GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
1,234 results · Showing 1–20
Court case 2984/2026
The data subject requested that the controller (a Bulgarian non-banking financial institution specialized in providing online fast loans and installment loans) provide copies of all documents containing their personal data, including loan agreements, credit applications, and information about payments made under their contracts. The controller provided only an extract from its records and information about the processing of the data, without supplying copies of the requested documents. The Administrative Court of the city of Lovech annulled the controller's refusal and ordered the company to reconsider the request in accordance with the law. It held that the company had failed to fulfil the individual’s right of access to personal data under Article 15 of the GDPR. The controller appealed to the Bulgarian Supreme Administrative Court (BSAC), arguing that the lower court’s decision was inadmissible or legally incorrect. The company also requested that the proceedings be suspended pending a related case before the Court of Justice of the European Union (CJEU), Case C-676/2025. The BSAC rejected the request to suspend the proceedings, finding that the pending CJEU case concerned different circumstances, namely contractual relationships that had already ended. Since the contractual relationship in the present case had not been shown to have ended, the outcome of the CJEU case was not decisive. The Court also confirmed that the controller's response constituted an explicit refusal because it did not provide the requested document copies in the first place. The BSAC confirmed that Article 15(3) GDPR requires a data controller to provide a copy of the personal data being processed, including data contained in stored documents. Referring to the CJEU judgment of 4 May 2023 in Case C-487/2021, it explained that this right may require copies of entire documents, rather than extracts alone, where necessary for the individual to understand and verify the accuracy and lawfulness of the processing of their data. Loan agreements, repayment schedules, credit applications, and related financial information may all contain personal data covered by this right. The BSAC clarified that access may be restricted to protect the rights and freedoms of third parties according to Article 23 GDPR#1]] GDPR. The controller had therefore to take care not to disclose personal data belonging to other individuals contained in the requested documents. However, no other applicable grounds for restricting access were established in this case. The Court noted that Article Article 23 GDPR]] establishes certain restrictions on the right of access to personal data. Since the controller had not invoked national security, defence, public security, or any of the other grounds for restriction listed in Article 23(1)(a)–(h) and (j), the only relevant limitation in this case was Article 23(1)(i), concerning the rights and freedoms of others. Accordingly, the controller had to protect the personal data of third parties and must not disclose personal data relating to other individuals if such data appears in the requested documents. This limitation did not, however, justify withholding the applicant’s own personal data contained in the requested documents. The BSAC therefore upheld the finding that the controller had failed to comply fully with its obligations under Article 15 GDPR]] by providing only an extract from its records instead of the requested document copies, subject to the necessary protection of third-party rights.
Court case VI ZR 402/24
A well-known German singer (the data subject) was secretly photographed by a press photographer while on a walk with her daughter and her mother in the city centre of Munich in May 2022. The photographer sold these images to various news outlets, including Bild, RTL, Freizeitwoche, and Freizeit Revue. Following an unsuccessful warning letter, the defendant was prohibited by a preliminary injunction from displaying or distributing the data subject's images. The data subject filed a lawsuit against the photographer and claimed at least €10,000 in damages under Article 82(1) GDPR. Alternatively, she based her claim on national provisions, stating the photographer had violated her right of personality. The court of first instance granted the lawsuit regarding monetary compensation on the grounds of a particularly serious violation of the data subject’s right of personality resulting from the taking and the distribution of the images. Upon appeal by the photographer, the appellate court dismissed the lawsuit. The data subject appealed this decision to the Federal Court of Justice. The Federal Court of Justice upheld the appellate court’s decision and dismissed the data subject’s appeal. Neither Article 82 GDPR nor the national provisions on the general right of personality could give rise to a claim for monetary compensation in the present case. The court held that the taking and the disclosure of the images constituted processing of personal data within the meaning of the GDPR. However, these processing operations did not need to be assessed against the substantive requirements of the GDPR – according to the court, they constituted processing for journalistic purposes and fell under the exemption in Article 85(2) GDPR. Consequently, the data subject’s claim for damages could not be based on Article 82(1) GDPR. The court interpreted the provisions governing data processing for journalistic purposes in its judgment broadly in light of the case law of the CJEU. It could be left open which federal state’s provisions on media privilege were applicable to the photographs at issue, as the taking and the distribution of the images constituted journalism within the meaning of these provisions in any German state. In addition, the court held that responsibility for the editorial content of publications rests solely with the press. A person who provides photographic material to the press is therefore generally not responsible for the content of editorial pieces created on that basis. Finally, the court concluded that the data subject’s right to her own image and right to privacy were affected by being photographed. However, the freedom of the press and the photographers freedom of occupation outweighed these interests, which precluded a claim for compensation based on the data subject’s right of personality.
Court case 200.361.079/01
The data subject submitted an access request, in electronic format, of his gambling data to Risepoint Limited (the controller), the operator of online gambling services in the Netherlands, pursuant to Article 15 GDPR. This was to allow the data subject to check its accuracy, whether processing was lawful and determine the amounts which were deposited and withdrawn from the service. The controller was willing to provide some data, however refused to provide transaction data, relying on Maltese data protection law. The data subject brought the issue to court. The Rotterdam District Court ordered the controller, to provide the data subject with his personal gambling data. The controller appealed on the grounds that the actual intentions behind the data subjects request were so that he could potentially bring a claim against the controller, and that the request was excessive under Article 12(5) GDPR. Furthermore, relying on Maltese data protection law which allows restriction of access in circumstances involving legal proceedings. The controller argued that disclosing the transaction data could affect potential litigation. Finally, the controller claimed that the requested electronic format requested by the data subject was not justified by Article 20 GDPR. The data subject on the other hand, argued that Article 15 GDPR should entitle him to access his gambling and transaction records as they constituted personal data. The data subject emphasised that a potential legal claim did not invalidate his rights under the GDPR, particularly, right to access. Moreover, the data subject addressed the controller’s reliance on Maltese law, however stated that such must still comply with Article 23 GDPR and satisfy the proportionality and necessity requirements. Finally, the data subject argued that the format requested would allow him to assess the accuracy of his records effectively. Primarily, the court rejected the controller’s argument that the data subject only made the access request to later bring a claim against them. Relying on the CJEU judgement C-307/22 (FT v DW), the court emphasised that a data subject may request access under Article 15 GDPR for purposes beyond merely understanding the processing operations, such as to establish liability. Thus, the court held that this does not constitute an abuse of their right. Moreover, the court rejected, the excessive nature of the access request by the data subject argument of the controller. The Court found that in such a context, a request may only be regarded as excessive where objective circumstances demonstrate that the purpose of the access request, pursuant to Article 15 GDPR is not being pursued and that the data subject is clearly manipulating the conditions. The Court found that the controller did not establish such grounds and emphasised that they cannot rely on the burden arising from their business model and large volume of access requests received onto a data subject. As regards the Maltese data protection law and the restrictions to access, the court rejected the controller’s argument, stating that Article 23 permits certain national restrictions however under the condition that the satisfy the principle of proportionality and necessity. A controller may not simply refuse access because the data may prove useful in legal proceedings, as such would undermine the ability of data subjects to verify the controller’s own records. Finally, the court found that the data subject’s request to receive his data in an electronically and usable format was valid. The court emphasised Article 12(5) GDPR which requires information to be provided electronically where such a request is made in the same manner. Thus, the court found no reason as to why numerical transaction records could not be given in the format requested. The controller ultimately incurred the litigation costs of a total of €1,841 which included the filing fee, lawyers’ salary and additional costs.
Microsoft Ireland Operations Limited
The Irish Council for Civil Liberties (ICCL), a qualified entity, brought a representative action against Microsoft Ireland Operations Limited concerning the processing of personal data through the Xandr real-time bidding platform. ICCL alleged that personal data broadcast during real-time bidding auctions could include highly personal information and that the processing infringed several GDPR requirements, including transparency, data minimisation, security and consent obligations. It sought injunctive relief requiring Microsoft to cease, amend or restrict the processing. A dispute subsequently arose concerning the burden of proof and the parties' pleading obligations. ICCL argued that Articles 5(2) and 24(1) GDPR required the controller to demonstrate its compliance with the GDPR. Microsoft disputed that it was the relevant controller and argued that the ordinary rules of civil procedure placed the burden of establishing the alleged infringements on ICCL. The parties also disagreed about the information that had to be provided in the representative action. Microsoft sought further information concerning, among other things, the alleged infringements, the consumers affected and the funding of the proceedings. The court therefore determined several preliminary questions relating to the burden of proof, pleading requirements and access to information before the underlying GDPR allegations were decided. The court held that Articles 5(2) and 24(1) GDPR do not create a general reversal of the legal or evidential burden of proof. The claimant must first establish the matters for which it bears the burden, including that the defendant is a controller and that processing takes place which engages the relevant GDPR obligations. However, once those matters are established and compliance with a relevant GDPR obligation is at issue, the controller bears the legal and evidential burden of demonstrating compliance. In particular, where compliance with the principles in Article 5(1) GDPR or with the requirements covered by Article 24(1) GDPR must be determined, it is for the controller to prove that the relevant processing complies with those obligations. The Court considered this to follow from the accountability obligations. The court further held that the ordinary national rules on pleadings continue to apply to both parties. Each party must plead the material facts supporting the matters it is required to prove. Consequently, where the controller wishes to advance a positive case that it complied with the GDPR, it must plead the material facts on which that claim of compliance is based. Regarding the representative action, the court held that [https://www.irishstatutebook.ie/eli/2023/act/22/enacted/en/print Sections 19(10)] and [https://www.irishstatutebook.ie/eli/2023/act/22/enacted/en/print 19(11) of the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023] do not give the controller a standalone right to require the claimant to provide further information. However, the controller may rely on ordinary procedural mechanisms, including requests for particulars, discovery or disclosure under [https://www.irishstatutebook.ie/eli/2023/act/22/enacted/en/print Section 34(2)], where the applicable requirements are met, and may challenge the admissibility of the representative action. The court did not determine whether the processing through the Xandr platform actually infringed the GDPR. It also declined to determine certain additional questions, including the application of the "peculiar knowledge principle", because the necessary facts had not been agreed. No fine or corrective measure was imposed.
Court case 15 U 340/25
A rapper (the data subject) requested the operators of a search engine (the defendants) to delist a search result in March 2022. When the data subject’s name and the word “Nazi” were entered in the search engine, the search results referred to an article about a person who was allegedly deeply involved in the neo-Nazi scene. The article contained a picture that suggested this person had managed the sales booth for the data subject’s fashion label at an event. The defendants refused to remove the search result. Following this, the data subject filed an action for injunctive relief requesting the search result to be delisted. The defendants blocked the search results after a witness had stated in a hearing before the court of first instance that the person mentioned in the article had nothing to do with managing the data subject’s sales booth. The court of first instance granted the injunction under Article 17(1)(d) GDPR in the territory of the Federal Republic of Germany. It held that the processing had been unlawful as the statement about the defendant having a business relationship with a person involved in neo-Nazi circles was found to be untrue. The defendants appealed this decision to the Higher Regional Court of Cologne. The data subject also appealed the decision as they found the court had wrongly limited the claim for injunctive relief to German territory. The court granted the defendants’ appeal and dismissed the data subject’s appeal. It held that the data subject had no right to an injunction under Article 17(1)(d) GDPR. According to the court, a legally enforceable claim for erasure and supplementary injunctive relief against a search engine operator to have a search result delisted exists only if the search engine operator has violated its duty to review the content based on a request from the data subject. Otherwise, the search engine operator is not liable for the display of search results that refer to unlawful content. In the present case, the defendants had not violated such duties: they were not required to recognise that the information in the article was untrue until this was confirmed by the witness in the hearing before the court of first instance. In addition, the court held that the data subject must provide the search engine operator with sufficient and relevant evidence proving that the information contained in the search results is manifestly inaccurate if they dispute the accuracy of the search results. A mere assertion and the presentation of evidence during litigation are generally insufficient. As the data subject had simply asserted that the person with neo-Nazi connections had not managed their sales booth, the processing at issue had been necessary for exercising right of freedom of expression and information within the meaning of Article 17(3)(a) GDPR.
Court case W274 2320278-1
An address publishing service and direct marketing company (the controller) sent the address data of a data subject to clients as part of its business activities. The clients are both end-customers who engage in sending communication e.g. for fund raising purposes, as well as industry partners that create and sell data sets to direct marketing companies. After the controller sends the personal data to its clients, it deletes the data. The controller is subject to the code of conduct for address publishing services and direct marketing companies pursuant to Article 40 GDPR. As far as the rights of the data subjects are concerned, according to the code of conduct, the controller is obliged to give full access to the data subjects’ data as provided for by Article 15 GDPR in case the controller is directly involved in the marketing communication. In case the controller provides the address data for a client’s marketing campaign and is therefore not involved in the direct marketing communication, the controller is obliged to instruct the client to provide in its communication with the data subjects the information that the address data has been obtained from the controller. The data subject is not on the so-called “Robinson list” for persons who do not wish to have their address data distributed for marketing purposes. The data subject requested access to their personal data from the controller, specifically concerning information about recipients and categories of recipients. The controller provided information on the categories of recipients but not the specific recipients. An additional access request by the data subject concerning information about the specific recipients was denied by the controller on the grounds that it is not possible to provide such information because of the sector specific practices in direct marketing. According to its deletion practice, the controller was not in possession of the requested data. Upon the subsequent complaint filed by the data subject with the DPA, the DPA held that the controller violated Article 15(1)(c) GDPR by not providing information on the specific recipients. The controller appealed the decision to the Austrian Federal Administrative Court (the court). The court held that the controller was not obliged under the GDPR to store the data about the specific recipients. However, the controller is obliged to comply with the principle of data minimisation (Article 5(1)(c) GDPR) as well as the principles of storage limitation (Article 5(1)(e) GDPR) and purpose limitation (Article 5(1)(b) GDPR). The storage period of personal data is to be reduced to the minimum. If there was a general obligation to store the data on the recipients, the controller would have to store that data for the sole purpose of answering to a theoretical access request by the data subject. This would contradict the logic of the data minimisation principle because the controller could always argue, when faced with a possible violation of the principles of data minimisation or storage limitation, that it stored the data for the purpose of a future access request. According to the court, Article 11 GDPR and Recital 64 postulate the general principle that the data minimisation principle enjoys priority over an obligation to store data for the sole purpose of providing information in an access request. In line with the jurisprudence of the CJEU, the court held that the court must balance the interest of the data subject to receive access to the information with the controller’s interest to delete the data in order not to be burdened with the storage of the data. Such a balancing of interest in the context of the storage period of data can also be derived from Article 24(1) GDPR that lays down the criteria to consider for the implementation of technical and organisational measures and the demonstration of compliance. Depending on the outcome of the balancing of interest, the controller can be obliged to protocol information on the recipients. This can be the case when the data concerned requires special protection. In the specific case, the code of conduct for address publishers did not impose on the controller the obligation to store the data on the recipient. The code of conduct obliges the controller to give access to all data pursuant to Article 15 GDPR in case the controller has stored their own marketing data. Therefore, the storage of data is a prerequisite of the access request. But this provision does not deal with the obligation to store data. The data subject’s right to data protection is not impaired because of the negation of a general obligation of the controller to store the data on recipients. This is because of the legal obligation under national law to provide direct marketing communication with an indication of the source from which the personal data has been obtained from. In case the direct marketing is conducted by a client of the controller, the controller is obliged to instruct the client to provide its communication with such an indication. Therefore, the source of their personal data is in any case communicated to the data subject. According to the court, the data subject can also expect any third party that has obtained their data from the controller to actually contact the data subject and provide the information on where the data has been obtained from. This is because it would be economically disadvantageous for the client to buy the data and not use it for contacting the data subject, running the risk that the address of the data subject might become outdated. The data subject did not make use of the possibility to be listed in the “Robinson list”, by which they would avoid the processing of their data by the controller. On the other side, the interest of the controller not to be subject to an administrative burden by storing additional data, which runs counter the principle of data minimisation, must be considered. Since the data in question does not enjoy special protection, the balancing of interest results in favour of the controller.
XXXX
XXXX as the party lodged a complaint at the Austrian DPA (District Hospital XXXX as the co-party) on the unauthorised sharing of her personal data in seven different instances by the District Hospital XXXX. XXXX complained that the municipal association running the hospital infringed her fundamental right to secrecy of personal data. During a bitter employment dispute, her court submissions, which included health data, were circulated to the hospital's collegiate management, the members of the association's committee, their secretaries and others, and were discussed at a committee meeting on 27 October 2020. She also filed 27 further procedural applications, on service of documents, an oral hearing, file management, and injunctions against further processing. The Court held that the disclosures were lawful, as they were based on the controller's legitimate interests under Article 6(1)(f) GDPR (and, for health data, the exception for legal claims in Article 9(2)(f) GDPR). The Court affirmed that the recipients were authorised in this case to review the data, as they needed the information gained from the personal data to decide on the dismissal, could not be classified as "unauthorised third parties". The processing was found to be necessary, in line with respected data minimisation, and no overriding interests of the appellant could be established for XXXX. The Court relied on earlier final BVwG judgments and on an Austrian Supreme Court (OGH) decision of 28 July 2021 concerning the same dispute. The Court further rejected the XXXX's argument that the hospital's administrative director was a "falsus procurator" (false agent) and that only the association's chairman could access her data. The Court supported DPA's stance, confirming XXXX has no subjective right to assert how an authority should conduct the proceedings, where the Court dismissed on some aspects of the appeal as they had already been previously decided (res iudicata ). An appeal on points of law (Revision) was declared inadmissible because no question of fundamental legal importance arose.
Court case HelHO:2026:8
A company (A) requested information from the District Court of Eastern Uusimaa (Itä-Uudenmaan käräjäoikeus; the controller) regarding pending and closed criminal matters involving 39 individuals who applied to be cast in an entertainment program (the data subjects). The company claimed the purpose of the request was to investigate the data subjects' backgrounds, which in turn constituted processing for exclusively journalistic purposes within the meaning of [https://www.finlex.fi/fi/lainsaadanto/2018/1050 Section 27 of the Finnish Data Protection Act]. This national provision contains exemptions from certain GDPR provisions allowed by Article 85(2) GDPR. The district court denied the request in August 2025 and held that the information was in fact requested to investigate the backgrounds of individuals who had applied for the entertainment program for the purpose of making casting decisions, rather than for journalistic purposes as A claimed. A subsequently appealed the case to the Helsinki Court of Appeal and demanded that the controller be ordered to disclose the information specified in the information request aiming at investigating the applicants' backgrounds. A argued that a journalistic purpose may also encompass editorial work related to the preparation of journalistic content. In this case, researching the backgrounds of applicants and selecting participants were part of the journalistic process. In addition, a media company (B) claimed before the court of appeals that it should be given the right to intervene in the proceedings as A served as a subcontractor for B in gathering information for the production of the entertainment program. First, the court held that B had no right to intervene in the matter concerning its subcontractor's request for information. As the case concerned a request for information made by B's subcontractor and not B's own right to information, the matter could not be considered to concern B's rights as required under national law to allow B to participate in the proceedings as an intervenor. Second, the court of appeals confirmed the findings of the district court regarding the main proceedings and dismissed A's appeal. The court concluded that A could not rely on the journalistic exception set forth in [https://www.finlex.fi/fi/lainsaadanto/2018/1050 Section 27 of the Finnish Data Protection Act] and referred to the CJEU's decisions in the cases C-740/22 Endemol Shine Finland and C-199/24 Legal Newsdesk Sweden AB to support its conclusion. In the former case, the CJEU held that the public access to official documents must be weighed against the respect for private life and the protection of personal data. In addition, these interests carry greater weight when the disclosure concerns sensitive information such as criminal convictions. In the latter decision, the CJEU held that the purpose of the processing falling under journalistic purposes within the meaning of Article 85(2) GDPR must be the disclosure of information, opinions or ideas to the public in compliance with ethical rules or codes of conduct. Furthermore, the information generally needs to undergo editing or adaptation and verification of factual allegations. The court held that the request for information had not been made for exclusively journalistic purposes within the meaning of [https://www.finlex.fi/fi/lainsaadanto/2018/1050 Section 27 of the Data Protection Act]: A had requested information regarding criminal matters primarily to evaluate which individuals would be selected for one specific production. The immediate purpose of the processing at issue was therefore to make a production-related decision regarding who would participate in the program rather than journalistic fact-finding. The fact that A was involved in the production of a television program was not decisive in the assessment of the matter.
Court case W256 2337399-1
A marketing company (controller) that specialises in recruiting personnel for third companies was fined by the DPA for recording telephone interviews with potential customers (data subjects) with €25,500. The records were used for internal training purposes for the controller’s staff. In some occasions, the data subjects were not informed about the recording, in other cases only after the recording has already started. After the DPA’s reprimand, the controller stopped the processing, cooperated with a law firm and a data protection officer to establish and adapt a privacy notice, internal contracts and other documents and guidelines in conformity with the GDPR. The controller employs on average 18-20 people and has an annual turnover of €4,231,213.16 for the year prior the infringement. The controller appealed the DPA’s fine, not the unlawfulness of the processing. The court partially upheld the DPA’s decision, but reduced the amount of fine to €22,000. As far as the calculation of the fine was concerned, the court added the individual fines for the two violations, but limited the total amount of fine to the specified fine for the graves infringement, in accordance with Article 83(3) GDPR. Since both processing operations were linked to each other, Article 83(3) GDPR applied. Both infringements fell under Article 83(5) GDPR. Therefore, the specified amount of fine for the infringements is €20,000,000 or 4% of the total worldwide annual turnover of the preceding financial year. Since the first sum was higher, the static maximum fine in this case was €20,000,000. The static maximum fine must be adjusted to the individual case at hand: When assessing the amount of fine, Article 83(1) GDPR postulates that the fine must be effective, proportionate and dissuasive. One of the aims of the fine is the specific deterrence of the controller. For this purpose, the amount of fine should be in proportion to the size of the enterprise (in this case 18-20 employees, therefore a small enterprise with a structural adjacency to a micro-enterprise). Its annual turnover can be considered as well. The court held that the infringement at hand was of medium gravity. This is because on the one hand, all data subjects that were interviewed by the controller were affected, several data of each data subject were unlawfully processed and the unlawful processing continued for a period of four months. On the other hand, according to the court, the controller violated the GDPR with negligence not intent, the data processed was not of special importance and the obtained data was merely used for internal training purposes. The court considered, as aggravating factors (Article 83(2)(k) GDPR), that the controller violated the GDPR on two occasions: the unlawful recording of the interviews and failure to comply with the obligation to inform the data subjects pursuant to Article 13 GDPR. From the fact that the specified amount of fine for the infringements was this high, the court concluded a special importance of the protected legal interest. As a mitigating factor (Article 83(2)(k) GDPR), the court took into account that there were no previous GDPR violations by the controller. Moreover, the controller cooperated with the DPA by providing further audio material of interviews. This could be considered a mitigating factor, because with it, the controller exceeded its obligations under Article 31 GDPR and by doing so, did more than what was asked from him under the GDPR anyways. Also, the controller stopped the unlawful processing after the DPA ordered it to do so. The lack of damages suffered by the data subject was not a mitigating factor, contrary to the controllers claim, because the court held that the data subject suffered immaterial damages by loss of control over their data. Neither did the other privacy safety measures that the controller conducted be considered a mitigating factor (technical and organisational measures pursuant to Article 83(4)(a) GDPR) because they did not exceed what was asked from it under the GDPR).
Latvijas Republikas Saeima
Seventeen natural persons, who were minority shareholders of a public limited liability company, brought proceedings before the Satversmes tiesa (the Constitutional Court of Latvia). They challenged national legislation requiring information on shareholders to be included in the public companies register. The information made publicly available included shareholders’ identity and contact details, as well as information concerning the class, number and nominal value of their shares and the number of votes attached to them. The information could be accessed online and downloaded in bulk by any person without identification or the need to demonstrate a legitimate interest. The data subjects argued that such disclosure constituted an unjustified and disproportionate interference with their rights, particularly because they were neither beneficial owners nor members of the company’s management bodies and did not exercise control over the company. The national legislation pursued several objectives, including ensuring transparency and protecting third parties, combating money laundering and terrorist financing, and facilitating the implementation of sanctions. The Constitutional Court stated the proceedings and referred questions to the CJEU. In particular, whether [https://eur-lex.europa.eu/eli/dir/2017/1132/oj/eng Directive 2017/1132] required such disclosure and whether Articles 5 and 6 GDPR permitted national legislation providing unrestricted public access to that personal data. Directive 2017/1132 The Court first held that [https://eur-lex.europa.eu/eli/dir/2017/1132/oj/eng Article 14(d) Directive 2017/1132] does not require the disclosure of information relating to all shareholders, including minority shareholders. Shareholders do not, merely by holding shares, participate in the administration, supervision or control of a company within the meaning of that provision. In particular, minority shareholders are generally not authorised to represent or bind the company or perform management or supervisory functions. Legal basis The Court recalled that any processing must comply with the principles under Article 5 GDPR and satisfy one of the lawful bases under Article 6 GDPR. (i) The purposes must be sufficiently determined by law Since the disclosure of the shareholders’ personal data was required by national law, the Court considered that the processing had to be assessed under Article 6(1)(c) GDPR, which permits processing where it is necessary for compliance with a legal obligation to which the controller is subject. (ii) The purpose limitation and minimisation principles The Court recalled that, pursuant to Article 6(3) GDPR, the legal basis must determine the purpose of the processing, pursue an objective of public interest and be proportionate to the legitimate aim pursued. First, regarding the determination of the purpose, the Court held that the national court must verify whether the purposes of the processing could be identified with sufficient certainty from the wording of the legislation or its legislative context. This assessment was also relevant under the purpose limitation principle in Article 5(1)(b) GDPR. Second, regarding necessity and proportionality, the Court referred to the data minimisation principle under Article 5(1)(c) GDPR. It considered that making shareholders’ identity, contact details and information about their shareholdings publicly accessible constituted a serious interference with their rights. Such information could reveal aspects of their financial situation and investments and was accessible to a potentially unlimited number of persons. The possibility of downloading the information in bulk further increased the risk of retention, dissemination and misuse. As regards transparency and the protection of third parties, the Court found that disclosing the personal data of all shareholders, particularly minority shareholders, was neither appropriate nor necessary because those shareholders generally cannot represent or bind the company. The Court also acknowledged that public access could contribute to combating money laundering and terrorist financing. However, unrestricted access was not strictly necessary, since those objectives could be achieved through less intrusive measures, such as limiting access to persons demonstrating a legitimate interest. Practical difficulties in verifying such an interest could not justify a broader interference with fundamental rights. Similarly, although public access could facilitate the implementation of sanctions, unrestricted disclosure was not necessary. Less intrusive alternatives included limiting disclosure to persons subject to sanctions or granting access to other shareholders’ information only where a legitimate interest was demonstrated. Finally, the Court noted that the legislation lacked sufficient safeguards against abuse because the data were accessible online and could be downloaded in bulk by unidentified users. Consequently, the Court held that Articles 5 and 6 GDPR, read in light of [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12012P/TXT Articles 7] and [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12012P/TXT 8 CFR], preclude national legislation requiring the personal data of all shareholders, including minority shareholders, to be publicly accessible without conditions such as demonstrating a legitimate interest.
Kindred Group Limited
The District Court of The Hague (the Court) considered an action brought by 51 individuals who had participated in online gambling offered through the website Unibet before 1 October 2021. At that time, the relevant websites were operated by Risepoint Limited, formerly Trannel International Ltd (the controller). Kindred Group Limited had previously been the parent company of Risepoint. The data subjects had authorised Dynamiet Nederland B.V., a commercial legal services provider, to act on their behalf in matters relating to gambling losses (hereinafter, Dynamiet). The authorisation expressly included submitting access requests under Article 15 GDPR concerning account and transaction data held by online gambling providers. Between December 2024 and January 2025, the data subjects, acting through Dynamiet, submitted access requests to the controller under Article 15 GDPR. They requested, among other things, their personal data, account and contractual information, financial transactions and detailed information concerning their gambling activity. The controller did not provide the requested data. The data subjects subsequently brought proceedings seeking an order requiring the controller to provide the requested information. They also requested a penalty payment in the event of non-compliance. The controller argued, among other things, that the claims should not be examined because of Maltese legislation restricting certain GDPR rights and because the requirements of Article 80(1) GDPR were not fulfilled. The Court held that Maltese Subsidiary Legislation 586.09 did not automatically justify refusing an Article 15 GDPR access request. Although Article 23 GDPR allows certain restrictions on data subject rights, such restrictions must still be necessary and proportionate. The controller had also failed to demonstrate that the requests were abusive or excessive. However, the Court did not assess whether Article 15 GDPR had been infringed. It found that Dynamiet was effectively conducting the proceedings on behalf of the data subjects. This followed from the broad authorisations granted to it and from its role during the proceedings. The Court held that Article 80(1) GDPR permits an organisation to act on behalf of data subjects only where it fulfils the conditions laid down in that provision. Dynamiet did not meet those requirements, in particular because it operated for profit. The claims were therefore declared inadmissible under Articles 79 and 80(1) GDPR. The Court also held that other fundamental rights could not be relied on to circumvent Article 80(1) GDPR. It therefore did not rule on the substance of the access requests. No fine or corrective measure was imposed, and the data subjects were ordered to pay the procedural costs.
UWV
UWV, the controller, is the Dutch employee insurance agency. In February 2023, the data subject requested the rectification of a medical report drafted by an insurance physician in August 2012. She argued that the report inaccurately described statements allegedly made during a consultation, including information concerning her treatment, an upcoming medical appointment, contact with a personal coach and her employment. The controller rejected the request because it had not identified inaccuracies or omissions in the report. Instead, it added the rectification request to the medical file as a patient statement. In June 2023, the controller rejected the data subject’s objection and maintained its initial decision. A court dismissed the subsequent appeal. The data subject then appealed to the high court. She argued, in particular, that her rectification request should have been substantively assessed by an insurance physician under Article 10 of the controller’s internal objections regulation. She also relied on an earlier medical report which, in her view, demonstrated that the 2012 report contained inaccuracies. The high court dismissed the appeal and upheld the lower court’s judgment. It recalled that Article 16 GDPR entitles a data subject to obtain the rectification or completion of personal data where those data are inaccurate or incomplete. However, the alleged inaccuracies must be capable of being established easily and objectively. The right to rectification is not intended to alter or remove impressions, opinions, research results or conclusions merely because the data subject disagrees with them. Nor does Article 16 GDPR provide a general right to supplement existing documents. In the present case, the disputed information formed part of an insurance physician’s record of what, according to that physician, had been discussed during the consultation. The data subject did not substantiate in concrete terms why that account was incorrect and acknowledged during the hearing that, due to the time that had elapsed, she could no longer remember the conversation precisely. The high court therefore considered that the disputed statements were not inaccuracies that could be objectively established for the purposes of Article 16 GDPR. Consequently, the controller was not required to rectify the report, and the lower court had correctly upheld the rejection of the rectification request.
Data Protection Commission (DPC)
On 25 May 2018, Michael Veale, the data subject, submitted an access and data portability request to Meta Platforms Ireland Limited (MPIL) (then Facebook Ireland Limited), the controller. He requested access to all personal data concerning him stored in the controller's internal "Hive" data warehouse under Article 15 GDPR, including the data in raw form and information on its processing. He also requested relevant personal data in a structured, commonly used and machine-readable format under Article 20 GDPR. On 19 July 2018, the controller refused to provide the raw Hive data. Among other grounds, it relied on Article 12(5) GDPR, Article 15(4) GDPR and Article 20(4) GDPR. The data subject subsequently lodged a complaint with the Data the DPA arguing that the controller had failed to comply with his rights under Articles 15 and 20 GDPR and had unjustifiably relied on restrictions to those rights. On 27 July 2018, the DPA opened a complaint-based inquiry under [https://www.legislation.gov.uk/ukpga/2018/12/contents Section 110(1) Data Protection Act 2018]. The inquiry examined the controller's compliance with its obligations concerning the data subject's request. During the investigation, the controller explained that its approach to Hive data was generally applicable to its users and argued, inter alia, that extracting user-specific log-level data from Hive was computationally unfeasible. In August 2023, the DPA issued its Final Inquiry Report. The investigator considered that the controller had failed to provide the data subject with information required under Article 15(1)(a), (d) and (g) GDPR. On 10 October 2025, the DPA issued a preliminary draft decision (PDD). It provisionally found that the controller had infringed Article 15(1) and (3) GDPR by refusing access to and a copy of relevant personal data; Article 15(1)(a), (d) and (g) GDPR by providing inadequate information; Article 20(1) GDPR by refusing to provide relevant portable data; and Article 12(3) and (4) GDPR by failing to comply with the applicable time limits. The DPA also proposed a reprimand, a compliance order concerning the controller's general access and portability practices and administrative fines totalling between €360 million and €430 million. In determining the proposed corrective measures, the DPA took into account that the practices identified through the individual complaint potentially affected millions of users. The controller challenged the PDD before the High Court. It argued that the DPA had unlawfully transformed an inquiry concerning a single complaint into a systemic, EEA-wide own-volition inquiry. According to the controller, the DPA acted ultra vires by proposing systemic corrective measures and fines based on broader effects on other users. It also alleged breaches of fair procedures and legitimate expectations. The High Court dismissed the controller's action. The Court held that neither the GDPR nor the Data Protection Act 2018 establishes the limitation alleged by the controller. Although a complaint under Article 77 GDPR must concern an alleged infringement of the complainant's personal data rights, this does not prevent the complaint from raising systemic issues where the complainant is personally affected. The Court distinguished the origin and scope of an inquiry from the corrective powers available to the DPA. A complaint-based inquiry is defined by the subject matter of the complaint, whereas an own-volition inquiry is defined by the DPA itself. However, this procedural distinction does not limit the corrective powers available once an infringement within the scope of the complaint has been identified. Consequently, the fact that an inquiry originated from an individual complaint did not require the DPA to disregard broader or systemic implications of the infringement. Addressing such implications did not convert the proceedings into an own-volition inquiry. Systemic corrective measures and administrative fines The Court noted that Articles 57 and 58 GDPR confer broad enforcement powers on supervisory authorities and do not distinguish between complaint-based and own-volition inquiries regarding the corrective measures available. Where an infringement is established, Article 58(2) GDPR requires the DPA to consider appropriate corrective measures. These may include orders bringing processing operations into compliance and administrative fines under Article 83 GDPR. Such measures are not necessarily confined to restoring the individual complainant's position and may address systemic deficiencies identified through the inquiry. In particular, the Court considered that Article 83 GDPR itself requires factors such as the nature, gravity and duration of the infringement and the number of affected data subjects to be considered when determining an administrative fine. Therefore, the broader impact of an infringement may legitimately influence a fine even when the underlying inquiry originated from one individual complaint. The Court consequently held that a complaint-based inquiry may result in system-wide corrective measures and administrative fines informed by systemic considerations, provided that these measures arise from infringements established within the subject matter of the complaint. The Court did not, however, determine whether the controller had actually infringed Articles 12, 15 or 20 GDPR or whether the proposed €360–€430 million fine was appropriate. Those findings and measures remained provisional within the DPA's ongoing decision-making procedure. Fair procedures The Court also rejected the controller's argument that the DPA had breached its right to fair procedures by expanding the inquiry after the investigative stage. The controller had been informed from the beginning that findings of infringement could result in the exercise of the DPA's corrective powers under Article 58 GDPR, including administrative fines. Moreover, throughout the inquiry, the controller had itself addressed the operation of Hive and its general approach to access requests across its user base. The systemic implications were therefore inherent in the issues under examination rather than introduced as a new subject matter at the decision-making stage. The Court further noted that the regulatory procedure had not yet concluded. The controller retained the opportunity to make submissions on the PDD before the Article 60 GDPR cooperation procedure and could subsequently challenge any legally binding final decision. Consequently, no procedural unfairness warranting judicial review had been established. Legitimate expectations The Court equally rejected the controller's claim that it had a legitimate expectation that any corrective measures would be confined to the individual data subject. Neither the DPA's guidance, its previous practices nor its correspondence with the controller contained a sufficiently precise and unconditional assurance that systemic corrective measures could only be adopted through an own-volition inquiry. On the contrary, the controller had repeatedly been informed that the DPA retained its corrective powers under Articles 58 and 83 GDPR. The Court therefore held that no legitimate expectation arose that the consequences of a complaint-based inquiry would be restricted to an individual remedy for the complainant. Accordingly, the Court found no unlawful expansion of the inquiry, breach of fair procedures or violation of legitimate expectations and dismissed the judicial-review proceedings.
Court case 7 A 170/24
A firearms authority (the controller) sent the holder of a hunting license and a firearms ownership card (the data subject) information required under Articles 13 and 14 GDPR after the permits granted to the data subject had been transferred to it from another authority. The data processed by the controller included the name, date of birth, and contact information of the data subject. The data subject objected to the use of their home address for mailing letters in February 2024. In March, they requested the restriction of processing under Article 18(1)(d) GDPR. As the controller did not respond, the data subject repeated this request in April 2024 and made an access request under Article 15 GDPR. The data subject repeated the access request in June 2024 and criticised the controller for the failure to meet the deadline set forth in Article 12(3) GDPR. The data subject filed a lawsuit in July 2024, stating the controller had infringed Article 12(3) GDPR - this lawsuit has already been subject to a court decision. In August 2024, the controller provided the data subject certain information. The data subject maintained this information was incomplete and requested access to all their data processed by the controller. The data subject then filed another lawsuit in August, where they claimed the controller should to supplement the information provided - this lawsuit has also already been subject to a court decision. In a third lawsuit - subject to the decision at hand filed in October 2024 before the Administrative Court Osnabrück - the data subject claimed the information they requested access to on 21 August 2024 had not yet been provided to them and should have been provided by September 2024. The controller maintained the repeated access requests had been excessive. The court held that the lawsuit was well founded and stated that controller had failed to take action on the data subject’s access request within the one-month period required by Article 12(3) GDPR. The controller had not informed the data subject about an extension of the deadline either. In addition, the controller had failed to make a decision to not act on the access request and inform the data subject about this pursuant to Article 12(4) GDPR. Furthermore, the court held that even if the request is excessive within the meaning of Article 12(5) GDPR - the controller is required to react to the request. In the present case, there was strong evidence suggesting that the access request made on 21 August 2024 could be considered excessive. However, the court pointed out that this would merely have entitled the controller to charge a reasonable fee or refuse to act on the request which would require a respective information to the data subject. Therefore, the controller cannot remain entirely passive.
Court case 6Ob148/25w
The controller runs an address publishing business as well as a credit information agency. As part of its credit assessment activity, it (i) checks that individuals whose credit score is requested exist with data like their name and address and (ii) issues credit scores based on data provided by debt collection agencies and on statistics, as payment default data is available on approximately 10% of Austrians. The controller bought personal data about a data subject (name, address, date of birth) from a company (B) that operates in the address publishing and direct marketing industry. The contract provided that this data may only be used to check whether the individual with that name under that address exists. While the data subject’s data was initially collected by company B for the purpose of direct marketing, the controller used the personal data in question exclusively to check the individual with that name under that address exists. At a customer's request, the controller issued a credit assessment of the data subject. The assessment was based on the name, gender and address of the data subject because there was no available data on possible payment defaults of the data subject. The data subject brought an injunction against the controller. The main discussions regarded (i) a violation of the purpose limitation principle: the data was initially collected for direct marketing purposes and later used for credit assessment; (ii) the calculation of the score, which relied solely on statistical data and not on data actually concerning the payment history of the data subject. The court of first instance and second instance rejected the injunction. The court of first instance held that the controller processed the data according to the contract with company B. Moreover, the processing for the original purpose was compatible with the further processing. The court of second instance however held that the further processing was not compatible with the original purpose but that the controller could rely on national law as legal basis. As far as the method of credit assessment was concerned, both courts held that the processing fell under Article 6(1)(f) GDPR because the processing was necessary for operating a credit information agency. The data subject appealed the decision. The court partly upheld the decision of the court of second instance. Pre-emptive injunctions Firstly, the court referred to the case law of the CJEU that provides for the possibility of pre-emptive injunctions under national law. The scope of the subject matter of the injunction under Austrian national law is reduced to the specific violating actions the data subject claims. Therefore, as far as the data subject requests the controller to desist from unlawfully processing their personal data in general, the injunction is inadmissible because the data subject failed to name a specific violation. Purpose limitation The court considered that processing data to check if the individual exists in the context of credit assessments must be regarded as processing data for the purpose of credit assessments. This is true even where the data was not used for calculating the credit score itself. In this case, the controller processed the personal data for a different purpose than the marketing purpose that justified the initial collection. The further processing had significant consequences for the data subject and was not subject to appropriate safeguards pursuant to Article 6(4)(e) GDPR, in violation of Article 6(4) GDPR. Lawfulness of credit scoring calculation in absence of payment default data The court held that the assessment of a credit score on the basis of statistical data, and the address and and name of the data subject in the absence of data on possible payment defaults was not per se unlawful under Article 6(1)(f) GDPR. As there is available data on payment defaults on only 10% of Austrians, credit assessments of the majority of the population would otherwise not be possible. Such a calculation was also in line with data subjects expectations. The court found a violation of the principle of purpose limitation but held that the credit assessment in the absence of payment data was not per se unlawful.
Court case M 32 E 26.3990
The author of a manuscript (the data subject) submitted their text to an editorial office of a quarterly journal for review in November 2025. The journal was published by a private publishing company and overseen by several co-editors, including two professors at a Bavarian university (the alleged controller). The data subject received an email pointing out inconsistencies in the external review process in April 2026. On 7 May, the data subject submitted an access request under Article 15 GDPR to the university and requested a complete copy of their personal data processed in connection with the publishing process. The work email accounts of the two aforementioned university professors were explicitly identified as storage locations in the access request. The university rejected the access request in a decision dated 20 May 2026: it argued that it was not the controller within the meaning of Article 4(7) GDPR. According to the university, only the co-editors of the journal and the publishing company could be classified as controllers with regard to the storage of personal data in connection with publishing activities. On 26 May, the data subject filed a both a lawsuit and an application for a preliminary injunction before the Administrative Court Munich. In the application, they requested a preliminary injunction ordering the university to retain all the data subject's personal data until the main proceedings regarding the right to access would be legally concluded. As the data subject sought to secure their right of access with the application, they argued that their right to a preliminary injunction arose from Articles 5(2), 15, and 32 GDPR. The court rejected the data subject's application for a preliminary injunction: the requirements laid down in [https://www.gesetze-im-internet.de/vwgo/ § 123(1)(1) of the German Code of Administrative Court Procedure (VwGO)] were not fulfilled. First, the court held that the role of the university in the processing at issue could be left open in connection with the application for a preliminary injunction. Instead, it should be determined in the main proceedings whether the university was acting as a controller within the meaning of Article 4(7) GDPR. The court pointed out, however, that an employee using a work email account to process personal data in connection with their private activities generally determines the purpose and the means of the processing and is therefore acting as the sole controller. Second, the court concluded that the data subject did not have a right of access under Article 15 GDPR. The court weighed the data subject's right to access against the university professors' legitimate interests in maintaining the confidentiality of their communication and their general right to privacy. As the requested disclosure of information would constitute a significant infringement of the professors' right to privacy, the court held that the legitimate interests of the university professors prevailed over the data subject's right of access. According to the court, this conclusion was supported by Article 23(1)(i) GDPR and [https://www.gesetze-bayern.de/Content/Document/BayDSG Article 10(2)3) of the Bavarian Data Protection Act (BayDSG)], as these provisions restrict the right of access. The national provision states that information shall not be disclosed to the extent that personal data or the fact of its storage must be kept confidential to protect the data subject or due to the overriding legitimate interests of third parties. The court also referred to Article 15(4) GDPR to support its argumentation. Pursuant to this provision, the right to receive a copy of personal data processed shall not adversely affect the rights and freedoms of others. In addition, the court pointed out that Article 15 GDPR must be interpreted in light of the fundamental rights guaranteed in the EU Charter.
Data subject
The data subject was an existing customer of a telecommunications provider (the controller). An unknown third party used the data subject’s name, date of birth and bank account number to order a mobile phone contract and smartphone through the controller’s online shop without the data subject’s knowledge and provided a delivery address that had no connection to the data subject. The controller did not verify the identity of the person placing the order or compare the delivery address with the data subject’s existing address information. Despite instruction to require identity verification for the delivery, the delivery company handed the package to an unknown third party and recorded the data subject as the recipient. The data subject lodged a complaint with the Austrian Data Protection Authority (DPA), alleging that the controller had allowed a third party to use their personal data to conclude a contract without adequate identity verification. The controller argued that it had selected personal delivery with an identity check as an appropriate security measure. It also argued that the delivery company was independently responsible for the failure to check the recipient’s identity. The DPA upheld the complaint. The controller appealed to the Austrian Federal Administrative Court. First, the court held that the controller had violated Article 5(f) GDPR, Article 24 GDPR and Article 32 GDPR by failing to implement adequate technical and organisational measures to prevent identity fraud. Second, the court held that the controller had violated Article 5(1)(d) GDPR, which requires controllers to ensure the accuracy of personal data. By failing to verify the data subject’s identity or check the delivery address against the information already held for this existing customer, the controller had failed to take adequate measures to ensure data accuracy. Third, the court rejected the controller’s argument that arranging personal delivery with an identity check was sufficient. The controller had not convincingly explained how it monitored compliance with the personal delivery requirement. Relying on the delivery company’s contractual obligation to verify the recipient’s identity did not affect the controller’s own obligations. Finally, the court upheld the DPA's finding that the controller had infringed the data subject’s right to confidentiality under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 § 1 DSG], read together with Article 5(1)(d) GDPR, Article 5(1)(f) GDPR, Article 24 GDPR and Article 32 GDPR. It dismissed the appeal and held that a further appeal was inadmissible.
Court case 10 A 5144/23
The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the parking lot, the goods receiving and shipping areas, production area, the office, and staff break rooms. The monitoring of employees (the data subjects) was discovered during a labour inspectorate inspection in June 2022, which informed the DPA. In September 2023, the DPA reprimanded and fined the controller for violations of the principle of lawfulness and storage limitation, lack of legal basis for the processing, and the obligation to maintain a record of processing activities. The DPA issued two separate decisions against the controller – one where it fined the controller, and a separate decision where it issued the controller a reprimand. Upon the controller's appeal regarding the decision issuing the fine, the amount of the fine was reduced to €8,000 by a decision of the Local Court Hannover (Amtsgericht Hannover). The controller appealed the reprimand decision to the Administrative Court Hannover (Verwaltungsgericht Hannover) and argued that the employees had given their consent to the surveillance. It also stated that the surveillance was necessary to ensure compliance with hygiene regulations and that the outdoor areas were monitored to prevent break-ins, theft, and vandalism. According to the controller, both a reprimand and a fine for the same violations infringed the general prohibition against double punishment. The court dismissed the appeal and upheld the reprimand issued to the controller. It held that the controller had violated Articles 5(1)(a), 5(1)(e), 6(1), and 30 GDPR. Moreover, the court stated that issuing a reprimand and a fine for the same GDPR violations did not constitute a double punishment, as a reprimand does not fall under the criminal law definition of a sanction. The court pointed out that a reprimand is an administrative measure that involves a finding of a GDPR violation but does not serve a punitive purpose. Regarding the lawfulness of the processing, the court examined whether consent or legitimate interest could be relied upon. For consent, the court found that the processing could not be based on Article 6(1)(a) GDPR: the controller had not provided any evidence that the employees would have consented to the processing. The controller could not rely on legitimate interests under Article 6(1)(f) GDPR either, as no balancing test had been conducted. In addition, the court pointed out that neither compliance with hygiene regulations nor the prevention of burglaries and vandalism could constitute legitimate interests in the present case. Regarding hygiene, the court pointed out that the controller was required to comply with hygiene provisions by law as a business that processes food of animal origin. There was also no factual evidence for crimes mentioned by the controller being a threat in the area. Furthermore, the court held that the controller had infringed the principle of storage limitation by storing the video surveillance footage for longer than necessary: some data had been stored for years. Finally, the court confirmed that the controller had also violated Article 30(1) GDPR as it had not provided a record of processing activities despite the DPA's repeated requests.
Minister of Finance
The personal data of an individual was stored in the Fraud Detection System (FSV), an application used by the Dutch Tax Authority between 2012 and 2020 to record potential indicators of tax fraud. The Minister of Finance was the controller. The data subject submitted an access request under Article 15 GDPR. In particular, she requested information about the personal data processed, the purposes of the processing, the recipients of the data, its source and retention period, and any automated decision-making concerning her. The controller provided an overview of the personal data stored in the FSV and answered the data subject’s questions. The data subject objected to the decision, claiming that the controller had not disclosed all information relating to her registration. The controller rejected the objection. It explained that the data subject had been selected for a manual review of her tax return under Project 1043, an anti-fraud initiative launched by the Dutch Tax, and was consequently registered in the FSV. It also stated that the data was accessible only to employees of the Tax Authority and had not been disclosed to other organisations. The District Court of Amsterdam dismissed the data subject’s appeal. It held that the proceedings concerned compliance with the GDPR access request and not the lawfulness of her inclusion in the FSV or any alleged resulting damage. The data subject appealed this judgment before the Council of State. The Council of State dismissed the appeal and upheld the judgment of the District Court. The Court held that there was no evidence that the controller had incorrectly applied Article 15 GDPR. The controller had provided an overview of all personal data concerning the data subject processed in the FSV, explained the purposes of the processing and clarified the circumstances of her registration under Project 1043. Although the data subject suspected that the controller held additional information, she did not provide concrete evidence supporting this claim. The Court also found no indication that she had been classified as a fraudster or that her personal data had been disclosed to other organisations. The Court further clarified that the lawfulness of the data subject’s registration in the FSV, the deletion of her data and any claim for compensation fell outside the scope of the access proceedings. Consequently, the Court confirmed the contested judgment and did not award litigation costs.
pharmacy customer (data subject)
The data subject did not pay for items ordered and collected from a pharmacy (controller). After several reminders, the controller commissioned a debt collection agency, which pointed to several enforcement proceedings against the data subject. The controller then reported the data subject for fraud and provided the police with a record of the enforcement proceedings. The data subject lodged a complaint with the Austrian DPA (DSB) regarding the violation of their right to confidentiality, claiming the disclosure of the record constitutes a violation of [https://www.ris.bka.gv.at/eli/rgbl/1896/79/P427/NOR40233943?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=EO&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=427&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=03.08.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=c7a56c5c-2040-47e7-91fe-3ae37e4eb965 § 427 EO] in conjunction with [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=03.08.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=607193ce-5b62-4d7a-abab-5027790e9ed4 § 1 DSG]. On 13. January 2026, the DPA dismissed the data subject's complaint and requests. The data subject subsequently appealed against the DPA's decision arguing that the provisioning of the record would violate the principle of data minimisation under Article 5(1)(c) GDPR, since handing over bills and reminders would have been sufficient. They also argued that the disclosure of the record would constitute a significant interference with their rights and, therefore, the conducted balancing of interests under Article 6(1)(f) GDPR was incorrect. Additionally, some of the listed enforceable titles were no longer current, thus violating the right to accuracy under Article 5(1)(d) GDPR. First, the court held that the controller had not violated the data subject's right to confidentiality under [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=03.08.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=607193ce-5b62-4d7a-abab-5027790e9ed4 § 1(1) DSG], as the provision of the record of enforcement proceedings to the police was in the legitimate interest of the controller under Article 6(1)(f) GDPR and did not violate the right to data minimisation pursuant to Article 5(1)(c) GDPR. The record was necessary as it provided a substantive evidence of the alleged fraud - providing only bills and reminders would not have been sufficient - as well as for the collection of outstanding debts. Thus, the record was also the least intrusive means. Given their prior history, the data subject should have reasonably anticipated such legal action. Consequently, the data subject's rights were found not to outweigh the controller's competing interests. Secondly, the court held that the professional and ethical confidentiality obligations of a pharmacist do not prevent them from reporting (potential) criminal offences or pursuing civil causes of action. Therefore, the court dismissed the appeal, as the DPA's decision was not found to be unlawful.