GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
A trade union requested that an employer provide a detailed list of the 200 highest gross salaries paid in April 2024, broken down by salary components, including organisational unit, service, department, and job code. The request was made in the context of a collective labour dispute and was justified by the trade union on the basis of a collective agreement and its role in protecting workers’ interests. The employer refused to disclose the requested data. The court of first instance rejected the trade union’s request, finding that the disclosure of such personal data lacked a sufficient legal basis, and ordered the trade union to reimburse the employer’s procedural costs. The trade union appealed, arguing that public-sector salaries are public under national law, which obliges employers to provide trade unions with data necessary for the performance of trade union activities. The court dismissed the appeal and upheld the judgment of the court of first instance. First, the court held that the collective agreement relied upon by the trade union does not constitute a law and therefore cannot serve as a legal basis for the disclosure of personal data, as required by Article 6(2) of the Personal Data Protection Act (ZVOP-2), implementing Article 6 and 9 GDPR. Although public-sector salaries are public under national law, the court clarified that this does not entitle a trade union to obtain individual salary data within a collective labour dispute. Access to such information must be sought before the competent authority, and not before a labour court. The court additionally found that the national legislation invoked is not sufficiently specific, on its own, to justify the disclosure of detailed personal salary data. In line with the principle of data minimisation under Article 5(1)(c) GDPR, the trade union would have had to demonstrate concretely why the requested data were necessary for specific trade union activities, which it failed to do. General claims about mo
The data subject, Max Schrems, was a user of a social networking platform operated by Meta (Facebook/Instagram). He filed twelve claims against Meta alleging violations of the GDPR, seeking clarification of data processing roles, assessment of the legality of certain processing activities, access to his personal data, and €500 in non-material damages. Since 2011, the data subject had attempted to obtain full access to his personal data, but Meta only provided partial access. The data subject argued that Meta unlawfully processed his personal and sensitive data, failed to provide full access to all personal data upon request, and collected personal data from users through social plugins, third-party apps, and websites using them for personalized advertising without consent. The proceedings were initiated in 2014 and extended over a period of approximately 11 years, involving several judicial bodies. The Regional Civil Court in Vienna initially declined jurisdiction on two occasions, taking the view that the data subject did not qualify as a consumer in relation to his private account. In later decisions, the court [https://noyb.eu/sites/default/files/2020-06/Urteil%20FB_geschw%C3%A4rzt.pdf cited] [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0446 uncertainty regarding jurisdiction under the GDPR]. During the course of the proceedings, the Austrian Supreme Court submitted [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0446 two questions to the European Court of Justice (CJEU).] In 2021, the Supreme Court issued a [https://noyb.eu/sites/default/files/2020-12/BVI-209_blackened_en.pdf partial judgment], awarding data subject €500 in damages, while leaving the remaining claims undecided until the ECJ rulings were available. The Austrian Supreme Court has now ruled on the remaining points of the appeal. The Austrian Supreme Court (OGH) ruled that Meta must provide data subject full access to all personal data processed about him. Th
The data subject purchased eye drops, skin care products, and other similar products from on online pharmacy website, as well as items from an online sex shop website. The data subject used the online payment service provided by Paydirekt GmbH (the controller) when making the online purchases. The controller stored data regarding the items purchased, along with the amount of money spent and the date of the purchases. The data subject, represented by noyb, filed a complained with the Hesse DPA (HBDI) in which she argued that the controller violated Article 5(1) GDPR and Article 9(1) GDPR by processing health-related data and data relating to her sexual life (both sensitive data) without a legal basis - specifically by storing the information on the individual items purchased, and Article 25(1) GDPR by processing data that were not needed for the provision of the payment services (data minimisation). The DPA partially rejected the complaint, finding that the controller can process information on the items purchased by a customer from an online pharmacy and an online sex shop based on its legitimate interest to minimise mid-transaction payment cancellations and for fraud prevention purposes. Furthermore, the DPA held that the specific information on purchased items is not sensitive data. In August 2022, the data subject appealed against the DPA's decision in court, requesting that the decision be revoked and that the DPA prohibit the controller from processing the purchased items when making a purchase. Following the CJEU judgement in C-21/23 EuGH the DPA changed their position on the classification of these data to be partially sensitive data. However, the DPA did not provide a detailed explanation as to the consequences of this change of position. In 2025, the controller entered liquidation proceedings and ceased operations. The Court noted that the controller ceased operations, entered liquidation and claimed to have deleted the data subject’s data. Therefor
The defendant, an insurance agent at Croatia Osiguranje d.d., had his access to company business applications revoked during his employment termination notice period in September 2021. Despite this restriction and without authorization from his employer or clients, he used the login credentials of another employee to repeatedly access internal sales applications. He then sent 41 emails containing 848 documents that included the insurance policies and personal data (names, addresses, personal identification numbers, birth dates, and phone numbers) of at least 334 clients. He first sent the data to his official work email and then forwarded it to his private email. The prosecution alleged that this conduct violated the GDPR, the Croatian GDPR Implementation Act, and internal company access rules and this this constituted unauthorized use of personal data and unauthorized access to computer systems under Croatian criminal law. The court held that the defendant committed a criminal offense against privacy. Because the defendant intentionally accessed and used personal data without permission and without a valid legal basis under Article 6(1) GDPR, the court held that he committed the criminal offense of violation of privacy under Article 146(1) of the Croatian Criminal Code. The court sentenced HIM to a prison term of three months. Additionally, the court found that the defendant knowingly accessed the employer’s computer systems without authorisation. The court held that this conduct constituted a criminal offense against computer systems, programs, and data under Article 266(1) of the Croatian Criminal Code because it involved intentional interference with computer systems which the defendant had no lawful access. For this the court sentenced the defendant to a prison term of four months. The court combined the sentences into a single six-month prison term. It then imposed a suspended sentence, so the prison term would not be executed if the defendant did not commi
A data subject initiated proceedings in front of the Administrative Court of Sofia - City against Izi Asset Management (the controller) due to the refusal of the controller to provide them with a copy of a consumer credit agreement in accordance with Article 15 GDPR. The data subject’s representative, an attorney, contacted the controller via email to request the copies. The controller based its refusal on an alleged lack of explicit power of attorney on the part of the data subject’s representative. The court found that the controller’s refusal was unlawful. It noted that the request was valid under Article 15 GDPR, since the representative already indicated the power of attorney with an express right to file a complaint on the data subject’s behalf. The court noted that there were no grounds to require the submission of additional evidence by the representative of the data subject. Furthermore, it emphasised the obligations of the controller to provide information to the data subject under Article 12 GDPR. Therefore, the court revoked the controller’s decision to terminate the proceedings with the data subject regarding the provisions of the requested copies, and referred the case back to the controller for a decision on the merits of the request.
The case was about unlawful processing of personal data for advertising without a valid legal basis, not specifically about cookie or consent banner violations.
Criteo placed tracking cookies on users' devices through third-party websites without obtaining prior consent.
The data subject requested information from a credit rating agency acting as controller regarding the calculation of his credit score. The score was used by third parties, such as lenders, to assess the data subject’s creditworthiness and had a significant impact on his ability to conclude contracts. Relying on Article 15 GDPR, the data subject sought access not only to his personal data but also to information on how the score was generated. The controller provided general information but refused to disclose details about the functioning of the scoring system, arguing that the algorithm and weighting factors constituted trade secrets and that the score itself did not amount to automated decision-making. The data subject lodged a complaint with the DPA, which was later rejected. The data subject brought an appeal before the Administrative Court, arguing that the credit score resulted from automated processing and had legal or similarly significant effects, thereby entitling him to the additional information required under Article 15(1)(h) GDPR. The court upheld the data subject’s claim. After hearing the parties, the court stayed the proceedings and referred the case to the CJEU (C-634/21 and C-203/22). The questions posed regarded the interpretation of Article 22, and whether credit scoring can amount to automated decision-making. The court then relied heavily on the CJEU's reasoning in assessing the case at hand. It held that credit scoring qualifies as automated decision-making within the meaning of the GDPR, as the score is generated exclusively by automated means and is intended to be used as a decisive factor in contractual decisions affecting the data subject. The fact that third parties ultimately rely on the score does not negate the automated nature or significance of the processing. Accordingly, the Court found that Article 15(1)(h) GDPR applies. The controller is therefore required to provide the data subject with meaningful and understandable informat
On 7 April 2021, the data subject requested access to their data under Article 15 GDPR. The controller replied on 12 April 2021 and provided further information on 27 May 2021 after the data subject made a further enquiry. As the controller's privacy policy listed significantly more data being collected, the data subject lodged a complaint with the Austrian DPA (DSB) on 13 July 2021. They argued that the data provided and its sources were incomplete. On 03 January 2022, the DPA partly upheld the complaint and ruled that the controller violated the right of access by not providing information pursuant to Article 15(1)(h) GDPR, as the calculation of the creditworthiness constitutes profiling under Article 4(4) GDPR. On 09 February 2022, the controller appealed, stating that its calculations were not based on automated processing and that providing further information would reveal trade secrets. The proceedings were stayed until the CJEU's preliminary ruling in [https://infocuria.curia.europa.eu/tabs/document/C/2022/C-0203-22-00000000RP-01-P-01/ARRET/295841-EN-1-html 'Dun & Bradstreet Austria' (C‑203/22)]. By letter of 15 May 2025, the court resumed the case. During the entire proceedings, the controller gradually provided further information on the personal data being processed and the calculation of the credit score. Hence, the following data is used to calculate the credit score: Name, age, gender, address, macroeconomic statistical parameters, payment history. The calculation itself is performed automatically using an algorithm and the same formula unless the controller's customers order a different score model. First the court ruled that the controller had an obligation to provide information under Article 15(1)(h) GDPR, as all three cumulative requirements pursuant to Article 22 GDPR were stated to be met: A credit score was calculated ('decision'), which predicts various aspects of the data subject, including their economic situation, for example. This con
The data subject requested access under Article 15 GDPR from the controller (a credit information agency). The controller provided the personal data it held, including the data subject's name, date of birth, address and business role, as well as information about the sources of those data. The data subject considered the response incomplete and requested further information. The controller provided additional information, including the companies that had queried the data subject's creditworthiness between 2014 and 2021 and the credit scores disclosed to them. The data subject then lodged a complaint with the DPA. The data subject argued that the controller processed more personal data than it had disclosed, pointing in particular to the broader categories listed in the controller’s privacy notice and the absence of information about certain data sources. During the DPA proceedings, the controller provided another response, saying that the credit score could change based on statistical criteria linked to economic developments, which it considered non-personal. The data subject appealed the DPA's decision. During the court proceedings, the controller provided further information. It explained that the credit score was calculated using, among other things, payment history data, name, age, sex, address, and the first and last confirmation of the address. However, the controller still did not disclose the specific data covered by the statistical parameters linked to general economic developments that it had used when calculating the data subject’s credit score. First, the court rejected the argument that the controller must have processed additional personal data merely because its privacy notice listed broader categories of data. The privacy notice described data that the controller could theoretically process, but this did not establish that the controller actually processed those data in relation to the data subject. Second, the court examined whether the statistic
Inteligo Media SA (the controller) is the publisher of the online news publication, which informs the general public about the legislative changes occurring each day in Romania. By subscribing to a 'Premium Service', users can access more articles per month and receive a daily newsletter, via email, called ‘Personal Update’ (unless the user opts not to benefit from that service). On 26 September 2019, the Romanian DPA (‘the DPA’) concluded that the controller had infringed Article 5(1)(a) and (b), Article 6(1)(a) and Article 7 GDPR and imposed an administrative fine of ca €9,000 (RON 42,714). The DPA had found that the controller had processed the personal data (email addresses, passwords, usernames) of 4,357 users on a legal basis which was not appropriate for the daily transmission via email of the Personal Update, without proving that it had obtained the express consent of the users to the processing of their personal data for that purpose. The controller initiated legal proceeding requesting, principally, the annulment of the DPA's decision and its exemption from liability for the administrative offense. Both the controller and the DPA appealed against a first instance judgement. Those appeals are pending before the referring court. In those circumstances, the referring court decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling: #In a case in which a publisher of online news publications [...] obtains the email address of a user when the latter creates a free user account entitling him or her: (i) to access, free of charge, an additional number of articles from the publication in question; (ii) to receive, via email, a daily newsletter containing a summary of the new legislation discussed in articles within the publication and hyperlinks to those articles; and (iii) to access, for a fee, additional and/or more extensive articles and analyses from the publication compared with those in the free
On 28 January 2025, the Croatian Personal Data Protection Agency (AZOP) dismissed a complaint from a data subject who alleged that an education inspector had disclosed his personal data to the principal of a music school in Rijeka. The data subject claimed that the inspector copied him on an email to the principal without his consent, revealing his identity and breaching the GDPR and the Croatian implementing act. AZOP rejected the complaint, stating that there were no legal grounds to open a procedure, without assessing whether the data subject’s rights had been violated. They argued that the data subject’s allegations were about breaches of sectoral rules governing inspections, not about GDPR violations and consequently they lacked competence. The data subject challenged this decision before the Administrative Court in Rijeka. The Administrative Court in Rijeka annulled AZOP’s decision and sent the case back for reconsideration. The court held that AZOP could not rule on breaches of the Education Inspection Act or the inspector’s disciplinary responsibilities. However, as an independent supervisory authority under Article 51 GDPR, AZOP was competent and obliged to assess whether the data subject’s personal data had been unlawfully processed. The court found that AZOP should have examined the complaint on its merits rather than dismissing it on procedural grounds. The court required AZOP to establish the full facts, determine if unlawful processing occurred, and issue a substantive decision within 60 days. AZOP was ordered to reimburse the data subject €1,000 for legal costs while other cost claims were denied.
A data subject lodged a data protection complaint against a credit information agency (the controller) with the Austrian Data Protection Authority (DSB). The data subject requested access under Article 15 GDPR to understand how his personal data were processed, specifically regarding the calculation of his creditworthiness score, including the logic, factors, and rules applied. At that time, the controller maintained two datasets about him: one as a private individual and one as a sole trader. Following a prior deletion request by the data subject, the controller deleted certain data related to his previous debt settlement proceedings. Regarding the controller's response to the access request, the data subject argued that provided information was inadequate.He claimed that he was entitled to a full explanation of how the score was generated and how the underlying data influenced it. The DSB initially sided with the data subject, finding that the controller violated Article 15 GDPR by deleting one dataset after the access request and providing insufficient information on the remaining dataset. The DSB ordered the controller to clarify and supplement the information provided. The controller further appealed to the Federal Administrative Court (BVwG), which overturned the DSB’s decision. It found that the deletion of the dataset had been at the request of the data subject, and therefore did not constitute a violation. Regarding the second dataset, the court held that the access provided was sufficient because the creditworthiness score value of 0.01 was a manually assigned neutral baseline, not a result of an automated decision or profiling. Consequently, no automated decision-making under Article 22 GDPR occurred, and the data subject received adequate information about the sources, parameters, and general methodology for future creditworthiness assessments. The data subject then filed an extraordinary revision with the Administrative Supreme Court (VwGH) . The S
TikTok challenged a decision and related suspension order issued by the Irish DPA concerning transfers of EEA user data to China under Article 46 GDPR. In the decision, the DPA found that TikTok had infringed Article 46(1) GDPR by failing to ensure that personal data of EEA users transferred outside the EEA (specifically through remote access by personnel in China) received a level of protection essentially equivalent to that available within the EU during the relevant period. The DPA also found a breach of Article 13(1)(f) GDPR for failure to provide required information about such data transfers to data subjects. Consequently, the DPA imposed administrative fines totalling €530 million, a suspension order requiring TikTok to suspend the data transfers, and a corrective order requiring TikTok to bring its processing operations into compliance. TikTok initiated an appeal against the DPA decision. The appeal automatically stayed the obligation to pay the administrative fines, but it did not stay the suspension order or corrective order. TikTok applied for a stay of those orders, asserting that compliance would require billions of euros in expenditure, significant business disruption, and harm to stakeholders’ experience, and that such losses could not be remedied if TikTok ultimately succeeded on appeal. The DPA opposed the stay, asserting that the ongoing data transfers posed risks to the fundamental rights of TikTok’s 159 million monthly EEA users. The Court held that the appropriate legal standard for deciding whether to grant a stay should be decided according to the national procedural rules (Okunade test), rather than the harmonized EU ones (Zuckerfabrik test). Under the Okunade test, the Court must identify the course of action carrying the least risk of injustice pending the appeal. As the DPA accepted that TikTok’s appeal raised a serious issue to be tried, the Court focused on whether damages would be an adequate remedy and where the balance of justi
The data subject was a member of the management board of Zagrebački holding, a company owned by the City of Zagreb, from 3 September 2021 until 31 March 2023. A television broadcaster published several pieces, including a video on its YouTube channel, reporting on the data subject’s resignation. The publications mentioned his name, role, employer, salary, and information on the brand of his private car. The data subject filed a complaint with the Croatian Personal Data Protection Agency (AZOP), claiming that the publication constituted unlawful processing under the GDPR because the media lacked a valid legal basis under Article 6, the reporting was inaccurate and excessive, and it did not serve any genuine public interest. He latter further claimed during the lawsuit against AZOP's decision that the authority had incorrectly and incompletely established the facts, misapplied substantive law, and breached procedural rules. He emphasized that the published personal data was unrelated to transparency in public administration, that he was neither a public figure nor a political actor, and that any public interest ended once he left office on 31 March 2023. He invoked his right to erasure under Article 17 GDPR and sought removal of the content, annulment of AZOP’s decision, or alternatively, a remittal for a new procedure. AZOP contested the lawsuit in full, maintaining that it had acted in accordance with Article 34 of the Croatian GDPR Implementation Act and Article 77 GDPR. It argued that the publication fell within a justified public interest under Article 8 of the Croatian Media Act and that it had properly carried out a balancing test between privacy (Article 8 ECHR) and freedom of expression (Article 10 ECHR). According to AZOP, the reporting was necessary, proportionate, and not sensationalistic, and did not excessively intrude on the data subject’s privacy. It added that consent was not required because the processing relied on legitimate interest under Article
The controller is a music streaming service, which used an external processor until December 2019. At the time of termination of the contract, the processor informed the controller that all the personal data it was processing would be deleted. The controller never followed up on this communication to conduct the appropriate checks. It was discovered that the processor actually did not delete the data until 2023, and that from 2022 the users data were sold on the darknet. The controller informed the data subjects as soon as it knew about the incident. One of the data subjects affected sought compensation for immaterial damages. The Regional Court dismissed the claim, which was confirmed by the Court of Appeals. The court did establish that the controller failed to comply with its obligations to carefully monitor its processor. Still, they also reasoned that the data subject did not suffer any immaterial damages as a result of it. It assessed that receiving spam emails cannot account as a damage, and that fears and anxiety are normal everyday feelings that cannot amount to damages, especially after 2 years from the data breach. The rationale was that the further away from the event, the lower the probability of an actual damage occurring. Moreover, the fear was also resulting from the fact that the data subject was also hacked before in an unrelated incident, so no causal link could be established. The data subject filed an appeal to the Federal Court of Justice. The court upheld the appeal, and sent the judgement back to the court of appeals for it to award appropriate damages to the data subject. The court explained that a claim for damages under Article 82(1) needs, cumulatively, 1. A GDPR breach 2. The existence of an immaterial damage 3. A causal link between damage and breach. The breach of the controller’s obligations under Article 28 and Article 32 GDPR had already been established previously. Establishing the damage was more complicated. The c
The data subject filed a complaint with the Norwegian Data Protection Authority (Datatilsynet) about their employer. The DPA handled the complaint and chose to use corrective measures toward the employer. The data subject attempted to appeal this decision to the Privacy Appeals Board (PVN), but the PVN rejected the appeal because the data subject did not have the right to appeal under the national law. Later, The Civil Ombudsman stated that the data subject actually does have a right to appeal under Article 78(1) GDPR, which gives to the data subject the right to an effective judicial remedy against the DPA’s decisions. The Norwegian Civil Ombudsman argued that the CJEU rulings in SCHUFA and Land Hessen expand complainants’ right to bring legal action, suggesting they may challenge all aspects of complaint handling, including corrective measures. PVN was then instructed to reconsider its decision. Upon reconsideration, PVN concluded that the data subject still does not have the right to appeal DPA's decision. Under [https://lovdata.no/dokument/NLE/lov/1967-02-10 national law], the data subject is not considered a party to the case against the employer. A party is defined as a person “to whom a decision is addressed or who is directly affected by the case,” and PVN found it clear that the data subject did not meet this threshold. Moreover the PVN examined the possible application of Article 78 GDPR. According to Article 78 GDPR, every natural or legal person shall have the right to an effective judicial remedy against a legally binding decision concerning them taken by a supervisory authority. So, the question was whether the right to an effective judicial remedy under Article 78(1) GDPR can be invoked by a data subject who has lodged a complaint with a supervisory body but who are not themselves the addressees of the decision subsequently taken. According to Recital 143, any natural or legal person should have the right to an effective judicial remedy by the com
The data subject was employed by the German Federal Financial Supervisory Authority (BaFin), the public authority responsible for supervising banks, financial service providers, and insurance companies. He worked as a case officer in a specialised unit dealing with serious financial misconduct, including organised crime and terrorism financing. Due to their work, employees in this unit regularly issue binding decisions, conduct on-site inspections, and may appear as witnesses in criminal proceedings, which makes them identifiable to affected persons. Because several employees in this unit had been threatened in the past, the data subject’s home address had been blocked from disclosure in the population register for many years. When the blocking period expired, he applied for a renewal. The local registration authority refused the request on the ground that no individual threat against the claimant had been demonstrated. The lower administrative court dismissed the data subject’s appeal against the authority’s decision, while the Higher Administrative Court ordered the renewal after the data subject also appealed the first instance court’s decision. The registration authority appealed to the Federal Administrative Court. The Court dismissed the appeal and confirmed that the blocking of the address had to be granted. The Court held that an address may be blocked where there are objectively verifiable facts showing that disclosure could endanger a person’s life, health, personal freedom, or similarly protected interests. This requires an individualised risk assessment, but it does not require that the applicant has already been personally threatened. Risks arising from a specific professional activity may suffice, particularly where other persons performing essentially the same tasks have been subjected to threats or attacks. In this case, the Court had to find a balance between the public’s right to transparency of information, and the employee’s right to privacy an
A data subject, a resident of Amsterdam, had a conflict between 2016 and 2017 that led to him leaving his home. During that period, several reports about him were allegedly made to the municipal Care and Residential Nuisance Hotline. Believing that information about him had been collected and shared within the municipality, the data subject submitted a request to the Municipal Executive of Amsterdam, the controller, to access all personal data processed about him by the Hotline under Article 15(1) GDPR. The controller treated the request as one made under Article 15 GDPR, which grants data subjects the right to access their personal data and provided him an overview of how his data had been processed and a partly redacted copy of the file. Parts of the file were redacted to protect the privacy of third parties who had made or were involved in reports. The data subject filed an objection, arguing he was entitled to full access, including names and the unredacted content. He claimed a legitimate need to access his full file to gather evidence for potential civil and criminal proceedings and defend himself. The controller rejected that, maintaining that the redactions were necessary. The data subject then appealed to the District Court of Amsterdam, which ruled that while the controller correctly withheld the identities of third parties, its decision had not clearly indicated what personal data about the data subject had been received from other parties, nor had it explained adequately with which authorities his data had been shared. The court partially annulled the decision and ordered the controller to reconsider these points. Following the judgment, the controller issued a new decision, providing a revised overview that included the personal data about the appellant obtained from others, but still excluding any data that could identify third parties. The data subject lodged a further appeal to the Council of State, arguing that his interests had not been properly w
A data subject submitted an access request under Article 15 GDPR to the court administration of the Financial Court Berlin-Brandenburg (Finanzgericht Berlin-Brandenburg - FG). The data subject considered the response incomplete. Subsequently, they filed a complaint with the Brandenburg State Commissioner for Data Protection (Landesbeauftragter für den Datenschutz Brandenburg) under Article 77 GDPR but did not receive a reply within three months. The data subject then brought an action for inaction under Article 78(2) GDPR against the supervisory authority. They requested that the authority order the court administration to answer their access request immediately and completely. The Financial Court referred the dispute to the local Administrative Court (Verwaltungsgericht - VG), stating that the German Fiscal Code gives financial courts jurisdiction only for GDPR disputes concerning tax authorities and tax matters. The data subject challenged this referral, arguing that the court administration is a public body, its data processing occurs in a tax context, and the financial courts were therefore competent. The Bundesfinanzhof (BFH) rejected the complaint. It held that a request under Article 15 GDPR to a court administration does not involve processing by a tax authority and is not a tax matter. The granting or refusal of access by a court administration constitutes general administrative activity, not judicial activity. Therefore, the German Fiscal Code does not grant financial courts jurisdiction. The BFH confirmed that the correct legal route for an inaction complaint under Article 78(2) GDPR in this context is through the administrative courts. The referral by the Financial Court to the local Administrative Court was lawful. The data subject’s appeal against the referral was dismissed, and the costs were to be borne by the data subject.