GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
198 results · Showing 181–198
AVROTROS
AVROTROS (defendant) is a Dutch radio and television broadcaster that is part of the Dutch public broadcasting system. It broadcasts a weekly program called ‘Opgelicht ?!’, which is a program about fraud. In one of the episodes AVROTROS plans to broadcast an item in which plaintiff is recognizably portrayed and accused of committing fraud. Plaintiff tries to prevent AVROTROS from broadcasting this item. The judge has to balance the interests of AVROTROS against the interests of the plaintiff. With regards to the GDPR, the judge holds that the processing of personal data is a processing for journalistic purposes as specified in Article 85 GDPR, Article 32 of the Dutch GDPR Implementation Act (UAVG) and Article 7 of the Constitution of the Netherlands. The legal basis for the processing is Article 6(1)(f) GDPR. Plaintiff's request was denied.
Court case II SA/Wa 2227/19
The data subject's complaint concerned irregularities in the process of processing of his personal data by the company. They consisted in making his personal data available to unauthorised persons. It was alleged that the company's employees - in the presence of third parties located in the MP's office (public place) - read, using the applicant's personal data, the content of the statement on termination of the employment contract. The applicant indicated that - after refusing to accept the termination - representatives of the company left an unsecured letter containing the termination in the presence of persons in the MP's office; therefore, the applicant requested that all actions be taken to rectify the violations indicated. President of the Personal Data Protection Office has decided that the provision of personal data to the applicant in the above mentioned way was done in violation of the provisions of personal data protection Article 5 (1) (c) and (f) of the GDPR. Both parties filed a complaint against the President of the Personal Data Protection Office decision with the Provincial Administrative Court for Warsaw. The court considered whether the Polish DPA correctly applied Article 5(1)(c) and (f) of the GDPR and whether the GDPR provisions would be applied at all in the given situation. The Provincial Administrative Court for Warsaw revoked the decision of the President of the Personal Data Protection Office. In its reasoning, the Court states that Article 2 (1) of the GDPR shall apply only "to the processing of personal data wholly or partly by automatic means and to the processing, other than by automatic means, of personal data which form part of a filing system or are intended to form part of a filing system". The Court stressed that under Article 4(6) of the GDPR, a data filing system is a structured set of personal data accessible according to specific criteria, whether that set is centralised, decentralised or dispersed on a functional or geo
COOPERATIVE RABOBANK UA
The claimant was registered in the Central Credit Information System (hereinafter CKI) of the BKR (Credit Registration Office) because of two instances on which he had defaulted on repaying an overdraft. BKR then issued the claimant with a revolving credit, set to begin in 2012 and end in 2019, and visible until 2024. The registration of the revolving credit contained an arrears code (signalling that money is owed and should have been paid earlier) which would remain visible on his account until 2021. When the claimant paid back the full amount in 2020, he asked to have the arrear code removed from his file. Rabobank refused to remove the code, which led to the complainant filing a complaint. Pursuant to Article 21(1) of the GDPR, persons such as [the claimant] can object to the processing of their personal data on the basis of Article 6(1)(e) or (f) GDPR due to their specific situation . The controller, in this case Rabobank, must honor the objection, unless it submits compelling legitimate grounds for the processing that outweigh the interests, rights and freedoms of the persons concerned. If the objection is granted, the controller must delete the personal data without unreasonable delay. If the controller does not honor the objection, the data subject may, if necessary, ask the court for an effective remedy (Article 79 GDPR and Article 35 UAVG). The court assesses whether the controller has demonstrated that its compelling legitimate interests (in this case the dual purpose of the credit registration: to protect the consumer against excessive credit and to warn other credit institutions) in this specific case outweigh the interests or the fundamental rights and freedoms of the data subject (recital 69 GDPR). Whether it was proportionate for the BKR registration to be maintained, given the fact that the claimant had paid back her arrear and the current registration was preventing her from taking out housing credit? After weighing up the interests involved, R
GBA
After ceasing her notary activity, the applicant engaged in a liquidation dispute with her former business partner and their accounting office. This dispute arose as the accounting office (1) failed to fulfill several ethical obligations and (2) transferred files containing personal data about the applicant to the former partner (without the applicant’s consent). The Litigation Chamber of the Data Protection Authority declared the applicant’s complaint admissible, but dismissed it for the following opportunity reasons: * the complaint did not contain any grievances that a have a “broad social impact”; * another complaint was pending with the competent authority with regard to the ethical and professional mistakes ; * taking into account the resources available, the DPA should make choices regarding the type of files it will follow up on grants. The applicant subsequently appealed to the Market Court of the Brussels Court of Appeal against the aforementioned dismissal decision of the DPA. Should Article 57.1, f) GDPR be read as such that supervisory authorities may not dismiss complaints but should instead review the full substance of the allegations in each complaint? In other words, does the data subjects' right to lodge a complaint under Article 77 GDPR equals the right to claim a full substantive investigation and a full substantive assessment by the supervisory authority? Article 57 GDPR provides that the supervisory authority must "examine the content of the complaint" only "to the extent that is appropriate". There is therefore no absolute obligation but a discretionary power for the supervisory authority to make a full substantive investigation and a full substantive assessment of the complaint. If the supervisory authority considers that a treatment of the case on substantive merits is not appropriate (due to policy considerations, for example), it is authorized to dismiss the complaint. The option to dismiss is indeed one of the consequences that can
Autoriteit Persoonsgegevens
In two similar cases, complainants requested Dutch Data Protection Authority to take enforcement action against the Administrative Jurisdiction Division of the Council of State. According to the complainants, the Division violates GDPR by providing journalists with access to physical copies of procedural documents on the day of hearing. Complainants point to the violation of Articles 5, 6, 9, 12, 13, 14, 15, 32, 33 and 34. The Dutch DPA is of the opinion that, pursuant to Article 55(3) GDPR, it is not authorized to supervise this processing. There is an inextricable link between the public nature of justice and the judicial task; transparency and openness in individual cases is an important part of judicial task. On 29 May 2020 the Court of First Instance of the Central Netherlands decided to submit the following questions to the Court of Justice of the European Union: 1. Should Article 55(3) of the GDPR be interpreted as meaning that “processing operations of courts acting in their judicial capacity” includes the provision by a judicial authority of access to the procedural documents containing personal data to a journalist, as described in this order for reference? 1a. In answering this question, is it important whether, in specific cases, the exercise of the supervision powers by the national supervisory authority over this form of data processing affects the independence of judgement? 1b. In answering this question, is it important that the nature and the purpose of data processing, according to the judicial authority, is to inform a journalist to allow for better reporting on public hearings and legal proceedings, which supports the openness and transparency of justice? 1c. In answering this question, is it important that data processing is explicitly provided for by national legislation? The Council finds that a preliminary ruling from the Court of Justice as referred to in Article 267 of the TFEU is needed, since the concept of “judicial task” is an EU l
Court case C/05/368427 / KG ZA 20-106
A mother of three underage children (plaintiff) filed a claim in the Court to cease the posting of her children’s photos by their grandmother (defendant) on social media. The plaintiff argued that the defendant had not obtained a consent from her or her ex-partner – the legal representatives of one of the children concerned. Despite several letters requesting the defendant to remove photos from her Facebook page, the defendant did not comply with the request. The defendant’s child (child 1), whom the current proceedings concern, is under 16 years old. The Dutch GDPR Implementation Act (Uitvoeringswet Algemene Verordening gegevensbescherming) (“UAVG”) stipulates that the posting of photos of minors who have not yet reached the age of 16 requires their legal representative(s)’ consent. The plaintiff, as a legal representative, had not given permission to post photos of her children on social media. In the case of child 1, his father also had not granted permission to the defendant. The Dutch GDPR Implementation Act (Uitvoeringswet Algemene Verordening gegevensbescherming) (“UAVG”) stipulates that the posting of photos of minors who have not yet reached the age of 16 requires the permission of their legal representative(s). The Court ruled that it was impossible to establish with certainty that the posting of photos on social media fell under the “household exemption” Article 2(2)(c) GDPR. Therefore, such processing of plaintiff’s photos falls within the scope of the GDPR. Given the lack of consent, the Court ordered the defendant to remove the photo of child 1 from her Facebook page as well as to remove the photo of the plaintiff from the Pinterest account. In addition, the defendant is prohibited from posting without permission photos of plaintiff’s minor children on social media.
Court case Ro 2019/04/0229
The Austrian Data Protection Authority (DSB) had issued a fine of EUR 4,800 under Article 83 GDPR against a legal person based in Austria ("the company"). The reason for this fine were four violations of the GDPR and the DSG (Austrian Data Protection Act) in connection with a CCTV (closed circuit television). The company filed an appeal against this fine with the BVwG (Austrian Federal Administrative Court). On 19 August 2019 the BVwG repealed the fine and suspended the administrative penal procedure. It held that the DSB had failed to make an accusation pursuant to § 30(1) and (2) DSG (Austrian Data Protection Act) against specific persons who have a decisive influence on the accused company's business (managers) and whose own culpable actions (own actions, own omissions or lack of supervision of subordinate employees) can be attributed to the accused company. In its reasoning, the BVwG also referred to a VwGH (Austrian Supreme Administrative Court) decison regarding violations of the BWG (Austrian Banking Act). This is because § 30 DSG, that establishes rules for data protection liability of legal persons, has a very similar wording to § 99d BWG. The DSB filed an appeal against this decision with the VwGH requesting it to repeal the BVwG's decision and to reinstate the decision of the DSB. A) Is the VwGH case law on § 99d BWG relevant with regard to § 30 DSG and Article 83 GDPR? (§ 99d BWG requires culpable conduct on the part of a natural person who is entitled to decision-making or asserting control within the legal person.) B) Or rather, is the CJEU case law on fines under competition law relevant with regard to § 30 DSG and Article 83 GDPR? (EU competition law allows the European Commission to impose a fine against a legal person without having to specifically accuse a natural person of culpable conduct.) C) Is § 30 DSG even applicable or is there a lack of a corresponding opening-clause in the GDPR? (§ 30 DSG requires the same culpable conduct of a natural
Court case C/13/677172 / HA RK 19-435
Data subject and their spouse applied for membership of the Nederlands Israëlitische Hoofdsynagoge (the Dutch Israeli Main Synagogue), the controller, in 2014. On 22 March 2019 data subject requested that the membership of him and his family be terminated immediately and that all personal data be destroyed as soon as possible. They repeated this request 31 October 2019 after having received no substantive reply of the data controller. On the same day, the data controller replied that they did not store the data subject's personal data any longer than required, but that it is necessary to retain their personal data indefinitely, even after termination of the membership, because this personal data is required to verify "halachic status of [data subject's] descendants". Data subject replied that this had no effect to his request. In response the controller said that they would not be granted. On 17 November 2019, data subject filed a complaint with the AP (Dutch DPA). The complaint was still under consideration at the time of this court case. On 19 December, data subject filed a case and requested the District Court to order the data controller to delete their personal data, and pay claimant €1,500 in damages on the basis of Article 82 GDPR. Data subject argued to have had €250 in material damages for the costs of the trial, €500 in immaterial damages because of "loss of control of their personal data", and €750 in immaterial damages because of stress and uncertainty relating to the trial. The District Court rejected all claims. First, the Court held that data subject no longer had any interest in the erasure request, because the controller deleted the personal data before the Court gave its verdict. Furthermore, the Court ruled that the claimed €250 in material damages were legal costs, and, therefore, do not qualify for damage compensation. Moreover, it held that the claim of €750 in immaterial damages is inherent to filing a court case and finds no basis for compensation in Article 82 GDPR. Lastly, the Court stated that the other claim of €500 in immaterial damages because of "loss of control of personal data", is unsubstantiated. Data subject based this claim on case law where the controller provided personal data unlawfully to third parties, but in this case no such evidence was provided.
Minister for Legal Protection
The Appellant filed several Freedom of Information Act requests with the municipality of Borsele; he also filed an access request under the previous data protection law. On 16 August 2016 the municipality responded that they processed the Appellant’s name and address for the purpose of registering his FOA requests and creating, registering and sending FOA-related letters. The municipality also shared his details on the closed forum of the Association of the Municipalities of the Netherlands, but the municipality of Borsele would not let him know the specifics. The State Council heard this dispute on 5 March 2019. The municipality clarified that two messages relating to the Appellant’s request were posted on the forum: one contained the Appellant’s name; another one only mentioned the name of his legal consultancy firm. The Appellant claimed non-material damages resulting from loss of control over his personal data and delays in providing him with the information about the forum messages. The State Council had to assess this claim. The State Council decided that breach of GDPR does not automatically imply an impairment of the integrity of a person which would lead to compensation of damages. The facts that an infringement of GDPR can result in non-material damage and that a data subject must receive full and effective compensation of the damages under GDPR, do not mean that violation of the law always results in damages. The damage caused must be real and certain. The State Council also pointed out that the Appellant has failed to demonstrate that the failure to provide complete information about his personal data processing in a timely manner had caused damages. The claim for compensation was rejected.
CRPA, LDH and MGEN ASS
The NGOs, Circle for reflection and proposal of actions on psychiatry (CRPA), The Human Rights League (LDH) and the French organism fight for social welfare (MGEN ASS) brought action for annulment before the Supreme Administrative Court (the Council of State ‘CE’). The complainants requested, inter alia, the annulment of the decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorizing the processing of personal data of persons in psychiatric care without consent for monitoring purposes, for misuse of authority. The decree from 2018 (without modification) allows the processing of personal data of persons in psychiatric care without their consent for monitoring purposes. The amending decree adds a further processing which is to inform State representatives of new admissions of persons in psychiatric care without their consent. The same decree states that this other processing is the prevention of terrorist radicalization, within the meaning of the French criminal law. The Complainants argued that that new processing infringed Articles 9, 12, 13, 14, 16 and 17 GDPR. The Court had to assess which legal was applicable and whether the further processing is lawful. The Supreme Administrative Court decided First, on the link between the two processing aforementioned, the Court ruled that the two processing operations constitute themselves one and only operation. It issued that the legal framework applicable to such processing depends on the purpose thus pursued. Secondly, the Court issues that the purpose of such processing to prevent radicalised persons with psychiatric disorders from committing terrorist acts. Thus, the processing is in the field of State Security and Defence and falls outside the scope of Union law, as foreseen in Article 2(2)(a) GDPR. More precisely, the processing is subject to the specific provisions for processing carried out on behalf of the State and relating to State security or defence in the French Data Protection and Freedom of Information Law (Loi Informatique et Liberté) Thirdly, the Court pointed the processing was limited to what is was necessary to achieve the purpose. Indeed, the controllers are solely processing the data needed for the identification of the person. Thus, the data processed are adequate, relevant and not excessive in relation to the purpose pursued and that only persons who need to know them in order to contribute to the attainment Fourthly, the Court ruled that personal data related to health are lawfully processed for public interests. Additionally, the Court issued that the plea alleging infringement of Article 8 of the Charter of Fundamental Right was not substantiated and thus, rejected. Finally, the Court rejected the other argument related to the competence of the enacting authority and to French administrative procedure. As a consequence, the Court ruled that the actions were rejected and that the decree is lawful.
Christian Wirthensohn
The plaintiff, data subject, argued that the defendant, data controller, had violated their rights by processing information about their political opinions, a special category of personal data prohibited from processing in accordance with article 9 GDPR, thus causing non-material damage to them. Therefore, the plaintiff exercised their right to receive compensation resulting from article 82(1) GDPR, asking for the data controller to be held liable for the damage caused to them by the data processing which infringed the GDPR. Should a breach of GDPR provisions by a data controller be automatically considered to have caused a damage for the data subject whose data was processed unlawfully, thus granting them the right to compensation as set out in article 82(1) GDPR? = The plaintiff argued incorrect legal assessment of the case by the by the LG Feldkirch. Also, he argued that substantial facts of the case had not been established by the LG Feldkirch and that he should have been awarded the whole amount that he sued for (€ 2.500). = The defendant also argued incorrect legal assessment of the case, as - in its point of view - there had been no processing of special categories of personal data and no actual (emotional) damage occured. It argued that the plaintiff had failed to state, why and in what regard he had actually sufferd emotional damages. Consequently, the LG Feldkirch had only found, that certain GDPR provisions have been violated, but had not establised what acutal emotional damage the plaintiff had suffered. The OLG of Innsbruck rejected the claim and gave reason to the data controller, holding that the data subject had not sufficiently proved that they had suffered of a non-material damage caused by the infringement of the GDPR. The data subject should have been able to cumulatively prove the disadvantage in life and the impairment of personality rights that the breach of the law by the data controller caused for them. Only then could it have been con
unknown (Austrian Credit Agency)
The defendant, a credit agency had processed incorrect data on the plaintiff, who was denied a loan for a real estate purchase due to this entry and later had to enter into another loan agreement. The plaintiff sued the defendant for damages of EUR 8,271.67 and further requested a declaration that the defendant is liable for future damages. The first instance court (Landesgericht Feldkirch) awarded damages of EUR 2,000 to the plaintiff but rejected the further claims. The plaintiff appealed against this rejection, but it was upheld by the second instance court (OLG Innsbruck). The OLG Innsbruck admitted the plaintiff’s further appeal as there was no case law by the Austrian Supreme Court on the distribution of the burden of proof for damages under Article 82 GDPR. Does Article 82 GDPR put the burden of proof for damages that result from a data protection violation regarding *occurrence and amount of a damage, *causality and *unlawfulness on the injured party (data subject) or on the injuring party (controller/processor)? The OGH held, that Article 82 GDPR does not stipulate a reversal of the burden of proof from the injured party to the injuring party regarding occurrence and amount of a damage, causality or unlawfulness of the data processing. It is up to the injured party - the plaintiff - to prove all facts giving rise to liability. Only when it comes to the culpability, the burden of proof is shifted to the injured party (Article 82(3) GDPR) In the case at hand, the plaintiff did not proof any damages beyond the awarded EUR 2,000 and was further not able to proof the causality. Hence, the OGH upheld the judgment of the OLG Innsbruck.
Court case 3-19-579
The complainant made a submission to the Estonian DPA, which the DPA interpreted as a request for information and not as a complaint in terms of Article 77(1) GDPR. The complainant, however, expected the submission to be processed as a complaint within the meaning of Article 77(1) GDPR. The issue was mainly to know the margin of discretion within which the AKI assesses the complaints submitted and to what extend the administrative judge can review it. The court found that the complainant's submission to the DPA clearly requested DPA assistance in preventing unlawful use of the complainant's personal data and interpreting it merely as a request for information was not justified. The court emphasized that the intent of a submission must be considered by the DPA and that a more convenient process cannot be selected merely because a complaint is vaguely formulated or the content briefly stated. The court further noted that a complainant does not need to outline which data protection measures they expect the DPA to undertake, nor do they even need to understand what are the measures available to the DPA - rather, the DPA must evaluate the substance of a complaint and decide for itself which measures are appropriate and accompany any refusal to process a complaint with the required justification. The decision references Article 77(1) GDPR and Estonian Data Protection Act §28 p 1.
Dutch Ministry of Justice and Security
The data subject requested deletion of a publication in the Dutch ‘Staatscourant’, the official government publication site, claiming violation of their privacy, honour and reputation. This request was denied by the State Secretary, so the data subject requested from the judge to order deletion. The data subject also asked for compensation under Article 82 GDPR because of alleged material and non-material damages. The judge rejected the case as inadmissible on the procedural ground that it was brought before the public court, while the competent court is the administrative one.
Fashion ID GmbH & Co. KG
Fashion ID embedded Facebook's 'Like' plug-in, transmitting user data to Facebook without user consent or knowledge, violating third-party consent requirements.
unknown (private person)
In June 2017, a Greek medical doctor working for a Greek clinic performed a hair transplant on the claimant. Shortly after, the claimant lost his hair even in places that were not affected by the surgery. His hair only regrew months later. In the course of the claimant's stay in Greece, both the doctor and employees of the Greek clinic had taken picture of the claimant - even during the surgery. These pictures were published on the Greek clinic's website, together with the claimant's name. The claimant had not consented to this processing of personal data and requested the removal of the photographs and his other personal data. A dispute ensued between the claimant and the doctor (the defendant). The claimant requested a) repayment of the remuneration paid to the defendant of EUR 5,880 and b) damages of EUR 20,000 for the photographs published on the Internet. The defendant argued that the surgery had been performed lege artis and that the photographs had been published by the Greek clinic without the defendant's knowledge and had been removed immediately after the claimant's request. As there was no economic or personal interdependence between the Greek clinic and the defendant, the defendant should not be liable for any damages occurred. The OLG Linz dismissed the appeal (which only concerned the claim for damages) and upheld the decision of the Landesgericht Linz which had dismissed the claim. The unauthorised action of employees of the Greek clinic to put the claimant's name on the photographs and to publish them on the internet without his consent constituted an interference that was unforeseeable for the defendant. As a result, under Article 82(3) the defendant cannot be held responsible for the processing of the claimant's personal data by the Greek clinic.
Court case 4 U 760/19
In that case, the Claimant brought an action against the deletion of a video from the 1970s that he shared in a social network where the word "negro" appeared several times. He also complained about having his account limited to "read only" mode for a few days (the exact duration is disputed between the parties). With regard to Article 99(2) GDPR, the Court already expressed doubts as to whether Article 82 GDPR is applicable to the deletion/blocking that took place in March/April 2018, as this regarded a past and completed situation. However, this point could be left open as for the Court, the video deletion and temporary account blocking was lawful under Article 6(1)(a) GDPR in connection with the terms of use of the network. In any event, the Claimant did not suffer any non-material damages pursuant to Artcile 82(1) GDPR. Not every perceived discomfort without serious impairment of an individual's self-image or reputation may constitute such damage. Recital 146 to the GDPR, referring to "full and effective compensation", does not alter this finding. Otherwise, an almost "unconditional" right to non-material compensation would arise under data protection law.
Schrems
Mr Schrems (permanent resident in Vienna) has brought a lawsuit against Facebook Ireland Ltd (headquartered in Dublin) before the Regional Court in Vienna ("Landesgericht für Zivilrechtssachen Wien", LGfZRS) under Article 79 GDPR. The Viennese Civil Court (LGfZRS) has denied jurisdiction. The Higher Regional Court (OLG) has overturned the judgment and held that the Civil Court has jurisdiction in the case. = Facebook argued that the case was inadmissible, as § 29(2) Austrian Data Protection Act (DSG) only allowed damages claims before civil courts, while all other GDPR rights (like the right to erasure, right to access and alike) have to be brought before the DPAs. Parallel enforcement would violate the Austrian Constitutional rules on the separation of powers between the judiciary and the executive. Facebook argued that Mr Schrems would try to enforce "general claims" that need to be brought before DPAs. If any court is in charge then it would have to be the Viennese Commercial Court ("Handeslgericht Wien"). Further claims on a change of the applications were made, that are irrelevant from a GDPR perspective and therefore not expanded here. = Mr Schrems argued that Article 77 and 79 GDPR explicitly allow parallel procedures ("without prejudice to any available administrative or non-judicial remedy"). § 29(2) DSG only talks about damages, but does not regulate other situations. It explicitly does not refer to the Courts of First Instance (of which there are three in Vienna) but to the Viennese Civil Court. § 29(2) DSG therefore overrides the general rules on jurisdictions of these three courts. The Austrian Government has objected to that in the GDPR negotiations. EU law overrides Austrian law. All claims are explicitly in his name only. All claims are personal claims by Mr Schrems and are not "general claims". GDPR explicitly allows "dual track" enforcement ("Doppelgleisigkeit"). Most of the legal literature agrees with this concept. The Austrian government has as the only country objected to the "dual track enforcement", but was not successful. This part of the legal history of GDPR explicitly shows that GDPR does foresee parallel enforcement. No violation of Article 94(1) of the Austrian Constitution ("B-VG"). § 29(2) DSG explicitly leads to the jurisdiction of the Viennese Civil Court. The judgment by the Higher Regional Court (OLG) was upheld.