Authority: Hellenic Data Protection Authority (Greece)

Decision date: 24 June 2026

Cited provisions: Art. 5(1)(a) GDPR, Art. 6(1)(c) GDPR, Art. 17(1)(d) GDPR

The complainant, an electrical engineer, submitted a complaint to the Hellenic DPA on 26-03-2024 after the Decentralized Administration of the Aegean refused her requests to remove her name from eleven administrative decisions published on the Diavgeia portal (open-government platform that publishes official public sector decisions and expenditures online). These decisions concerned the rejection of applications submitted by third parties for drilling and water-use permits, where the complainant acted as an authorized representative or engineer. According to the complaint: -The published decisions explicitly identified the complainant by name and referred to her role as the authorized representative of the applicants. -The decisions stated that requested supporting documents had not been submitted and that no response had been received from the authorized representative or the applicants within the prescribed deadlines. -The complainant argued that she had never consented to the publication of her personal data and that the wording of the decisions created the false impression that the permit applications were rejected because of her professional inadequacy, thereby harming her professional reputation. -On 24-05-2023 and through subsequent requests, she exercised her right to erasure and requested the removal of her name from the published decisions. The Administration rejected those requests, maintaining that publication was legally required by the legislation governing Diavgeia and that the GDPR right to erasure did not apply. During the DPA proceedings, the Administration argued that the publication served the objective of public-sector transparency and that the complainant's name was necessary for adequately explaining the reasons for rejecting the permit applications. The Hellenic DPA held that the publication of the complainant's personal data in the eleven decisions was unlawful. According to Article 76(3)(k) of Law 4727/2020, only individual administrative acts whose publication is expressly required by a specific legal provision may be uploaded to Diavgeia. The Administration relied on Article 4(10) of Joint Ministerial Decision 146896/2014, which requires publication of decisions granting water-use and water-resource permits. However, the Authority found that this provision applies only to granted permits and not to decisions refusing permit applications. Therefore, the eleven rejection decisions were not legally required to be published on Diavgeia. As a result, the Administration could not rely on Article 6(1)(c) GDPR (processing necessary for compliance with a legal obligation), and the publication lacked a valid legal basis. The Authority therefore found a violation of the principle of lawfulness under Article 5(1)(a) GDPR and Article 6(1)(c) GDPR. The DPA further held that the Administration unlawfully refused the complainant's erasure requests. Since the processing itself was unlawful and the Administration failed to demonstrate any exception under Article 17(3) GDPR, it should have removed the complainant's name from the decisions or otherwise anonymized the information. Its failure to do so constituted a violation of Article 17(1)(d) GDPR. Consequently, the Hellenic DPA: -Imposed a €2,000 administrative fine on the Decentralized Administration of the Aegean for violating Articles 5(1)(a) and 6(1)(c) GDPR; -Issued a reprimand for violating Article 17(1)(d) GDPR; -Ordered the Administration to immediately remove the eleven decisions from Diavgeia and report compliance to the Authority within 20 days.

Decision date: 18 December 2025

Cited provisions: Art. 5(1)(a) GDPR, Art. 5(1)(c) GDPR, Art. 6(1)(f) GDPR, Art. 13 GDPR, Art. 14 GDPR

= AB Storstockholms Lokaltrafik (the controller) is the public transport authority for the Stockholm area and operates public transport services. The controller equipped its ticket inspectors with body cameras. The cameras are used to prevent and document threats and violence against inspectors and to verify the identity of passengers who do not have a ticket and need to pay a fine. The cameras had a “circular memory” and automatically erased footage after a certain amount of time; however, ticket inspectors could press a button to preserve the footage. The DPA investigated the controller’s use of body cameras. In 2021 it concluded that the controller operated the cameras in violation of Article 6(1)(f), 5(1)(a)(c), and 13 the GDPR. In particular, the DPA held that the controller violated Article 13 GDPR by failing to inform the passengers (the data subjects) that they were being recorded. On these grounds the DPA issued a fine for a total SEK 16,000,000 (€1,422,000). Out of the total, SEK 4,000,000 (€ 355,500) related specifically to the violation of Article 13. The controller challenged the decision with the Administrative Court of Stockholm. The Court dismissed the action in so far as it concerned the breach of Article 13. The controller further challenged the decision with the Administrative Court of Appeal of Stockholm. Contrary to the DPA and the first instance court, the Court of Appeal held that in the case at hand, Article 14 applied instead of Article 13. On this basis, the Court annulled the DPA’s fine with regards to the SEK 4,000,000 that related to the violation of Article 13. The DPA challenged the Court of Appeal’s decision before the Supreme Administrative Court and claimed that Article 13 GDPR was the applicable provision and the correct ground for fining the controller. The Supreme Administrative Court then referred case to the CJEU for a preliminary ruling. = The Supreme Administrative Court referred the following question to the CJEU: “which of Articles 13 and 14 of the GDPR applies where personal data are obtained by a body camera?”. The controller and the DPA put forward different interpretations: * Under the DPA’s interpretation, Article 14 applies whenever the data subject is not the source of the data, regardless of its involvement in the collection of the data. This interpretation was in line with EDPB guidance and the case laws of DPAs; * Under the controller’s interpretation, Article 14 applies when the data subject does not actively take part in the collection of their data through a deliberate action (for instance, by filling out a form). Articles 13 and 14 both regulate the controller’s duty to provide information about the processing of personal data but differ in several ways, including the applicable exemptions and the time at which the information must be provided. In the case at hand, the difference mattered because the controller argued for the exemption found under Article 14(5)(b): “paragraphs 1 to 4 shall not apply where and insofar as (…) the provision of such information proves impossible or would involve a disproportionate effort”. On 1 August 2025 the AG delivered its Opinion on the case. Based on CJEU case law, the AG clarified that Articles 13 and 14 are mutually exclusive and that the scope of Article 14 is defined negatively by reference to Article 13 of the GDPR. In other words, Article 14 covers any processing of personal data that is not covered by Article 13. The AG held that Article 13 applies whenever the data subject is the source of the data (“collected from the data subject”), regardless of the data subject’s involvement in the collection of the data. In other words, for Article 13 to apply, “there should be no intermediary between the data subject and the controller"Margin 30.. It follows that Article 14 applies whenever the data are collected from a source other than the data subject. In this regard, the AG also pointed to the wording of Article 14(2)(f) GDPR and Recital 62 GDPR, as both support this interpretation. Finally, the AG clarified that the view that Article 13 applies to data collection by means of a body camera, is in line with the general principle of transparency. Unlike Article 14, Article 13 requires the controller to provide information immediately. This allows data subjects to adapt their behavior or even to refrain from entering the area under surveillance. For these reasons, the AG held that the case at hand fell under Article 13 GDPR. TBD

Decision date: 24 February 2022

Cited provisions: Art. 4(1) GDPR, Art. 4(2) GDPR, Art. 5(1) GDPR, Art. 23 GDPR

SIA ‘SS’ (‘the applicant’) is a company specialized in online advertising services in Latvia. Private individuals may post and advertise various products on the applicant's website (www.ss.com) with a view of selling them. These products may include vehicles such as second-hand cars or motorbikes. On 28 August 2018, the Director of the Latvian Tax Inspection Office (‘the defendant’) sent to the applicant a request for information on the basis of Article 15(6) of the national law on taxes and duties. In that request, the defendant asked the applicant to grant them access to information, and in particular to provide information on: a) the telephone numbers of advertisers; b) the chassis numbers of vehicles featured in advertisements published on the applicant’s website; and c) information on advertisements published in the ‘Motor Vehicles’ section of the website from 14 July to 31 August 2018. The applicant was asked to send the information electronically, in a format that would allow the data to be filtered and selected. The applicant was also asked to include the following information in the data file: a link to the advertisement; the advertisement text; make of vehicle; model; chassis number; price; and the vendor’s telephone numbers. The applicant lodged an administrative complaint challenging the request for information. According to the applicant, the requested information constituted personal data within the meaning of Article 4(1) GDPR and its disclosure was not justified by the law. The applicant argued, in particular, that the defendant, in its capacity as controller, did not comply with the principle of proportionality or the principle of minimisation enshrined in Article 5(1) GDPR. The defendant dismissed the applicant's complaint and upheld the request for information. The dispute escalated before the national courts. In this context, the referring court referred the following questions to the CJEU: 1. Must the requirements laid down in the General Data Protection Regulation be interpreted as meaning that a request for information issued by a tax authority, such as the request at issue in this case, which seeks the disclosure of information containing a considerable amount of personal data, must comply with the requirements laid down in the General Data Protection Regulation (in particular Article 5(1) thereof)? 2. Must the requirements laid down in the General Data Protection Regulation be interpreted as meaning that the Tax Administration may depart from the provisions of Article 5(1) of that regulation even though the legislation in force in the Republic of Latvia does not empower it to do so? 3. For the purposes of interpreting the requirements laid down in the General Data Protection Regulation, can there be considered to be a legitimate objective justifying the obligation, imposed by a request for information such as that at issue in this case, to provide all of the data requested in an undefined amount and for an undefined period of time, in the case where there is no prescribed expiry date for the fulfilment of that request for information? 4. For the purposes of interpreting the requirements laid down in the General Data Protection Regulation, can there be considered to be a legitimate objective justifying the obligation, imposed by a request for information such as that at issue in this case, to provide all of the data requested even if the request for information does not (or does not fully) specify the purpose of disclosing that information? 5. For the purposes of interpreting the requirements laid down in the General Data Protection Regulation, can there be considered to be a legitimate objective justifying the obligation, imposed by a request for information such as that at issue in this case, to provide all of the data requested even if that request relates in practice to absolutely all data subjects who have published advertisements in the ‘Motor Vehicles’ section of a portal? 6. What criteria must be used to verify that a tax authority, acting as controller, is duly ensuring that the processing of data (including the collection of information) is compliant with the requirements laid down in the General Data Protection Regulation? 7. What criteria must be used to verify that a request for information such as that at issue in this case is duly reasoned and occasional? 8. What criteria must be used to verify that personal data are being processed to the extent necessary and in a manner compatible with the requirements laid down in the General Data Protection Regulation? 9. What criteria must be used to verify that a tax authority, acting as controller, ensures that data are processed in accordance with the requirements laid down in Article 5(1) of the General Data Protection Regulation (accountability)? On 2 September 2021, AG Bobek rendered his opinion in this case. With regard to the first question, the CJEU analyzed whether the provisions of the GDPR should be interpreted in the sense that the collection of information containing a significant amount of personal data by the Tax Authority of a Member State is subject to the requirements set forth in this regulation, especially those provisions provided for in Article 5(1). First, it acknowledged that the information requested by the Tax Authority constitutes personal data under Article 4(1) GDPR. Similarly, it recognized that the collection, consultation, disclosure by transmission or any other way of making personal data available constitute 'processing' within the meaning of Article 4(2) GDPR. In the present case, the CJEU highlighted that the Tax Authority requested an economic operator to communicate and make available personal data that the latter is obliged to provide and make available under the terms of national legislation. At the same time, according to the CJEU, the communication and making available of said data by the economic operator in question involves 'processing'. Second, the CJEU rejected the application of the exception provided for in Article 2(2) GDPR, considering that, when requesting personal data for tax collection or the fight against tax fraud, the Tax Authority should not be considered a 'competent authority' within the meaning of Article 3(7) Directive 2016/680. Therefore, such requests do not fall under the exception provided for in Article 2(2)(d) GDPR, as this data is not collected for the specific purpose of initiating criminal proceedings. Thus, it concluded that the activity is subject to compliance with the principles relating to the processing of personal data set out in the GDPR, notably those of Article 5 GDPR. As for the second question, the CJEU assessed whether the provisions of the GDPR should be interpreted in the sense that the Tax Authority can derogate the provisions of Article 5(1) even if such power has not been conferred on it by the national law of the relevant Member State. As a preliminary point, the CJEU emphasized that the GDPR aims to ensure a high level of protection for natural persons in the Union. For this purpose, chapters II and III set out, respectively, the principles governing the processing of personal data and the rights of the data subject that any processing of personal data must respect. The Court recognized that Article 23 GDPR authorizes the Union and the Member States to adopt legislative measures that limit the scope of the obligations and rights provided for by Article 5. However, such a limitation must respect the essence of fundamental freedoms and rights and constitute a necessary and proportionate measure in a democratic society to safeguard important objectives of general public interest of the Union or of the Member State concerned, including in the budgetary and fiscal fields. In this regard, the CJEU also stated that the regulations that allow such interference must provide for clear and precise rules that regulate the scope and application of the measure in question and impose minimum requirements, so that the persons whose data have been transferred have sufficient safeguards to effectively protect such personal data against the risk of abuse. Consequently, the Tax Authority of a Member State cannot derogate from the provisions of Article 5 GDPR in the absence of a clear and precise legal basis in Union or national law that provides for the circumstances and conditions under which the right to data protection may be limited. It therefore concluded that the Tax Authority of a Member State cannot derogate from the provisions of article 5(1) GDPR when that right has not been conferred on it by a legislative measure, within the meaning of article 23(1) GDPR. As for the third to ninth questions, the CJEU assessed whether the provisions of the GDPR should be interpreted in the sense that the Tax Authority of a Member State is prohibited from requiring the provision of this information in a generic way, regarding all personal data, without specify the purpose of the request. The CJEU recalled that article 5(1)(b) GDPR provides that personal data must be collected for specific, explicit and legitimate purposes. Such a requirement, as follows from Recital 39 GDPR, means that the purposes must be identified, at the latest, at the time of collection of personal data. In the present case, the CJEU noted that the communication of personal data is not directly based on the national tax law, but results from a request from the competent public authority. Therefore, it is necessary for that request to specify the purposes of that collection in the light of the public interest or the exercise of public authority. This is necessary to enable the addressee of said request to verify that the transmission is lawful and also to enable the courts to carry out legality control. In addition, it recalled that Article 5(1)(c) GDPR establishes that personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Thus, the controller, even when acting as a public authority, cannot proceed in a generalized and undifferentiated manner to the collection of personal data. On the contrary, they must refrain from collecting data that are not strictly necessary for the purpose of the processing activity. Therefore, it is for the Latvian Tax Authority to demonstrate that, in accordance with Article 25(2) GDPR, it has sought to minimize as much as possible the amount of personal data to be collected. For these reasons, the CJEU finally concluded that tax authorities of a Member State may request information containing personal data, provided that such data are necessary in light of the specific purposes for which they are collected and the period of collection of said data does not exceed the duration strictly necessary to achieve the general interest intended.

Decision date: 22 June 2023

Cited provisions: Art. 15(1) GDPR, Art. 4(1) GDPR

J.M. (the data subject), a former employee and a customer of a bank in Finland (the controller), had learned that his customer data had been accessed by members of the bank’s staff on several occasions in 2013. The data subject had doubts of the lawfulness of those consultations. In May 2018, the data subject - who had in the meantime been dismissed from his post within the bank - made an access request asking the controller to inform him of i.) the identity of the persons who had consulted his customer data, ii.) the exact dates and iii.) the purposes of those consultations. The controller refused to disclose the identity of the employees who had carried out the consultation operations, on the ground that such information constituted the personal data of those employees. There was a suspicion of a conflict of interests in relation to the data subject which the controller said required processing of the data in question. The data subject then applied to the Finnish DPA for an order that the controller should provide him with the information requested. The Finnish DPA sided with the controller and considered that such log data constituted personal data relating to the employees who processed the data and rejected the application. Thereafter, the data subject brought an action against that decision before the Administrative Court of Eastern Finland. The Court referred to the CJEU for a preliminary ruling asking, essentially whether the log data generated during processing operations, in particular the identity of the controller’s employees, is covered by Article 15 GDPR since those log data might prove necessary to a data subject to assess the lawfulness of the processing of his or her data. Firstly, the CJEU found that a data subject has the right under Article 15(1) GDPR to obtain information from the controller relating to consultation operations carried out on the data subject’s personal data and information concerning the dates as well as purposes of those consulting operations. Secondly, the CJEU held that the employees of the controller cannot be regarded as being ‘recipients’, within the meaning of Article 15(1)(c) GDPR when they process personal data under the authority of that controller in accordance with its instructions. However, even though employees are not regarded as recipients, it was noted that by the CJEU that information relating to the persons who have consulted the data subject’s personal data that are contained in the log data may constitute personal data under Article 4(1) GDPR of the data subject, that enables the data subject to verify the lawfulness of the processing of his or her data and in particular to satisfy him or herself that the processing operations were actually carried out under the authority of the controller and in accordance with its instructions. After stating the above, the CJEU, furthermore recalled that the right of access should not adversely affect the rights or freedoms of others. Even if the disclosure of the identity of the controller’s employees to the data subject may be necessary for that data subject in order to ensure the lawfulness of the processing, it is nevertheless liable to infringe the rights and freedoms of those employees. In the event of a conflict between, on the one hand, i.) the exercise of an access right and, on the other hand, ii.) the rights or freedoms of others, a balance will have to be struck between the rights and freedoms in question. Consequently, the CJEU found that Article 15(1) GDPR does not lay down a right to the data subject to obtain the identities of the employees who carried out the consultation operations under the controller's authority and in accordance with its instructions, unless that information is essential in order to enable the data subject effectively to exercise the rights under the GDPR and provided that the rights and freedoms of those employees are taken into account.

Decision date: 2 March 2023

Cited provisions: Art. 5(1)(b) GDPR, Art. 6(1)(e) GDPR, Art. 6(3) GDPR, Art. 6(4) GDPR, Art. 23(1) GDPR

The company Fastec was contracted by the company Nycander for the construction of an office building. During the project, workers who carried out activities at the construction site registered their presence through an electronic records system. After completion of the work, Fastec filed a lawsuit with the Swedish Court of First Instance to collect a debt related to the services provided, including the hours worked by its staff. In response, Nycander claimed that the number of hours worked was lower than that presented by Fastec and requested the presentation of the electronic records as evidence. Fastec opposed this request, on the grounds that the disclosure of the records would violate the provisions of article 5(1)(b) GDPR, as personal data were collected from the staff members for the purpose of complying with legal tax obligations. The Court of First Instance granted Nycander's request and ordered the presentation of the unedited records for the period in which the work was carried out. In the second instance, this decision was confirmed. Dissatisfied, Fastec filed an appeal with the Supreme Court of Sweden and asked for the decision to be reversed. The Supreme Court then decided to stay the proceedings and refer the following preliminary questions to the CJEU: 1. Does Article 6(3) and (4) of the GDPR also impose a requirement on national procedural legislation relating to [the obligation to produce documents]? 2. If Question 1 is answered in the affirmative, does the GDPR mean that regard must also be had to the interests of the data subjects when a decision on [production] must be made which involves the processing of personal data? In such circumstances, does EU law establish any requirements concerning how, in detail, that decision should be made?' To answer the first question, the CJEU assessed whether personal data collected for the fulfillment of a legal tax obligation could be used for a different purpose, that is, for the production of evidence in legal proceedings. First, it noted that, according to Article 6(1)(e) GDPR, the processing of personal data is lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. It recalled that, in accordance with Article 6(3) GDPR, read in combination with Recital 45 thereof, this task must be defined by EU law or by Member State law to which the controller is subject. From the combination of the two articles, the CJEU held that the tasks performed by courts acting in their judicial capacity fall under this notion. Then, it pointed out that, where the processing of personal data is carried out for a purpose other than that for which those data have been collected, it follows from Article 6(4) GDPR, read in the light of Recital 50 thereof, that such processing is allowed provided that it is based, inter alia, on Member State law and that it constitutes a necessary and proportionate measure in a democratic society to safeguard one of the objectives referred to in Article 23(1) GDPR. In such cases, the controller is allowed to further process personal data irrespective of the compatibility of that processing with the purposes for which the personal data were initially collected. In the present case, the CJEU found that the legal basis for the use of personal data as evidence in a judicial proceeding is provided for by the national procedural law, while the legal basis for collection of such data by the employer is provided for by the national tax law. The first is intended to enable citizens to exercise their rights through access to evidence; the second is intended to enable tax authorities to exercise their inspection powers. Considering that these are different purposes, but both defined by law, the CJEU held it necessary to analyze not the compatibility between them, but the necessity and proportionality of the measure under Article 6(4) GDPR, in accordance with the objectives referred to in Article 23(1) GDPR. It recalled that these objectives include the protection of judicial independence and judicial proceedings, which encompasses the protection of the the proper administration of justice. Moreover, according to Article 23(1)(j), the enforcement of civil law claims also constitutes an objective which may justify further processing of personal data. In the light of all the foregoing considerations, the CJEU found that Article 6(3) and (4) GDPR must be interpreted as meaning that that provision applies, in the context of civil court proceedings, to the production as evidence of a staff register containing personal data of third parties collected principally for the purposes of tax inspection. Regarding the second question, the CJE assesed whether a judge must consider the interests of data subjects when issuing an order for the production of evidence. The CJEU stressed that, although the national procedural law does not stipulate this obligation for judges, any activity involving the processing of personal data must comply with the principles of Article 5 GDPR and be supported by one of the legal basis provided for in Article 6 GDPR. Thus, when information is simultaneously considered as personal data and potential evidence in a judicial process, the judge must carry out a weighing exercise before determining the production of evidence. According to the CJEU, this exercise must take into account the interests in conflict on a case-by-case basis. Although the right to data protection is considered fundamental, it is not an absolute right. Therefore, there is a need to make it compatible with other fundamental rights, such as the right to effective judicial protection. According to the settled case-law of the European Court of Human Rights, an individual have the right to present his or her case effectively before the court and enjoy equality of arms with the opposing side. It follows, inter alia, that an individual must have the benefit of adversarial proceedings and be able to submit, at various stages of those proceedings, the arguments he or she considers relevant to his or her case. For this reason, the CJEU held that the parties to civil court proceedings must be in a position to access the evidence necessary to establish to the requisite standard the merits of their complaints, which may possibly include personal data of the parties or of third parties. Also, it stated that the national Court must analyze whether data disclosure constitutes a measure that is proportional and necessary for the objective in question, in order to guarantee the minimisation of data imposed by Article 5(1)(c). In the event that the production of a document containing personal data proves to be justified, it also follows from that principle that wthe national court must consider determining the implementation of additional data protection measures, such as the pseudonymisation of the names of the data subjects or any other measure intended to minimise the interference with the right to the protection of personal data. Such measures may include limiting public access to the file or an order addressed to the parties to whom the documents containing personal data have been disclosed not to use those data for a purpose other than the taking of evidence during the court proceedings at issue. In the light of all the foregoing considerations, the CJEU found that Articles 5 and 6 of the GDPR must be interpreted as meaning that, when assessing whether the production of a document containing personal data must be ordered, the national court is required to have regard to the interests of the data subjects concerned and to balance them according to the circumstances of each case, the type of proceeding at issue and duly taking into account the requirements arising from the principle of proportionality as well as, in particular, those resulting from the principle of data minimisation referred to in Article 5(1)(c) of that regulation.

Decision date: 21 March 2024

Cited provisions: Art. 35 GDPR

Facts pending decision. Question referred: Does the obligation to take fingerprints and store them in identity cards in accordance with Article 3(5) Regulation (EU) 2019/1157 of the European Parliament and of the Council of 20 June 2019 on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement (OJ 2019 L 188, p. 67) infringe higher-ranking EU law, in particular (a) Article 77(3) TFEU (b) Article 7 CFR and Article 8 CFR (c) Article 35(10) GDPR and is it therefore invalid on one of those grounds?

Decision date: 17 November 2022

In the context of criminal proceedings in Bulgaria, the prosecutor requested the Spetsializiran nakazatelen sad (Bulgarian Criminal Court) to give him access to data, including location data, concerning the telephone calls of five persons involved in a serious crime case. The case file showed that the telephone numbers were potentially used to commit the crime. Under Bulgarian national law, the retention of traffic and location data is limited to six months. Access to these data is only allowed for investigative purposes in serious offences, but the national law does not include a provision that restricts access to what is strictly necessary for the purpose. The Criminal Court therefore referred the following question to the CJEU. (1) Is national legislation (Article 251b(1) of the Zakon za elektronnite saobshtenia (Law on electronic communications)) providing for the general and indiscriminate retention of all traffic data (traffic data and location data of users of electronic means of communication) for a period of 6 months in order to fight serious crime compatible with Article 15(1) of Directive 2002/58, read in combination with Article 5(1) and recital 11 thereof, provided that the national legislation contains certain safeguards? (2) Is national legislation (Article 159a of the Nakazatelno-protsesualen kodeks (Code of Criminal Procedure)) which does not limit access to traffic data to what is strictly necessary and does not grant the persons whose traffic data are accessed by the law enforcement authorities the right to be notified thereof, provided that that does not impede criminal proceedings, or the right to a legal remedy against unlawful access compatible with Article 15(1) of Directive 2002/58, read in combination with Article 5(1) and recital 11 thereof? (1) The Court considered that Article 15(1) of Directive 2002/58 does not allow Member States to derogate from Articles 4(1) and 4(1)bis, which require providers of electronic communications services to take appropriate technical and organisational measures to ensure effective data protection. It answered the first question by stating that Article 15(1) of the Directive must be interpreted as precluding national legislation which provides for general and undifferentiated data retention as a preventive measure in the context of criminal investigations. (2) As to the second question, concerning the failure of national legislation to provide for access to data to be limited to what is strictly necessary, the Court held that national legislation must satisfy the requirement of proportionality. In particular, the legislation cannot be limited to requiring that the authorities' access to the data be in accordance with the purpose of the legislation, but must also provide for the material and procedural conditions governing that use. The Court therefore considered that national legislation which does not provide that access to stored data is limited to what is strictly necessary to achieve the purpose of that storage does not comply with the mentioned provisions. As regards information and the right of appeal for data subjects, the Court considered that the articles in question preclude national legislation which does not guarantee that data subjects are informed of the processing to the extent provided for by EU law and which does not allow any means of appeal in the event of unlawful access to such data.

Decision date: 20 October 2022

Cited provisions: Art. 2(2) GDPR, Art. 2(3) GDPR, Art. 6(1)(e) GDPR, Art. 5(1)(c) GDPR

The Bulgarian DPA and the Bulgarian Central Election Commission adopted guidelines on national electoral procedures. The guidelines addressed the problem of the processing of personal data by means of video recording in the context of elections and limited such a processing to specific circumstances. The guidelines are direct implementation of the GDPR. A political party claimed that the guidelines were unlawful, as the GDPR does not apply to national elections, which fall outside the scope of EU law. The Administrative Court of Sofia (Administrativen sad Sofia) annulled some provisions of the guidelines. The Bulgarian DPA and the Bulgarian Central Election Commission appealed before the Supreme Administrative Court (Varhoven administrativen sad). The Supreme Administrative Court referred the case to the CJEU. The CJEU stressed that the only exceptions to the GDPR scope of application are provided by Article 2(2) and (3) of the GDPR. These exceptions shall be interpreted strictly. In particular, Article 2(2)(b) GDPR states that the regulation does not apply to processing activities falling outside the scope of EU law. However, according to the Court, this provision exempts only activities carried out in the context of national security or related purposes. Activities relating to the organisation of elections do not fall within this category. In the merits, the CJEU also addressed the question whether a national DPA could limit or prohibit processing activities such as the filming of electoral process, including the vote count. The Court stated that such processing activities could in principle rely on Article 6(1)(e) GDPR, namely processing carried out in the public interest. However, the Bulgarian DPA, by limiting or prohibiting video-recording of vote count and other electoral processes implemented the principle of data minimisation under Article 5(1)(c) GDPR. In particular, the ban did not impair the public interest objective, which was to guarantee transparency (and thus lawfulness) of electoral processes. As a matter of fact, the guidelines did not prevent people from being present during the vote count, but only from recording it.

Decision date: 8 December 2022

Cited provisions: Art. 4(1) GDPR, Art. 4(2) GDPR, Art. 2(2)(d) GDPR, Art. 6(1)(e) GDPR, Art. 6(1)(c) GDPR, Art. 6(3) GDPR

In 2013, the District Public Prosecutor’s Office in Petrich (Bulgaria) opened pre-trial proceedings (No 252/2013) against an unknown person for the commission of a crime. The applicant in the case in question (VS) took part in those proceedings as a victim. In 2016, the District Public Prosecutor’s Office in Petrich, compiled a number of criminal files containing information relating to VS, [after receiving a number of complaints concerning, inter alia, VS]. However, the Public Prosecutor's Office did not open any pre-trial proceedings in the absence of evidence. In 2018, the public prosecutor made formal accusations in respect of all the persons who took part in the incident at issue in the pre-trial proceedings (No 252/2013), including VS. VS brought an action before the Regional Court in Blagoevgrad (Bulgaria) against the Public Prosecutor’s Office of the Republic of Bulgaria seeking damages for the harm allegedly resulting from the excessive duration of the pre-trial proceedings (No 252/2013). At the hearing, the Public Prosecutor's Office requested that the files opened in 2016, concerning VS, be produced for the purposes of defending the public prosecutor's office against claims made by VS. The Regional Court ordered that public prosecutor's office to produce certified copies of the documents in the files in question. In March 2020, VS lodged a complaint with the Supreme Judicial Council, Bulgaria (‘the IVSS’), claiming that the District Public Prosecutor’s Office in Petrich, had infringed the data protection legislation. VS claimed, firstly, that that public prosecutor’s office had unlawfully used his personal data collected when he was considered to be a victim of a crime, in order to prosecute him in the same proceedings. Secondly, VS alleged that the public prosecutor’s office acted unlawfully as regards the processing of personal data that were collected in the files, in 2016, in the context of his action for damages against the Public Prosecutor’s Office of the Republic of Bulgaria. The IVSS rejected that complaint. In July 2020, VS brought an action before the Administrative Court in Blagoevgrad (Bulgaria) against that decision, claiming, first, that the processing of his personal data in the course of pre-trial proceedings (No 252/2013) is contrary to, inter alia, the principles of the Law Enforcement Directive 2016/680 ("LED 2016/680"), and second, that the processing of the data collected in the files, in 2016, after the Public Prosecutor’s Office had refused to initiate pre-trial proceedings, infringes the principles of the GDPR. The Administrative Court decided to stay the proceedings and to refer to the CJEU for a preliminary ruling. Within this particular case, the CJEU addressed whether the provisions of the GDPR apply to the processing of personal data by the public prosecutor's office for the purpose of exercising its rights of defendence in civil proceedings. Firstly, the CJEU considered the conditions for the definition of 'personal data' under 4(1) GDPR and processing' under Article 4(2) GDPR were met in this case, where a defendant, in civil proceedings, informs the competent court, even succinctly, of the opening of files concerning a natural person, in particular for the purposes of the ‘detection’ or ‘investigation’ of a criminal offence. With regard to the exception provided for in Article 2(2)(d) GDPR, which concerns the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, the CJEU held that the exception should be interpreted strictly. In this regard, it was also held that, the reason for that exception is that the processing of personal data by the competent authorities for the purposes set out in Article 2(2)(d) GDPR is governed by LED 2016/680. As in the present case, the CJEU found that even where the bringing action for damages against the State from alleged misconduct by the public prosecutor’s office in the course of criminal proceedings, the aim of the State’s defence in such an action is not to perform, as such, tasks for the purposes set out in Article 1(1) of LED 2016/680. Furthermore, it was stated that the participation of a public authority in civil proceedings as a defendant in an action for damages against the State does not seek to safeguard national security or of an activity which can be classified in the same category, in the light of Article 2(2)(a) GDPR. The public prosecutor’s office must be considered to be a ‘controller’, within the meaning not only of Article 4(7) GDPR, but also of Article 3(8) of LED 2016/680. The CJEU held that the GDPR is applicable to the processing of personal data by the public prosecutor’s office for the purpose of exercising its rights of defence in an action for damages against the State, where, first, it informs the competent court of the opening of files relating to a natural person who is a party to that action for the purposes set out in Article 1(1) of LED 2016/680 and, second, it transmits those files to that court. With regard to the lawfulness of the processing, the CJEU considered first that it must be determined whther the processing, by the public prosecutor’s officef or the purpose of defending the State or a public body in an action for damages for harm caused by misconduct on the part of the State or a public body, is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in it, within the meaning of Article 6(1)(e) GDPR. Moreover, it cannot be ruled out that, where, for the purpose of defending the State in an action for damages, the public prosecutor’s office of transmits the personal data to the court at that court’s request, that transmission is also liable to come within the scope of Article 6(1)(c) GDPR where that public prosecutor’s office is required to comply with such a request pursuant to national law. It is for the referring court to verify whether, in accordance with Article 6(3) GDPR, the national law lays down, 1) the basis for such processing and, 2) the purposes of that processing or, as regards Article 6(1)(e) GDPR, whether that processing is necessary for the public prosecutor’s office’s performance of its task carried out in the public interest. Furthermore the CJEU emphazised that the processing of personal data must also copmly with all the applicable requirements provided for by the GDPR. This decision represents an important milestone case for data protection in the context of law enforcement.

Decision date: 22 June 2022

Cited provisions: Art. 38(3) GDPR

Leistritz is a private company (the Company) based in Germany that is required under German law to have a Data Protection Officer (DPO). LH was the ‘Head of Legal Affairs’ in the Company, and subsequently, also became its Data Protection Officer from 1 February 2018. On 13 July 2018, the Company issued a letter by which it terminated LH’s employment with the Company, effective 15 August 2018. In the letter, the Company relied on internal restructuring measures, as per which the “activity of internal legal adviser and the data protection service were to be outsourced.” LH challenged the validity of termination of her employment and claimed that the same was invalid as per Article 38(2) GDPR and Section 6(4) BDSG, as the employment could be terminated only in case of a “just cause”. The Court agreed with the plaintiff and declared LH's termination unlawful since no “just cause” was to be found in the present case. The Company filed an appeal against the decision. The issue raised was whether Article 38(3) GDPR allows a Member State to make laws that impose stricter conditions for the termination of a DPO. Noting a divergence in German jurisprudence, the Federal Labour Court stayed the proceedings and referred the following questions to the CJEU for a preliminary ruling: 1. Is the second sentence of Article 38(3) GDPR to be interpreted as precluding a provision in national law, such as Paragraph 38(1) and (2) in conjunction with the second sentence of Paragraph 6(4) of the Bundesdatenschutzgesetz (Federal Law on data protection), which declares ordinary termination of the employment contract of the data protection officer by the data controller, who is his employer, to be impermissible, irrespective of whether his contract is terminated for performing his tasks? If the first question is answered in the affirmative: 2. Does the second sentence of Article 38(3) GDPR also preclude such a provision in national law if the designation of the data protection officer is not mandatory in accordance with Article 37(1) GDPR, but is mandatory only in accordance with the law of the Member State? If the first question is answered in the affirmative: 3. Is the second sentence of Article 38(3) GDPR based on a sufficient enabling clause, in particular in so far as this covers data protection officers that are party to an employment contract with the data controller? Answering the first question, the CJEU held that there are certain words within Article 38(3) GDPR that are otherwise not defined within the GDPR. To interpret these provisions requires reference to their ordinary meaning in everyday language as well as the context in which they appear in GDPR. The CJEU concluded that Article 38(3) GDPR is intended only to ensure a DPO's functional independence, not to govern the overall employment relationship between a controller or a processor; it applies irrespective of the nature of the DPO's employment relationship with the controller or processor. Because the EU is to support and complement the efforts of member states in the field of worker protections, the CJEU held that Article 38(3) GDPR does not preclude “national legislation which provides that a controller or a processor may terminate the employment contract of a data protection officer, who is a member of his or her staff, only with just cause, even if the contractual termination is not related to the performance of that officer’s tasks, in so far as such legislation does not undermine the achievement of the objectives of the GDPR.” As the first question was answered in the negative, the CJEU did not answer the remaining two questions.

Decision date: 17 February 2026

The applicant, Green Alliance, is an environmental association with its registered office in Bulgaria, founded in 2006. It challenged national regulations under which the State Agency for National Security (the Agency) can, on the decision of its head use “agents on cover” (civil servants who operate covertly within public authorities, private organizations, and certain professions) to carry out intelligence and counterintelligence activities for national security purposes. These regulations derive from the 2007 Act, which established the Agency as the successor to several national security and intelligence bodies, under government supervision, with its head appointed by the President and deputies by the government. Originally adopted in 2008, the regulations required that infiltration occur only where there was a proven operational need and, in many cases, with the consent of the target entity. They also defined the agents’ duties, prohibited the use of force or arrests, and specified employment rights. Amendments in 2018 expanded the scope of potential targets, removed the requirement for the target entity’s consent, and clarified that agents could operate in legal persons and civil associations, as well as in liberal professions, except private law firms, while emphasizing that their cover must not be exposed. The Agency insisted that these agents were distinct from “agents under cover,” who may employ covert surveillance equipment, as “agents on cover” do not use technical surveillance and remain criminally liable for their acts. Critics, including the Bulgarian Helsinki Committee and the Supreme Bar Council, warned that these changes could violate privacy rights, professional confidentiality, and Article 8 of the European Convention on Human Rights (ECHR), given the limited judicial oversight and explicit safeguards. Green Alliance argued that the regulations allowed arbitrary and disproportionate interference with its rights under Article 8 ECHR and that the absence of effective safeguards could result in abuses. The Bulgarian administrative courts held that the 2007 Act and the subsequent regulations authorizing the deployment of “agents on cover” were lawful. They found that the statutory delegation to the State Agency for National Security was valid, that the deployment of agents did not unlawfully interfere with private life or correspondence, and that sufficient oversight existed through parliamentary committees, government reporting, presidential review, and supervision by the Commission for the Protection of Personal Data. The courts concluded that the regulations struck an appropriate balance between national security needs and the protection of individual rights, and dismissed Green Alliance’s claims of violations of Article 8 ECHR. Following the dismissal of its claims domestically, Green Alliance brought its application to the European Court of Human Rights. The European Court of Human Rights (ECtHR) held that the 2008 regulations on “agents on cover,” as amended in 2018, violated Article 8 ECHR because they allowed interference with the applicant association’s rights to respect for its “home” and “correspondence” without adequate legal safeguards. The Court noted that these regulations enabled the Agency to deploy agents in private organizations and liberal professions without independent or judicial oversight, time-limits, or clear procedural requirements to ensure necessity and proportionality. The regulations lacked mechanisms to supervise agents’ work effectively, and no remedies were available for entities affected by their deployment. Although agents could not use technical surveillance or claim immunity from criminal liability, they could access sensitive communications and premises, potentially interfering with the association’s Article 8 ECHR rights. Domestic remedies, including requests for personal data access or complaints to the Commission for the Protection of Personal Data, were ineffective in practice, as the Agency could refuse disclosure on national security grounds, and legal persons could not independently challenge the deployment of agents. The Court emphasized that the degree of intrusion, rather than the technical method, determines the safeguards required, and found that the Bulgarian legal framework failed to prevent arbitrariness or abuse. While no evidence showed actual deployment against the applicant, the clandestine nature of “agents on cover” meant that the lack of evidence could not negate the violation. Consequently, the regulations did not meet the quality-of-law requirement under Article 8 § 2 ECHR, and the ECtHR found a violation. In applying Article 41 ECHR, the ECtHR considered the association’s claim for just satisfaction, including €4,000 for non-pecuniary damage and €6,500 for legal proceedings. The ECtHR underlined its discretionary power under Article 41 ECHR, noting that in some cases the public vindication of a Convention breach through a binding judgment constitutes sufficient redress. Since the violation stemmed solely from the law’s existence without demonstrable harm to the association, no monetary compensation for non-pecuniary damage was necessary. The Court concluded unanimously that the finding of a violation of Article 8 ECHR itself provided sufficient just satisfaction and emphasized that under Article 46 ECHR, the State must take general or individual measures to remedy the violation and align domestic law with Convention standards.

Decision date: 8 January 2026

Events Giving Rise to the Application The data subjects, Ferrieri and Bonassisa, were subjected to tax audits during which the Italian Tax Authority (the controller) requested and obtained their banking and financial transaction data from banks on the basis of tax audit purposes, without prior judicial scrutiny and without providing reasons. The applicants were notified from their banks only after the data had been accessed and used. The banks informed them that they had received legally binding requests to disclose information relating to their bank accounts and that they were obliged to comply. The data subjects complained of the excessively broad scope of the discretion conferred on the domestic authorities by the national legislation, and of the lack of sufficient procedural safeguards capable of protecting them against any abuse or arbitrariness, in particular the lack of ex ante and/or ex post judicial or independent review of the contested measures, arguing that any available remedies under national law, were ineffective in practice. More specific, the data subjects argued that Italian law lacked any effective ex post review of the measures. Civil remedies were merely theoretical, because there were no case-law examples of this, and unable to provide urgent protection, challenges before tax courts were only possible years later and could not invalidate tax assessments even if authorization was unlawful, and the Taxpayer’s Guarantor had no power to issue binding decisions. They therefore lodged an application before the European Court of Human Rights, alleging a violation of [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 8 of the Convention]. The data subjects also claimed compensation for the non-pecuniary damage they had suffered and asked the Court to determine the amount it deemed to be appropriate. Domestic Legislation Under [https://def.finanze.it/DocTribFrontend/getAttoNormativoDetail.do?ACTION=getSommario&id=%7B75A4827C-3766-4ECC-9C45-00C8D6CDC552%7D Italian tax law], the Tax Authority is empowered to access taxpayers’ banking data for the purposes of tax audits and assessments. Such access is authorized through an internal administrative decision, which is considered a preparatory administrative act, is not subject to prior judicial authorization, and cannot be challenged independently before the tax courts. Taxpayers are generally informed only after their banking data has already been obtained. While taxpayers may challenge the resulting tax assessment before the tax courts, domestic case-law consistently holds that these tax assessments are not automatically invalid even where banking data was obtained unlawfully, unless the taxpayer can demonstrate concrete harm to a constitutionally protected right. The Taxpayer’s Guarantor, an independent body intended to safeguard taxpayers’ rights, may issue recommendations or invite the tax authority to reconsider its actions, but has no binding powers. The European Court of Human Rights found that the Italian legal framework governing tax authorities’ access to taxpayers’ banking data gave rise to a violation of Article 8 ECHR. While the interference pursued a legitimate aim, namely the prevention of tax evasion and the protection of the economic well-being of the State,and was based on domestic law, the Court held that it was not in accordance with the law” within the meaning of [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 8 ECHR]. In particular, the Court emphasized that Italian law conferred very broad discretionary powers on the tax authorities to obtain extensive banking and financial data, without requiring prior judicial authorization or a reasoned decision. The authorization to access banking data was classified in domestic law as a purely internal, preparatory administrative act, which neither had to be justified nor could be independently challenged by the taxpayer. Moreover, taxpayers were generally informed only after their data had already been obtained and processed. The Court held that the domestic framework failed to provide effective ex remedies as safeguards against abuse. Authorizations to access banking data did not need to be reasoned and could not invalidate a tax assessment even if the data were unlawfully obtained, making challenges before the tax courts ineffective, uncertain, and potentially available only years later. Although administrative guidelines required banking audits to be necessary, proportionate, and targeted, these safeguards were non-binding and lacked legal force. Moreover, civil remedies were merely theoretical, as Italy failed to demonstrate their existence and effectiveness in practice, no relevant case-law examples were provided, and such remedies were in any event incapable of offering urgent or precautionary protection. Finally, the Taxpayer’s Guarantor lacked binding powers, but rather merely supervises the activity of the tax authorities. The Court found that the contested measures were not subject to effective ex post judicial or independent review and therefore rejected the Government’s objection of non-exhaustion of domestic remedies. It concluded that, although Italian law provided a general legal basis for accessing banking data, the framework failed to meet the Convention’s quality-of-law requirements, as it granted the authorities unfettered discretion and lacked sufficient procedural safeguards. Consequently, the interference could not be regarded as “in accordance with the law” under [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 8 § 2 of the Convention.] The data subjects also claimed that the lack of an effective judicial remedy violated their right of access to justice, [https://www.echr.coe.int/documents/d/echr/convention_ENG Articles 6 § 1 and 13 ECHR,] but the Court considered the main legal issues already addressed and did not examine these separately. Under [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 46 ECHR,] Italy must adopt measures to align its law and practice with the Court’s findings, as the violation of [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 8] was systemic, stemming from the domestic legal framework. The Court emphasized that the law should clearly define when and under what conditions authorities may access taxpayers’ banking data, requiring justification for such measures. Effective judicial or independent review must be available, assessing both compliance and the scope of measures, without waiting for a tax assessment notice. The framework should also consider international tax cooperation while safeguarding taxpayer rights. Under [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 41 ECHR], the Court held that the finding of a violation alone suffices to compensate the data subjects for non-pecuniary damage, dismissing the government’s objection.

Decision date: 2 October 2025

The defendants are Facebook Netherlands B.V., Meta Platforms Ireland Ltd and Meta Platforms Inc (established in the US), collectively referred to as Meta. In September 2025, Bits of Freedom (BoF), a Dutch non-profit advocacy group, in light of the upcoming national elections, filed an interim injunction against Meta before the court of first instance (Amsterdam District Court - Rechtbank Amsterdam). It argued that that Meta restricts users' freedom of choice and autonomy by the way it sets up its platforms (Instagram and Facebook) regarding their recommendation systems and that it thereby violates Article 27, Article 38 and Article 25 DSA. More specifically it argued that: i. The place to choose a non profiled recommendation system is difficult to find and thus not directly and easily accessible on the platforms. ii. After a user opens (the apps and/or websites of) the platforms, a profiled recommendation system is automatically applied to the home page, the comments section, and the reels section, even if the user selected a chronological recommendation system before the app/website was last closed. This "switching back" to a profiled recommendation system also happens automatically during a session when a user navigates between different sections of the platform. iii. It is impossible to set a "persistent" choice in the apps or on the websites. That is, a choice to set a non-profiled recommendation system that does not "switch back" to a profiled recommendation system the moment the user navigates between different sections of the platform, or closes and reopens the platform's app or website. Bof requested that Meta is ordered to respect the user’s choice, to make the choice persistent and more accessible, to include the written text "Profiled" or "Profiling" at the top of each profiling and to include information on recommendation systems. Meta Ireland argued that there was no evidence that profiled recommendation systems would influence the electoral process, that any measures imposed should apply only up to the election and that it was impossible for it to implement these orders within two weeks. First, the court held that the obligations arising from the DSA only rest with Meta Ireland, since it is the one offering the platforms to Dutch users. This means that the claims brought against Facebook Netherlands and Meta Inc will be dismissed. Second, the court examined BoF’s claims in relation to the interfaces of Instagram and Facebook as very large online platforms and found that: Regarding point (i), the discoverability of the setting of an unprofiled recommendation system on Instagram's home page on the Android app, Instagram's reels section (on both apps and website), and Facebook's home page and reels section do not meet the requirements set by the DSA. This functionality is not "directly and easily accessible" in accordance with Article 27(3) DSA. Regarding points (ii) and (iii), the 'switching back' to a profiled recommendation system, the court held that the unauthorised interference with users' autonomy referred to in Article 25(1) DSA is considered a "dark pattern". According to the court, the user-chosen preference option for an unprofiled recommendation system on the platforms is not "persistent", meaning that the choice for that recommendation system is not retained until the user changes it again. Therefore, Meta Ireland violates the Article 27(3) and Article 38 DSA. Third, the court highlighted the that the freedom of information gathering is a fundamental right, which is part of freedom of expression. This fundamental right is protected for the purpose of public debate, which is fundamental to a democratic society. In light of this, the claims filed in these interim proceedings were by their nature urgent, taking into consideration the upcoming elections. Fourth, the court ordered Meta Platforms Ireland Ltd, within two weeks of this judgment, to: 1. make the choice of recommendation system indicated by users of the platforms’ websites and/or apps, persistent, including the choice of a chronological or otherwise unprofiled recommendation system, to the effect that a choice of unprofiled recommendation system set by users will be preserved even if the user navigates to other sections within the platform, and even if the user has closed and then reopens the platforms' apps and/or website to make the preferred option for an unprofiled recommendation system directly and easily accessible in all platforms, 2. to make non-profiled recommendation system choices directly and easily accessible on (i) Instagram's home page on the Android app, (ii) Instagram's reels section (all apps and websites), and (iii) Facebook's home page and reels section (all apps and websites), 3.to pay to BoF a penalty payment of €100,000 for each day or part thereof that it fails to comply in full with the orders until a maximum total of €5,000,000. Fifth, the court rejected the claims to include the written text "Profiled" or "Profiling" at the top of each profiling and to include information on recommendation systems. Lastly, the court noted that the measures to be imposed only relate to offering the platforms to users within the Netherlands and will continue to apply beyond the elections.

Decision date: 23 September 2025

Cited provisions: Art. 13 GDPR, Art. 14 GDPR

The controller is Lidl, the discount food retailer. Lidl offers consumers a loyalty program, "Lidl Plus". Via Lidl Plus, registered users receive personalised product information and offers, also from third-party providers. Customers can register via the Lidl app and create a "Lidl Plus account". The terms and conditions for registering, which customers have to accept, stated that "Participation in Lidl Plus is free of charge." It also stated that the app collects users’ data in order to send them personalised offers and promotions and described in more detail which data is processed. Lidl also processed the data to optimise the Lidl Plus program. In January 2025, the Federal Consumer Association (Verbraucherzentrale Bundesverbands) (plaintiff) filed a case against Lidl before the court of first instance (Stuttgart Higher Regional Court-OLG Stuttgart) on the grounds that it breached its obligation to indicate the total price of the service which applies to distance selling contracts, in accordance with the provisions of the national Civil Code (Articles 312 et seq. BGB) in conjunction with the national Introductory Act on Civil Codes (Article 246a Section 1(1)(5) EGBGB). The plaintiff claimed that according to Article 312d(1) BGB(1) In the case of contracts concluded outside of business premises and in the case of distance contracts, the entrepreneur is obliged to inform the consumer in accordance with Article 246a of the Introductory Act to the Civil Code. The information provided by the entrepreneur in fulfilment of this obligation shall become the content of the contract, unless the contracting parties have expressly agreed otherwise. in conjunction with Article 246a Section 1(1)(5) EGBGBPursuant to § 312d (1) of the Civil Code, the entrepreneur is obliged to provide the consumer with the following information: 5. the total price of the goods or services, including all taxes and duties, or in cases where the price cannot reasonably be calculated in advance due to the nature of the goods or services, the type of price calculation;, Lidl was obliged to provide information about the total price of the service. Lidl infringed these provisions by stating in the conditions of participation that participation was free of charge and by not stating that consumers must provide a fee in the form of personal data. The provision of personal data was the price for using the app. According to the plaintiff, a price does not necessarily have to be paid in a monetary amount. The plaintiff requested that Lidl was ordered to refrain from offering the conclusion of a contract in connection with the app "Lidl Plus" under these terms and to be obliged to inform consumers of the total price. Lidl on the other hand, claimed that it is was not obliged to inform customers in this case because the exception of Article 312(1a) BGB applied, according to which the above mentioned obligation does not apply if the trader processes the personal data provided by the consumer exclusively in order to meet his obligation to perform or to comply with his legal requirements. In this case the purpose was the provision of personalised information. In any case, according to Lidl, even if Article 246a Section 1(1)(5) EGBGB was relevant, information on the total price would not be required, as this obligation only covers situations where there is a payment in money, but not the provision of personal data. The court assessed the plaintiffs allegations regarding LIdl's conduct from a consumer and competition law perspective. In particular it assessed the claims that Lidl did not provide the legally required information about the total price and that it incorrectly stated that participation was free of charge for the consumer. The court found no violations and decided to dismiss the case. Consumer protection law First the court asserted that Article 312d(1) BGB in conjunction with Article 246a Section 1(1)(5) EGBGB on distance selling contracts constituted consumer protection provisions within the meaning of the national Law on injunctions for consumer rights and other violations (Section 2(1) sentence 1 UKIaG). Second, the court held that what is to be understood by the "price" for the provider of services according to Article 246a Section 1(1)(5) EGBGB must be determined in accordance with the requirements of European consumer protection laws. Article 312d(1) BGB in conjunction with Article 246a Section 1(1)(5) EGBGB, constitute national implementations of Article 6(1)(e) of the Consumer Rights Directive (Directive 2011/83/EU) and Article 2(7) of the Directive on certain aspects of contracts for the supply of digital content and digital services (Directive 2019/770/EU). The concept of "price" in both Directives is only to be understood as the remuneration in money or a digital representation of a value. The court held that, the provision of personal data by the consumer is not covered by this definition. The court further pointed out that, in contrast, the protection of the consumer, who should be clearly and unambiguously be made aware of the implications of their consent to the provision of their personal data, is guaranteed by the requirements for informing the data subject in accordance with Article 13 and Article 14 GDPR. There are no indications that the legislator intended to extend the existing data protection information obligations with the provision in Article 6(1)(e) of the Consumer Rights Directive on the indication of the total price. Therefore, since the consumer did not have to pay a price or other costs, the fact that Lidl described its services as free of charge was not objectionable according to Article 246a Section 1(1)(5) EGBGB. The court found that the plaintiff was not entitled to the asserted a claim for injunctive relief pursuant to Section 2(1) UKIaG because Lidl did not violate any of the consumer protection laws relevant to the decision here. Competition law The court held that a claim for injunctive relief did not arise from the violation of a prohibition under competition law either, since Lidl did not incorrectly state that participation was free of charge for the consumer, pursuant to the national Act against Unfair Competition (Section 3(1) UWG in conjunction with Sections 5, 5a UWG). The court mentioned that the Guidance on the interpretation and application of Directive 2005/29/EC of the European Parliament and of the Council concerning unfair business-to-consumer commercial practices in the internal market states that it can be considered a misleading practice if products are presented as "free" in the online sector, but personal data is collected from users without adequately explaining to the consumer how this data and user-generated content is used.Products presented as ‘free’ are especially common in the online sector. However, many such services collect personal data of users such as their identity and email address. Importantly, the UCPD covers all commercial practices concerning ‘free’ products and does not require payment with money as a condition for its application. Data-driven practices involve an interplay between EU data protection legislation and the UCPD. There is an increasing awareness of the economic value of information related to consumers’ preferences, personal data and other user-generated content. The marketing of such products as ‘free’ without adequately explaining to consumers how their preferences, personal data and user- generated content are going to be used could be considered a misleading practice in addition to possible breaches of data protection legislation. (page 68) However, in this case Lidl explained the collection and use of personal data in the terms of use in an appropriate manner. Since no costs within the meaning of Article 246a Section 1(1)(5) EGBGB incurred for the consumers, the participation was free of charge. By describing it this way Lidl did not conceal the fact that the consumer must provide personal data and did not in any way deceived consumers. According to the court, anyone reading the terms and conditions would also be informed in detail about which data is collected and processed. Data protection law The plaintiff did not claim that information obligations under the GDPR had been violated and this was not apparent from its statement of claim, which is why the court decided not to examine these provisions.

Decision date: 12 August 2025

Cited provisions: Art. 6 GDPR, Art. 9 GDPR

The plaintiff is a consumer organisation registered as a qualified entity from another Member State of the European Union within the meaning [https://eur-lex.europa.eu/eli/dir/2020/1828/oj/eng Directive 2020/1828]. The respondent, and controller, is the subsidiary of Meta Platforms Inc., Meta Platforms Ireland Ltd. On 14 April 2025, Meta announced, via press release and via in-app notifications and emails, that from 27 May 2025 it would start using the public content of adult users and their interactions to train its AI models in its products. On 27 June 2025, the plaintiff filed a preliminary injunction application before the higher regional court (Higher Regional Court Schleswig-Holstein - OLG Schleswig). It requested that Meta stops, for the purpose of the development and improvement of AI technologies and regarding consumers in Germany, the processing of: 1. personal data published by users on their Facebook and Instagram accounts and personal data collected about them by third parties and transmitted to Meta on the basis of legitimate interest, 2. special categories of personal data published by them on the Facebook and Instagram services without their explicit consent, and 3. content created and shared by users on the Facebook and Instagram services for use outside of these services without providing for this in the General Terms and Conditions for the respective platform usage agreements. 4. in the alternative, to prohibit Meta from combining personal data from Facebook with personal data from Instagram and/or to further use personal data from Facebook and/or Instagram in other services provided by Meta without giving end users the specific choice and obtaining their effective consent. The plaintiff argued that the contested data processing violated Article 6 and Article 9 GDPR, as well as the prohibition of merging and the prohibition of further use under Article 5 DMA. It further claimed that no effective objection was made possible for the data subjects, especially if they were not registered users of Meta’s platforms. It also argued that data from advertising partners would also be used for the development of the AI applications. On the other hand, Meta claimed that compliance with the provisions of Article 6 and Article 9 GDPR was ensured by the de-identification and tokenisation of the individual learning data sets. Obtaining the consent of users to the processing of their data for the development and improvement of AI models was disproportionate. It further claimed that the likelihood that its AI model will extract personal data from private individuals is extremely low, due to the various protective measures taken. Lastly, Meta stated that "AI at Meta" is not a separate service, but an integrated function of all its platforms. The court rejected the interim injunction application as inadmissible. The court held that the element of urgency required for the issuance of an interim relief, under the Federal Act Against Unfair Competition (§12UWG), the Act on injunctions in consumer law and other infringements (§5 UKlaG) and ECJ case law ([https://curia.europa.eu/juris/liste.jsf?language=en&num=C-465/93 Case C-465/93]), was absent. The further questions of admissibility, in particular with regard to the active legitimation of the plaintiff for the injunction, and the question of the merits of the application are therefore irrelevant. First, it held that it remains undisputed that the plaintiff in the injunction was already aware of the conduct complained of due to Meta’s announcements some time before it began. In particular, the processing of personal data based on legitimate interest instead of consent, the processing of special categories of personal data, the use of the content published on Facebook and Instagram to develop and improve AI technologies outside these services (like Meta’s AI application ‘Llama’), the processing of personal data of data subjects appeared in institutional profiles and that the processing would affect more people, where all known from the emails sent by Meta. Insofar as the plaintiff claimed that Meta actually uses personal data of its users for AI training, which it receives from advertising partners, it has not made this disputed allegation credible. Second, the court held that the plaintiff waited for a month to file the application for a preliminary injunction after becoming aware of Meta’s alleged imminent infringement, so there was no longer any urgency with regard to the requested legal protection. The plaintiff also failed to demonstrate a valid reason as to why it waited until Meta had actually began the objectionable conduct to file the application. Nevertheless, the court pointed out that de-identification and tokenisation can be completely or partially reversed. Against this background, the processing of special categories of personal data covered by Article 9 GDPR cannot be processed under the legal basis of legitimate interest. It should also be borne in mind that it is not possible for data subjects to find out whether their data are being unlawfully processed in the AI’s learning data set and AI model itself.

Decision date: 3 December 2025

An applicant (the data subject) participated in several EU staff selection procedures administered by the European Personnel Selection Office (EPSO), acting as controller, and created an EPSO account in the Talent system. After he successfully passed one selection procedure, EPSO also stored his data in its recruitment portal. EPSO managed recruitment through two IT systems, both of which generated access logs, although those logs contained limited technical information regarding the purpose of each access. Between 2022 and 2024, the data subject submitted several requests to EPSO under [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Article 17 of Regulation (EU) 2018/1725], seeking access to all personal data concerning him. He requested, in particular, full access logs, minutes of meetings, internal and external communications containing his personal data, information on data recipients, and the restoration of personal data deleted after the expiry of retention periods. EPSO stated that certain data did not exist, that it could not restore lawfully deleted data, and that it had already disclosed all available log data. After the data subject lodged a complaint, the European Data Protection Supervisor (EDPS) reconsidered the matter in light of the CJEU’s judgment in Pankki. The EDPS ordered EPSO to provide all available log data relating to consultations of the data subject’s profile. EPSO complied with that order by disclosing the available logs but withheld the identities of individual staff members who had accessed the data. EPSO later rejected further access requests submitted by the data subject. As a result, the data subject brought two actions before the General Court (Cases T-318/24 and T-362/24), seeking the annulment of EPSO’s decisions. The General Court joined the two cases and examined together all the pleas in law raised by the data subject. The General Court dismissed both actions in their entirety. It held that the controller did not infringe [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Article 17(1)] or [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng (3)] of [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Regulation 2018/1725,] as the right of access concerns personal data undergoing processing and not documents as such, nor does it require the controller to restore lawfully deleted data. The Court confirmed that [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Regulation 2018/1725] contains no obligation for a controller to reinstate personal data once deleted in compliance with applicable retention rules. The Court further held that the controller had no obligation to disclose additional log data, meeting minutes, or communications where it credibly asserted that no such personal data existed. The data subject failed to rebut the presumption of legality attaching to the controller’s statements regarding the non-existence of further data. Moreover , The Court held that access logs constitute personal data to which a data subject is entitled, as they reveal the existence, frequency and purpose of processing. However, employees of a controller acting under its authority are not “recipients” within the meaning of the GDPR or [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Regulation 2018/1725], and controllers are not required to log or disclose their identities. Disclosure of such identities is only required if strictly necessary for the effective exercise of data protection rights and subject to safeguarding employees’ rights. Since the data subject had already been informed of the purposes and recipients of processing, the absence of staff identities or detailed purposes in the logs did not infringe the right of access. It is not further apparent from the Pankki that Article 15 GDPR requires the controller to set up a logging mechanism containing information on the identity of employees who have carried out consultation operations in respect of the personal data of a person. In addition, the Court found no infringement of the principles of lawfulness, fairness, transparency, accuracy, integrity, confidentiality, or accountability under [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Article 4 of Regulation 2018/1725.] The deletion of the data subject’s data after the expiry of retention periods was lawful and the data subject’s rights to restriction of processing and objection under Articles [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng 20] and [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng 23] were not applicable, as the deletion was based on a legal obligation rather than consent or legitimate interests.

Decision date: 8 January 2025

In 2021 and 2022, the data subject visited the website on the “Conference on the future of Europe” which is managed by the European Commission. The data subject alleged that his personal data including his IP address and information on his browser and terminal were transferred to recipients in the United States on three occasions through this website. On the 30 March 2022, the data subject’s IP address and browser and terminal information were transferred to Amazon Web Services through the “Amazon CloudFront”. The “Amazon CloudFront” provided the basis for the website visited by the data subject. On the same day, in order to sign up for an event, the data subject used the option of signing in with his Facebook account as provided for by the Commissions authentication service. The data subject alleged that this transferred his personal data to the American company Meta Platforms Inc. The data subject again visited the website on the 8 June 2022 and again his data was transferred to Amazon CloudFront. Claim one for non-material damages valued at €400 The data subject brought forward that the United States does not provide an adequate level of protection of personal data and that his data was at risk of being disclosed to US security and intelligence services. The data subject claimed for compensation of €400 for the non-material damage he had suffered due to the data transfer in violation of Article 46 of [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32018R1725 Regulation (EU) 2018/1725 ("EUDPR")] and Article 48(1)&(2)(b) EUDPR. In addition, the data subject sought the annulment of the transfer of his personal data. Claim two for non-material damages valued at €800 On the 1 April 2022, the data subject requested access to information from the Commission to which it responded on the 30 June 2022 via email. However, the data subject alleged that information provided in the email was insufficient. He therefore claimed that the Commission had failed to issue a position (inactivity claim) in response to the data subject’s request for information. Further, he alleged that no information on the data transfer to the United States was included in the privacy policy. For this, the data subject claimed €800 compensation for the infringement of his right to access to information in violation of Article 14(3)&(4) EUDPR and Article 17(1)&(2) EUDPR as well as the principle of transparency under Article 4(1)(a) EUDPR. annulment of the transfer The court dismissed the data subjects application for annulment as inadmissible since the transfers at issue are not likely to have binding legal effects or are capable of affecting the interests of the data subject changing their legal position. Claim two for damages valued at €800 The court found that the unlawful conduct only established in the case was that the Commission failed to observe the one-month time limit stipulated in Article 14(4) EUDPR. However, the data subject's argument concerned the substance of the information rather than the procedural rule that was actually infringed. Therefore, the data subject failed to demonstrate any non-material damage resulting from said infringement. The court therefore discarded the data subject’s claim for damages due to an infringement of the Commission's information obligation and of his right to access to information under Article 14 EUDPR and Article 17 EUDPR. Claim one for damages valued at €400 * Amazon CloudFront The court found that for the first data transfer to Amazon CloudFront, the data remained within the EU. In the second instance, the data was transferred to the United States due to a technical adjustment caused by the data subject. Since the transfer to the United States was caused primarily by the data subject's conduct the court found no sufficiently direct causal link between the Commission's allegedly unlawful conduct and the non-material damage claimed by the data subject. * Facebook sign-in The court found that through the “sign-in with facebook” hyperlink displayed on the EU login webpage, the Commission created the conditions for the transfer of personal data to Meta Platforms, which is established in the United States. Therefore, the transfer of data was attributed to the Commission. The court stipulated that at the time of the transfer, there was no decision by the Commission showing that the United States ensure an adequate level of protection for personal data. The Commission neither showed that appropriate safeguards were in place nor that standard data protection clauses or contractual clauses protected the personal data. The court established that the “sign-in with facebook” function was administered entirely according to Meta’s terms and conditions and therefore without appropriate safeguards. Therefore, the Commission did not comply with the required conditions for transfer of personal data by an EU institution to a third country contrary to Article 46 EUDPR and Article 48 EUDPR. As the data subject found himself in a position of uncertainty as regards the processing of his personal data, in particular of his IP address, the court assessed that he had suffered non-material damage and ordered the Commission to pay him damages valued at €400.

Decision date: 29 January 2025

Cited provisions: Art. 56(1) GDPR, Art. 60(3) GDPR, Art. 60(4) GDPR, Art. 65(1)(a) GDPR, Art. 4(24) GDPR, Art. 6(1) GDPR, Art. 9 GDPR

In 2018 three data subjects, from Belgium, Germany and Austria respectively filed complaints with the DPAs in their home countries. The data subjects were represented by noyb - European Center for Digital Rights. The complaints were filed against Facebook Ireland Ltd and WhatsApp Ireland Ltd (the controllers, both now Meta) regarding alleged illegal processing of data, including special categories of data. The alleged infringements pertained to the processing activities on the services Facebook, Instagram and WhatsApp. Given the cross-border nature of the processing and the establishment of Meta in Ireland, the Irish DPA (DPC) was the lead DPA responsible for handling those complaints, Article 56(1) GDPR. Following the DPC's three investigations, it submitted to the other concerned DPAs three draft decisions pursuant to Article 60(3) GDPR. In these draft decisions, the DPC considered, inter alia, that the data subjects had failed to demonstrate that the controllers could not rely on Article 6(1)(b) GDPR. Several of the other concerned DPAs objected to the DPC’s assessments and after failing to reach a consensus between the DPAs, the DPC submitted the matter to the EDPB according to the consistency mechanism established in Article 60(4) GDPR. The EDPB adopted Binding Decisions 3/2022, 4/2022 and 5/2022 on 5 December 2022 under Article 65(1)(a) GDPR. Finding most of the objections to the DPC’s draft decisions were relevant and reasoned, within the meaning of Article 4(24) GDPR the EDPB did not follow the DPC's analysis that the controllers could, a priori, rely on Article 6(1)(b) GDPR. Therefore, it demanded that the DPC exclude from its final decisions the finding that it was not necessary to have the users’ consent for the data processing carried out. By contrast the EDPB required the DPC to find in its three final decisions certain infringements GDPR, in particular of Article 6(1) GDPR, and to adopt corrective measures in respect of the controllers. Furthermore the EDPB found the scope of the investigation and analyses by the DPC excessively narrow. Thus, the EDPB instructed the DPC firstly to carry out a new investigation in order to determine, whether the processing operations carried out by the controllers in the context of its Facebook, Instagram and WhatsApp sevices relate to special categories of personal data, within the meaning of Article 9 GDPR. The DPC must also assess whether the processing is used for targeted advertising, marketing or otherwise for the purpose of improving the service, and if WhatsApp complies in that regard with the GDPR obligations. Secondly the EDPB ordered the DPC to issue a new draft decision under Article 60(3) GDPR. The DPC disputed the EDPB’s power to impose such measures, alleging that the EDPB exceeded the competence conferred on it by Article 65(1)(a) GDPR because primarily this provision cannot be interpreted to permit Binding Decisions regarding the scope of a lead DPA's investigation and decision. = The court found the DPC's challenge admissable, arguing that the DPC could just seek the annulment of the binding decisions. It therefore dismissed the EDPB's argument, that because the DPC only disputed the EDPB's instructions not the DPAs objections as being relevant and reasoned within the meaning of Article 4(24) GDPR its competence could not be questioned following Article 65(1)(a) GDPR. The court held, that the classification of the objections only constitutes the grounds of a legal act and are not in themselves capable of forming the subject of an action for annulment, as they do not produce legal effects. Therefore it was sufficient, the court held, that the DPC expressly disputes the EDPB’s interpretation of Article 4(24) GDPR concerning the concept of ‘relevant and reasoned objection’ without formally seeking their "annulment". The court also affirmed the DPC's interest in having the contested instructions annulled. Although the DPC did not dispute its obligation to reassess whether Meta needs the consent of users and reexamine the case, the court held, that this does not in itself imply the EDPB's power to impose such measures by binding decision = The court held, that the wording of Article 65(1)(a) GDPR, Article 65(6) GDPR and Article 4(24) GDPR and Recitals 126 and 136 GDPR does not limit the scope of an EDPB binding decision regarding objections to the considerations set out in the draft decision. Consequently, if it appears that the case file is insufficient for the purpose of carrying out the required analysis in full, the EDPB must be able to require the lead DPA to undertake further investigation. The court held, that Article 65(6) GDPR - which requires final decisions to refer to the lead DPA's decision - does not defines the the scope or the legal effect of a binding decision on the basis of Article 65(1)(a) GDPR; this provision only specifies the rules for the adoption of final decisions of the competent DPAs where those decisions may be adopted immediately on the basis of an EDPB binding decision. This, the court stated cannot be invalidated by the wording of Recitals 126 and 136 GDPR as they relate purely to procedural matters. The court held, that the scope of the investigation is not a procedural matter as it relates to the substance of the case, since it determines what must be examined in order to assess whether the processing at issue complies with the GDPR. The court also dismissed the DPC's argument that this interpretation enables the EDPB to completely direct the lead DPA whenever a question raised by a DPA concerned is classified as a relevant and reasoned objection. The court stated, that such objections may only relate to questions of substantial GDPR compliance not to the conduct of the investigation itself (as opposed to the scope of the investigation). The court held, that contrary to the DPC's contextual argument, that the short deadlines provided in Article 60(5) and (6) GDPR suggest that a revised draft decision cannot include major amendments. The court found, that these Articles cannot be applied where a new investigation is needed but only where the draft decision can immediately be amended. Additionally, the court stated, that the cooperation procedure between DPAs, described in Article 60 GDPR cannot be seen as a ‘one-way’ procedure in which the stages always follow in the order of the provisions providing for them. The court also dismissed the DPC's argument that read in the light of Recital 141 GDPR, Article 57(1)(f) GDPR demonstrates that the scope of the investigation following a complaint is within the discretion of the national DPA subject only to national judicial review. The court held, that the EDPB's review powers do not undermine the DPA's task to handle complaints and the possibility of judicial review of interim DPA decision by national courts does not prevent the draft decision of the lead DPA from itself being subject to review by the EDPB. The DPC submits that recognising the EDPB's power to direct a lead DPA to issue a new draft decision and broaden the scope of its investigation beforehand is not consistent with the purpose of the ‘one-stop-shop’ mechanism. However, the court rebuts this argument, by holding that procedural simplification cannot take precedence over the essential objective of the GDPR to ensure the protection of personal data. Furthermore, the negative effects of more complicated procedures for the persons concerned could be avoided if the lead DPA carries out an appropriate investigation and analysis from the outset. Insofar as the DPC argues referring to Article 58(4) and Recital 141 GDPR that disagreement between DPAs is to be resolved through judicial review in the national courts, the court held, that this cannot mean that persistent disagreements between the DPAs cannot be resolved within the EDPB, as the GDPR establishes the framework of the cooperation mechanism between DPAs exactly for that purpose. = The court held that the EDPB's power is exercised only in the event of a clearly identified shortcoming by the lead DPA and that that power results from the collective assessment of the DPAs comprising the EDPB. The court held that following the above analysis of Article 65 GDPR there is no doubt that the EDPB has the contested competence and therefore that it is expressly provided for by the legislature. While the court agreed, with the DPC that the exercise of the EDPB’s power is subject to judicial review it maintained its own ability to examine the legality of the very substance of the binding decisions giving instructions to the DPAs based on the EU legislature's decision that persistent disagreements between DPAs should be arbitrated in the context of the consistency mechanism within the EDPB. The court also stated, that an EDPB binding decision does not call into question a DPA's ability to prioritise the performance of its various tasks as an independent authority - which is for the national court alone to review - as it only provides binding decisions in exceptional cases. Therefore, the court found, that contrary to the DPC's assesment, the EDPB's powers are in line with the ‘Meroni doctrine’, stating that the principles of EU law require powers to be precisely delineated and amenable to judicial review.

Decision date: 16 April 2024

A data subject was hired by the Chief Directorate for the Execution of Punishments (the Chief Directorate) as a prison guard in July 2004. This position required no prior convictions, sentences, or substitute administrative penalties. In the period between his application and hiring, the data subject was found administratively liable for driving under the influence of alcohol and was issued a substitute administrative penalty and fine by the Troyan District Court. In accordance with Bulgarian law, a record card for the penalty was stored in the Troyan District Court’s criminal records bureau. In August 2012, the data subject applied for a post in the Ministry of Justice directorate ensuring the security of the judiciary. The Ministry of Justice obtained a criminal report that included the data subject’s substitute administrative penalty and on the basis of that data, rejected the data subject from the post. The criminal record report was also sent to the Chief Directorate, which dismissed the data subject from his post as a prison guard as a result of the substitute administrative penalty. After learning of his rejection from the Ministry of Justice’s position, the data subject requested that the Troyan District Court destroy the record card in accordance with Regulation 31(1), which required record cards for substitute administrative penalties to be destroyed five years after the judgement imposing the penalty had become final. Judicial Complaint Challenging Dismissal: The data subject sought judicial review from the Sofia City Administrative Court concerning the dismissal from his employment a prison guard, claiming that the Chief Directorate obtained the data about his penalty unlawfully. He argued that criminal record reports could only be used for law enforcement purposes. The court dismissed the claim in February 2014. The data subject appealed the ruling. In February 2015, the Supreme Administrative Court upheld the lower court’s judgement, holding that under the law, prison officers with substitute administrative penalties had to be dismissed. It considered that the law did not require the data about the penalties to be obtained in any particular way, and thus dismissed the data subject’s arguments as irrelevant. DPA Complaint Challenging Unlawful Disclosure of Data: In November 2012, the data subject also filed a complaint with the Bulgarian DPA (CPDP) claiming that the Ministry of Justice processed his data unlawfully because the Troyan District Court had kept the record card for his penalty past October 2009 despite the expiry of the five year retention period under Regulation 31(1). The Ministry of Justice argued that the retention period applied only to the record cards, not to the data therein. The CPDP upheld the data subject’s complaint in June 2013, finding that the retention of the data by the Troyan District Court after the expiry of the five year retention period infringed section 2(2)(2) of the Protection of Personal Data Act of 2002, which required data to be collected for specified, clearly defined and lawful purposes. It thus found the Troyan District Court’s disclosure of the data subject’s record to the Lovech District Court unlawful and issued a fine on the district court. The Troyan District Court sought judicial review. The data subject also withdrew his complaint to the Commission because he had not directed his complaint against the Troyan District Court and did not agree with the CPDP’s findings against it. In November 2013, the Sofia City Administrative Court found the CPDP’s decision null and void on the basis that the Commission’s competence had retroactively disappeared given the withdrawal of the complaint. The Supreme Administrative Court upheld the judgment in November 2014, rejecting the CPDP’s appeal. It found that the CPDP had erred in fining the Troyan District Court because the data subject’s complaint had been directed solely against the Ministry of Justice. It also held that the Troyan District Court had processed the data subject’s criminal data lawfully because Regulation 31(1) only applied a five year retention period to the card. The data therein was subject to another regulation, Regulation 28(3), which noted that the earmarking of a card for destruction is to be recorded in the corresponding criminal records bureau’s alphabetical index without erasing the names of the people concerned and the related data from the index itself. ECtHR Appeal: In August 2015, the data subject applied to the European Court of Human Rights arguing that his data was unlawfully processed under Article 8 of the Convention of Human Rights (the right to respect for private and family life). He advanced two claims: # The disclosure of the criminal record card data in 2012-2013 was unlawful. # The retention of those data is unlawful. The ECtHR found that the retention of the data was not sufficiently foreseeable given ambiguity in Bulgarian regulations, resulting in a violation of Article 8(2) of the Convention. = The Court dismissed the data subject’s first claim of unlawful disclosure of criminal record data because it did not satisfy Article 35(1) of the Convention’s admissibility criteria – the appeal was not filed within six months from the date of the final decision. With regard to the second claim, however, the ECtHR found that ongoing retention was a continuing situation and thus complied with the six-month window under Article 35(1) of the Convention. The Court also noted that the second claim satisfied Article 35(3) of the Convention’s admissibility criteria, noting that the data subject was a victim of the ongoing violation and that, although the data subject did not suffer a significant disadvantage, the ongoing retention concerned respect for human rights and thus obligated an examination on the merits. = Conduct must meet three criteria to constitute a breach of Article 8(2) of the Convention. First, there must be an interference with the right to respect for private life. Second, the interference must not be justified. An interference is justified where it is “in accordance with the law,” pursues one or more legitimate aim and is “necessary in a democratic society” to attain the aim(s). The ECtHR noted that it is settled that the processing of data about criminal convictions and related measures concerns the private life of data subjects under Article 8 of the Convention, and that the processing of such data by authorities interferes with that right. This is the case even when the data are based on a court judgement delivered in public (citing E.B. and Others v. Austria; Biancardi v. Italy, no,. 77419/16; Hubrain v. Belgium, no. 57292/16). The ECtHR found that this interference was not justified. To be “in accordance with the law,” an interference must not only have a basis in domestic law, but it must be accessible and sufficiently foreseeable. The regulations governing ongoing retention of data of substitute administrative penalties in this case are not sufficiently foreseeable. Those regulations lay down a clear time-limit (5 years up until February 2013, and 15 years since after an amendment) for keeping record cards for substitute administrative penalties. By contrast, the regulations are ambiguous on the question of whether the electronic data derived from those cards are to be deleted alongside the record cards themselves, or whether they are to be retained for longer or indeed indefinitely. The disagreement between the Bulgarian Ministry of Justice (which considered that the regulations required indefinite retention) and the CPDP (which considered that the regulations required the data to be deleted along with the cards) highlight the ambiguity of the regulations. In considering the Supreme Administrative Court’s decision, the ECtHR noted that the court failed to square the indefinite retention period with the principle of storage limitation in data protection law. Finding that the retention of data was not sufficiently foreseeable and thus interference was not in accordance with the law, the ECtHR found a violation of Article 8(2) of the Convention. The ECtHR rejected the data subject’s claim in respect of loss of earnings because the claim concerning the disclosure of the data and resulting dismissal was declared inadmissible. The ECtHR also rejected the applicant’s claim for non-material damages because there is no evidence of real detriment to the data subject. The ECtHR did, however, award lawyer’s fees in the amount of EUR 2,900 plus tax for lawyer and translation fees.

Decision date: 4 May 2022

Cited provisions: Art. 4(1) GDPR

An academic (the complainant) received EU funding for a research project and was discovered to have fraudulently claimed the money in personal expenses. OLAF recommended that the European Research Council Executive Agency (ERCEA) take appropriate measures to recover the sums and initiate proceedings for fraud and use of forgery. Within a year, OLAF issued a press release on the matter labelled [https://anti-fraud.ec.europa.eu/media-corner/news/olaf-investigation-uncovers-research-funding-fraud-greece-2020-05-05_en No. 13/2020.] The complainant argued that the press release identified her and in doing so OLAF had infringed Regulation (EU) 2018/1725.The Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the institutions, bodies, offices and agencies of the Union and on the free movement of such data is the version of the GDPR applicable to EU institutions. She agued that using the data contained in the press release, a reader could identify the fact that she was a Greek national woman, the amount of the funding, and the fact that her father worked at the same university. Moreover, a German Journalist had already identified her using the the press release and written an article about her. For this perceived breach, the complainant requested €1.1 million in damages. The General Court held that there was no personal data contained in the press release under Article 3(1) Regulation 2018/1725 (and 4(1) GDPR), because the applicant was not identified, and was not identifiable according to the 'means reasonably likely to be used' (Recital 16 Regulation 2018/1725 and Recital 26 GDPR). The General Court decided that whether OLAF’s press release contained personal data is tied not only to the ‘means reasonably likely to be used’ to identify the applicant but also by the ‘average or likely reader’ of said press release (para 76). The General Court therefore, disregarded the actual identification of the complainant by the German journalist. It argued that this journalist could not be considered an average reader since he was a professional with wide qualifications and an insider’s perspective due to his information network. Furthermore, the journalist appeared to be a daily reader of OLAF’s publications, which the General Court considered to be unusual (para 80). Since the General Court ruled that there was no breach, it did not go on to rule on damages.

Decision date: 24 May 2023

Cited provisions: Art. 6(1)(c) GDPR

The European Commission made information requests to Meta Platforms Ireland Ltd (Meta) on the implementation of the rules on competition laid down in Articles 101 and 102 TFEU. Following the requests, the Commission adopted a further decision under Article 18(3) of Regulation 1/2003 on the implementation of the rules on competition laid down in Articles 81 and 82 of the Treaty. Under the decision, the Commission requested Meta to provide, inter alia, a number of internal documents meeting certain cumulative criteria. With regard to providing the information, the Commission proposed a separate procedure for sensitive documents which, according to Meta, contained only personal information wholly unconnected with its commercial activities. Those documents would be examined first in a virtual data room and placed on the file only after having been deemed relevant for the investigation. Moreover, Meta had the possibility to redact documents containing personal information. Meta sought for the annulment of the decision before the General Court. Essentially, Meta relied on four pleas in law – of which one was Meta alleging, inter alia, infringements of the right to privacy. Meta claimed that, by requiring the production of numerous irrelevant documents of a private nature, the decision infringes, inter alia, its right to privacy and that of its staff and third parties, as protected by Article 7 of the Charter and Article 8 ECHR. Furthermore, Meta argued, inter alia, that the Commision’s interference is not provided for by law. Meta claimed that where it would be required to provide information, which Meta argued to be irrelevant for the purposes of the investigation, it would in fact contravene Article 6(1)(c) GDPR. The Commission contended that the Court should declare Meta’s head of claim inadmissible and dismiss the action. The Court examined whether the contested decision complies with Article 7 of the Charter and the conditions set out in Article 52(1) of the Charter. Article 52(1) of the Charter provides that any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the EU or the need to protect the rights and freedoms of others. According to the Court, Meta cannot question the fact that the limitation to the right to privacy would not be provided by law in this case: the Commission adopted its decision on the basis of Article 18(3) of Regulation 1/2003 on the implementation of the rules on competition laid down in Articles 81 and 82 of the Treaty which gives the Commission the power to adopt decisions requesting such information. Furthermore, in light of the principle of proportionality, the Court considered that the decision adopted by the Commission does meet the objectives of general interest recognised by the EU: the decision expressed the exercise of the Commission’s powers under the said regulation, which contributes to maintaining competition intended by the EU treaties, which the Court viewed businesses to have an absolute duty to comply with. After an exhaustive assessment in light of Article 52(1) of the Charter, the Court held that Meta had not established that the decision constituted an unjustified interference with its privacy or that of members of its staff or of other persons. The Court rejected Meta's claims in this regard.

Decision date: 6 September 2023

From 1 November 2017 until 30 September 2019 the data subject was a temporary employee at the Single Resolution Board (SRB). On 29 September 2019, via email, the data subject requested from SRB a copy of all his personal data and all data referring to his person stored at SRB, based on the Regulation 2018/1725. This was because there had been two instances of access to his personal data stored in the European Commission’s personnel management IT system, on 12 June 2019. Thus, he wanted the EDPS to investigate whether those instances of access could have constituted a breach of his personal data. He also requested that measures be taken to prevent any unauthorised access, modification, processing or disclosure of his personal data stored at the SRB. On 17 February 2020, he reiterated his request to the SRB to confirm whether or not personal (in particular, HR-related) data concerning him was being processed, to provide a copy of his personal data and to restrict the processing of his personal data, while objecting to the processing of his personal data. On 28 February 2020, the DPO replied the data subject with certain data concerning him, stating that SRB applies by analogy the Common Commission-level retention list for European Commission files and in view of Articles 11, 26, 81 and 127 of the applicable [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A01962R0031-20140501 Staff Regulations of Officials of the European Union and Conditions of Employment of Other Servants of the European Union], the SRB had the legal obligation to store personal file in accordance with the retention list and that his personal file was now archived and would be stored up to 8 years after the extinction of all his rights, and for at least 120 years after his birth date. On 8 March 2020, the data subject requested the SRB to delete his personal data processed by the latter and reiterated his request for restriction of the processing of his personal data and for objection to the processing of such of his personal data which are not to be deleted. By emails of 20 March and 17 and 20 April 2020, the data subject reiterated his request for erasure, withdrawing his consent to the processing of those data by the SRB. On 30 April 2020, the DPO responded to emails rejecting a request for data erasure. The DPO stated that SRB had a legal obligation to retain the individual's personal file based on European Commission rules and Staff Regulations. The DPO also emphasized that the data could not be deleted and explained the lengthy retention period of 120 years after the individual's birth date. He also mentioned the requirement to keep data in a single personal file to any EU institution as a potential new employer, and some of the data in the personal file were also kept in the context of a further and/or future financial obligation for its staff or their family members. Additionally, the DPO cited legal obligations for data retention under Regulation 2018/1725, which prevented the right to object. Regarding a request for data processing restriction, the DPO asked the applicant to specify the data whose accuracy he disputed according to Regulation 2018/1725. On 20 March 2020, the data subject lodged a complaint with the EDPS against the SRB claiming that the processing and storage for 120 years violates his rights entitled by Regulation 2018/1725, in particular his right to erasure (“right to be forgotten”) of Article 19, right to restriction of processing of Article 20 and the right to object of Article 23. In the complaint, the data subject then asked the EDPS to instruct the SRB to comply with his requests in exercise of his rights, in particular the requested erasure of his personal data. On 18 January 2021, the EDPS rejected the complaint by the first contested decision concluding: * As for the right to erasure of Article 19 of Regulation 2018/1725, read in the light of Article 26 of the Staff Regulations, the SRB was under a legal obligation, within the meaning of Article 19(3)(b) of Regulation 2018/1725, to keep the content of the applicant’s personal file. * Regarding the right to object to the processing of personal data of Article 23(1) of Regulation 2018/1725, the EDPS recalled that, under Article 5(1)(b) of Regulation 2018/1725, processing of those data was lawful if it was necessary for compliance with a legal obligation to which the controller of the personal data was subject and this was indeed the case here. * Request for restriction of the processing of his personal data, based on Article 20(1) of Regulation 2018/1725, the EDPS also considered that it should be refused. First of all, the EDPS rejected the applicant’s argument based on the assumption that his personal data held by the SRB were incomplete or inaccurate. He then noted that the processing was lawful within the meaning of Article 5(1)(b) of Regulation 2018/1725, since it was necessary for compliance with a legal obligation to which the SRB was subject pursuant to Article 26 of the Staff Regulations. * Lastly, he recalled that the applicant had no right to object under Article 23 of Regulation 2018/1725, as previously established. The EDPS concluded therefrom that the applicant had no ground, in terms of Article 20(1) of that regulation, to obtain from the SRB a restriction of the processing of his personal data. After a reviewal request made by the data subject on 17 February 2021, on 9 March 2021, the EDPS refused the applicant’s request for review by the second contested decision. The data subject claimed for an annulment of the decision by European Data Protection Supervisor (EDPS) of 18 January 2021 rejecting his complaint (‘the first contested decision’), and of the decision from 9 March 2021 refusing his request for review of the first contested decision (‘the second contested decision’) (together, ‘the contested decisions’) and a compensation of €20,000 for the damage which he claims to have suffered as a result of the contested decisions. CJEU highlighted that the SRB was right to refuse the data subject’s request. Regarding the right to erasure, SRB have a legal obligation under Article 26 of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A01962R0031-20140501 Staff Regulations], which requires them to keep all documents concerning the administrative status of the official or servant concerned and all reports relating to his or her ability, efficiency and conduct. This retention was necessary for pension rights and other potential legal claims. The applicant did not develop any legal argument concerning the examination of the retention period for personal data in the light of the principle of proportionality and his complaint was limited to the request seeking erasure, the exercise of the right to object, and the exercise of the right to restrict the processing of the applicant’s personal data. Ultimately, the court understood that EDPS did not infringe the right to good administration and that they acted in accordance with the law, and if the applicant wished to challenge the proportionality of the retention period, he could file a new complaint for further examination. Regarding the second decision, the Court upheld the EDPS's decision to deny the review request, as the data subject did not provide new evidence or legal arguments justifying a review, and certain issues raised in the review request were outside the scope of the original complaint and decision. The Court rejected all the data subject claims for review of the two decisions issued by EDPS and dismissed the compensation request of €20,000 since no unlawfulness vitiating in both decisions has been established.

Decision date: 26 April 2023

Following its decision concerning a resolution scheme, a controller (the Single Resolution Board or SRB) invited affected shareholders and creditors (the data subjects) to express their interest to be heard through an online form. In order to be heard, the shareholders and creditors had to submit supporting documentation to SRB, including proof of identity and ownership (the registration phase). The identified shareholders and creditors submitted their comments to SRB (the consultation phase). These comments were examined by SRB and by a third party. SRB had published a privacy statement on its website, but it did not mention the third party as a recipient of the personal data collected in this consultation phase. Comments submitted by the shareholders and creditors were each assigned with an alphanumeric code. Some comments were transmitted to the third party with the alphanumeric code associated to the comment. The EDPS received five (5) complaints from shareholders and creditors who had submitted comments (the complainants). The complainants' argued that SRB had not informed them about the fact that their comments collected in the consultation phase would be transmitted to a third party. In its original decision, the EDPS found that SRB had infringed [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Article 15(1)(d) of the] [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Regulation 2018/1725] (the Regulation) because it had not informed the complainants about the disclosure of their personal data to the third party in question. SRB argued that the information that was transmitted to the third party did not constitute personal data and requested the EDPS to revise its original decision. In its revised decision, the EDPS upheld its view of SRB infringing its obligation to inform the data subjects about the recipients of their personal data. Furthermore, the EDPS specified that (1) the disclosed data constituted pseudonymous data (i.e. personal data) because SRB had also shared the alphanumeric codes with the third party – notwithstanding the fact that the third party had not receive additional information necessary to identify the the data subjects, and that (2) the third party is a recipient pursuant to [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Article 3(13) of the Regulation]. SRB seeked for an annulment of the EDPS’s decision before the European General Court. The General Court agreed with the EDPS that the fact that the third party did not have the additional information necessary to identify the authors of the comments, does not alone exclude that the information transmitted would not constitute personal data. However, the General Court , by citing [https://curia.europa.eu/juris/document/document.jsf?text=&docid=184668&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=5578095 Case C-582/14 Breyer], considered it is necessary to make the assessment from the view of the third party receiving the information in order to determine whether the information transmitted constituted personal data. The General Court viewed that the EDPS was wrong to assess the question from the controller’s (SRB) view and not from the third party’s view who received the information in question. The EDPS should have determined whether the possibility of combining the information that had been transmitted to the third party with additional information held by the controller constituted “means likely reasonable” to be used by the third party for identifying the data subjects. Eventually, the General Court ruled that the EDPS had not appropriately investigated whether the third party had legal means available to it which could, in practice, enable it to access the additional information necessary to re-identify the data subjects. Therefore, the General Court viewed that the EDPS could not conclude that the information transmitted to the third party constituted personal data within the meaning of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1725 Article 3(1) of the Regulation]. The General Court ordered that the EDPS’s revised decision must be annulled, and so the controller was successful in its appeal.

Decision date: 11 June 2015

The claimant, Colin Boy McCullough, was an employee at the European Centre for the Development of Vocational Training (Cedefop) from 1991 to 2007. The claimant was the personal assistant of the director of the that European public authority (Cedefop) from 1997 to 2005. The European Anti-Fraud Office (OLAF) and Cedefop made allegations against him in proceedings before the Greek criminal courts in 2013. The claimant had to prepare his written defence before the Greek judge. He requested the authority to provide access to the minutes of all meetings of its Governing Board, its Bureau and the ‘Knowledge Management System’ Steering Group for the period of 2002 and 2005. The European public authority rejected the claimant’s request, on the basis of Article 4(1)(b) (privacy and the integrity of the individual would be undermined) of Regulation 1049/2001. The applicant then sent a confirmatory application to Cedefop for access to the documents according to Article 7(2) Regulation No 1049/2001. He stated in his application that Cedefop interpreted the exceptions to the right of access too broadly and vaguely and failed to examine whether there was a specific and actual risk that the interests protected by those exceptions would be undermined. On the 15th of July 2013, Cedefop rejected the claimant’s confirmatory application and refused access to the requested documents because it considered that the names of its governing Board and its Bureau, contained in these minutes, constituted personal data protected by Article 4(1)(b) of Regulation 1049/2001 and the Regulation No 45/2001. Thus, the access of third parties to these documents would lead to a serious violation of the privacy and the integrity of the members, their opinions and their views. Thus, the claimant brought an action for annulment under Article 263 TFEU of the decision of Cedefop of the 15th of July 2013. He asked for the annulment of the contested decision and to order the public authority to provide him the requested documents and to pay the costs. Preliminary considerations In its judgment, the General Court recalls that the exception found in Article 4 of Regulation No 1049/2001 must be interpreted and applied strictly. The institution refusing access to a document which it has been asked to disclose must explain how disclosure of that document could undermine the interest protected by the exception upon which it is relying. The General Court went on to establish that Regulations Nos 45/2001 and 1049/2001 do not contain any provisions granting one regulation primacy over the other and thus their full application should be ensured. In its paragraph 43, the Court underlines that “Article 4(1)(b) of Regulation No 1049/2001 is an indivisible provision and requires that any undermining of privacy and the integrity of the individual must always be examined and assessed in conformity with the EU legislation concerning the protection of personal data”. It establishes, through the case law of Bavarian Lager (C 28/08 P), that Article 4(1)(b) of Regulation No 1049/2001 establishes a specific and reinforced system of protection of a person whose personal data could be communicated to the public. Therefore, the provisions of Regulation No 45/2001 are applicable in their entirety when a request is based on Regulation No 1049/2001. The infringement by misinterpretation of Article 4(1)(b) of Regulation No 1049/2001 • The existence of personal data and the application of Regulation No 45/2001 The Court relied on the interpretation of Bavarian Lager to explain that surnames are personal data and protected by Regulation No 45/2001. Following the precedence set by the judgment Strack (C-127/13 P), the Court mentioned that the surnames may be transferred to a third party on the basis of Regulation No 1049/2001 only where that transfer fulfils the conditions laid down in Article 8(a) or (b) of Regulation No 45/2001 and constitutes lawful processing in accordance with the requirement of Article 5 of the same Regulation. The person requesting the access must establish the necessity of transferring the requested data, in line with Bavarian Lager. In the case at hand, the claimant did not provide any information/justification as to how the submission of the requested documents containing that data would affect the national proceedings to which he is a party and the risks to which he would be exposed in procedural terms. Having failed to demonstrate the necessity of the transfer of data, the General Court rejected his argument. • The absence of any risk that the protection of the privacy of the members of Cedefop’s Governing Board and Bureau would be undermined by the disclosure of their views and opinions The Court recalls through the case law of Sweden and Turco that the exceptions to Article 4 of Regulation No 1049/2001 must be interpreted and applied strictly. Specifically, according to the interpretation of the case Sweden and Turco (C-39/05 P), the institution, which decided to refuse the access to a document which it has been asked to disclose, must explain how granting access to that document could specifically undermine the interest protected by the exception under Article 4(1)(b) of Regulation No 1049/2001. In the case at hand, the public authority did not prove that the disclosure of those views or opinions in the document could undermine the participant’s privacy and the interests protected under the mentioned provision. Thus, the General Court rejected Cedefop’s argument. Cedefop did not assess whether granting access to the requested documents would specifically and actually undermine the interest relating to the protection of privacy and the individual. The General Court found a violation of Article 4(1)(b) of Regulation No 1049/2001. Therefore, it annulled the contested decision, and ordered Cedefop to pay its own costs as well as three quarters of the costs incurred by the claimant. Mr McCullough bear the remaining costs.

Decision date: 7 December 2022

Cited provisions: Art. 4(1) GDPR, Art. 12(1) GDPR, Art. 13(1)(d) GDPR, Art. 65(1)(a) GDPR, Art. 83 GDPR

Following the entry into force of the GDPR, the Irish DPA received complaints from users and non-users (the data subjects) of the ‘WhatsApp’ messaging service concerning the processing of personal data by WhatsApp Ireland Ltd (the controller). The Irish DPA, in its capacity as lead supervisory authority, started an investigation into the controller’s compliance with the obligation of transparency and the obligation to provide information with regard to individuals. Following that investigation, the Irish DPA submitted a draft decision to all the other supervisory authorities of the Member States concerned. Since no consensus was reached on that draft, the Irish DPA referred the matter to the European Data Protection Board (EDPB). On 28 July 2021, the EDPB adopted a binding decisionbinding decision 1/2021 of the EDPB of 28 July 2021, in which it ruled on the matters which, in its view, had been the subject of relevant and reasoned objections by some of those authorities. After receiving that decision, the Irish DPA adopted a final decision on 20 August 2021, in which it found that the controller had infringed certain provisions of the GDPR. The Irish DPA imposed corrective measures on the controller, in particular administrative fines for a cumulative amount of €225 million. The controller, in parallel, challenged the final decision before an Irish court and requested that the Court annul the contested decision in its entirety or, in the alternative, annul the relevant parts of that decision. As a preliminary point, the Court mentioned three conditions that must be met for an applicant (other than the ‘privileged’ applicants pursuant to Article 263(2) TFEU) to challenge an act, where it is not the addressee. First, the act must have binding legal effects capable of affecting the interests of the applicant by bringing about a distinct change in his legal position. Second, the act must be of direct concern to the applicant and, third, the applicant must be individually concerned by that act. = In that regard, the Court considered that the contested decision did not in itself change the controller’s legal position. Unlike the final decision of the Irish DPA, the contested decision was not directly enforceable against the controller. It constituted a preparatory act in a procedure, which must be closed by the adoption of a final decision. Moreover, the Court held that the contested decision had no legal effect against the controller that was independent of the final decision of the Irish DPA. All the assessments made in the binding decision were repeated in the final one, and the binding decision had no effect that was independent of the content of the final decision. Thus, the fact that an intermediate act expressed the definitive position of an authority that would have to be taken up in the final decision, did not necessarily mean that that intermediate act itself changed the applicant’s legal position. = The Court noted that, in the light of the nature of the contested act, which is an individual act, the controller was individually concerned by the contested decision. It related to certain aspects of a draft final decision of the Irish supervisory authority concerning it specifically. Contrary to what was argued by the EDPB, the contested decision was not limited to setting out principles or the interpretation of certain provisions of the GDPR that might concern any controller. In the contested decision, the EDPB ruled on the controller’s compliance with some of its obligations under the GDPR, regar a form of processing carried out solely by WhatsApp, and rules on certain corrective measures to be imposed on WhatsApp, in particular on certain aspects of the determination of the administrative fines to be imposed on it. The contested decision is thus specific to the controller. Even though it included a statement or reiteration of principles and interpretations of a general nature. = Next, the Court observed that the controller was not directly concerned by the contested decision. The Court noted that a measure was of direct concern to an applicant who is not an addressee, if it (1) directly affected that applicant’s legal situation and, (2) left no discretion to its addressees, who were entrusted with the task of implementing it. Such implementation being automatic and resulting from EU rules without the application of other intermediate rules. Regarding the first condition, the Court recalled that the contested decision was not enforceable against the controller in a way that would impose obligations on the controller without further procedural steps. The Court held that, the contested decision was not the final step of the full procedure provided for by the GDPR. With regard to the second condition, the Court found that it left a measure of discretion to the Irish DPA as to the content of the final decision, in particular to establish the amount of the administrative fines. Lastly, the Court noted that the inadmissibility of the controller’s action was consistent with the logic of the system of judicial remedies established by the TEU and the TFEU. The Court stated that the TFEU established a complete system of legal remedies designed to ensure judicial review of the legality of acts of the European Union, in which the national courts also participate. In particular, the possibility of bringing a direct action for annulment before the CJEU, or of making a request for a preliminary ruling. Individuals can challenge the validity of such an act before the national court. The national court, in turn, was able to make a request to the Court of Justice for a preliminary ruling. Individuals can however not, by reason of the conditions for admissibility, directly challenge EU acts before the Courts of the European Union. The Court stated that the logic of that system was that the judicial action of the Court of Justice of the European Union and that of the national courts complement each other effectively. The Courts of the European Union and the national courts should not be required to rule concurrently, in parallel proceedings, on the validity of the same EU act. In conclusion, the Court, for the first time, ruled on an application for annulment of a binding decision of the EDPB. The Court dismissed the action brought by the controller as inadmissible, because (1) it was not directed against an act that is open to challenge under Article 263 TFEU and (2) the controller was individually, but not directly concerned by the contested decision, within the meaning of the criteria for locus standi laid down in that article. The validity of the contested decision may be examined by a national court hearing an action against the subsequent final decision that closes the procedure and is adopted at national level.

Decision date: 6 December 2021

Cited provisions: Art. 5(1)(e) GDPR, Art. 25(1) GDPR

On 30 October 2019, the Berlin Data Protection Authority (DPA) fined Deutsche Wohnen SE 14,500,000 € for violating Article 5(1)(e) and Article 25(1) of the GDPR, as the company's archive system was structurally unable to delete unnecessary data. Deutsche Wohnen, a publicly listed real estate enterprise managing around 163,000 housing units and 3,000 commercial units through its subsidiaries, processed tenants' personal data, including proof of identity, health and social insurance information, tax data, and details of previous tenancies. The DPA, on its own initiative, conducted an inspection and found that the controller's subsidiaries were storing tenants' personal data without ensuring the ability to delete data that was no longer necessary. The DPA initially ordered Deutsche Wohnen to delete the data by the end of 2017, but the company claimed deletion was impossible due to technical and legal reasons. It argued that the old data would need to be migrated to a compliant system that met statutory retention requirements. Despite an ongoing exchange between the company and the DPA, a follow-up inspection in 2020 revealed no substantial progress in rectifying the GDPR violations. The DPA then issued a penalty order, citing that, from 25 May 2018 to 5 March 2019, Deutsche Wohnen had deliberately failed to take measures to enable the deletion of unnecessary data. The authority also imposed further fines for the continued storage of personal data relating to at least 15 tenants. Deutsche Wohnen appealed the decision, and on 18 February 2021, the Regional Court of Berlin overturned the DPA’s decision, arguing that under German law (specifically Paragraph 30 of the Law on Administrative Offences, OWiG), only natural persons could be subject to administrative fines, not legal entities. The Court held that while the actions of representatives could be attributed to the legal entity, there was no evidence of individual responsibility among Deutsche Wohnen’s representatives. Thus, the company could not be fined. The Berlin Public Prosecutor’s Office appealed this decision. The Kammergericht Berlin, the referring court, is now called upon to rule at final instance. The KG Berlin decided to suspend proceedings and referred the following preliminary questions to the CJEU: (1) Is Article 83(4) to Article 83(6) GDPR of the GDPR to be interpreted as incorporating into national law the functional concept of undertaking and the functionary principle associated with Articles 101 and 102 TFEU, with the consequence that, by extending the principle of legal entity on which Paragraph 30 of the OWiG is based, a fine procedure may be conducted directly against an undertaking and the penalty is not imposed on the determination of a person identified by a natural and identified person: if applicable, a fully tort, committed administrative offence is required? (2) If the answer to Question (1) is in the affirmative, must Article 83(4) and Article 83(6) GDPR be interpreted as meaning that the undertaking must have culpably committed the infringement mediated by an employee (see Article 23 of Council Regulation (EC) No 1/2003 of 16 December 2002 implementing the rules on competition laid down in Articles 81 and 82 of the Treaty), or is an objective breach of duty attributable to the company ("strict liability") already sufficient in principle for a fine of the company?

Decision date: 23 November 2011

The applicant submitted an application requesting public access to all the documents concerning additional pension scheme for Members of the European Parliament. The same was rejected by the European parliament on the ground that such documents contain details regarding the private lives of MEPs and such a disclosure would violate their right to privacy and integrity and would be contrary to Article 8(b) of Regulation (EC) No 45/2001 and Article 4(1)(b) of Regulation No 1049/2001. The court held that the applicant was unable to fulfill the obligation under Article 8(b) of the Regulation No 45/2001 that requires the demonstration of express and legitimate reasons for sharing the requested personal data so that the European parliament can balance the interests of the concerned parties and to determine whether the legitimate interests and the privacy of the MEPs would be violated by transferring the requested data in such a scenario.

Decision date: 7 August 2020

Cited provisions: Art. 4(14) GDPR, Art. 5(1)(c) GDPR, Art. 9(1) GDPR, Art. 9(2)(a) GDPR

Polish DPA became aware of irregularities in the processing of personal data of pupils of the primary school consisting in the collection of fingerprints of children using the services of the school canteen. The school explained that it uses a biometric reader which is placed at the entrance to the school canteen and which identifies children who take meals in the school canteen in order to verify that they have paid for the meal of the day. The school indicated that it obtains the biometric data of its pupils on the basis of the written consent of the parent (legal guardian). The school further informed that upon termination of the contract for the use of lunches in the school canteen, the data needed for fingerprint identification, i.e. the string of bytes stored in the reader, is deleted. Polish DPA also found that, according to the lunch policy posted on the website of the canteen run by the school, pupils without biometric identification let everyone through and wait at the end of the queue , and once all pupils with biometric identification have entered the canteen, the admission of pupils without biometric identification begins one by one. As a result of the analysis of the collected evidence, the Polish DPA ordered the school to delete personal data in the area of digitized information on fingerprint characteristics of children using school canteen services, ordered the school to stop collecting personal data in the area of digitized information on fingerprint characteristics of children using school canteen services, and imposed a fine on the school in the amount of PLN 20,000.00 for the violation found in the decision. As the DPA argued, the common law provisions indicate the type of data that a school may obtain from its pupils, but none of them authorises the processing (acquisition and collection) of pupils' biometric data, the processing of which is in principle prohibited under Article 9(1) of the GDPR, for the purpose of the provision of school canteen services. Can the consent of a parent (legal guardian) be a legal prerequisite for the processing of biometric data? Whether pupil data obtained by the school which includes information on fingerprint characteristics and which has been processed into a digital record constitutes biometric data within the meaning of Article 4(14) of the GDPR? The court held that the DPA, had properly accepted that the pupil data acquired by the school, which included information about fingerprint characteristics processed into a digital record, constituted biometric data within the meaning of the provision of Article 4(14) of the GDPR. The court found that the written statements in which the parents of the pupils to whom the biometric data pertained gave their consent to the processing of the data for the specified purpose in an unambiguous and unquestionable manner - testified to the fulfilment of the prerequisite of Article 9(2)(a) of the GDPR. The court stated that the processing of data to a slightly broader extent than the minimum necessary shall be regarded as admissible, provided that the processed data are closely related to the achievement of the purpose (e.g. facilitate its achievement). Consequently, the court held that it could not agree with the DPA that the school's processing of pupils' biometric data was incompatible with the principle of minimisation in Article 5(1)(c) of the GDPR.

Decision date: 10 December 2020

Cited provisions: Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 15 GDPR, Art. 32 GDPR, Art. 77 GDPR, Art. 78(1) GDPR

By a letter of 18 December 2019, registered at the Court as Case E-11/19, the Board of Appeal for Administrative Matters (BoA) made a request (in the context of appeals against decisions of the DPA of the Principality of Liechtenstein). The BoA requested for an advisory opinion in a case pending before the DPA between Adpublisher AG (a public limited company of Liechtenstein) and "J" for alleged infringement of Articles 5, 6 and 15 GDPR. The DPA upheld J’s complaint concerning the infringement of Articles 5 and 6 GDPR. Further, on its own volition, the DPA determined that there had been an infringement of Articles 7, 15 and 32 GDPR. By a separate letter of 18 December 2019, registered at the Court as Case E-12/19, the BoA made a request for an advisory opinion in a case pending before it between Adpublisher AG and "K" (for alleged infringement of Article 15 GDPR). The DPA upheld K’s complaint in part and determined that there had been an infringement of Article 15 GDPR. Adpublisher challenged both decisions before the BoA and requested that both decisions be set aside. The Court decided, pursuant to Article 39 of the Rules of Procedure, to join the cases for the purpose of the procedure and the final judgment. The questions examined by the court are referring to the general procedure of hearing a complaint under the GDPR and further national appellate proceedings. The first question by the referring body, is whether the proceedings under article 77 and 78(1) GDPR may be carried out without disclosing the identity of a complainant, and whether any grounds must be provided for non disclosing the identity of the complainant. The second question set by the referring body, is whether the free of charge nature of the complaint procedure under article 77 GDPR extends to subsequent proceedings before appellate bodies, or has an impact on the liability of the data subject to be ordered to pay costs. As per the first question examined, the court the Court held that disclosing personal data of a complainant in a procedure initiated by the complainant themselves is necessary in instances where the following would otherwise be inhibited: 1. The ability to carry out obligations under the GDPR, 2. The exercise of the right to effective judicial remedy and due process. Further, the court held that the referring body essentially asks whether the free of charge nature of the complaint procedure under Article 77 GDPR extends to proceedings before appellate bodies or has an impact on the liability of the data subject to be ordered to pay costs. The court held that the data subject cannot be made responsible for costs incurred in relation to proceedings where: 1. They have been made party to these proceedings under Article 78(1) GDPR by virtue of a data controller appealing against a supervisory authority’s decision and, 2.  National law imposes this status on a data subject automatically. Consequently, where a data subject becomes a party to proceedings under Article 78(1) GDPR after a data controller appealing against a supervisory authority’s decision, and where national law imposes this status on a data subject automatically, the data subject may not be made responsible for any costs incurred in relation to those proceedings. ----

Decision date: 27 February 2020

Cited provisions: Art. 9(2)(a) GDPR, Art. 9(2)(g) GDPR

The Provence-Alpes-Côte d’Azur French region (PACA region) authorized a new virtual control access system experimentation in two high schools. This system used facial recognition technologies and was aimed at controlling and ensuring the security. Four associations challenged the lawfulness of the decision aforementioned before the Administrative judge. The Court had to assess whether the control access system processed the students’ biometric data lawfully. The Court upheld the applicants’ arguments by ruling that the decision authorizing the experimentation was unlawful. First, the Court pointed out that the facial recognition system processed underage’s biometric data without a free and informed consent. Hence, the consent was given contrary to Article 9(2)(a), read in the lights of Articles 4 and 7 GDPR. Secondly, the purposes of the processing mentioned in the disputed decision which were linked to the schools' access and security, could not fall under the scope of Article 9(2)(g) GDPR. Therefore, the Court annulled the regional decision which had authorized the virtual access control system experimentation in the two high schools.

Decision date: 26 February 2020

The Data protection authority (AP) dismissed the complainant’s request to issue a sanction against a business for the alleged unlawful recording of personal data with surveillance camera. Indeed, after having carried out on-site investigations, the surveillance camera position has been adjusted to be less visible for the public road. Thereafter, the area monitored corresponded to the plot boundary with the entrance gate and a section of the public road. In this regard, the AP found that the surveillance camera’s owners had legitimate interests in installing the camera, as it was used for security purposes and that one incident already took place. For that purpose, the AP found that a limited part of the public road must be filmed and that it cannot be achieved by another less restrictive mean. In addition, the AP pointed out that the data controllers had implemented sufficient safeguards to inform the passers-by about the installation of the aforementioned camera. The AP concluded that the complainant’s privacy interests did not outweigh those of the data controller. The complainant challenged the AP’s decision before the District Court, which dismissed the appellant’s claims as well. As a consequence, the appellant lodged an appeal against the District Court's decision before the Council of State. The appellant argued that the District Court disregarded that a large part of the public road was monitored by the camera and that the incident which took place did not justify surveillance camera as it only happened once and was not directed against the data controller. In addition, it argued that the AP infriged Dutch administrative law as the authority did not send its report on its on-site investigations. Therefore, the Council of State had to judge whether the District Court properly balanced the appellant's and the data controller's interests, and thus if the personal data were lawfully recorded by the camera. In addition, the Council of State had to rule on the violation of Dutch administrative law. The Council of State ruled that the surveillance camera is filming the company’s entrance gate and a section of the public road. However, only the people who are close to the plot boundary are fully captured. In addition, the Court confirmed that the data controllers implemented sufficient safeguards, such as the deletion of the images after two weeks. Finally, the Council of State confirmed that the passers-by were properly informed of the use of the surveillance camera. However, as the AP failed to send the appellant its report on its on-site investigations, the District court should have issued its decision with an order to pay the costs of the proceedings and a order compensation from the court registry. Thus, the district Court issued its judgement contrary to Section 6:22 of the General Administrative Law Act. As a conclusion, the Council of State ruled that the appeal was well-founded and annulled the District Court judgement insofar there is no order for costs.

Decision date: 24 September 2026

Cited provisions: Art. 12(4) GDPR, Art. 15(4) GDPR

The DPA received a complaint from a former employee (data subject) of the controller concerning the refusal of an access request. More specifically, the data subject was dismissed by the controller on the basis of having gained access to the data subjects’ correspondence with another employee on Messenger. The data subject therefore requested access to the material on which the employer had based the decision. The controller clarified that the correspondence which was the basis of its decision to refuse access was discovered by chance on another employees work phone when they had turned it in following their resignation. The controller further emphasised that it took into consideration the criminal proceedings that had been initiated concerning the access of the correspondence. Particularly the fundamental need to safeguard the controller’s legal position in light of those proceedings. The data subject on the other hand argued that whilst refusal to an access request is allowed this should not result in refusal to all personal data and information of the data subject. The data subject also argued unlawful obtention of the correspondence by the controller and the corresponding compelling interests of the data subject as a result thereof, to be provided with a copy of the information. Finally, the data subject emphasised the fact that controller did not provide specific information as to the grounds for refusal. That being clear identification of which rights and freedoms would be violated if the data subject had obtained a copy, and the compelling public interest which outweighs those of the data subject. The DPA held that the controller acted within the limits of its right to refuse an access request in accordance with Article 15(4) GDPR, where the data subject’s interests are outweighed by compelling private and public interests. In this regard, as a result of the material to which the data subject had requested access was also the subject of criminal proceedings

Authority: Datatilsynet (Norway) (Norway)

Decision date: 2 October 2026

Cited provisions: Art. 4(1) GDPR, Art. 4(11) GDPR, Art. 5(2) GDPR, Art. 6(1) GDPR, Art. 7 GDPR, Art. 9(1) GDPR, Art. 9(2)(a) GDPR, Art. 9(2)(e) GDPR, Art. 24 GDPR, Art. 26(1) GDPR, Art. 80(1) GDPR, Art. 83(5)(a) GDPR

The advertising technology company Xandr (controller, at that time AppNexus, now a part of Microsoft) engaged in so-called real-time bidding. Real-time bidding is a technology where advertisers can bid against each other via an automated process to show their personalised advert to a user of a website or app. It occurs every time a user visits a website or app where there is an available ad space. Within this auction process, Xandr acted both on the buyer and seller side, meaning it provided both a supply side platform and a demand side platform. It offered to its clients a console, a tool to interact with its platform, where the clients were able to conduct, optimize and track their advertising transactions. Through the platform, Xandr receives ad requests of their clients and enriches the bid with information which segment(s) a user belongs to. The bid request is sent to advertisers who evaluate the request and decide whether to bid on the ad space. Real-time bidding requires the collection, accumulation and dissemination of personal data to target and personalise the advertisement and optimise the bid. The console offers settings where the clients of Xandr can exclude certain categories of data from bid requests or to exclude certain recipients from receiving bid requests. Within this process of real-time bidding at hand, Xandr processed personal data of Grindr users in Norway. Grindr is a dating app with a target market in the LGBTQ+ community. Amongst the data processed by Xandr was the information that individuals were using Grindr, their advertising ID, and IP addresses. This data was shared with third-party advertisers. On the one side, Xandr provided assistance to Grindr to make its ad spaces available to potential buyers. On the other side, Xandr also operated on the demand side and send ad requests to third parties where an ad should be placed on the Grindr app, through an intermediary that had access controls within the console. The Norwegian Consu

Decision date: 24 September 2026

Cited provisions: Art. 12(4) GDPR

A user of a social media platform (the data subject) sent the platform (the controller) an email where they objected to the processing of their personal data for direct marketing purposes. The controller replied with instructions on how to delete data stored in the social media app and opt out of targeted marketing in the app's internal settings. Following three further emails where the data subject repeated this request, the data subject lodged a complaint against the controller in October 2025. According to the data subject, the controller had violated Articles 12 and 21 GDPR by referring the request to a customer service representative instead of the data protection officer and providing irrelevant and misleading information. The controller stated that its customer service had provided the data subject information on the basis for targeted advertising, changing advertising settings, deleting data from the app, and how to reduce targeted messages by changing account settings. However, the controller pointed out that it does not target advertising at the data subject at all because the data subject is under 18 years of age and resides in an EEA country. According to the controller, all decisions regarding the purposes and means of processing personal data were made in the United States. The DPA held that the controller had infringed Article 12(4) GDPR by failing to provide the data subject with a reason for not taking action in response to the data subject’s objection to direct marketing. However, the DPA did not consider it necessary to exercise corrective powers in the case at issue. First, the DPA held that the GDPR was applicable to the present case as the processing at issue concerned a data subject located in Finland and was related to the offering of social media services to Finnish data subjects. Second, the DPA pointed out that the controller had not processed the data subject's personal data for direct marketing purposes, as the data subject had been u

Decision date: 6 October 2026

Cited provisions: Art. 5(1)(f) GDPR, Art. 5(2) GDPR, Art. 12(3) GDPR, Art. 24 GDPR, Art. 32(1) GDPR

A company (controller) sent a data subject an email with a formal notice attached to it. The email was sent to the data subject’s work email address, with a third-party email address listed as recipient in the cc field. The data subject asked the controller for the identity of the third party. The controller answered that the request would be addressed as soon as possible. On another occasion, the controller sent the data subject an email with a payment notice via the data subject’s work email address. Again, the third-party email address was listed as recipient. The data subject asked again for the disclosure of the third party’s identity, and, for an explanation as to where the controller has obtained the data subject’s work email address from. The controller did not respond. The controller sent another two emails with a reminder concerning non-compliance with a payment plan and a pre-seizure statement of account to the data subject and, again, to the third-party email address. The controller started an internal investigation into the matter and deleted the third-party email address. In the course of the communication, amongst other data, the data subject’s name, home address and car licence plate number were revealed to the third party. The data subject lodged a complaint with the DPA on the grounds of improper use of their work email address and the disclosure of their personal data to the third-party recipient. Moreover, they requested information regarding the third party involved in their communication, the erasure of their work email address and that none of their personal data be transmitted to the third party. The controller demonstrated that the data subject has initiated contact with them via their work email address. The disclosure of the data subject’s data to the third party resulted from an erroneous manual data entry that led to the data subject being associated with the third-party email address in the controller’s debtor record. Th

Decision date: 25 February 2020

The defendant revoked the plaintiff’s appointment as a group data protection officer due to the allegations that the plaintiff had illegally set up a pension commitment for the then commercial director in collusive cooperation and had likewise acted on his own pension promise without an effective legal basis. = TThe plaintiff took the view that the revocations of the appointment as group or data protection officer were ineffective since there was no important reason. The plaintiff argued that he had not violated his obligations as data protection officer. = The defendant argued that the plaintiff lacks the necessary reliability for the work of the data protection officer. In the defendant’s view, there was no entitlement to a company pension scheme and the plaintiff's legal opinion was not justifiable. Only the Supervisory Board was responsible for the promise of a pension. The plaintiff disregarded the objections expressed by the head of payroll accounting and two other employees. He also did not involve the defendant's supervisory board. The State Labour Court Mecklenburg-Western Pomerania had to decide, whether the plaintiff has violated any general obligations from the employment relationship that prevent further use in the role of data protection officer. The Court stated that the data protection officer must not only have the necessary specialist knowledge, but also offer the guarantee that he will carry out his duties conscientiously and not against his obligations as a data protection officer, e.g. B. violates his duty of confidentiality. A serious violation of general employment contract obligations can also jeopardize reliability, e.g. theft, embezzlement, intentional damage to reputation, assault against other employees, etc. The reliability must be assessed taking into account the purpose of the appointment of a data protection officer. The data protection officer has the task of ensuring effective self-monitoring of the data protection regulations, in order to relieve public control bodies at the same time. The person appointed to the data protection officer must be able to guarantee effective self-control in addition to expertise. With an internal data protection officer, his position as a data protection officer cannot be completely separated from the underlying employment relationship. A serious breach of contractual obligations can mean that it is no longer possible to reliably exercise self-regulation under data protection law. The court argued that the plaintiff has the necessary reliability for the work of the data protection officer. In the opinion of the court, the plaintiff has not violated any general obligations from the employment relationship that prevent further use in the role of data protection officer

Decision date: 28 April 2020

Cited provisions: Art. 6(1) GDPR

The housing corporation Stichting Nijestee submitted non-anonymized judgments against the Claimant and her deceased father in proceedings against another tenants. According to Nijestee a court order is public unless legal exception apply. The Claimant has brought forward her private information by herself via a public procedure, after which it was included in the judgement. According to Nijestee they had reasonable grounds for using that judgement in another procedure. Nijestee also believes that data processing is permitted if certain conditions allowing it are met, and it has not been demonstrated that this was not the case. Claimant is of the opinion that Nijestee acted unlawfully towards her and her diseased father. She asked the Court to prohibit Nijestee from sharing her personal data contained in a judgement. The Court did not take into consideration the Claimant’s complaint about the processing of her father’s personal data because the Claimant had failed to explain why that processing was unlawful against her. The Court considered that it was possible that the personal data provided by Claimant to a court for the purpose of obtaining a judgment had been made available in a public court order. However, the Claimant’s consent to further dissemination of her personal data cannot be assumed from this. The Court therefore ruled that, in the absence of consent or any other legal basis, the sharing of the Claimant’s personal data by Nijestee was unlawful. Nijestee was also prohibited from sharing Claimant’s personal data with other parties, like co-tenants and other housing corporations.

Decision date: 23 September 2026

Cited provisions: Art. 24 GDPR, Art. 25 GDPR, Art. 35 GDPR, Art. 22 GDPR

Αn enterprise (the controller) planned the implementation of an AI tool intended to be used for the screening and evaluation of candidates in recruitment and internal mobility processes. The system will seek to analyse resumes, assign scores and prioritise candidates which may have a direct influence on the decisions regarding employment and promotions. Clarified was that final decisions were to be made by a human. The controller notified its employees of the implementation of this system in December. The DPA started an investigation. The controller clarified that it is part of a group of undertakings which is carrying out the evaluation and development of the system including compliance with data protection at a central level. Regardless, the controller emphasised it would analyse the established data protection implications and take appropriate measures prior to putting the system into operation. Following the investigation, the DPA issued a warning to the controller. The DPA addressed the controller’s obligation to ensure data protection by design and default and to implement appropriate technical and organisational measures to ensure data protection compliant processing in accordance with Articles 24 and 25 GDPR. More specifically, the DPA addressed the necessity for a risk assessment posed by the system, and if the processing is likely to result in a high-risk, to also implement the necessary DPIA pursuant to Article 35 GDPR. Furthermore, the DPA warned of the principle of transparency in relation to data subjects and their rights. That means providing them clear, accessible and understandable information regarding their personal data and the way it is processed. In this regard the controller is to take into account the functioning off the tool, and degree of human intervention throughout the process. Particularly, the controller must assess the possibility of Article 22 GDPR application and corresponding necessary limitations and safeguards.

Decision date: 29 July 2026

Cited provisions: Art. 37(7) GDPR, Art. 38(6) GDPR

A bailiff (the controller) appointed by a district court notified the DPA of a data breach in April 2023. According to the data breach notification, the controller also held the position of data protection officer within the bailiff's office from January 2020 to September 2025. However, the contact details of the data protection officer had not been published or communicated to the DPA. The DPA initiated an investigation regarding the appointment and the status of the data protection officer. The controller argued that it had not been obligated to appoint a data protection officer but had instead carried out the data protection officer's tasks on a voluntary basis. The DPA held that the controller had violated Articles 37(7) and 38(6) GDPR. It issued the controller a fine of PLN 3,500 (€800) for the former and PLN 12,000 (€2,700) for the latter GDPR infringement. The DPA imposed two separate fines on the controller as it considered the violations at issue to constitute two independent acts by the controller. First, the DPA concluded that the controller had failed to publish the contact details of the data protection officer and communicate them to the DPA as required by Article 37(7) GDPR. It pointed out that court bailiffs are public officials who execute judgments and perform their duties under the surveillance of a district court. In addition, they manage individual bailiff's offices. As controllers, bailiffs are obligated to appoint a data protection officer. Second, the DPA held that the controller's tasks and duties as both a bailiff and a data protection officer had resulted in a conflict of interests within the meaning of Article 38(6) GDPR. In the present case, the controller made decisions as a bailiff that must subsequently be subject to the data protection officer's assessment. This undermined the controller's ability to effectively carry out their tasks as a data protection officer. The controller had the highest-level position in the organisationa

Decision date: 4 August 2026

Cited provisions: Art. 5(1)(c) GDPR, Art. 25(2) GDPR

A pension insurance company (the controller) had disclosure the amount of an applicant's (the data subject's) pension accrual in euros to a physician who conducted a medical evaluation of the data subject in March 2023. The purpose of the evaluation was to decide whether the data subject was entitled to disability pension. The DPA investigated whether the controller had violated the principle of data minimisation laid down in Article 5(1)(c) GDPR and the obligation to implement appropriate technical and organisational measures under Article 25(2) GDPR. The controller argued that the physician needed information on the data subject's accrued pension benefits to be able to assess the data subject's ability to work. The physician conducting the medical evaluation generally receives data on the applicants' health status and employment history and gives a reasoned opinion on whether the conditions for granting disability pension are fulfilled. According to the controller, the physician must know the data subject's accrued pension benefits to assess their ability to work and determine whether the data subject would fall under the employment pension or the national pension system. The DPA held that the controller had not acted in violation of Articles 5(1)(c) and 25(2) GDPR by disclosing the data subject's accrued pension to a physician involved in processing the application for disability pension. According to the DPA, no facts had come to light in the present case that would justify the opposite conclusion. The DPA pointed out that information on the data subject's accrued pension was appropriate, relevant, and necessary for the processing of the pension application. It also argued that the physician acted under professional liability and was bound by a statutory duty of confidentiality. Finally, the DPA noted that it was in the data subject's best interest for the physician to know the exact amount of the data subject's pension accrual – the physician's evaluation a

Decision date: 1 September 2026

Cited provisions: Art. 58(1)(a) GDPR, Art. 58(1)(e) GDPR, Art. 58(2)(i) GDPR, Art. 83(1) GDPR, Art. 83(2) GDPR, Art. 83(5)(e) GDPR

The DPA launched an investigation into two websites operated by the controller under case number DKN.5101.8.2025. The controller collected the names and the occupations of individuals (the data subjects) and had not disclosed its identity and contact information on the websites. The DPA requested the controller to provide information on the processing operations pursuant to Articles 58(1)(a) and 58(1)(e) GDPR. It attempted to contact the controller by sending it a letter on 15 April, an email on 15 May, and another email on 5 June. The DPA also called the business owner's contact number on 10 and 12 June, but the number was unavailable. Due to the unsuccessful attempts to contact the controller in connection with the proceedings in case DKN.5101.8.2025, the DPA initiated the administrative proceedings at issue against the controller. The controller was notified of this on June 15. The controller did not submit any additional explanations regarding the previous case, nor did it provide the data necessary to determine the basis for calculating the administrative fine in the present proceedings. The DPA held that the controller had failed to provide the DPA access to personal data and other information it required for the performance of its tasks and issued the controller a fine of PLN 31,507 (€7,200). It found that the controller had violated Articles 58(1)(a) and 58(1)(e) GDPR.

Decision date: 16 September 2026

Cited provisions: Art. 5(1)(c) GDPR, Art. 10 GDPR, Art. 83(5)(a) GDPR, Art. 58(2)(b) GDPR

An editor-in-chief at a media company (controller) reported on so-called SLAPP lawsuits (strategic litigation against public participation lawsuits) initiated by an attorney. As part of this reporting, he published posts on his personal social media profiles on three different platforms about a legal action that the attorney was pursuing against the data subject on the grounds of defamation and libel. The lawsuit was dismissed because the data subject was found not guilty of defamation and libel. In these posts, the controller published the court decision and failed to redact the data subject’s name on several occasions within the document. In the document, the position of the data subject as the accused was apparent. The post was publicly accessible for several days and was reposted several times by other users of the platforms. The controller published the post on his own initiative and was not instructed to do so by the media company he is employed at. After the DPA has been notified about the incident, the controller deleted the posts. Retrospectively, the data subject made a statement that he consented to the disclosure of his name in the controller’s posts. The DPA found a violation of the data minimisation principle pursuant to Article 5(1)(c) GDPR and issued a reprimand. It held that the data in question fell under Article 10 GDPR because it identified the data subject as an accused in a criminal law proceeding despite the fact that he was acquitted. Moreover, the DPA held that because the controller acted on his own initiative, he held the role of the controller. The media company did not assert any influence on the controller to publish the post. The DPA held that Article 85 GDPR in conjunction with national law on the processing of personal data for the purpose of journalistic reporting was applicable as legal basis because the post formed part of the controllers reporting on the “SLAPP” lawsuits of the attorney. However, since the national prov

Decision date: 19 June 2026

Cited provisions: Art. 5(2) GDPR, Art. 6(1)(f) GDPR, Art. 9 GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 19 GDPR, Art. 20 GDPR, Art. 21 GDPR, Art. 22 GDPR, Art. 58(2)(c) GDPR, Art. 58(2)(d) GDPR

The controller was a private individual who operated a website that collected documents from public authorities’ document registers and made them easier to search and access online. The DPA found that some documents remained available on the website even after the original authorities had imposed access restrictions. Public authorities and data subjects had also contacted the controller requesting the removal of personal data. The controller relied on Article 6(1)(f) GDPR, arguing that the processing served the legitimate interest of facilitating access to public information. He also argued that continuously checking all republished documents for subsequent access restrictions was technically difficult. The DPA held that the controller was independently responsible for ensuring that the republication of personal data complied with the GDPR. The fact that personal data had previously been published by a public authority did not automatically provide a legal basis for its further publication. The DPA found that the controller lacked sufficient technical and organisational measures under Articles 5(2), 24 and 25 GDPR to prevent personal data from remaining publicly accessible after the original source had restricted access. Regarding Article 6(1)(f) GDPR, the DPA held that a general legitimate-interest assessment could not justify the republication of all documents containing personal data. The controller had to assess whether a valid legal basis existed for the specific processing, particularly where access restrictions had subsequently been imposed. Where special categories of personal data were involved, Article 9 GDPR also had to be satisfied. The DPA also required the controller to ensure proper handling of requests under Articles 15 to 22 GDPR. Under Article 58(2)(c) and (d) GDPR, the DPA ordered the controller to implement safeguards preventing unlawful publication, stop processing personal data when no legal basis existed, review documents for subsequent acce

Decision date: 7 August 2026

Cited provisions: Art. 5(1)(c) GDPR, Art. 5(1)(e) GDPR, Art. 25(1) GDPR

The DPA began investigating the storage periods of the personal data of housing applicants (the data subjects) contained in rental housing applications during a previous proceeding against the a real estate agency (the controller). This proceeding was initiated in December 2022 and concluded in February 2025. The controller stated in its submissions connected to the aforementioned case that it collected e.g. the personal identification number, information relating to employment, financial information, and other information needed to assess the applicants' ability to pay rent from the data subjects. The data subjects could also additionally choose to provide the controller a wide range of sensitive personal information about themselves. The controller retained the housing application data for 12 years in total in order to avoid potential liability for damages. In the present case, the DPA investigated whether the storage periods complied with the principles of data minimisation and storage limitation as well as the requirements for data protection by design and default. The controller estimated that there had usually been from a few to half a dozen damages claims per year, none of which had processed to a lawsuit filed in court in the past 12 years. In the year preceding the DPA investigation, the controller had received approximately 82,000 housing applications. National law requires real estate agencies to retain information related to housing applications for five years. According to the controller, data collected more than five years ago was only used to file or defend legal claims, or to comply with anti-money laundering legislation. The DPA held that the controller had violated the principles of data minimisation and storage limitation by systematically retaining all personal data contained in housing applications for 12 years. Furthermore, it found that the controller had failed to comply with the requirements of data protection by design and default laid d

Decision date: 28 January 2026

Cited provisions: Art. 9(2)(f) GDPR, Art. 9(2)(g) GDPR

The data subject was involved in a legal dispute before a civil court in which the findings of an expert opinion led to the dismissal of the case. The expert opinion concerned the health status of the data subject. The data subject challenged the expert opinion in court in an individual legal proceeding. The court, in that second proceeding, ordered another expert (controller) to review whether the expert opinion in the first legal dispute was issued lege artis. In order for the controller to assess the findings of the expert opinion, the other party of the legal dispute made available to the controller the health data of the data subject via an online link. The health data included not only the data concerning the body part that was subject to the legal dispute, but all the data subject’s health data that the other party of the legal dispute processed. Additionally, the controller made the health data available to a neurologist in an anonymised form in order to receive a second opinion on their findings. The data subject’s complaint before the DPA concerned both the making available of the health data by the other party in the legal dispute to the controller as well as the making available by the controller to the neurologist. The DPA dismissed the complaint fully. # Disclosure to the controller As far as the making available of health data by the other party in the legal dispute was concerned, the DPA held that the processing of health data fell under Article 9(2)(f) and (g) GDPR. National law provides for a legal basis for the making available of health data where the health condition of a person is relevant for a decision in the public interest. The other party in the legal dispute made the data subject’s health data available in the context of a court proceeding that was dealing with the subject matter of an expert opinion on the health status of the data subject. The processing thus fell under the legal basis provided for by national law. Moreover, nat

Decision date: 8 June 2026

Cited provisions: Art. 17(3)(a) GDPR, Art. 10 GDPR

The data subject requested from a search engine (controller) the removal of a URL that appears when the data subject’s name is entered into the search engine. The URL points to the official website of the United States federal government for access to official publications. It refers to a judicial decision concerning the enforcement of Belgian orders within the United States and mentions the data subject’s name and states that he was convicted in Belgium in 2020 of forgery, fraud, breach of trust and embezzlement as well as forfeiture of assets in 2021. The data subject requested the de-listing of the URL from the controller but the controller refused to grant the request. Consequently, the data subject lodged a complaint with the DPA, claiming damages to his reputation and negative consequences for his professional situation. The DPA rejected the complaint. According to the DPA, the request of de-listing the URL is to be assessed under the deletion request provided for by Article 17 GDPR. Article 17(3)(a) GDPR requires the DPA to balance the interest of internet users to information with the data subject’s rights when assessing whether the personal data is to be deleted upon the data subject’s request or not. When balancing the interest, regard must be made of the special protection of personal data concerning criminal convictions as provided for by Article 10 GDPR. The DPA held that the interest of the internet users to the information prevailed over the data subject’s rights. Firstly, there was no doubt that the personal data concerned was accurate, the criminal convictions could not be classified as mere allegations but proven facts. Moreover, the information was still relevant since the convictions date back to 2020, its affirmation on appeal to 2021 and the referenced court decision to 2022. Thus, they reflect the current situation and not old facts. The DPA also considered that the convictions did not concern the data subject’s private or intimate lif

Decision date: 18 May 2026

Cited provisions: Art. 5(1)(a) GDPR, Art. 5(1)(f) GDPR, Art. 6(1)(c) GDPR

The data subject requested the mayor of their place of residence (the controller) to provide them scans of contracts the city had concluded with certain companies and invoices issued to these companies in February 2024. In April 2024, the controller responded that he did not possess the requested documents. This response contained the first and last name as well as the email address of the data subject and was forwarded to multiple recipients, including one of the companies the data subject’s request concerned. Following this, the data subject filed a complaint with the DPA. The controller argued it had processed the data subject’s personal data solely for responding to the request for access to public information. In addition, the controller was of the opinion that the processing had been necessary to fulfil a legal obligation. Since the request concerned multiple parties, the controller had determined there had been special grounds for disclosing the processed data. The DPA issued the controller a reprimand for the disclosure of personal data to unauthorised entities without a legal basis. It held that the processing had not been lawful under Article 6(1)(c) GDPR, as the controller could have complied with its obligation to respond to the request for information without disclosing the data subject’s personal data. Furthermore, the DPA held that the controller had violated the principles of lawfulness and confidentiality laid down in Articles 5(1)(a) and 5(1)(f) GDPR respectively.

Decision date: 27 January 2026

Cited provisions: Art. 6(1)(f) GDPR, Art. 14(5)(b) GDPR

A retailer (controller) sent a notebook to the address of a data subject after having received an order to that address. However, the data subject has never placed the order and did not hold an account with the retailer. An unknown third person has placed the order, using the data subject’s address, correct first and last name and date of birth. The e-mail address and phone number used by the third person did not belong to the data subject. After having received the order, and believing that the order was placed by the data subject, the controller carried out a credit check of the data subject with a credit information agency. After receiving the notebook and learning about the false order, the data subject requested within one e-mail both access to their personal data held by the controller and the deletion of their personal data. The controller gave access to some of the data subject's personal data. Afterwards, the data subject filed a complaint with the DPA, claiming the data received upon their access request was incomplete because the data relating to the credit check were not included, amongst others. Moreover, the data subject claimed that the controller did not have a legal basis for disclosing their personal data to the credit rating agency. After the complaint was lodged, the controller replied to the access request and subsequently deleted the data. At the time of the procedure before the DPA, the controller did not process personal data of the data subject anymore. According to the DPA, the data subject cannot claim a violation of their access right because of incomplete access to their data when the data is already deleted, in accordance with their request. The data subject runs the risk of impairing their access right in case of incomplete access to their personal data when the data subject requests access to their personal data and the deletion thereof at the same time. Since the data subject requested the deletion before the involvement of the DPA

Decision date: 31 July 2026

Cited provisions: Art. 45 GDPR, Art. 46(2)(c) GDPR, Art. 49(1)(b) GDPR, Art. 77 GDPR

The DPA was acting upon a complaint addressing the subject matter of third country personal data transfers. The controller, established in Ireland, operates an e-marketplace platform within the Union that connects costumers with independent vendors mostly located in Asia. The use of the controller’s platform requires potential costumers to create an account with the platform. When a customer orders a product via the platform, the controller establishes the contact between the costumer and the vendor. The parties of the purchase contract, however, are the customer and the vendor, not the controller. The processing of personal data in the context of providing the controller’s platform takes place within the Union and in the United Kingdom. In case of an order, the personal data is transferred to the vendors registered on the platform who offer the requested product. A customer (data subject) created an account with the controller’s platform in 2024. He logged into his account on the platform another time in 2024 and once in 2026, shortly after the procedure before the DPA was concluded. During his log-in in 2026, the data subject placed an order via the controller’s platform. In the course of the order, the data subject’s personal data was transferred to the People’s Republic of China and to two companies within the US. The European Commission has issued an adequacy decision pursuant to Article 45 GDPR concerning data transfers to the US (so-called “Data Privacy Framework”). Both US companies are featured on the “Data Privacy Framework List”. There is no adequacy decision concerning data transfers to the People’s Republic of China. The Irish DPA has declared itself not competent for the procedure at hand. The DPA held that the complaint at hand cannot be considered an abusive exercise of rights and was legally admissible. The question arose because the DPA considered the complaint as part of a campaign against processing of transfers of personal data to the Peop

Decision date: 1 June 2026

Cited provisions: Art. 31 GDPR, Art. 58(1)(a) GDPR, Art. 58(1)(e) GDPR

The DPA received two complaints against the same company (the controller) due to the unauthorised access to the data subjects’ personal data. The first complaint concerned processing that had taken place in January 2025, while the events giving rise to the second complaint had occurred in May 2025. During the proceedings initiated following the second complaint, the DPA requested certain information related to the processing operations at issue from the controller by sending the controller two letters in July and August respectively. The request included information on the scope of personal data processed, the sources from which the data were obtained, the legal basis and the purposes of processing. The controller never collected the first letter from the post office and failed to respond to the second one despite having received it. The DPA initiated administrative proceedings against the controller for refusal to cooperate due to the controller’s failure to respond to the request for information. The controller was requested to provide information on its income for 2025 for the purposes of determining an administrative fine, which it also failed to do. It was then discovered that the controller had also engaged in similar conduct in the proceedings related to the first complaint. Following this, the DPA contacted the controller electronically, and the controller provided information related to both complaint cases. The DPA held that the controller had violated Articles 31, 58(1)(a), and 58(1)(e) GDPR and issued it a reprimand. According to the DPA, the controller had refused to cooperate with the supervisory authority by failing to respond to the requests for information sent to it. Denying access to the information prevented a comprehensive and timely examination of the case, which in turn resulted in an unjustified prolongation of the proceedings. Furthermore, the DPA held that a reprimand was a sufficient sanction in the present case: the controller had submi