GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
367 results · Showing 1–20
Microsoft Ireland Operations Limited
The Irish Council for Civil Liberties (ICCL), a qualified entity, brought a representative action against Microsoft Ireland Operations Limited concerning the processing of personal data through the Xandr real-time bidding platform. ICCL alleged that personal data broadcast during real-time bidding auctions could include highly personal information and that the processing infringed several GDPR requirements, including transparency, data minimisation, security and consent obligations. It sought injunctive relief requiring Microsoft to cease, amend or restrict the processing. A dispute subsequently arose concerning the burden of proof and the parties' pleading obligations. ICCL argued that Articles 5(2) and 24(1) GDPR required the controller to demonstrate its compliance with the GDPR. Microsoft disputed that it was the relevant controller and argued that the ordinary rules of civil procedure placed the burden of establishing the alleged infringements on ICCL. The parties also disagreed about the information that had to be provided in the representative action. Microsoft sought further information concerning, among other things, the alleged infringements, the consumers affected and the funding of the proceedings. The court therefore determined several preliminary questions relating to the burden of proof, pleading requirements and access to information before the underlying GDPR allegations were decided. The court held that Articles 5(2) and 24(1) GDPR do not create a general reversal of the legal or evidential burden of proof. The claimant must first establish the matters for which it bears the burden, including that the defendant is a controller and that processing takes place which engages the relevant GDPR obligations. However, once those matters are established and compliance with a relevant GDPR obligation is at issue, the controller bears the legal and evidential burden of demonstrating compliance. In particular, where compliance with the principles in Article 5(1) GDPR or with the requirements covered by Article 24(1) GDPR must be determined, it is for the controller to prove that the relevant processing complies with those obligations. The Court considered this to follow from the accountability obligations. The court further held that the ordinary national rules on pleadings continue to apply to both parties. Each party must plead the material facts supporting the matters it is required to prove. Consequently, where the controller wishes to advance a positive case that it complied with the GDPR, it must plead the material facts on which that claim of compliance is based. Regarding the representative action, the court held that [https://www.irishstatutebook.ie/eli/2023/act/22/enacted/en/print Sections 19(10)] and [https://www.irishstatutebook.ie/eli/2023/act/22/enacted/en/print 19(11) of the Representative Actions for the Protection of the Collective Interests of Consumers Act 2023] do not give the controller a standalone right to require the claimant to provide further information. However, the controller may rely on ordinary procedural mechanisms, including requests for particulars, discovery or disclosure under [https://www.irishstatutebook.ie/eli/2023/act/22/enacted/en/print Section 34(2)], where the applicable requirements are met, and may challenge the admissibility of the representative action. The court did not determine whether the processing through the Xandr platform actually infringed the GDPR. It also declined to determine certain additional questions, including the application of the "peculiar knowledge principle", because the necessary facts had not been agreed. No fine or corrective measure was imposed.
XXXX
XXXX as the party lodged a complaint at the Austrian DPA (District Hospital XXXX as the co-party) on the unauthorised sharing of her personal data in seven different instances by the District Hospital XXXX. XXXX complained that the municipal association running the hospital infringed her fundamental right to secrecy of personal data. During a bitter employment dispute, her court submissions, which included health data, were circulated to the hospital's collegiate management, the members of the association's committee, their secretaries and others, and were discussed at a committee meeting on 27 October 2020. She also filed 27 further procedural applications, on service of documents, an oral hearing, file management, and injunctions against further processing. The Court held that the disclosures were lawful, as they were based on the controller's legitimate interests under Article 6(1)(f) GDPR (and, for health data, the exception for legal claims in Article 9(2)(f) GDPR). The Court affirmed that the recipients were authorised in this case to review the data, as they needed the information gained from the personal data to decide on the dismissal, could not be classified as "unauthorised third parties". The processing was found to be necessary, in line with respected data minimisation, and no overriding interests of the appellant could be established for XXXX. The Court relied on earlier final BVwG judgments and on an Austrian Supreme Court (OGH) decision of 28 July 2021 concerning the same dispute. The Court further rejected the XXXX's argument that the hospital's administrative director was a "falsus procurator" (false agent) and that only the association's chairman could access her data. The Court supported DPA's stance, confirming XXXX has no subjective right to assert how an authority should conduct the proceedings, where the Court dismissed on some aspects of the appeal as they had already been previously decided (res iudicata ). An appeal on points of law (Revision) was declared inadmissible because no question of fundamental legal importance arose.
Latvijas Republikas Saeima
Seventeen natural persons, who were minority shareholders of a public limited liability company, brought proceedings before the Satversmes tiesa (the Constitutional Court of Latvia). They challenged national legislation requiring information on shareholders to be included in the public companies register. The information made publicly available included shareholders’ identity and contact details, as well as information concerning the class, number and nominal value of their shares and the number of votes attached to them. The information could be accessed online and downloaded in bulk by any person without identification or the need to demonstrate a legitimate interest. The data subjects argued that such disclosure constituted an unjustified and disproportionate interference with their rights, particularly because they were neither beneficial owners nor members of the company’s management bodies and did not exercise control over the company. The national legislation pursued several objectives, including ensuring transparency and protecting third parties, combating money laundering and terrorist financing, and facilitating the implementation of sanctions. The Constitutional Court stated the proceedings and referred questions to the CJEU. In particular, whether [https://eur-lex.europa.eu/eli/dir/2017/1132/oj/eng Directive 2017/1132] required such disclosure and whether Articles 5 and 6 GDPR permitted national legislation providing unrestricted public access to that personal data. Directive 2017/1132 The Court first held that [https://eur-lex.europa.eu/eli/dir/2017/1132/oj/eng Article 14(d) Directive 2017/1132] does not require the disclosure of information relating to all shareholders, including minority shareholders. Shareholders do not, merely by holding shares, participate in the administration, supervision or control of a company within the meaning of that provision. In particular, minority shareholders are generally not authorised to represent or bind the company or perform management or supervisory functions. Legal basis The Court recalled that any processing must comply with the principles under Article 5 GDPR and satisfy one of the lawful bases under Article 6 GDPR. (i) The purposes must be sufficiently determined by law Since the disclosure of the shareholders’ personal data was required by national law, the Court considered that the processing had to be assessed under Article 6(1)(c) GDPR, which permits processing where it is necessary for compliance with a legal obligation to which the controller is subject. (ii) The purpose limitation and minimisation principles The Court recalled that, pursuant to Article 6(3) GDPR, the legal basis must determine the purpose of the processing, pursue an objective of public interest and be proportionate to the legitimate aim pursued. First, regarding the determination of the purpose, the Court held that the national court must verify whether the purposes of the processing could be identified with sufficient certainty from the wording of the legislation or its legislative context. This assessment was also relevant under the purpose limitation principle in Article 5(1)(b) GDPR. Second, regarding necessity and proportionality, the Court referred to the data minimisation principle under Article 5(1)(c) GDPR. It considered that making shareholders’ identity, contact details and information about their shareholdings publicly accessible constituted a serious interference with their rights. Such information could reveal aspects of their financial situation and investments and was accessible to a potentially unlimited number of persons. The possibility of downloading the information in bulk further increased the risk of retention, dissemination and misuse. As regards transparency and the protection of third parties, the Court found that disclosing the personal data of all shareholders, particularly minority shareholders, was neither appropriate nor necessary because those shareholders generally cannot represent or bind the company. The Court also acknowledged that public access could contribute to combating money laundering and terrorist financing. However, unrestricted access was not strictly necessary, since those objectives could be achieved through less intrusive measures, such as limiting access to persons demonstrating a legitimate interest. Practical difficulties in verifying such an interest could not justify a broader interference with fundamental rights. Similarly, although public access could facilitate the implementation of sanctions, unrestricted disclosure was not necessary. Less intrusive alternatives included limiting disclosure to persons subject to sanctions or granting access to other shareholders’ information only where a legitimate interest was demonstrated. Finally, the Court noted that the legislation lacked sufficient safeguards against abuse because the data were accessible online and could be downloaded in bulk by unidentified users. Consequently, the Court held that Articles 5 and 6 GDPR, read in light of [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12012P/TXT Articles 7] and [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12012P/TXT 8 CFR], preclude national legislation requiring the personal data of all shareholders, including minority shareholders, to be publicly accessible without conditions such as demonstrating a legitimate interest.
Court case 6Ob148/25w
The controller runs an address publishing business as well as a credit information agency. As part of its credit assessment activity, it (i) checks that individuals whose credit score is requested exist with data like their name and address and (ii) issues credit scores based on data provided by debt collection agencies and on statistics, as payment default data is available on approximately 10% of Austrians. The controller bought personal data about a data subject (name, address, date of birth) from a company (B) that operates in the address publishing and direct marketing industry. The contract provided that this data may only be used to check whether the individual with that name under that address exists. While the data subject’s data was initially collected by company B for the purpose of direct marketing, the controller used the personal data in question exclusively to check the individual with that name under that address exists. At a customer's request, the controller issued a credit assessment of the data subject. The assessment was based on the name, gender and address of the data subject because there was no available data on possible payment defaults of the data subject. The data subject brought an injunction against the controller. The main discussions regarded (i) a violation of the purpose limitation principle: the data was initially collected for direct marketing purposes and later used for credit assessment; (ii) the calculation of the score, which relied solely on statistical data and not on data actually concerning the payment history of the data subject. The court of first instance and second instance rejected the injunction. The court of first instance held that the controller processed the data according to the contract with company B. Moreover, the processing for the original purpose was compatible with the further processing. The court of second instance however held that the further processing was not compatible with the original purpose but that the controller could rely on national law as legal basis. As far as the method of credit assessment was concerned, both courts held that the processing fell under Article 6(1)(f) GDPR because the processing was necessary for operating a credit information agency. The data subject appealed the decision. The court partly upheld the decision of the court of second instance. Pre-emptive injunctions Firstly, the court referred to the case law of the CJEU that provides for the possibility of pre-emptive injunctions under national law. The scope of the subject matter of the injunction under Austrian national law is reduced to the specific violating actions the data subject claims. Therefore, as far as the data subject requests the controller to desist from unlawfully processing their personal data in general, the injunction is inadmissible because the data subject failed to name a specific violation. Purpose limitation The court considered that processing data to check if the individual exists in the context of credit assessments must be regarded as processing data for the purpose of credit assessments. This is true even where the data was not used for calculating the credit score itself. In this case, the controller processed the personal data for a different purpose than the marketing purpose that justified the initial collection. The further processing had significant consequences for the data subject and was not subject to appropriate safeguards pursuant to Article 6(4)(e) GDPR, in violation of Article 6(4) GDPR. Lawfulness of credit scoring calculation in absence of payment default data The court held that the assessment of a credit score on the basis of statistical data, and the address and and name of the data subject in the absence of data on possible payment defaults was not per se unlawful under Article 6(1)(f) GDPR. As there is available data on payment defaults on only 10% of Austrians, credit assessments of the majority of the population would otherwise not be possible. Such a calculation was also in line with data subjects expectations. The court found a violation of the principle of purpose limitation but held that the credit assessment in the absence of payment data was not per se unlawful.
Court case 10 A 5144/23
The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the parking lot, the goods receiving and shipping areas, production area, the office, and staff break rooms. The monitoring of employees (the data subjects) was discovered during a labour inspectorate inspection in June 2022, which informed the DPA. In September 2023, the DPA reprimanded and fined the controller for violations of the principle of lawfulness and storage limitation, lack of legal basis for the processing, and the obligation to maintain a record of processing activities. The DPA issued two separate decisions against the controller – one where it fined the controller, and a separate decision where it issued the controller a reprimand. Upon the controller's appeal regarding the decision issuing the fine, the amount of the fine was reduced to €8,000 by a decision of the Local Court Hannover (Amtsgericht Hannover). The controller appealed the reprimand decision to the Administrative Court Hannover (Verwaltungsgericht Hannover) and argued that the employees had given their consent to the surveillance. It also stated that the surveillance was necessary to ensure compliance with hygiene regulations and that the outdoor areas were monitored to prevent break-ins, theft, and vandalism. According to the controller, both a reprimand and a fine for the same violations infringed the general prohibition against double punishment. The court dismissed the appeal and upheld the reprimand issued to the controller. It held that the controller had violated Articles 5(1)(a), 5(1)(e), 6(1), and 30 GDPR. Moreover, the court stated that issuing a reprimand and a fine for the same GDPR violations did not constitute a double punishment, as a reprimand does not fall under the criminal law definition of a sanction. The court pointed out that a reprimand is an administrative measure that involves a finding of a GDPR violation but does not serve a punitive purpose. Regarding the lawfulness of the processing, the court examined whether consent or legitimate interest could be relied upon. For consent, the court found that the processing could not be based on Article 6(1)(a) GDPR: the controller had not provided any evidence that the employees would have consented to the processing. The controller could not rely on legitimate interests under Article 6(1)(f) GDPR either, as no balancing test had been conducted. In addition, the court pointed out that neither compliance with hygiene regulations nor the prevention of burglaries and vandalism could constitute legitimate interests in the present case. Regarding hygiene, the court pointed out that the controller was required to comply with hygiene provisions by law as a business that processes food of animal origin. There was also no factual evidence for crimes mentioned by the controller being a threat in the area. Furthermore, the court held that the controller had infringed the principle of storage limitation by storing the video surveillance footage for longer than necessary: some data had been stored for years. Finally, the court confirmed that the controller had also violated Article 30(1) GDPR as it had not provided a record of processing activities despite the DPA's repeated requests.
pharmacy customer (data subject)
The data subject did not pay for items ordered and collected from a pharmacy (controller). After several reminders, the controller commissioned a debt collection agency, which pointed to several enforcement proceedings against the data subject. The controller then reported the data subject for fraud and provided the police with a record of the enforcement proceedings. The data subject lodged a complaint with the Austrian DPA (DSB) regarding the violation of their right to confidentiality, claiming the disclosure of the record constitutes a violation of [https://www.ris.bka.gv.at/eli/rgbl/1896/79/P427/NOR40233943?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=EO&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=427&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=03.08.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=c7a56c5c-2040-47e7-91fe-3ae37e4eb965 § 427 EO] in conjunction with [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=03.08.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=607193ce-5b62-4d7a-abab-5027790e9ed4 § 1 DSG]. On 13. January 2026, the DPA dismissed the data subject's complaint and requests. The data subject subsequently appealed against the DPA's decision arguing that the provisioning of the record would violate the principle of data minimisation under Article 5(1)(c) GDPR, since handing over bills and reminders would have been sufficient. They also argued that the disclosure of the record would constitute a significant interference with their rights and, therefore, the conducted balancing of interests under Article 6(1)(f) GDPR was incorrect. Additionally, some of the listed enforceable titles were no longer current, thus violating the right to accuracy under Article 5(1)(d) GDPR. First, the court held that the controller had not violated the data subject's right to confidentiality under [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=03.08.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=607193ce-5b62-4d7a-abab-5027790e9ed4 § 1(1) DSG], as the provision of the record of enforcement proceedings to the police was in the legitimate interest of the controller under Article 6(1)(f) GDPR and did not violate the right to data minimisation pursuant to Article 5(1)(c) GDPR. The record was necessary as it provided a substantive evidence of the alleged fraud - providing only bills and reminders would not have been sufficient - as well as for the collection of outstanding debts. Thus, the record was also the least intrusive means. Given their prior history, the data subject should have reasonably anticipated such legal action. Consequently, the data subject's rights were found not to outweigh the controller's competing interests. Secondly, the court held that the professional and ethical confidentiality obligations of a pharmacist do not prevent them from reporting (potential) criminal offences or pursuing civil causes of action. Therefore, the court dismissed the appeal, as the DPA's decision was not found to be unlawful.
Court case 8426/2026
The data subject was a candidate for the position of senior legal counsel at the Bulgarian branch of the German commercial bank Flatex Degiro (the controller). As a prerequisite for entering into an employment relationship, the controller required her to submit a criminal record certificate. The data subject brought a damages claim before the Administrative Court of Sofia, seeking BGN 100 in compensation for non-material damage. She argued that the requirement to provide a criminal record certificate was unlawful and that the processing of the personal data contained in it lacked a legal basis. She alleged that this caused her psychological distress, discomfort and stress in the workplace. The controller argued that the requirement was justified by the nature of the position and the access to confidential information associated with it. It maintained that the unauthorised use of such information could lead to fraud and abuse. The Administrative Court dismissed the claim after finding that the processing of the data subject’s criminal record certificate was lawful under Article 6(1)(c) GDPR. It found that the applicable Bulgarian anti-money laundering legislation did not expressly provide for requesting a criminal record certificate at the time but rejected a formalistic approach requiring an explicit legal provision. It considered that the requirement followed from the purpose and overall framework of the anti-money laundering legislation and therefore found the processing lawful under Article 6(1)(c) GDPR. The data subject appealed this decision before the Bulgarian Supreme Administrative Court. The Bulgarian Supreme Administrative Court first noted that an Article 82 GDPR damages claim requires three cumulative conditions: an infringement of the GDPR, damage and a causal link between the infringement and the damage. It also held that the controller bore the burden of proving the lawfulness of the processing pursuant to Article 82(2) GDPR. It found that it had provided sufficient evidence that the processing was lawful. The court however did not base the lawfulness of the processing on a legal obligation under Article 6(1)(c) GDPR. The court agreed that requiring and reviewing the criminal record certificate constituted processing of personal data but found that the processing was lawful under Article 6(1)(f) GDPR. It considered that the controller had a legitimate interest in assessing the reliability of a senior legal counsel who would have access to confidential information, including client data, contracts, corporate documents and correspondence with banks and regulatory authorities. The court also considered the risk that such information could be misused for fraud or other abuses. The court found no infringement of the GDPR and upheld the dismissal of the damages claim. It further observed that the emotional distress alleged by the data subject appeared to result not from the processing of her personal data itself, but from the controller’s failure to accept her professional opinion that requesting the criminal record certificate was unlawful.
Municipal Executive Board of Enschede
The Municipal Executive Board of Enschede, the controller, decided to conduct continuous pedestrian counts to obtain information about visitor numbers in the city centre. From 25 May 2018, at least ten sensors captured the Media Access Control (hereinafter, MAC) addresses of devices with Wi-Fi enabled. When a sensor detected a MAC address, it was temporarily stored and converted into a pseudonymised MAC address using an algorithm. Since all sensors used the same algorithm, the same device received the same pseudonymised identifier across different locations. The resulting data included the sensor that detected the device and the date and time of detection. After several filters were applied, the data was retained for up to six months and used to estimate the number of unique visitors. The controller discontinued the pedestrian-counting system on 1 May 2020. Following an enforcement request, the Autoriteit Persoonsgegevens, the DPA, investigated the processing. It considered that the combination of pseudonymised MAC addresses and location data related to identifiable natural persons. According to the DPA, the data allowed individuals to be distinguished and could reveal lifestyle and behavioural patterns. It also identified three methods through which the controller could potentially determine the identity of device users. On 11 March 2021, the DPA imposed a fine of €600,000 on the controller for processing personal data without a legal basis between 25 May 2018 and 30 April 2020. It considered the controller responsible for determining the purposes and means of the processing and found that no legal basis under Article 6 GDPR had been established. The controller challenged the decision before the District Court of Overijssel. The Court held that the DPA had not sufficiently proven that the information processed by the controller constituted personal data. In particular, the DPA had relied on assumptions regarding the possibility of identifying device users without sufficiently investigating whether those identification methods were realistically available. The Court held that, under Recital 26 GDPR, the DPA should have assessed whether the means allegedly available to identify the individuals were reasonably likely to be used, taking into account the costs, time, available technology and technological developments. It therefore annulled the decision on the objection and revoked the original fine. The DPA appealed the judgment before the Council of State (Appeal Court). The Appeal Court dismissed the DPA’s appeal and upheld the annulment of the €600,000 fine. The Appeal Court noted that the DPA did not challenge the Court’s finding that it had failed to sufficiently investigate and substantiate the three methods through which the controller could allegedly identify individual device users. During the appeal hearing, the DPA also acknowledged that the applicable standard of proof had not been met regarding those methods. Instead, the DPA argued that natural persons had already been directly identified because the combination of MAC addresses and location data allowed the controller to distinguish and count unique visitors. According to the DPA, the ability to single out unique visitors was itself sufficient for the information to qualify as personal data under Article 4(1) GDPR, irrespective of whether the controller could determine their civil identity. However, the Appeal Court held that the DPA had not relied on this reasoning in its original decision or in its decision on the controller’s objection. In proceedings concerning an administrative fine, the DPA must conclusively establish and substantiate the alleged infringement before completing the administrative decision-making process. This requirement safeguards legal certainty and allows the alleged infringer to defend itself effectively and in a timely manner. The DPA could not wait until the judicial appeal stage to introduce a new argument explaining why the processing concerned personal data and why a punishable infringement had occurred. The Court had therefore not erred by refusing to assess this new argument. Since the DPA had not otherwise challenged the substance of the Court’s finding that the original infringement had not been sufficiently proven, the annulment of the fine remained in effect. The Appeal Court did not determine whether the pseudonymised MAC addresses and location data were, as such, personal data under the GDPR.
Zagrebački Holding d.o.o.
A utility and municipal services enterprise, Zagrebački Holding d.o.o. (the controller) provided users of its services with the option to request a copy of their bill via email. Where the name appearing in the email address differed from the user’s name, the controller requested a copy of an identification document as part of the process of verifying the identity of its users. It treated that discrepancy as an indication of possible identity fraud. According to the controller, users were asked to redact any information on the document that was not necessary for identification. In addition, the copies were deleted once the relevant purpose had been fulfilled and access to them was limited to a small number of authorised employees. The Croatian DPA (AZOP) found that the controller had not adequately informed users of the legal basis for collecting copies of identification documents, the applicable retention period, or whether providing such a copy was mandatory and what the consequences of not providing it would be. It held that the controller had infringed Article 13(1)(c) GDPR, Article 13(2)(a) GDPR and Article 13(2)(e) GDPR. Furthermore, it found that the company had not implemented appropriate technical and organizational measures for the process of verifying the identity of users who requested copies of bills via email, in violation of Article 25(2) GDPR. It fined the controller €25,000. The controller challenged the decision before the Administrative Court of Zagreb. It argued that it had published information on its website regarding the processing of personal data. It claimed that the information had been modelled on guidelines published by the EDPB. The controller further alleged that users had been informed that the data would not be retained for longer than was necessary for the purpose of the processing. It also argued that it did not collect an excessive amount of data, as it asked users to redact unnecessary information and that copies were deleted after verification was completed. The DPA pointed out that the information regarding data retention was contradictory or open to different interpretations, and that the controller’s deficiencies were not corrected even when a user requested clarification directly from the controller. Regarding the identification process, the DPA argued that the controller could have achieved the same objective without requesting copies of identification documents, for example by using previously verified email addresses. It considered that a discrepancy between a user’s name and the name associated with an email address did not constitute a reliable criterion for detecting potential identity fraud. According to the DPA, the procedure was not designed with sufficient consideration of the nature, context, and risks of the specific processing, and the mere instruction to users to redact parts of their identification document did not constitute a sufficient safeguard. The court held that the controller had not transparently provided users with the legal basis for collecting copies of identification documents. It found that this information was neither available in the controller’s published documents nor provided when users requested it directly via email. The court therefore upheld the finding of an infringement of Article 13(1)(c) GDPR. The court further found that the information concerning the retention period could be interpreted in different ways. In response to a specific inquiry, the controller should have provided clear information on the duration of the storage. It ruled that this amounted to an infringement of Article 13(2)(a) GDPR. The court also noted that one user had been told that the requested data could not be provided without an identification document, while the controller later stated before the DPA that users unwilling to send a copy could instead present it in person at the Holding Centre in Zagreb. In light of the lack of clear information as to whether providing the identification document was mandatory and the consequences of not providing it, the court upheld the finding of an infringement of Article 13(2)(e) GDPR. Moreover, the court agreed with the DPA that the controller had not implemented appropriate technical and organisational measures for the identification procedure. It determined that the format or name of an email address did not provide sufficient assurance that a request actually originated from the user concerned, while the procedure effectively required certain users to provide a copy of an identification document in order to communicate remotely. The court pointed out that processing such copies could pose a high risk to individuals’ rights, such as identity theft. The court considered that the controller could instead have established a secure email-verification procedure, allowing users to verify an email address for communications and the delivery of bills, while ensuring that the identification procedure applied consistently regardless of the structure of the email address. It therefore upheld the finding that the controller had failed to implement appropriate safeguards in breach of Article 25(2) GDPR. Furthermore, the court rejected the controller’s reliance on the EDPB’s practice, noting that it concerned a different context, namely the verification of the identity of individuals exercising their rights under the GDPR. It acknowledged that an ID copy may be justified in higher-risk situations, such as certain GDPR rights requests involving sensitive or extensive data, or where the controller has no ongoing relationship with the requester. However, it held that this did not affect the infringements established in relation to the controller’s procedure for issuing copies of bills. The court upheld the DPA’s €25,000 fine.
FT (an agent for players and Vice-President of Football Forum)
Fédération internationale de football association (FIFA) is a Switzerland-based non-profit that acts as the global governing body for football. A large number of football clubs and national football associations are member of FIFA and bound by its regulations. In January FIFA published the FIFA Football Agent Regulations (FFAR). FFAR regulated the conduct of player’s agents. In particular, FFAR provided maximum limits to agents’ remuneration and prohibited specific types of contractual arrangements between clubs, agents, and agencies. In order to ensure compliance with these rules, Article 12 FFAR required agents to disclose certain information to FIFA. In particular, agents had to disclose: * Information about any agreement with a client, other than a representation agreement; * Information on any arrangement between agents to cooperate in the provision of their services, or to share the revenue or profits of their services; * Information about their relationship with agencies, including the names of all of the agency’s employees. Additionally, FIFA would make the information available to a number of stakeholders including agents, players, and football clubs. Three applicants (an agent, a company acting as a players’ agent, and the Vice-President of a players’ agents’ associations) challenged FFAR in the Regional Court of Mainz (Germany). The Court referred four questions to the CJEU for a preliminary ruling. In essence, the Court asked the CJEU whether the FFAR was compatible with Articles 101 TFEU (prohibition on cartels), 102 TFEU (prohibition on abuse of a dominant position), 56 TFEU (freedom to provide services), and 6 GDPR (legal bases for processing personal data). With regards to Article 6 GDPR specifically, the referring court essentially asked whether there was a lawful basis under the GDPR for a collection of personal data, such as required under the FFAR’s mandatory disclosure rules. The referring question did not specify what legal basis had to be examined in order to assess the compatibility of FFAR disclosures with the GDPR. However, the AG opined that interest under Article 6(1)(f) was the relevant legal basis, based on the nature of the FFAR rules and on other information on the order for reference. Therefore, the AG focused on the legal basis of legitimate interest exclusively. The AG recalled that the mandatory disclosure under FFAR were compatible with the GDPR if they met three cumulative requirements: # They genuinely pursued an interest worthy of protection; # They were limited to what was strictly necessary to that end; # They did not place an intolerable burden on the data subjects as regards their right to privacy and their financial interests. The AG opined that in the case at hand, the processing of personal data pursued an interest worthy of protection (that is, FIFA’s interest in ensuring that the conduct of agents was consistent with the core objective of the football transfer systems, and other objectives related to the good functioning of the player market). However, the AG was more cautious about the other two requirements. With regards to the requirement of necessity, the AG noted that FFAR required the collection of a substantial amount of personal data, including delicate data about agents’ remuneration and contractual agreements. Additionally, FIFA would not only receive the data but also make it available to stakeholders such as clubs, players, and player’s agents. The AG opined that such a broad collection and disclosure of personal data could, to some extent, exceed what was strictly necessary to pursue FIFA’s legitimate interest. In that regard, the AG stressed that FIFA should explain to the referring court why the collection and disclosure of the data were necessary, in relation to each type of information. With regards to the balancing of interests, the AG opined that agents operate within a regulatory framework and, therefore, have a reasonable expectation that FIFA would process their data as a regulatory body. In the AG’s view, this expectation could weight favorably on the balancing of legitimate interest. At the same time, the AG opined that the availability of agents’ personal data to both competitors and potential clients, could financially harm agents and erode trust in agent-client relationships. The CJEU held that processing based on Article 6(1)(f) GDPR is lawful only where three cumulative conditions are met. First, the controller or a third party must pursue a legitimate interest. Second, the processing must be necessary for that interest. Third, the interests or fundamental rights and freedoms of the data subject must not override the legitimate interest pursued. Regarding the information agents were required to submit through the controller’s digital platform under [https://digitalhub.fifa.com/m/1e7b741fa0fae779/original/FIFA-Football-Agent-Regulations.pdf Article 16 FFAR], the Court considered that ensuring compliance with the regulatory framework governing football agents could constitute a legitimate interest. This was conditional on the underlying obligations being compatible with EU and national law. The Court found that the information required under [https://digitalhub.fifa.com/m/1e7b741fa0fae779/original/FIFA-Football-Agent-Regulations.pdf Article 16 FFAR] appeared capable of identifying attempts to circumvent rules on representation, remuneration and conflicts of interest. The processing could therefore be adequate, relevant and limited to what was necessary. However, the referring court had to determine whether equally effective but less intrusive measures were available and assess any additional information requested through the platform whose precise scope was not defined in the regulations. The processing under [https://digitalhub.fifa.com/m/1e7b741fa0fae779/original/FIFA-Football-Agent-Regulations.pdf Article 16 FFAR] could therefore be compatible with Article 6(1)(f) GDPR, subject to verification by the referring court. Regarding [https://digitalhub.fifa.com/m/1e7b741fa0fae779/original/FIFA-Football-Agent-Regulations.pdf Article 19 FFAR], the Court distinguished between the different categories of information disclosed by the controller. The publication of agents’ names and contact details, the identity of their clients, the duration and exclusivity of representation agreements and the services provided could pursue legitimate interests such as establishing professional and ethical standards, protecting clients from unethical conduct and improving transparency. Since the information concerned professional activities within a regulatory framework known to the persons involved, this processing could satisfy the balancing test under Article 6(1)(f) GDPR. By contrast, publishing detailed information about every transaction involving an agent, including the service fees paid, was not limited sufficiently. The Court held that agents and clients did not need access to detailed information about all transactions involving their competitors to comply with the regulations. The indiscriminate disclosure of this information therefore infringed the data minimisation principle under Article 5(1)(c) GDPR and was not necessary under Article 6(1)(f) GDPR. The Court also examined the publication of sanctions imposed on agents and clients. It accepted that publication could, in certain circumstances, deter misconduct, restore confidence in the market and allow persons harmed by an infringement to become aware of it. Nevertheless, [https://digitalhub.fifa.com/m/1e7b741fa0fae779/original/FIFA-Football-Agent-Regulations.pdf Article 19 FFAR] required the publication of every sanction without considering its seriousness, the harm caused, its relevance to market confidence or the time elapsed since the infringement. The regulation also did not provide for the information to cease being available after a defined period. The blanket publication obligation therefore did not appropriately balance the controller’s interests against the data subjects’ rights under [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Articles 7] and [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng 8 CFR]. Moreover, where a sanction contained personal data relating to criminal convictions or offences, Article 10 GDPR applied. In the absence of authorisation under EU or Member State law and supervision by a public authority, the controller could not process such data. The Court consequently held that Article 6(1)(f) GDPR precluded regulations adopted by an international sports federation insofar as they required the disclosure and publication of: * every sanction imposed on agents or their clients; and * detailed information concerning all transactions involving agents. The Court did not impose a fine or order any specific corrective measure. It provided an interpretation of EU law for the referring court, which remained responsible for resolving the underlying dispute and verifying the relevant factual and legal conditions.
Court case W298 2314952-1
The data subject was a policeman who was subject to disciplinary measures. He filed a complaint concerning those disciplinary measures. The decision concerning the complaint was published on an official website of the Federal Chancellery of Austria that makes available legal decisions (Rechtsinformationssystem des Bundes). In the published decision, the professional position of the data subject within the police was not redacted. Neither was the place of the police school redacted where he was teaching (including the address of the school and the courses he was teaching). Moreover, the workplace where he was referred to after the disciplinary measure was not redacted. The published decision also mentioned the mental health status of the data subject, as it was relevant for the disciplinary measure, and a religious function he was exercising. Any other personal information of the data subject was redacted. The data subject filed a complaint with the court under national law concerning a violation of the protection of his personal data, claiming insufficient anonymisation. The court held that the complaint was partly justified. The combination of personal data about the data subject’s professional career that was made available on the website made the data subject identifiable pursuant to Article 4(1) GDPR to a significant number of persons. Thus, the data subject’s health status was made available to an undefined group of people. As far as the personal data concerning the data subject’s professional career was concerned, the court held that the making available violated the data subject’s data right to protection of their personal data. Legal decisions are published with the aim of guaranteeing legal certainty as well as transparency. By anonymising the data subject’s personal information concerning his professional career, none of those aims would be impaired. The meaning of the decision would not be altered. The court held that the making available of the health data was lawful under Article 5(1)(a) GDPR, Article 6(1)(e) GDPR in conjunction with Article 6(3) GDPR. The interest of the public to learn about jurisprudence, especially in the field of disciplinary decisions where the health status was relevant for the decision, prevailed over the data subject’s right. The processing of the religious function the data subject was exercising was lawful under Article 5(1) GDPR, Article 6(1)(c) GDPR, according to the court. This is because it was necessary to mention his function in order to understand a conversation between the data subject and a witness in the context of the disciplinary decision.
Court case 7890/2026
A data subject lodged a complaint with the Bulgarian DPA (CPDP), alleging that her neighbour (the controller) was unlawfully monitoring her property through CCTV. She claimed that a camera had been mounted on a metal structure on a third-floor terrace of the neighbouring building and installed in a manner that extended into the space above her property. According to the data subject, the camera had the technical capacity to identify individuals and objects throughout her property. The controller did not deny installing the camera but argued that it was directed towards the fence and an outbuilding on his own property. He also stated that a second camera had been installed on the western façade of the building. The controller claimed that both cameras were used solely to monitor his own property and the processing was lawful under the GDPR. The DPA carried out an on-site investigation and found that the CCTV system consisted of two independent cameras operated through separate software applications. Both cameras could be rotated in all directions and could use an automatic tracking function. The recordings were stored on memory cards for approximately 15 days before being automatically deleted, and only the controller had access to the system. The DPA noted that Camera 1 recorded the northern part of the controller’s yard, his house and the fence bordering the data subject’s property and Camera 2 recorded the roof of the controller’s house and a small part of the data subject’s yard. The DPA reviewed the oldest available footage and noticed that Camera 2 had recorded the data subject’s house and yard. The inspection report stated that the system could process personal data relating to individuals on both properties, but did not allow the identification of individuals or facial recognition. The DPA pointed out that warning stickers informing individuals of the video surveillance were displayed at the property. It found the complaint well founded in relation to Camera 1 and established a violation of Article 5(1)(c) GDPR, for which it issued an official warning to the controller. However, it found the complaint unfounded in relation to Camera 2, considering that the surveillance was permissible on the basis of the controller’s legitimate interest in protecting his property. The data subject appealed the part of the decision concerning Camera 2. The court of first instance annulled that part of the DPA’s decision and remitted the case to the DPA for reconsideration. It found that the DPA had relied entirely on the findings of the inspection team without carrying out a thorough, objective and independent examination of the relevant facts. Both the DPA and the controller appealed that judgment before the Bulgarian Supreme Administrative Court. The Supreme Administrative Court rejected the appeals and upheld the judgment of the court of first instance. The court noted that Camera 2 recorded the roof of the controller’s building and part of the data subject’s yard. It further pointed out that the DPA had found that, due to their technical characteristics, both cameras could alter their surveillance coverage and process personal data relating to individuals on both properties, while the CCTV system allowed individuals to be identified. Moreover, the court agreed with the first-instance court that the DPA had failed to provide adequate reasons for treating the two cameras differently. In particular, the DPA had not explained how the partial recording of the data subject’s yard contributed to the protection of the controller’s legitimate interest in safeguarding his property. It determined that it had also failed to establish whether adjusting the field of view of Camera 2 could expand its recording perimeter and allow it to capture a larger part of the data subject’s property.
Austrian Data Protection Authority
The controller, an assistant professor at a private university (the appellant), was engaged in an employment dispute with her university employer before a labour and social court. The data subject, a senior legal counsel employed by the university gave testimony as a witness in that employment proceeding. On 23 January 2025, the labour and social court ruled in the controller's favour, finding that her employment relationship continued beyond the university's purported termination date. The judgment referred to the data subject several times by her academic title and surname in connection with her witness testimony. In April 2025, the controller published the unredacted judgment in full, including the data subject's title and surname on social media. She shared a downloadable link (first via Dropbox, later via Adobe) on her public Facebook profile and in a closed Facebook group of around 230 members connected to the university community. The files were later removed by Dropbox and Adobe after the data subject reported them. The data subject's full first name and additional details could also be found by combining her academic title and surname with the university's name in a Google search, which surfaced her LinkedIn profile. The data subject filed a complaint with the Austrian DPA, arguing that the controller had no justification for naming her and had drawn her into a public dispute with her employer. The controller argued that the judgment concerned matters of wider relevance to university staff, that the Facebook group was closed and that the data subject's name and role were already public via the university directory and LinkedIn. On 15 October 2025, the DPA upheld the complaint, finding that the controller had violated the data subject's right to secrecy under §1(1) of the Austrian Data Protection Act (DSG) by publishing the judgment without a legal basis. The DPA found that a legitimate interest existed in principle, but that both publications were excessive as the judgment was made accessible to an uninvolved and disproportionately wide audience and that disclosing the data subject's name was not necessary to achieve the controller's stated purpose of informing colleagues in similar situations. The DPA noted that publishing the judgment with the data subject's name redacted would have been an equally effective, less intrusive alternative. The controller appealed, arguing that the data subject had no protectable secrecy interest because she had participated in the proceeding in a public professional capacity and had made comparable information about herself public on LinkedIn and that the DPA had failed to weigh her freedom of expression rights under Article 10 ECHR against the data subject's secrecy interest. The court dismissed the appeal in full and confirmed the DPA's decision. First, the court rejected the controller's argument that no protectable secrecy interest existed because the data subject had acted in a professional capacity. It held that, under settled national case-law, appearing in a professional role does not by itself remove a person's right to secrecy under §1(1) DSG. Second, applying the three-part test for legitimate interest under Article 6(1)(f) GDPR, the court accepted that the controller had, in principle, a legitimate interest in informing colleagues in comparable employment situations about the judgment. However, it held that publishing the data subject's surname failed the necessity requirement under this test and therefore also breached the data minimisation principle under Article 5(1)(c) GDPR. The court noted that the data subject was a witness testifying about legal matters, not the person responsible for the controller's employment contract and that naming her added nothing to the comprehensibility or persuasive value of the information the controller sought to share. Because necessity was lacking, the court found it unnecessary to conduct any further balancing of the parties' respective rights. Third, the court rejected the controller’s argument that her freedom of expression justified the full disclosure of the judgment, for which she relied on the CJEU’s judgment in Case [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62017CJ0345 C-345/17] (Buivids). The court held that Buivids concerned whether processing could be regarded as being carried out solely for journalistic purposes, whereas there was no indication of journalistic activity in the present case. It further held that §9 DSG, which implements Article 85 GDPR in relation to journalistic activity, was therefore inapplicable. In any event, the court stated that §9 DSG does not entirely override the principle of proportionality but establishes a different standard for balancing the competing interests. Finally, the court agreed with the DPA that redacting the data subject's name and title would have been an equally effective and only minimally burdensome alternative that would not have undermined the controller's informational purpose and held that the controller had not plausibly explained why such redaction would have been insufficient. The court accordingly found no unlawfulness in the DPA's decision and dismissed the appeal. It declared that an appeal on points of law (Revision) was not admissible, since the case did not raise a legal question of fundamental importance and was consistent with existing case-law.
Amazon Road Transport Spain, S.L.
Unión General de Trabajadores (UGT), a trade union, lodged a complaint with the DPA (AEPD) against Amazon Road Transport Spain, S.L., the controller. Applicants wishing to work within the Amazon Flex delivery programme were required to provide a certificate confirming that they had no criminal record. The certificates and other application documents were processed by external processors responsible for the preliminary screening of candidates. The controller considered this requirement necessary to protect its customers and ensure the security of the programme. Delivery drivers transported packages directly to private residences and had access to customers’ addresses, telephone numbers and information that could reveal aspects of their habits. They could also be entrusted with packages of significant value. On 10 February 2022, the DPA imposed a €2 million fine on the controller for an infringement of Article 6(1), in conjunction with Article 10 GDPR, as well as [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 Articles 10] and [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 71 LOPDGDD]. The DPA considered that a certificate showing the absence of criminal convictions still constituted personal data relating to criminal convictions and offences. Consequently, it held that candidates’ consent could not legitimise the processing without a specific authorisation under Union or national law. The controller appealed the decision before the Audiencia Nacional, the appeal court. It argued that a certificate confirming the absence of criminal records did not fall within Article 10 GDPR and referred to previous cases in which the DPA had accepted similar requirements for certain professional activities. The Court granted the appeal and annulled the DPA’s decision and the €2 million fine. First, the Court held that Article 10 GDPR must be interpreted strictly, particularly in administrative sanctioning proceedings, which are governed by the principle of minimum intervention and the prohibition of extensive interpretations against the alleged infringer. The Court distinguished between processing information concerning existing criminal convictions or offences and processing a certificate confirming that the person has no criminal record. In its view, Article 10 GDPR expressly covers personal data relating to criminal convictions and offences, but not information concerning their absence. The Court considered that a negative criminal record certificate contains favourable information regarding a person’s conduct. Therefore, processing such a certificate does not amount to processing specially protected criminal-offence data under Article 10 GDPR. As a result, the consent provided by candidates was not invalid merely because no Union or national law specifically authorised the processing under that provision. The Court distinguished the case from situations involving direct access to criminal-record databases or the creation of files containing adverse information. It also distinguished previous employment-law judgments concerning employers requesting criminal records. Although requiring such certificates could be unlawful or abusive under employment law, this did not necessarily mean that the conduct was sanctionable under data protection law. Nevertheless, the Court clarified that processing negative criminal record certificates remained subject to the general GDPR requirements, particularly the principles under Article 5 GDPR and the need for a valid legal basis under Article 6(1) GDPR. In this regard, the Court found the controller’s reasons sufficient to consider the processing legitimate. Amazon Flex drivers delivered packages to private homes and had access to customers’ contact details and information capable of revealing their habits. The Court therefore accepted that verifying candidates’ good standing served the security of the recruitment process and the protection of customers. Accordingly, the Court concluded that the processing was legitimate, granted the controller’s appeal and annulled the DPA’s decision without awarding costs.
Court case W292 2292202-1
The data subject is in the military. The unit he is employed at (controller) and the data subject are involved in a multitude of legal disputes concerning his employment, disciplinary proceedings, data protection matters as well as procedures of criminal law. After the controller revealed information on one of the legal proceedings concerning a penalty he received in an official meeting to third persons, the data subject lodged a complaint with the DPA. In the course of the DPA investigation of the complaint, the controller revealed to the DPA a statement written by the data subject concerning his declining health status because of the multitude of proceedings between the two parties. The data subject considered the sharing of this document as a processing of health data, in violation of Article 9 GDPR. The proceeding before the DPA dealt with the question of whether the data subject’s complaint was excessive pursuant to Article 57(4) GDPR. The DPA held that the statement constituted health data pursuant to Article 4(15) GDPR. Since the processing of the statement happened in the context of the enforcement of legal claims, the DPA did not find a violation of Article 9 GDPR. The data subject appealed the DPA's decision. The Court upheld the DPA’S decision and decided that the controller could rely on the legal basis of Article 9(2)(f) GDPR. The Court held that the notion of “legal claims” pursuant to Article 9(2)(f) GDPR must be understood broadly as meaning any legal conflict. The notion of necessity in the context of Article 9(2)(f) GDPR is to be applied broadly as well because of the role the exemption plays for the enforcement of legal claims and because of Article 47 CFR, the right to an effective remedy and fair trial. “Necessary” must be understood as meaning that without the data in question, the enforcement of legal claims must be impossible or considerably more difficult. According to the Court, the requirement of necessity is not met where the processing of health data is arbitrary and bears no connection to the legal proceeding. This question must be assessed from an ex-ante perspective. For the case at hand, the Court decided, that the statement concerning the data subject’s health data was lawfully shared with the DPA. This is because the DPA had to decide on the question of whether the data subject’s complaint was excessive pursuant to Article 57(4) GDPR. In order for the DPA to answer this legal question, it is necessary for the DPA to receive all information on the multitude of legal disputes between the parties to get an understanding of the situation, and the statement is part of the correspondence between the parties on their disputes. Moreover, since the DPA is obliged to treat the information it receives confidentially, a higher level of protection of health data is guaranteed. According to the Court, the data subject deserves less protection because he made the statement available to the controller himself.
Court case VwGH Ro 2025/04/0007-7
The controller was an address publisher and direct advertising company that operated a data application to provide advertisers with personal data for targeted marketing measures. In 2019, following media reports concerning the alleged sale of personal data, particularly information about natural persons’ political party affinity, the Austrian DPA (DSB) initiated an ex officio investigation against the controller. Based on its investigation, the DPA found that the controller had unlawfully processed political party affinity data and unlawfully further processed parcel-frequency data, and had infringed its obligations concerning the DPIA and record of processing activities. It consequently imposed a fine of €18,000,000. The controller appealed to the Federal Administrative Court (BVwG), arguing that the commission of an infringement by a legal person was not, in itself, sufficient for a fine to be imposed under the GDPR. It claimed that since a legal person could not act on its own, the culpable conduct of a natural person had to be identified and attributed to it. The controller argued that the DPA had failed to establish such attribution. The court agreed and, on 26 November 2020, annulled the fine. It found that the DPA had failed to establish that natural persons acting on behalf of the controller had engaged in culpable conduct. The DPA filed an extraordinary official appeal against this judgment with the Austrian Supreme Administrative Court (VwGH). The court stayed the proceedings pending the CJEU’s preliminary ruling in Case C-807/21 (Deutsche Wohnen SE), as the questions referred in that case were also relevant to the appeal proceedings. The CJEU published its judgement on this matter on 5 December 2023. The CJEU held that a fine under Article 83(4) GDPR, Article 83(5) GDPR and Article 83 (6) GDPR may be imposed on anyone who qualifies as a controller where it is established that the controller committed the relevant infringement intentionally or negligentl
NTH Haustechnik GmbH
A data subject was an employee of a heating and air conditioning business. The data subject ceased working at the company, however, was still able to access the company’s premises and computers through their managing director for several years. The company brought a case against the data subject, on the grounds that the data subject had sold equipment belonging to the company through eBay. The company sought damages based on this. The German Landesarbeitsgericht Niedersachsen (Higher Labour Court, Lower Saxony) stayed proceedings and requested a preliminary ruling from the CJEU. The data protection issue in this case is that the company became aware of the transactions by accessing the data subject’s private eBay account (how the company received the ID and password is disputed). According to the Court, the company collected and stored the data unlawfully. The Court also considered that it carried out data processing in assessing the evidence during the proceedings, and asked for clarification regarding national legislation for judicial data processing activities and their legal bases. The Court referred the following questions: # Do national provisions involving an independent judicial processing activity under public interest (Article 6(1)(e) GDPR) fulfil the certainty requirements under the EU Charter of Fundamental Rights and the GDPR if it interferes with the fundamental rights of a (third) party? # Data processing by a court: ## Can a court rely solely on Article 17(3)(e) GDPR to process personal data? ## If yes: ### Does this still apply if the initial data collection is unlawful? ### Does the principle of fairness (Article 5(1)(a) GDPR) restrict the applicability of Article 17(3)(e) GDPR? ### Must Article 17(3)(e) GDPR be interpreted as an exception to the prohibition of using unlawfully obtained data for judicial purposes? # Regardless of the questions above: ## Must the court carry out a comprehensive proportionality test in accordance with the principles of necessity and data minimisation? ## What impact does the principle of storage limitation (Article 5(1)(e) GDPR) have on judicial data processing activities? ## Under EU law, can a court use evidence obtained unlawfully only if there is a recognisable interest of the party bearing the burden of proof, or is it the competence of the national legal system to make provisions in that regard? ## Are possible sanctions for the employer under the GDPR appropriate only if it is considered a serious infringement, or do they apply for less serious breaches at the initial moment of collecting the data? ## Must a court take into consideration whether the party collecting the data has complied with its obligations under Article 13 GDPR? ## Do data protection responsibilities of the court extend to the personal data of third parties? How does a possible unlawful data processing affect judicial proceedings? The AG provided an opinion on question 3(2). The AG first made a distinction between the data involved; on one hand, the data subject’s data stored in the company server and company devices (“initial data”). On the other hand, the data from the eBay website used by the company to bring an action against the data subject (“data relating to the sales”). The AG suggested that to reformulate the question to assess whether the principle of storage limitation, read in conjunction with Article 6 GDPR, imposes specific requirements on national courts to process data that has been previously unlawfully processed. In answering the question, the AG noted that any data processing activity must comply with the principles of the GDPR, including lawfulness in accordance with Article 6 GDPR. In this case, processing of data by the court may be lawful under public interest (Article 6(1)(e) GDPR). Nonetheless, the AG stated that the controller may only store data for as long as necessary, meaning initially lawful processing can become unlawful if processed for longer than necessary. According to the AG, neither Article 5(1)(e) nor 6(1)(e) GDPR contain an absolute prohibition preventing a public authority (such as a court) to process data that is processed unlawfully. In the absence of EU rules, it is for the national law to establish procedural rules while respecting the principle of equivalence and effectiveness of EU law. Limitations must also comply with [https://fra.europa.eu/en/eu-charter/article/52-scope-and-interpretation-rights-and-principles Article 52(1) of the EU Charter of Fundamental Rights]. Finally, the AG noted that EU law does not govern the admissibility of evidence in national judicial proceedings. Taking into account the obligation of courts to establish the truth based on evidence provided, the AG opined that there is a national legal basis (within the meaning of Article 6(3)(b), read in conjunction with 23(1)(j) GDPR) for the court to process the personal data. == The court first clarified that it assessed the answer to this question in light of Article 6(1)(c) GDPR as a legal basis rather than Article 6(1)(e) GDPR. This is because the referring court processed data (evidence presented by the parties) in order to comply with its legal obligation of assessing the evidence and making a decision. The court also clarified that it is for national law alone to determine the rules on admissibility and assessment of facts and evidence.See case C‑511/18, C‑512/18 and C‑520/18 La Quadrature du Net and Others, margin 223 and case C‑140/20 Commissioner of An Garda Síochána and Others, margin 127 The court determined that the GDPR is applicable and that the referring court processed personal data when assessing evidence, in particular when placing documents with personal data in a file. However, the referring court must determine whether the processing in this case falls under the GDPR. The GDPR lays additional requirements for processing under Article 6(1)(c) GDPR to be lawful. The court highlighted that Article 6(3) GDPR requires the processing to have a legal basis under national law. This legal basis must also meet an objective of public interest and be proportionate to that objective. The court noted that the national law provisions at issue did not lay down conditions in order for evidence containing personal data that was initially unlawfully processed to be considered admissible. The court considered that the GDPR does not preclude such national provisions, providing that there is clear and precise national case law that establishes these conditions. Case law must also meet an objective of public interest and be proportionate to that objective.The court considered the conditions required under the CFREU and ECHR to limit the right to privacy and data protection. The court referred to case law from the ECtHR, which states that the term “law” under Article 8(2) of the ECHR must be understood in a substantive and not formal sense, meaning it may also include case law. See ECtHR, 23 January 2025, H.W. v. France, CE:ECHR:2025:0123JUD001380521, margin 65 == Article 6(1) GDPR sets an exhaustive and restrictive list of legal bases for which a processing activity is considered lawful. The court stated that while Article 17(3)(e) GDPR introduces an exception to data subjects’ right to erasure, it does not create an autonomous legal basis for the processing of personal data for the establishment or exercise of legal claims. This Article would be insufficient to comply with Article 5(1)(a) GDPR. Therefore, the court considered there was no need to answer the question 2(2) and its sub questions. == Question 3(1): Must the court carry out a comprehensive proportionality test? The court highlighted that under [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 52(1) CFREU], a limit to the exercise of a fundamental right must meet the requirements of proportionality and necessity. In terms of proportionality, the measure must allow the objectives to be met, the interference must be limited to what is strictly necessary, and there must be a balancing test between the objectives and the seriousness of the interference.The court noted that the principle of data minimisation (Article 5(1)(c) GDPR gives expression to the principle of proportionality. However, it does not in itself implement the principle (and therefore the conditions needed to fulfil it). The court noted that a processing activity complies with the first two conditions of proportionality if it complies with the principle of data minimisation. For the third condition, the court stated that, in principle, compliance with Article 6(1) GDPR already limits the processing to what is necessary to achieve a legitimate objective. This includes processing with a legitimate interest that outweighs the seriousness of the interference with the fundamental rights under [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Articles 7 and 8 CFREU]. Here, the court reiterated that processing under Article 6(1)(c) GDPR must also comply with the requirements of Article 6(3) GDPR. Therefore, the referring court must comply with the requirements of data minimisation and Article 6(3) GDPR (proportionality and balancing of interests). However, the principle of data minimisation does not require the referring court to ensure that the principle of proportionality is observed for every processing of personal data it undertakes. Questions 3(2) to (4): can a court process data subjects' personal data in evidence provided to the court, even if this data was initially processed unlawfully? The court first referred to the AG’s opinion, and stated that the GDPR does not lay an absolute prohibition preventing a public authority from taking into account personal data that was previously unlawfully processed by the person who transmitted the data to such authority. The court stated that a court has the obligation to rule on whether evidence presented by parties is admissible and to take said evidence into account to reach a decision (in accordance with national law). The processing of personal data carried out by a court in connection to these obligations is, in principle, necessary. These obligations do not appear to contradict the requirements set in Articles 6(1)(c) and 6(3) GDPR. Therefore, the principle of data minimisation does not prohibit a national court from processing data subjects' personal data in evidence provided to the court, even if this data was initially processed unlawfully. The court took into account the importance of the right to fair trial ([https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 47 CFREU]), and concluded that processing of personal data was not a disproportionate interference with the fundamental right to privacy and data protection. The court noted that no other measure appeared to be capable of achieving the objective as effectively as allowing courts to process personal data found in evidence presented by parties. Nonetheless, the court noted that the data processed must be limited to what is adequate, relevant and necessary, in accordance with the principle of data minimisation. Here the court made a distinction between assessing the admissibility of evidence and using that evidence to reach a decision; assessing all evidence does not infringe the principle of data minimisation. However, after finding the admissible evidence, the court must take measures to reduce the amount of data processed before placing it on file (e.g. by anonymising documents where possible). This data placed on file must, in principle, be considered to be compliant with the principle of data minimisation. Finally, when disclosing the data (e.g. when publishing the decision), the court must again limit the data processing to what is necessary for its purpose(s). Question 3(5): does the previous question also apply to data processed in violation of the initial controller's information obligations? Similarly, the court stated that Articles 13(1) and (2) GDPR do not prohibit a national court from processing data subjects' personal data in evidence provided to the court, even if this data was initially processed in violation of the initial controller’s information obligation. The court reiterated that the GDPR does not lay an absolute prohibition on processing data that was previously unlawfully processed. Therefore, the fact that the controller did not comply with its obligations under the GDPR did not mean that transferring the evidence with personal data is unlawful. Question 3(6): the court's obligations when processing data of persons who are not a party to the proceedings Finally, the court stated that a court is required, when acting in its judicial capacity, to ensure compliance with the GDPR when processing the personal data of persons who are not a party to the proceedings.
Court case W292 2298015-1
The data subject was a customer of a bank (controller). The data subject withdrew their consent to the processing of their e-mail address and phone number by the controller, and requested the deletion thereof. The data was not deleted. The controller tried to call the data subject in order to discuss the necessity of processing of their phone number, and send them an e-mail about the matter. The controller contacted the data subject again on the matters of possible usage of their bank account in violation of contract, and change of terms of service. Consequently, the data subject sought the termination of the contractual relationship with the controller. Because of unpaid bills, the contract could not be terminated. In order to discuss the matter, the controller tried to contact the data subject again. Eventually, the account of the data subject with the controller was closed. The data subject requested access to their data from the controller. The controller tried to call the data subject again on that matter. The data subject lodged a complaint with the DPA. The DPA held that the controller called the data subject in violation of the GDPR because the calls were not necessary for the performance of a contract between the parties pursuant to Article 6(1)(b) GDPR. Moreover, the DPA held that the controller could not rely on Article 6(1)(f) GDPR because the data subject must not reasonably expect to be called after requesting the deletion of their phone number. The controller appealed the decision by the DPA. The court overruled the decision of the DPA. The court distinguished between before and after termination of the contract. It held that before contract termination, the processing of the data subject’s e-mail address and phone number was necessary for the performance of the contract. In particular, contact details are necessary to be able to contact the data subject per phone call or e-mail about possible security threats concerning the data subject’s bank account. The intended calls of the controller concerned matters of the contractual relationship. Before and after contract termination, the processing was lawful under Article 6(1)(c) GDPR in conjunction with national provisions of banking law that require the controller to store certain personal data of their customers, amongst them the e-mail address and phone number, for ten years after termination of the contractual relationship. The court added that the processing was lawful under Article 6(1)(f) GDPR because of legitimate interests of the controller. For the balancing of interest, the sphere that the personal data belongs to can be used as an argument of assessing the level of protection of the the personal data. The processing of the data subject’s phone number and e-mail address concerned the social sphere of the data subject because this type of personal data is typically revealed to third persons as a means of communication. The data does not belong to the domestic sphere, neither is it specially protected pursuant to Article 9 GDPR. Therefore, the interest of the controller prevail. The data subject could reasonably expect their data to be processed for the purpose of resolving the contractual relationship. The court held held that the processing was lawful.
Infobel
The Belgian DPA had imposed a €40,000 fine on INFOBEL S.A., a commercial data broker (the controller), for processing and reselling personal data for direct marketing purposes without demonstrating a valid legal basis. The data at issue had been obtained from a telecom operator with which the data subject had took a telephone subscription in the past and were subsequently used and resold by the controller for direct marketing purposes. The DPA found that the controller had not demonstrated that the data subject had given freely given, specific, informed and unambiguous consent to the processing of his data for their resale for direct marketing purposes. Specifically, it held that the consent was not freely given, since the resale of personal data was not directly and objectively linked to the performance of the contract that concerned the provision of telephone services. The DPA also found that no separate opt-in had been offered for the specific purpose of reselling the data for direct marketing purposes, that the data subject had not been adequately informed as the controller’s identity was not mentioned anywhere in telecom operator’s general terms and conditions and that the consent was based on an opt-out rather than a clear affirmative act. The DPA had accordingly determined that the controller infringed article 5(1)(a) GDPR in conjunction with Article 6 GDPR and Article 24 GDPR. It had also ordered the controller to delete the personal data processed without a valid legal basis and to inform the recipients of those data of the decision and of the lack of a legal basis for the processing. The controller appealed the decision and challenged the fine before the Brussels Court of Appeal. It argued, inter alia, that the erasure order and the related obligation to inform recipients had become devoid of purpose because the relevant database had already been deleted in 2023. The DPA maintained that the erasure order was still justified because it had not been able to
Ekdotikos Oikos Dias Dimosia Ltd
On 13 March 2019, Sigma, a Cypriot TV channel operated within DIAS Media Group (ΕΚΔΟΤΙΚΟΣ ΟΙΚΟΣ ΔΗΜΟΣΙΑ ΔΙΑΣ ΛΙΜΙΤΕΔ), published a report disclosing financial information concerning a public figure in Cyprus (the data subject). The DPA treated DIAS Media Group as the controller responsible for the publication. The report formed part of coverage on whether there had been favourable treatment of a politically exposed person. On 15 April 2019, the data subject lodged a complaint with the Cypriot DPA concerning the disclosure of their financial personal data by Sigma and other media outlets belonging to the controller’s group. The DPA found that the controller had failed to properly balance the journalistic interest in publication against the data subject’s rights to privacy and data protection. In particular, the DPA considered that the controller had failed to demonstrate that it had taken into account certain balancing criteria, including whether the processing was carried out exclusively for journalistic purposes, whether it was strictly necessary to ensure the right to information on matters of public interest, whether the information was accurate and truthful, and whether there had been prior contact with the data subject. The DPA held that, by publishing information concerning the data subject’s financial situation, the controller had infringed the principles of lawfulness, fairness and transparency, data minimisation and accuracy. Therefore, it found that the controller infringed Article 5(1)(a) GDPR, Article 5(1)(c) GDPR and Article 5(1)(d) GDPR. Accordingly, the DPA fined the controller €10,000 and ordered it to remove the publication from the websites of all entities controlled by it within one week. The controller challenged the decision before the Administrative Court of Cyprus. It argued, among other things, that the DPA had violated its right to freedom of expression and its exercise of journalistic freedom under Article 85 GDPR. The court found that th