GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
198 results · Showing 1–20
Court case VI ZR 402/24
A well-known German singer (the data subject) was secretly photographed by a press photographer while on a walk with her daughter and her mother in the city centre of Munich in May 2022. The photographer sold these images to various news outlets, including Bild, RTL, Freizeitwoche, and Freizeit Revue. Following an unsuccessful warning letter, the defendant was prohibited by a preliminary injunction from displaying or distributing the data subject's images. The data subject filed a lawsuit against the photographer and claimed at least €10,000 in damages under Article 82(1) GDPR. Alternatively, she based her claim on national provisions, stating the photographer had violated her right of personality. The court of first instance granted the lawsuit regarding monetary compensation on the grounds of a particularly serious violation of the data subject’s right of personality resulting from the taking and the distribution of the images. Upon appeal by the photographer, the appellate court dismissed the lawsuit. The data subject appealed this decision to the Federal Court of Justice. The Federal Court of Justice upheld the appellate court’s decision and dismissed the data subject’s appeal. Neither Article 82 GDPR nor the national provisions on the general right of personality could give rise to a claim for monetary compensation in the present case. The court held that the taking and the disclosure of the images constituted processing of personal data within the meaning of the GDPR. However, these processing operations did not need to be assessed against the substantive requirements of the GDPR – according to the court, they constituted processing for journalistic purposes and fell under the exemption in Article 85(2) GDPR. Consequently, the data subject’s claim for damages could not be based on Article 82(1) GDPR. The court interpreted the provisions governing data processing for journalistic purposes in its judgment broadly in light of the case law of the CJEU. It could be left open which federal state’s provisions on media privilege were applicable to the photographs at issue, as the taking and the distribution of the images constituted journalism within the meaning of these provisions in any German state. In addition, the court held that responsibility for the editorial content of publications rests solely with the press. A person who provides photographic material to the press is therefore generally not responsible for the content of editorial pieces created on that basis. Finally, the court concluded that the data subject’s right to her own image and right to privacy were affected by being photographed. However, the freedom of the press and the photographers freedom of occupation outweighed these interests, which precluded a claim for compensation based on the data subject’s right of personality.
Court case HelHO:2026:8
A company (A) requested information from the District Court of Eastern Uusimaa (Itä-Uudenmaan käräjäoikeus; the controller) regarding pending and closed criminal matters involving 39 individuals who applied to be cast in an entertainment program (the data subjects). The company claimed the purpose of the request was to investigate the data subjects' backgrounds, which in turn constituted processing for exclusively journalistic purposes within the meaning of [https://www.finlex.fi/fi/lainsaadanto/2018/1050 Section 27 of the Finnish Data Protection Act]. This national provision contains exemptions from certain GDPR provisions allowed by Article 85(2) GDPR. The district court denied the request in August 2025 and held that the information was in fact requested to investigate the backgrounds of individuals who had applied for the entertainment program for the purpose of making casting decisions, rather than for journalistic purposes as A claimed. A subsequently appealed the case to the Helsinki Court of Appeal and demanded that the controller be ordered to disclose the information specified in the information request aiming at investigating the applicants' backgrounds. A argued that a journalistic purpose may also encompass editorial work related to the preparation of journalistic content. In this case, researching the backgrounds of applicants and selecting participants were part of the journalistic process. In addition, a media company (B) claimed before the court of appeals that it should be given the right to intervene in the proceedings as A served as a subcontractor for B in gathering information for the production of the entertainment program. First, the court held that B had no right to intervene in the matter concerning its subcontractor's request for information. As the case concerned a request for information made by B's subcontractor and not B's own right to information, the matter could not be considered to concern B's rights as required under national law to allow B to participate in the proceedings as an intervenor. Second, the court of appeals confirmed the findings of the district court regarding the main proceedings and dismissed A's appeal. The court concluded that A could not rely on the journalistic exception set forth in [https://www.finlex.fi/fi/lainsaadanto/2018/1050 Section 27 of the Finnish Data Protection Act] and referred to the CJEU's decisions in the cases C-740/22 Endemol Shine Finland and C-199/24 Legal Newsdesk Sweden AB to support its conclusion. In the former case, the CJEU held that the public access to official documents must be weighed against the respect for private life and the protection of personal data. In addition, these interests carry greater weight when the disclosure concerns sensitive information such as criminal convictions. In the latter decision, the CJEU held that the purpose of the processing falling under journalistic purposes within the meaning of Article 85(2) GDPR must be the disclosure of information, opinions or ideas to the public in compliance with ethical rules or codes of conduct. Furthermore, the information generally needs to undergo editing or adaptation and verification of factual allegations. The court held that the request for information had not been made for exclusively journalistic purposes within the meaning of [https://www.finlex.fi/fi/lainsaadanto/2018/1050 Section 27 of the Data Protection Act]: A had requested information regarding criminal matters primarily to evaluate which individuals would be selected for one specific production. The immediate purpose of the processing at issue was therefore to make a production-related decision regarding who would participate in the program rather than journalistic fact-finding. The fact that A was involved in the production of a television program was not decisive in the assessment of the matter.
ING Bank
ING Bank (the controller) is a bank. One of the services the controller offers is to make contactless payments using an Android phone. This was initially done through its own app, however, the controller later discontinued this and offered the contactless payment through Google Pay. To activate Google Pay, data subjects have to create an account with Google. When making a payment, the controller shares data related to the payment and store to Google. Two Dutch consumer’s organisations (the “Benadeelden in Actie” Foundation, or SBIA and Consumer Union) demanded that the controller discontinue Google Pay, and requested it to share its data. The controller stated that it had reached agreements with Google regarding data processing for contactless payments, but it refused to disclose those agreements. The consumer organisations therefore filed a case with the court, requesting it to order the controller to provide access to the agreements. The organisations also requested access to additional documentation, such as (draft) decisions and research data. They argued that they questioned the lawfulness of the processing of personal data in relation to contactless payments, and needed access in order to verify whether this processing was lawful. The controller, on the other hand, argued that the argument was unsubstantiated because the processing was lawful. The organisations argued that ING and Google acted as joint controllers in accordance with Article 26 GDPR. ING disputed this, and argued that it was only a joint controller with Google for the activation of tokens when making a payment. The court also clarified that ING Bank and Google were joint controllers, in accordance with Article 26 GDPR. The court dismissed the argument that ING and Google were joint controllers only in a specific instance (activating tokens). The court stated that both companies aimed at enabling data subjects to make contact payments with their phones using Google Pay. The court considered this a jointly defined purpose. Furthermore, the companies do not limit their data exchange to tokens; for example, Google stored the payment data to generate payment summaries. In terms of further processing of the personal data by Google (e.g. for advertising purposes), the court held that the ING may have a certain duty of care. This means that ING may have the obligation to implement safeguards to prevent the processing of data for contactless payments for any other purpose. The court also stated that the data subjects can hold ING liable for a breach of this duty of care. In terms of access, the court assessed whether the organisations had this right under the code of civil procedure rather than the GDPR. The court first stated that the request for access applied to ING Bank and not ING Group (the entity the organisations had initially brought the case against). This is because the parent group ING Group did not have a banking license. The court stated that the organisations have a legitimate interest in reviewing the agreements to assess whether they are sufficient and whether the companies are processing the data lawfully. Finally, the court noted that the organisations may determine the relationship (i.e. whether a joint controllership existed) between the companies based on this access request. The court ordered the controller to provide the organisations with access to the agreements between ING and Google. This includes how data subjects’ data will be processed (business sensitive information could be redacted. However, the controller did not have to grant access to the other requested data (e.g. research data or internal correspondence).
Legal Newsdesk Sweden AB
= Under Swedish lawYttrandefrihetsgrundlagen (1991:1469) (Constitutional Law on freedom of expression). the Swedish Agency for the Media can issue publications certificates which confers constitutional protection to the activities of the holder. Such certificates can also be issued for the publication and maintenance of databases of personal dataYttrandefrihetsgrundlagen (1991:1469) (Constitutional Law on freedom of expression), Chapter 4, Paragraph 1.. Swedish lawLagen (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning, 1:7 (Law (2018:218) laying down supplementary provisions to the EU GDPR, Chapter 1, Article 7). provides for broad GDPR derogations for certain activities covered by the permit, as an implementation of Article 85 GDPR ("Processing and freedom of expression and information"): * The GDPR and the Swedish Law on data protection do not apply when they would conflict with the constitutional protection afforded by a publication certificate. * Additionally, specific Articles of the GDPR and the Law on data protection - including all of Chapter VIII of the GDPR (Remedies, liabilities and penalties)- do not apply to the processing of personal data that takes place for journalistic purposes or for academic, artistic or literary creation. As a result of these broad exemption, data subjects have limited remedies available when the processing of their data is covered by a publication certificate. In particular, Swedish lawLagen (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning, 9:1. provides that in such cases, controllers can only be held liable for damages when the processing of personal data constitutes defamation. = Legal Newdesk Sweden AB, formerly Garrapatica AB (the controller), holds such a certificate. The controller maintained a database (Lexbase) where personal data, including criminal convictions, are stored. The data were made available to third parties for payment. A data subject challenged the processing of his data on Lexbase. In particular, he claimed that the controller could not lawfully make information about his criminal convictions available after the same information was removed from the public register of criminal records. After sending an unsuccessful erasure request, the data subject initiated civil proceedings before the District Court of Attunda and requested SEK 300,000 (about €26,000) in damages over the allegedly unlawful processing of their data on the Lexbase database. The controller, on the other hand, claimed that its activities were exempt from the GDPR because they were covered by the constitutional protection of the publishing certificate. = The District Court referred three somewhat complex questions to the Court of Justice about the interpretation of Article 85 GDPR: # Does Article 85(1) of the GDPR make it possible for the Member States to adopt legislative measures in addition to those which they must adopt under Article 85(2) of the regulation relating to the processing of personal data for purposes other than journalistic ones or the purposes of academic, artistic or literary expression? # If the previous question is answered in the affirmative: Does Article 85(1) of the GDPR allow a reconciliation of the right to the protection of personal data pursuant to that regulation with the freedom of expression and of information which means that the only legal remedy available to a person whose personal data are processed by making criminal convictions involving that person available to the public on the internet in return for payment is the initiation of criminal proceedings for defamation or the claiming of damages for defamation? # If the first question is answered in the negative or the second question is answered in the negative: Can an activity which consists of making available to the public on the internet in return for payment, without any processing or editing, public documents in the form of criminal convictions constitute processing of personal data for the purposes set out in Article 85(2) of the GDPR? The Advocate General opined that a data processing activity, such as that carried out by the controller in the case at hand, did not constitute a journalistic activity and did not fall under Article 85(2) GDPR. Furthermore, the Advocate General opined that Article 85(2) GDPR did not allow for legal derogations to Chapter VIII GDPR. Finally, the Advocate opined that neither paragraph (1) nor (2) of Article 85 allowed for derogations to all of the GDPR. The CJEU held that Article 85(1) GDPR does not allow Member States to create derogations from the GDPR beyond those expressly permitted by Article 85(2). Article 85(1) requires Member States to reconcile data protection with freedom of expression and information. However, it does not itself authorise exemptions from the GDPR. Such exemptions may only be introduced under Article 85(2) and only for processing carried out for journalistic purposes or for academic, artistic or literary expression. The CJEU therefore found that Member States cannot rely on Article 85(1) to exclude other forms of processing from the application of the GDPR. The CJEU also held that Article 85 GDPR does not permit Member States to restrict the remedies available to data subjects under Chapter VIII GDPR. National law cannot limit a data subject whose criminal-conviction data is published online to defamation proceedings only. Accordingly, the data subject must retain access to the remedies provided under Articles 77, 78, 79 and 82 GDPR, including the right to lodge a complaint with the DPA, seek an effective judicial remedy and claim compensation. Regarding journalistic purposes, the CJEU confirmed that the concept must be interpreted broadly. The fact that processing is carried out online, for payment or in relation to criminal convictions does not, by itself, exclude the application of Article 85(2). However, the mere publication of information is not sufficient. Processing qualifies as journalistic only where it is intended to inform the public and is carried out in accordance with journalistic professional and ethical standards. It must involve editorial work or adaptation, or at least follow an editorial policy, and the relevant factual information must be verified. The CJEU found that making unedited criminal judgements available to any paying user did not appear to satisfy those requirements. In particular, the activity did not appear to involve editorial assessment, adaptation or a journalistic policy. The fact that the documents could be useful to journalists was not enough to bring the processing within Article 85(2). It was for the referring Court to verify whether the controller’s activity met the conditions for processing for journalistic purposes. The CJEU did not impose a fine, award compensation or order corrective measures. Those issues remained for the referring Court to decide.
Court case VI ZR 97/22
An employee of a private bank (the controller) erroneously sent a third party a message that was intended for a candidate in the controller’s staff selection process (the data subject) in October 2018. The message contained the data subject’s full name and information about their salary expectations. After the data subject was informed they were no longer considered for the position, they brought court proceedings requesting injunctive relief in order to prohibit the controller from processing the data subject’s personal data in connection with their job application. In addition, the data subject claimed non-material damages. The court of first instance granted the injunction and awarded the data subject € 1,000 in damages. The appellate court upheld the injunction but rejected the damages claim. The Federal Court of Justice (BGH) referred several questions to the CJEU regarding the interpretation of Article 82 GDPR. The CJEU rendered its judgment in the case C-655/23 Quirin Privatbank in September 2025. It held that Member States may provide for injunctive relief in national law in cases of unlawful processing. According to the CJEU, negative feelings caused by a loss of control over personal data can also constitute non-pecuniary damages. First, the Federal Court of Justice held that the data subject was entitled to non-material damages in accordance with Article 82 GDPR. The court confirmed the appellate court had correctly found that sending the message containing personal data to a third party had been unlawful due to the lack of a legal basis under Article 6(1) GDPR – the data subject had not consented to the processing. Furthermore, the controller had not argued that the processing would have been lawful under a different legal basis. The court also confirmed that the data subject had suffered non-material damage as a result of this GDPR violation. In the present case, the data subject’s concern that the recipient of the message might use the personal data contained in it for their own job applications already constituted loss of control of the data subject’s personal data and was therefore enough to establish a claim for damages under Article 82 GDPR. The court referred the case back to the appellate court so that it could determine the amount of non-material damages. Finally, the court held that the appellate court had erroneously upheld the data subject’s claim for injunctive relief: there was no risk of recurrence required for such a claim in German law. As the staff selection process in which the data subject had participated had already been completed, there was no likelihood whatsoever that such an infringement of the data subject’s rights would recur.
Court case 3 L 37/26.Z
The data subject lodged a complaint with the data protection authority of Saxony-Anhalt in August 2023, arguing that the procedure for selecting and electing the DPA violated the GDPR. The DPA found no GDPR infringement that could be pursued under Article 77 GDPR and rejected the complaint. The data subject appealed this DPA decision. He stated that the DPA had failed to properly examine the complaint on its merits and should therefore be required to reconsider it. The court of first instance dismissed the appeal as it considered the the DPA decision to be correct and could not find any GDPR infringement either. The data subject argued in his further appeal before the higher administrative court that Article 77 GDPR confers the data subject the right to a genuine substantive investigation of the complaint. He was of the opinion that the DPA had essentially refused to handle his complaint within the meaning of Article 78(2) GDPR and should be required to reconsider it. The court dismissed the appeal as unfounded. First, it pointed out that Article 57(1)(f) GDPR requires the DPA to investigate the subject matter of the complaint to the extent appropriate. The DPA therefore retains discretion concerning the scope of the investigation. In this case, the court found that the DPA had not simply ignored the complaint: it had conducted a legal assessment of the complaint and issued a reasoned decision. Second, the court held that the present case fell under Article 78(1) GDPR instead of Article 78(2) – the DPA had not failed to handle the complaint as it had issued a legally binding decision. Therefore, the court ultimately came to the conclusion that a DPA cannot be required to investigate the complaint again if the court reviewing the case can determine that no violation of the GDPR has occurred.
Court case III OSK 2508/25
The data subject had previously worked as an IT specialist of a city. In May 2019, his work computer was supposed to be handed over to another employee. The data subject had remained logged into his personal account on Facebook that contained conversations between him and other employees of the city. The employee responsible for handing over the computer printed out the conversations and gave them to the mayor (the controller), who used them to initiate disciplinary and criminal proceedings against the employees. The data subject filed a complaint with the supervisory authority regarding the processing of his personal data contained in the Facebook conversations. The DPA reprimanded the controller for violations of Articles 5(1)(a), 5(1)(b), 6(1), and 9(1) GDPR in September 2020. According to the DPA, there had been no legal basis for the processing of personal data that also included information about the data subject’s religion. The controller appealed the decision. The court of first instance held the case concerned the secrecy of correspondence instead of data protection and annulled the DPA decision in 2021. The Supreme Administrative Court overturned this decision in 2025 and referred the case to the court of first instance for re-examination. This time, the court of first instance dismissed the appeal and deemed the DPA decision correct. The controller appealed further to the Supreme Administrative court, arguing that he had not processed personal data. The Supreme Administrative Court dismissed the controller’s appeal as unfounded. In the court’s view, the data subject’s login credentials, profile information and information in the Facebook conversations clearly constituted personal data within the meaning of Article 4(1) GDPR: logging in allowed access to the profile of a specific natural person and therefore identified them. Second, the court held that the controller had undeniably processed personal data pursuant to Article 4(2) GDPR. The controller could view, collect, download, print out, and use personal data of the data subject and other individuals after using the login credentials to access his Facebook account. In addition, the controller had further processed the personal data by using the content of private Facebook conversations in paper form.
DSB
The data subject was a military officer against whom were launched disciplinary proceedings. These proceedings resulted first in the imposition of a fine against them and ultimately in their dismissal. The dismissal judgement was later annulled by the Supreme Administrative Court. The data subject lodged 14 complaints with the DPA from 11 April 2023 to 22 August 2024. The DPA pointed out that in the recent past, it had already decided on 19 previous complaints that the data subject had lodged with it. From these 19 cases, the data subject’s complaints were dismissed nine times. Eight complaints were upheld, and one was partially upheld. Moreover, the data subject had appealed three of these decisions. The DPA found that all of the new 14 complaints shared a common link. They were all related to the data subject’s employment-related conflicts and the disciplinary proceedings. They were also filed against individuals connected to the data subject’s former employment. In addition, the DPA noted the repetitive language in the data subject's submissions. The data subject in their complaints regularly alleged unlawful use of their data, unlawful disclosures and violations of their data subject rights. The DPA highlighted that on some occasions the data subject had filed a complaint with it as early as the day after the rejection of one of their requests. The DPA believed that the data subject was attempting to resolve issues with former departments and superiors through data protection complaints. It concluded that the data subject was using the complaints as a form of retaliation, rather than genuinely seeking to protect their legal rights due to an alleged data protection violation. The DPA emphasized that data protection proceedings should not be used as a means of pressure against former superiors. Consequently, the DPA determined that the data subject's complaints were abusive and their actions excessive. Deeming this an abuse of rights, the DPA decided not to process the 14 new complaints under Article 57(4) GDPR. The reason for this was that the requests were deemed excessive because they were clearly aimed at causing annoyance or exerting pressure. The DPA issued a decision refusing to handle the 14 complaints. The data subject then appealed this decision before the Federal Administrative Court. The data subject contended that the DPA did not adequately address the specific grounds of their complaints. They also argued that the DPA had relied on the overall number of proceedings instead of assessing the individual complaints. The data subject cited the CJEU ruling in [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62023CJ0416 Case C-416/23] to argue for the proper interpretation of Article 57(4) GDPR. CJEU had clarified that repeated Article 77 GDPR complaints are not excessive merely because of their number and that the DPA must prove abusive intent. Moreover, they argued, that one of the complaints should not have been included in the DPA’s refusal decision, because it had already been submitted to the Federal Administrative Court. The court partly upheld the appeal only in relation to one complaint, which had already been submitted to court and therefore should not have been included in the DPA’s refusal decision. Therefore, it ruled that there were 13 complaints at issue in this case, not 14. The court did not examine the merits of the data subject’s complaints. It reviewed only whether the DPA was entitled to refuse to handle them under Article 57(4) GDPR. The court relied heavily on [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62023CJ0416 CJEU Case C-416/23] to evaluate whether the complaints were excessive pursuant to Article 57(4) GDPR and recognized that the number or frequency of the requests alone is insufficient to indicate excessiveness. The DPA must establish abusive intent. However, it remarked that these factors could suggest that the data subject's primary aim was unrelated to data protection. The court also noted that hostility towards specific individuals could constitute an abusive purpose. It observed that the 13 complaints were primarily directed against the data subject’s superiors, many of whom were involved in their disciplinary proceedings. The court also highlighted the close temporal proximity between these proceedings and the filing of the complaints. Consequently, the court determined that the complaints were closely linked to the data subject’s disciplinary disputes and mainly targeted former superiors involved in those proceedings. The court concluded that the complaints were used as a means of pressure, rather than to primarily protect data protection rights. The court upheld the DPA's opinion that there was abusive intent in the data subject's 13 complaints and that they were excessive under Article 57(4) GDPR.
The European Commission
The background In 2021 Hungary adopted "Law LXXIX of 2021 adopting stricter measures against persons convicted of paedophilia and amending certain laws for the protection of children" ("the amending law"). The law introduced a number of rules to restrict the access of minors to content portraying or promoting gender identities that do not correspond to the sex assigned at birth, sex reassignment or homosexuality. The law also introduced new rules for access to public documents, requiring public bodies to allow broad access to information about individuals convicted of sexual offences against children. The alleged purpose of the law was to protect minors. In 2021 the Commission sent a formal letter to Hungary contesting the amending law's compliance with EU law. After some unproductive back-and-forth, the Commission escalated the case to the CJEU, requesting the CJEU to declare the amending law incompatible with EU law. The European Commission filed four pleas, claiming that Hungary violated of a long list of provisions from primary and secondary EU lawThe Commission alleged the violation of Articles 1, 7, 8(2), 11 and 21 CFREU; Article 2 TEU; Article 56 TFEU; Article 3(2) of the Directive on electronic commerce; Articles 16 and 19 of the Services Directive, Article 9(1)(c)(ii) of the AVMS Directive; and Article 10 GDPR.. Only the Commission's fourth plea invokes data protection law- specifically, [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 8(2) of the EU Charter of Fundamental Rights (CFR)] ("Protection of personal data") and Article 10 GDPR ("Processing of personal data relating to criminal convictions and offences"). The fourth plea: Article 10 GDPR The alleged violation of the GDPR relates to the amended law's rules on access to information about individuals convicted of sexual offences against children. The law amended the "Law on the criminal record system" and made documents about sexual offences accessible to a broad audience. Under the new rules, any adult who is either a relative or a guardian of a minor ("authorised person"), has the right to access and share information about individuals convicted of sexual offences against children (the data subjects) from bodies with access to registered data. The Commission claimed that the amended law failed to specify with sufficient clarity who is authorised to submit a data request and, therefore, did not provide sufficient guarantees for the rights and freedoms of data subjects regarding the conditions of access to their personal data. On these grounds, the Commission claimed that the amended law infringed Article 10 of the GDPR (as well as [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Art. 8(2) CFR]). In its defense, Hungary argued that the law accurately identified "authorised persons" when read in light of the definition of "relatives" in the Hungarian civil code. Additionally, Hungary claimed that there were two additional criteria access to personal data under Hungarian law: the authorised person must consider the relevant data to be probably necessary, and it must be disproportionately difficult for them to access the subjects' data if they are not disclosed. In other words, Hungary argued that when interpreted correctly, Hungarian law provided for three cumulative criteria for the disclosure of data about convictions for sex offences against children: * (i) the disclosure was requested by an authorized person (i.e. "any adult who is either a relative of, or educates, supervises or cares for, a person who has not attained 18 years of age"- where "relative" was to be understood in the well-defined sense of Hungarian civil law); * (ii) the disclosure was probably necessary to keep the minor safe; * (iii) it was disproportionately difficult for the authorized person to access the data otherwise. Hungary claimed that these criteria were clearly defined and provided sufficient safeguards for data subjects. On this basis, Hungary argued that the amended law complied with Article 10 GDPR and [https://www.europarl.europa.eu/charter/pdf/text_en.pdf 8(2) CFR]. AG Cápeta clarified that, according to CJEU case law, the GDPR did not impose an absolute ban on the disclosure of personal data from public authorities. The GDPR did, however, require a balancing between the purpose of such disclosures, and the rights and freedoms of data subjects. In particular, the disclosure of personal data regarding criminal convictions, required strict justification and clear legal safeguards, because of the sensitive nature of such data. In the case at hand, the AG conceded that the data disclosure pursued an important public interest (the protection of minors). So, the question was whether the amending law correctly balanced this interest against the right to data protection. The AG opined that the amending law failed to do so and exceeded what was strictly necessary to protect minors, for two reasons. First, the AG agreed with the Commission that the notion of "authorised persons" was too broad and unclearly defined under the amending law, even when the amending law was interpreted in light of domestic civil law. In this regard, the AG pointed to the CJEU case law on the access to personal data from national authorities: in order to satisfy the requirement of proportionality, national law that allowed for such access "must lay down clear and precise rules governing the scope and application of the measure in question and imposing minimum safeguards". The AG further opined that such criteria would also apply to access from private citizens, as in the case at hand. Second, the AG considered that requirements (ii) and (iii) (i.e.: the probable necessity of the disclosure, and the difficulty of otherwise accessing the data) were overly generic and were to be assessed by the authorized person themselves. The AG argued that such a self-declaratoty regime lent itself to abuse and deprived the disclosing body of any control over the necessity and proportionality of the disclosure. For this reason, the AG opined that the amending law failed to provide the required safeguards for data subjects. On these grounds, the AG opined that the amended law was disproportionate and violated Article 10 GDPR as well as [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 8(2) CFR]. The court first noted that one of the objectives of the GDPR is to ensure a high level of protection of data subjects’ fundamental rights and freedoms, in accordance with Article 1 GDPR and [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 8(1) CFR].See Mousse, C‑394/23, margin 21, https://infocuria.curia.europa.eu/tabs/document?source=document&text=&docid=294110&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=14235898 Therefore, any processing of personal data must be lawful, in accordance with Articles 5(1)(a) and 6(1) GDPR. In addition, any legal basis other than consent (Article 6(1)(a) GDPR) must be interpreted restrictively.See Mousse, C‑394/23, margin 27, https://infocuria.curia.europa.eu/tabs/document?source=document&text=&docid=294110&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=14235898 The court then assessed whether the processing was lawful under Article 6(1)(e) and 86 GDPR. Article 6(1)(e) GDPR provides for a legal basis based on public interest or in the exercise of official authority vested in the controller. In the case of disclosing this data, Article 86 GDPR states that this may be done to reconcile public access to official documents with the right to the protection of personal data. The court stated that, in principle, the processing of data related to criminal convictions (including its disclosure) could be lawful under Article 6(1)(e) and 10 GDPR. However, Article 10 GDPR makes the processing subject to additional restrictions (for example, the processing must provide for appropriate safeguards). In addition, limits to the fundamental rights to privacy and data protection must respect the essence of the fundamental right and be proportionate, in accordance with [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 52(1) CFR].See Endemol Shine Finland, C‑740/22, margin 52, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:62022CJ0740 This is especially relevant in this case, as data related to criminal convictions is particularly sensitive and its processing can be a particularly serious interference with data subjects’ fundamental rights.See Endemol Shine Finland, C‑740/22, margin 54, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:62022CJ0740 The court followed the reasoning of the AG in stating that the protection of minors was an important public interest. However, the court considered the amending law incompatible with Article 10 GDPR. The law was not sufficiently precise, particularly in defining the concept of “authorised person”. The court considered that the processing was not limited to what is strictly necessary, as the circle of persons potentially entitled to submit a request was too broad. Finally, the court concurred with the AG, and stated that the amending law was not proportionate. This is because it relied on the person requesting the data to justify the need to access it. Therefore, the amending law did not provide for appropriate safeguards by relying on the self-declaration regarding the necessity and proportionality of accessing the data. The court concluded that the amending law did not meet the requirements under Article 10 GDPR, meaning it could not justify its processing under Article 6(1)(e) GDPR. With this, Hungary had failed to fulfil its obligations under Article 10 GDPR and [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 8(2) CFR].
Controller (subsidiary of parent company)
The parent company operated a customer loyalty programme through its subsidiary, the controller, starting 2 May 2019. The controller managed the operational business and processed personal data of registered customers, including profiling activities based on customer data. The controller designed the profiling consent forms, determined the data processing activities, prepared the privacy documentation, implemented technical and organisational measures, and established GDPR compliance processes. The parent company only financed the controller. On 12 October 2021, the Austrian DPA fined the parent company €8,000,000. The DPA considered the parent company and the subsidiary to be joint controllers under Article 26 GDPR. It held that the consent forms used for profiling did not meet the requirements for valid consent under Article 4(11) and Article 7 GDPR. It further held that the profiling lacked a valid legal basis under Article 6(1) GDPR because the consent was invalid. The parent company appealed. The Federal Administrative Court annulled the fine and terminated the proceedings. The DPA then appealed to the Austrian Supreme Administrative Court. First, the court referred to the case law of the Court of Justice of the European Union on the concept of controller under Article 4(7) GDPR and joint controllership under Article 26 GDPR. The court noted that a party qualifies as a controller only if it actually influences the purposes and means of the relevant processing operations. Merely establishing and financing a subsidiary did not automatically create joint controllership, as the parent company didn't exercise actual influence over the specific processing activities. As a result, the parent company was not a joint controller under Article 26 GDPR. Second, the court also rejected the DPA’s reliance on CJEU judgments such as Jehovan todistajat, Fashion ID and others, as those cases involved direct influence over concrete processing operations, which was absent here. Finally, the court rejected the DPA’s appeal.
Court case 12009-25
A data subject filed a complaint with the DPA concerning the processing of personal data in a research project linked to an American researcher, the American association Prostitution Research and Education (PRE), and a Swedish association (the controller). The DPA opened supervision against the controller. It intended to assess compliance with the GDPR provisions on the basic principles, legal basis, special category data, criminal offence data and transparency obligations. The DPA later closed the case. It considered that the Swedish association was not the controller for the processing of the complainant’s personal data. In particular, the DPA relied on the ethical review application, where the association was not identified as responsible for the research project. The DPA considered that it's involvement, including participant selection, provision of premises, storage facilities and an email address, indicated processor status rather than controller status. The complainant appealed. They argued that the Swedish association had exercised influence over both the purposes and means of the processing, had its own interest in the research project, and could not avoid responsibility merely because PRE or another actor may also have been a controller. The Court upheld the appeal. First, the court held that the Swedish association was a joint controller. It recalled that controller status must be assessed objectively and interpreted broadly. What matters is whether an entity, for its own purposes, actually exercised influence over the purposes and means of the processing. A formal designation in project documents is not decisive. The court found that the Swedish association had a significant role in the project. It had initially identified itself as controller, was listed as a co-founder, had a representative involved in data collection, processing, analysis and report writing, had published research based on the project data, had used the project to pursue its own knowledge and policy objectives, and had participated in recruitment, interviews and storage of personal data. Taken together, these circumstances showed that the Swedish association had exercised significant influence over both the purposes and means of the processing. The court therefore held that it was a joint controller under the GDPR. Second, the court held that the DPA had not fulfilled its duty to investigate the complaint. Although supervisory authorities have discretion as to the scope of an investigation and the choice of measures, this discretion is not unlimited. In this case, the processing concerned sensitive personal data and raised complex questions concerning research-related processing. The court found that the DPA could not close the case merely because the complainant’s personal data had allegedly been deleted, because the legal situation had changed during the procedure, or because measures against the american association might be difficult or ineffective. The DPA had to assess, with due diligence, which further measures were appropriate to ensure compliance with the GDPR. The court annulled the DPA’s decision and remanded the case. The DPA must resume the investigation on the basis that the Swedish association is a joint controller.
Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
In 2024 the federal Data Protection Authority (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, or BfDI) requested access from the Federal Intelligence Service (BND, the controller), to ensure that their activities complied with data protection law. The request related to the controller’s processing of foreign data subject’s communications. The controller refused this request on the grounds that the Independent Supervisory Board (UKR) had exclusive jurisdiction to review the case. The BfDI filed a complaint with the Federal Chancellery (the highest federal authority responsible for the controller), who rejected the claim. The BfDI brought a case to the Federal Administrative Court. The BfDI requested the court to order the controller to provide access, or alternatively, to declare that the controller violated the BfDI’s right to access under national law. On the other hand, the controller requested the court to dismiss the case. The court dismissed the claim on procedural grounds, stating that the BfDI did not have standing under national law. The court dismissed both claims of access and declaratory judgment. The court dismissed the BfDI’s argument regarding its standing based on a constitutional requirement for effective supervisory control. The court drew a distinction between the BfDI invoking a subjective public right as a public authority in comparison to a citizen. The court first clarified that this case falls outside of the scope of the GDPR, in accordance with Article 2(2)(a) GDPR. In these situations, national law provisions did not allow the BfDI to directly intervene against the controller for the purpose of data protection oversight. Instead, the BfDI must file a complaint with the competent supreme federal authority. This limitation must not be circumvented through the court proceedings. The court considered that the BfDI has sufficient powers to contribute to remedying situations it deems unlawful by raising an objection to the Federal Chancellery. This authority has similar powers under national law as those outlined in Article 58(1) to (3) GDPR.
DPA
The data subject filed a complaint with a DPA on 18 June 2024 under Article 77 GDPR. The complaint concerned a controller established in another Member State and alleged an incomplete response to an access request under Article 15 GDPR. The DPA did not issue a decision within six months. On 26 August 2025, the data subject lodged a complaint with the court, claiming that the DPA had failed to comply with its obligation to decide within the statutory deadline. The DPA argued that the case involved cross-border processing and that another supervisory authority acted as the lead authority under Article 56 GDPR. It further stated that the decision deadline was suspended due to the cooperation procedure under Article 60 GDPR. The DPA formally transmitted the complaint to the lead authority on 22 October 2025. First, the court held that the case concerned cross-border processing within the meaning of Article 4(23) GDPR. Therefore, the cooperation and consistency mechanism under Articles 56 and 60 GDPR applied, making the foreign supervisory authority the lead authority. Second, the court considered that, in such cases, the competence to issue a final decision depends on the outcome of the cooperation procedure. It noted that only the lead authority can adopt binding decisions concerning cross-border processing, while other DPAs act as concerned authorities. Third, the court held that the decision period under national law was suspended pursuant to § 24 DSG during the cooperation procedure under Articles 56 and 60 GDPR. The court clarified that this suspension applied automatically from the moment the complaint was filed, not only after the formal initiation of cooperation between authorities. Finally, the court concluded that the DPA had not failed to act within the required time frame. As a result, there was no violation of the duty to decide, and the complaint was dismissed.
Reddit BV
Reddit BV (the controller) is a social media platform. In March 2025, the Dutch DPA initiated an ex-officio investigation into the controller’s data processing activities. This investigation began as a result of media coverage revealing that the users’ public content was shared or sold to train developers’ AI models. While the DPA initially limited its investigations to Articles 6, 13 and 21 GDPR, it later widened the research to include Article 5 GDPR, and considered hearing personnel from the US. During the investigations, the controller objected to the DPA’s requests for information, and later ceased cooperating on the grounds that the DPA had not provided clear explanations on the reasons behind the investigation. In addition, the controller argued that the DPA had access to incorrect or unlawfully obtained information (including from a former employee seeking legal advice after copying confidential information), which it was not allowed to verify during the investigations. Some of the information the controller objected to was covered by legal professional privilege, which the DPA obtained through a procedure designed for this type of information. The DPA later informed the controller that it will impose a fine for refusing to grant it access to the necessary information during its investigations, in violation of Article 31 GDPR. The controller brought a case to the court in January 2025. The controller requested the court to order the DPA to provide information regarding the confidential information it had obtained, or alternatively, allow the controller to seize the evidence obtained by the DPA for potential future litigation. The controller later amended the request, asking the court to order the DPA to ensure the controller's right to refuse to give evidence. Finally, the controller requested the court order(s) to be subject to a €1,000,000 fine for noncompliance. The DPA requested the court to declare the controller’s case as inadmissible, as there was n
Court case III C 904/23
The Financial Ombudsman’s office (the controller) sent a letter containing the name, the address, and the case reference number of a customer (the data subject) to 28,366 public institutions and entities registered on an official government platform in February 2021. The data subject demanded compensation for the unauthorised disclosure of his personal data from the controller in November 2021. The controller refused to accept liability for the incident. The supervisory authority issued the controller a reprimand in September 2022 for disclosure of personal data in violation of Article 6(1) GDPR. The data subject brought a lawsuit for damages under Article 82 GDPR before the Regional Court in Warsaw in August 2023. The data subject stated that they had experienced severe stress and lost the sense of security and control over their data as a result of the unauthorised disclosure of the letter. The controller argued it was not at fault for the incident as it was caused by a temporary IT system failure that the controller could not have foreseen. The Regional Court in Warsaw held that the controller was undoubtedly liable for the unauthorised disclosure of the data subject’s personal data pursuant to Article 82 GDPR: the controller was an administrator for the government platform and had not taken adequate measures to secure the data. Second, the court held that the data subject had suffered non-material damage in connection with the aforementioned incident. It took into account that the data had been disclosed to numerous entities. In addition, the deterioration of the data subject’s mental state was confirmed by a witness. The court awarded the data subject PLN 40,000 in damages. It considered the data subject’s claim of PLN 50,000 to be excessive in light of established case law.
WhatsApp Ireland Ltd
Following the entry into force of the GDPR, the Irish DPA received complaints from users and non-users (the data subjects) of the ‘WhatsApp’ messaging service concerning the processing of personal data by WhatsApp Ireland Ltd (the controller). After receiving an European Data Protection Board (EDPB) 'binding decision' (28 July 2021) within the framework of the GDPR's consistency mechanism, the Irish DPA adopted a final decision on 20 August 2021, in which it found that the controller had infringed certain provisions of the GDPR. The Irish DPA imposed corrective measures on the controller, in particular administrative fines for a cumulative amount of €225 million. The controller, challenged the EDPB's binding decision before the European General Court (GC) and in - in parallel - the implementing final decision by the Irish DPA before an Irish court. On 7 December 2022, the GC rejected the controller’s action as inadmissible. In that order, the GC considered, in essence, that the binding decision did not constitute a challengeable act for the purpose of [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12008E263:EN:HTML Article 263(1) TFEU] and that the controller was not directly concerned with that decision, within the meaning of [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12008E263:EN:HTML Article 263(4) TFEU]. Additionally, the GC considered the controller’s action brought out of time, because the Irish DPA had informed the controller already of ‘the relevant content’ of the contested decision prior to the EDPB’s publication thereof on its website, thus the term under [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12008E263:EN:HTML Article 263(5)] had already commenced then and not only with the publication. By its appeal lodged on 17 February 2023, the controller requested that the CJEU in essence to reject the GC's order and find the action admissible. The controller put forward two grounds of appeal: # The GC misin
Court case 25/12378
The data subject had lodged a complaint against a former employer for GDPR violations. While the DPA found an infringement and issued a reprimand against the employer, it rejected the complaint insofar as the data subject sought further corrective measures. The Data Protection Board of Appeal subsequently held that the data subject lacked a legal interest in appealing the DPA’s decision, arguing that the right to an effective remedy under Article 78 GDPR primarily protects persons on whom the decision has direct legal effects, and that national procedural law may limit who has standing to seek judicial review. The Ombudsman disagreed and challenged this restrictive interpretation, relying on CJEU case law, including Schufa cases and Land Hessen. The Ombudsman argued that Article 78(1) GDPR grants both data subjects and controllers the right to an effective remedy against supervisory authority decisions, including review of the authority’s choice of corrective measures under Article 58(2) GDPR. The Ombudsman also referred to [https://www.privacy-regulation.eu/en/recital-141-GDPR.htm Recital 141 GDPR] and [https://fra.europa.eu/en/eu-charter/article/47-right-effective-remedy-and-fair-trial Article 47 of the EU Charter], emphasizing the need for full judicial review where a supervisory authority fails to intervene adequately to protect a data subject’s rights. Restricting data subjects to cases of ongoing violations, risks undermining uniform enforcement of the GDPR and lowering the level of data protection. The data subject must have the right to an effective judicial remedy under Article 78(1) GDPR against all aspects of a supervisory authority’s decision, including the selection and adequacy of corrective measures. This right is not limited to situations where the decision has binding legal effects on the data subject, nor may it be excluded by national procedural rules.
Court case W137 2328811-1
In 2008, a district court issued a payment order against the data subject for an unpaid lawyer’s fee. The payment order became final and enforceable in June 2008, but the data subject never paid the debt. After the judgement, the data subject changed her surname, moved to Germany and did not inform the lawyer (the controller) about these changes. The controller attempted to recover the unpaid legal fee from the data subject. He discovered the data subject’s new address and contacted her, requesting the outstanding payment. The data subject asked the controller where it got her address from, arguing that failing to provide this information would violate Article 14 GDPR. The controller responded that he had obtained the address in the course of his professional activity and could not disclose details due to his duty of professional secrecy. On the same day, the data subject filed a complaint with the Austrian Data Protection Authority (DSB). She alleged violations of Article 14(2)(f) GDPR, the principles of processing under Article 5(1)(b) GDPR, the lawfulness requirement under Article 6 GDPR, and her right to erasure under Article 17 GDPR. The data subject claimed she would not pay until these procedures were concluded. The DSB refused to deal with the complaint under Article 57(4) GDPR as it considered the complaint unfounded and abusive because it served only to delay or obstruct the enforcement of the debt. The data subject appealed this decision to the court. First, the court confirmed that supervisory authorities may refuse to act on complaints that are manifestly unfounded or abusive under Article 57(4) GDPR. It referred to the case law of the CJEU that clarifies that the concept of an “application” in Article 57(4) GDPR also covers complaints under Article 77 GDPR. Second, the court assessed whether the complaint pursued a legitimate data protection objective. It found that the data subject used the complaint primarily to delay or prevent the enforcement of
Court case W292 2342582-1/13E
A data subject hired an association whose business model is to automatically search for possible data protection violations and filing complaints or lawsuits on behalf of data subjects with the financial aid of litigation funders. The agreement between the data subject and the association foresees that the data subject receives 70% of possible profits coming from a favourable judicial or administrative decision and 30% of the profits go to the litigation funders. In the agreement, the association claims their offer would generate profit without any risk for their customers. The association made an access request and filed a complaint via a lawyer on behalf of the data subject. The telecommunication provider charged the data subject with a service fee the parties have not agreed upon. The access request concerned invoices of a telecommunication provider that the data subject was in a contractual relationship with and the service fee was indicated on the invoices. On the initiative of the association, not the data subject, the association made an access request, claiming the service fee let the data subject to believe that the telecommunication provider might possess documents concerning the data subject without their knowledge and might process their personal data unlawfully. The data subject already had access to the invoices through the telecommunication provider’s online portal for customers. The data subject did not, or did not remember, to explicitly mandate the association to lodge the access request. The lawyer hired by the association filed a complaint on behalf of the data subject because of a possible violation of Article 15 GDPR. The grounds of the violation were illustrated only rudimentary in the complaint. The association filed a total of more than 900 complaints with the DPA that follow the same pattern, with 142 of those complaints being filed against the telecommunication provider because of GDPR violations in the context of charging a service fee. The DPA refused to act on the request on the basis of Article 57(4) GDPR because it held that the data subject lodged the complaint not for reasons of the protection of personal data. The data subject appealed the decision. The Federal Administrative Court (Bundesverwaltungsgericht) upheld the decision of the DPA and decided that the data subject lodged the complaint not for reasons of the protection of personal data but for financial reasons. Therefore, Article 57(4) GDPR was applicable. The Court believed that without the financial incentive, the data subject would not have lodged the complaint. According to the Court, the fact that the initiative to exercise the data subject’s right did not come from the data subject themselves but from the association, is another factor that lead the Court to assume an abusive exercise of data subjects’ rights. The data subject did not explicitly mandate the association with the access request, the data was already available to the data subject via the portal but they did not show any interest in it and there was no indication of unlawful processing. All those factors added to the conclusion that the data subject did not have a data protection interest for exercising their rights. The sole motivation for the access request was to enable the business model of the association. These activities of the association that are aimed primarily at re-claiming the service fee through the means of civil law, are already known to the Court. The decision of the DPA to reject the complaint instead of requesting the DPA to issue a fee for their activity pursuant to Article 57(4) GDPR, which would be a less intrusive measure, was adequate. Because of the notorious activity of the association that is systematically disabling the work of the DPA, a fee would not be adequate to stop this activity.
Court case Ro 2023/04/0028
In June 2021, the data subject lodged a complaint with the Austrian Data Protection Authority (DSB) under Article 77 GDPR, alleging a violation of his right to data secrecy. The data subject concerned the use of his professional email address by a bank employee (the controller) for a private matter in 2019. The DSB rejected the complaint on the basis of § [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 24(4) of the Austrian Data Protection Act (DSG)], which provides that the right to have a complaint examined expires one year after the data subject becomes aware of the alleged infringement and, in any event, three years after the event. The data subject had acknowledged that he became aware of the alleged breach no later than April 2019, meaning the one-year subjective limitation period had elapsed. The data subject appealed to the Federal Administrative Court (BVwG), but the court dismissed the appeal. The data subject then appealed to the Supreme Administrative Court of Austria (VwGH), arguing that [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 § 24(4) DSG] was incompatible with Article 77 GDPR, which does not provide for any limitation period, and that national law could not restrict a directly applicable EU right. The Supreme Administrative Court dismissed the appeal as unfounded. It held that [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 § 24(4) DSG] is compatible with Article 77 GDPR. The Court found that, in the absence of EU-level harmonization of procedural time limits, Member States retain procedural autonomy to regulate the modalities for exercising GDPR rights, including the introduction of limitation periods, provided that the principles of equivalence and effectiveness are respected. The one-year subjective limitation period under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 § 24(4) DSG] was deemed reasonable, proportionate, and justified by considerations of legal certainty, and it does not render the exercise of the right to lodge a complaint practically impossible or excessively difficult. Accordingly, the DSB lawfully rejected the complaint as time-barred in the first place.