GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
532 results · Showing 1–20
Court case 2984/2026
The data subject requested that the controller (a Bulgarian non-banking financial institution specialized in providing online fast loans and installment loans) provide copies of all documents containing their personal data, including loan agreements, credit applications, and information about payments made under their contracts. The controller provided only an extract from its records and information about the processing of the data, without supplying copies of the requested documents. The Administrative Court of the city of Lovech annulled the controller's refusal and ordered the company to reconsider the request in accordance with the law. It held that the company had failed to fulfil the individual’s right of access to personal data under Article 15 of the GDPR. The controller appealed to the Bulgarian Supreme Administrative Court (BSAC), arguing that the lower court’s decision was inadmissible or legally incorrect. The company also requested that the proceedings be suspended pending a related case before the Court of Justice of the European Union (CJEU), Case C-676/2025. The BSAC rejected the request to suspend the proceedings, finding that the pending CJEU case concerned different circumstances, namely contractual relationships that had already ended. Since the contractual relationship in the present case had not been shown to have ended, the outcome of the CJEU case was not decisive. The Court also confirmed that the controller's response constituted an explicit refusal because it did not provide the requested document copies in the first place. The BSAC confirmed that Article 15(3) GDPR requires a data controller to provide a copy of the personal data being processed, including data contained in stored documents. Referring to the CJEU judgment of 4 May 2023 in Case C-487/2021, it explained that this right may require copies of entire documents, rather than extracts alone, where necessary for the individual to understand and verify the accuracy and lawfulness of the processing of their data. Loan agreements, repayment schedules, credit applications, and related financial information may all contain personal data covered by this right. The BSAC clarified that access may be restricted to protect the rights and freedoms of third parties according to Article 23 GDPR#1]] GDPR. The controller had therefore to take care not to disclose personal data belonging to other individuals contained in the requested documents. However, no other applicable grounds for restricting access were established in this case. The Court noted that Article Article 23 GDPR]] establishes certain restrictions on the right of access to personal data. Since the controller had not invoked national security, defence, public security, or any of the other grounds for restriction listed in Article 23(1)(a)–(h) and (j), the only relevant limitation in this case was Article 23(1)(i), concerning the rights and freedoms of others. Accordingly, the controller had to protect the personal data of third parties and must not disclose personal data relating to other individuals if such data appears in the requested documents. This limitation did not, however, justify withholding the applicant’s own personal data contained in the requested documents. The BSAC therefore upheld the finding that the controller had failed to comply fully with its obligations under Article 15 GDPR]] by providing only an extract from its records instead of the requested document copies, subject to the necessary protection of third-party rights.
Court case 200.361.079/01
The data subject submitted an access request, in electronic format, of his gambling data to Risepoint Limited (the controller), the operator of online gambling services in the Netherlands, pursuant to Article 15 GDPR. This was to allow the data subject to check its accuracy, whether processing was lawful and determine the amounts which were deposited and withdrawn from the service. The controller was willing to provide some data, however refused to provide transaction data, relying on Maltese data protection law. The data subject brought the issue to court. The Rotterdam District Court ordered the controller, to provide the data subject with his personal gambling data. The controller appealed on the grounds that the actual intentions behind the data subjects request were so that he could potentially bring a claim against the controller, and that the request was excessive under Article 12(5) GDPR. Furthermore, relying on Maltese data protection law which allows restriction of access in circumstances involving legal proceedings. The controller argued that disclosing the transaction data could affect potential litigation. Finally, the controller claimed that the requested electronic format requested by the data subject was not justified by Article 20 GDPR. The data subject on the other hand, argued that Article 15 GDPR should entitle him to access his gambling and transaction records as they constituted personal data. The data subject emphasised that a potential legal claim did not invalidate his rights under the GDPR, particularly, right to access. Moreover, the data subject addressed the controller’s reliance on Maltese law, however stated that such must still comply with Article 23 GDPR and satisfy the proportionality and necessity requirements. Finally, the data subject argued that the format requested would allow him to assess the accuracy of his records effectively. Primarily, the court rejected the controller’s argument that the data subject only made the access request to later bring a claim against them. Relying on the CJEU judgement C-307/22 (FT v DW), the court emphasised that a data subject may request access under Article 15 GDPR for purposes beyond merely understanding the processing operations, such as to establish liability. Thus, the court held that this does not constitute an abuse of their right. Moreover, the court rejected, the excessive nature of the access request by the data subject argument of the controller. The Court found that in such a context, a request may only be regarded as excessive where objective circumstances demonstrate that the purpose of the access request, pursuant to Article 15 GDPR is not being pursued and that the data subject is clearly manipulating the conditions. The Court found that the controller did not establish such grounds and emphasised that they cannot rely on the burden arising from their business model and large volume of access requests received onto a data subject. As regards the Maltese data protection law and the restrictions to access, the court rejected the controller’s argument, stating that Article 23 permits certain national restrictions however under the condition that the satisfy the principle of proportionality and necessity. A controller may not simply refuse access because the data may prove useful in legal proceedings, as such would undermine the ability of data subjects to verify the controller’s own records. Finally, the court found that the data subject’s request to receive his data in an electronically and usable format was valid. The court emphasised Article 12(5) GDPR which requires information to be provided electronically where such a request is made in the same manner. Thus, the court found no reason as to why numerical transaction records could not be given in the format requested. The controller ultimately incurred the litigation costs of a total of €1,841 which included the filing fee, lawyers’ salary and additional costs.
Court case 15 U 340/25
A rapper (the data subject) requested the operators of a search engine (the defendants) to delist a search result in March 2022. When the data subject’s name and the word “Nazi” were entered in the search engine, the search results referred to an article about a person who was allegedly deeply involved in the neo-Nazi scene. The article contained a picture that suggested this person had managed the sales booth for the data subject’s fashion label at an event. The defendants refused to remove the search result. Following this, the data subject filed an action for injunctive relief requesting the search result to be delisted. The defendants blocked the search results after a witness had stated in a hearing before the court of first instance that the person mentioned in the article had nothing to do with managing the data subject’s sales booth. The court of first instance granted the injunction under Article 17(1)(d) GDPR in the territory of the Federal Republic of Germany. It held that the processing had been unlawful as the statement about the defendant having a business relationship with a person involved in neo-Nazi circles was found to be untrue. The defendants appealed this decision to the Higher Regional Court of Cologne. The data subject also appealed the decision as they found the court had wrongly limited the claim for injunctive relief to German territory. The court granted the defendants’ appeal and dismissed the data subject’s appeal. It held that the data subject had no right to an injunction under Article 17(1)(d) GDPR. According to the court, a legally enforceable claim for erasure and supplementary injunctive relief against a search engine operator to have a search result delisted exists only if the search engine operator has violated its duty to review the content based on a request from the data subject. Otherwise, the search engine operator is not liable for the display of search results that refer to unlawful content. In the present case, the defendants had not violated such duties: they were not required to recognise that the information in the article was untrue until this was confirmed by the witness in the hearing before the court of first instance. In addition, the court held that the data subject must provide the search engine operator with sufficient and relevant evidence proving that the information contained in the search results is manifestly inaccurate if they dispute the accuracy of the search results. A mere assertion and the presentation of evidence during litigation are generally insufficient. As the data subject had simply asserted that the person with neo-Nazi connections had not managed their sales booth, the processing at issue had been necessary for exercising right of freedom of expression and information within the meaning of Article 17(3)(a) GDPR.
Court case W274 2320278-1
An address publishing service and direct marketing company (the controller) sent the address data of a data subject to clients as part of its business activities. The clients are both end-customers who engage in sending communication e.g. for fund raising purposes, as well as industry partners that create and sell data sets to direct marketing companies. After the controller sends the personal data to its clients, it deletes the data. The controller is subject to the code of conduct for address publishing services and direct marketing companies pursuant to Article 40 GDPR. As far as the rights of the data subjects are concerned, according to the code of conduct, the controller is obliged to give full access to the data subjects’ data as provided for by Article 15 GDPR in case the controller is directly involved in the marketing communication. In case the controller provides the address data for a client’s marketing campaign and is therefore not involved in the direct marketing communication, the controller is obliged to instruct the client to provide in its communication with the data subjects the information that the address data has been obtained from the controller. The data subject is not on the so-called “Robinson list” for persons who do not wish to have their address data distributed for marketing purposes. The data subject requested access to their personal data from the controller, specifically concerning information about recipients and categories of recipients. The controller provided information on the categories of recipients but not the specific recipients. An additional access request by the data subject concerning information about the specific recipients was denied by the controller on the grounds that it is not possible to provide such information because of the sector specific practices in direct marketing. According to its deletion practice, the controller was not in possession of the requested data. Upon the subsequent complaint filed by the data subject with the DPA, the DPA held that the controller violated Article 15(1)(c) GDPR by not providing information on the specific recipients. The controller appealed the decision to the Austrian Federal Administrative Court (the court). The court held that the controller was not obliged under the GDPR to store the data about the specific recipients. However, the controller is obliged to comply with the principle of data minimisation (Article 5(1)(c) GDPR) as well as the principles of storage limitation (Article 5(1)(e) GDPR) and purpose limitation (Article 5(1)(b) GDPR). The storage period of personal data is to be reduced to the minimum. If there was a general obligation to store the data on the recipients, the controller would have to store that data for the sole purpose of answering to a theoretical access request by the data subject. This would contradict the logic of the data minimisation principle because the controller could always argue, when faced with a possible violation of the principles of data minimisation or storage limitation, that it stored the data for the purpose of a future access request. According to the court, Article 11 GDPR and Recital 64 postulate the general principle that the data minimisation principle enjoys priority over an obligation to store data for the sole purpose of providing information in an access request. In line with the jurisprudence of the CJEU, the court held that the court must balance the interest of the data subject to receive access to the information with the controller’s interest to delete the data in order not to be burdened with the storage of the data. Such a balancing of interest in the context of the storage period of data can also be derived from Article 24(1) GDPR that lays down the criteria to consider for the implementation of technical and organisational measures and the demonstration of compliance. Depending on the outcome of the balancing of interest, the controller can be obliged to protocol information on the recipients. This can be the case when the data concerned requires special protection. In the specific case, the code of conduct for address publishers did not impose on the controller the obligation to store the data on the recipient. The code of conduct obliges the controller to give access to all data pursuant to Article 15 GDPR in case the controller has stored their own marketing data. Therefore, the storage of data is a prerequisite of the access request. But this provision does not deal with the obligation to store data. The data subject’s right to data protection is not impaired because of the negation of a general obligation of the controller to store the data on recipients. This is because of the legal obligation under national law to provide direct marketing communication with an indication of the source from which the personal data has been obtained from. In case the direct marketing is conducted by a client of the controller, the controller is obliged to instruct the client to provide its communication with such an indication. Therefore, the source of their personal data is in any case communicated to the data subject. According to the court, the data subject can also expect any third party that has obtained their data from the controller to actually contact the data subject and provide the information on where the data has been obtained from. This is because it would be economically disadvantageous for the client to buy the data and not use it for contacting the data subject, running the risk that the address of the data subject might become outdated. The data subject did not make use of the possibility to be listed in the “Robinson list”, by which they would avoid the processing of their data by the controller. On the other side, the interest of the controller not to be subject to an administrative burden by storing additional data, which runs counter the principle of data minimisation, must be considered. Since the data in question does not enjoy special protection, the balancing of interest results in favour of the controller.
Kindred Group Limited
The District Court of The Hague (the Court) considered an action brought by 51 individuals who had participated in online gambling offered through the website Unibet before 1 October 2021. At that time, the relevant websites were operated by Risepoint Limited, formerly Trannel International Ltd (the controller). Kindred Group Limited had previously been the parent company of Risepoint. The data subjects had authorised Dynamiet Nederland B.V., a commercial legal services provider, to act on their behalf in matters relating to gambling losses (hereinafter, Dynamiet). The authorisation expressly included submitting access requests under Article 15 GDPR concerning account and transaction data held by online gambling providers. Between December 2024 and January 2025, the data subjects, acting through Dynamiet, submitted access requests to the controller under Article 15 GDPR. They requested, among other things, their personal data, account and contractual information, financial transactions and detailed information concerning their gambling activity. The controller did not provide the requested data. The data subjects subsequently brought proceedings seeking an order requiring the controller to provide the requested information. They also requested a penalty payment in the event of non-compliance. The controller argued, among other things, that the claims should not be examined because of Maltese legislation restricting certain GDPR rights and because the requirements of Article 80(1) GDPR were not fulfilled. The Court held that Maltese Subsidiary Legislation 586.09 did not automatically justify refusing an Article 15 GDPR access request. Although Article 23 GDPR allows certain restrictions on data subject rights, such restrictions must still be necessary and proportionate. The controller had also failed to demonstrate that the requests were abusive or excessive. However, the Court did not assess whether Article 15 GDPR had been infringed. It found that Dynamiet was effectively conducting the proceedings on behalf of the data subjects. This followed from the broad authorisations granted to it and from its role during the proceedings. The Court held that Article 80(1) GDPR permits an organisation to act on behalf of data subjects only where it fulfils the conditions laid down in that provision. Dynamiet did not meet those requirements, in particular because it operated for profit. The claims were therefore declared inadmissible under Articles 79 and 80(1) GDPR. The Court also held that other fundamental rights could not be relied on to circumvent Article 80(1) GDPR. It therefore did not rule on the substance of the access requests. No fine or corrective measure was imposed, and the data subjects were ordered to pay the procedural costs.
UWV
UWV, the controller, is the Dutch employee insurance agency. In February 2023, the data subject requested the rectification of a medical report drafted by an insurance physician in August 2012. She argued that the report inaccurately described statements allegedly made during a consultation, including information concerning her treatment, an upcoming medical appointment, contact with a personal coach and her employment. The controller rejected the request because it had not identified inaccuracies or omissions in the report. Instead, it added the rectification request to the medical file as a patient statement. In June 2023, the controller rejected the data subject’s objection and maintained its initial decision. A court dismissed the subsequent appeal. The data subject then appealed to the high court. She argued, in particular, that her rectification request should have been substantively assessed by an insurance physician under Article 10 of the controller’s internal objections regulation. She also relied on an earlier medical report which, in her view, demonstrated that the 2012 report contained inaccuracies. The high court dismissed the appeal and upheld the lower court’s judgment. It recalled that Article 16 GDPR entitles a data subject to obtain the rectification or completion of personal data where those data are inaccurate or incomplete. However, the alleged inaccuracies must be capable of being established easily and objectively. The right to rectification is not intended to alter or remove impressions, opinions, research results or conclusions merely because the data subject disagrees with them. Nor does Article 16 GDPR provide a general right to supplement existing documents. In the present case, the disputed information formed part of an insurance physician’s record of what, according to that physician, had been discussed during the consultation. The data subject did not substantiate in concrete terms why that account was incorrect and acknowledged during the hearing that, due to the time that had elapsed, she could no longer remember the conversation precisely. The high court therefore considered that the disputed statements were not inaccuracies that could be objectively established for the purposes of Article 16 GDPR. Consequently, the controller was not required to rectify the report, and the lower court had correctly upheld the rejection of the rectification request.
Data Protection Commission (DPC)
On 25 May 2018, Michael Veale, the data subject, submitted an access and data portability request to Meta Platforms Ireland Limited (MPIL) (then Facebook Ireland Limited), the controller. He requested access to all personal data concerning him stored in the controller's internal "Hive" data warehouse under Article 15 GDPR, including the data in raw form and information on its processing. He also requested relevant personal data in a structured, commonly used and machine-readable format under Article 20 GDPR. On 19 July 2018, the controller refused to provide the raw Hive data. Among other grounds, it relied on Article 12(5) GDPR, Article 15(4) GDPR and Article 20(4) GDPR. The data subject subsequently lodged a complaint with the Data the DPA arguing that the controller had failed to comply with his rights under Articles 15 and 20 GDPR and had unjustifiably relied on restrictions to those rights. On 27 July 2018, the DPA opened a complaint-based inquiry under [https://www.legislation.gov.uk/ukpga/2018/12/contents Section 110(1) Data Protection Act 2018]. The inquiry examined the controller's compliance with its obligations concerning the data subject's request. During the investigation, the controller explained that its approach to Hive data was generally applicable to its users and argued, inter alia, that extracting user-specific log-level data from Hive was computationally unfeasible. In August 2023, the DPA issued its Final Inquiry Report. The investigator considered that the controller had failed to provide the data subject with information required under Article 15(1)(a), (d) and (g) GDPR. On 10 October 2025, the DPA issued a preliminary draft decision (PDD). It provisionally found that the controller had infringed Article 15(1) and (3) GDPR by refusing access to and a copy of relevant personal data; Article 15(1)(a), (d) and (g) GDPR by providing inadequate information; Article 20(1) GDPR by refusing to provide relevant portable data; and Article 12(3) and (4) GDPR by failing to comply with the applicable time limits. The DPA also proposed a reprimand, a compliance order concerning the controller's general access and portability practices and administrative fines totalling between €360 million and €430 million. In determining the proposed corrective measures, the DPA took into account that the practices identified through the individual complaint potentially affected millions of users. The controller challenged the PDD before the High Court. It argued that the DPA had unlawfully transformed an inquiry concerning a single complaint into a systemic, EEA-wide own-volition inquiry. According to the controller, the DPA acted ultra vires by proposing systemic corrective measures and fines based on broader effects on other users. It also alleged breaches of fair procedures and legitimate expectations. The High Court dismissed the controller's action. The Court held that neither the GDPR nor the Data Protection Act 2018 establishes the limitation alleged by the controller. Although a complaint under Article 77 GDPR must concern an alleged infringement of the complainant's personal data rights, this does not prevent the complaint from raising systemic issues where the complainant is personally affected. The Court distinguished the origin and scope of an inquiry from the corrective powers available to the DPA. A complaint-based inquiry is defined by the subject matter of the complaint, whereas an own-volition inquiry is defined by the DPA itself. However, this procedural distinction does not limit the corrective powers available once an infringement within the scope of the complaint has been identified. Consequently, the fact that an inquiry originated from an individual complaint did not require the DPA to disregard broader or systemic implications of the infringement. Addressing such implications did not convert the proceedings into an own-volition inquiry. Systemic corrective measures and administrative fines The Court noted that Articles 57 and 58 GDPR confer broad enforcement powers on supervisory authorities and do not distinguish between complaint-based and own-volition inquiries regarding the corrective measures available. Where an infringement is established, Article 58(2) GDPR requires the DPA to consider appropriate corrective measures. These may include orders bringing processing operations into compliance and administrative fines under Article 83 GDPR. Such measures are not necessarily confined to restoring the individual complainant's position and may address systemic deficiencies identified through the inquiry. In particular, the Court considered that Article 83 GDPR itself requires factors such as the nature, gravity and duration of the infringement and the number of affected data subjects to be considered when determining an administrative fine. Therefore, the broader impact of an infringement may legitimately influence a fine even when the underlying inquiry originated from one individual complaint. The Court consequently held that a complaint-based inquiry may result in system-wide corrective measures and administrative fines informed by systemic considerations, provided that these measures arise from infringements established within the subject matter of the complaint. The Court did not, however, determine whether the controller had actually infringed Articles 12, 15 or 20 GDPR or whether the proposed €360–€430 million fine was appropriate. Those findings and measures remained provisional within the DPA's ongoing decision-making procedure. Fair procedures The Court also rejected the controller's argument that the DPA had breached its right to fair procedures by expanding the inquiry after the investigative stage. The controller had been informed from the beginning that findings of infringement could result in the exercise of the DPA's corrective powers under Article 58 GDPR, including administrative fines. Moreover, throughout the inquiry, the controller had itself addressed the operation of Hive and its general approach to access requests across its user base. The systemic implications were therefore inherent in the issues under examination rather than introduced as a new subject matter at the decision-making stage. The Court further noted that the regulatory procedure had not yet concluded. The controller retained the opportunity to make submissions on the PDD before the Article 60 GDPR cooperation procedure and could subsequently challenge any legally binding final decision. Consequently, no procedural unfairness warranting judicial review had been established. Legitimate expectations The Court equally rejected the controller's claim that it had a legitimate expectation that any corrective measures would be confined to the individual data subject. Neither the DPA's guidance, its previous practices nor its correspondence with the controller contained a sufficiently precise and unconditional assurance that systemic corrective measures could only be adopted through an own-volition inquiry. On the contrary, the controller had repeatedly been informed that the DPA retained its corrective powers under Articles 58 and 83 GDPR. The Court therefore held that no legitimate expectation arose that the consequences of a complaint-based inquiry would be restricted to an individual remedy for the complainant. Accordingly, the Court found no unlawful expansion of the inquiry, breach of fair procedures or violation of legitimate expectations and dismissed the judicial-review proceedings.
Court case 7 A 170/24
A firearms authority (the controller) sent the holder of a hunting license and a firearms ownership card (the data subject) information required under Articles 13 and 14 GDPR after the permits granted to the data subject had been transferred to it from another authority. The data processed by the controller included the name, date of birth, and contact information of the data subject. The data subject objected to the use of their home address for mailing letters in February 2024. In March, they requested the restriction of processing under Article 18(1)(d) GDPR. As the controller did not respond, the data subject repeated this request in April 2024 and made an access request under Article 15 GDPR. The data subject repeated the access request in June 2024 and criticised the controller for the failure to meet the deadline set forth in Article 12(3) GDPR. The data subject filed a lawsuit in July 2024, stating the controller had infringed Article 12(3) GDPR - this lawsuit has already been subject to a court decision. In August 2024, the controller provided the data subject certain information. The data subject maintained this information was incomplete and requested access to all their data processed by the controller. The data subject then filed another lawsuit in August, where they claimed the controller should to supplement the information provided - this lawsuit has also already been subject to a court decision. In a third lawsuit - subject to the decision at hand filed in October 2024 before the Administrative Court Osnabrück - the data subject claimed the information they requested access to on 21 August 2024 had not yet been provided to them and should have been provided by September 2024. The controller maintained the repeated access requests had been excessive. The court held that the lawsuit was well founded and stated that controller had failed to take action on the data subject’s access request within the one-month period required by Article 12(3) GDPR. The controller had not informed the data subject about an extension of the deadline either. In addition, the controller had failed to make a decision to not act on the access request and inform the data subject about this pursuant to Article 12(4) GDPR. Furthermore, the court held that even if the request is excessive within the meaning of Article 12(5) GDPR - the controller is required to react to the request. In the present case, there was strong evidence suggesting that the access request made on 21 August 2024 could be considered excessive. However, the court pointed out that this would merely have entitled the controller to charge a reasonable fee or refuse to act on the request which would require a respective information to the data subject. Therefore, the controller cannot remain entirely passive.
Court case M 32 E 26.3990
The author of a manuscript (the data subject) submitted their text to an editorial office of a quarterly journal for review in November 2025. The journal was published by a private publishing company and overseen by several co-editors, including two professors at a Bavarian university (the alleged controller). The data subject received an email pointing out inconsistencies in the external review process in April 2026. On 7 May, the data subject submitted an access request under Article 15 GDPR to the university and requested a complete copy of their personal data processed in connection with the publishing process. The work email accounts of the two aforementioned university professors were explicitly identified as storage locations in the access request. The university rejected the access request in a decision dated 20 May 2026: it argued that it was not the controller within the meaning of Article 4(7) GDPR. According to the university, only the co-editors of the journal and the publishing company could be classified as controllers with regard to the storage of personal data in connection with publishing activities. On 26 May, the data subject filed a both a lawsuit and an application for a preliminary injunction before the Administrative Court Munich. In the application, they requested a preliminary injunction ordering the university to retain all the data subject's personal data until the main proceedings regarding the right to access would be legally concluded. As the data subject sought to secure their right of access with the application, they argued that their right to a preliminary injunction arose from Articles 5(2), 15, and 32 GDPR. The court rejected the data subject's application for a preliminary injunction: the requirements laid down in [https://www.gesetze-im-internet.de/vwgo/ § 123(1)(1) of the German Code of Administrative Court Procedure (VwGO)] were not fulfilled. First, the court held that the role of the university in the processing at issue could be left open in connection with the application for a preliminary injunction. Instead, it should be determined in the main proceedings whether the university was acting as a controller within the meaning of Article 4(7) GDPR. The court pointed out, however, that an employee using a work email account to process personal data in connection with their private activities generally determines the purpose and the means of the processing and is therefore acting as the sole controller. Second, the court concluded that the data subject did not have a right of access under Article 15 GDPR. The court weighed the data subject's right to access against the university professors' legitimate interests in maintaining the confidentiality of their communication and their general right to privacy. As the requested disclosure of information would constitute a significant infringement of the professors' right to privacy, the court held that the legitimate interests of the university professors prevailed over the data subject's right of access. According to the court, this conclusion was supported by Article 23(1)(i) GDPR and [https://www.gesetze-bayern.de/Content/Document/BayDSG Article 10(2)3) of the Bavarian Data Protection Act (BayDSG)], as these provisions restrict the right of access. The national provision states that information shall not be disclosed to the extent that personal data or the fact of its storage must be kept confidential to protect the data subject or due to the overriding legitimate interests of third parties. The court also referred to Article 15(4) GDPR to support its argumentation. Pursuant to this provision, the right to receive a copy of personal data processed shall not adversely affect the rights and freedoms of others. In addition, the court pointed out that Article 15 GDPR must be interpreted in light of the fundamental rights guaranteed in the EU Charter.
Minister of Finance
The personal data of an individual was stored in the Fraud Detection System (FSV), an application used by the Dutch Tax Authority between 2012 and 2020 to record potential indicators of tax fraud. The Minister of Finance was the controller. The data subject submitted an access request under Article 15 GDPR. In particular, she requested information about the personal data processed, the purposes of the processing, the recipients of the data, its source and retention period, and any automated decision-making concerning her. The controller provided an overview of the personal data stored in the FSV and answered the data subject’s questions. The data subject objected to the decision, claiming that the controller had not disclosed all information relating to her registration. The controller rejected the objection. It explained that the data subject had been selected for a manual review of her tax return under Project 1043, an anti-fraud initiative launched by the Dutch Tax, and was consequently registered in the FSV. It also stated that the data was accessible only to employees of the Tax Authority and had not been disclosed to other organisations. The District Court of Amsterdam dismissed the data subject’s appeal. It held that the proceedings concerned compliance with the GDPR access request and not the lawfulness of her inclusion in the FSV or any alleged resulting damage. The data subject appealed this judgment before the Council of State. The Council of State dismissed the appeal and upheld the judgment of the District Court. The Court held that there was no evidence that the controller had incorrectly applied Article 15 GDPR. The controller had provided an overview of all personal data concerning the data subject processed in the FSV, explained the purposes of the processing and clarified the circumstances of her registration under Project 1043. Although the data subject suspected that the controller held additional information, she did not provide concrete evidence supporting this claim. The Court also found no indication that she had been classified as a fraudster or that her personal data had been disclosed to other organisations. The Court further clarified that the lawfulness of the data subject’s registration in the FSV, the deletion of her data and any claim for compensation fell outside the scope of the access proceedings. Consequently, the Court confirmed the contested judgment and did not award litigation costs.
Court case VI ZR 144/23
The operator of an online store (the controller) had embedded third-party features in its website. As a result of this practice, the data of users accessing the website (the data subjects) was stored on servers operated by third parties. A data subject who had ordered goods from the controller's online store argued that his name, address, IP address, and numerous pieces of usage data from the ordering process had been unlawfully transferred to third parties. The data subject filed a lawsuit requesting an injunction to stop these transfers of personal data. The court of first instance dismissed the lawsuit on the grounds that it was inadmissible due to a lack of specificity. It also held the lawsuit was without merit. The data subject appealed this decision. The court of appeals dismissed the data subject's claim in March 2023: it held that the provisions of the GDPR are exhaustive and that national law may only be invoked if an opening clause is provided for in the GDPR. There was no applicable opening clause concerning injunctive relief. The data subject subsequently appealed the case further to the Federal Court of Justice. The Federal Court of Justice set the appealed decision aside and referred the case back to the court of appeals for a new hearing and decision. First, the court stated that the court of appeals had correctly found the lawsuit admissible. The requirement of sufficient specificity was met, as it was unambiguous which conduct of the controller was to be prohibited. The data subject was undoubtedly seeking legal protection to prohibit the controller from designing websites in a way that leads to unlawful transfers of personal data to third parties. Second, the court held that the claim for injunctive relief could not be denied on the merits. It found that the court of appeals had been incorrect in assuming that a claim for an injunction regarding the unlawful transfer of personal data was precluded under national law because the provisions of the GDPR are exhaustive. The court referred to the CJEU's decision in the case C-655/23 Quirin Privatbank', where the CJEU held that the GDPR does not prevent Member States from providing a legal remedy requiring the controller to refrain from further unlawful processing on a national levelSee CJEU - C-655/23 - Quirin Privatbank, margin number 52.. The court emphasised such remedies may improve the level of protection for data subjects. It could therefore not be ruled out that the plaintiff could be entitled to an injunction under national law. Moreover, it could not be assumed that the data subject could have achieved their objective of preventing unlawful transfers of their personal data to third parties by asserting any of the data subject rights provided for in the GDPR, particularly the right to erasure laid down in Article 17 GDPR.
Court case W605 2289290-2/18E
The data subject received social benefits from a public authority (controller) because of their unemployment. The controller has established an investigation unit that investigates undeclared workers and people who refuse to work but receive benefits. Employees from that investigation unit visited the data subject’s address and took pictures in the context of an investigation into possible income from self-employed work. The data subject requested from the controller access to their personal data processed by the controller pursuant to Article 15 GDPR. The controller submitted the data to the data subject. In an additional access request, the data subject requested information as to the number of photos taken at the address of the data subject, what objects were depicted, which employees took those pictures and with what justification. As a response, the controller sent six pictures that were taken at the address of the data subject in PDF format to the data subject. Three pictures were taken from the public pavement and depicted a poster and an advertisement placard, both visible from the public pavement. Three other pictures depicted the data subject’s car and house. The data subject lodged a complaint with the DPA, claiming incomplete access to their personal data, especially because the controller failed to provide them with information concerning the employers who conducted the investigation against them and meta data of the pictures, including technical data of the pictures. The DPA rejected the complaint and the data subject appealed it to the Federal Administrative Court (BVwG). As far as the scope of the access request was concerned, the Court held that the data subject has narrowed the scope of the subject matter of the access request to the pictures and the justification to take them by specifying those matters in their request. Since the access request is triggered by the request of the data subject, the request can limit the scope of what the DPA has to decide on, and thus, define the subject matter in the proceeding before the Court. Concerning the access to specific documents, the Court held that the access request can only include the information mentioned in Article 15 GDPR. In specific cases, in order to fulfill the obligation under Article 15 GDPR, it is necessary for the controller to provide whole documents in which the personal data is included. However, Article 15 GDPR does not stipulate a right to access to documents. Article 15(3) GDPR that stipulates that the controller shall provide a copy of personal data, must be understood as specifying a means of providing the information pursuant to Article 12 GDPR. It depends on the individual case whether the controller is required to provide whole documents or whether they fulfil their obligation by providing a register of the personal data. As far as access to data about the employees who took the pictures was concerned, the Court held that the right to access does not include the personal data of third persons. This is also true for the meta data requested. Moreover, according to the Court, the controller fulfilled their access request by providing the six pictures and information of the modalities of taking the pictures and the justification thereof. The data subject’s claim of the existence of more than those six pictures was unfounded according to the Court. The data subject was unable to demonstrate any facts that point to the existence of further pictures. However, it is for the data subject to prove that the access was incomplete. Mere speculation is not sufficient for the Court to investigate into the existence of further pictures. In conclusion, the Court confirmed the DPA decision that the controller did not violate Article 15 GDPR and gave complete access.
Court case 1 K 12737/25
A resident of North Macedonia (the data subject) was expelled from German territory in September 2021, and a two-year ban on entry and residence was imposed on him. The data subject subsequently re-entered German territory without a visa in December 2024 and travelled back to North Macedonia in July 2025. A federal police directorate (the controller) assumed that the data subject had violated the ban on entry and residence. The controller determined that the data subject posed a threat within the meaning of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1861-20210803 Article 24(2) of Regulation (EU) 2018/1861], ordered an alert for refusal of entry and stay, and entered it into the Schengen Information System (SIS) in August 2025. The data subject filed a lawsuit with the Stuttgart Administrative Court in October 2025, requesting that the controller be ordered to delete the alert and alternatively to correct it or to impose a time limit on it. The court held that the lawsuit was admissible and well-founded and ordered the controller to delete the alert for refusal of entry and stay from the SIS pursuant to [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02018R1861-20210803 Articles 53(1), 24(1) and (2) of Regulation (EU) 2018/1861] in conjunction with Article 17(1) GDPR. In the present case, the personal data of the data subject was inaccurate as the requirements for the alert were no longer fulfilled: the court held it could not be assumed that the data subject’s presence on German territory posed a threat to public order or security. In addition, the court referred to the principle of proportionality and pointed out that alerts may not be stored in the SIS for longer than necessary. The data subject had clearly changed his behaviour by marrying a German citizen and filing a visa application for family reunification since his expulsion from Germany. Therefore, the court held that the grounds for erasure laid down in Article 17(1)(a) and (d) GDPR were applicable.
Rydo Telecom
Rydo Telecom (the controller) is a telecommunications provider. In 2023, a data subject made an access request following a dispute with the controller on whether the data subject received two phones they had purchased from the controller. The data subject informed the controller in a letter that they intended to claim costs in the event that it did not respond to the request. The controller began investigating the data subject and found a similar claim against PostNL (one of the controller’s suppliers). According to PostNL, the data subject had made a similar claim that it had failed to deliver the two phones. The data subject later filed a case with the Amsterdam sub district court after the controller refused to respond to the request. The court dismissed the data subject’s claim for reimbursement of €2,908, on the grounds that the data subject had accused both companies of the same issue, and had left the hearing early. The data subject continued to reiterate their access request in 2024, and received a response from the controller in 2025. The controller stated that it no longer had data related to them beyond their email address in connection to the previous lawsuit. The data subject filed a case with the sub district court in 2026, who later referred the case to the court. The data subject requested the court to order the controller to provide full access to their data, subject to a penalty for noncompliance. The court first noted that the data subject had filed approximately 20 GDPR request cases with the sub district court within one year against different controllers. The court then assessed whether the data subject’s request was abusive within the meaning of Article 12(5) GDPR. This includes an objective and subjective element following CJEU case law (Brillen Rottler).See case C‑526/24 (Brillen Rottler), https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62024CJ0526 According to the CJEU, the subjective element requires the data subject to intend to obtain a benefit by artificially creating the conditions to receive said benefit. Publicly available information can be used for this assessment. The court considered that the data subject had abused their right. The court took into consideration other cases the data subject had initiated, and considered that the data subject had a financial motive for their requests rather than a genuine concern to assess their personal data or verify the lawfulness of its processing. The court gave as an example the fact that the data subject had insisted that the controller reach a settlement in the form of paying compensation or damages. The court dismissed the case. Since there was an established abuse of rights, the court saw no need to assess the merits of the data subject’s claim.
Data subject
The data subject sent an access request to the service provider (the processor). It replied that it held no personal data concerning the data subject in its capacity as controller. It explained that it provided services to N-GmbH and acted as its processor. The processor and N-GmbH belonged to the same corporate group. The data subject had received payment demands from a debt collection agency in 2020 and 2021 that identified the processor as the instructing party and also received demands from a law firm in 2020 and 2024 referring to the processor as its client. The DPA initially rejected the data subject's complaint in 2023. In 2025, the Federal Administrative Court partially voided the decision because the DPA had not adequately investigated whether the processor had processed the data in connection with the debt collection and litigation activities, including whether those activities fell within the processing agreement with N-GmbH. The court upheld the rejection of the data subject's other requests. Following the remittal, the DPA again rejected the data protection complaint. The data subject appealed, arguing that the controller had acted in its own name and therefore as controller rather than processor. First, the court distinguished between a controller and a processor by focusing on who actually decided the purposes and essential means of the processing. A processor could not freely determine those elements because it processed personal data on behalf of the controller. Second, the court found that the processor had been commissioned by N-GmbH to handle payment processing, including payment reminders and the handling of legal cases. The payment demands and reminder sent to the data subject therefore formed part of the tasks assigned to the processor and were covered by the processing agreement. The court found no evidence that it had exceeded the authority given to it under that agreement. The court therefore concluded that N-GmbH, as controller, was responsible for responding to the data subject's access request and the processor did not have a separate obligation to provide the requested information beyond its processor role. The court upheld the DPA's decision and dismissed the data subject's complaint as unfounded.
job applicant (data subject)
The data subject applied for a job with the association and provided additional documents, regarding the use of their personal data. Among other things, it was stated that the data subject's information would be considered as intellectual property, and further processing or reproduction would constitute an intentional criminal offence. Furthermore, an extended retention period for their personal data would have no valid legal basis and non-compliant behaviour would result in legal consequences, and the data subject objected to the retention. The controller notified the data subject that the position had already been allocated, and informed them about the duration and the purpose of their data being processed after the rejection for the purpose of possible legal claims against the rejection, as provided for by national law. In response, the data subject requested the deletion of their data, but the controller refused, stating that they would retain the additional documents in order to defend possible legal claims by the data subject. After seven months and in accordance with their privacy policy, the data controller deleted the data. The data subject lodged a complaint with the DPA regarding the violation of their right to erasure, which the DPA dismissed. Then, the data subject appealed against this decision. First, the court held that the retention of the data subject's data was lawful under Article 6(1)(f) GDPR for the purpose of defence against possible legal claims by the data subject concerning the rejection of their application, irrespective of the fact that the data subject renounced taking any legal action. The court held that the data subject was aware of the controller's processing practices due to their privacy policy that mentioned the retention period, as they voluntarily and in their own interests applied for the job position. Since the data subject tried to prevent the retention of seven months by pro-actively objecting to the retention at the time of submitting the application, the data subject reasonably expected the retention of their application after the rejection. . The controller rightfully informed the data subject at the earliest opportunity about further processing of their data, namely upon rejection of their application. The controller was not obliged, according to the court, to inform the data subject about further processing at the time of the initial data collection. It was sufficient to inform them at the time of further processing. The retention period that was prescribed by national law, could not be waived by the parties. The court held that there was no other obligation to delete the data subject's data under Article 17(1) GDPR. The processing of the data was lawful under Article 6(1) GDPR in conjunction with Article 5(1)(a) GDPR for the above mentioned reasons.
Societatea Națională de Căi Ferate CFR SA
On 5 June 2025, an individual (the data subject) made an access request under Article 15 GDPR to the Romanian National Railways Company, Societatea Națională de Căi Ferate SA (the controller). The data subject requested CCTV footage from 30 May 2025 and information regarding the processing of his personal data following an alleged altercation between the data subject and police agents in front of a railway station. The controller refused to provide the data subject with the requested footage citing the protection of the rights and interests of other persons in the CCTV images. Subsequently, the data subject filed a complaint with the Romanian DPA (ANSPDCP). The DPA found violations of Article 12(6) GDPR, Article 15(3) GDPR and Article 83(5)(b) GDPR and issued the controller with a warning. Moreover, the DPA ordered the controller, among other things, to provide the requested footage, to the extent that it was still available, while following guidelines about sharing such images. In court, the data subject sued the controller for immaterial damages worth RON 3,500 (€665) claiming that its failure to provide the requested footage led to feelings of frustration, stress, injustice and helplessness by being forced to undertake additional steps to make use of his rights and by making it impossible to use the requested footage in other legal cases. The court held that the DPA’s decision attested the infringement of the data subject’s right to access by the controller, meeting the requirements of an illicit act under Article 1357 Romanian Civil Code. Moreover, the court accepted the data subject’s stress and suffering and the causal link between them and the controller’s access request refusal. Therefore, the court awarded RON 1,000 (€190) in immaterial damages to the data subject in accordance with Article 1381(1) Romanian Civil Code, Article 1381(2) Romanian Civil Code and Article 1385 Romanian Civil Code. At the same time, the court considered that the damage was not severe nor prolonged and took this into account when deciding on the amount of damages awarded. Finally, the court dismissed the data subject’s request to order the controller to provide the requested footage since it had already been deleted.
Brillen Rottler GmbH & Co. KG
An Austrian citizen residing in Vienna (the data subject) subscribed to the newsletter of a family-run optician company (the controller) mainly operating in the German states of North Rhine-Westphalia and Lower Saxony in March 2023. During the registration process, he provided his email address as well as his first and last name and consented to the processing of his personal data. He then made an access request under Article 15 GDPR by fax, using letterhead that included his full home address, email address, and fax number. The controller refused to provide the requested information in April 2023 as it considered the request to constitute abuse of rights. It cited newspaper reports indicating that the defendant had subscribed to numerous newsletters solely for the purpose of asserting claims for damages. The controller brought proceedings concerning the legality of its rejection of the access request. The data subject demanded access to the information required by in Article 15 GDPR and the payment of monetary compensation of €1,000 in a counter-lawsuit. The court referred the case to the CJEU for a preliminary ruling in July 2024. The CJEU rendered its judgment in the case C-526/24 Brillen Rottler on 19 March 2026. It held that even an initial access request could be rejected on the grounds of an abuse of rights. According to the CJEU, the assessment of abusive conduct is based on all circumstances of the individual case. Both objective circumstances and the subjective intent of the data subject need to be taken into account. An abusive intent always exists if the access request is made in order to artificially create a claim for damages. The court held that the lawsuit had originally been well-founded and ruled that the counterclaims were without merit. According to the court, the controller could reject the data subject’s access request as excessive under Article 12(5)(b) GDPR. The data subject also had no right to damages under Article 82 GDPR due to the absence of a GDPR violation. The court referred to the preliminary ruling in the case C-526/24 and based its decision on an overall assessment of the objective and subjective circumstances of the present case as required by the CJEU decision. It held that the data subject’s conduct had been abusive. To the conviction of the court, there were numerous indications of abusive conduct: first, the data subject had voluntarily disclosed more personal data than was needed to subscribe to the newsletter. Second, the court could not identify any personal interest in a regional newsletter concerning operations in Nordrhein-Westfalen, as the data subject was an Austrian resident. In addition, the court took into account that the data subject had made the access request only nine days after subscribing to the newsletter and had not filed a complaint with the competent DPA before raising a claim for damages. Finally, information on the internet about numerous cease-and-desist letters sent by the data subject pointed to abusive conduct.
Data Subject versus Social Media Platform Operator
The data subject had used a social media platform operated by the controller, an Irish company, since 2013. The controller provided “Business Tools” to third-party website operators and app providers. These tools enabled the controller to obtain data concerning how users interacted with third-party websites and apps, including information about page visits, purchases and advertisements clicked. In November 2023, the data subject requested that the controller recognize that the processing of his personal data was contrary to the parties’ contract, erase or anonymize the personal data, provide access to the personal data and pay compensation. The data subject subsequently brought an action before the Regional Court of Munich II, seeking a declaration that the parties’ user contract did not permit the processing, cessation of the processing of personal data collected through the Business Tools on third-party websites and apps, restriction of further processing, erasure or anonymization of previously collected data and at least €5,000 in non-material damages. The relevant data included direct and indirect identifiers, such as his name, contact details, IP address and internal identifiers, as well as website URLs, visit times, app names and information about his interactions with websites and apps. The Regional Court of Munich II dismissed the action, holding that the declaratory and erasure or anonymization claims were inadmissible, the cessation claims were legally unavailable and the damages claim had not been sufficiently substantiated. In relation to the damages claim, it found that the data subject had not identified specific third-party websites or apps through which his personal data had been processed. The data subject accordingly appealed to the Higher Regional Court of Munich. The Higher Regional Court of Munich partially upheld the appeal. First, the court held that the Controller processed the data subject’s personal data under Articles 4(1) and 4(2) GDPR by receiving data transmitted through its Business Tools, associating it with a user account and storing it. The data subject was not required to identify every website, app or individual transmission because the relevant information was principally within the controller’s knowledge and it was sufficiently probable that he had been affected. Second, referring to CJEU C‑40/17 concerning the broad interpretation of “controller”, the court held that the controller was a joint controller under Articles 4(7) and 26 GDPR for the collection and transmission of the personal data. It controlled the programming of the Business Tools and participated in determining the purposes and means of processing. Allocating certain obligations to third-party website and app operators did not remove its responsibility. Third, referring to CJEU C‑252/21, the court held that the controller had not established a lawful basis for the processing of the personal data. The processing was not justified by consent under Article 6(1)(a), contractual necessity under Article 6(1)(b), a legal obligation under Article 6(1)(c), a public-interest task under Article 6(1)(e), or legitimate interests under Article 6(1)(f) GDPR. Accordingly, the court held that the controller's processing infringed Articles 5(1)(a), 5(1)(b), 5(1)(c) and 6 GDPR. Relying on CJEU C‑655/23, the court granted an injunction against future unlawful processing under German law. It also ordered restriction pending erasure under Article 18(1)(b) and erasure under Article 17(1)(d) GDPR. The court upheld the dismissal of the separate declaratory claim and also rejected anonymization of the website and app interaction data. Finally, relying on BGH VI ZR 10/24, the court awarded €1,500 in non-material damages under Article 82(1) GDPR for the data subject’s loss of control over his personal data.
Court case 42 K 25/25
A Jehovah’s Witnesses congregation (the controller) sent another congregation an introductory letter containing the personal data of two members (the data subjects) who were changing congregations from the controller to the recipient. The data subjects did not receive a copy of this letter despite their request. They filed a complaint with the DPA in July 2023, stating that their right of access under the GDPR had been violated. The controller argued that providing access to the introductory letter would undermine confidentiality required by religious law. According to the controller, restricting the right of access was necessary to allow the elders of the congregations to fulfill their biblical mandate to care for the members as shepherds of God’s flock. The controller only provided the data subjects a short list of information about them contained in the letter. The DPA dismissed the complaint as unfounded in May 2024. It held that the restriction to the right of access was justified under Article 91(1) GDPR and the national Jehovah’s Witnesses Data Protection Act (DSGJZ), as providing access would jeopardise the religious community’s ability to fulfill its mission. The data subjects filed a lawsuit before the Administrative Court of Berlin in May 2024, claiming the right to obtain a copy of the introductory letter. The court ordered the controller to provide the data subjects access to their personal data undergoing processing by handing over a copy of the introductory letter addressed to the data subjects’ new congregation. First, the court referred to the principle of primacy of EU law and held that Article 91(1) GDPR gives precedence to the data protection rules of religious associations or communities only insofar as these rules comply with the GDPR. Second, the court concluded that the data subjects were entitled to receive the requested copy pursuant to Article 15(1) GDPR in conjunction with Article 15(3) GDPR. The court considered a merely abstract over