GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Court case W214 2233132-1/27E
A data subject filed a complaint with the DSB claiming a violation of his right to access under Article 15 GDPR. The DSB partially upheld the complaint of the data subject, ordering the controller, an address publisher and direct marketing company, to disclose to the data subject information about the target groups of personal data about him being processed for advertising purposes and the names of the recipients of such data as it failed to fully comply with the access request. The controller then appealed the decision before the BVwG, claiming that it is not obliged to disclose such information. The BVwG started evaluating the case but then suspended the proceedings, pending the decision of the CJEU in case C-154/21 and issued only a partial decision on 17 May 2022 (BVwG - W214 2233132-1/13E) annulling parts of the DSB's decision. In January 2023, the CJEU delivered its judgment in case C-154/21 and the BVwG continued the case in May 2023. Upon hearing further submissions by the parties, the BVwG issued its final decision on the remaining part of the case on 29 November 2023. In the second partial judgment the court considered the two parts of the DSB’s decision that had not already been decided, namely: (2a) the order to the controller to disclose the names of all recipients of the data subject’s personal data and (1) the declaration that the controller violated the data subject’s right to access as it failed to fully comply with his request under Article 15 GDPR. The Court first of all held that, part (2a) of the DSB’s decision should be dismissed, as the controller in its later submissions sufficiently proved that it was impossible for it to identify all recipients of the data subject’s personal data and thus it could and can not comply with the order to disclose their names. As regards part (1) of the DSB’s decision, the BVwG held that, even though it was indeed impossible for the controller to identify the recipients of the data subject's personal data, t
Court case 4 U 347/21
A data subject requested a copy of the personal data about him being stored by his former employer under Article 15(1) and (3) GDPR. The data subject believed that the response by his former employer, the controller, was incomplete and filed suit with the Regional Court of Nürnberg-Fürth. On 29 January 2021, the court dismissed the claim. Unsatisfied with the decision of the court, the data subject filed an appeal with the Higher Regional Court of Nürnberg (Oberlandesgericht Nürnberg, OLG Nürnberg), claiming again that his right to access to all personal data about him saved by the controller. The data subject, as former employee and board member of the controller requested access to personal data about him from January 2000 until September 2016, including, among others, correspondence, calendar appointments, offsetting of company shares and other information related to his role as board member. The OLG Nürnberg held first of all, that the appeal was admissible. Then, the court considered that the access request was sufficiently clear, as it basically reflected the wording of Article 15(1) GDPR and that it is generally not necessary for access requests to specify the data requested. Then, the court also considered that personal data about a data subject cover all information that is connected to that person, because of its content, purpose or effects. Further, making reference to C-307/22, the court clarified that the right to access under Article 15 GDPR is “without prerequisites”, meaning that a controller should grant access to personal data that is needed also for purposes other than those included in Recital 63 GDPR. Moreover, the court held that the access request cannot be considered an abuse of the data subject’s rights, since the right to data protection is a fundamental right and having access to one’s personal data is a way of protecting such right. The fact that, because of the long term of employment of the data subject, the personal data about hi
Ex-employee (data subject)
The data subject was employed by the controller in December 2016. In October 2022, the data subject requested access to their personal data under Article 15 GDPR, which the controller complied with. The data subject then sent another request and set a deadline until 16 October 2022. The controller did not respond by that date, and after multiple reminders and new deadlines, it provided a response that was delayed and incomplete, missing data on storage duration and recipients. The controller later supplemented the information by early December 2022. The data subject claimed that the controller violated its Article 15 GDPR duties by failing to provide timely and complete information, causing immaterial harm (loss of control over data). They sought compensation under Article 82 GDPR. In the previous decision, the lower court awarded €10,000. The controller appealed the decision. First, the court held that a delayed or initially incomplete data access response does not constitute “data processing” as defined in Article 4(2) GDPR. It pointed out that a missed or belated answer is not an active processing act but “non-processing” of data, and thus cannot trigger compensation under Article 82 GDPR, which requires an actual unlawful processing breach. The court also held that an immaterial damage claim must be tied to concrete harmful processing. Generalized assertions like “loss of control” or “frustration” are insufficient and must be proven. As a result, the court amended the first-instance decision and dismissed the data subject’s claim for non-material damages. Revision (appeal) to the Federal Labour Court was permitted.
Court case W214 2222613-2
A credit reference agency (the controller), acting under Austrian law (Article 152 of the Law on business activity - [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10007517 Gewerbeordnung]), created an identity and creditworthiness database. Using the collected data, the controller assigned individuals with a creditworthiness score. Apart from identifying data, the controller processed a final score and the “interim” scores, used to create the final one. The database was framed and logically prepared within the Microsoft SQL Server software. The database consisted of various tables, defined and related to each other. The design of the database aimed at maximizing the performance of the database, inter alia by avoiding redundant storage of data. One of the people whose data had been collected in the database (the data subject) exercised their rights under Article 12 GDPR and Article 15 GDPR with the controller. They requested details on the processing activities pursued and the copy of the data in a “standard technical format”. The controller answered the access request and provided the data subject with the details of processing activities, in particular, the source of the data, data recipients, the creditworthiness score. The data subject, unsatisfied with the answer, lodged a complaint with the Austrian DPA (DSB) regarding the violation of Article 14 GDPR and violation of Article 15 GDPR, indicating the controller didn’t provide them with the copy of the data. The DPA dismissed the case. The DPA’s decision was appealed by the data subject with the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). In the meantime, the controller supplemented the information sent to data subject, explaining retention period, criteria of data deletion, and claiming that in previous six months there were no inquiries regarding the creditworthiness of data subject. During the proceedings before the court, the controller provided
Court case 5 Ca 877/23
A data subject applied for an open position at a credit agency in 2017. On 18 May 2023, the data subject made an access request under Article 15 GDPR giving the controller a two-week limit to reply. The controller did not respond within the deadline and the data subject reminded the controller of his access request. On 5 June 2023, the controller replied to the request, stating that it did not process any of the data subject’s personal data. The data subject then got back to the controller asking why it took so long to respond to his access request and the controller replied stating that it lawfully replied within the time limit foreseen in Article 12(3) GDPR. Still, the data subject believed that the controller violated Article 12(3) GDPR’s requirement that controllers provide information on data subjects’ requests “without undue delay”. In the data subject’s opinion, the one-month deadline of Article 12(3) GDPR is a maximum deadline; if it wasn’t so, the “without undue delay” would lose its meaning. In the data subject's view, in absence of particular circumstances, this means that controllers should answer within a week. Also, given the simplicity of the access request, the controller in this case should have been able to respect the two-week limit set by the data subject. The data subject claimed to be entitled to immaterial damages under Article 82(1) GDPR, as it suffered a temporary loss of control over his personal data and not knowing whether personal data concerning him were being processed, he could also not know whether the controller was lawfully processing his data or not. The data subject further claimed to have suffered emotional damages. For these reasons, he asked the controller for compensation in the amount of €1,000, which the controller refused to pay. The data subject then filed suit in the Labour Court of Duisburg (Arbeitsgericht Duisburg- ArbG Duisburg) in order to obtain compensation of at least €2,000 from the controller. In its submissi
CJEU case C‑307/22 FT (Copies of medical records)
The case involved a dispute between a patient (DW) and a healthcare practitioner (FT) regarding access to the patient's medical file. DW is the data subject and FT the controller. DW received dental care from the controller and suspected errors during the treatment. DW requested a free copy of their medical file from FT. FT insisted that DW should bear the costs associated with providing the copy, in accordance with German national law. Initially, DW's request for a free copy was granted, as the first-instance court based their interpretation of German national legislation in light of Article 12(5) and Article 15(1) and 15(3) GDPR. FT appealed this decision to the Bundesgerichtshof (Federal Court of Justice, Germany). The court stated that the solution to the dispute depends on the interpretation that should be given of the provisions of the GDPR. Therefore, the Bundesgerichtshof referred the case to the CJEU as a preliminary reference with the following questions: 1. Does the GDPR (Article 15(3) GDPR, read in conjunction with Article 12(5) GDPR) require the practitioner to provide a free copy of the patient's personal data when the patient's request is for a purpose other than those mentioned in the GDPR under recital 63? For example in this case, requesting a first copy of their medical file in order to hold a medical practitioner liable? 2. If the answer to the first question is negative: a) Can a national provision adopted before the GDPR came into force restrict the right to receive a free copy of personal data granted by the GDPR?In this case the rights granted by reading first sentence of Article 15(3), in conjunction with Article 12(5) of the GDPR under Article 23(1)(i) GDPR. b) If the answer to a) is positive, do the 'rights and freedoms of others mentioned under Article 23(1)(i) GDPR include being relieved of the costs and charges associated with providing a copy of the data? c) If the answer to b) is positive, does a national regulation that gives the doctor a right to reimbursement of costs from the patient for providing a copy of the patient's personal data, constitute a restriction on the rights and obligations provided by the GDPR? 3. If the answer to the first question and the second question (a) to (c) is negative, does the the first sentence of Article 15(3) of the GDPR mean that the patient has the right to receive copies of all parts of the medical file containing personal data, or is it limited to a copy of the patient's personal data, allowing the treating physician to decide how to compile the data concerning the patient? On the first question the court stated that Article 12(5) and Article 15(1) and (3) GDPR imposes an obligation on controllers to provide the data subject, free of charge, with a first copy of his or her personal data being processed. Article 12(5) GDPR, already considers two reasons why a controller may either charge a reasonable fee or refuse to follow up on a request. These reasons relate to cases of abuse of rights, in which the requests of the person concerned are "manifestly unfounded" or "excessive", in particular because of their repetitive nature. In this case, the referring court had already noted that the request of the person concerned was not unfair. A data subject's right of access is guaranteed by Article 15(1) GDPR. The court used Article 15(4) to read Article 15(3) as conferring a 'right' to the data free of charge. Payment can therefore be required by the controller only when the data subject has already received, free of charge, a first copy of his or her data and requests it again. Furthermore, as Article 15(3) GDPR outlines, this copy should be a faithful reproduction the personal data, understood in a broad sense, that are subject to operations that can be classified as ‘processing carried out by the controller’.(judgment of 4 May 2023, Österreichische Datenschutzbehörde and CRIF, C‑487/21, EU:C:2023:369, paragraph 28). Thus, a combined reading of Article 12(5) and Article 15(1) and (3) GDPR confirms the right of the data subject to obtain a first free copy of his or her personal data being processed. It also confirms exemptions to this general rule. Under certain conditions, the controller can charge reasonable fees taking into account administrative costs, or refuse to comply with a request if the latter is manifestly unfounded or excessive (as outlined in Article 12(5) GDPR). Importantly, the court confirms that the above obligation remains valid even when the DSAR request is motivated for a purpose unrelated to those referred to in the first sentence of recital 63 GDPR. Neither the wording of Article 12(5) GDPR nor that of Article 15(1) and (3) GDPR condition the provision (to access the first copy of their personal data free of charge) on a reason to justify the requests (see paragraph 38). It follows that the person concerned is not required to give reasons for the request for access to the data. The first sentence of recital 63 cannot be interpreted as meaning that a request must be rejected if it is intended for an objective other than that of taking knowledge of the processing of the data and verifying its lawfulness. In this manner recital 63 cannot restrict the scope of Article 15(3) GDPR (see paragraph 35). On the second question Article 23(1)(i) GDPR must be interpreted to mean that national legislation adopted before the entry into force of the GDPR is likely to fall within the scope of this provision. However, such an option does not allow the adoption of national legislation which, in order to protect the economic interests of the controller, charges the data subject for the costs of a first copy of his or her personal data subject to such processing. Article 23(1) GDPR does not exclude from its scope national legislative measures adopted before the entry into force of the GDPR, provided that they meet the conditions the GDPR prescribes. The court agreed that Article 23(1)(i) GDPR places a limitation on the scope of Article 15 GDPR. Consequently the right granted to the data subject to obtain a first free copy of his or her personal data being processed is not absolute. However, this limitation is related to the protection of the rights and freedoms of others. Thus, an objective related to the protection of the economic interests of practitioners is not sufficient to justify a limitation of the right enshrined by Article 15 GDPR. This is further substantiated by the fact that these interests even have the consequence of deterring patients from making legitimate requests for a copy of their medical record, As to the last question, already in C-487/21 F.F. v DSB the CJEU decided that the right to a copy under Article 15(3) GDPR entails that data subject must be given a faithful and intelligible reproduction of all their personal data. This may include, to the extent that it is necessary to protect their rights and interests, copies of extracts from documents, entire documents or extracts from databases. Here the CJEU extends this principle to the the context of a doctor/patient relationship, and in doing so seems to limit it. The patient has the right to obtain a full copy of the documents in his/her medical record, where it is essential in order to understand the personal data which those documents contain.Para 79 of the judgement states: 'the right to obtain a copy of personal data undergoing processing means that the data subject must be given a faithful and intelligible reproduction of all those data. That right entails the right to obtain a full copy of the documents included in his or her medical records and containing, inter alia, those data if the provision of such a copy is essential in order to enable the data subject to verify how accurate and exhaustive those data are, as well as to ensure they are intelligible'. This right includes information such as diagnoses, examination results, opinions of treating doctors and any treatment or intervention administered to him or her.
ING Bank
In December 2005, the data subject took out a €202,500 mortgage for a house with ING Bank (the controller). In 2008, the data subject faced financial hardship and could no longer pay off the mortgage, and had to declare bankruptcy. In 2009, the house was sold at auction for €147,788, which left the data subject with a residual debt of €77,575 (due to accrued interest). The data subject enrolled in a debt-assistance programme that they completed in 2021. By this time, ING Bank had received €72,000 from the data subject and wrote off its claim. Despite that, ING Bank still had the data subject negatively registered in the Central Credit Information System (CKI) of the Bureau Krediet Registratie (BKR). BKR is the body which collects and manages all credit data in the Netherlands. On 6 December 2022, the data subject made an erasure request under Article 17 GDPR and an objection under Article 21 GDPR to have their negative registration no longer processed and removed. ING Bank refused both requests. In particular, ING argued that its legitimate interest in recording the data subject’s credit history overrode the data subject's right to be forgotten. On 19 April 2023, the data subject filed a claim with the Amsterdam District Court. The Court held that the interests of the data subject overrode those of ING Bank (the controller) in relation to the erasure request. In reaching its conclusion, the Court undertook a balancing test to determine whether the Bank had sufficiently demonstrated compelling legitimate grounds for processing which were capable of overriding the data subject’s interests and rights. In the balancing test, the Court determined the scope of the controller's legitimate interest through the purposes behind the Bank’s credit registration system. The Court understood the purpose of the credit registration system to be twofold: 1. To protect consumers from taking on too much debt; 2. To protect lenders against consumers who do not or cannot fulfil their financial re-payment obligations. ING submitted that its legitimate interest in maintaining the registration with BKR outweighed the data subject’s interests, as the data subject had a problematic debt situation for several years and as a result had low creditworthiness. Consequently, maintaining their negative registration fulfilled the purpose of credit registration system. The Court held that ING’s grounds did not constitute compelling legitimate grounds which could override the data subject’s legitimate interests. As the data subject had improved their credit worthiness and paid off their debts, the bank no longer had a legitimate interest in having them registered negatively because this was in opposition to the system's purpose The Court took into consideration that the data subject had sought help for the debt and had managed to pay it off. Moreover, the Court also took into consideration that the bankruptcy arose following a significantly bad economic period after the 2008 financial crash. As a result, ING’s did not have a compelling legitimate interest in maintaining the registration, and thus, their interests did not override those of the data subject. As a result, the Court ordered ING to fulfil the data subject’s erasure request within one week of the ruling.
Court case 7 K 2578/22
A data subject took a test to a German University in order to be admitted to a Degree in Medical studies. The data subject sent an e-mail to the coordination office for the test, submitting that he had taken the test in Frankfurt on 7 May 2022 and requested a copy of his examination file as it contained personal data about him, in accordance with Article 15(3) GDPR and citing CJEU case C-434/16. On 15 June 2022 the coordination office replied to the e-mail giving an overview of the personal data about him that were being stored and a scan of the information on test processing. In addition to this, the office sent him a copy of the test booklet where the content of the test was blackened but his answers and notes were readable. The data subject replied to the e-mail complaining about the blackening of the test questions and he asked to receive a copy of the test including the questions too, within a week. As he did not get a reply within one week he sent another e-mail to the coordination office stating that he would file suit with the Administrative Court of Karlsruhe (Verwaltungsgericht Karlsruhe - VG Karlsruhe). The office replied that they believed that such a request might be unfounded or excessive and they could not provide any more information than what they did. On 03 August 2022, the data subject, hereinafter the plaintiff, filed suit with the VG Karlsruhe asking to obtain a non-redacted copy of the test he took under Article 15(3) GDPR, not to delete certain data about him and requesting access to other information about the testing procedure. As regards the test questions, he submitted that even though questions per se do not constitute personal data, the multiple choice answers he chose to tick do reflect his own choices and thus can constitute personal data. In its submissions, the test coordination centre, as a defendant, argued that it complied with the access request under Article 15(3) GDPR by providing the plaintiff with a copy of the test booklet
Court case ECLI:NL:RBZWB:2023:7274
The data subject owned a mobile home, which was permanently pitched at a campsite. Between 31 March 2021 and 4 November 2021, the Municipality of Oisterwijk's tax authority charged the data subject for municipal taxes of sewerage and commuter tax. The data subject objected to the taxes through the Municipality's objection procedure. The data subject founded his objection on GDPR grounds and made the following claims: (i) he made an Article 15 GDPR access request, (ii) claimed that the taxes were invalid as they were calculated through automated means, and invoked his right not to be subject to automated decision-making under Article 22 GDPR, and (iii) made an erasure request under Article 17 GDPR. On 22 March 2022, the Municipality responded to the data subject's objection and provided him with a copy of his data held by them, in the context of the calculation of the commuter and sewerage tax charges. The Municipality rejected the data subject's Articles 17 and 22 GDPR requests. The data subject objected to the Municipality's response and appealed it to the Court of East Brabant. The Court held that the Municipality was entitled to reject the data subject's erasure request (Article 17 GDPR) and their Article 22 GDPR claim. In relation to Article 17 GDPR, the Court held that the Municipality had a legitimate aim in retaining the data and assessing whether the data subject could be rightly classified as a taxable person. Moreover, the Municipality was legally obligated to retain the data under national administrative law (Article 17(3)(b) GDPR). On the issue of Article 22 GDPR, the Court held that the Municipality had adequately demonstrated that all automated tax calculations were subject to sufficient human intervention, and thus did not fall under the scope of Article 22 GDPR. Consequently, they were entitled to reject the data subject's Article 22 GDPR claim.
Court case W256 2275675-1
On 9 March 2023, a data subject asked the Arbeitsmarktservice (the public employment service), as a controller, to change their gender on the platform from “male” to “divers”. In this, the data subject also submitted an official document proving the change of gender entry in the civil register. On 15 March, the controller replied that it could not do so as it was impossible to with the software used. A few days later, the data subject filed a complaint with the Austrian DPA (DSB) claiming that their right to rectification under Article 16 GDPR had been violated. In its submissions, the controller stated that it was planning to implement a system allowing to change one’s gender on the platform, but this would only be available in June 2023, that is, still within the deadline of additional two months foreseen in Article 12(3) GDPR. The controller claimed that, once the technical changes will be implemented, it will proceed to change the data subject’s gender. The data subject submitted that the controller could have complied with their request by June 2023, if the controller would have informed the data subject about the additional time needed, even though the controller actually had enough time before that in order to duly adapt its technical system. Since the controller did not do that, but instead answered that they will not follow the request, Article 12(3) GDPR is not relevant. Later, however, the controller let the DSB know that it would take it even longer to adopt the technical implementations required to allow the data subject to change their gender on the platform. The DSB, however, suspended the proceedings on the basis of [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10005768&FassungVom=2017-07-12&Artikel=&Paragraf=38&Anlage=&Uebergangsrecht= Article 38 of the General Administrative Procedures Act (AVG)] until the CJEU delivers its judgment on the preliminary questions in case C-247/23, received on 18 April 2023, which concerned the interpretation of Article 16 GDPR. The data subject claimed that the DSB was not allowed to suspend proceedings since the case pending before the CJEU was not relevant to the procedure in question. Hence, the case was submitted for review to the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG held that the DSB may have a right to suspend administrative proceedings under [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10005768&FassungVom=2017-07-12&Artikel=&Paragraf=38&Anlage=&Uebergangsrecht= §38 AVG] and in line with the jurisprudence of the Supreme Administrative Court, also in case of a pending preliminary ruling before the CJEU, where such ruling is decisive for the administrative proceedings in question. To be considered decisive for administrative proceedings, a pending ruling by another court or authority must first be a decision concerning a question that is necessary in order to answer the main query in the proceedings; secondly, the pending decision must be binding on the authority. The questions referred to the CJEU did concern the interpretation of Article 16 GDPR, but as regards the obligation to change a data subject’s gender in a registry upon request. In the case at hand, however, the controller did not refuse to do so, but it stated that it will do so once the technical implementations necessary thereto are adopted. In the case at hand, the issue regards a delay in complying with the data subject’s request of rectification, the question being whether the controller has a right to delay compliance with the request by another 2 months as foreseen in Article 12(3) GDPR. The preliminary ruling by the CJEU, thus does not have a decisive impact on the proceedings, as it deals with different matters that are not relevant for the DSB to take a decision. The BVwG further clarified that, generally, in order to suspend proceedings before an authority it is sufficient there is at least a “similar” question pending before another court. However, the mere fact that in this case the two procedures both dealt with questions regarding Article 16 GDPR did not make them sufficiently similar, as the actual object of the procedures differed substantially. The BVwG thus annulled the suspension of proceedings by the DSB.
S-Bahn Berlin
The controller in this case is the operator of the Berlin S-Bahn train network. Its trains are provided with CCTV cameras and the recorded data is saved for 48 hours and then automatically deleted unless requested by law enforcement authorities. A data subject visited a train of the controller on 6 October 2020 and on the same day sent an e-mail to the controller requesting access to the CCTV recordings of the train she was on and asked not to automatically delete the recordings after 48 hours. The controller refused to do so since, it claimed, it can only provide such data to law enforcement authorities. The data subject then complained to the Berlin DPA (Berliner Beauftragte für Datenschutz und Informationsfreiheit - BlnBDI), which issued a reprimand against the controller for violating the right to access of the data subject under Article 15 GDPR. Following the decision, the controller, hereinafter the plaintiff, appealed the decision by the Berlin DPA, as a defendant, before the Berlin Administrative Court (Verwaltungsgericht Berlin - VG Berlin). In its appeal, the plaintiff claimed, among others, first, that its video recordings do not constitute personal data under the GDPR as the individuals are not identifiable; secondly, that even if they were to be considered identifiable perosnal data, the effort to fulfill such requests is disproportionately high making also reference to Article 11(1) GDPR, which states that controllers are not required to process further information in order to comply with an access request. Through this legal action, the plaintiff sought the annulment of the reprimand and a court ruling stating that it is not obliged, in any case, to retain CCTV recordings for more than 48 hours and make them available to data subjects requesting access. The Berlin VG ruled, first of all that the plaintiff was not obliged to provide the data subject with the CCTV video recorings in question. The court recognised that the data included therein doe
Court case PVN-2023-06
In June 2019, A had sent a request to Hospital X containing 18 points in which she wanted her son's medical records to be amended or supplemented. In a letter to A dated July 8, 2019, the hospital complied with two of these points. The other requests for correction/supplementation were rejected. The County Governor also approved the hospitals decision. In November 2019, A complained to the Data Protection Authority. The complaint was extensive and concerned several different data controllers. This case concerns a claim for rectification of medical records at Hospital X. On April 26, 2021, the Data Protection Authority asked Hospital X to provide an account of the case processing at the hospital and the assessments that had been made in relation to the complainant's deletion and rectification claims. Hospital X provided an account in a letter dated May 21, 2021. On July 15, 2022, the Data Protection Authority concluded that Hospital X had fulfilled its obligation to rectify/supplement and closed the case. On August 21, 2022, A filed another complaint against the DPA's decision. The DPA considered the complaint, but found no grounds to change its decision. The DPA referred the case to the Data Protection Board on April 19, 2023. The Board upheld the DPA's decision. The conclusion is that the right to rectification was fulfilled by the hospital pursuant to Article 16 GDPR. Firstly, it follows from the Health Personnel Act that health-related assessments, including assessments of the accuracy of medical records, must be made by the health enterprise and possibly by the state administrator. It is the health personnel who perform the health care who are obliged to keep patient records and who must assess what is relevant and necessary information about the patient and the medical assistance, cf. sections 39 and 40 of the Health Personnel Act. In this case, the County Governor (now the State Administrator) has already upheld the hospital's assessment, cf. section 42 of the Health Personnel Act. Secondly, the data protection legislation does not give either the Data Protection Authority or the Data Protection Board the authority to review information in patient records for the purpose of ordering changes to the content of a record at the request of a patient or his/her relatives. Which information belongs in a medical record and what should be archived elsewhere is not regulated by data protection legislation and cannot be determined by the DPA or the Data Protection Board. Lastly, the Board agrees with the Data Protection Authority's assessment that the hospital has processed the submitted requests for correction and supplementation in a manner that meets the requirements of the data protection regulations pursuant to Article 16 GDPR.
Court case W176 2265088-1
A data subject submitted a request to the controller, a credit agency, to delete personal data relating to her. The data in question referred to three debts in the amounts of around €24, €35 and €1,000 which she had paid off by the time the complaint was filed. The controller responded that it would not delete such data and submitted that its processing activities relate to credit data which is relevant for establishing creditworthiness of data subjects on the basis of Article 6(1)(f) GDPR, as it has a legitimate interest to provide third parties, whose activities entail a credit risk, with accurate credit data. For these third parties it is essential to consult the database provided by the controller, in order to be able to assess the payment behavior of their potential contractual partners, such as the data subject in this case. The controller claimed that it is important to keep data relating to, among others, unpaid bills in their database, as they significantly increase the chances of future default and thus constitute relevant credit data. For the sake of accuracy under Article 5(1)(d) GDPR, the controller submitted that it is important to also keep records of debts that have been paid off, in fact, if the controller were to delete data relating to already settled debts of the data subject, this would create a distorted picture of her creditworthiness. In this case, the data subject had been sent several reminders by creditors before she actually settled her debts, whereby the creditors had to put debt recovery measures in place and suffered temporary damages from the unpaid bills. In the present case, the debts had been settled in 2019 and 2020, after being left unpaid for about three years. On 5 August 2022, the data subject brought a complaint with the DSB following the refusal by the controller to delete credit data relating to her, claiming also that the controller failed to inform her that data relating to her credit history were being saved for up to
Court case W214 2275073-1
On 15 May 2023, a data subject filed an access request via e-mail to a controller, the operator of a gambling website, in accordance with Article 15 GDPR. Unsatisfied with the response by the controller, the data subject filed a complaint with the Austrian DPA (DSB). The DSB, however, issued a decision stating that it suspended proceedings against the controller until the lead supervisory authority in the case had decided. According to the DSB, the object of the complaint referred to a matter of competence of the authority in which the controller had its main establishment under Article 56(1) GDPR, which, in the case was the Maltese DPA. The DSB held that in such circumstances it is obliged under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 Article 24 of the Austrian Data Protection Law (Datenschutzgesetz - DSG)] to suspend the complaint procedure. The data subject instead was of the opinion that the DSB should have dealt with the case as the requirement of Article 56(2) GDPR was met. In fact, the complaint in this case substantially affected only data subjects in Austria. Also, the data subject argued that neither [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 Article 24(10) DSG] nor [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10005768&FassungVom=2017-07-12&Artikel=&Paragraf=38&Anlage=&Uebergangsrecht= Article 38 of the General Administrative Procedures Act (AVG)] provided for a legal basis for suspending proceedings. For these reasons, the data subject appealed the decision of the DSB before the Federal Administrative Court of Austria (Bundesverwaltungsgericht - BVwG). First of all, the BVwG clarified that the case clearly dealt with cross-border processing activities. The BVwG then reiterated that the handling of cross-border complaints involves three main steps: first, the roles of different authorities as concerned or lead supervisory authority are defined; secondly, the lead supervisory authority initiates the cooperation mechanism and takes a binding decision; lastly, the decision is communicated to the data subject. The DSB claimed that under Article 56(1) GDPR as well as [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 Article 24(10) DSG], while the competence of the lead supervisory authority is being established or during a procedure in which a lead supervisory authority is competent, the complaint procedure before the authority with which the complaint was lodged is to be suspended ex officio. However, the data subject rightfully pointed out that [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 Article 24 DSG] does not provide a legal basis for suspending proceedings but merely states that the time deadlines are suspended during an Article 56, 60 or 63 procedure. Also, the procedure could not be suspended in accordance with [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10005768&FassungVom=2017-07-12&Artikel=&Paragraf=38&Anlage=&Uebergangsrecht= Article 38 AVG], which foresees that a procedure can be suspended if another authority or court is to issue a binding decision which is essential for the authority to issue its own decision. This could be the case, for instance, if the EDPB were to issue a binding decision regarding the competence of the lead supervisory authorities under Article 65 GDPR. However, in the case at hand the BVwG stated that since neither a cooperation mechanism under Article 60 GDPR nor a procedure under Article 65 GDPR were initiated, it did not have to elaborate on the circumstances allowing for the proceeding to be suspended. Further, the BVwG agreed with the data subject that Article 60 GDPR does not foresee that the only competent authority is the supervisory authority of the main establishment of the controller. Instead, it foresees that all concerned authorities collaborate in the procedure, meaning that, also in this case, a suspension of proceedings is not envisaged. So, the BVwG concluded, the contested decision by the DSB should be rectified accordingly.
DSB (DPA)
On 05.09.2019, the Austrian DPA (DSB) notified the controller of a customer loyalty program that they were initiating an ex officio investigation. The controller responded by answering the provided questionnaire and submitting further documents. On 23.10.2019, the DPA ruled that the investigation was justified and that the declaration of consent for profiling using certain registration methods (website, app, partner company store, flyer) did not comply with the requirements of Article 4(11) GDPR and Article 7 GDPR, nor were they provided in an intelligible way. If a contract covers several aspects, the declaration of consent must be clearly distinguishable. Regarding the website and flyer, the following was found: The website says 'Enjoy your personal benefits' without providing clear information that 'personal benefits' involves profiling. In an embedded box, the relevant points were merely referred to. Information regarding profiling was only accessible by scrolling down further. Concerning the flyer, the following information was provided under the signature field: 'This signature only applies to the declaration of consent and is voluntary. Your registration [...] is also valid without a signature.' Thus, it conveyed the impression that a signature was required to confirm the registration. Consequently, the controller was required to amend the declaration and to cease using any obtained consents for the purpose of profiling prior to 01.05.2020. The controller lodged a complaint. In addition to other information, the controller stated that the data processing was in accordance with Article 6(1)(a) GDPR, and that they had a legitimate interest under Article 6(1)(f) GDPR. The DPA ruled a preliminary decision on the complaint, thereby changing the ruling that the website and flyer did not meet the requirements under Article 6(1)(a) GDPR, and thus, the processing of personal data, collected in that cases, was forbidden. The other methods ensured that the consent was clearly separated from the rest of the registration process. The controller then filed a request for referral to the court, arguing that the DPA had exceeded their corrective powers by prohibiting the processing of the data. Furthermore, the data processing for profiling would be used to manage customer memberships under Article 6(1)(b) GDPR. Following their view, processing under Article 6(4) GDPR was applicable. Additionally, the controller denied the DPA's view that a violation of the principle of good faith would foreclose a weighing of interests under Article 6(1)(f) GDPR. The court quashed the preliminary decision as the DPA had not examined the other grounds of justification for data processing under Article 6(1) GDPR in their initial decision. The DPA then lodged an appeal to the Austrian Supreme Administrative Court (Verwaltungsgerichtshof), which overturned the court's ruling ([https://ris.bka.gv.at/Dokument.wxe?ResultFunctionToken=844801d7-ae74-4038-8071-841905f3f78f&Position=1&SkipToDocumentPage=True&Abfrage=Vwgh&Entscheidungsart=Undefined&Sammlungsnummer=&Index=&SucheNachRechtssatz=True&SucheNachText=True&GZ=Ro+2021%2f04%2f0033&VonDatum=&BisDatum=17.07.2026&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Dokumentnummer=JWT_2021040033_20220208J00 VwGH 08.02.2022, Ro 2021/04/0033]). It was the court's responsibility to examine the potential legal bases, rather than overturning the DPA's decision. Therefore, the case was returned to the court. In the meantime, the controller complied with the preliminary decision by deleting the affected personal data in 2021 and changing their registration process in 2020. First, the court found that they had to formally rule on whether the DPA's decision was lawful at the time it was ruled. It is not to be considered that the controller complied with the administrative decision and fulfilled the required steps ([https://www.ris.bka.gv.at/Dokument.wxe?Abfrage=Vwgh&GZ=Ra+2022%2f06%2f0056&SkipToDocumentPage=True&SucheNachRechtssatz=False&SucheNachText=True&ResultFunctionToken=c2bc8e93-e95d-4a66-b3b8-643a4325eae3&Dokumentnummer=JWT_2022060056_20220428L00 VwGH 28.04.2022, Ra 2022/06/0056]). Second, the court held that the controller did not comply with the transparency requirements regarding the layout of their declaration of consent under Article 7(2) GDPR in both cases (website, flyer). Third, the court ruled that they could not agree with DPA's view, that an invalid declaration of consent always constitutes unlawful data processing and that a review of other grounds of justification would not be necessary ([https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252 CLEU in 'Meta Platforms and Others' (C-252/21) ECLI:EU:C:2023:537]). Further on, the Supreme Administrative Court ruled that both, the DPA and the court are required to examine the presence of other grounds ([https://ris.bka.gv.at/Dokument.wxe?ResultFunctionToken=844801d7-ae74-4038-8071-841905f3f78f&Position=1&SkipToDocumentPage=True&Abfrage=Vwgh&Entscheidungsart=Undefined&Sammlungsnummer=&Index=&SucheNachRechtssatz=True&SucheNachText=True&GZ=Ro+2021%2f04%2f0033&VonDatum=&BisDatum=17.07.2026&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Dokumentnummer=JWT_2021040033_20220208J00 VwGH 08.02.2022, Ro 2021/04/0033]). Fourth, the court held that the controller could not base their appeal on Article 6(4) GDPR as the data processing did not satisfy the grounds of justification, nor were other grounds apparent. Inter alia, following the CLEU's preliminary ruling in [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252 'Meta Platforms and Others' (C-252/21) ECLI:EU:C:2023:537], three cumulative requirements must be met for data processing under Article 6(1)(f) GDPR: (1) The controller or a third party must have a legitimate interest, (2) which requires the processing of that personal data, (3) and 'the fundamental rights and freedoms of the data subject' must not outweigh those interests. There were no doubts about the controller's legitimate interest in processing the personal data in question for targeted marketing purposes, as this was both necessary and reasonable. However, the data subject should have been notified about profiling. The wording 'only if the member consents' did not constitute such a notification, and therefore the data subjects were not to be expected that their personal data was used for profiling purposes. Furthermore, the controller explicitly excluded it in their general terms and conditions. Hence, the data subject's right to secrecy overrode the controller's legitimate interest. In summary, the court dismissed the controller's complaint. Last, the court held that an appeal to the Supreme Administrative Court was admissible under [https://ris.bka.gv.at/eli/bgbl/1930/1/A133/NOR40201324?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=B-VG&Gesetzesnummer=&VonArtikel=133&BisArtikel=&VonParagraf=&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=17.07.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=6de721aa-e72c-4f30-ab00-f9dcd1f2f196 Article 133(4) B-VG], as no prevailing case law concerning the implementation of a declaration of consent existed. Hence, the decision relied on a legal question of fundamental importance.
Court case IV ZR 177/22
The data subject is contesting the validity of insurance premium increases in his private health insurance. He has filed a lawsuit demanding that the controller (defendant insurer) provide information about all premium increases from 2013 to 2016. This includes submitting documents that detail the amount of each increase, the specific tariffs involved, the letters sent to him with explanations, the amendments to the insurance policy, and the accompanying leaflets. This request is part of a step-by-step legal action in which he also seeks a declaration that the specified increases are invalid and the payment of an amount to be determined after the information is provided. The LG Gießen dismissed the lawsuit, but the OLG Frankfurt ruled in favor of the plaintiff, ordering the defendant to provide the requested information. The defendant has appealed this decision. The appeal is partially successful, resulting in the overturning of the OLG Frankfurt's decision concerning the information claim. According to the principle of good faith and fair dealing, an insurance policyholder may be entitled to information about past premium adjustments. To establish this right, it must first be shown that the policyholder could still have refund claims from previous premium increases if those increases were invalid, forming the basis for the request. Additionally, the policyholder must no longer have the relevant documents and be unable to reasonably obtain the necessary information independently. If these conditions are met, a determination must be made, taking into account the reasons for the loss of documents, whether the policyholder is justifiably uncertain about their rights. The policyholder must present and prove these relevant circumstances. However, a claim to a copy of the entire explanation letters and attachments cannot be derived from Article 15(1), (3) GDPR, as neither the letters themselves nor the attached documents in their entirety are considered personal data of
Court case W256 2234851-1
On 22 February 2019, a data subject submitted an access request to the controller, a logistics and postal service provider acting in its capacity as an address publisher and direct marketing company, that initially did not answer his request at all. Against this background, the data subject filed a complaint with the DSB. After hearing the controller, the DSB established that it did reply to the access request and it considered the complaint to be without object. In response to this, the data subject claimed that such answer was incomplete, as it did not receive information about the data recipients and of the existence of profiling. The DSB thus considered the complaint anew, as the claimed infringement changed to incomplete provision of information under Article 15 GDPR. In its submissions, the controller held that it did provide information about the categories of recipients and it did not inform the data subject about profiling, as it did not carry out such activities. The DSB partially admitted the complaint, holding that the controller infringed the data subject’s right to access as it did not provide sufficient information as to the data recipients, without explaining why providing such information would affect her protected interest as an address publisher. It also held that the controller failed to provide meaningful information about the logic involved and the scope and effects of processing according to Article 15(1)(h) GDPR as regards the marketing classification, which is to be considered “profiling” under Article 4(4) GDPR. The DSB thus ordered the controller to duly inform the data subject about the above mentioned within a period of four weeks. The controller still believed the information it provided to be complete, since it lawfully chose to provide information about the categories of recipients and not the recipients themselves and it considered that marketing classifications do not constitute personal data and that it did not carry out profiling activities. The controller thus appealed the DSB decision before the BVwG. However, on 9 March 2023, before the BVwG issued its final judgment, the controller submitted that, given some recent case-law of the BVwG and of the CJEU, it recognized that its activities as an address publisher constitute profiling within the meaning of Article 4(4) GDPR. In line with case C-154/21 the controller also provided the data subject with information about the specific recipients of her personal data. However, it still claimed that the obligations of Article 15(1)(h) GDPR do not apply to its activities as it does not engage in automated-decision-making under Article 22(2) GDPR. The controller submitted that the scope and effects of the marketing classifications are defined in the Austrian Commercial Code ([https://www.ris.bka.gv.at/eli/bgbl/1994/194/P151/NOR40096343 Gewerbeordnung, GewO)] and they are only used to set target groups for third party marketing purposes and they help selecting the addresses where higher response rates to advertisement are expected in order to increase advertisement accuracy. With respect to the data subject’s access request about the data recipients, the BVwG held that the controller had eventually complied with its obligation under Article 15 GDPR. As regards the provision of information about profiling, the BVwG first of all held that marketing information clearly constitutes personal data as per Article 4(1) GDPR. Equally so, that processing of such information constitutes profiling under Article 4(4) GDPR. Further, the BVwG considered the controller’s position that it did not carry out profiling within the meaning of Article 22 GDPR and therefore did not have to comply with the obligation of Article 15(1)(h) GDPR. The BVwG held in this respect that even though under Article 15(1)(h) GDPR it can be understood that a controller has to inform a data subject about the existence of automated decision-making including profiling, it is clear from the wording of the second part of the Article that further information about the logic involved must be provided only when the conditions of Article 22(1) GDPR and Article 22(4) GDPR are met. In the case at hand, so the BVwG, it did not appear from the submissions of the controller that it carries out profiling within the meaning of Article 22 GDPR, thus, the BVwG held that the controller did not have to comply with the obligation of Article 15(1)(h) GDPR to provide further meaningful information about the logic involved. Hence, the BVwG concluded that the controller complied with its obligations under Article 15 GDPR.
Uitvoeringsinstituut werknemersverzekeringen
On 16 July 2021, the controller, the Institute for Employee Insurance, a public body, informed the data subject of a data breach. Five letters meant for the data subject were sent to the the wrong address. After a complaint made by the data subject to the controller, the controller offered €250 in compensation. The data subject did not agree with the amount offered and demanded €3000. In addition, she made an access request under Article 15. The controller rejected the claim of €3000. The data subject then appealed the controller's rejection of their initial claim and made another claim for compensation under Article 8:88 AWB to the controller as a public administrative body. Article 8:88 AWB provides that "the administrative court is entitled, at the request of an interested party, to order an administrative body to compensation for damage suffered or will suffer by the interested party." The controller rejected the data subject's claim under Article 8:88 AWB. The controller argued that Article 8:88 AWB did not apply to it because the matter involved sending letters to the wrong address, was a factual action, not a formal decision with legal implications for the purposes of Article 8:88 AWB. The data subject appealed this to the Administrative Court of Den Haag. The Court treated the data subject's case as a request for compensation under Article 8:88 Awb in connection with Article 82 GDPR. The Court made an order under Article 8:88 AWB ordering the Institute for Employee Insurance to compensate the data subject for the data breach. However, the calculation of the amount to be paid was based on Article 82 GDPR. The Court determined that for the purposes of non-material damages under Article 82 GDPR, a compensatory amount of €500 was fair and appropriate. The Court considered the psychological impact of the data breach on the data subject, but noted that the five letters were returned in sealed envelopes and there was no evidence of third-party use.
Court case 22/4916
A data subject had submitted an access request to the Board of Public Prosecutor’s office seeking to obtain information about any personal data about him being processed by the Board. The Board, as a defendant, treated his request as a general access request under Article 15 GDPR and [https://wetten.overheid.nl/BWBR0014194/2023-11-01 Article 39(i) Judicial and Criminal Records Act (Wet justitiële en strafvorderlijke gegevens - WJSG]). Under [https://wetten.overheid.nl/BWBR0014194/2023-11-01 Article 39(i) of the WJSG], data subjects have the right to request the Board to obtain confirmation as to whether criminal records about them is being processed and, if so, to obtain information about the processing thereof. On 31 August 2022, the Board thus provided the data subject with two separate documents, one regarding the criminal records about him that were being processed under the WJSG and the other containing all other personal data about him being processed under the GDPR. The data subject, the plaintiff claimed that the response was incomplete. The defendant thus asked him to substantiate his request and the data subject answered that he wished to receive all data concerning him that was being processed. The defendant then added additional personal data and criminal records of the plaintiff that were found in its database. Still unsatisfied with the response, the plaintiff appealed against the judgment. The court issued its final judgment on 20 September 2023 and held that, since the access request by the data subject was drafted in general terms and had a broad scope, the defendant correctly replied with a general overview of the personal data and criminal records about him being processed. The plaintiff objected to this response and the defendant asked him to specify his request in line with Recital 63 GDPR. As the plaintiff again answered in general terms, claiming he requested access to all his personal data, the court held that the defendant was right in replying in broad terms too. When the plaintiff substantiated his request at the appeal hearing, mentioning specific data he wished to have access to, the court held that it was too late and he should have mentioned this at the time of objection or submit a new request. Further, upon hearing the defendant on its search operations, the court held that the defendant did carry out a sufficiently complete research when looking for the plaintiff’s personal data in its possession. As regards the provision of copies of personal data of the plaintiff under Article 15(3) GDPR, making reference to CJEU C-487/21, the court specified that a right to obtain a copy of one’s personal data does not constitute an obligation for an administrative body to provide copies of documents entailing the data subject’s personal data. The latter can choose to provide an understandable reproduction of such data as long as a copy of the documents is not indispensable for the data subject to exercise his rights under the GDPR. The court held in this respect, that the plaintiff did not make it clear in his request that the data was indispensable for him to exercise his rights, hence the defendant was not bound to provide him with a copy of his personal data. As regards the plaintiff’s criminal records, the court also held that he had no right to obtain a copy thereof under the WJSG. In light of the above, the court declared the appeal to be unfounded as the defendant had answered in a complete and clear manner to the plaintiff’s access request.
Datatilsynet
The data subject had been receiving unemployment benefits from NAV, the Norwegian Labour and Welfare Administration (the controller) since autumn 2015. With a decision of 2 October 2015, the controller suspended benefits to the data subject as he stated that he was in education, thus no longer entitled to receive them. Later, the data subject submitted more information stating that he was not an active student and the controller reassessed the case and started granting him benefits again from 30 November 2015. On 17 March 2016, the controller issued a new decision reversing its October 2015 decision to suspend benefits, so that the data subject was granted unemployment benefits also for the period of suspension. In relation to this, the data subject requested the controller to obtain access to his personal data and to rectify inaccurate data about him, namely the fact that he was in education or training while also receiving benefits, as stated in the decision of suspension of benefits of October 2015. On 26 May 2021, the controller refused to comply with the request for rectification of the data included in its decision of October 2015 as it added a note in that document referring to its corrected decision of March 2016. The data subject filed a complaint with the Norwegian DPA on 6 June 2021 asking the DPA to order the controller to provide him with all documents including his personal data and rectify inaccurate data about him and to assess any other GDPR violations by the controller. On 14 December 2021, the Norwegian DPA held that the controller could not comply with the data subject’s request to rectification/completion of his data according with Article 16 GDPR as the information was not per se incorrect and thus the first condition under Article 16 GDPR was not met. Given that the controller added a note to its decision of 2 October 2015 referring to its corrected decision of March 2016, it thus fulfilled the complainant’s request of rectification of his personal data. The data subject was dissatisfied with the DPA’s decision as it claimed that adding a note to a decision that references the corrected one cannot be considered rectification and decided to appeal. Thus, on 6 February 2023, the Norwegian DPA transferred the case to the Norwegian Privacy Appeals Board (Personvernnemnda) for review. On 15 September 2023, the Board considered the case and held that the two decisions concerning the suspension and granting of unemployment benefits issued by the controller must be seen in conjunction with one another. As regards the decision of October 2015, the Board held that the information included therein cannot be considered an objective factual error since that decision was based on evidence describing the data subject’s situation in that moment, namely that he was in education, as he submitted in his application for benefits. It follows that the information required to be corrected is not “incorrect” data and it thus falls outside the scope of Article 16 GDPR. In addition to this, the Board clarified that, with its decision of March 2016, the controller fulfilled the data subject’s request by supplementing its initial decision, and provided the correct information about the complainant. In the Board’s view, both decisions must be read together which translates as follows: the controller does not consider the data subject to be in education and it recognises its suspension of benefits of October 2015 to be unlawful, meaning that no incorrect information about the data subject was registered. The Board thus upheld the DPA's decision and concluded that the data subject does not have a right to claim rectification of his personal data by virtue of Article 16 GDPR as the condition for rectification set out in its first sentence is not met.