GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Court case W274 2251055-1/5E
In the original case before the Austrian DPA, the data subject filed a complaint, claiming that the controller (a bank) recorded their phone calls and there was no possibility to opt-out from such a processing. Clients were informed about the recording by a tape announcement at the beginning of the call. The controller justified the processing as a legitimate interest pursuant to Article 6(1)(f) GDPR, stating that recording was necessary to ensure the best service quality for clients. The controller also referred to their obligations under EU law, especially [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32014L0065 Directive 2014/65/EU (MiFID II)], and national banking laws, such as [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20010182 § 66(1) Payment Services Act] (Zahlungsdienstegesetz - ZaDiG) and [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20009943 § 33(2) and (3) Securities Supervision Act 2018] (Wertpapieraufsichtsgesetz 2018 - WAG). The DPA upheld the data subject's claim and issued a decision against the controller. The controller appealed this decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). To the arguments mentioned above, the controller added that that it was impossible not to record all incoming calls. Furthermore, the controller questioned the DPA's competence, as the case allegedly fell under the WAG and not the GDPR. The court rejected the controller's appeal. The court confirmed that the DPA was competent. The data subject's complaint was about their right to confidentiality of personal data. The infringement of Article 6(1) GDPR could lead to an infringement of [https://ris.bka.gv.at/geltendefassung.wxe?abfrage=bundesnormen&gesetzesnummer=10001597&tid=121676594&ShowPrintPreview=True § 1(1) Austrian Data Protection Act] (Datenschutzgesetz - DSG) which contains the fundamental right to data protection. The right t
VG Mainz
The controller was a company that allowed their employees to use the company vehicle. One of these cars was used to commit traffic offences. During the police investigation, it was not established which employee had driven the car at that time. Therefore, the competent administration asked the controller to disclose the identity of the driver. In addition, the administration ordered the controller to keep a log of their vehicles, the people to which they were provided and other details concerning the services offered by the controller. The legal basis for such an obligation can be found in the German traffic law. The controller refused to comply with the order and appealed it before a court. The controller argued that the GDPR precludes the disclosure of personal data of the driver(s) to the authorities and the keeping of a logbook with the drivers' names. The first instance court rejected the claim and the controller appealed the decision before the Higher Administrative Court of Rhineland-Palatinate (Oberverwaltungsgericht Rheinland-Pfalz, OVG Rheinland-Pfalz). The court of appeal upheld the first instance judgement. According to the court, both the disclosure of personal data of the drivers and the keeping of a log with personal data of the latter were permissable pursuant to Article 6(1)(f) GDPR. As a legal basis, the controller could (and should) rely on the protection of the legitimate interests of the authorities in fulfilling tasks incumbent upon them in the public interest, which include the prosecution of administrative offences. Moreover, the court observed how the further stages of the processing were also permissable from the public authority side under Article 6(1)(e) GDPR.
Court case W252 2248630-1
The data subject created an account with the controller in order to purchase goods online. In this context, they allegedly were forced to give consent to the processing of their personal data for the purpose of advertising. The data subject lodged a complaint with the Austrian DPA. The Austrian DPA declared the processing unlawful. The controller appealed the decision, arguing that the data subject was not actually "forced" to create a customer account to purchase the goods. As a matter of fact, they could have ordered the goods by using a so-called “guest” option, which would not imply any processing for advertising purposes. To the contrary, the creation of a customer account implies that a user wants to have access to discounts and be informed about offers concerning the controller's products. The court upheld the controller’s appeal. Pursuant to Article 4(11) GDPR, consent must be freely given. In light of Article 7(4) GDPR, this is clearly not the case when the conclusion of a contract is made dependent on the data subject’s consent, unless consent is necessary for the performance of the contract. Thus, the court checked the nature of the contract in the case at issue. The court found that it was not possible to separate the creation of an account with the controller from the purchase of goods online. Such an account did not exclusively serve the purpose of sharing offers and discounts with the data subject. The purchase of goods could rather be seen as the main object of the contract. For such a purpose consent to the processing of personal data for advertising was not necessary. The court then checked whether the guest option could be a valid alternative to achieve the object of the agreement. The court rejected the DPA’s argument that the guest option was no valid alternative to the creation of an account with regard to the purchase of online goods. The court acknowledged that the use of a guest option entails an additional effort for the user, namely the effort of filling the fields that are auto-filled for the holder of a customer account. However, such an effort was not disproportionate. In light of the above, the court overturned the DPA's decision and declared that consent to the processing was freely given.
Court case 5 BV 20.2104
Following several episodes of vandalism, the city council of Regensburg installed surveillance cameras in a communal garden where migrants and marginalised groups of people usually spent their time. The data subject, who usually passed through that area, asked the Administrative Court of Regensburg to order the police to stop recording and remove the cameras. The court of first instance held that the case at issue did not fall within the scope of Directive (EU) 2016/680 (Law Enforcement Directive), but rather of the GDPR. Indeed, the exception under Article 2(2)(d) GDPR did not apply, since the controller was not a law enforcement agency acting with the aim to protect public security. The court also found that the data subject could not rely on injunctive relief against the unlawful processing pursuant to the German Civil Code. According to the judges, Article 79(1) GDPR provides data subject with a legal remedy that is only applicable to violations of Articles 13-23 GDPR individually affecting the data subject. Finally, the court found that the monitoring was in any case lawful, as it was based on a public interest pursuant to Article 6(1)(e) GDPR, namely the protection of public property from vandalism. The data subject appealed the judgement before the Superior Administrative Court of Munich (Verwaltungsgerichtshof München). At the outset, the court clarified that the protection of public property by a municipality does not trigger Article 2(2)(d) GDPR, as it cannot be considered an activity carried out in the context of the fight against crime. Therefore, the GDPR – and not the Law Enforcement Directive – was applicable. The fact that such a purpose could partially overlap with the prevention of crime was not deemed sufficient by the court to rule out the applicability of the GDPR. However, the court of appeal stressed that Article 79 GDPR does not explicitly limit judicial remedies to the rights enshrined in Chapter III of the regulation. Therefore, an inj
Court case 2-24 O 156/21
The plaintiff in this case is a consumer protection organization under German law. The defendant is a German energy and gas provider, which, with a view to lowering the risk of payment defaults, is in a contractual relationship with SCHUFA Holding AG and another credit rating agency, hereinafter the credit agencies. This contract foresees that whenever an interested individual submits a request for conclusion of an energy provision contract on the online form of the defendant, the latter sends the basic information about the interested persons to the credit agencies, that calculate a credit score about them, and receives information on the economic risks related to those individuals. The plaintiff read the general terms and conditions on the webpage of the defendant and under “Data Protection, Creditworthiness information” – “Data Transmission to SCHUFA and other agency” which stated that the defendant transmits data collected in the request for conclusion, the implementation and termination of a contract and data about non-contractual behavior to the credit agencies, on the basis of Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. The plaintiff considered that the transmission of so-called “positive data” on the implementation and termination of a contract to be unlawful and directed this in a letter to the defendant in December 2020, asking the plaintiff to cease using those clauses. In its view, the transmission of such data was not justified by any of the legal bases of Article 6(1) GDPR. The plaintiff first filed a lawsuit with the Regional Court of Darmstadt, which concluded that it was not competent to deal with the case and referred it to the Regional Court of Frankfurt am Main (Landgericht Frankfurt am Main, LG). The plaintiff asked the court to order the defendant to cease and desist from any further violations and to refrain from using the contested clauses in its terms and conditions in consumer contracts for energy supply. In its submissions, the defendant argued that the claim should be dismissed, already because the plaintiff was not authorized to bring an action before a court and because the claim was unfounded. Further, the defendant argued that the content of the terms constituted a mere privacy notice, whose content is not binding. First of all, the court held, against the view of the defendant, that the plaintiff did have standing before the court as a consumer protection organization under [https://www.gesetze-im-internet.de/uklag/ §3(1)(1) the German UklaG], to bring a claim under Article 80(1) GDPR and Article 80(2) GDPR. Also, the court clarified, making reference to CJEU case C-319/20, that Article 80(2) GDPR does not presuppose the existence of a concrete violation of a data protection right, but it is sufficient that the processing in question could violate the rights of identified or identifiable data subjects - in this case, all those who concluded an energy contract with the defendant after 2019 by accepting the contested terms. Also, the court held that it suffices for the personal scope of Article 80(2) GDPR to be open, that a violation of consumer protection law, in this case the terms and conditions of the defendant, goes hand in hand with a violation of the GDPR. Hence, the court considered that all the requirements of Article 80(1) GDPR and Article 80(2) GDPR were met. As regards the content of the terms, the court first considered that the clauses in question constituted a concretization of the object of the contract, as clarified in another clause of the terms, so that the average consumer understood such clauses as a privacy policy and not as a mere notice, as submitted by the defendant. The court went on to ascertain whether the content of the clauses constituted a disproportionate disadvantage for consumers under the German Civil Code (Bürgerliches Gesetzbuch, BGB), which is given when a party deviates from a norm, protecting a consumer, in a significant way. In this, the court assessed whether the defendant had deviated from the obligation under Article 6(1) GDPR in a significant way, that is, whether the transmission of “positive” data to the credit agencies by the defendant could be based on Article 6(1)(b) GDPR or on Article 6(1)(f) GDPR. After clarifying that data regarding the implementation and termination of a contract cannot be considered “negative” data, thus not credit-relevant data, the court considered that the transmission of such data cannot be based on Article 6(1)(b) GDPR. As a matter of fact, the court could not ascertain how the transmission of such data to credit ranking agency would be necessary for the performance of an already concluded contract between the energy provider and a consumer. Further, the court considered whether processing for other purposes could be based on Article 6(1)(f) GDPR. To this end, the transmission of positive data would have to be necessary for the protection of a legitimate interest of the controller or a third party, insofar as the rights and interests of the data subject do not override them. In the case at hand, the court held that it cannot be excluded a priori that positive data about a person might be used for credit scoring purposes. However, the court clarified that it is up to the credit agency to prove to what extent such data are necessary for credit scoring, as per [https://www.gesetze-im-internet.de/bdsg_2018/ § 31 BDSG]. In the case at hand, the court held that first, the defendant failed to clearly define which data about the implementation and termination of a contract would be transmitted and also failed to provide reasons for the transmission of such data which also suggests that they might not even be used for calculating a credit score; secondly, the court observed that in any case, the interests and rights of the data subjects prevail over those of the defendant. This occurs when, for instance, the data subject cannot expect further processing of his or her data, as suggested in Recital 47 GDPR. Effectively, not knowing exactly which data is transmitted constitutes a significant interference in the right to informational self-determination of individuals and leaves them confused as to whether their data are going to be further processed or not. Thus, the court considered the contested clauses in the general terms and conditions of the defendant to be in violation of Article 6(1)(f) GDPR and unreasonable under the BGB. The court thus ordered the defendant to cease and desist from using the clauses in its terms and conditions in the context of consumer contracts.
Meta Platforms Ireland Ltd
The European Commission made information requests to Meta Platforms Ireland Ltd (Meta) on the implementation of the rules on competition laid down in Articles 101 and 102 TFEU. Following the requests, the Commission adopted a further decision under Article 18(3) of Regulation 1/2003 on the implementation of the rules on competition laid down in Articles 81 and 82 of the Treaty. Under the decision, the Commission requested Meta to provide, inter alia, a number of internal documents meeting certain cumulative criteria. With regard to providing the information, the Commission proposed a separate procedure for sensitive documents which, according to Meta, contained only personal information wholly unconnected with its commercial activities. Those documents would be examined first in a virtual data room and placed on the file only after having been deemed relevant for the investigation. Moreover, Meta had the possibility to redact documents containing personal information. Meta sought for the annulment of the decision before the General Court. Essentially, Meta relied on four pleas in law – of which one was Meta alleging, inter alia, infringements of the right to privacy. Meta claimed that, by requiring the production of numerous irrelevant documents of a private nature, the decision infringes, inter alia, its right to privacy and that of its staff and third parties, as protected by Article 7 of the Charter and Article 8 ECHR. Furthermore, Meta argued, inter alia, that the Commision’s interference is not provided for by law. Meta claimed that where it would be required to provide information, which Meta argued to be irrelevant for the purposes of the investigation, it would in fact contravene Article 6(1)(c) GDPR. The Commission contended that the Court should declare Meta’s head of claim inadmissible and dismiss the action. The Court examined whether the contested decision complies with Article 7 of the Charter and the conditions set out in Article 52(1) of the Charter. Article 52(1) of the Charter provides that any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the EU or the need to protect the rights and freedoms of others. According to the Court, Meta cannot question the fact that the limitation to the right to privacy would not be provided by law in this case: the Commission adopted its decision on the basis of Article 18(3) of Regulation 1/2003 on the implementation of the rules on competition laid down in Articles 81 and 82 of the Treaty which gives the Commission the power to adopt decisions requesting such information. Furthermore, in light of the principle of proportionality, the Court considered that the decision adopted by the Commission does meet the objectives of general interest recognised by the EU: the decision expressed the exercise of the Commission’s powers under the said regulation, which contributes to maintaining competition intended by the EU treaties, which the Court viewed businesses to have an absolute duty to comply with. After an exhaustive assessment in light of Article 52(1) of the Charter, the Court held that Meta had not established that the decision constituted an unjustified interference with its privacy or that of members of its staff or of other persons. The Court rejected Meta's claims in this regard.
Energie AG
In this particular case, the controller had made an unlawful entry regarding a debt of the data subject with Schufa - a German credit ranking system. As a result, the credit score value of the data subject was negatively impacted. The data subject received a letter informing him about the registration and requested the controller to remove the wrong registration. He claimed that due to this negative entry, among other damages, his mental health was affected and that he could not enter into a certain energy supply contract. Later, the entry was deleted. The data subject however considered that he suffered damages in the past and filed a complaint with the Regional Court of Magdeburg. He claimed that he suffered material and non material damages of a total amount of €10,000. The controller argued that this action constituted an abuse of rights. The Court recalled that under Article 82 (1) and (2) GDPR, any person who has suffered material or non-material damage as a result of a violation of the GDPR is entitled to compensation for damages from the person responsible for the damage caused by the processing that violates the GDPR. The Court considered the wrong entry as an unlawful processing and noted that the data subject successfully proved that they had suffered non-material damages, including the damages for the data subject's mental health. Consequently, the Court awarded €4,000 of damages to the data subject.
Court case 8 U 94/22
The plaintiff was a member of the defendant, a registered association with approximately 5,500 members, and requested that the association transferred a list containing the names, addresses and e-mail addresses of the association's members directly to them, i.e. without the involvement of a trustee. These data were necessary in preparation for the association's general meeting. The plaintiff's concern was to contact other members to organize opposition to the actions of the association's board. Following the general meeting, the plaintiff also intended to contact members in the same manner in order to initiate the calling of an extraordinary general meeting, pursuant to § 37(1) of the German Civil Code. After the Dortmund Regional Court denied the plaintiff's claim to transmission of the list of members, the plaintiff appealed to the Hamm Higher Regional Court (OLG Hamm). The court sustained the appeal. Interestingly, the court examined the dispute first from an association law perspective and then from a data protection perspective. National law (association law) First, the court stated that a claim requires a legitimate interest of the association member, which must not be outweighed by any secrecy interests of the association or legitimate interests of the association members in the context of a comprehensive weighing of interests in the individual case. The basic interest involved in this case, the organization of an opposition to the policy of the defendant's association board, must be considered as legitimate. This interest requires to get in contact with the other members also outside of the meeting of the members, for example in order to motivate these to participate in those meetings in the first place. In particular, the plaintiff had a legitimate interest in obtaining the e-mail addresses, since e-mail communication enables an almost free, direct, individualized exchange practically without time delay, but at the same time also asynchronous communicati
Court case 33 O 5976/22
The controller was a telecommunication company. In its contracts with the customers, the controller informed the latter that personal data, including “positive data”, could be transferred to the credit ranking agency SCHUFA. The controller and SCHUFA were in a mutually advantageous relationship: the former got reliable information to check potential customers’ creditworthiness, the latter improved its scoring system. According to the plaintiff, a consumer association, such data sharing violated Articles 5(1)(a) and 6 GDPR, as neither contract nor legitimate interest could be used as a legal basis for transmission of data to SCHUFA. Therefore, the consumer association asked a court to stop the disclosure of so-called “positive data” to SCHUFA. By "positive data" we refer to personal data that do not show any data subject’s negligence in the performance of the underlying contract with the telecommunication company. In response to the legal claim, the controller raised several points. Firstly, the association did not have legal standing, as it represented consumers and not data subjects. Secondly, the controller argued that Article 80(2) GDPR did not apply at the case at issue, as no concrete violation of the GDPR with regard to a specific data subject was alleged by the association. The association lamented an abstract violation as a consequence of the controller’s privacy policy. In the merits, the controller stated that the disclosure of personal data to SCHUFA was subject to strict and clear requirements. Data processing was covered both by Article 6(1)(b) and (f) GDPR, as it was necessary to perform telecommunication contracts and prevention of credit risks and fraud was a legitim ate interest of the controller and society at large. Thanks to the disclosure the consumers also improved their SCHUFA “score” through positive data points. From the outset, the court clarified that the GDPR aims to protect the data subject’s fundamental rights not only as a citizen, b
Election Commitee of the Workers Council of SuperVista AG
A dispute arose about material required by the election committee for conducting works council elections at an online eyewear retailer employing nearly 400 people. The employer had partially complied with requests by the election committee but withheld some email and postal addresses, citing privacy concerns and the feasibility under data protection laws. The matter was taken to court to resolve whether the employer must provide complete information. The court affirmed the employer’s obligation to provide the complete list of email and postal addresses, detailed by location and job function, as required by the election committee to smoothly conduct the works council elections. The ruling referenced multiple laws, including § 24 WO and § 26 BDSG, stating the processing of personal data for election purposes is lawful without employee consent, due to its necessity for the election process. The court also clarified that data protection concerns did not outweigh these statutory obligations.
Court case 2 A 111/22
A company’s (controller) activity was to buy metal residues from dental practices and laboratories. In this purpose, the controller was searching for contact details of practitioners and laboratories from publicly accessible directories such as the Yellow Pages. These data included surname and first name of the practice owner, address and phone number and were stored on the controller’s database. The controller then used these data to contact dentists and researchers to find out if they were selling metal residues. A dentist complained to the Saarland Administrative Court which ordered the controller to stop the processing of dental practices’ owners for advertising purpose without consent and to delete the data stored under a €2,500 penalty. The controller appealed this judgment with the Higher Saarland Administrative Court, requesting from the administrative Court to rescind the decision. The controller claimed that it had a legal basis for the processing. It explained that the purpose of the advertising was to make a profit, which is a legitimate interest within the meaning of Article 6(1)(f) GDPR. The processing must also be necessary for this purpose. The controller considered that it was “simply a question of whether an equally suitable but less intrusive means is available”. In this case, it held that a contact by telephone only lasts about one minute on average while postal mail would require additional administrative work on the part of the data subject. It concluded that contact by telephone was a milder option than contact through postal mail. The controller added that under the GDPR, data processing would only lack legal basis if the interests of the data subject outweighed the legitimate interest of the controller. An equal impact on the data protection interests of the data subject was therefore not sufficient. The Administrative Court requested to dismiss the appeal. It added that this kind of advertising had an anti-competitive nature. According to German administrative law, there was no reason for reopening the case. Indeed, to do so, the factual or legal situation must have changed regarding the circumstances that were decisive for the administrative act, which was not the case in this matter. Regarding the legal basis, the Court did not follow the argument of the controller. It considered that the legal basis for telephone advertising should have been consent. The Higher Court therefore confirmed the appealed decision.
Court case W298 2252644-1
The data subject was a judge working at the Austrian Federal Administrative Court. An internal judicial body – the controller – opened a disciplinary investigation concerning the data subject’s performance at work, including the latter’s mental health. The disciplinary body concluded the investigation with a final report and an evaluation of the data subject, which were subsequently notified to them. The data subject brought action against the controller for violation of Articles 5(1)(a) to (c), 6 and 9 GDPR. According to the data subject, the investigation would have been hampered by many inadequacies and investigative mistakes in the processing of their personal data. In particular, the controller would have picked and chosen pieces of evidence, deliberately ignoring fundamental elements. The Austrian Federal Administrative Court dismissed the data subject’s claim. According to the judges, data protection law cannot override the rules delimiting jurisdictions. A review of the investigation methods by the Federal Administrative Court would encroach upon the competence of the disciplinary body, which is a judicial body as well. In other words, a data subject cannot use data protection law to limit the investigative powers of a judicial body whose jurisdiction is subject to.
Data Protection Authority of Lower Saxony
The controller operated a 24-hour self-service petrol station with a retail shop, both accessible by everyone. Following a complaint, the DPA requested the plaintiff to provide information about the video surveillance. In their response, the controller pointed out, that they had installed cameras in the shop and outdoor, including the self-service gas station area. According to the controller, the self-service gas station property is damaged five to six times a year. It also happened that customers forgot the fuel nozzle in the vehicle and drove off. The video surveillance recordings was stored on a hard drive for about six to eight weeks. The controller added that they determined the annual damage in the gas station operation in the amount of € 10.000 – including vandalism and break-ins. The video recordings had a crucial function with regard to these offences. A storage period reduced to 72 hours, as asked by the original complainant, was unreasonably short. The controller also argue that compensation for damages would be made considerably more difficult by a 72 hours storage period. In addition, according to the controller, the GDPR Regulation does not provide for any rigid deletion periods. The DPA ordered the plaintiff to limit the storage period of the video recordings. In the event of non-implementation, incomplete implementation or late implementation, a penalty payment was threatened. The DPA further explained, that it not objected Article 6(1)(f) GDPR as legal basis for the video surveillance. However, any video surveillance encroaches on the fundamental right of natural persons. Video surveillance measures have a high degree of intervention intensity. Numerous people are included in the surveillance action who are not related to specific misconduct. Video recordings should therefore be deleted immediately if they are no longer necessary to achieve the purposes for which they were collected. Although there are no rigid retention limits stated in the GDPR, storage limits are based on the necessity of storage. A day or two should be sufficient to decide whether further storage of the video recordings is necessary. Taking into account the data protection principles of data minimization and storage limitation, deletion should take place regularly after 48 hours. Considering non-working hours at the weekend 72 hours are acceptable. As an exception, a longer storage period is permissible for absences on public holidays. The controller appealed against the order of the DPA. In the appeal, the controller repeated their previous submissions before the DPA. In particular, the DPA order violated the principle of certainty. The GDPR does not contain any information about the duration of data storage. The plaintiff took the view that § 4 Bundesdatenschutzgesetz (BDSG) is the legal basis for the video surveillance. The self-service petrol is a facility for maintaining public transport and thus an operation in the area of services of general interest, so that it is to be regarded as a public facility within the meaning of the BDSG. § 4 BDSG The Administrative Court of Hannover dismissed the lawsuit. The permissible purpose of video surveillance is to prevent and track criminal offenses, in particular vandalism and damage to property. For this purpose, the controller was entitled to collect and store images. However, it was not necessary to keep these records for six to eight weeks to achieve the purpose. It was easily possible to determine within 72 hours whether vandalism or damage occurred and, should this be the case, then to view the video material. If the video material then provides further information on a crime, a controller is entitled to store it for a longer period of time. The court also stressed how EDPB also generally assumes a permissible storage period of 72 hours. A storage period that goes beyond this is possible, but requires a necessity and a particular justification. With regard to the clarification of cases of vandalism and damage to property, the plaintiff has not succeeded in presenting a comprehensible reason why it should not be possible for them to report corresponding incidents within 72 hours. The decision of the data protection authority to limit the storage period was therefore legally not objectionable. The limitation of the retention period by the authority was based on Article 58(2)(f) GDPR. Accordingly, the supervisory authority can impose a temporary or permanent restriction on processing, including a ban. Contrary to what the controller believed, the order was not vague. In the disputed decision, it was pointed out that a longer storage period is permissible in the event of absences on public holidays. The DPA also explained that longer storage is possible in cases in which the recorded video is necessary to clarify cases of damage. Concerning the legal basis for the processing, video surveillance carried out by the controller and the storage of video recording were subject to the regulatory regime of the GDPR. Contrary to what the controller believed, they could not base the video surveillance and storage on § 4 BDSG. This provision is contrary to Union law insofar as it affects non-public bodies. Article 6(1)(e) GDPR and Article 6(3) GDPR only give the member states regulatory leeway to regulate video surveillance that is carried out in the context of a task that is in the public interest or in the exercise of official authority. § 4(1) BDSG, contrary to Union law, allows video surveillance for the exercise of domiciliary rights by non-public bodies.
CJEU case C-268/21 Norra Stockholm Bygg
The company Fastec was contracted by the company Nycander for the construction of an office building. During the project, workers who carried out activities at the construction site registered their presence through an electronic records system. After completion of the work, Fastec filed a lawsuit with the Swedish Court of First Instance to collect a debt related to the services provided, including the hours worked by its staff. In response, Nycander claimed that the number of hours worked was lower than that presented by Fastec and requested the presentation of the electronic records as evidence. Fastec opposed this request, on the grounds that the disclosure of the records would violate the provisions of article 5(1)(b) GDPR, as personal data were collected from the staff members for the purpose of complying with legal tax obligations. The Court of First Instance granted Nycander's request and ordered the presentation of the unedited records for the period in which the work was carried out. In the second instance, this decision was confirmed. Dissatisfied, Fastec filed an appeal with the Supreme Court of Sweden and asked for the decision to be reversed. The Supreme Court then decided to stay the proceedings and refer the following preliminary questions to the CJEU: 1. Does Article 6(3) and (4) of the GDPR also impose a requirement on national procedural legislation relating to [the obligation to produce documents]? 2. If Question 1 is answered in the affirmative, does the GDPR mean that regard must also be had to the interests of the data subjects when a decision on [production] must be made which involves the processing of personal data? In such circumstances, does EU law establish any requirements concerning how, in detail, that decision should be made?' To answer the first question, the CJEU assessed whether personal data collected for the fulfillment of a legal tax obligation could be used for a different purpose, that is, for the production of evidence in legal proceedings. First, it noted that, according to Article 6(1)(e) GDPR, the processing of personal data is lawful if it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. It recalled that, in accordance with Article 6(3) GDPR, read in combination with Recital 45 thereof, this task must be defined by EU law or by Member State law to which the controller is subject. From the combination of the two articles, the CJEU held that the tasks performed by courts acting in their judicial capacity fall under this notion. Then, it pointed out that, where the processing of personal data is carried out for a purpose other than that for which those data have been collected, it follows from Article 6(4) GDPR, read in the light of Recital 50 thereof, that such processing is allowed provided that it is based, inter alia, on Member State law and that it constitutes a necessary and proportionate measure in a democratic society to safeguard one of the objectives referred to in Article 23(1) GDPR. In such cases, the controller is allowed to further process personal data irrespective of the compatibility of that processing with the purposes for which the personal data were initially collected. In the present case, the CJEU found that the legal basis for the use of personal data as evidence in a judicial proceeding is provided for by the national procedural law, while the legal basis for collection of such data by the employer is provided for by the national tax law. The first is intended to enable citizens to exercise their rights through access to evidence; the second is intended to enable tax authorities to exercise their inspection powers. Considering that these are different purposes, but both defined by law, the CJEU held it necessary to analyze not the compatibility between them, but the necessity and proportionality of the measure under Article 6(4) GDPR, in accordance with the objectives referred to in Article 23(1) GDPR. It recalled that these objectives include the protection of judicial independence and judicial proceedings, which encompasses the protection of the the proper administration of justice. Moreover, according to Article 23(1)(j), the enforcement of civil law claims also constitutes an objective which may justify further processing of personal data. In the light of all the foregoing considerations, the CJEU found that Article 6(3) and (4) GDPR must be interpreted as meaning that that provision applies, in the context of civil court proceedings, to the production as evidence of a staff register containing personal data of third parties collected principally for the purposes of tax inspection. Regarding the second question, the CJE assesed whether a judge must consider the interests of data subjects when issuing an order for the production of evidence. The CJEU stressed that, although the national procedural law does not stipulate this obligation for judges, any activity involving the processing of personal data must comply with the principles of Article 5 GDPR and be supported by one of the legal basis provided for in Article 6 GDPR. Thus, when information is simultaneously considered as personal data and potential evidence in a judicial process, the judge must carry out a weighing exercise before determining the production of evidence. According to the CJEU, this exercise must take into account the interests in conflict on a case-by-case basis. Although the right to data protection is considered fundamental, it is not an absolute right. Therefore, there is a need to make it compatible with other fundamental rights, such as the right to effective judicial protection. According to the settled case-law of the European Court of Human Rights, an individual have the right to present his or her case effectively before the court and enjoy equality of arms with the opposing side. It follows, inter alia, that an individual must have the benefit of adversarial proceedings and be able to submit, at various stages of those proceedings, the arguments he or she considers relevant to his or her case. For this reason, the CJEU held that the parties to civil court proceedings must be in a position to access the evidence necessary to establish to the requisite standard the merits of their complaints, which may possibly include personal data of the parties or of third parties. Also, it stated that the national Court must analyze whether data disclosure constitutes a measure that is proportional and necessary for the objective in question, in order to guarantee the minimisation of data imposed by Article 5(1)(c). In the event that the production of a document containing personal data proves to be justified, it also follows from that principle that wthe national court must consider determining the implementation of additional data protection measures, such as the pseudonymisation of the names of the data subjects or any other measure intended to minimise the interference with the right to the protection of personal data. Such measures may include limiting public access to the file or an order addressed to the parties to whom the documents containing personal data have been disclosed not to use those data for a purpose other than the taking of evidence during the court proceedings at issue. In the light of all the foregoing considerations, the CJEU found that Articles 5 and 6 of the GDPR must be interpreted as meaning that, when assessing whether the production of a document containing personal data must be ordered, the national court is required to have regard to the interests of the data subjects concerned and to balance them according to the circumstances of each case, the type of proceeding at issue and duly taking into account the requirements arising from the principle of proportionality as well as, in particular, those resulting from the principle of data minimisation referred to in Article 5(1)(c) of that regulation.
Court case W292 2259696-1
A woman (the controller) used intimate photos of her husband (the data subject) and his lover in a divorce proceeding. According to the data subject, the controller also shared this material with a third party, namely the husband of the other woman involved. The pictures were originally uploaded on a cloud service by the data subject himself. Credentials to access the cloud were noted down in a notebook kept next to the computer, which was accessible to all the members of the family. The data subject filed a complaint with the Austrian DPA (Datenschutzbehörde - DSB). The DSB dismissed the complaint. On the one hand, disclosure before the civil court was necessary to prove the data subject’s responsibility in the divorce dispute. On the other hand, disclosure to third parties could not be proved. The Federal Administrative Court confirmed that a disclosure to third parties could not be proved. As a matter of fact, the former husband of the data subject’s lover got the pictures only indirectly from an anonymous email addressed to his lawyer. In particular, the Court pointed out to the fact that credentials to access the data subject’s account on the cloud were easily available to everybody living in the house. Concerning the disclosure in the civil proceeding, the pictures were undoubtedly special categories of personal data under Article 9(1) GDPR, whose processing is in principle prohibited. However, in this case processing was covered by the exception under Article 9(2)(f) GDPR. The Court stressed that, for the exception to apply, processing should be “necessary” to the purpose stated in this provision, which means that a judicial claim or defence would not be possible without the processing. Nevertheless, such a requirement shall not be interpreted too strictly. In the Court’s opinion, when disclosure in judicial proceeding is deemed not relevant by the judge, this does not automatically entail a violation of Article 9 GDPR. The only case in which Article 9(2)(
Court case 13 K 278/21
The data subject was a federal civil servant who applied for assistance from the controller, the German Federal Administrative Office. The data subject attached to his application 13 copies of receipts with special categories of personal data – in particular information about his health. The receipts included nine invoices and statements from various specialist doctors in 2019, detailing the individual services provided and, in some cases, including diagnostic information, along with four prescriptions for medications. The controller should have returned the copies to the data subject, but due to an administrative error, the data subject received the copies concerning a third person and the data subject´s receipts were also accidentally sent to a third person. After the controller got back the receipts from the third person, they were eventually sent to the data subject. Due to this error, health data of the data subject was disclosed to a third person, without any legal ground. This violated the data subject's general right of personality and his right to informational self-determination. Therefore, the data subject claimed €3,000 as compensation for damages pursuant to Article 82(1) GDPR. The court found the disclosure unlawful as occurred in violation of Article 9(1) GDPR. In the quantification of damages the court ruled the following. First, there was nothing to indicate that the data were made known to other persons, other than the known (wrong) recipient. In this respect, it could be assumed that the risk of further dissemination of the data subject's health data by the third party did not materialize. The controller immediately demanded the return of the receipts from the third party and returned them to the data subject after it had noticed the incorrect dispatch. Further, the court held that the incorrect dispatch of the aid vouchers was only due to simple negligence; the court did not find any gross negligence or intent in the unlawful disclosure. Finally, there was also no risk of repetition. According to the controller, the misdirection was a one-time exceptional case. The controller also changed the way it handles the documents sent in. The aid notifications were now sent without supporting documents and all supporting documents provided were now destroyed in the aid office in line with data protection requirements. A violation of Article 9 GDPR similar to the present case was thus ruled out for the future. In addition, the court noticed how the controller called in the responsible data protection officer. For this reasons, the court set the compensation at €1,000.
Court case 3 K 596/22
The case concerns the legality of a request for documents. The controller was the owner of several apartments. The Bavarian tax authority required the controller to provide several documents, including their rental contracts. The controller submitted the rental contracts but redacted the names of the tenants. They explained that it was not possible to disclose personal data without consent. The names were also not necessary for an examination of their actual income. The tax office dismissed the objection and requested the landlord to submit the names of the tenants. The tax office stated that a tax payer is obliged pursuant to § 90 Section 1 of the Fiscal Code (Abgabenordnung - AO) to cooperate in determining the facts. This obligation to cooperate also includes the obligation to submit documents. The tax office needed the names of the tenants and the respective rental agreements to check the tax-relevant circumstances. As a matter of fact, tenants' name were required in order to assign payment flows to the respective tenancy individually. Therefore, the document request was appropriate and reasonable. The controller was entitled (and obliged) to name the tenants to fulfill their tax obligations in accordance with Article 6(1)(c) GDPR. The controller brought an action before the finance court. They took the view that the personal data of the tenants contained in the apartment rental contracts were protected by the GDPR. The landlord was therefore not allowed to disclose this data to third parties without the tenants' consent. The Nuremberg Financial Court dismissed the action. The tax office was allowed to request the documents at issue. The German legislator used the open clause of Article 6(1)(c) and (e) GDPR, in combination with Article 6(2) and Article 6(3) GDPR, to create a legal basis for the processing of personal data by tax authorities pursuant to § 29(b) AO. The processing of personal data by a tax authority is permitted if it is necessary to fulf
Spetsializiran nakazatelen sad (Specialised Criminal Court, Bulgaria)
A data subject was accused of a criminal offence and refused to consent to the collection of her genetic and biometric data (Photographs and fingerprints), which the Bulgarian Police required to create a record. The data subject also refused to let the police take a sample for the purpose of creating a DNA profile. In the end, the police did not collect this data. The police went to a Bulgarian Criminal court (Spetsializiran nakazatelen sad), which was also the referring court in this case. Here, the police asked the court to authorise the forced collection of the genetic and biometric data, considering there was enough evidence to convict the data subject of the crime. The police position was mostly based on Bulgatian law (ZMVR, Law of the ministry of Home affairs) authorising the collection of biometric and genetic data for, among the others, law and order purposes. However, the referring court had doubts whether the such law was actually compliant with EU law. This Bulgarian law did refer to Article 9 GDPR, but did not refer to [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016L0680&from=DE#d1e1816-89-1 EU directive 2016/680]. The latter is an EU directive which concerns the protection of personal data regarding processing of competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. This directive states that the processing of certain special category data, including genetic and biometric data, can be lawful if this is compliant with EU law or national law. The Bulgarian law had even taken over some of the wording from Article 10(a) of this directive for its national provision. The court determined that there were two problems resulting from the fact that this national law contained a reference to the GDPR, but did not mention the aforementioned directive. The first problem was the fact that the GDPR was not applicable to the processing
Storstockholms Lokaltrafik (SL)
The Swedish Privacy Authority (IMY) decided on 21 June 2021 that AB Storstockholms Lokaltrafik (SL) would pay an administrative fine of SEK 16 million under the General Data Protection Regulation of which - SEK 4 000 000 relates to SL's use of body-worn cameras to preventing and documenting threats and violence, through the use of pre-recording technology for one minute, - SEK 8 000 000 relates to SL's use of body-worn cameras to ensure the identity of passengers liable to pay a surcharge, and - SEK 4 000 000 relates to SL's failure to provide information to data subjects. SL first intended to use the body-worn cameras on 4-10 ticket inspectors in the metro during a test period starting from December 2018. Test period was extended and later introduced permanently. The body-worn cameras are used since they became permanent by about 55 ticket inspectors on weekdays and 20 ticket inspectors on public holidays across the network. The technology works as follows a camera and microphone continuously record images and sound. The cameras have a circular memory that allows any video footage older than one minute to be is automatically cleared unless the ticket inspector activates a recording. Then the footage from one minute back from when the recording was activated (so-called automatic pre-recording). The ticket inspector has been instructed to activate recording when the to issue a surcharge or when threatening or violent situations arise. The footage from the camera is uploaded after the shift to a server where it reviewed by a few evidence administrators. The case was appealed to Stockholms förvaltningsrätt, where they dismissed the administrative fine regarding against SL's use of body-worn cameras to preventing and documenting threats and violence, through the use of pre-recording technology for one minute, Förvaltningsrätten considers that the evidence supports that SL's use of body cameras with a one-minute pre-recording is both necessary and propo
Court case 3 O 277/22
The controller run some websites that make use of Google tools. When users interacted with such tools their personal data were transferred to the US, allegedly in violation of the GDPR. The data subject visited some of these websites via web crawling and claimed damages for data protection violations. The controller considered the data subject's request unfounded and brought an action for injunctive relief before the Regional Court of Baden-Baden. The controller asked the court to order the data subject to refrain from further warnings and requests, as the data subject had no right to compensation under the GDPR. The court held that the controller's request was admissible and justified. The court pointed out that the CJEU case law allows the application of national law enabling judges to check the existence of abuses of EU rights by the parties (see [https://curia.europa.eu/juris/liste.jsf?nat=or&mat=or&pcs=Oor&jur=C%2CT%2CF&num=C-373%252F97&for=&jge=&dates=&language=en&pro=&cit=none%252CC%252CCJ%252CR%252C2008E%252C%252C%252C%252C%252C%252C%252C%252C%252C%252Ctrue%252Cfalse%252Cfalse&oqp=&td=%3BALL&avg=&lg=&page=1&cid=2070463 C-373/97]). In the present case, such parameter is the standard of "good faith" under § 242 of the German Civil Code (Bürgerliches Gesetzbuch - BGB) which, according to the court, the data subject had violated in the present case. This results from the fact that, contrary to the data subject's submissions, their primary interest when accessing the websites was the generation of claims for damages against the controller. The court rejected the data subject's statement that their main concern was to denounce data protection violations. Besides, the court held that the risk that inexperienced users came to the webpages was very low. A violation in the form of unlawful data transfers materialised only because the data subject intentionally looked for it with an aim of asking for non-material damages. As a further argument to substantiate the