GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
www.jameda.de
The controller managed a website – www.jameda.de – where personal data of doctors’ where collected and made available to internet users. These data included at least: name, academic degree and specialization of the practitioners, as well as professional addresses and telephone numbers. Data were processed without data subjects’ consent. The controller also offered doctors the option to add further information to their basic profile by paying a price. This optional service included the possibility to upload pictures, statements, articles, videos etc. Both basic and “premium” profiles enabled users to anonymously publish their “reviews”, which were attached to the doctor’s profile and publicly visible. The data subject was a doctor reviewed on the website, but they never consented to the processing of their personal data by the controller. He brought several allegations against the controller and requested a civil court to order the controller to erase the profile and stop several processing operations. The Regional Court of Munich (Landgericht München – LG München) declared the processing unlawful and imposed on the controller the erasure of the profile insofar as personal data of the data subject were associated with user reviews. However, the data subject appealed the part of this judgement that was not favourable to them. In particular, the data subject asked the court of appeal to check whether the controller violated the GDPR by implementing for premium profiles a design that infringed the data subject’s fundamental rights. More specifically, in the data subject’s view, services offered to paying customers indirectly put the data subject in a position of disadvantage, as basic profile holders were not allowed to personalise their page. In addition, the appeal concerned the fact that the data subject’s basic profile was used to display advertisements regarding other doctors who decided to subscribe to the “premium” option, again damaging the data subject’s professional activity. The controller also appealed. The Higher Regional Court of Munich (Oberlandesgericht München - OLG München) found that data processing, based on a legitimate interest of the controller, was outweighed by the fundamental right to data protection of the data subject. In particular, processing was unlawful insofar as the controller granted a more favorable treatment to paying customers, enabling them to personalize their profile, whereas the data subject could not. However, the Court of Appeal dismissed the argument that the controller should refrain from displaying third-party advertisements on the data subject’s personal profile, as there was no real competition between the data subject and other doctors. As a matter of fact, doctors involved had different specialisations. Both the controller and the data subject appealed to the German Federal Court of Justice (Bundesgerichtshof – BGH). The Federal Court of Justice clarified that processing in the case at issue could be solely based on legitimate interest pursuant to Article 6(1)(f) GDPR. The existence of a legitimate interest depends on 3 elements. The first element is the legitimate interest itself, namely an interest that is rooted in the law or in a societal need. Concerning this first element, the Federal Court of Justice held that the portal managed by the controller pursued both a controller’s interest and a general interest of the users of the platform. On the one hand, the collection of data about medical practitioners could be seen as a manifestation of the freedom of information under Article 11 of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A12012P%2FTXT Charter of Fundamental Rights of the EU], both in its active and in its passive dimension. As a matter of fact, the function of the website not only did not conflict with the legal system but was also socially desirable: thanks to this service, patients could better choose their doctor. The users’ right to disseminate opinions is also a fundamental one. On the other hand, running the platform was also part of the controller’s fundamental right to conduct a business, which is enshrined in Article 16 of the Charter of Fundamental Rights of the EU. As a second step, the Federal Court of Justice assessed whether the processing was really necessary to achieve the legitimate interest. The judges found that processing was indeed necessary to provide users with an overview of medical profession, insofar as processing was limited to the name of the doctor, their academic degree, professional information and the ratings by patients. Thirdly and finally, a legitimate interest should not be outweighed by data subjects’ rights. The Federal Court of Justice pointed out to the fact that in the present case, not only data protection, but also data subjects’ right for private and family life (Article 7 of the Charter of Fundamental Rights of the EU) and their right to conduct a business might be impaired. However, the legitimate interest of controller and users prevailed. Preliminary, the court stressed that doctors shall accept the risk of receiving bad reviews by customers. Moreover, in the opinion of the Court, the possibility of using legitimate interest as a valid legal basis ultimately relied on the fact that the controller did not violate its duty of neutrality by unfairly favouring paying customers. In this sense, the mere fact that premium account holders had a privileged position was not sufficient in itself to break neutrality obligations. What is relevant, according to the Federal Court of Justice, is that the controller did not put pressure on the data subject by displaying on their personal page advertisements from potential competitors. This did not occur in the present case as advertisements popping up on the data subject’s profile concerned doctors whose field of specialisation was not related to the one of the data subject. Furthermore, the simple difference in the design of basic profiles and premium profiles did not entail unfair advertising operations on behalf of paying customers. According to the Federal Court of Justice, it was clear to the average user that a difference in the layout of the profiles did not depend on the doctor’s skills, but rather on their willingness to personalise their profile on the platform. For this reason, the judges considered very unlikely the occurrence that a user, comparing basic and premium profiles, could switch to a doctor holding the latter because of the profile design alone. In light of the above, the Federal Court of Justice dismissed the data subject’s appeal and upheld the controller’s one.
VS
In 2013, the District Public Prosecutor’s Office in Petrich (Bulgaria) opened pre-trial proceedings (No 252/2013) against an unknown person for the commission of a crime. The applicant in the case in question (VS) took part in those proceedings as a victim. In 2016, the District Public Prosecutor’s Office in Petrich, compiled a number of criminal files containing information relating to VS, [after receiving a number of complaints concerning, inter alia, VS]. However, the Public Prosecutor's Office did not open any pre-trial proceedings in the absence of evidence. In 2018, the public prosecutor made formal accusations in respect of all the persons who took part in the incident at issue in the pre-trial proceedings (No 252/2013), including VS. VS brought an action before the Regional Court in Blagoevgrad (Bulgaria) against the Public Prosecutor’s Office of the Republic of Bulgaria seeking damages for the harm allegedly resulting from the excessive duration of the pre-trial proceedings (No 252/2013). At the hearing, the Public Prosecutor's Office requested that the files opened in 2016, concerning VS, be produced for the purposes of defending the public prosecutor's office against claims made by VS. The Regional Court ordered that public prosecutor's office to produce certified copies of the documents in the files in question. In March 2020, VS lodged a complaint with the Supreme Judicial Council, Bulgaria (‘the IVSS’), claiming that the District Public Prosecutor’s Office in Petrich, had infringed the data protection legislation. VS claimed, firstly, that that public prosecutor’s office had unlawfully used his personal data collected when he was considered to be a victim of a crime, in order to prosecute him in the same proceedings. Secondly, VS alleged that the public prosecutor’s office acted unlawfully as regards the processing of personal data that were collected in the files, in 2016, in the context of his action for damages against the Public Prosecutor’s Office of the Republic of Bulgaria. The IVSS rejected that complaint. In July 2020, VS brought an action before the Administrative Court in Blagoevgrad (Bulgaria) against that decision, claiming, first, that the processing of his personal data in the course of pre-trial proceedings (No 252/2013) is contrary to, inter alia, the principles of the Law Enforcement Directive 2016/680 ("LED 2016/680"), and second, that the processing of the data collected in the files, in 2016, after the Public Prosecutor’s Office had refused to initiate pre-trial proceedings, infringes the principles of the GDPR. The Administrative Court decided to stay the proceedings and to refer to the CJEU for a preliminary ruling. Within this particular case, the CJEU addressed whether the provisions of the GDPR apply to the processing of personal data by the public prosecutor's office for the purpose of exercising its rights of defendence in civil proceedings. Firstly, the CJEU considered the conditions for the definition of 'personal data' under 4(1) GDPR and processing' under Article 4(2) GDPR were met in this case, where a defendant, in civil proceedings, informs the competent court, even succinctly, of the opening of files concerning a natural person, in particular for the purposes of the ‘detection’ or ‘investigation’ of a criminal offence. With regard to the exception provided for in Article 2(2)(d) GDPR, which concerns the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, the CJEU held that the exception should be interpreted strictly. In this regard, it was also held that, the reason for that exception is that the processing of personal data by the competent authorities for the purposes set out in Article 2(2)(d) GDPR is governed by LED 2016/680. As in the present case, the CJEU found that even where the bringing action for damages against the State from alleged misconduct by the public prosecutor’s office in the course of criminal proceedings, the aim of the State’s defence in such an action is not to perform, as such, tasks for the purposes set out in Article 1(1) of LED 2016/680. Furthermore, it was stated that the participation of a public authority in civil proceedings as a defendant in an action for damages against the State does not seek to safeguard national security or of an activity which can be classified in the same category, in the light of Article 2(2)(a) GDPR. The public prosecutor’s office must be considered to be a ‘controller’, within the meaning not only of Article 4(7) GDPR, but also of Article 3(8) of LED 2016/680. The CJEU held that the GDPR is applicable to the processing of personal data by the public prosecutor’s office for the purpose of exercising its rights of defence in an action for damages against the State, where, first, it informs the competent court of the opening of files relating to a natural person who is a party to that action for the purposes set out in Article 1(1) of LED 2016/680 and, second, it transmits those files to that court. With regard to the lawfulness of the processing, the CJEU considered first that it must be determined whther the processing, by the public prosecutor’s officef or the purpose of defending the State or a public body in an action for damages for harm caused by misconduct on the part of the State or a public body, is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in it, within the meaning of Article 6(1)(e) GDPR. Moreover, it cannot be ruled out that, where, for the purpose of defending the State in an action for damages, the public prosecutor’s office of transmits the personal data to the court at that court’s request, that transmission is also liable to come within the scope of Article 6(1)(c) GDPR where that public prosecutor’s office is required to comply with such a request pursuant to national law. It is for the referring court to verify whether, in accordance with Article 6(3) GDPR, the national law lays down, 1) the basis for such processing and, 2) the purposes of that processing or, as regards Article 6(1)(e) GDPR, whether that processing is necessary for the public prosecutor’s office’s performance of its task carried out in the public interest. Furthermore the CJEU emphazised that the processing of personal data must also copmly with all the applicable requirements provided for by the GDPR. This decision represents an important milestone case for data protection in the context of law enforcement.
SOVIM SA
In Case C-37/20, YO, a real estate company, lodget a request to Luxembourg Business Registers (LBR) pursuant Article 15 Law of 13 January 2019 (Law of 13 January 2019 of Luxembourg establishing the Beneficial Owner Register - transposing the provisions of Article 30 Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing) requesting that access to the information concerning WM, its beneficial owner, contained in the register, to be restricted solely to the entities mentioned in that provision, on the ground that the general public’s access to that information would seriously, actually and immediately expose WM and his family to a disproportionate risk and risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation. On November 20, 2019 the request was rejected by LBR arguing that WM’s situation does not meet the requirements of Article 15 Law of 13 January 2019, since WM cannot rely either on ‘exceptional circumstances’ or on any of the risks referred to in that article. On 5 December 2019, WM brought an action before the tribunal d’arrondissement de Luxembourg (Luxembourg District Court, Luxembourg), maintaining that his position as executive officer and beneficial owner of YO and of a number of commercial companies requires him frequently to travel to countries whose political regime is unstable and where there is a high level of crime, which creates a significant risk of his being kidnapped, abducted, subjected to violence or even killed. In that regard, the referring court raised the question of the interpretation to be given to the concepts of ‘exceptional circumstances’, ‘risk’ and ‘disproportionate’ risk within the meaning of Article 30(9) Directive 2015/849, as amended. In Case C‑601/20, Sovim lodged a request to LBR, pursuant to Article 15 Law of 13 January 2019, requesting that access to the information concerning its beneficial owner, contained in the register, be restricted solely to the entities mentioned in that provision. On February 6, 2020, the request was rejected by LBR. On 24 February 2020, Sovim brought an action before the referring court seeking a declaration that Article 12 Law of 13 January 2019, pursuant to which access to certain information contained in the register is open to ‘any person’, and/or Article 15 Law of 13 January 2019 are inapplicable and an order for the information provided by Sovim pursuant to Article 3 Law of 13 January 2019 not to be made publicly accessible. Sovim argued that granting public access to the identity and personal data of its beneficial owner would infringe the right to respect for private and family life and the right to the protection of personal data, enshrined respectively in Articles 7 and 8 EU Charter of Fundamental Rights. They also stated that the aim of Directive 2015/849, on the basis of which the Law of 13 January 2019 was introduced into Luxembourg law, are to identify the beneficial owners of companies used for the purposes of money laundering or terrorist financing, as well as to ensure certainty in commercial relationships and market confidence. However, it has not been shown how granting the public entirely unrestricted access to the data held in the register enables those aims to be attained. Sovim highlighted that public access to personal data contained in the register constitutes an infringement of several provisions of the GDPR, in particular a number of fundamental principles set out in Article 5(1) thereof. In the alternative, Sovim claims that the referring court should hold that there is a disproportionate risk in the present case, within the meaning of Article 15(1) Law of 13 January 2019, and accordingly make an order requiring LBR to restrict access to the information referred to in Article 3 Law of 13 January 2019. CJEU examined if Directive 2018/843's amendment, mandating public access to beneficial ownership data, was valid under Articles 7 and 8 EU Charter of Fundamental Rights. This amendment requires Member States to ensure that information on beneficial ownership is accessible to the general public. The Court identified that making beneficial ownership information publicly accessible does indeed constitute an interference with these fundamental rights. CJEU emphasized the potential for creating detailed profiles on individuals based on their economic activities and the unlimited access by potentially any person, which could lead to misuse of this information. Despite recognizing that such transparency aims to deter money laundering and terrorist financing, the Court questioned whether this broad access is strictly necessary and proportionate to the objectives pursued. The CJEU questioned the justification for this interference, considering whether the measures respect the essence of the fundamental rights under the Charter, whether they genuinely meet objectives of general interest recognized by the EU, and whether they are necessary and proportionate. Despite acknowledging the importance of combating financial crimes, CJEU found that the directive's approach to providing unrestricted public access to beneficial ownership information did not guarantee a proper balance between the objective of general interest and the protection of fundamental rights, such as privacy. The Court highlighted the lack of clear and precise rules on the scope and application of this measure, raising concerns over the adequacy of safeguards against the risk of abuse and the difficulty for individuals to control or challenge the use of their data. Ultimately, the CJEU declared Article 1(15)(c) Directive 2018/843 invalid, concluding that making beneficial ownership information universally accessible to the public constitutes a serious interference of the rights pursuant Articles 7 and 8 EU Charter of Fundamental Rights that is not justified by the objectives of general interest it seeks to achieve.
Court case III OSK 25287/21
On 25 January 2018, the plaintiff filed a request with the Parliament (the defendant) to access the list of candidates for the National Council of the Judiciary. The documents requested contained a list of citizens supporting a given application and/or lists of judges supporting a given application. By decision of 27 February 2018, the defendant refused to comply with the request. The plaintiff appealed this decision to the Court of First Instance. The Court of First Instance ordered the defendant to comply with the request to access document, but only after having anonymised the judges' personal identification number (PIN). The Court held that the PIN was not related to the public function performed by the judges, and therefore should not be made available. During the Court of First Instance proceedings, the Polish DPA initiated ex officio proceedings concerning the same matter and ordered the defendant (the controller) to restrict any further processing of personal data, including refraining from making them publicy available in any form. After not having received any information several months after the decision of the Court of First Instance, the plaintiff started proceedings regarding inaction by the defendant. As a result, the Court of Second Instance ordered the defendant again to comply with the request. The defendant filed a cassation appeal before the Supreme Administrative Court. The main argument of the defendant was the DPA decision, which contrary to the Court of First Instance order, prohibited the defendant from disclosing the information. In the cassation appeal, the Court considered whether the information ought to be disclosed and whether a DPA decision to not comply with a public information access request could overturn a court judgement on the same matter. The Supreme Administrative Court ruled that the Court of First Instance exercised the constitutional right to control the activity of public administration and ruled legally that the
Court case AN 14 K 22.00468
The controller is a cyclist who took pictures of parking offences and, together with a short description, sent it to the police authority in charge to report the offence. The case at hand concerned photographs taken in June 2020 of various vehicles that showed the parking situation and the vehicles' license plates. In June 2021, the competent DPA issued a reprimand against the controller in accordance with Article 58(2)(b) GDPR. The DPA argued that taking and redirecting pictures of the parking offences constitutes processing of personal data and that the controller did not fulfil their informational duties pursuant to Articles 13(1)(d) and 14(2)(b) GDPR. The authority claimed that there was no legitimate legal basis under Article 6(1) GDPR for the processing, as the controller neither obtained a consent of the vehicle owners nor had a legitimate interest that would justify the processing. The controller was requested to pay an administrative fee of 100 euros. The controller filed a complaint against the DPA's decision in a written statement at the Administrative Court of Ansbach. The Administrative Court Ansbach overturned the DPA's decision. It held that the reprimand issued by the DPA is unlawful because the claimant did not violate any provisions of the GDPR, which is a condition for a reprimand pursuant to Article 58(2)(b) GDPR. Material scope of the GDPR According to the court, the GDPR applies in the case at hand since taking pictures of vehicles and forward them to the police constitutes the processing of personal data in accordance with Article 2(1) GDPR and Article 4(1) GDPR. A license plate is information that allows the identification of a natural person, despite the fact that the provision of additional information from authorities is necessary to identify the data subject. Furthermore, the household exemption laid down in Article 2(2) GDPR is not applicable since the processing of personal data is leaving the private sphere. The pictures taken w
Court case 200.292.660/01
The controller carried out activities in the field of media. Via its website, it published articles, that were also sometimes published in national newspapers. Among these articles was a 28-page file about the data subject. One article referred to the data subject as a master swindler. Another article stated that the data subject sold phone cards to detainees and scammed them. The publications included the data subject's full name, date of birth and a photograph. The data subject deemed these publications unlawful pursuant to the GDPR and Article 8 ECHR and took the matter to court. The data subject claimed that the controller was liable for €40,000 in damages and also requested a ban on any future publications about him. The Court of First Instance dismissed the claims. It considered that the controller processed the personal data for journalistic purposes and that in this case, the freedom of expression of the controller outweighed the protection of the data subject's privacy. The Court noted that the press has a watchdog function, in particular with regard to fraud and the importance of warning the public about it. The data subject appealed the decision of the Court of First Instance. He opposed the Court's finding that the controller processed personal data for journalistic purposes on its website. According to the data subject, the controller's purpose was to make people look bad and that the controller acted out of spite. The controller had no legal ground for processing pursuant to Article 6 GDPR. Therefore, the journalistic exception laid down in Article 43 of the Dutch Implementation Act for the GDPR (UAVG) was not applicable. The Court of Appeal of Amsterdam stated, firstly, that the term 'journalistic' within the meaning of Article 43 UAVG should be interpreted broadly. The Court found that controller's website aimed to inform the public about fraudulent activities. The data subject's statement that the controller's purpose was to make people look bad
Koalitsia ‘Demokratichna Bulgaria – Оbedinenie’
The Bulgarian DPA and the Bulgarian Central Election Commission adopted guidelines on national electoral procedures. The guidelines addressed the problem of the processing of personal data by means of video recording in the context of elections and limited such a processing to specific circumstances. The guidelines are direct implementation of the GDPR. A political party claimed that the guidelines were unlawful, as the GDPR does not apply to national elections, which fall outside the scope of EU law. The Administrative Court of Sofia (Administrativen sad Sofia) annulled some provisions of the guidelines. The Bulgarian DPA and the Bulgarian Central Election Commission appealed before the Supreme Administrative Court (Varhoven administrativen sad). The Supreme Administrative Court referred the case to the CJEU. The CJEU stressed that the only exceptions to the GDPR scope of application are provided by Article 2(2) and (3) of the GDPR. These exceptions shall be interpreted strictly. In particular, Article 2(2)(b) GDPR states that the regulation does not apply to processing activities falling outside the scope of EU law. However, according to the Court, this provision exempts only activities carried out in the context of national security or related purposes. Activities relating to the organisation of elections do not fall within this category. In the merits, the CJEU also addressed the question whether a national DPA could limit or prohibit processing activities such as the filming of electoral process, including the vote count. The Court stated that such processing activities could in principle rely on Article 6(1)(e) GDPR, namely processing carried out in the public interest. However, the Bulgarian DPA, by limiting or prohibiting video-recording of vote count and other electoral processes implemented the principle of data minimisation under Article 5(1)(c) GDPR. In particular, the ban did not impair the public interest objective, which was to guarantee transparency (and thus lawfulness) of electoral processes. As a matter of fact, the guidelines did not prevent people from being present during the vote count, but only from recording it.
Digi Távközlési és Szolgáltató Kft.
This case concerned a Hungarian provider for internet and television services (controller) and the Hungarian DPA. A technical error caused problems for the functioning of the controller’s server. After this, the controller created a database for testing (test database), to which the personal data of one third of its customers was copied. This personal data was originally kept in another database (original database), which was coupled with the website of the controller. This original database contained personal data of subscribers for the controller's newsletter, for the purpose of direct marketing. The original database also contained data of system administrators who provided access to the interface of the website. On the 23 September 2019, the controller learned that an ethical hacker managed to get access to the test database which contained the data of 320,000 data subjects. The hacker notified the controller and provided a line of code from the test database as proof of the security issue. The controller fixed this issue, signed an NDA (Non Disclosure Agreement) with the hacker and gave him a reward. The controller also deleted the test database. The controller notified the DPA on 25 September 2019, which started an investigation into the controller. In its decision of 18 May 2020, the DPA held that the controller violated Articles 5(1)(b) GDPR and 5(1)(e) GDPR by not deleting the test database after conducting the necessary tests and fixing the errors. By not deleting this database, the controller kept the personal data of data subjects without any purpose for almost one and a half years. The DPA ordered the controller to investigate all its databases and also gave the controller a fine of 100,000,000 Forint (€248,000). The controller appealed this decision at the Fővárosi Törvényszék (Judge for the agglomeration of Budapest), which asked the following preliminary questions to the Court of Justice of the European Union (CJEU). 1) Should the purpose limitati
Court case 4 K 1338/21
The controller published a screenshot of an advisory board video call meeting on his webpage, where among others, a local politician, the data subject, could be seen. As a response, the data subject filed a complaint to a DPAWhich exact DPA was concerned was not further specified in the decision. which, subsequently, issued a decision on the matter. In the decision, the DPA stated that the publication of the screenshots and videos violated the personality right of the data subject. Even a possible justification pursuant to Article 6(1)(f) GDPR due to the fact that (1) the data subject is a public figure and (2) it would be in the public interest to know what he is doing, would not prevail over the data subjects interest to not be defamed. Information about the his work is available in the protocol of the meeting, which is available to the public. The general public could get a better picture of the work from the protocol than from a screenshot, which does not provide any context, except the visual appearance of the data subject. Therefore, there was no need to process the data by publishing it in a visual form on a website. The main purpose of the publication of the screenshot was to defame the data subject, not to inform the general public about his work. The decision ordered the controller to erase all personal data and prohibited the future recording of videos or screenshots of the advisory board meetings. Subsequently, the controller filed a lawsuit against the DPA's decision at the Administrative Court in Bremen. In its decision, the court held that the decision from the DPA was legally correct and dismissed the case. The publication of the screenshots and videos on a private webpage, which is mostly used by the data controller to express his views and not to inform the general public about current affairs, constituted a processing of personal data in the sense of Article 4(2) GDPR. Therefore, the data controller needed a lawful ground for processing in the sense of Article 6(1) GDPR. Due to the fact that the purpose of the processing was not in the interest of the general public, where the interest of the public would prevail over the interest of the data subject, but predominantly served to defame the data subject, the legal ground of Article 6(1)(f) GDPR could not be considered. Also, there was also no need for the publication of the videos and screenshots. There were other (official) means to inform the public. The general public could watch the meeting live via web stream, protocols were published afterward. The erasure of the videos was justified as an act of the DPA under Article 58(2)(f) GDPR. The court also confirmed the decision of the DPA to refrain from any future publications.
NN
The defendant allegedly took out household contents insurance with the insurance company 'Nationale Nederlanden' (the controller). Under this insurance, the defendant made claims for damages based on false documents. The controller found out and claimed damages from the defendant for submitting claims based on false documents. The defendant disputed that he made those false claims, and, moreover, that he took out any insurance at all. He alleged identity fraud by a former employee of the controller (the data subject). The defendant stated that the data subject received the money paid by the controller through some sort of fabrication. To prove this, the defendant claimed the release of the data subject's name and address details. In addition, the defendant argued that if it would be ordered to pay, he would have a claim against the data subject for that amount. He therefore believed it was in his interest to call the data subject in indemnity. The controller disputed that it had to provide the address details. It argued that, the defendant did not sufficiently substantiate his interest in requesting the release of the data subject's name and address details. It also stated that the request was in violation of Article 6(1)(f) GDPR. First, the Court stated that pursuant to Article 843a(1) of the Code of Civil Procedure (CCP), the defendant may demand certain specified documents relating to a legal relationship in which they are a party from the person who has these documents at their disposal. The defendant must however have a legitimate interest in receiving the documents. The Court stated that, without the name and address details, the defendant would be unable to hold the data subject liable for the damages resulting from the claim alleged by the defendant. The defendant thus had an interest in granting the claim to provide the name and address details. The Court added that it was not necessary for defendant to show that his underlying claim would succeed. It wa
Court case 2 A 124/22
The data subject is a public employee of a state authority and involved in family law proceedings. In the course of the proceedings, she filed a lawsuit to seek a declaration that four judges, which were involved in the proceedings, violated her right to data protection by disclosing data from the family law dispute to her public employer without authorisation and requested that they cease and desist from violating her right to data protection in the future. The defendants pointed out that during her family law proceedings, the data subject developed a history of filing numerous and extremely detailed regular disciplinary complaints against judges responsible for her law suits, succeeding more than 100 complaints a year. Furthermore, the data subject shared many of her correspondence with the court with her employer by placing their email address in the "cc" in an email and it was found that fax submissions by the plaintiff had shown the area code assigned to the data subject's state authority. Due to the excessive amounts of complaints, the judges have been given reasons to believe that she may not be able to properly represent herself in front of the court in her family law disputes or commit to her public employment. To ensure an exhaustive evaluation of the situation, some judges who were ruling in the family disputes got into contact with her employer and disclosed personal data concerning the family law proceedings. The first instance court held that the data processing is legal pursuant to Article 6(1)(c) GDPR and Article 6(1)(e) GDPR. The GDPR does not provide any specific regulation regarding employment data protection law other than Article 88 GDPR, which allows employment data to be regulated by the member states. Due to her employment at a public office, the data processing was lawful upon § 22 Nr. 1 SaarlDSG, which regulates that data processing is allowed when the data processor is a public office and the processing is needed for the beginning or termination of employment. Additionally, in a balancing of interests, the interest of the employer to have trustworthy employees would overweight the right to protection of her personal data. The court dismissed the appeal. It noted that requirement to present the case in the appeal admissions procedure pursuant to German procedural law requires that the respective applicant substantially examines the content of the challenged decision of the administrative court and its the supporting reasons. This substantiated discussion requires appropriate preparation by the applicant. On the other hand, it is not the task of the Higher Administrative Court to determine, from a mixture of statements in the form of a statement of grounds for appeal, which aspect of the argument could be assigned to which ground for admissibility.
City of Helsinki
The social and health authority of the city of Helsinki (the controller) had asked the Administrative Court of Helsinki (the Court) to overturn the Finnish DPA's decision, according to which the controller had no legal basis to process the background information of applicants applying to volunteer as a child support person. The controller filed the appeal claiming that the processing of personal data was necessary to comply with its legal obligations under Article 6(1)(c) GDPR. The controller claimed that [https://www.finlex.fi/fi/laki/ajantasa/2014/20141301 the Finnish Social Welfare Act] and [https://www.finlex.fi/fi/laki/ajantasa/2007/20070417 the Finnish Child Welfare Act] oblige and entitle it to extensively process the background information of support person applicants, on the basis of which it can be assessed if they pose a threat to the child's physical and psychological integrity. The Court agreed with the controller that determining the background of volunteers working with children could be considered necessary in order to fulfil its obligations under [https://www.finlex.fi/fi/laki/ajantasa/2014/20141301 the Finnish Social Welfare Act] and [https://www.finlex.fi/fi/laki/ajantasa/2007/20070417 the Finnish Child Welfare Act]. However, the Court noted that pursuant Article 6(2) GDPR, the processing of personal data related to the organisation of support person activities is regulated in more detail in [https://www.finlex.fi/fi/laki/ajantasa/2002/20020504#P5 Section 5 of the Finnish Act on Checking the Criminal Background of Persons Working with Children], according to which the municipality may only request an extract from the criminal record from the applicant. In light of this, the Court agreed with the DPA that the personal data processed by the controller had exceeded what was necessary and relevant for the original purpose of the processing, therefore violating Article 6 GDPR and Article 10 GDPR.
Autoriteit Persoonsgegevens (AP)
The controller is a sports club in the legal form of an association. To, in its own words, 'give more meaning' to the sport, its vision and the memberships of its members, the controller worked with sponsors. It provided these sponsors with personal information of its members (the data subjects) such as names and addresses. Some members complained to the Dutch DPA that they did not give the controller explicit consent to provide its sponsors with their personal data. The Dutch DPA investigated the matter and found that the controller had disclosed the personal data without consent or any other legal ground, in breach of Article 5(1)(b) and Article 6(1) read in conjunction with Article 5(1)(a) GDPR. The DPA fined the controller €525,000. The controller appealed the DPA's decision at the District Court of Amsterdam. It stated that there was, in fact, a legal ground for processing and this was its legitimate interest under Article 6(1)(f) GDPR. The DPA continued to be of the opinion that the controller had no legitimate interest and that the processing was not necessary to pursue such alleged legitimate interest. The parties were divided on the interpretation and scope of legitimate interest within the meaning of Article 6(1)(f) GDPR. According to the DPA, it followed from the grammatical interpretation of this term that there must be an interest laid down in a law. According to the controller, any interest was justified unless prohibited by law. The Court noted that there were three cumulative conditions according to established case law of the CJEU for processing on the grounds of legitimate interest: (1) the pursuit of a legitimate interest of the controller, (2) the processing must be necessary and (3) the controller's legitimate interest must outweigh the interest or fundamental fights and freedoms of the data subject(s). The Court held that it could not without reasonable doubt decide whether the controller had a legitimate interest. There was no established
Municipality of Amersfoort
Data subjects were a group looking for paranormal activities. They visited a cemetery in the municipality of Amersfoort (controller) to conduct a séance, "looking for energies of the deceased". This happened with the permission of the director of the cemetery. The parents of two children who were buried at the cemetery later found out about the séance and requested the data subjects' NAW-data (name, address and residence) from the municipality. They wanted to talk to them directly and possibly hold them liable for the damage they suffered as a result of the séance. The mother stated that it is absolutely not allowed to summon "spirits or devils" at graves in their Islamic culture. As a result of the séance, she claimed to have suffered serious psychological problems. The data subjects did not want their personal data to be disclosed. They had received serious threats because of the incident and felt unsafe. The municipality apologised for the events but stated that it was not obliged to disclose the personal data to the parents. It did offer to facilitate a conversation between the parties, during which the data subjects would remain anonymous, but the parents declined the offer. The parents were of the opinion that the municipality was acting unlawfully by not providing the personal data, so they brought the case before the court. The District Court of Midden-Nederland (Rechtbank Midden-Nederland - Rb. Midden-Nederland) heard the case. The Court stated that the data subject's did not consent to the disclosure of their personal data and this does not fit with the purpose for which the data was initially processed. It must therefore be tested against Article 6(1)(f) and (4) GDPR. The Court noted that (1) there must be legitimate interest, (2) the disclosure must be necessary and (3) it had to balance the interests of both parties: the right to protection of personal data and the safety of the research group and the right to information and effective legal protection of the parents. Initially, the Court found that the parents had a legitimate interest to access the personal data of, at least, the representative of the paranormal group. Then they could learn more about what exactly happened at the graves of their children and get answers to the questions they still had. The Court also held that the condition of necessity had been met. However, the Court held that the safety aspect weighed heavily. The mayor had also received threats, after which a conviction followed. Although the interests of the parents were important, they did not outweigh the interests of the data subjects. Moreover, the alternatives to get answers have not yet been exhausted by the parents. They even turned down previous proposals from the municipality. The data subjects did not want a personal conversation with the parents, and such a conversation cannot be forced. Lastly, the Court stated that it's doubtful whether the data subjects acted unlawfully towards the parents. Therefore, it was not proportional to take an irreversible decision like the provision of personal data. Ultimately, the Court held that the municipality was not obliged to provide the name and address details of the data subjects and denied the parents' request.
OT
The Chief Ethics Commission was a Lithuanian body checking declarations of private interests by public officers. According to Lithuanian law, public officers were asked to provide a large amount of information about themselves and their partner, including name, personal identification number, social security number, employment status, membership or undertakings with trade unions and/or political parties and details about transactions over €3,000 concluded in the last 12 months. The Chief Official Ethics Commission then published information on its website (after removing sensitive data). Notably, the published information, whilst removing what was obviously special categories of personal data, would still include the name of their spouse, cohabitant, or partner. The data subject was a public officer who asked the annulment of a decision by the Chief Ethics Commission according to which they failed to disclose mandatory information. The data subject claimed that this mandatory declaration violated their data protection rights under EU law. The Lithuanian court sent a preliminary reference to the CJEU to clarify whether Lithuanian law establishing the obligation violated Articles 6(1)(c) and (e), 6(3) and 9(1) GDPR. The preliminary questions concern the issue whether the existence of a legal obligation – Article 6(1)(c) GDPR – or a public interest – Article 6(1)(e) GDPR – can authorise a mandatory disclosure of personal data of a public officer for online publication. According to the CJEU, such mandatory declaration of private interests was a limitation of the data subject right to privacy and data protection; therefore, it shall be compliant with Article 52(1) of the European Charter of Fundamental Rights. The CJEU noticed that the mandatory declaration was based on Lithuanian law and pursued a public interest, namely the prevention of conflicts of interest and corruption. However, the measure shall also be proportionate. The Court found the declaration appropriat
VoetbalTV
VoetbalTV (the controller) is a collaboration between the Royal Dutch Football Association and Talpa Network. The online platform allowed fans to (re)watch and analyze professional video footage of football matches played by amateur players (the data subjects). VoetbalTV based its processing activities on a legitimate interest. = The Dutch DPA investigated Voetbal TV in 2019 and imposed a fine of €575.000 for processing personal data without a legal basis. The DPA held that VoetbalTV had a purely commercial interest, which can never be legitimate interest pursuant to Article 6(1)(f) GDPR. The DPA followed that a legitimate interest should (1) stem from a legal provision, (2) be worthy of protection and (3) have an urgent nature. According to the DPA, a purely commercial interests was not specific enough and lacked an urgent legal nature. VoetbalTV appealed this decision at the District Court. = The court found that the DPA gave a wrong interpretation of legitimate interest. It noted that having a purely commercial interest does not exclude a legitimate interest. The further held that the DPA did not sufficiently substantiate its decision. It should have investigated all the interests of VoetbalTV and weigh them against the violation of the privacy of those involved. Therefore, the Court held that the DPA should not have issued the fine and annulled the decision (see: [https://gdprhub.eu/index.php?title=Rb._Midden-Nederland_-_UTR_20/2315 UTR 20/2315]). The DPA appealed this decision at the Council of State. = During the appeal, the DPA stood by its strict interpretation of legitimate interest. The DPA argued that the District Court misconstrued the concept of legitimate interest, as a legitimate interest must follow from the law. It repeated that VoetbalTV's interest was purely commercial which does not qualify as a legitimate interest as this is not an interest provided for by law. The DPA substantiated this by saying that interpreting legitimate interest in a broader sense seemed illogical in light of the objective pursued by the GDPR and even conflicts with the interpretation of Article 8 ECHR.The DPA did not expain why a broad interpretation of the concept of legitimate interest conflicts with the GDPR and Article 8 ECHR (or at least this did not follow from the decision of the Council of State) Even if VoetbalTV had a legitimate interest, the processing was still unnecessary and balancing the interests at stake would have been in favor of the data subjects according to the DPA. The DPA also requested prejudicial questions, as the CJEU had not given an opinion on the topic of a solely commercial interest as a legitimate interest. VoetbalTV argued that a legitimate interest is an interest that is not in conflict with the law and that the DPA wrongly labelled its interest as purely commercial. VoetbalTV argued that the platform also (1) enhanced the involvement and enjoyment of fans, (2) facilitated technical analyses by trainers and analysts, and (3) offered players, friends and family the possibility to watch or review the matches remotely. The Council of State agreed with the District Court that the DPA gave a wrong interpretation of the concept of legitimate interest. The Council of State noted that to successfully rely on legitimate interest as a legal basis, three conditions must be met pursuant to the FashionID case: a legitimate interest, necessity and a balancing test. The Council held that the organization that processes the personal data indicates what its interest are and why processing is necessary for that purpose. The DPA must then test that interest against the FashionID criteria. The Council held that VoetbalTV's interest were not purely commercial in nature. The DPA wrongly disregarded the other interests that VoetbalTV put forward during its assessment. In addition, the Council held that the DPA neglected to assess whether the processing was necessary and weigh the interests of VoetbalTV against those of the players. The Council held that the DPA failed to perform the three-step test completely and the decision was therefore insufficiently motivated. The Council noted that because it had been established that the interests in question were not purely commercial in nature, the question whether an exclusively commercial interest could in itself be a legitimate interest did not need answering. Hence no prejudicial question was required. The Council of State held that the appeal lodged by the DPA was unfounded and the judgement under appeal must be upheld.
Court case 21/00910
The controller (an inspector of the Tax Administration Arnhem) imposed an additional turnover tax assessment of €25,269 on the data subject. After objecting to this decision by the controller, the data subject brought the case before the Court of Gelderland, which partially upheld his claims. The data subject then appealed the Court’s decision. During the appeal, the controller submitted two overviews of the data subject's trading stock: one which contained personal data (such as registration numbers of the cars, tax numbers of buyers, names of buyers, etc.), and one where the personal data had been redacted. The controller invoked confidentiality as referred to in Article 8:29 Awb to protect the data of third parties, and only wanted the anonymized version to be used in his defense. He argued that the submission of the overview including the personal data was in violation of the data minimization principle. The data subject argued that the overview including the personal data had to be submitted, as the anonymised overview would be a disadvantage to his procedural position. First, the Court of Appeal considered that the overview contained personal data, and that its submission to the Court had to be understood as ‘processing’ within the meaning of Article 4(2)(c) GDPR. It further noted that the controller had a legal obligation to provide the Court with documents ‘relating to the case’ pursuant to Article 8:42 Awb. The Court found that the overview did relate to the case, and held that the submission of the overview including personal data was not in violation of the data minimization principle (Article 5(1)(c) GDPR), since the processing was based on a legal obligation pursuant to Article 6(1)(c) GDPR.
Court case ВАС - № 6515
The controller was Toplofikacia Sofia EAD, a heating company in Bulgaria. The data subjects were customers of the controller. The controller submitted a copy of the data subjects' mortgage deed as evidence in a separate court procedure before the District Court of Sofia. The controller had obtained a copy of the document in the normal course of business with the data subjects. Bulgarian law required that the controller establish the property rights of its customers before executing a contract to supply heat. The Administrative Court of Sofia found that the controller had processed data on the property and financial situation of the data subjects contained in the mortgage deed without a legal basis under Article 6 GDPR and ordered the controller to pay the data subjects €127.82 Euro (250 BGN) each as compensation for non-material damages. The controller appealed the decision, taking the view that the lawful bases for processing the data subjects' personal data were "data subjects' consent," "neccessary for performance of a contract," and "necessary for compliance with a legal obligation," under Articles 6(1)(a), 6(1)(b), and 6(1)(c) GDPR respectively. The Supreme Administrative Court of Bulgaria upheld the decision by the lower court in its entirety. First, the Court confirmed that the controller had processed the data subjects' personal data: The mortgage contained the data subjects' personal data because it contained their names as well as financial and property information (all relating to identified natural persons per Article 4(1) GDPR), and the controller processed that data initially by collecting it. The Court clarified that retaining the data and later producing it before a court were further processing that required a legal basis under Article 6. Next, the Court acknowledged that the data subjects did in fact consent to the initial processing (collection) of their personal data, but it stressed that this consent extended only insofar as processing was nec
Court case 2 K 98/20
The plaintiff, a journalist, sought access to information in connection with the granting of "old-age compensation due to health problems" to former members of the Bundestag. He requested an anonymised or otherwise redacted overview of cases between 2000 and 2020 from the Bundestag, broken down by year and with information regarding whether they had been decided positively and negatively, as well as the number of cases since 2006 in which compensation had been paid out without their requirements being met. In addition, he requested an affirmation regarding the correctness and completeness of the information as well as access to all relevant administrative files. The German Bundestag rejected the plaintiff's applications on the grounds that access to information was contrary to the protection of personal data. It was highly likely that the applicant would be able to identify the persons concerned. This resulted from the fact that only a relatively small number of MPs left the German Bundestag prematurely. Since the career of individual MPs could be easily traced (e.g. by means of an internet search) the information and the files could be attributed to a narrowly defined group of persons, even if the documents were redacted. Insofar as the MPs were deceased, the disclosure would be contrary to the post-mortem right of personality. None of the persons concerned and none of the relatives of the deceased had declared their consent. The interest of the data subjects in secrecy outweighed the interest in information of the plaintiff, because the requested information was connected to the political mandate of the individuals concerned. In addition, it concerned sensitive health data. In three steps, the court held that the information concerning former members of the Bundestag is protected insofar as they are still alive. The court first established that the information concerning still living former members of the Bundestag constituted personal data. In accordance with Article 4(1) GDPR, an identifiable natural person is one who can be identified directly or indirectly, in particular by means of an association with an identifier such as a name. What is required is the possibility of establishing the identity of the data subject. In the context of determining whether a natural person is identifiable, account must be taken of all the means reasonably likely to be used by the controller or by any other person to identify the natural person, directly or indirectly (Recital 26 GDPR). In this light, the court held that the requested information constitutes personal data. The possibility that the living individuals concerned will be identified is not negligible. This applies irrespective of the fact that the plaintiff is only requesting information on the number of applications that have been decided, without naming names, and that the year of the decision does not necessarily correspond to the year of leaving the Bundestag. The group of persons potentially affected is limited which makes them identifiable. Second, the court held that the still living MPs' interest in secrecy outweighs the plaintiff's interest in information. According to Article 9(1) GDPR, the transmission of special categories of personal data, such as health data, is prohibited unless one of the conditions of Article 9(2) GDPR, such as explicit consent, is met. According to Article 4(15) GDPR, health data are personal data relating to the physical or mental health of a natural person from which information about his or her state of health emerges. Consequently, the information sought by the plaintiff concerns specially protected personal data as the data as to whether the Bundestag administration has given a positive or negative decision on an application pursuant to "old-age compensation due to health problems" contains an assessment by the Bundestag administration of the physical and/or mental state of health of the applicant. Furthermore, access to information was also precluded by § 5.2(1) of the German Freedom of Information Act. According to this provision, the applicant's interest in information does not prevail in the case of information from documents insofar as they are connected with a mandate of the third party (in this case, the Member of Parliament). Third, the court held that there are no grounds for exclusion for the information concerning deceased persons due to two reasons. Firstly, because natural persons within the meaning of Article 4(1) GDPR are only living persons (Recital 27 GDPR) the data concerning already deceased persons does not constitute personal data under the GDPR. Secondly, contrary to the arguments of the Bundestag, the post-mortem right of personality also does not prevent the disclosure of the concerned information. The deceased are not protected by the general right of personality under Article 2(1) in conjunction with Article 1(1) of the Basic Law as only living individuals are the bearers of this fundamental right. The protection of the post-mortem right of personality, also resulting from Article 1 (1) of the Basic Law, is an altogether separate right to the general right of personality. The post-mortem right of personality protects, on the one hand, a general right to respect, as well as, on the other hand, a right of the deceased to not be degraded or humiliated. Nevertheless, in the interpretation of the court, this right only protects against gross distortion, but not against mere questioning. In the present case, the disclosure would neither be connected with a degrading nor would it entail a gross distortion of the image of their life.
GLOBAL SALES SOLUTIONS LINE SLU
The Labour Chamber of the Spanish National High Court dealt with an appeal from a case in which a trade union sued a company for not providing their workers a corporate email and asking for a personal email instead (among other things). The workers were working remotely since the COVID-19 pandemic, and the company demanded their private emails in order to be able to communicate with the workers for diverse matters such as holidays requests, leaves, etc. This was established by a clause in their contracts. The company had also previously agreed to provide corporate emails to the workers. Additionally, the company had suffered a data breach in which their employees' private emails had been compromised. Upon this, the trade union had also asked the company to provide the list of such emails so they could communicate with the workers. The company replied that they would not provide the workers' emails without their consent. Given these facts, the Court first remarks that the law obliges the employer to provide their workers every means necessary to achieve develop their professional activity. In this regard, also, the law regulating remote work, passed in 2020, establishes that in any case, companies shall be obliged to provide the means, equipment, tools and consumables required for the development of remote work. Additionally, the Court highlights that the Court's case law has already established that demanding workers to provide their personal email or phone is a violation of GDPR, since, should they be necessary for the development of the workers' activity, they should hence be provided by the company. Therefore, the company would have breach the data minimisation principle from Article 5(1)(c) GDPR. With regard to the union's demand to provide a list of the workers' emails, the Court stated that, also according to the Court's case law, providing such list does not require consent since it is necessary for the development of the purposes of the right (and freedo