GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
15 results · Showing 1–15
Plaintiffs versus Free State of Saxony
The plaintiffs challenged a decision approving the amendment plan concerning the southern runway and apron at Leipzig/Halle Airport. During the proceedings, they sought permission for their technical adviser, a permanent resident in the United States, to participate in the oral hearing by video and audio transmission. Among other issues, with the participation via video call, the discussion revolved around the transmission qualifying as a data transfer to United States. The transfer involved data of the plaintiffs, judges as well as spectators. The plaintiffs considered such lawful according to Article 49(1)(e) GDPR. The plaintiffs also submitted that personal attendance of the adviser would involve considerable time and expense and that avoiding a burdensome long-distance journey would support the quality of his participation. They further argued that remote participation would reduce the costs of the environmental proceedings and avoid air travel in furtherance of their noise and climate protection objectives. They suggested scheduling the adviser’s participation on a designated hearing day and at an appropriate time. The oral hearing had been scheduled over three days, with two substitute dates, in proceedings involving extensive subject matter and numerous participants. The court rejected the application. First, it exercised its discretion under § 102a VwGO and considered the case unsuitable for a video hearing because accommodating the six-hour time difference would impede the structured conduct of the complex, multi-day hearing. The adviser’s questioning from the United States would also constitute sovereign judicial activity extending into another state and therefore require US authorization through judicial assistance. Concerning data protection, the court held that Article 6(1)(e) GDPR read with § 102a VwGO did not by itself make the transfer lawful. On the contrary, the Court considered that consent should have been obtained under Article 49(1)(a) GDPR, which was not possible in that case given that it was not possible to know in advance which people would attend the hearing. Article 44 GDPR additionally required compliance with Chapter V. The court found that the Commission’s adequacy decision under Article 45 GDPR applied only to transfers to US organizations listed under the EU-US Data Privacy Framework but did not cover the potential transfers in the present case. The plaintiffs had neither claimed nor established that the transmission would be confined to such organizations, and no appropriate safeguards under Article 46 GDPR had been put in place. The court also held that Article 49(1)(e) GDPR did not apply because the transfer was not necessary for the pursuit of legal claims, as the adviser could attend the hearing in person. Accordingly, the court concluded that the costs, time, and environmental considerations did not outweigh the legal and planning risks.
TikTok Technology Limited
TikTok Technology Limited, the controller, and TikTok Information Technologies UK Limited appealed a decision of the Data Protection Commission, the DPA, before the High Court. The DPA had opened an own-volition inquiry into transfers of personal data of EEA users of the TikTok platform to China. The controller operated the TikTok platform in the EEA and allowed personnel of China-based group entities to remotely access certain EEA user data. The controller accepted that the data included personal data and that the remote access constituted a transfer under Chapter V GDPR. The controller relied on standard contractual clauses and supplementary measures. It argued that the personal data was stored outside China and only remotely accessed from China. On this basis, the controller claimed that Chinese public authorities could not compel access to the data because, under the territoriality principle in Chinese law, Chinese authorities had no power to access data stored outside China. The DPA considered that the controller had not sufficiently demonstrated that the relevant Chinese laws would not apply to the personal data while it was being processed by personnel in China. The DPA also considered that the controller had failed to properly assess whether the transferred data received a level of protection essentially equivalent to that guaranteed in the EEA. During the inquiry, the controller also introduced Project Clover. This was a set of measures intended to localise EEA user data in Europe, restrict access by China-based personnel and reduce the data flows still accessible from China. Under Project Clover, certain data would remain accessible by China-based personnel, but the controller argued that this data would be subject to additional privacy-enhancing measures, including pseudonymisation and differential privacy. The DPA found that the controller infringed Article 46(1) GDPR between 29 July 2020 and 17 May 2023. It also found that the controller infringed Article 13(1)(f) GDPR between 29 July 2020 and 1 December 2022, because its 2021 privacy policy did not identify the third countries to which personal data was transferred and did not properly explain the nature of the processing. The DPA imposed administrative fines totalling €530 million. It also ordered the controller to suspend the transfers and to bring its processing into compliance with the GDPR. The controller appealed the infringement findings, the fines and the corrective orders. The Court largely dismissed the appeal. Unlawful international transfers to China First, the Court upheld the finding that the controller infringed Article 46(1) GDPR. The Court held that Chapter V GDPR requires a controller transferring personal data to a third country to verify that the data receives a level of protection essentially equivalent to that guaranteed in the EEA. The controller must also be able to demonstrate that assessment, in line with the accountability principle under Articles 5(2) and 24 GDPR. The Court rejected the controller’s argument that the DPA had reversed the burden of proof. The DPA did not have to prove that Chinese authorities would in fact access the personal data. Rather, the relevant question was whether the controller had adequately verified and demonstrated that the transferred personal data received the required level of protection. The Court also rejected the controller’s argument that the DPA had misinterpreted Schrems II. According to the Court, the DPA was entitled to assess whether the controller’s verification of the third-country legal framework and supplementary measures was adequate. Since the controller had not properly assessed the position of personal data processed by personnel in China, the DPA was entitled to find an infringement. Transparency obligations (Article 13(1)(f) GDPR) Second, the Court upheld the finding that the controller infringed Article 13(1)(f) GDPR. The Court held that the controller’s privacy policy should have identified the third countries to which personal data was transferred, including China. It should also have explained the nature of the processing. The Court considered that the 2021 privacy policy fell short of the GDPR’s transparency requirements. Negligence and entitlement to impose fines (Article 83 GDPR) Third, the Court upheld the DPA’s conclusion that the infringements were negligent under Article 83(2)(b) GDPR. The controller failed to comply with an obvious obligation under Article 46(1) GDPR and did not justify its misunderstanding of its obligations under Article 13(1)(f) GDPR. Therefore, the DPA was entitled to impose administrative fines. However, the Court left the controller’s appeal against the amount of the fines for a later judgment. Corrective measures Fourth, the Court assessed the corrective orders. It held that the DPA had not erred in law by considering whether a suspension order and processing order were necessary, appropriate and proportionate. The DPA was not required to make a further infringement finding before adopting corrective orders. However, the Court found that the DPA had not adequately assessed later evidence submitted by the controller. This included an updated Chinese law opinion and, in particular, the Project Clover measures. The Court accepted that Project Clover involved significant changes to the controller’s transfer model, including data localisation, access controls, reduced data flows and privacy-enhancing technologies. The Court held that the DPA had not sufficiently explained why the controller’s pseudonymisation and differential privacy measures were ineffective, or why they did not affect the need for a suspension order. In particular, the DPA had not properly assessed whether EEA users remained identifiable in the data still accessible by China-based personnel under Project Clover. The Court noted that pseudonymised data is not automatically non-personal data, but it is also not necessarily personal data in every context. This required a reasoned assessment. Outcome The Court therefore upheld the finding that the controller’s transfers to China were unlawful under Article 46(1) GDPR and confirmed that the DPA was entitled to impose administrative fines. However, it vacated the DPA’s order requiring the suspension of the transfers, as well as the related processing order. The matter was remitted to the DPA, which must reassess whether corrective measures remain necessary and proportionate in light of Project Clover and the other later evidence.
Court case W171 2302513-1
The controller was an Austrian magazine publisher based in Vienna. Its business consisted in publishing and distributing weekly, monthly and other periodicals. The data subject was a long-standing customer of the controller. They held multiple subscriptions. On 7 March 2022, the data subject received an informational email with regard to one of their subscriptions. The email contained links allowing users to unsubscribe from further emails or manage their email settings. The unsubscribe link led to a website operated by the controller’s marketing software provider. The provider was a company specializing in mass email marketing solutions. Its parent company was headquartered in USA, while its subsidiary was based in Germany. The data subject complained to the controller and requested information regarding the receipt of this email. Additionally, they contended that the transfer of their data to the United States was unlawful. On 25 April 2022, the data subject lodged a complaint with the Austrian DPA. They argued that the controller had failed to properly respond to their access request, had not provided the required information under the GDPR and had apparently transferred personal data to the United States without a valid legal basis. The controller alleged that the failure to respond happened because of an internal error. It argued that it had subsequently provided the data subject with the information required under Article 13 GDPR, Article 14 GDPR and Article 15 GDPR. The controller further submitted that for the sending of informational emails, it used a marketing software provider, acting as a processor, which offered services for the mass sending of emails. According to the controller, only the data subject’s first name, surname and email address were shared for this purpose. It acknowledged that a transfer to third countries could not be ruled out, but argued that any such transfer was covered by Standard Contractual Clauses (SCCs) and additional technical, contractual and organisational measures. It also referred to amendments it made after the Schrems II to its data processing activities to comply with this decision and to the later migration of existing customer data to European data centres. The DPA partly upheld the complaint. It found that the controller had infringed Article 44 GDPR because it had not complied with the requirements for transferring the data subject’s personal data to the USA. The DPA also found a violation of Article 13 GDPR, because the controller had failed to provide the data subject with the required information at the time of data collection. However, the DPA rejected the complaint concerning Article 15 GDPR since the controller had subsequently provided the requested information. The controller appealed the DPA’s decision before the Austrian Federal Administrative Court. It further argued that the SCCs with the provider and the additional implemented safeguards ensured a level of data protection equivalent to that of the GDPR. It also alleged that there was a reference to this contractual relationship in its privacy policy. Regarding the transfer to third countries, the court agreed with the DPA that the processing involved a transfer of personal data to the USA by disclosing the data subject’s first name, surname and email address to the marketing software provider. It pointed out that the provider had used these data at least once for the sending of the email at issue. The Court then assessed the transfer under Chapter V GDPR which governs transfers of personal data to third countries or to international organizations. It noted that, at the relevant time, there was no adequacy decision under Article 45 GDPR for transfers to the United States. It found that the previous EU – US Privacy Shield was already declared invalid by the CJEU ruling in [https://infocuria.curia.europa.eu/tabs/affair?lang=en&sort=AFF_NUM-DESC&searchTerm=%22C-311%2F18%22&publishedId=C-311%2F18 Case C-311/18 (Schrems II)] and the later EU-US Data Privacy Framework was not relevant to the case, because it was adopted after the processing at issue. It relied heavily on Schrems II. It stated that Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR may constitute appropriate safeguards. Furthermore, it pointed out that the CJEU in this case held that due to the contractual nature of SCCs they cannot bind third-country public authorities. The court therefore determined that SCCs may need to be supplemented by additional safeguards, depending on the situation of the third country concerned. The court concluded that the transfer must ensure a level of protection essentially equivalent to that guaranteed within the EU. The court accepted that the controller and the provider had used the European Commission’s Standard Contractual Clauses and had implemented certain technical, contractual and organisational measures, including encryption, terms of use and storage-management systems. However, it held that although these additional measures increased the level of data protection, they were not sufficient to remedy the core concerns identified by the CJEU in Schrems II, namely the potential access of US authorities to personal data and the lack of effective judicial redress. The court therefore upheld the DPA’s decision that the safeguards implemented by the controller were insufficient. It therefore ruled that the transfer infringed Article 44 GDPR. Regarding the information obligations, the court also upheld the DPA’s finding of a violation of Article 13 GDPR. It noted that the controller did not actively provide the required information to the data subject at the time of data collection. It also pointed out that it was not enough to argue that a privacy policy existed online. In addition, the court concluded that the controller had violated the accountability principle under Article 5(2) GDPR since it was not able to prove that the required information had been provided to the data subject in accordance with Article 13 GDPR. The court dismissed the controller’s appeal and upheld the DPA’s findings.
TIKTOK TECHNOLOGY LIMITED
TikTok challenged a decision and related suspension order issued by the Irish DPA concerning transfers of EEA user data to China under Article 46 GDPR. In the decision, the DPA found that TikTok had infringed Article 46(1) GDPR by failing to ensure that personal data of EEA users transferred outside the EEA (specifically through remote access by personnel in China) received a level of protection essentially equivalent to that available within the EU during the relevant period. The DPA also found a breach of Article 13(1)(f) GDPR for failure to provide required information about such data transfers to data subjects. Consequently, the DPA imposed administrative fines totalling €530 million, a suspension order requiring TikTok to suspend the data transfers, and a corrective order requiring TikTok to bring its processing operations into compliance. TikTok initiated an appeal against the DPA decision. The appeal automatically stayed the obligation to pay the administrative fines, but it did not stay the suspension order or corrective order. TikTok applied for a stay of those orders, asserting that compliance would require billions of euros in expenditure, significant business disruption, and harm to stakeholders’ experience, and that such losses could not be remedied if TikTok ultimately succeeded on appeal. The DPA opposed the stay, asserting that the ongoing data transfers posed risks to the fundamental rights of TikTok’s 159 million monthly EEA users. The Court held that the appropriate legal standard for deciding whether to grant a stay should be decided according to the national procedural rules (Okunade test), rather than the harmonized EU ones (Zuckerfabrik test). Under the Okunade test, the Court must identify the course of action carrying the least risk of injustice pending the appeal. As the DPA accepted that TikTok’s appeal raised a serious issue to be tried, the Court focused on whether damages would be an adequate remedy and where the balance of justi
Court case 13 O 156/24
The controller is the provider of a social network based in the United States. It stores personal data on several different servers, some of which are in the US. The data subject is a user of the controller’s social network, which made an access request under Article 15 GDPR. The controller partly refused to provide the data subject with information under Article 15 GDPR. The refusal concerned possible access to data by US intelligence services. The controller referred to national law (Section 702 of the US Foreign Intelligence Surveillance Act of 1978), under which it is forbidden for the controller to provide the data subject with such information. The data subject sued the controller before the court of first instance (Regional Court of Bonn, Landgericht Bonn - LG Bonn) for, inter alia, €1,500 in non-material damages for the allegedly illegal transfers of personal data to the U.S. Furthermore, he claims another €1,000 in non-material damages for the refusal of the controller to provide the data subject with a copy of his personal data under Article 15 GDPR. The controller claimed that the data transfer to the US was justified, because it is necessary for the performance of the contract, which follows from the nature of a digital, international, social network. It also insisted that is was not permitted to provide information regarding the access of US intelligence services. The court found that the lawsuit was partly inadmissible and partly unfounded. First, the court found that the personal data transfers to the US between the coming into effect of the GDPR until the 9 July 2023 had been legal under Article 49(1)(b) GDPR. Since 10 July 2023 they were and are legal under Article 45(1) GDPR due to the adequacy decision by the European Commission. Second, the court followed the argument of the controller that it was in the very nature of an international social network that personal data can potentially be accessed world wide and therefore need to be able to be saved world wide in order for the controller to be able to provide their services. The court acknowledged that it is at least necessary to temporarily save the data in a cache in the US to provide US users with the profile information of the data subject. The court found that it doesn’t matter if the user really has platform friends in the US but rather that the controller has to ensure that their services are working properly world wide. Therefore, at least infrastructure for international caching of data was necessary. Third, the court also held that the data subject had at least implicitly consented to the international transfer of data under Article 6(1)(a) GDPR because every user of a US based social network had to know that their data would potentially be stored in the US in order for the social network to function properly. It didn’t matter, as the court holds, that the data subject had his contract with an Irish subsidiary, because everyone knew that a US company was behind this social network. Fourth, regarding the controller’s refusal to provide the data subject with information about data transfers to US intelligence services the court did not see a justification for this refusal under the national data protection law (§ 29(1) German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG)) because it only referred to other German laws that prohibit providing the data subject with information under Article 15 GDPR. The court furthermore held, that Article 15(4) GDPR was also not a legal basis for a refusal to provide information in this case because there were no rights and freedoms of others concerned by a law in the US. However, the court held that the controller’s refusal can be relied on the general justification of a legal emergency, in its specific form of an unresolvable conflict between obligations. Lastly, the court held that the German public has known for many years that the US did not have a comparable level of data protection and therefore a user has to expect that a US based company had to comply with such US laws. Even though the US had a government with anti-democratic, anti-rule of law, autocratic and fascist tendencies, and despite the deficits in freedom and data protection rights, the US still had to be viewed as a democratic and rule of law state. Therefore, it needs to be allowed for US companies that do business in the EU to comply with US laws.
Court case 2023 640 JR
In 2023, two applicants challenged decisions under Ireland's safe third country return system. Applicant A argued that the Minister improperly relied on the UK adequacy decisions, which exclude immigration-related data transfers, to justify the return order. Applicant B claimed the system lacked adequate data protection equivalent to the Dublin III Regulation. Both cases centered on the transfer of personal data to the UK during the immigration process, alleging GDPR violations. However, neither applicant pursued data protection remedies with the Irish Data Protection Commissioner. The State defended the data transfers, citing public interest grounds under Article 49(1)(d) GDPR and emphasizing the necessity of data exchange for the functioning of the Common Travel Area (CTA), a long-standing arrangement enabling free movement between Ireland and the UK. The court concluded that alleged GDPR breaches did not invalidate the safe third country return system. It found that existing remedies under the Data Protection Act 2018, such as complaints to the Data Protection Commissioner, were sufficient to address potential violations. Furthermore, the court upheld the legality of data transfers under Article 49(1)(d) GDPR, citing public interest in maintaining fair and effective immigration control and the CTA’s operation. The judgment emphasized that broader questions of GDPR compliance in the immigration context require fuller evidence and more focused proceedings.
Association of Accidental Americans
The Association of Accidental Americans (“Association”) sought the annulment of the decision of 23 May 2022 by which the French DPA (“CNIL”) ordered the closure of its complaint seeking the suspension of automatic transfers of tax data operated between France and the United States pursuant to the international agreement concluded on 14 November 2013 (“FATCA Agreement”). The Association appealed the decision in front of the French Supreme Administrative Court (“Conseil d’Etat”). Firstly, Article 5 GDPR states that processing must respect data minimization and storage limitation. The Association had considered that by analyzing the US Treasury and statements by the US tax authority, the transfer of personal data to the US authorities under the FACTA Agreement did not meet the data minimization requirement since (i) little or no use would be made of this data by these authorities due to the lack of resources available and (ii) there would be a lack of reciprocity between the American and European authorities as regards to the transmission of this data. The Conseil d’Etat considered that since it was not disputed that the processing at issue served a legitimate purpose of improving compliance with tax obligations and provides for procedures for selecting, collecting and processing data that was appropriate and proportionate to that purpose, the circumstances alleged could not lead to this processing as being regarded as failing to comply with the data minimization requirement. Furthermore, the Conseil d’Etat noted that the mere fact that the 'FATCA' agreement does not contain any stipulations on the length of time for which transferred data may be retained did not in itself, in view of the safeguards provided by US law, and in particular the Privacy Act of 1974, imply a failure to comply with Article 5(1)(e) GDPR. Secondly, the Association had held that although the Conseil d’Etat had ruled that the FATCA Agreement did not infringe Article 46 GDPR in previous decisi
Court case W137 2255764-1
This judgement stems from one of the 101 complaints filed by the NGO noyb in the context of data transfers to the US. The data subject lamented a violation of Chapter V GDPR due to the unlawful transfer of their personal data in lack of a valid legal basis. The controller made use of analytical tools by Google on their website. When visiting such a website, the data subject triggered a transfer of personal data to the US, where Google processes personal data imported from Europe. Data transfers between US and EU were originally based on an Adequacy Decision by the Commision, in turn based on the transatlantic legal framework known as 'Privacy Shield'. Nevertheless, after C-311/18 (“Schrems II”), the Commission’s adequacy decision concerning was invalidated by the CJEU. Consequently, controllers could export data only on the basis of alternative tools guaranteeing an adequate level of protection, such as Standard Contractual Clauses (SSCs). The Austrian DPA held that SSCs implemented by the controller – the “data exporter” – could not guarantee an adequate level of protection, mainly due to their inability to limit the power of US intelligence agencies to access personal data stored by Google. The controller appealed the decision. The controller claimed that data transferred were not personal data and that in any case Chapter V GDPR envisages a risk-based approach, which was taken into account by the controller. Finally, the controller also argued that the data subject had no legitimation to bring action, as at the time of the events they were working for the NGO that represented them in the procedure before the DPA. The Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG) rejected the appeal. First, the court denied that the fact that the data subject worked with the NGO representing them pursuant to Article 80 GDPR could exclude their legitimation to file a complaint against the controller. About the qualification of the information transferre
Österreichischen Datenschutzbehörde (Austrian data protection authority)
This case concerns a judicial review against a 2021 decision of the Austrian DPA (Datenschützbehörde - DSB). The decision originally stemmed from a complaint filed by the NGO noyb, following the CJEU judgement in case [https://curia.europa.eu/juris/liste.jsf?num=C-311/18 C-311/18] ("Schrems II"). The Austrian DPA found that the use of Google Analytics by an Austrian website led to the transfer of personal data to the US in violation of Chapter V of the GDPR. At the same time, the supervisory authority ruled that Chapter V of the GDPR sets out obligation only for the data exporter - in the present case, the Austrian website - and not the data importer - Google LLC. Google LLC appealed the decision. Google stated that transfers were lawful as they relied on Standard Contractual Clauses (SCCs) pursuant to Article 46(2)(c) GDPR. It also claimed to have adopted a "risk-based approach" to the transfers, by implementing technical and organisational measures aiming at mitigating the risks to Europeans' data protection rights. The data subject also appealed the decision, arguing that Chapter V of the GDPR applies to data importers, too. In addressing the controller's appeal, the court confirmed that the data transfer to Google LLC was unlawful. Referring to the CJEU judgement in case [https://curia.europa.eu/juris/liste.jsf?num=C-311/18 C-311/18], the court held that SCCs can be considered effective only as long as - on their own or in combination with additional technical and organisational measures - they are able to compensate for the risks taken by a data exporter when transferring data to third countries. If the data exporter is not able to meet these requirements, data transfers are unlawful and shall not take place. With regard to the present case, the court found that even though Google had implemented certain organisational and technical measures, these were not sufficient to prevent US intelligence agencies from accessing Europeans' personal data. As a matter of fact, Google's own report indicated that the number of requests made by such agencies was actually very high. Assessing Google's organisational measures, the court noted that a contractual obligation to inform the data exporter about an access request by a public authority was not sufficient to address the risks to data subjects' fundamental rights. In case of emergency, US law enables public authorities to order the controller not to share with third parties information about the disclosure. In addition, and above all, Europeans have no effective legal remedy against unlawful disclosure. The publication of a transparency report by Google did not solve the issue, either. As far as technical measures were concerned, the court stressed that encryption was not an effective tool. Under US law, Google is obliged to provide the requesting authority not only with data transferred, but also with encryption keys to decypher them. More in general, the court explicitly clarified that Chapter V of the GDPR is incompatible with the "risk-based approach" envisaged by the Google. As a matter of fact, a "business-friendly interpreation" of the GDPR did not play any role in [https://curia.europa.eu/juris/liste.jsf?num=C-311/18 C-311/18] and was thus inadmissible. As far as the data subject's appeal was concerned, the court dismissed the data subject's arguments. The court upheld the Austrian DPA's interpretation that Chapter V of the GDPR applies only to the data exporter, and not to the data importer. The court stressed that obligations stemming from Chapter V of the GDPR should not be confused with contractual obligation binding the data importer in the context of SCCs or other private law agreements with the data exporter.
Court case 3 L 763/22.NW
In 2022, the German Federal Statistical Office, the controller, ran the 2022 census. As part of the census 2022, it also conducted a building and housing census (GWZ). In this vein, the controller requested information about the property of the data subjects in June 2022, which the latter did not comply with. The data is collected via an online form on the official Census 2022 homepage or via a paper form that is thereupon digitalized by a third party. In July 2022, the data subjects requested information about the data processing of the controller via Article 15 GDPR. Among other things, the data subjects wanted to know if the personal data would be processed in a third country. The data subjects opposed the data collection, claiming that the collected personal data was not sufficiently protected and that the incorporation of Cloudflare was not in line with the Schrems II judgment of the CJEU. In its response, the controller clarified that all collected data is exclusively processed by servers of the Federal Statistical Office. The integration of the company Cloudflare within the official Census 2022 homepage concerns only the generally accessible information and its functionality. In September 2022, the data subject filed a suit, claiming that, among other things, that the collected personal data was not sufficiently protected. Especially the incorporation of Cloudflare into the official Census 2022 was not in line with the Schrems II judgment by the CJEU. Collection of data The court held that the request by the defendant to provide information concerning the building and housing census did not violate the provisions of data protection law and was compatible with the provisions of the GDPR. The collection of data within the framework of the Census 2022 served the performance of a task in the public interest. The Census 2022 is a federal statistic and therefore a prerequisite for political decisions, to continuously collect, process, present and analyse da
Pflegeplatzmanager GmbHhttps://gruendelpartner.de/newsroom/gruendelpartner-erwirkt-weitreichende-entscheidung-zur-unzulaessigkeit-von-cloud-und-it-dienstleistungen-durch-us-tochterunternehmen-in-deutschland/
The case concerned a decision by Vergabekammer Baden-Württemberg (Procurement Chamber Baden-Württemberg), the administrative authority that reviews public procurement procedures. A publicly owned company (Regionale Kliniken Holding RKH GmbH, today RKH Regionale Kliniken Holding und Services GmbH), owned only by municipalities and regional authorities and therefore subject to public procurement law, invited tenders for the procurement of software for digital administration in an open procedure throughout Europe.https://ausschreibungen-deutschland.de/843547_Software_fuer_Digitales_EntlassmanagementReferenznummer_der_Bekanntmachung_2021-20-WEI-OV_2021_Ludwigsburg The criteria contained, among other things, requirements for data protection and IT security. The company inviting the tenders received offers from company A and company B (Pflegeplatzmanager GmbH)https://gruendelpartner.de/newsroom/gruendelpartner-erwirkt-weitreichende-entscheidung-zur-unzulaessigkeit-von-cloud-und-it-dienstleistungen-durch-us-tochterunternehmen-in-deutschland/. Company A used the services of company C (Amazon Web Services EMEA S.à r.l.)The decision was pulished via [http://web.archive.org/web/20220812064735/https://rewis.io/urteile/urteil/ocw-13-07-2022-1-vk-2322/ rewis.io]. The used clauses are unique to [https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf AWS]. a subsidiary of company D (Amazon Web Services, Inc.) based in the United States, as a sub-processor. Its servers were located in the EU. Company C included clauses in its offer stating that it would not disclose customer data to any third party, except as necessary to maintain or provide the services, or as necessary to comply with the law or a valid and binding order of a governmental body. After reviewing the offers, the publicly owned company issued a decision where it awarded the contract to Company A, as their evaluation of the price was the most economical. Company B challenged this decision. It argued that company A had
Marie CITRINI in her capacity as user representative on the AP-HP Supervisory Board
In the emergency context of COVID-19 vaccination, the Ministry of Solidarity and Health entrusted the management of vaccine appointments on the Internet to various service providers, including the company Doctolib. Several associations including Interhop asked the interim relief judge to suspend the partnership with the Doctolib company insofar as the data collected was stored on an American company (Amazon Web Services or AWS), transfering data outside the EU non compliant with the GDPR. *Does Doctolib provide an adequate level of data protection when using Amazon Web Services? *Has the state sufficiently fulfilled its duty of care for the health data of the data subjects? It was held that no health data was provided other than certifying being eligible for priority vaccination. Additionally, it was considered by the Court the fact that Doctolib using the hosting services of AWS Luxembourg, whose data centres are based in France and in Germany. Considering the existence of legal safeguards, an addendum to AWS Ireland contract that no data would be transferred to the US and requests of access would be denied, and a technical safeguards entailing encryption of the data with a key held by a trusted third party in France, so that AWS does not have access to the data and the data being deleted after three months or at any time at the request of individuals, the Court considered that the level of protection in this context could not be regarded as manifestly inadequate. The Court therefore considered that in this specific context, data are not being transferred to the US. The application is therefore rejected by the Conseil d'État.
Court case 17 Sa 37/20
The Plaintiff worked as the defendant's employee. Employees' data are been processed for billing purposes. For that reason plaintiff's personal data were stored by the employer. The plaintiff by his request, asked for a copy of his data stored by the employer. The request was followed by a lawsuit, from the investigation of which it emerged that the data were transferred to the US' headquarters. The transfer took place before the starting date of the regulation. Does the mere threat of a potential data misuse suffice to claim damages under Article 82 GDPR? The court held that neither §26(1) BDSG nor Article 6(1)f GDPR legitimize the processing of employee data for software testing purposes. This is due to the fact that for these two legal basis to apply, the element of necessity is lacking. Instead of actual personal data it would have sufficed to use fictitious data to test the software. In this matter the Regional Labour Court acknowledged a violation of the GDPR as well as the BDSG. Furthermore, the mere potential threat of loss of control over a data subject’s own data does not does not constitute damage under Article 82 GDPR, consequently, the plaintiff is not entitled to damages under Article 82 GDPR. That is for the reason that an individual is only entitled to compensation for damages they have „suffered“, hence, the damage must have in fact occurred and not merely been anticipated. It has been also maintained that the defendant did not violate the GDPR by continuing the processing by the parent company in a third country when the GDPR entered into force on 25 May 2018. This is for the reason that the defendant had concluded the EU Commission’s standard contractual clauses (SCC) before transferring the personal data to the parent company and amended the SCC in ways that is sufficient to comply with Article 28 GDPR.
Syndicat de la Médecine Générale (SMG)
The parties asked the French Supreme Administrative Court (Conseil d’Etat) to suspend the centralisation and data processing of personal data relating to Covid-19 on the health data platform ‘Health Data Hub’ (data controller). The EU subsidiary of the American corporation Microsoft, established in Ireland, has access to personal data on the Hub as it licenses the software necessary to operate it (data processor). The data centre is located in the Netherlands. The parties also asked the Court to request the French DPA (CNIL) to rule on the implication of the invalidation of the Privacy Shield agreement in relation to personal data processed in the Health Data Hub. The parties highlighted that the condition of urgency was met. This is due to the urgent nature of the Covid-19 pandemic, the sensitive nature of the data centralised and processed in the Health Data Hub and the recent CJEU decision (“Schrems II” of the 16th July 2020). Finally, they deemed that there was a serious violation of the right to privacy and to protection of personal data. This is due to the fact that the company in charge of the Health Data Hub’s technical aspects, Microsoft, is subject to US law. The risk that this posed to the above-mentioned rights were outlined in the Schrems II decision. Is the contract between the French Health Data Hub and Microsoft, as a company subject to US surveillance law, in violation of Article 44 to 49 GDPR following the Schrems II decision? With regard to the Schrems II decision: The French Court outlined relevant segments in the the Schrems II CJEU decision. In this case, the CJEU held that Articles 46(1) and 46(2)(c) GDPR must be interpreted as meaning that a data subject, whose personal data is transferred to a third country, benefits from a level of protection essentially equivalent to that guaranteed by the GDPR and the EU Charter of Fundamental Rights. The French Court also highlighted that the CJEU held that the Privacy Shield adequacy decision (adopted as per Article 45(3) GDPR) was invalid. It was deemed invalid as it did not provide an adequate level of protection to personal data transfers from the EU to companies in the US. This is notably because public authorities in the US are able to request access to such personal data as a result of surveillance laws: Article 702 Foreign Intelligence Surveillance Act (FISA) or the Executive Order (EO) 12333. These law allow for bulk collection of personal data. They do not allow a data subject to enforce any rights before a tribunal. With regard to national law relating to collection and processing of data: The French Court outlined that Article L. 1462-1 of the public health code provides for the Health Data Hub and the collection of health data from the existing national health data system (as per Article L. 1461-1). Article L. 3131-1 of the public health code stipulates that the Health Minister can prescribe an Order in the public interest in case of a public health emergency, such as a pandemic. This order must be proportionate and necessary. As such, a Ministerial Order of the 10 July 2020 prescribed measures necessary to combat covid-19, including the processing of personal data concerning health (see Article L. 3131-16 public health code) With regard to the risk of transfer of data due to the contractual arrangement with Microsoft: The French Court stipulated the FISA and EO allows US public authorities to have access to transfers of data to the US from the EU without such appropriate safeguards for data subject. Therefore, any transfer of data to the US would be deemed to infringe Article 44 and subsequent of the GDPR, following the recent Schrems II decision by the CJEU. This is the case unless justified within derogation pursuant to Article 49. The Court highlighted that the contract with Microsoft stipulates that data must not be processed outside of the stipulated geographical zone (Netherlands). This is true unless resolution of issues must be achieved outside of this zone subject to authorisation by the Health Data Hub. However, the Minister for Solidarity and Health introduced a Order of the 9th October 2020, which stipulated that no data transfer outside of the EU would be performed. The French Court therefore outlined that this imposed on a barrier on the contractual arrangement with Microsoft which allowed for such a possibility. Therefore, the Court deemed that there was no possibility of transfer of personal data outside of the EU as a result of the contract. The claimant’s claim that there was an interference with fundamental rights, including to data protection, is not well founded. With regard to the risk of other transfers of personal data: The Court addressed the claimant’s concern that Microsoft, as an American company, is subject to FISA and EO. This means that it can be under the obligation to transfer data to American public authorities even if the data is stored in the EU and the contract between the Health Data Hub and Microsoft preclude such transfers. The Court held that it was necessary to consider the level of protection afforded during the transfers of data in light of the contractual stipulation, the law in the third country and the judicial system there. The Court highlighted that the French DPA (CNIL) stipulated in its defense that the risk of a transfer to the US by virtue of US surveillance law could not be excluded. This would subsequently infringe Article 28 and 48 GDPR which prohibit transfers to third countries unless agreed upon by the data controller or as a result of a legal obligation provided for in EU law or a Member State’s law. However, the French Court outlined that the CJEU in Schrems II only discussed circumstances where data is transfered to the US and did not discuss circumstances where such data is processed in the EU by American corporations subject to US law. The French Court also noted that the CJEU held that derogations found under Article 49 may allow for such transfers where necessary for a public interest recognised by EU law or the law of a Member State. It also deemed that there was public interest in allowing the use of health data in the context of the Covid-19 crisis and therefore, public interest in contracting with Microsoft on the technical aspects. The Court noted that such measures must be proportionate to the risk posed by the public health emergency and necessary considering the urgency and the absence of technical alternatives. The Court highlighted that it is the French DPA which must assess any potential public interest in link with the Covid-19 pandemic. The French Court also outlined that the claimants only claimed that there was a risk of a violation of the GDPR should Microsoft have to grant access to personal data to US public authorities rather than claiming a direct violation of the Regulation. The Court stipulated that the Health Data Hub must ensure that the data processor, Microsoft, adopts appropriate technical and organisational measures to ensure the protection of the rights of data subjects (pursuant to Article 28 GDPR). In light of this Article, Microsoft must also provide all information required and allow audits to be conducted. The Court therefore did not order the suspension of the Health Data Hub.
Data Protection Commission
Maximillian Schrems, an Austrian citizen, had been a Facebook user since 2008. As is the case with users residing in the European Union, some of the data belonging to Mr. Schrems had been transferred by Facebook Ireland to its servers belonging to Facebook Inc., located in the United States. In 2013, Mr. Schrems complained to the Irish Data Protection Commissioner (DPC) seeking to prohibit these transfers. When this complaint was rejected, he brought an action against the decision before the Irish High Court, which in turn referred a number of questions to the CJEU, the most prominent of which was whether the EU-US adequacy decision, the so-called “Safe Harbor", was valid. In its judgment on October 6th 2015 (Case C-362/14, “Schrems I”), the CJEU invalidated the Safe Harbor and stated that, in order to be "adequate", the level of data protection offered by the third country should be “essentially equivalent” to that being offered in the EU. As a result, the High Court annulled the decision rejecting Mr. Schrems’ complaint, and referred the case back to the DPC. In the remittal “judgment” before the DPC, Facebook Ireland explained that the invalidated adequacy decision was not relevant as a large part of personal data was transferred to Facebook Inc. pursuant to Standard Contractual Clauses (SCCs). On this basis, the DPC asked Mr. Schrems to reformulate his complaint. In his reformulated complaint lodged on December 1st 2015, Mr. Schrems alleged that US law required Facebook Inc. to disclose his personal data to certain United States authorities in the context of various monitoring programs (in particular, the FISA 702 and the Executive Order 12.333). In Mr Schrems’ view, these programs contravened different data protection principles as well as Articles 7, 8, and 47 of the Charter. After investigating the allegations made by Mr. Schrems, the DPC argued that it could not adjudicate on them until the CJEU had examined the validity of the SCCs, and so it brought pro