer relevant. Concerning the fourth point (insufficient information about the integration partnership program), the court stated first and foremost that granting access to personal data of Facebook users can be regarded as relevant data processing for which Meta was responsible. As a result, the information obligation rested on it as data controller. Moreover, in the absence of any evidence to the contrary, the court concluded that, at the relevant time, Facebook users were not informed at all about this data processing. Issue 2 – Processing of personal data without a valid legal basis Regarding the legal basis for processing (Article 6 GDPR) the court held that Meta could not rely on any of the alternatives it put forward for the processing of personal data for advertising purposes. Addressing the “contractual necessity” argument, the court clarified that in the context of a contractual online service, the specific purpose is decisive. In this regard, in order to prove that the processing is necessary in this way, the controller must demonstrate that the main object of the contract cannot take effect if the specific processing of the personal data does not take place. The court held that the most essential feature of the agreement consists in offering a profile on a social network; and that behavioral advertising is subordinate to this. The core function of the contract was therefore providing a social media service, not advertising, and the processing in question could not be considered necessary for the performance of this contract. In addition, the EDPB guidelines on the provision of online services state as a general rule that the processing of personal data based on browsing behavior is not necessary for the performance of a contract for online services. The court concluded that during the part of the period that the GDPR applied, there was no legal basis for the processing of personal data for advertising purposes. Regarding consent, the court stated that none of the methods used on the Facebook service resulted in a consent validly given. There was not a specific, informed and unambiguous expression of will for processing for advertising purposes and, as a result, Meta could not claim to rely on consent as a legal basis. Furthermore, legitimate interest was also not recognised by the court as a basis for processing personal data for advertising purposes. The court stated that the CJEU still has to decide if legitimate interest is even a legal basis that can be used for advertising purposes. In any case, although the court confirmed that commercial interests on the part of Meta could in principle constitute a legitimate interest, it noted that Meta did not make a concrete balancing test of interests. In addition, Meta's legitimate interest does not pass the necessity test because the sale of advertisements that are not personalized, or are less personalized, would be sufficient to achieve the goal. Also, it cannot be argued that data subjects, as users of a free service such as Facebook, generally expect that their personal data is being processed and their activities are being closely monitored, resulting in a negative assessment in terms of proportionality and subsidiarity. Issue 3 – Processing of special categories of personal data With regards to the processing of special categories of personal data, the court’s assessment was limited to the period that was subject to the investigation by the Dutch DPA – namely between 2012 and 2017. In order to address the question of whether Meta unlawfully processed special categories of data during that period, the court referred to the judgment of the CJEU of 1 August 2022 (OT/Vtec). In this case, the CJEU found that a higher level of protection applies to special categories of personal data. Meta asserted a distinction between special data that users specifically enter into the website; and data that Meta obtains by deducing certain interests from browsing history. Meta claimed it did not use the former for advertisement, and that the latter cannot be considered special category data. The court did not accept Meta’s arguments in this regard. Firstly, the Dutch DPA investigation found that Meta allowed advertisers to show users personalised adverts based on sexual orientation indicated in their profiles. Secondly, in terms of browsing habits, the court found that this data is cable of revealing special category personal data, in accordance with the high level of protection afforded to such information. Furthermore, the court also referred to the EDPB guidelines on targeting social media users. The classification of users on the basis of religion, philosophical belief or political opinion is considered processing of special categories of personal data, regardless of the accuracy of the classification. In light of all of the above, the court found that Meta unlawfully processed special category personal data, in violation of Article of the Dutch law implementing the Data Protection Directive and Article 9 GDPR. Issue 4 – Cookie Tracking and Use of Location Data With regard to the use of cookies, the court addressed Meta’s argument that the obligation to inform users and obtain consent was not theirs, but it concerned rather the operator of the third party website. The court held that the obligations rest with the legal person responsible for placing data in the peripheral equipment and obtaining access to the information stored in the peripheral equipment. Meta is also responsible in the case of third party cookies. However, it can delegate this to the website administrator via agreement. Therefore, in view of insufficient evidence to the contrary, it could not be established that Meta violated Article 11.7a of the Dutch law implementing the e-Privacy Directive. However, this does not alter the fact that Meta did not have a valid legal basis to process personal data via cookies for advertising purposes (see above). With regard to the location data, the court ruled that, insofar as this data is part of the data of which the processing has not been sufficiently communicated or for which no legal basis has been demonstrated (see above), the above judgments also apply to this data. Summary Overall, the court held that Meta had violated Articles 5(1)(a) and 6(1) GDPR by processing personal data for advertisement without a legal basis. Meta also violated Article 9(1) GDPR by unlawfully processing special category data for advertisement. Finally, Meta violated its transparency obligations in accordance with Article 13 GDPR. In addition, the controller was ordered to pay the costs of the proceedings. It has to be stressed that the decision adopted by the court is just a declaratory judgement, which means that the questions concerning the existence and the amount of damages and the related right to compensation remained open.
SA Rossel et Cie
This ruling is the result by an appeal of Rossel & Cie, a large media company (controller), which was fined €50.000 by the Belgian DPA after an investigation on their cookies practices (see [https://www.gegevensbeschermingsautoriteit.be/publications/arrest-van-22-februari-2023-van-het-marktenhof-ar-953-beschikbaar-in-het-frans.pdf here] for the DPA decision and here for the GDPRhub summary). The Belgian law empowers the board management of the DPA to issue a referral in order to open an ex officio investigation (Article 63(1) of the Law establishing the Belgian DPA). This referral needs to indicate that there are "serious indications of a practice that could give rise to an infringement of the fundamental principles of personal data protection. In this case, the board management issued a referral on 16 January 2019 without mentioning any reference to serious indications of potential infringements, or any evidence for that matter. The investigation was however considered open on that date. On 7 March 2019, an handwritten note was drawn up by the investigation service (so, not by the management board (!)) containing several reasons for starting the investigation, among others the high amount of visitors of the controller's websites. On 16 June 2022, the DPA issued decision 103/2022, fining the controller for several GDPR related violations. The controller appealed this decision at the Market Court in Brussels, stating that the DPA's board management referral did not indicate the reasons to investigate. It was thus irregular, and implied that the investigation service was irregularly seized. As a result, the DPA decision was also invalid. The court confirmed that the management board had issued the referral to investigate the controller on 16 January 2019. The referral constituted the only administrative act leading up to decision 103/2022. The internal note of the investigation service of 7 March 2019 could not be considered as (a part of) the referral, and was therefore not an administrative act. The court then assessed if the referral was compliant with the requirement of motivation of administrative acts. Specifically, this motivation requirement would obligate the DPA to properly explain the presence of serious evidence, pursuant to Article 63(1) LCA. The court concluded that the referral itself did in contain any specific arguments for the existence of serious evidence. The court stated that this irregularity of the referral led to the irregularity of decision 103/2022. It therefore annulled the DPA decision and ordered the DPA to pay the costs of the proceedings.
Enel Energia
After receiving several complaints, at different times, about unwanted promotional phone calls from ENEL Energia (the controller), one of Italy's most important energy providers, the DPA initiated its investigation. At the end of 2018 and the beginning of 2019, the DPA made two requests for information to the controller. It then submitted a third request on 17 December 2019, which went unanswered. The DPA followed up with a fourth request on 10 July 2020, which the controller replied to on 14 January 2021. Then, on 14 May 2021, the DPA notified the controller of the initiation of the sanctioning procedure. On 16 December 2021, the Italian DPA fined the controller €26,513,977 with its [https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_9735672 decision of 9735672]. The controller appealed the decision to the Tribunale ordinario di Roma (Court) arguing that the Italian DPA failed to comply with the 120-day deadline for notification of the beginning of the sanctioning procedure, which the DPA should have complied with. To begin with, the Court noted that the Italian DPA had issued [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9107640 Regulation No 2/2019] concerning the identification of terms and organisational units responsible for the administrative procedures. In accordance with [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29.pdf/b1787d6b-6bce-07da-a38f-3742e3888c1d?version=7.0 Article 166(5) of the Italian Privacy Code], the Regulation gives the DPA a time limit of 120 days from the establishment of the violation to notify the controller of the beginning of the sanctioning procedure. Subsequently, the Court addressed the DPA’s claim that the 120-day time limit was not mandatory. The Court stated that the time limit must be regarded as peremptory under [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:1990-08-07;241!vig= Article 2 comma 5 of the L. 241/1990], as this is an indispensable prerequisite to respect the fundamental principles of the legal system. The Court indeed noted that the word "deadline" indicates a moment by which a certain act must be performed and that knowing the deadlines by when the DPA should have started and concluded the proceedings is a requirement for the right of defence, legal certainty and, ultimately, the rule of law. Regarding whether the DPA took longer than the established deadline, the Court had to assess from which day the 120-day deadline started. Thus, the Court found that the relevant day from which the 120-day period begins is when the DPA last received a response to its information request or, in case of silence, by the expiration of the deadline assigned to the controller to reply. In the present instance, the Court noted that the DPA’s notification of the infringement procedure to the controller on 14 May 2021 had come after the expiration of the 120 days, namely after the controller could legitimately consider that its conduct had not given rise to a sanctioning procedure. Indeed, after the controller did not reply to the third information request of 17 December 2019, the DPA reiterated the request only with the fourth information request on 10 July 2020, almost seven months later. Moreover, after the controller's reply, the DPA requested further clarification more than five months later, on 14 December 2020. All follow-ups then did not comply with the 120-day deadline. Not to mention that the first two requests by the DPA were sent in 2018 and 2019, one to two years before the notification. Therefore, the Court found that the DPA’s notification of the sanctioning procedure was delayed and that the contested measure should therefore be annulled.
Court case 10 O 14/21
The controller operates several websites. The data subject stated that, as a consumer, he ordered household goods from the controller's online shop in 2020, giving his name and address. According to the data subject, the controller violated data protection law in several ways. He stated that the controller had deliberately integrated malware into its site, which manipulated the data subject's internet browser. Thereby, personal data had been unlawfully processed by the controller itself, as well as being irrevocably forwarded to foreign third party companies in order to track his online behaviour by setting cookies without his consent. Due to the alleged violations, the data subject claimed to be entitled to injunctive relief for infringement of Article 6(1) GDPR. Furthermore, he argued the infringement of Article 26 GDPR (joint responsibility) and Article 44 GDPR (third country transfer). The controller argued that the data subject had not sufficiently substantiated his claim since he had neither specified the processing of his data that allegedly took place nor described it accurately. Moreover, according to the controller, there is no basis for a claim because the GDPR does not provide for injunctive relief under civil law. The Regional Court Wiesbaden found the data subject's action both inadmissible and unfounded. First, the court stated that the data subject's claim was not sufficiently specific as it did not specify what exact behaviour he wanted to prevent with the injunction. Then, the court added that the lack of specification of the exact data processing activity also made the claim unfounded as the data subject had not even given information on what and when he ordered in what specific online shop of the controller. To the court it was clear that the data subject was not concerned with being affected in a specific case where he saw his personal rights violated, but rather a fundamental abstract clarification. There had been no pre-judicial correspondence in the case at hand, which would have been required in order for the controller to be able to defend itself. Finally, the court agreed with the controller that the GDPR does not provide for injunctive relief under civil law. According to the court, there was no basis for the claim under Article 6 GDPR and Article 44 GDPR. It held that for a civil law claim, it is in not sufficient that there are regulations in the sense of permission or prohibition norms, but that there must be a norm that formulates a subjective claim for the individual and can thus be used as a basis for asserting a claim. Article 17 GDPR, which would give the data subject individual rights, was not applicable as it did not match the data subject's objective. While § 1004 BGB generally allows for injunctive relief, the court did not see any room for application because the cases for claims under the GDPR are exhaustive.
VD
EU law restricts the ability of Member States to implement broad data retention requirements and access regimes as part of combating market abuse, and requires national courts to exclude improperly obtained evidence in accordance with EU law principles. On 22 May 2014, a judicial investigation was initiated into VD and SR for insider dealing and related offenses. On 23 and 25 September 2015, the Autorité des marchés financiers (the French Financial Markets Authority (hereinafter AMF)) provided the investigating judge with personal data from telephone calls made by VD and SR. The AMF had collected such data under French law, namely Article L. 34-1 CPCE. VD and SR challenged the use of this telephone data, on the grounds that it infringed Article 15(1) e-Privacy Directive. On 20 December 2018 and 07 March 2019, the French courts rejected the claims brought by the parties, relying on Article 23(2) Regulation No. 596/2015 relating to market abuse, which allows competent authorities to access such data where there is suspicion of insider dealing. The Court firstly noted that the wording of the provisions in the Regulation only refer to the authority's power to "require existing" data records, suggesting that the EU legislature did not intend to mandate data retention obligations. The Court also held that the context and objectives of the legislation support the interpretation that it only governs access to existing data, not an obligation to retain data generally and indiscriminately. The Court concluded that a broad interpretation that would allow mandating data retention would deprive the clear wording of the provisions of effectiveness, which the Court cannot do according to its settled case law. The purpose of the EU legislation on insider trading — namely, Directive 2003/6 and Regulation No 596/2014 — is to protect the integrity of EU financial markets and enhance investor confidence by preventing the improper use of inside information. However, the EU legislation does not provide a legal basis for imposing a general obligation on electronic communications service providers to retain traffic and location data for the purposes of investigating market abuse offenses. Directive 2002/58 governs the processing of personal data in the electronic communications sector, including the retention of traffic data records. Provisions of national law requiring the general and indiscriminate retention of traffic and location data for the purpose of combating market abuse offenses must therefore be assessed in light of Article 15(1) of Directive 2002/58, read in conjunction with the relevant provisions of the Charter of Fundamental Rights. The AMF investigators collected traffic data based on an exception in French law that allowed for the retention of certain types of data for 1 year to investigate, detect, and prosecute criminal offences. The data that could be retained included information identifying the user, data on the communications terminal equipment, technical characteristics and details of each communication, data on additional services used, and data identifying the parties to the communication. This data, while not including the content of communications, could allow very detailed profiles to be created about individuals' private lives and activities. The purpose of the data retention was for investigating, detecting and prosecuting criminal offences, including market abuse offenses like insider trading. However, the Court of Justice of the EU (hereinafter CJEU) has ruled that such general and indiscriminate data retention, even for such purposes, is not justified under EU law and exceeds what is strictly necessary. Therefore, the Court concluded that Article 12(2) Directive 2003/6 and Article 23(2) Regulation No. 596/2014, read in conjunction with Article 15(1) Directive 2002/58, preclude national legislation that requires the general and indiscriminate retention of traffic data for one year as a preventive measure to combat market abuse offenses. Secondly, the Court emphasised that the principle of primacy of EU law requires national courts to give full effect to EU law provisions, which extends to refusing to apply conflicting national legislation. The CJEU can exceptionally allow temporary suspension of the effect of an EU law rule on national law. However, this is a prerogative of the Court when interpreting EU law. Unlike breaches of procedural obligations, a failure to comply with Article 15(1) of Directive 2002/58 (on data retention) cannot be remedied by allowing temporary maintenance of the national legislation. This means that the domestic law continuously imposed obligations contrary to EU law, thereby interfering with fundamental rights. The referring national court cannot restrict the temporal effects of a declaration of invalidity of the national data retention legislation that it is bound to make under national law. The Court did not impose any temporal restriction on the effects of its previous rulings on data retention, so it did not do so in the present case either. The Court emphasized the importance of determining the effect of finding the national data retention provisions incompatible with EU law on the admissibility of evidence obtained from the retained data in the main proceedings, in accordance with the principles of equivalence and effectiveness. Thus, EU law precludes national courts from restricting the temporal effects of a declaration that national laws requiring the general and indiscriminate retention of traffic data, and allowing access to that data without prior judicial or independent authorization, as this is incompatible with Article 15(1) of the E-Privacy Directive and the Charter of Fundamental Rights. The admissibility of evidence obtained under such incompatible national laws is a matter for national law, subject to the principles of equivalence and effectiveness.