GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
1,504 results · Showing 1–20
The data subject was baptised as a minor. The name, date and place of birth and place of baptism were recorded in the baptismal register with the Bisdom Gent (Diocese of Ghent, controller). The baptismal register is a physical book that indicates the date of birth and the place of baptism. It is kept in a safeguarded storage (for example in a locked safe or dedicated room) that only a limited amount of persons affiliated with the Diocese have access to. After the data subject departed from the Church, they requested the controller to erase their personal data from the register. The controller recorded the departure of the data subject from the church with an annotation in the baptismal register. Upon the request, the controller stroke through the personal data of the data subject from the registry, however, it remained legible. The data subject complained with the DPA. The DPA found an infringement of the GDPR. The controller appealed the decision with the Court of Appeal of Brussels. The Court of Appeal, having doubts about the interpretation of the GDPR, referred the question to the CJEU for a preliminary ruling whether an individual who was baptised as a minor and who, as an adult, wishes to dissociate themselves from the religious community in question, has the right to have their personal data erased from the baptismal register. The referring court also wishes to know whether the mere annotation, in the margin of the baptismal register, that a person has left the religious community constitutes ‘erasure’ within the meaning of Article 17(1) and (3) of the GDPR. The Advocate General structured the opinion under the aspects of applicability of the GDPR, right to erasure, archiving in the public interest or historical research, and the concept of "erasure". = Firstly, according to the Advocate General Medina, the baptismal register is to be considered a filing system under Article 4(6) GDPR. Therefore, the GDPR is applicable despite the manual processing of the
The Irish Council for Civil Liberties (ICCL), a qualified entity, brought a representative action against Microsoft Ireland Operations Limited concerning the processing of personal data through the Xandr real-time bidding platform. ICCL alleged that personal data broadcast during real-time bidding auctions could include highly personal information and that the processing infringed several GDPR requirements, including transparency, data minimisation, security and consent obligations. It sought injunctive relief requiring Microsoft to cease, amend or restrict the processing. A dispute subsequently arose concerning the burden of proof and the parties' pleading obligations. ICCL argued that Articles 5(2) and 24(1) GDPR required the controller to demonstrate its compliance with the GDPR. Microsoft disputed that it was the relevant controller and argued that the ordinary rules of civil procedure placed the burden of establishing the alleged infringements on ICCL. The parties also disagreed about the information that had to be provided in the representative action. Microsoft sought further information concerning, among other things, the alleged infringements, the consumers affected and the funding of the proceedings. The court therefore determined several preliminary questions relating to the burden of proof, pleading requirements and access to information before the underlying GDPR allegations were decided. The court held that Articles 5(2) and 24(1) GDPR do not create a general reversal of the legal or evidential burden of proof. The claimant must first establish the matters for which it bears the burden, including that the defendant is a controller and that processing takes place which engages the relevant GDPR obligations. However, once those matters are established and compliance with a relevant GDPR obligation is at issue, the controller bears the legal and evidential burden of demonstrating compliance. In particular, where compliance with the principles in Article
In 2021, Groupe Canal +, the controller, carried out electronic direct marketing campaigns targeting approximately 3.9 million people. Their personal data had initially been collected by two internet service providers (ISPs). When collecting the data, the ISPs asked their subscribers to tick a box consenting to the use of their personal data for direct marketing by the ISPs’ “partners”. However, the partners were not identified on the collection form, through a hyperlink or by any other means. Consequently, the data subjects did not know that the controller could subsequently receive and use their data for electronic direct marketing. Following several complaints concerning the controller’s marketing activities the French DPA carried out inspections. On 12 October 2023, the DPA found, among other infringements, that the controller had breached Article [https://www.legifrance.gouv.fr/codes/texte_lc/LEGITEXT000006070987?fonds=ALL&init=true&page=1&query=Code+des+postes+et+des+communications+%C3%A9lectroniques&searchField=ALL L. 34-5 of the French Post and Electronic Communications Code] and Article 7(1) GDPR because it did not have valid consent from the data subjects for the electronic direct marketing. The DPA imposed a €600,000 administrative fine. The controller challenged the DPA’s decision before the French Supreme Court (Conseil d’État). It argued that the consent obtained by the ISPs was sufficiently informed because the data subjects had consented to their personal data being used for marketing by the ISPs’ “partners”. The national court questioned whether consent originally given to a data collector for marketing by a category of recipients could allow an unidentified member of that category to subsequently conduct electronic direct marketing without obtaining new consent. It also asked whether the degree of precision with which the category of recipients was described was relevant when assessing whether the consent was informed. The national court stayed the
A company operating a financial education portal and a YouTube channel with about 1,5 million subscribers and one of its co-founders (the plaintiffs) had repeatedly requested the operator of two large social media platforms (the defendant) to erase content posted by fake accounts. Users not associated with the plaintiffs had created profiles and posted advertisements under names resembling the plaintiffs' trade marks as well as featuring photos and deepfake videos of the co-founder. If users of the social media platforms followed the links in the posts, they were directed to groups on the defendant’s messaging app where fraudulent investment options were promoted. The plaintiffs had reported these incidents using the defendant's "Brand Rights Protection Tool", reported approximately 256 violations within a month, assigned a full-time employee to monitor the violations, and sent the defendant a formal legal warning. Erasing the infringing content took between 0 and 62 days, and more fake content appeared almost daily. Following the unsuccessful attempts to get the content removed, the plaintiffs filed a lawsuit requesting an injunction and damages. They based their claims on provisions of copyright law, data protection law, trademark law, and personality rights. The plaintiffs argued that the defendant could not invoke the liability exemption for hosting service providers under [https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng Article 6 DSA]. They also stated that the co-founder featured in the infringing content could base his claims on Articles 17 and 82 GDPR for the injunction and damages respectively, as the photos and videos featured in the fake content contained the co-founder’s personal data. According to the plaintiffs, the defendant was acting as a joint controller within the meaning of Article 26 GDPR with the profile owner or advertiser. The court held that the defendant was liable for fake profiles on its social media platforms under the DSA. It grant
An address publishing service and direct marketing company (the controller) sent the address data of a data subject to clients as part of its business activities. The clients are both end-customers who engage in sending communication e.g. for fund raising purposes, as well as industry partners that create and sell data sets to direct marketing companies. After the controller sends the personal data to its clients, it deletes the data. The controller is subject to the code of conduct for address publishing services and direct marketing companies pursuant to Article 40 GDPR. As far as the rights of the data subjects are concerned, according to the code of conduct, the controller is obliged to give full access to the data subjects’ data as provided for by Article 15 GDPR in case the controller is directly involved in the marketing communication. In case the controller provides the address data for a client’s marketing campaign and is therefore not involved in the direct marketing communication, the controller is obliged to instruct the client to provide in its communication with the data subjects the information that the address data has been obtained from the controller. The data subject is not on the so-called “Robinson list” for persons who do not wish to have their address data distributed for marketing purposes. The data subject requested access to their personal data from the controller, specifically concerning information about recipients and categories of recipients. The controller provided information on the categories of recipients but not the specific recipients. An additional access request by the data subject concerning information about the specific recipients was denied by the controller on the grounds that it is not possible to provide such information because of the sector specific practices in direct marketing. According to its deletion practice, the controller was not in possession of the requested data. Upon the subsequent complaint filed by
In July 2019, the father of a pupil filed a complaint with the Dutch DPA, against Onderwijsgroep Zusters der Christelijke Scholen Zuid-Kempen VZW (OZCS), the controller, a non-profit organisation operating a subsidised independent educational establishment. The complaint concerned a survey on pupils' well-being which was distributed to pupils through a digital platform. According to the complaint, the controller had not informed the parents beforehand, had not obtained their consent, had collected more personal data than necessary and had failed to comply with its obligations regarding the processing of the pupils' personal data. On 16 June 2020, the DPA found that the controller infringed Article 6(1) GDPR, Article 8 GDPR, the data minimisation principle under Article 5(1)(c) GDPR and the transparency principle under Article 5(1)(a) GDPR in conjunction with Articles 12(1) and 13 GDPR. The DPA ordered the controller to bring the processing into compliance and imposed a €2,000 administrative fine. Article 83(7) GDPR allows Member States to determine whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State. Belgium made use of this possibility in [https://www.belgium.be/en/personal_data Article 221(2) of its Data Protection Law], which excludes the application of Article 83 GDPR to public authorities and their employees or agents, except for legal persons governed by public law that offer goods or services on a market. The dispute therefore concerned whether the controller, despite being a legal person governed by private law, could fall within that exemption because it provided publicly subsidised education. The controller appealed. A court held that the DPA had not sufficiently justified whether the controller benefited from the exemption from administrative fines provided under [https://www.belgium.be/en/personal_data Article 221(2) of the Belgian Data Protection Law]. The DPA subsequently adop
XXXX as the party lodged a complaint at the Austrian DPA (District Hospital XXXX as the co-party) on the unauthorised sharing of her personal data in seven different instances by the District Hospital XXXX. XXXX complained that the municipal association running the hospital infringed her fundamental right to secrecy of personal data. During a bitter employment dispute, her court submissions, which included health data, were circulated to the hospital's collegiate management, the members of the association's committee, their secretaries and others, and were discussed at a committee meeting on 27 October 2020. She also filed 27 further procedural applications, on service of documents, an oral hearing, file management, and injunctions against further processing. The Court held that the disclosures were lawful, as they were based on the controller's legitimate interests under Article 6(1)(f) GDPR (and, for health data, the exception for legal claims in Article 9(2)(f) GDPR). The Court affirmed that the recipients were authorised in this case to review the data, as they needed the information gained from the personal data to decide on the dismissal, could not be classified as "unauthorised third parties". The processing was found to be necessary, in line with respected data minimisation, and no overriding interests of the appellant could be established for XXXX. The Court relied on earlier final BVwG judgments and on an Austrian Supreme Court (OGH) decision of 28 July 2021 concerning the same dispute. The Court further rejected the XXXX's argument that the hospital's administrative director was a "falsus procurator" (false agent) and that only the association's chairman could access her data. The Court supported DPA's stance, confirming XXXX has no subjective right to assert how an authority should conduct the proceedings, where the Court dismissed on some aspects of the appeal as they had already been previously decided (res iudicata ). An appeal on points of law (Re
A company (A) requested information from the District Court of Eastern Uusimaa (Itä-Uudenmaan käräjäoikeus; the controller) regarding pending and closed criminal matters involving 39 individuals who applied to be cast in an entertainment program (the data subjects). The company claimed the purpose of the request was to investigate the data subjects' backgrounds, which in turn constituted processing for exclusively journalistic purposes within the meaning of [https://www.finlex.fi/fi/lainsaadanto/2018/1050 Section 27 of the Finnish Data Protection Act]. This national provision contains exemptions from certain GDPR provisions allowed by Article 85(2) GDPR. The district court denied the request in August 2025 and held that the information was in fact requested to investigate the backgrounds of individuals who had applied for the entertainment program for the purpose of making casting decisions, rather than for journalistic purposes as A claimed. A subsequently appealed the case to the Helsinki Court of Appeal and demanded that the controller be ordered to disclose the information specified in the information request aiming at investigating the applicants' backgrounds. A argued that a journalistic purpose may also encompass editorial work related to the preparation of journalistic content. In this case, researching the backgrounds of applicants and selecting participants were part of the journalistic process. In addition, a media company (B) claimed before the court of appeals that it should be given the right to intervene in the proceedings as A served as a subcontractor for B in gathering information for the production of the entertainment program. First, the court held that B had no right to intervene in the matter concerning its subcontractor's request for information. As the case concerned a request for information made by B's subcontractor and not B's own right to information, the matter could not be considered to concern B's rights as required under national la
A marketing company (controller) that specialises in recruiting personnel for third companies was fined by the DPA for recording telephone interviews with potential customers (data subjects) with €25,500. The records were used for internal training purposes for the controller’s staff. In some occasions, the data subjects were not informed about the recording, in other cases only after the recording has already started. After the DPA’s reprimand, the controller stopped the processing, cooperated with a law firm and a data protection officer to establish and adapt a privacy notice, internal contracts and other documents and guidelines in conformity with the GDPR. The controller employs on average 18-20 people and has an annual turnover of €4,231,213.16 for the year prior the infringement. The controller appealed the DPA’s fine, not the unlawfulness of the processing. The court partially upheld the DPA’s decision, but reduced the amount of fine to €22,000. As far as the calculation of the fine was concerned, the court added the individual fines for the two violations, but limited the total amount of fine to the specified fine for the graves infringement, in accordance with Article 83(3) GDPR. Since both processing operations were linked to each other, Article 83(3) GDPR applied. Both infringements fell under Article 83(5) GDPR. Therefore, the specified amount of fine for the infringements is €20,000,000 or 4% of the total worldwide annual turnover of the preceding financial year. Since the first sum was higher, the static maximum fine in this case was €20,000,000. The static maximum fine must be adjusted to the individual case at hand: When assessing the amount of fine, Article 83(1) GDPR postulates that the fine must be effective, proportionate and dissuasive. One of the aims of the fine is the specific deterrence of the controller. For this purpose, the amount of fine should be in proportion to the size of the enterprise (in this case 18-20 employees, therefo
Seventeen natural persons, who were minority shareholders of a public limited liability company, brought proceedings before the Satversmes tiesa (the Constitutional Court of Latvia). They challenged national legislation requiring information on shareholders to be included in the public companies register. The information made publicly available included shareholders’ identity and contact details, as well as information concerning the class, number and nominal value of their shares and the number of votes attached to them. The information could be accessed online and downloaded in bulk by any person without identification or the need to demonstrate a legitimate interest. The data subjects argued that such disclosure constituted an unjustified and disproportionate interference with their rights, particularly because they were neither beneficial owners nor members of the company’s management bodies and did not exercise control over the company. The national legislation pursued several objectives, including ensuring transparency and protecting third parties, combating money laundering and terrorist financing, and facilitating the implementation of sanctions. The Constitutional Court stated the proceedings and referred questions to the CJEU. In particular, whether [https://eur-lex.europa.eu/eli/dir/2017/1132/oj/eng Directive 2017/1132] required such disclosure and whether Articles 5 and 6 GDPR permitted national legislation providing unrestricted public access to that personal data. Directive 2017/1132 The Court first held that [https://eur-lex.europa.eu/eli/dir/2017/1132/oj/eng Article 14(d) Directive 2017/1132] does not require the disclosure of information relating to all shareholders, including minority shareholders. Shareholders do not, merely by holding shares, participate in the administration, supervision or control of a company within the meaning of that provision. In particular, minority shareholders are generally not authorised to represent or bind the compa
The District Court of The Hague (the Court) considered an action brought by 51 individuals who had participated in online gambling offered through the website Unibet before 1 October 2021. At that time, the relevant websites were operated by Risepoint Limited, formerly Trannel International Ltd (the controller). Kindred Group Limited had previously been the parent company of Risepoint. The data subjects had authorised Dynamiet Nederland B.V., a commercial legal services provider, to act on their behalf in matters relating to gambling losses (hereinafter, Dynamiet). The authorisation expressly included submitting access requests under Article 15 GDPR concerning account and transaction data held by online gambling providers. Between December 2024 and January 2025, the data subjects, acting through Dynamiet, submitted access requests to the controller under Article 15 GDPR. They requested, among other things, their personal data, account and contractual information, financial transactions and detailed information concerning their gambling activity. The controller did not provide the requested data. The data subjects subsequently brought proceedings seeking an order requiring the controller to provide the requested information. They also requested a penalty payment in the event of non-compliance. The controller argued, among other things, that the claims should not be examined because of Maltese legislation restricting certain GDPR rights and because the requirements of Article 80(1) GDPR were not fulfilled. The Court held that Maltese Subsidiary Legislation 586.09 did not automatically justify refusing an Article 15 GDPR access request. Although Article 23 GDPR allows certain restrictions on data subject rights, such restrictions must still be necessary and proportionate. The controller had also failed to demonstrate that the requests were abusive or excessive. However, the Court did not assess whether Article 15 GDPR had been infringed. It found that Dynamiet was ef
The media company used a two-layer cookie consent banner where rejecting cookies required more steps than accepting them, violating GDPR and ePrivacy Directive requirements.
Sanoma Media Finland placed cookies and made web requests without obtaining user consent, violating the requirement for prior consent under the ePrivacy Directive.
UWV, the controller, is the Dutch employee insurance agency. In February 2023, the data subject requested the rectification of a medical report drafted by an insurance physician in August 2012. She argued that the report inaccurately described statements allegedly made during a consultation, including information concerning her treatment, an upcoming medical appointment, contact with a personal coach and her employment. The controller rejected the request because it had not identified inaccuracies or omissions in the report. Instead, it added the rectification request to the medical file as a patient statement. In June 2023, the controller rejected the data subject’s objection and maintained its initial decision. A court dismissed the subsequent appeal. The data subject then appealed to the high court. She argued, in particular, that her rectification request should have been substantively assessed by an insurance physician under Article 10 of the controller’s internal objections regulation. She also relied on an earlier medical report which, in her view, demonstrated that the 2012 report contained inaccuracies. The high court dismissed the appeal and upheld the lower court’s judgment. It recalled that Article 16 GDPR entitles a data subject to obtain the rectification or completion of personal data where those data are inaccurate or incomplete. However, the alleged inaccuracies must be capable of being established easily and objectively. The right to rectification is not intended to alter or remove impressions, opinions, research results or conclusions merely because the data subject disagrees with them. Nor does Article 16 GDPR provide a general right to supplement existing documents. In the present case, the disputed information formed part of an insurance physician’s record of what, according to that physician, had been discussed during the consultation. The data subject did not substantiate in concrete terms why that account was incorrect and acknowledged dur
On 25 May 2018, Michael Veale, the data subject, submitted an access and data portability request to Meta Platforms Ireland Limited (MPIL) (then Facebook Ireland Limited), the controller. He requested access to all personal data concerning him stored in the controller's internal "Hive" data warehouse under Article 15 GDPR, including the data in raw form and information on its processing. He also requested relevant personal data in a structured, commonly used and machine-readable format under Article 20 GDPR. On 19 July 2018, the controller refused to provide the raw Hive data. Among other grounds, it relied on Article 12(5) GDPR, Article 15(4) GDPR and Article 20(4) GDPR. The data subject subsequently lodged a complaint with the Data the DPA arguing that the controller had failed to comply with his rights under Articles 15 and 20 GDPR and had unjustifiably relied on restrictions to those rights. On 27 July 2018, the DPA opened a complaint-based inquiry under [https://www.legislation.gov.uk/ukpga/2018/12/contents Section 110(1) Data Protection Act 2018]. The inquiry examined the controller's compliance with its obligations concerning the data subject's request. During the investigation, the controller explained that its approach to Hive data was generally applicable to its users and argued, inter alia, that extracting user-specific log-level data from Hive was computationally unfeasible. In August 2023, the DPA issued its Final Inquiry Report. The investigator considered that the controller had failed to provide the data subject with information required under Article 15(1)(a), (d) and (g) GDPR. On 10 October 2025, the DPA issued a preliminary draft decision (PDD). It provisionally found that the controller had infringed Article 15(1) and (3) GDPR by refusing access to and a copy of relevant personal data; Article 15(1)(a), (d) and (g) GDPR by providing inadequate information; Article 20(1) GDPR by refusing to provide relevant portable data; and Article 12(3) and (4)
A firearms authority (the controller) sent the holder of a hunting license and a firearms ownership card (the data subject) information required under Articles 13 and 14 GDPR after the permits granted to the data subject had been transferred to it from another authority. The data processed by the controller included the name, date of birth, and contact information of the data subject. The data subject objected to the use of their home address for mailing letters in February 2024. In March, they requested the restriction of processing under Article 18(1)(d) GDPR. As the controller did not respond, the data subject repeated this request in April 2024 and made an access request under Article 15 GDPR. The data subject repeated the access request in June 2024 and criticised the controller for the failure to meet the deadline set forth in Article 12(3) GDPR. The data subject filed a lawsuit in July 2024, stating the controller had infringed Article 12(3) GDPR - this lawsuit has already been subject to a court decision. In August 2024, the controller provided the data subject certain information. The data subject maintained this information was incomplete and requested access to all their data processed by the controller. The data subject then filed another lawsuit in August, where they claimed the controller should to supplement the information provided - this lawsuit has also already been subject to a court decision. In a third lawsuit - subject to the decision at hand filed in October 2024 before the Administrative Court Osnabrück - the data subject claimed the information they requested access to on 21 August 2024 had not yet been provided to them and should have been provided by September 2024. The controller maintained the repeated access requests had been excessive. The court held that the lawsuit was well founded and stated that controller had failed to take action on the data subject’s access request within the one-month period required by Article 12(3) GDPR. T
The controller runs an address publishing business as well as a credit information agency. As part of its credit assessment activity, it (i) checks that individuals whose credit score is requested exist with data like their name and address and (ii) issues credit scores based on data provided by debt collection agencies and on statistics, as payment default data is available on approximately 10% of Austrians. The controller bought personal data about a data subject (name, address, date of birth) from a company (B) that operates in the address publishing and direct marketing industry. The contract provided that this data may only be used to check whether the individual with that name under that address exists. While the data subject’s data was initially collected by company B for the purpose of direct marketing, the controller used the personal data in question exclusively to check the individual with that name under that address exists. At a customer's request, the controller issued a credit assessment of the data subject. The assessment was based on the name, gender and address of the data subject because there was no available data on possible payment defaults of the data subject. The data subject brought an injunction against the controller. The main discussions regarded (i) a violation of the purpose limitation principle: the data was initially collected for direct marketing purposes and later used for credit assessment; (ii) the calculation of the score, which relied solely on statistical data and not on data actually concerning the payment history of the data subject. The court of first instance and second instance rejected the injunction. The court of first instance held that the controller processed the data according to the contract with company B. Moreover, the processing for the original purpose was compatible with the further processing. The court of second instance however held that the further processing was not compatible with the original purpos
The author of a manuscript (the data subject) submitted their text to an editorial office of a quarterly journal for review in November 2025. The journal was published by a private publishing company and overseen by several co-editors, including two professors at a Bavarian university (the alleged controller). The data subject received an email pointing out inconsistencies in the external review process in April 2026. On 7 May, the data subject submitted an access request under Article 15 GDPR to the university and requested a complete copy of their personal data processed in connection with the publishing process. The work email accounts of the two aforementioned university professors were explicitly identified as storage locations in the access request. The university rejected the access request in a decision dated 20 May 2026: it argued that it was not the controller within the meaning of Article 4(7) GDPR. According to the university, only the co-editors of the journal and the publishing company could be classified as controllers with regard to the storage of personal data in connection with publishing activities. On 26 May, the data subject filed a both a lawsuit and an application for a preliminary injunction before the Administrative Court Munich. In the application, they requested a preliminary injunction ordering the university to retain all the data subject's personal data until the main proceedings regarding the right to access would be legally concluded. As the data subject sought to secure their right of access with the application, they argued that their right to a preliminary injunction arose from Articles 5(2), 15, and 32 GDPR. The court rejected the data subject's application for a preliminary injunction: the requirements laid down in [https://www.gesetze-im-internet.de/vwgo/ § 123(1)(1) of the German Code of Administrative Court Procedure (VwGO)] were not fulfilled. First, the court held that the role of the university in the processing at issu
The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the parking lot, the goods receiving and shipping areas, production area, the office, and staff break rooms. The monitoring of employees (the data subjects) was discovered during a labour inspectorate inspection in June 2022, which informed the DPA. In September 2023, the DPA reprimanded and fined the controller for violations of the principle of lawfulness and storage limitation, lack of legal basis for the processing, and the obligation to maintain a record of processing activities. The DPA issued two separate decisions against the controller – one where it fined the controller, and a separate decision where it issued the controller a reprimand. Upon the controller's appeal regarding the decision issuing the fine, the amount of the fine was reduced to €8,000 by a decision of the Local Court Hannover (Amtsgericht Hannover). The controller appealed the reprimand decision to the Administrative Court Hannover (Verwaltungsgericht Hannover) and argued that the employees had given their consent to the surveillance. It also stated that the surveillance was necessary to ensure compliance with hygiene regulations and that the outdoor areas were monitored to prevent break-ins, theft, and vandalism. According to the controller, both a reprimand and a fine for the same violations infringed the general prohibition against double punishment. The court dismissed the appeal and upheld the reprimand issued to the controller. It held that the controller had violated Articles 5(1)(a), 5(1)(e), 6(1), and 30 GDPR. Moreover, the court stated that issuing a reprimand and a fine for the same GDPR violations did not constitute a double punishment, as a reprimand does not fall under the criminal law definition of a sanction. The court pointed out that a reprimand is an administrative measure that involves a finding of
The personal data of an individual was stored in the Fraud Detection System (FSV), an application used by the Dutch Tax Authority between 2012 and 2020 to record potential indicators of tax fraud. The Minister of Finance was the controller. The data subject submitted an access request under Article 15 GDPR. In particular, she requested information about the personal data processed, the purposes of the processing, the recipients of the data, its source and retention period, and any automated decision-making concerning her. The controller provided an overview of the personal data stored in the FSV and answered the data subject’s questions. The data subject objected to the decision, claiming that the controller had not disclosed all information relating to her registration. The controller rejected the objection. It explained that the data subject had been selected for a manual review of her tax return under Project 1043, an anti-fraud initiative launched by the Dutch Tax, and was consequently registered in the FSV. It also stated that the data was accessible only to employees of the Tax Authority and had not been disclosed to other organisations. The District Court of Amsterdam dismissed the data subject’s appeal. It held that the proceedings concerned compliance with the GDPR access request and not the lawfulness of her inclusion in the FSV or any alleged resulting damage. The data subject appealed this judgment before the Council of State. The Council of State dismissed the appeal and upheld the judgment of the District Court. The Court held that there was no evidence that the controller had incorrectly applied Article 15 GDPR. The controller had provided an overview of all personal data concerning the data subject processed in the FSV, explained the purposes of the processing and clarified the circumstances of her registration under Project 1043. Although the data subject suspected that the controller held additional information, she did not provide concrete evide