GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
On 14 May 2025 the data subject suffered an injury during a parachute jump in the context of a training programme with the Royal Dutch Aviation Association (the controller). The data subject submitted an access request under Article 15 GDPR, asking the controller to receive the incident report regarding his injury. The controller rejected this request on the grounds of confidentiality. The data subject then submitted a request to the civil court, requesting access to the incident report. He claimed that information about how the incident happened is his personal data, as it described his behaviour, and as such Article 15 applied. The controller, on the other hand, affirmed that information about the accident did not amount to personal data. It also stated the that incident report was covered by confidentiality, and it amounted to a lawful restriction of data subject rights and obligations under Article 23 GDPR. The controller further specified that if, after a thorough analysis of the report, it will deem it necessary to conduct deeper investigations on the event, then the report will be published. For the time being, it could only submit to the data subject an account of his direct personal data which is present on the cover page of the incident report, including his full name, surname, age, residence, height and weight. The court partially upheld the data subject’s request, but only as far as it concerns the direct personal data on the cover page on the incident report. It rejected the access request to the detailed information about the incident. First, it confirmed that incident data is personal data, and thus the right of access under Article 15 applied. As for the question on confidentiality, the court agreed with the argument of the controller regarding restrictions to rights and obligations under Article 23. The national GDPR implementation act (UAVG), in Article 41, specifies that access requests (among other rights) may be refused on the grounds of pr
A data subject wished to be addressed in a gender-neutral way and claimed they were misgendered by two companies (the controllers) in profile settings, tickets, and train announcements. They initially sent a tweet to one of the involved controllers asking whether gender-neutral options would be available and later filed a complaint with the Equal Treatment Commission and the Austrian Data Protection Authority (DSB), claiming a violation of their right under Article 16 GDPR. The DPA rejected the complaint, arguing that the data subject had not submitted a formal request for rectification to the controllers. The complainant then appealed to the Federal Administrative Court. The Court dismissed the appeal, holding that there was no violation of the GDPR because the data subject had not submitted a formal request for rectification. Article 16 GDPR requires a clear and specific request for correction, and vague or indirect statements, such as tweets or general demands for a change of the controller’s practice, do not satisfy this requirement. During the proceedings, it became clear that the data subject’s statements, primarily concerned the implementation of a future change of the controller’s practice to allow a gender-neutral option for all users, rather than a concrete request to correct their own personal data. In addition, some corrections had already been made to the data subject’s profile and invoices, while oral misgendering in trains and via loudspeaker announcements was found to fall outside the scope of the GDPR, as such statements were not stored in any personal data filing system. Finally, the Court noted that the minutes of the Equal Treatment Commission hearing could not be relied upon as full proof, as the hearing had been recorded only in audio form and not documented in accordance with the requirements of [https://www.ris.bka.gv.at/Dokumente/Erv/ERV_1991_51/ERV_1991_51.pdf Austrian administrative procedure law (AVG).] Statements made during the Equal
Imagens Médicas Integradas S.A., several companies in the SIBS group and Synlabhealth II S.A. (the controllers) are a number of companies in the medical field. Between 2021 and 2022, the national competition authority conducted several investigations under the authorisation of the Public Prosecutor’s Office. The information seized included employees’ emails and internal documents. The controllers objected to the competition authority seizing employees’ emails, and filed an appeal with the Tribunal da Concorrência, Regulação e Supervisão (Competition, Regulation and Supervision Court, Portugal). According to the controllers, the seizures were illegal, as they infringed their right to secrecy of correspondence. The competition court decided to stay proceedings and refer questions to the CJEU concerning the lawfulness of the seizure of emails of employees during investigations carried out by the competition authority. The competition court referred the following questions: # Do the business records at issue in this case, which are transmitted by email, constitute “correspondence” for the purposes of [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 CFR]? # Does [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 CFR] preclude business records arising from email communications between managers and employees of undertakings from being seized in the course of an investigation into agreements and practices prohibited under [https://eur-lex.europa.eu/eli/treaty/tfeu_2012/oj/eng Article 101 TFEU] (ex Article 81 [EC]) [or, in Case C 260/23, [https://eur-lex.europa.eu/eli/treaty/tfeu_2012/oj/eng Article 102 TFEU] (ex article 82 [EC])]? # Does [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 CFR] preclude such business records from being seized on the prior authorisation of a judicial authority, in this case the Public Prosecutor’s Office, which is responsible for representing the State, defending the interests determined by law, b
Imagens Médicas Integradas S.A., several companies in the SIBS group and Synlabhealth II S.A. (the controllers) are a number of companies in the medical field. Between 2021 and 2022, the national competition authority conducted several investigations under the authorisation of the Public Prosecutor’s Office. The information seized included employees’ emails and internal documents. The controllers objected to the competition authority seizing employees’ emails, and filed an appeal with the Tribunal da Concorrência, Regulação e Supervisão (Competition, Regulation and Supervision Court, Portugal). According to the controllers, the seizures were illegal, as they infringed their right to secrecy of correspondence. The competition court decided to stay proceedings and refer questions to the CJEU concerning the lawfulness of the seizure of emails of employees during investigations carried out by the competition authority. The competition court referred the following questions: # Do the business records at issue in this case, which are transmitted by email, constitute “correspondence” for the purposes of Article 7 of the [Charter]? # Does Article 7 of the [Charter] preclude business records arising from email communications between managers and employees of undertakings from being seized in the course of an investigation into agreements and practices prohibited under Article 101 TFEU (ex Article 81 [EC]) [or, in Case C 260/23, Article 102 TFEU (ex article 82 [EC])]? # Does Article 7 of the [Charter] preclude such business records from being seized on the prior authorisation of a judicial authority, in this case the Public Prosecutor’s Office, which is responsible for representing the State, defending the interests determined by law, bringing criminal prosecutions on the basis of the principle of legality and defending democratic legality in accordance with the Constitution, and which operates independently of the other central, regional and local authorities?’ In his ini
The data subject filed a lawsuit with the Munich Regional Court against the controller, a credit information agency. The data subject claimed to have suffered damages due to automated decision-making carried out by the controller, more specifically receiving rejections due to his credit score when renting an apartment and applying for car financing. The Court dismissed the case on the grounds that no violation of Article 22 GDPR was found, and did not award damages because a GDPR breach is a pre-requisite for awarding damages under Article 82. The data subject then filed for an appeal with the Munich Higher Regional Court, asking, among other things, for a declaration of illegality of credit scoring based on automated processing, compensation for immaterial damages, and specific information on score calculation under Article 15(1)(h). The court noticed the parties that it intends to dismiss the data subject’s appeal in full. The court could not produce a declaration of illegality of credit scoring based on automated processing. It reasoned that the mere creation of a score does not constitute a legal decision under Article 22. Also, the rejections faced by the data subject were not exclusively, if at all, based on the credit scoring, but on other factors. Thus, there is no demonstrable link between the scoring and the rejections. For Article 22 to apply, three cumulative conditions have to apply: a) the presence of a decision b) the decision must be solely based on automated processing including profiling c) the decision produces legal effects or similar impact on the data subject According to the court, the creation of a score cannot amount to a legal effect or similarly impactful effect concerning the data subject. Moreover, the data subject could not sufficiently prove that the data processing resulting in the credit assessment had a meaningful weight on the decisions of third parties. Thus, Article 22 GDPR cannot be applicable. The data subject, i
Grindr is a location-based dating app aimed at gay and bisexual men, transgender people and queer people. In 2020, the Norwegian Consumer Council filed a complaint against Grindr with the Norwegian Data Protection Authority. The reason for this was that Grindr disclosed personal data to several third parties for marketing purposes. The Norwegian Data Protection Authority concluded that Grindr disclosed personal data about its users to third parties for behavioural marketing without valid consent, and that the information about the use of the Grindr app constituted information about the users' sexual orientation or sexual relationships. In December 2021, the Data Protection Authority imposed a fine of NOK 65 million (€5 million). Grindr appealed the decision, and in 2022 the case was referred to the Privacy Appeals Board for review. In September 2023, the Board upheld the Data Protection Authority's conclusions and the decision to impose a fine. Grindr appealed against the Privacy Appeals Board’s decision, and in 2024, the Oslo District Court upheld the administrative fine. The Oslo District Court ruled that the consents were not valid and that Grindr transferred sensitive personal data to advertising partners. Grindr appealed the judgment from Oslo District Court to Borgarting Court of Appeal on 12 August 2025. The Court of Appeal dismissed Grindr’s appeal and upheld the Data Protection Authority’s decision and fine. It held that the information Grindr disclosed to its advertising partners, including users’ App IDs, constituted special categories of personal data under Article 9(1) GDPR, as this data indirectly revealed users’ sexual orientation and sexual relationships. Referring to CJEU case law, the court found that information which can indirectly reveal such sensitive details falls within the scope of Article 9(1) GDPR. Grindr’s argument that the data did not “reveal” sexuality and that its purpose was purely commercial was rejected because the app’s design,
A data subject, a former employee of the Dutch Tax and Customs Administration, requested access to his personal data under Article 15 GDPR. In response, the Ministry of Finance (the controller) sent an overview of the processed data. Considering it incomplete, the data subject lodged an objection, further specifying their request. They requested email correspondence containing the user IDs of team members, the purposes for which the personal data was used, and its recipients. In its new decision dated 30 May 2024, the controller identified an email message containing the data subject's personal data. It partially complied by granting access to the personal data within it, but did not specify the purpose of processing and the recipients of the data. The data subject appealed the part of the decision concerning the email to the District Court. They argued that merely providing the processed personal data was insufficient and that the access right under Article 15(1) GDPR entitled them to receive information on the purpose of the processing and the recipients of this data. The controller justified its decision by arguing that the data subject asked more than what was required under Article 15(1) GDPR. It also supported its decision by referring to the restrictions under Article 23 GDPR in conjunction with national law (Article 41 UAVG). It further contended that the information requested might not be available or reproducible to begin with. The court annulled the contested decision and ordered the Ministry to adopt a new decision. The court first distinguished between the "right of access under Article 15 GDPR" and the "right of access to administrative documents". The former does not require the controller to disclose the underlying administrative documents, provided that the controller fulfils the purpose of Article 15 GDPR. The purpose of Article 15 GDPR is to enable the data subject to verify the lawfulness of the processing of their personal data. Informatio
A consumer protection organisation filed a case against a mobile phone service provider in Germany. The organisation challenged the provider’s practice of transferring “positive data” about customers to the credit agency SCHUFA. Positive data is information about the existence and proper fulfillment of a postpaid mobile contract. The controller stated that this transfer served the purpose of fraud prevention and credit risk management. The organisation claimed that the transfer violated the GDPR, as it was carried out without the data subject’s consent. It also argued that the provider’s data protection notice was an invalid section of the controller's general terms and conditions under German civil law. The lower courts dismissed the claims. The organisation appealed to the Federal Court of Justice (Bundesgerichtshof - BGH). The BGH dismissed the appeal and confirmed that the transmission of positive data to SCHUFA was lawful under Article 6(1)(f) GDPR. The court held that the controller had a legitimate interest in preventing fraud and assessing credit risk when concluding postpaid mobile phone contracts, particularly those involving the provision of smartphones. It found that consumers could reasonably expect such data transfers in this context. The court explained that the transfer of positive data was minimal and proportional because the information shared was limited and did not reveal private preferences or behaviour. The BGH rejected the organisation’s argument that the transfer aimed to identify “contract hoppers" (people who frequently change contracts to get bonuses), as there was no factual evidence to support this claim. It also held that the proceedings did not need to be suspended pending other cases, as the relevant legal issues had already been clarified by the CJEU in its previous case law (Mousse v CNIL C-394/23; Schufa C‑26/22 and C‑64/22). Regarding the data protection notice, the BGH found that it was not part of the contractual terms but mer
The data subject is a former entrepreneur who appeared in Estonian news articles, including tabloids, due to being photographed alongside celebrities and sharing such photos on social media. Among other thing, the data subject maintained a channel on the Youtube platform promoting their own products. The data subject filed a complaint with the Estonian DPA (AKI) on 29 April 2024 requesting an intervention for the erasure of personal data from a number of articles available online, published by several media outlets (the controllers). In addition, on 2 May 2024, the data subject filed a subsequent complaint with the DPA, asking for intervention for their request to Google (the controller) to de-index the same articles. The DPA rejected the complaints based on the findings that the processing of personal data in the published articles was lawful for journalistic purposes under Article 4 Estonian Personal Data Protection Act (IKS) since the data subject was a public figure and there was public interest in the information, including in the availability of archives. The data subject appealed the decision of the DPA to the Tallinn Administrative Court (Tallinna Halduskohus) seeking to have the DPA decision annulled and their complaint re-examined. The Court noted that the articles listed by the data subject in the two complaints made to the DPA overlapped and therefore decided to analyse them together. The Court found that the DPA had to weigh two rights against each other in reaching a conclusion regarding the complaint. On one hand, the continued publication of the articles containing the personal data of the data subject may infringe upon their right to privacy and the protection of personal data. On the other hand, the anonymisation of personal data in the articles may cause an infringement upon the right to freedom of expression and information. Firstly, the Court referred to the criteria used in the European Court of Human Rights (ECtHR) case of [https:
Apple used identifiers for personalized advertising without obtaining prior user consent, violating ePrivacy Directive requirements.
A journalist requested information from the Vorarlberg State Government (the controller) under the Vorarlberg Freedom of Information Act regarding the locations of election posters and digital election advertising displays used by political parties for the next state election. Under Article 1c(2) of the Vorarlberg Political Party Promotion Act (PFG), political parties were legally required to notify the state government of the locations used for election posters or digital election advertising displays. The journalist stated that the purpose of the information request was to compare the poster locations reported by political parties with a photographic documentation of actual poster locations prepared by several editors of their media outlet. The controller refused this request on data protection grounds. It argued that the map showing election poster locations and the addresses in their descriptions involved special categories of personal data under Article 9 GDPR, as these data could reveal the political opinions of the property owners associated with the respective addresses. The controller also stated that no exemption under Article 9(2) GDPR applied in this case. Additionally, the controller stated that disclosure was not permissible due to the absence of a legal basis. The controller argued that the interest in confidentiality of special categories of personal data prevailed, especially since there was no necessity for the requested information to exercise freedom of expression in accordance with Article 10 of the European Convention on Human Rights (ECHR). The journalist appealed the decision to the Provincial Administrative Court (LVwG) of Vorarlberg. They argued that the intention behind their information request was to determine the geographical focus of the election campaign by assessing the poster locations and had no intention of using the requested data to attribute political views to individuals or entities. The journalist contended that it was in the
A data subject received a COVID-19 vaccination information letter sent by the social insurance institution together with the Ministry of Social Affairs, Health, Care and Consumer Protection. Believing that his vaccination status and contact data must have been unlawfully accessed or shared, he filed a complaint with the Austrian Data Protection Authority (DSB), alleging a violation of his right to confidentiality under [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=1&Paragraf=1&Anlage=&Uebergangsrecht= § 1 DSG] and unlawful processing under Articles 5, 6, and 9 GDPR. He further argued that the controller had failed to comply with the information obligations under Article 14 GDPR, had not concluded a joint-controller agreement with the Ministry, and had not carried out a data protection impact assessment. The DSB dismissed the complaint and the data subject appealed to the Federal Administrative Court, and when that court dismissed his appeal and refused to allow an ordinary revision, he filed an extraordinary appeal with the Supreme Administrative Court. The Supreme Administrative Court examined the data subject’s extraordinary appeal and determined that it raised no legal question of fundamental importance. It agreed with the lower court and the DSB that the social insurance institution, classified as a public law institution, was entitled, under [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008147&FassungVom=2021-08-31&Artikel=&Paragraf=750&Anlage=&Uebergangsrecht= national law], to process the data subject’s data from the central vaccination register on the basis of explicit statutory authorizations, which required the identification of unvaccinated insured persons and the sending of official information regarding health risks and available free vaccines. Moreover, because this legal basis met the requirements of Articles 6 and 9 GDPR, no violation of the data subject’s righ
A data subject was covered by mandatory social insurance in Poland and stayed at a rehabilitation center in 2022. She shortened her stay after the death of her mother and informed the Social Insurance Institution (the controller) to avoid charges for the unused period. On 26 July 2022, a Social Insurance Institution employee accidentally sent an Excel file containing the data subbject’s personal data from their work email to their private email account. The data included her name, ID number, the name of the rehabilitation center, the duration of stay, and the reason for shortening the stay. The file was not encrypted, but the employee deleted it from the private email on the same day. The Social Insurance Institution informed the data subject about the incident, apologised, and explained the potential risks. The data subject feared that her data could be misused for financial or other purposes and took preventive steps such as blocking her bank account and requesting a new identity document. On 16 November 2023, the data subject filed a lawsuit seeking PLN 4,000 (€870) in compensation for non-material harm caused by the breach under Article 82 GDPR and the Polish Civil Code. She claimed that Social Insurance Institution violated her privacy by unlawfully processing her personal data. The Regional Court in Warsaw (Sąd Okręgowy w Warszawie) dismissed the claim in full on 7 October 2025. The court recognised that sending the Excel file breached Article 5 GDPR because the data were not securely transmitted. However, the court explained that a GDPR breach alone does not create a right to compensation. To obtain redress under Article 82 GDPR, the data subject must show that she suffered actual harm and that the harm was caused by the controller’s actions. The court found that the data subject did not prove that any third party accessed her personal data. Her fear of misuse, although genuine, was not reasonable given the circumstances: the file went only to the empl
The law of 2 March 2022 had introduced Article 61-3-1 of the Civil Code, which created a simplified procedure to change one’s surname in France. This reform led to an increase in name changes, which were only registered in civil status registers and not in administrative databases. In response, the French Ministry of the Interior adopted, on 19 December 2023, an Order creating an automated table called “table of correspondence of first and family name”. This table relied on eight categories of information: first name and family name before and after the change, the place and date of birth, the date of the change of name, the gender and, where applicable, the parental link (filiation). On 4 March 2024, the Ligue des droits de l'Homme (LDH) brought a case to the supreme administrative Court against the Minister of the Interior regarding its Order of 19 December 2023, with additional claims filed on 4 June 2024. Issues under the GDPR Firstly, the LDH contended that the processing revealed special categories of personal data within the meaning of Article 9 GDPR. Secondly, it submitted that Article 6(1)(e) GDPR was breached because no sufficiently defined public interest task justified the processing. Thirdly, LDH relied on Article 5(1)(c) GDPR, claiming that the scope of data collected, particularly sex and parental link (filiation), was not limited to what was necessary for the purposes put forward by the State. Fourthly, invoking Article 5(1)(f) GDPR, it maintained that there was a risk of uncontrolled dissemination of the data in view of the potentially large number of services and agents authorised to access the table. Fifthly, under Article 5(1)(e) GDPR, it argued that the principle of storage limitation was not respected, on the basis that the six-year retention period for the personal data was excessive while the three-year retention period for logging data was insufficient. Sixthly, LDH claimed a breach of Article 12 GDPR, asserting that data subjects were not
A data subject sought detailed information from a credit information agency (the controller) about how their credit scores were generated. The controller produced scores using statistical models based on various categories of personal and financial data, while denying the use of sensitive data. In July 2023, the controller gave the data subject their stored data and their scores transmitted to third parties. In August 2024, the data subject demanded damages, recognition that the scoring was unlawful, adjustment of their scores, omission of disclosures, reimbursement of legal fees, and detailed information about the calculation methods. They argued that the scoring system is opaque and that lenders rely so heavily on the score that it effectively dictates whether a consumer can obtain credit, discouraging them from even applying. The Regional Court dismissed the claims. On appeal, the data subject argued that the court had ignored relevant CJEU judgments and that the controller had used characteristics such as age, gender, and residence history. They pointed to large fluctuations in transmitted probability values as evidence of arbitrariness. After withdrawing most of their original claims, they sought only detailed information on how their various scores had been computed on the basis of Article 15(1)(h) GDPR in conjunction with Article 22 GDPR. Specifically, they asked for which personal data and criteria were used, how the criteria were weighted, and what the significance of the resulting scores was, arguing that the information previously disclosed was insufficient because it did not allow them to understand how their scores were determined in detail. The court held that the data subject was entitled to additional, but not complete, information about how his credit scores had been generated. It reasoned that Article 15(1)(h) GDPR, read together with Article 22 GDPR, grants data subjects a right to individualized, comprehensible explanations of the logic, sign
The controller is X Corp., the provider of the social media platform X, formerly known as Twitter. The data subject, an X user, made an access request to X under Article 15 GDPR, requesting access to personal data held about him, including information about automated decision-making (“ADM”) under Article 22 GDPR. His request was not satisfied. The data subject filed a case before the court of first instance (Amsterdam District Court - Rechtbank Amsterdam) demanding the satisfaction of his rights. On 5 July 2024, the court of first instance ordered X to respond to the data subject’s access request and provide details on ADM including specific information about some function of X like “reputation scores”, “labels“ and a particular system (“system y“). X then appealed the decision of the court of first instance before the Court of Appeal (Gerechtshof Amsterdam - AmsterdamCourt of Appeal). X sought the annulment of the contested decision, or in any case the exclusion from the data to be provided, data from which the operation of X's content moderation systems, spam filters and advertising settings could be deducted. X maintained that the court of first instance should not have ordered it to give (full) access to the data processing in the “system y“. According to X the system contains trade secrets and sensitive security information, which if fallen in the wrong hands could lead to abuses of the platform. X had therefore, for the time being, only provided a redacted version of “system y“ to the data subject, in which all confidential information had been deleted. X further requested the court of appeal to impose a disclosure prohibition (gag order - mededelingenverbod) to the data subject within the meaning of the Dutch Code of Civil Procedure (Rv) (Article 28(1)(b)) with regard to the unredacted version of “system y“ that had yet to be submitted. This request covered all information that has been omitted from the full version of the documentation “system y“
A psychiatric-neurological doctor (the controller) made a report in which a data subject was diagnosed with a borderline personality disorder. The data subject claimed that this diagnosis was incorrect, because the controller did not form an independent medical opinion but instead copied a previous assessment made by another psychiatrist, and formally asked the controller to amend the report. The controller rejected the request, affirming that they stood by their professional diagnosis. The data subject then filed a complaint with the Austrian Data Protection Authority (DSB), arguing that the controller violated their right to rectification under Article 16 GDPR. The DSB dismissed the complaint, reasoning that the diagnosis in a medical expert report represents a professional judgment, not a factual assertion. Under Article 5(1)(d) and 16 GDPR, only inaccurate facts can be corrected, not evaluative or interpretative assessments. The data subject appealed this outcome to the Federal Administrative Court (BVwG), arguing again that the diagnosis was medically incorrect and should therefore be rectified. The Federal Administrative Court (BVwG) upheld the DSB’s decision and dismissed the complaint as unfounded. The court explained that the right to rectification under Article 16 GDPR applies only to objectively incorrect factual information. The law does not permit the correction of subjective professional evaluations, which include diagnoses, assessments, or conclusions drawn by medical experts in the course of preparing a report. Such judgments are inherently interpretative and cannot be subjected to an “accuracy check” under the GDPR. Although the data subject believed the diagnosis to be incorrect, the court emphasized that medical diagnoses are value judgments, even if they rely on factual observations. These value judgments cannot be rectified simply because the person concerned or another doctor disagrees. The relevant question is not whether the diagnosis is m
An academic researcher (the data subject) received EU funding for a project. The European Commission was initially a party to the funding agreement, but was later replaced by the European Research Council Executive Agency (ERCEA). The ERCEA later carried out a financial audit and informed the European Anti-Fraud Office (OLAF) of the results. OLAF alleged that the data subject had fraudulently claimed part of the funding for personal expenses, and published a press release on its website. The data subject brought an action to the General Court, requesting compensation from the Commission for the damage caused by the press release. The General Court dismissed the action, and stated that there was no violation of the data subject’s rights. According to the General Court, whether the data subject is identifiable depends on the ‘means reasonably likely to be used’ to identify the applicant as well as whether the ‘average or likely reader’ of said press release would be able to identify them. The General Court did not take into account the journalist that identified the data subject, as it did not fall under the definition of "average reader"See: GC - T‑384/20 - OC v Commission. The data subject appealed the decision to the CJEU. The CJEU held that the General Court had misinterpreted the EUDPR and GDPR; the CJEU dismissed the General Court’s reasoning of the “average reader”, and stated that the information in the press release (such as the data subject’s gender, nationality, grant amount and father’s occupation) allow the data subject to be identifiable.See CJEU - C‑479/22 P - OC v Commission The CJEU referred the case back to the General Court. The Commission argued that the press release is anonymous, does not disclose any personal data of the data subject and does not contain inaccurate data. Therefore, the press release cannot cause the data subject any harm. The Court first clarified that there are three cumulative conditions for the EU to incur non-contractua
The operator of a loyalty program (the controller) provided customers (the data subjects) with the option to collect points in order to receive discounts. During registration, data subjects were asked to consent to their data being used for profiling. Having consent under Article 6(1)(a) GDPR as the legal basis, the controller performed automated analyses of purchasing behavior to personalize advertising. The Austrian DPA (DSB) initiated an ex-officio investigation, conducted an on-site inspection and found that the consent for profiling did not meet GDPR standards under Articles 4(11) and 7 GDPR. The information about profiling was not clearly visible or easy to understand, and the consent was bundled with registration and acceptance of terms instead of being given separately. The DSB declared the processing regarding profiling unlawful since there was no valid consent or other legal basis. The controller was ordered to stop processing data for profiling purposes until it had a valid legal basis and was granted a six-month period for compliance. The controller appealed to the Federal Administrative Court (BVwG), which upheld the appeal and overturned the DSB’s decision. The DSB then appealed to the Supreme Administrative Court (VwGH), which partially overturned the BVwG’s ruling, siding in part with the DSB. The case returned to the BVwG, which rejected the controller’s appeal but modified parts of the DSB’s decision. The controller subsequently appealed against this BVwG decision to the VwGH. The VwGH rejected the controller’s appeal and upheld the BVwG’s decision regarding the prohibition on profiling, confirming that the prohibition was not disproportionate. It only applied to unlawful profiling and did not affect any future processing based on valid consent. The court held that consent was invalid under Article 4 and Article 7 GDPR, because there was bundled with registration and acceptance of terms and the privacy policy, the visual design did not make the
The controller is the Management Centre for Protection and Security, a center offering protection to children, young people and adults in Friesland (Stichting Regiecentrum Bescherming en Veiligheid-RBV). Between 2015 and 2018, several departments of RBV were involved in the data subject's life and therefore created and maintained a file containing his personal data. On 10 June 2024, the data subject, invoking Article 17 GDPR, requested the destruction of the file. RBV agreed, confirming in writing on 26 November 2024 that the file would be destroyed within six weeks. Before the scheduled deletion, on 6 December 2024, the data subject filed a case before the court of first instance (District Court of North Netherlands) seeking immediate destruction of the file. RBV subsequently destroyed the file on 7 January 2025. The court of first instance dismissed the data subject's claim on 5 February 2025 because the RBV had already agreed to and completed the data erasure. The data subject, appealed the decision of the court of first instance before the court of appeal (Court of Appeal Arnhem-Leeuwarden), requesting the court to order RBV to notify other "processors" of his file about its destruction, based on Article 17(2) GDPR. First, the Court held that Article 17(2) GDPR applies only when data have been made public, for instance, published online or in publicly accessible register in a way where others may view or reuse them. Ordinary exchanges of information with authorities or institutions do not amount to “making public,” and thus RBV had no duty to notify other controllers of the deletion of the data under this provision. Second, the Court pointed that Article 19 GDPR requires controllers to communicate the erasure of personal data to each recipient to whom the personal data have been disclosed, and not just processors, without further or specifically directed request from the data subject, unless doing so is impossible or disproportionate. In this case, the