GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Financial advisory firm (controller)
The data subject was an employee of the controller, a financial advisory firm. On 11 April 2019, the data subject requested copies of all personal data the controller held about them under Article 15(3) GDPR, covering the years from 1 January 1997 to 31 March 2018. The controller provided a standard disclosure of stored information but did not supply actual copies of documents. The data subject then sued for damages and specifically sought court orders requiring the controller to hand over copies of all personal data, including telephone notes, file memos, minutes of conversations, emails, letters, and subscription documents related to investments. The case progressed through the regional court and higher regional court, which differed on the scope of what must be provided. Both controller and data subject appealed previous decisions. First, the court clarified that the right under Article 15(3) GDPR to receive a “copy” of personal data does not automatically extend to entire documents simply because they contain personal data. It held that documents the data subject themself authored (such as emails and letters to the controller) are in their entirety personal data and must be supplied as copies because the personal data is inherent in the document. Documents or parts of documents created by the controller (such as telephone notes, file memos, minutes, letters from the controller, or investment subscription forms) are not wholly personal data of the data subject as they may contain mixed information. Second, it clarified that the controller must provide only those portions that constitute the data subject’s personal data and need not turn over entire documents if parts are unrelated to the personal data. Finally, the court therefore limited the data subject’s entitlement to copies of their own emails and letters held by the controller and dismissed requests for broader document disclosure.
Court case 2 Ca 4416/23
The data subject applied for a job position at the controller. As his application was rejected, the data subject wanted to know the reasons for the rejection and requested from the controller a copy of his personal data under Article 15 GDPR. However, the controller only provided a printout of the stored data to the data subject. Subsequently, the data subject filed a complaint against the controller before the labour court in Düsseldorf ("Arbeitsgericht Düsseldorf"), seeking all information about recipients of his personal data, reasons for rejection of his job application, and a copy of all of his personal data. The data subject also requested €6,000 for non-material damages under Article 82 GDPR. During the course of the proceedings, the first three claims were settled as the controller provided the requested information in the written statement. The monetary compensation was reduced to €2,000. The data subject still claimed non-material damages because the controller failed to provide access under Article 15 GDPR without undue delay and in any event within one month, which resulted in a loss of control over his data. The data subject was also massively annoyed that the controller did not properly fulfil his right to access. The court dismissed the data subject's claim for monetary compensation under Article 82(1) GDPR as he was unable to demonstrate either non-material damage or the causal nexus between the violation of the GDPR and the damage. The court took into account the CJEU judgements in case C-667/21 - Krankenversicherung Nordrhein and C-687/21 - Saturn Electroand held that Article 82(1) GDPR is not about punitive damages for a violation of the GDPR. It merely fulfils a compensatory function as a genuine claim for damages. Therefore, a claim for damages would require a violation of the law as well as damage caused as a result of the violation of the law. Thus, there must also have been negative consequences for the person to claim damages. The court took into account the CJEU judgement in C-687/21- Saturn Electro and held that damage must be a sufficiently justified and demonstrable fear and that the mere assertion of a "loss of control" is not sufficient. The court further held that the burden to prove existence of such damage lies upon the data subject. But as the data subject had not provided any evidence to sufficiently and specifically set out the factual prerequisites of damage and causality, his claim was dismissed.
Callcenter
The controller (employer) and the data subject (employee) disagreed about the immaterial damages according to Article 82(1) GDPR. The data subject first demanded the removal of two written warnings (one for a data protection violation) from their personnel file on 12 July 2022 which they had received on 29 June 2022. On 13 July 2022, the data subject also sent the controller a request pursuant to Article 15 GDPR and demanded a copy of their personal data. The controller complied on 30 August 2022 and informed the data subject of the data that is processed, but did not include copies of documents. On 02 February 2023, the data subject filed a lawsuit to demand that the controller hands over a copy of the data and €3,000 in compensation (Article 82(1) GDPR) due to a belated and incomplete provision by the controller. The subject alleged that they suffered immaterial damages due to the loss of control over their data. On 01 June 2023, the parties reached a partial settlement before the Labour Court Mainz. The controller agreed to remove both written warnings from the personnel file of the data subject, supply copies of the processed data in the future, and let the data subject access the file after 31 August 2023, while the subject in turn agreed to be more careful in the future about who is included in the mailing list as to not cause another data protection violation. The Labour Court sentenced the controller to pay €1,000 (as opposed to the initially suggested €3,000) to the data subject. The controller appealed this decision and argued that not every violation against the GDPR could constitute immaterial damages and that the other party needed to prove the damages. In case of the data subject, it alleged it needed to be proven how the loss of control caused damages, and that the data was not lost, but lawfully processed. The data subject responded by requesting a dismissal of the appeal and to be paid another €2,000 by the controller for the failure to timely a
Court case 1 K 187/21
On 20 October 2020, the data subject requested information regarding his personal data stored by the controller and requested copies of all records containing this data. In a letter from 18 November 2020, the controller provided the data subject with general information regarding the personal data stored in their IT systems, the categories of this data, and the recipients of this data to whom the controller had disclosed it. Moreover, the controller stated that although the data subject is not entitled to receive copies of all documents in which his personal data is mentioned, copies will be made available to the data subject if he specifies his request for information and describes which documents or processing activities he was concerned with. In a letter from 4 December 2020, the data subject argued that the information provided was late and incomplete as it only listed in a specific way his so-called 'master data' (Stammdaten'), whereas the data subject asserted a right to receive copies of all documents held by the controller in which his personal data was listed. He additionally requested from the controller to erase all of his personal data and in the case of no erasure, the data subject objected to further processing of his personal data. In a letter from 28 December 2020, the controller informed the data subject that it could not erase his personal data and rejected the data subject's objection to further processing. The controller reiterated that further copies will only be made available if the data subject specifies his request. On 15 March 2021, the data subject filed a lawsuit against the controller at the Administrate Court of Berlin (Verwaltungsgericht Berlin, VG Berlin). The controller complied with the request for erasure after the filing of the lawsuit and therefore the parties agreed that this part of the lawsuit was settled. However, the data subject still requested the controller to provide him with all information on his personal data and to
Court case VI ZR 15/23
The data subject has private health and long-term care insurance with the controller. The controller increased the contributions in 2018 and 2020. The data subject considers the premium increases to be unlawful. Consequently, in civil court, the data subject requested information on the basis of Article 15(1) GDPR from the controller about premium increases starting from 2016, including justifications for the premium adjustment and supplements to the insurance policy. The Landsgericht Verden (Regional Court of Verden) upheld the action. The controller appealed the decision to the Oberlandesgerichts Celle (Higher Regional Court of Celle). However, the Court of Appeal held that the data subject is entitled to the asserted right to information under Article 15(1) GDPR. It found that letters from the controller to the data subject, even standard letters sent to a large number of recipients with the same content, are subject to the right to information as they contain information about the data subject. The controller appealed to the German Federal Court of Justice (Bundesgerichtshof – BGH). The Federal Court of Justice held that the access request by the data subject cannot be affirmed based on the reasoning of the Court of Appeal. Article 15 GDPR and the GDPR as such are applicable, even if the processing occurred before the GDPR came into force in 2018. This is because the request was submitted after 2018. The CJEU previously ruled that “it is applicable to a request for access to the information referred to in that provision where the processing operations which that request concerns were carried out before the date on which that regulation became applicable, but the request was submitted after that date.” (see [https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62021CJ0579 CJEU Case C-579/21], para 36). However, Article 15 GDPR cannot be used in the case at issue, because of the following reasons: Firstly, in light of the broad scope of personal data und
Dansk Retursystem
On May 2021, Dansk Retursystem sent to the data subject an advertising letter advertising products from X. Lebensversicherung AG. As a result, the data subject demanded information from the controller and the deletion of his data. The controller replied that it had received the data from the company AD from Switzerland and processed it on behalf of X. Lebensversicherung AG for marketing purposes on the basis of Article 6(1)(f) GDPR, without transmitting the data to the data subject himself. The data subject claimed for non-material damages pursuant to Article 82 GDPR in the amount of EUR 3,000.00, as well as pre-trial legal costs, for violation of Article 6(1)(f) GDPR, affirming that he did not consent to such processing of his personal data and there was no customer relationship with the defendant or its business partners. The Court dismissed the claim, recognizing that advertising can be a legitimate interest within the controller's business. Also, the data subject's interests do not outweigh the interests of the controller. In addition, they highlighted that having a customer relationship before the direct advertising it is not a requirement. Unsatisfied, the data subject appealed, requesting a compensation for his non-material damage in the amount of €3,000.00 and the reimbursement of the appeal in the amount of €603.93. The Court decided to uphold the judgment of the Stuttgart Regional Court, dismissing the data subject's appeal. They concluded that the advertising mail sent by Dansk Retursystem was lawful under Article 6(1)(f) GDPR and there was no need for an existing customer relationship for direct advertising to be considered a legitimate interest. Also, they highlighted that the data subject's claim for damages under Article 82 GDPR was unfounded, since he failed to demonstrate that he suffered any actual harm or distress beyond mere displeasure from receiving the advertisement. The Court reaffirmed that the use of personal data for direct advertising
Association diocésaine d'Angers
On 15 February 2020, a data subject lodged a complaint with the French DPA (“CNIL”) regarding the refusal by the Diocesan association of Angers to grant his request for access to personal data concerning him contained in the baptism register of Angers’ diocese and to exercise his right to erasure and to object the processing of his personal data. After noting that the access request had been granted by the controller, the CNIL considered that (i) the data subject could not rely on any of the grounds for deletion mentioned in Article 17(1) GDPR and (ii) the insertion in the margin of the register of a statement indicating that the data subject did not recognize the value of his baptism could be regarded as satisfying the exercise of his right to object under Article 21(1) GDPR. Therefore, in a letter dated 2 December 2021, the CNIL informed the data subject of their decision to close the complaint. The data subject appealed this decision asking the French Supreme Administrative court (“Conseil d’Etat”) to annul it. Firstly, regarding the lawfulness of the processing in itself, data revealing a person’s religious beliefs is, by virtue of Article 9 GDPR, sensitive data whose processing is, in principle, prohibited. By way of exception, the processing of such data is authorised, in particular under Article 9(2)(d) if it is carried out, in the context of their legitimate activities and subject to appropriate safeguards, by an association pursuing a religious aim, provided that the processing relates to members, former members or persons having regular contact with it. The Conseil d’Etat noted that the baptism registers kept by the Catholic Church are intended to keep a record of every event. This personal data was only accessible to the persons concerned and the registers were kept in a closed place before being deposited in the diocese’s historical archives for a period of 120 years. The Conseil d’Etat therefore considered that the mention of personal data in the ba
Austrian Data Protection Authority
In 2010, debt settlement proceedings were issued against the data subject. The data subject settled the payments of their debts in March 2018. After settling the debts, the civil court ordered to make the personal data of the data subject unavailable to the public in the public insolvency register. The controller, a credit ranking agency, continued to process and store personal data of the data subject that related to his debt settlement procedure that the controller obtained from the public insolvency register. The purpose of the procesing was to assess the creditworthiness of the data subject and his company. The data subject was the company's sole shareholder. The data subject requested the erasure of his personal data on 4 May 2018, after fulfilling his debt payment plan. The controller did not reply. On 24 October 2018, the data subject lodged a complaint at the Austrian DPA against the controller for the infringement of the right to erasure under Article 17 GDPR. The controller informed the DPA by letter the same day that it would not comply with this request. The DPA dismissed the data protection complaint. The decision does not give detail on why the complaint was dismissed. The data subject appealed this decision at the Federal Administrative Court (Bundesverwaltungsgericht, BVwG). The court dismissed the appeal. The court found that the controller’s processing the personal data in question was necessary, as the purpose of the processing was for making a forecast about the future payment behaviour of the data subject. The court found that the interests of the controller and its third parties outweighed the interests of the data subject The court concluded that the processing of data on historical insolvencies and payment defaults of the data subject was necessary and lawful and that the objections raised by the data subject could not justify his request for erasure. The data subject appealed to the decision before the Austrian Supreme Administrative Co
The data subject was a registered user of Twitter, operated by the parent company of the controller. The data subject posted on multiple occasions content that the controller removed on the same days. On 13 February 2022, the controller deactivated the data subject's account and notified them. The data subject sought legal redress, and the LG Köln ordered the controller to fully restore the profile, provide information on whether the deactivation had been undertaken by a third-party company, and cover the data subject's legal costs. The court rejected the data subject's additional requests for data correction, prevention of further account blocking, and damages of €1,500. The data subject appealed, seeking these rejected requests. The controller, however, withdrew its appeal. The Higher Regional Court of Cologne dismissed the data subject's appeal. First, the court held that the data subject's request to delete all deletion and blocking notes from their user data record did not establish a valid deletion claim under Article 17 GDPR#1 as the upcoming legal processes made the data necessary for the defence of legal claims Article 17 GDPR#3e. The court found that the controller's documentation of violations against its terms did not entitle the data subject to a correction claim under Article 16 GDPR. The statements on the deletion counter were not factual inaccuracies but legal assessments. Thus, the claim for correction rights according to Article 16 GDPR did not apply. Third, the court examined the request to prevent future account blocks without prior notification and found it excessively broad. Certain scenarios, such as blocking for unlawful content, permitted the controller's immediate action under legal compliance obligations. Therefore, this claim was unreasonable. astly, the court dismissed the request for damages, as the appeal did not present a clear basis for differentiating claimed material and immaterial damages (€1,500 total), which contravened proce
CEE Projekte Verwaltung GmbH
The data subject is managing director of CEE Projekte Verwaltung GmbH, has been listed in the commercial register with their date of birth and residence since September 2012. In 2022, the data subject requested the deletion of their date of birth and residence from the commercial register, citing safety concerns due to their professional involvement with explosives, which could make them a target for kidnapping or robbery. The request was denied by the local court. Subsequently, the data subject appealed this decision, additionally requesting that the transmission of their personal data from the commercial register to third parties only occur after a balancing of interests. The appeal was rejected by the OLG Celle. The data subject then filed a legal complaint with the German Federal Court of Justice, which also upheld the previous decisions, insisting on the necessity of these data being included in the commercial register. The German Federal Court of Justice upheld all lower court's decision, determining that the controller had no right to the deletion of their date of birth and residence from the commercial register under Article 17(1) GDPR. The court ruled that the inclusion of this information is crucial for fulfilling a legal obligation of the register court under both union and national law. First, the court concluded that the data processing was mandated by law, rendering Article 17(3)(b) GDPR applicable, which permits data processing necessary for compliance with a legal obligation. Second, the court found that the data subject's objections under Article 21(1) GDPR were invalid when the data processing is based on Article 6(1)(c) GDPR, necessitated by a legal duty imposed on the controller. Lastly, the court noted that no restriction on processing could be requested under Article 18(1)(d) GDPR, as the data processing was lawful and essential for the register's public function. Hence, the Federal Court of Justice ruled that the residence and the date of
Court case W252 2247042-1
The controller, an Public Employment Service Austria, processed the personal data of the data subject in connection with his file. On 21 February 2019, 15 March 2019 and 25 November 2020, the data subject sent access requests to the controller by fax, each time explicitly insisting on delivery of the response by registered post, addressed personally and refusing delivery by email. With the November 2020 request, he also sent a blank DVD-R by post, asking the controller to copy the data onto it. The controller responded to each request with a printed access response sent by registered letter, the responses were substantially identical and the DVD-R was returned unused. The controller's usual practice is to provide access electronically through an online account. The access responses included the data subject's basic data, insurance and benefit periods and a chronological log of case notes "Informationen/Gesprächsnotizen/Vermerke", which listed attachments where relevant but did not include copies of entire documents. The data subject was aware of the content of the documents listed as attachments, since he himself had submitted them to the controller. None of the three responses referred to a specific case note dated 17 October 2018, recording a phone call between the controller and the data subject's family doctor about his health. The data subject repeatedly and specifically requested this note. The controller only produced it during the proceedings before the Federal Administrative Court, in a submission of 29 June 2023, which the Court forwarded to the data subject in July 2023. The data subject lodged a complaint with the Austrian DPA in February 2020, arguing that the access provided was deficient because copies of documents were missing, unexplained abbreviations were used, the response was not delivered in a common electronic format and it contained incorrect data. The DPA partially upheld the complaint (ordering the controller to explain certain abbreviations) but rejected the remainder, holding that the right of access does not include a right to copies of documents. The data subject appealed only the rejecting part of the DPA's decision to the Federal Administrative Court. First, the court held that the data subject was entitled, in the specific circumstances, to receive a copy of the case note of 17 October 2018. Citing CJEU case-law, the court noted that "personal data" must be interpreted broadly and that a "copy" means a faithful reproduction, not a mere general description or reference to categories of data. Because the data subject had specifically identified and requested this particular note as early as February 2019, the controller's asserted practice of a staged, multi-step access process could not be relied on to justify withholding it. However, the court held that this part of the complaint became moot once the controller supplied the missing note during the court proceedings, since the data subject's interest in access was thereby satisfied, even though the note reached him via the court rather than directly from the controller. Referring to national case-law, the court noted that there is no separate right to a formal declaration that a past infringement of the right of access occurred, once the substantive right has been satisfied. It also stated that any dispute about the accuracy of the date shown on the note was a matter for the right to rectification, not the right of access. Second, the court held that the right of access does not, in general, entitle a data subject to copies of entire documents or file attachments. Reproduction of extracts or whole documents is only necessary where needed to make the disclosed personal data intelligible. Since the data subject already knew the content of the referenced attachments (he had submitted them himself and had annotated copies of the responses identifying their content), the court held that further disclosure of the attachments was not necessary for comprehensibility and the access already given was complete. Third, the court rejected the data subject's argument that the access responses should have been delivered in a "common electronic format." While the GDPR provides that a request submitted electronically should, in principle, be answered electronically unless the data subject indicates otherwise, the court held that the data subject himself had explicitly and repeatedly requested delivery by registered post rather than email and this constituted "otherwise" within the meaning of that provision. The court also held that there is no obligation on a controller to use a physical data carrier (such as the data subject's own DVD-R) to provide access. It rejected the argument that paper delivery was designed to prevent the data being machine-searchable, noting that the right of access, unlike the right to data portability, does not guarantee a right to further processing of the data. The appeal was dismissed and the court declared that an appeal on points of law (Revision) was not admissible, since the relevant questions were already settled by existing CJEU and national supreme administrative court case-law.
Court case W252 2246156-1
On 9 April 2020, the data subject sent an access request to the controller, the legal representative of the data subject's former landlord. The controller provided the data subject with information about their personal data that was processed and about a rental agreement and communications between the data subject and their landlord, without providing copies of these to the data subject. On 11 May 2020, the data subject lodged a complaint with the Austrian DPA ("Datenschutzbehörde"), arguing that the controller violated their right of access by providing incomplete information. In particular, documents like their rental agreement and email correspondence were missing. On 22 July 2021, the DPA dismissed the complaint, stating that the right of access does not include providing entire documents. On 30 August 2021, the data subject appealed the DPA's decision at the Federal Administrative Court ("Bundesverwaltungsgericht"), claiming the controller did not provide all information about the origin of the data and did not provide copies of certain documents. Copies of documents like land register and company register extracts, as well as various correspondence between the data subject, the controller and the data subject's former landlord were still missing. On 13 July 2023, the controller provided the additional information on the land register and company register extracts. Regarding the origin of the data The court found that the data subject's argument was vague and that the controller explained the sources of the individual data in a transparent way. There is thus no violation of right of access under Article 15(1)(g) GDPR as the origin of all the relevant data was clear. Regarding the land register extract of property and the commercial register extract The court took into account [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=2&Paragraf=24&Anlage=&Uebergangsrecht= Section 24(6) of the Austrian data prote
LM
The statute of a company was changed by a natural person who was the majority shareholder. As a consequence of the changes, some personal data of him and the other company's partners were wrongly included. Among such data, there were names, monetary amounts and bank account details. As per national law, the new articles were prepared by the notary of the majority shareholder, and sent to the the registry of the court (Companies Court) and then forwarded by the court to the Office of the Moniteur belge for publication. After the publication, the notary, having realised the mistake, was authorised to request the deletion of the above sensitive data on behalf of the data subject (the majority shareholder) under Article 17 GDPR. The Moniteur Belge refused and the data subject filed a complaint with the Belgian DPA. The Belgian DPA reprimanded the Moniteur Belge and ordered them to comply with the erasure request within 30 days. The Belgian State appealed this decision to the Brussels Court of Appeal seeking an annulment of the DPA's decision. Specifically, they argued that it was uncertain whether the Moniteur Belge was a controller as per Article 4(7) GDPR. The passage had been processed by several 'successive controllers' (the notary who drew up the extract, the registry of the Court and the Moniteur Belge, who published the extract as it stood due to national law requirements). Moreover, since the parties did not claim joint controllership, it was also uncertain whether the Moniteur Belge was solely responsible for compliance with the GDPR. With this in mind, the court referred two questions to the CJEU: 1) Does Article 4(7) GDPR mean that a Member State's official journal, responsible for publishing official documents under national law (such as the one in the case), has the status of a data controller? 2) If so, does Article 5(2) GDPR mean that only that journal in question need to comply with the data controller's responsibilities? Or are the responsibilities incumbent cumulatively on each successive controller? First, the CJEU held that the journal (the Moniteur belge) was a data controller as defined by Article 4(7) GDPR. Second, unless joint responsibilities arise, they are solely responsible for compliance under the principle of accountability arising out of Article 5(2) GDPR. On the first question: Article 4(7) GDPR defines a controller as the: natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. (Underline emphasis added). As this case involved national law, the Court used the second part of Article 4(7) (underlined) to determine whether the Moniteur belge was a controller. In doing so, it looked at whether Belgian national law determined a controller. Moniteur belge is not explicitly vested by national law with the power to determine the purposes and means of data processing operations. However, the Court determined that national law implicitly did so and that this was sufficient to make the Moniteur belge a controller under Article 4(7) GDPR. The Court justified this broadened scope by stating that definition of controller must be read broadly to determine effective and complete protection of data subjects (see C‑131/12 Google Spain). To be implicitly a controller under national law, three positive criteria must be fulfilled: 1) There must be no apparent designation of powers under national law. In this case, not only was the Moniteur belge under national legislation not vested with explicit powers to determine the purpose and means of processing, but neither was the public entity in charge of it (FPS Justice). 2) The law must implicitly determine the purpose of the controller's processing. In this case, Moniteur belge's role under national law is to publish the documents as received from the companies court. This publication serves the purpose of informing the public of the existence of those acts as to make them enforceable against third parties. 3) The law must implicitly determine the means of the controller's processing. In this case, Moniteur belge's must publish these cases to the public. The processing is therefore performed by automated means. Both a paper and electronic copy is produced for citizens to access. The Moniteur belge, therefore, fulfilled the criteria needed to be an implicit controller under Belgian national law. Nonetheless, the court went further to identify two factors that do not exclude an entity from being an implicit controller under national law: 1) The entity in question does not need to have legal personality. This is because the wording of Article 4(7) GDPR makes it clear that a controller can be a natural person as well as a public authority. These do not have legal personalities, meaning that this is not a limiting factor when determining implied controllership. 2) The entity in question does not need to check the data before publishing it. This is because the Moniteur belge, under national law, is confined to the role of publishing the data as it stands.This is the case in many civil law countries where laws, company constitutions etc. are often published automatically. If Article 4(7) would be applied literally, it would contradict its objective and exclude Moniteur belge as a controller simply because it cannot exercise control over the personal data contained in its publications. Ex-post control and discretion over the content of the data is, therefore, not essential for implied controllership. On the second question: The Court determined that the Moniteur belge is classified as a controller within the meaning of Article 4(7) GDPR. Article 5(2) limits the principle of accountability to the controller. In this case, the Moniteur belge is solely responsible for compliance with the GDPR as Belgian law has implicitly designated only it as the controller. The court, however, went further and applied the concepts it developed in the first question to joint controllers. National law can determine/nominate a sole controller under Article 4(7) GDPR. The Court utilised this reasoning to point out that national law can likewise determine a chain of processing operations involving numerous joint controllers. This interpretation is supported by Article 26(1) GDPR which states that joint controllers must arrange their responsibilities unless national law determines this for them. This is also supported by case law C‑683/21 Nacionalinis visuomenės sveikatos centras where the arrangement between various controllers was determined by national law and it was held that joint controllership does not require each responsible entity to have access to the personal data concerned. The combination of Article 4(7) and 26(1), therefore, means that national law can determine joint controllers. Since (as reasoned above) the concept of controllership can be implicitly determined, this also means that national law can also implicitly determine joint controllers. The court noted that when this is the case, Article 5(2) GDPR will apply and make all controllers jointly responsible for compliance with the GDPR. However, whether joint controllership is implied by national law is for national courts to determine. Therefore, in its answer, the CJEU sent the question back to the referring court. Should they determine that there is no implied joint controllership, the Moniteur belge will be solely responsible for compliance with the GDPR under Article 5(2) GDPR.
Court case W258 2243523-1/9E
A real estate development company, the controller, contacted an owner of real estate, the data subject, asking her whether she would be interested in selling her property. The data subject claimed to have requested deletion of her personal data under Article 17 GDPR but kept receiving messages from the controller thereafter. Thus, on 26 April 2020, the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde, DSB). In its submissions, the controller argued that it obtains data about real estate properties on sale by requesting access to the land registry of property addresses and it processes personal data according to Article 6(1)(f) GDPR. Further, the controller stated that it nonetheless complied with the deletion request as it pseudonymised the data of the data subject and added a note next to the address of her property that it should no longer be consulted in the land registry. The DSB held that the controller did violate the data subject’s right to deletion as it failed to fully erase her personal data. First, according to the DSB, the interests of the data subject outweighed those of the controller and that it was still possible to identify the data subject using the address of her property. The controller decided to appeal the DSB’s decision on 14 May 2021 to the Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG), claiming that the DSB failed to properly assess the case. The controller submitted that it deleted the data of the data subject when she requested it and then her data mistakenly reappeared in her database, which is why she was contacted again by the controller. However, the controller remedied this by pseudonymising her data. Hence, the DSB should have differentiated between the two processing activities: the data subject only requested deletion of her data with respect to the first set of processing activities. As regards the second set of processing activities, the data subject never asked for erasure.
Austrian Data Protection Authority
The controller, the Public Employment Service in Austria, supports workers in (re)integrating into the labour market by offering various services, including a counsellor that discusses labour market opportunities with the jobseeker. In order to assess the jobseeker’s labour opportunities on the market, the controller used an algorithm to calculate the degree of probability for jobseekers to be employed for a certain number of days, based on: (1) age group, (2) gender, (3) country group, (4) education, (5) health impairment, (6) care responsibilities, (7) occupational group, (8) career history and (9) the regional labour market situation and the duration of cases at the controller. The algorithm did not include motivation, self-help potential of the jobseeker, addiction, debt or housing situation. Based on this, the algorithm divided jobseekers into the following three groups: (1) Service jobseekers with high labour market opportunities, (2) Care jobseekers with low labour market opportunities, (3) Consultancy jobseekers with medium labour market opportunities. The result was used as a starting point for counsellors to work with jobseekers to assess their potential and any obstacles in the labour market integration. The algorithm itself was not used for job placement, but only for targeted support and assistance, meaning, choosing the right support strategy based on which group the jobseeker was assigned to. The controller claimed it had a legal basis under Austrian national law (the Arbeitsmarktservicegezetz, AMSG) to process data with the help of an algorithm. Under Article 4(4) GDPR, this processing of data is considered profiling. According to Austrian data protection law (see [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563 Article 1 §2 DSG]), processing for the performance of a public task needs to be authorised in Asutrian law. However, the DPA found that a legal basis for this processing could not be found in the AMSG. The DPA also held that the case at issue was a case of automated individual decision-making under Article 22 GDPR. Although the results of the algorithm were not binding, as the final decision lies with the counsellor, the DPA noted that it could be ruled out that in individual cases, the decision will be based exclusively on profiling. Therefore, the Austrian Data Protection Authority (DSB) issued a ban due to lack of a sufficient legal basis for the processing. The controller appealed this decision at the Federal Administrative Court (Bundesverwaltungsgerichts, BVwG). The Federal Administrative Court upheld the controller’s appeal against the decision of the DPA. The Court held that the controller is allowed to carry out this processing of personal data in accordance with national law ( [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008905&Artikel=&Paragraf=25&Anlage=&Uebergangsrecht= §25(1) AMSG ]) and therefore has a legal basis. Moreover, Article 22 GDPR does not apply, as the final decision lies with the counsellors and therefore the decision-making is not based solely on automated processing. However, the Court held that the controller should provide counsellors with instructions and training to ensure they do not accept the result of the algorithm unquestioningly. The Court concluded that the DPA decision should be annulled due to the lack of violation of the principle of lawful data processing under Article 5(1)(a) GDPR. The DPA appealed the decision before the Supreme Administrative Court (Verwaltungsgerichtshof, VwGH). The DPA argued that the Federal Administrative Court did not take into account the character of profiling as a special processing procedure and challenged the lawfulness of the processing under Article 22 GDPR. The Supreme Administrative Court found that the lawfulness of the data processing at issue in the proceeding must be examined against the background of Article 22 GDPR. The Court found that the controller’s algorithmic process in itself is an automated decision under Article 22(1) GDPR, based on the recent CJEU decision C-634/21 - Schufa. The Court explained that the algorithm decided on the allocation of jobseeker’s group and thus has a legal effect on the jobseekers concerned or similarly significantly affects them. The fact that the final decision on the jobseeker’s group assignment lies with the counsellor, does not prevent the algorithm from being classified as an automated decision under Article 22(1) GDPR. The Supreme Administrative Court found that the instructions and trainings that were provided to ensure counsellors would not accept the algorithm’s results unquestioningly could not exclude the possibility that the algorithm is ultimately decisive for the allocation. The Court further held that the algorithm did not fall under the exceptions of Article 22(2) GDPR. Therefore, the Court concluded that the appeal had to be upheld and that the decision of the Federal Administrative Court needed to be set aside, de facto confirming the violations identified by the DPA.
Public Employment Service Austria (respondent in the initial trial before the DSB)
The Public Employment Service (AMS) is a service provider under public law with its own legal personality, which is responsible for implementing the labour market policy of the federal government. In order to support workers in their (re-)integration into the labour market, it offers various services which are implemented by its counsellors. In order to support counsellors in assessing the labour market opportunities of jobseekers, the AMS has developed a concept for calculating the labour market opportunities of jobseekers (AMAS). In concrete terms, AMAS uses an algorithm to automatically calculate the probability of currently registered customers being employed for a certain number of days within a certain period in the future. For this purpose, a so-called IC is calculated from the following data: age group, sex, Group of States, Education, Health impairment, Caring duties, professional group, pre-career, Regional labour market performance, Duration of the business case at the AMS. Based on the calculated IC, a classification is made into the following groups: Service clients with high labour market opportunities, care clients with low labour market opportunities, Counselling clients with medium labour market opportunities. The results of the AMAS ought to be used in the guidance process and be a starting point for the counsellors to determine, together with the client, the optimal support strategy (subsidies and support services). The final decision on the assignment to a client group is always made by the counsellors. Originally, the Data Protection Authority (DSB) initiated an ex officio investigation into the matter and concluded that, the AMS was prohibited from processing data with the help of the AMAS with effect from 1 January 2021, unless there is a suitable legal basis for the data processing. In the contested decision, the Austrian Federal Administrative Court held that the Public Employment Service could lawfully process personal data belonging to jobseekers according to Article 9(2)(g) GDPR as this was necessary in order to guarantee a well-functioning labour market and outlined in Austrian law. The automated processing of the personal data of the jobseekers concerned (in AMAS) based on a mathematical-statistical program falls under the definition of "profiling" according to Art. 4(4) GDPR in accordance with the case law of the CJEU in C-634/21. The automatied processing - in this case the determination a value, which determines the probability of integration into the labor market - is itself (already) to be regarded as an "automated decision" within the meaning of Art. 22 para. 1 GDPR, provided that this value significantly determines the allocation to one of the groups and thus has a legal effect on the jobseekers concerned or significantly affects them in a similar way. The fact, that the final decision on the group assignment of the jobseekers lies with the employees of the Public Employment Service, does not necessarily prevent the algorithm (AMAS) from being qualified as an automated decision within the meaning of Art. 22(1) GDPR [they could, indeed, still draw strongly upon the calculated value]. The fact that the employees undergo training and follow instructions to ensure they do not accept the result of the algorithm without questioning does not exclude the possibility that AMAS - as an automated decision - is ultimately decisive for this classification. The previous instance court will thus have to investigate the exact use of the value calculated with AMAS, in particular which other parameters are taken into account and to what extent, or which procedure is envisaged for the utilization of AMAS. If the use of AMAS falls under the scope of Art. 22(1) GDPR (as will have to be decided by the previous instance court), it would be prohibited unless one of the exceptions listed in Art. 22(2) GDPR applies and the special requirements of Art. 22(3) and (4) GDPR are met.
The data subject had a Facebook account since 2008. On 16 May 2018, nude images were uploaded to data subject’s account. The controller (“Facebook”) temporarily blocked the data subject’s account. The account was unblocked the same day. On 28 November 2021, the data subject posted a video of an artist on his Facebook profile. The controller deleted the video and after review, reactivated the account. On 23 December 2021, images or videos of child sexual abuse were published by third parties via the data subject’s account. The controller blocked the data subject’s account again. The data subject tried to persuade the controller to reopen their account, but failed. On 17 January 2023, the data subject contacted the controller with a letter from a lawyer, requesting the controller to restore their account and asserted claims for, amongst others, information and correcting their data. A few days later, the data subject regained access to their account. The data subject then went to the Regional Court (“LG Stuttgart”) to request correction of all the data subject’s data by deleting all deletion and blocking notices under Article 16 GDPR and Article 17 GDPR. The data subject argued that the controller no longer needed the user data relating to the deletion and blocking processes. The controller argued that the question of the lawfulness of the reasons behind the blocking notices was only a value judgement that is not subject to rectification and that the blocking notices were still needed for quality assurance and legal defence. The Regional Court dismissed the case. There was no claim for deletion, because according to the Court, incorrect data would not be stored by the controller. It only stored documentation on what had occurred, such as when the data subject was blocked on the controller’s platform. According to the findings of the Regional Court, a reset of the offences counter was also ruled out, as all offences expired after one year and were therefore no long
Schufa
A data subject was refused a loan after Schufa (the controller) had provided the data subject’s bank with a negative credit score. Schufa is a credit agency which provides third parties with information relating to individuals’ creditworthiness. The data subject requested Schufa to provide them with information relating to the data stored and to erase incorrect entries relating to them. As well as, to provide them with a detailed account of the logic involved in the determination of their credit score, and the significance and consequences of the processing of their data. Schufa responded by only providing the applicant with their credit score and a vague outline of its credit-score calculation process, noting that they were unable to disclose a detailed account of the calculation process as this would violate commercial secrecy. Moreover, Schufa noted that it only provided third parties with information which they used to reach decisions, while Schufa itself was not the party to determine the decisions. Following this, on 18 October 2018, the data subject filed a complaint against Schufa with the Hessian Commissioner for Data Protection (‘HBDI’), requesting that they order Schufa to disclose the logic involved in the determination of their credit score, and the significance and consequences of the processing of their data. On 3 June 2020, the HBDI dismissed the complaint, holding that Schufa’s processing was compliant with domestic law.[https://dejure.org/gesetze/BDSG/31.html §31 of the Bundesdatenschutzgesetz]. The data subject then appealed to the Administrative Court of Wiesbaden, under Article 78(1) GDPR. The Court stayed the proceedings and referred two questions to the CJEU. Only the first question is of relevance, as the CJEU did not consider the second. # Is a credit score issued by one party a decision for the purposes of Article 22(1) GDPR, where a third party draws strongly on that credit score to reach a decision? The Court held that a credit score is a decision for the purposes of Article 22(1) GDPR, where a third party ‘draws strongly’ on it to reach a decision. Article 22(1) GDPR provides that ‘the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.’ In interpreting Article 22(1) GDPR, the Court held that it imposes three cumulative conditions for its application:Para 43. # There must be a decision; # The decision must be based solely on automated processing, including profiling; # The decision must produce legal effects concerning the data subject, or similarly significantly affect them. In relation to the fulfilment of these three conditions, the Court found that they can be met at different times and by different parties, noting that criterion (3) will be fulfilled,The decision must produce a legal effect or similarly significantly affect the data subject. where an action taken by a third party ‘draws strongly’ on a probability value issued by the controller.Para 73. In reaching this conclusion, the Court held that ‘there would be a risk of circumventing Article 22 of the GDPR and, consequently, a lacuna in legal protection if a restrictive interpretation of that provision was retained, according to which the establishment of the probability value must only be considered as a preparatory act and only the act adopted by the third party can, where appropriate, be classified as a ‘decision’ within the meaning of Article 22(1) of that regulation.’Para 61. Moreover, the Court addressed the relationship between Article 22(2)(b) GDPR and national law. Article 22(2)(b) GDPR provides that Article 22(1) GDPR does not apply if a decision is ‘authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests’. The Court noted that it is for national courts to determine whether national law is compatible with Article 22(2)(b) GDPR. However, the Court emphasised that Member States cannot adopt regulations under Article 22(2)(b) if these disregard the principles under Article 5 and 6 GDPR and the safeguards under Article 22 GDPR.Para 68. If a national court were to find that national law is incompatible with Article 22(2)(b) GDPR, then the general prohibition against automated decision-making under Article 22(1) GDPR would apply and the controller’s processing activities would be in violation of the GDPR.
UF (data subject and claimant before national court)
The data subjects UF and AB underwent insolvency proceeding in Germany and were granted an early discharge from remaining debts by court decisions of 17 December 2020 and 23 March 2021 respectively. In accordance with § 9(1) Insolvenzordnung (Insolvency Code) and § 3(1)(2) InsBekV (Regulation on public notifications in insolvency proceedings on the internet), the official publication of these decisions on the debt discharges in the German insolvency register was erased after 6 months. SCHUFA Holding AG (SCHUFA), a German credit information agency had recorded these decisions on debt discharges in their own data bases and intended to store it for three years after registration, in accordance with a code of conduct under Article 40 GDPR approved by the competent DPA. UF and AB requested SCHUFA to erase the (no longer public) decisions on the debt discharges. SCHUFA refused and UF and AB lodged complaints with the Hessian DPA (HBDI) under Article 77 GDPR. The HBDI dismissed the complaints, finding SCHUFA's processing lawful. UF and AB each brought an action under Article 78 GDPR against the HBDI's decisions before the Verwaltungsgericht Wiesbaden (VG Wiesbaden), arguing that the HBDI was obliged to take measures in respect of SCHUFA to enforce the erasure of the entries concerning them. The HBDI requested the dismissal of the actions, arguing that Article 77(1) GDPR constitutes a mere "right of petition". Hence the VG Wiesbaden could only review whether the HBDI handled the complaints and informed the complainants of their progress and outcome but not review the substantive correctness of the decisions. On UF's and AB's requests for erasure, the HBDI argued that SCHUFA could store the decisions on debt discharges for as long as is necessary for the purpose of processing (i.e. assessing the creditworthiness of UF and AB) and that the storage period of three years after entry in the file according to the code of conduct should apply. The VG Wiesbaden doubted the HBDI’s line of argument and referred the following questions to the CJEU under Article 267 TFEU: (1) Is Article 77(1) of [the GDPR], read in conjunction with Article 78(1) thereof, to be understood as meaning that the outcome that the supervisory authority reaches and notifies to the data subject: – has the character of a decision on a petition? This would mean that judicial review of a decision on a complaint taken by a supervisory authority in accordance with Article 78(1) of that regulation is, in principle, limited to the question of whether the authority has handled the complaint, investigated the subject matter of the complaint to the extent appropriate and informed the complainant of the outcome of the investigation, or – is to be understood as a decision on the merits taken by a public authority? This would mean that a decision on a complaint taken by a supervisory authority would be subject to a full substantive review by the court in accordance with Article 78(1) of that regulation, whereby, in individual cases – for example where discretion is reduced to zero – the supervisory authority may also be obliged by the court to take a specific measure within the meaning of Article 58 of that same regulation? (2) Is the storage of data at a private credit information agency, where personal data from a public register, such as the “national databases” within the meaning of Article 79(4) and (5) of Regulation [2015/848] are stored without a specific reason in order to be able to provide information in the event of a request, compatible with Articles 7 and 8 of the [Charter]? (3) (a) Are private databases (in particular databases of a credit information agency) which exist in parallel with, and are set up in addition to, the State databases and in which the data from the latter (in casu, insolvency announcements) are stored for longer than the period provided for within the narrow framework of Regulation 2015/848, read in conjunction with the national law, permissible in principle? (b) If Question 3a is answered in the affirmative, does it follow from the “right to be forgotten” under Article 17(1)(d) of [the GDPR] that such data must be deleted where the processing period provided for in respect of the public register has expired? (4) In so far as point (f) of [the first subparagraph of] Article 6(1) of [the GDPR] enters into consideration as the sole legal basis for the storage of data at private credit information agencies with regard to data also stored in public registers, is a credit information agency already to be regarded as pursuing a legitimate interest in the case where it imports data from the public register without a specific reason so that those data are then available in the event of a request? (5) Is it permissible for codes of conduct which have been approved by the supervisory authorities in accordance with Article 40 of [the GDPR], and which provide for time limits for review and erasure that exceed the retention periods for public registers, to suspend the balancing of interests prescribed under point (f) of [the first subparagraph of] Article 6(1) of that regulation? Regarding question 1, AG Pikamäe suggested to interpret Article 78(1) GDPR as meaning that under that provision a legally binding decision of a supervisory authority is subject to a full substantive judicial review. The AG emphasized that a complaint procedure under Article 77 GDPR cannot be viewed in the same way as a petition. As for the questions 2 to 5, the AG suggested (i) to interpret Article 6(1)(f) GDPR meaning that it precludes the storage by a private credit information agency of personal data from a public register on insolvency proceedings for a period beyond that for which the data are stored in the public register, (ii) to interpret Article 17(1)(d) GDPR as meaning that the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where those data have been unlawfully processed in accordance with Article 6(1) GDPR and (iii) to interpret Article 17(1)(c) GDPR as meaning that the data subject has, in principle, the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where he or she objects to the processing pursuant to Article 21(1) GDPR. It is for the referring court to examine if, exceptionally, there are overriding legitimate grounds for the processing. The CJEU followed the AG's opinion almost entirely. On question 1, the CJEU held that under Article 78(1) GDPR a court reviewing a DPA decision in a complaint procedure under Article 77 GDPR should exercise full jurisdiction, examine all questions of fact and law relevant to the dispute. For a judicial remedy to be effective, a DPA decision must be subject to full judicial review. As the CJEU clarified, a compliant procedure under Article 77 GDPR is not similar to that of a petition but designed a mechanism capable of effectively safeguarding the rights and interests of data subjects. Hence, a DPA must deal with a complaint with all due diligence and is required to react appropriately in order to remedy GDPR violations. The CJEU emphasized that the interpretation of the HBDI that a court could only assess a) whether the DPA has investigated a complaint to the extent appropriate and b) whether a complainant has been informed of outcome of the investigation would compromise the objectives of GDPR. The CJEU added that a DPA assessing a complaint has a margin of discretion as to the choice of appropriate and necessary means. On questions 2 to 5, the CJEU first referred to its reasoning in Meta Platforms and Others (General terms of use of a social network), C‑252/21 on the concept of legitimate interest under Article 6(1)(f) GDPR, emphasizing that said provision lays down three cumulative conditions for the processing of personal data to be lawful (first, the pursuit of a legitimate interest by the data controller or by a third party; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, that the interests or freedoms and fundamental rights of the person concerned by the data protection do not take precedence). The CJEU then held that it is for the referring VG Wiesbaden to ascertain whether the storage of the data at issue by SCHUFA in its own databases meets these requirements for the period during which the data are made available to the public. Regarding the storing of decisions on debt discharges beyond their public availability, the CJEU held that this processing constitutes a serious interference with the fundamental rights of the data subject, enshrined in Articles 7 and 8 of the Charter. The longer the data are stored with the credit information agency, the greater the requirements relating to the lawfulness of the storage of that information. Article 79 Regulation(EU) 2015/848 on insolvency proceedings leaves it to the Member States to limit the public availability of data stored in insolvency registers, in accordance with the GDPR. German legislature provides that information on debt discharges is kept in the insolvency register for only six months. The CJEU reasoned that the discharge from remaining debts in an insolvency proceeding is intended to allow the person who benefits from it to re-enter economic life. Hence, credit information agencies jeopardize this intention when they retain data on such debt discharges beyond their public availability and consider it a negative factor when assessing the persons creditworthiness. In those circumstances, the retention of decisions on debt discharges beyond their public availability cannot be based on Article 6(1)(f) GDPR. The CJEU also held that that the conditions for the lawfulness of the processing of personal data laid down by a code of conduct under Article 40 GDPR cannot differ from the conditions laid down in Article 6(1) of the GDPR. Consequently, a code of conduct cannot be taken into account in the balance of interests under Article 6(1)(f) GDPR. On the erasure obligations under Article 17 GDPR, the CJEU held that under Article 17(1)(d) GDPR SCHUFA will be under the obligation to erase data on decisions on debts discharges stored beyond the six-month period for which the data are kept in the public insolvency register, because the data would be unlawfully processed. Lastly, the CJEU held that under Article 17(1)(c) GDPR data subject enjoys a right to object to processing and a right to erasure, unless there are overriding legitimate grounds which take precedence over the interests and rights and freedoms of that person within the meaning of Article 21(1) GDPR, which it is for the controller to demonstrate and, in the current case, for the VG Wiesbaden to examine.
Postbeamtenkrankenkasse (PBeaKK, German Postal Civil Servants’ Health Insurance Fund)
The data subject was a civil servant for one of the companies (Bundesanstalt für Post und Telekommunikation (BAPT)) the controller manages the employee's health insurance benefits of. On 13 June 2018, the data subject sent a telefax to the controller, looking to exercise their Article 15 GDPR right to obtain from the controller a confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data in a detailed list. The controller responded on 2 July 2018, covering all aspects of Article 15 GDPR (a)-(h) in a one page document containing name, address, birth date, employee ID, tax ID, bank information, type of insurance, beginning of insurance as well as which group and pay scale. It also contained a general listing of billing documents and digitized receipts and outgoing mail since 2007. The data subject was not satisfied with this response, criticizing the lack of health data, missing information about the health reimbursement record for civil servants (Beihilfeakte), and an incorrect phone number. The controller replied to the complaint on 1 August 2018, saying that the phone number was deleted and offering examples of health data in the form of past doctors the data subject frequented. The data subject was yet again not satisfied and filed a disciplinary complaint at a data protection authority as the disclosure was deemed incomplete. The controller referred to Article 23 GDPR in conjunction with § 34(1)(2)(a) German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG), stating they store approximately 3,000 documents, some with multiple pages, relating to the client due to the retention period of 10 years. It also claimed that the employer of the data subject has expressly reserved the right to respond to data requests based on Article 15 GDPR for themselves. The data subject kept repeatedly reaching out to the controller about its incomplete data inquiry, on 27 August 2018, 02