GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
The data subject requested the deletion of all his proceedings-related data stored by the child protection council. The council granted the request as to criminal investigations, but not to child protection investigations. The data subject filed a lawsuit with the Court, affirming the controller did not provide sufficient grounds for not deleting child protection investigation data. Moreover, this was accompanied by a claim for damages for deleting criminal investigation data with too big of a delay. The Court partially upheld the complaint. It agreed with the controller that child protection related data fell within the exception of Article 17(3)(b) GDPR, as it amounted to processing carried out in the public interest or in the exercise of official authority under Article 6(1)(e) GDPR. Provisions of national law sufficiently demonstrate the controller’s necessity to process personal data for the performance of its tasks in the public interest. Moreover, the controller adequately demonstrated that they were timely in the deletion of the criminal files, within a month from the request by the data subject. As such, no administrative fine was imposed by the Court. Still, the removal took place more than one year after proceedings, allowing for other government entities to consult the documents, thus causing distress in the data subject. Essentially, the controller was not proactive in the deletion of data about the criminal proceedings. Due to this, the data subject was entitled to symbolic compensation of €125.
A data subject filed a lawsuit against a psychiatrist who had prepared a psychological report in family proceedings on behalf of a district court. The data subject claimed that the psychiatrist had unlawfully processed their personal data and relied on Article 79 GDPR. The District Court dismissed the action. The data subject then filed an appeal before the Regional Court, represented not by a lawyer but by a non-profit association. The Regional Court rejected the appeal as inadmissible because, under [https://www.gesetze-im-internet.de/englisch_zpo/englisch_zpo.html § 78(1) of the German Code of Civil Procedure (Zivilprozessordnung – ZPO)], parties before Regional and Higher Regional Courts must be represented by a lawyer. The data subject sought legal aid (Prozesskostenhilfe) to challenge this decision before the Federal Court of Justice (Bundesgerichtshof – BGH). The BGH rejected the application for legal aid because the prosecution did not offer a sufficient prospect of success. The Court clarified that Article 80(1) GDPR did not change the national rule in § 78(1) ZPO, which requires representation by a lawyer before higher courts. Article 80(1) GDPR allows certain non-profit organisations to act on behalf of data subjects in exercising rights under Articles 77, 78 and 79 GDPR, but it does not give these organisations the right to represent parties in court proceedings where legal representation is mandatory. The Court explained that Article 80(1) GDPR regulates the right of a data subject to authorise an organisation to act on their behalf, but it does not confer postulatory capacity or modify procedural requirements under national law.
The resident of a flat (a data subject) filed a complaint with the Austrian DPA (DSB) alleging that her neighbor (the controller) had unlawfully recorded her and her children in her private garage and disclosed the images to a third party. The data subject and the controller were neighbors living in a shared residential complex with individual garage boxes in a common underground garage. The controller claimed that he had only a wildlife camera in his own car, or that he received the photos anonymously on a DVD, but these explanations were later found contradictory and not credible by the DPA. The DSB found that the controller had infringed the data subject in the right to secrecy. He unlawfully took pictures of the data subject using at least one camera installed in the garage box and he transmitted unlawfully these images to a third party. DSB argued that the GDPR is applicable because the data processing had intervened in the sphere of third parties. The processing of data was not exclusively for personal or family activities and thus did not take effect the household exception of Article 2(2)(c) GDPR. The controller appealed to the Federal Administrative Court (BVwG). The Court dismissed the appeal and upheld the DSB’s decision. The court held that the video recording of natural persons, provided that it enables the identification of the data subject, constitutes processing of personal data, that falls within the scope of the GDPR, see CJEU case law. However, in accordance with Article 2(2)(c) GDPR, the regulation does not apply to the processing of personal data by natural persons for the exercise of only personal or family activities, see CJEU case law. Insofar as video surveillance extends only partially to the public space and is therefore directed to an area outside the private sphere of the person who processes the data in this way, the court found that it cannot be regarded as an exclusively “personal or family” activity, under CJEU case law. The cont
The controller is a private security company providing security services at a shopping centre in Bavaria. In January 2021, a security guard working for the controller asked multiple times the data subject to leave the seating area owned by the controller. The situation became tense, to the point that the police was called. In 26 July 2021, the data subject lodged a complaint with the Data Protection Authority (Bavarian Data Protection Authority - LfD Bayern) against the controller, alleging that the security guard started recording him without his consent with his body-worn camera. According to the data subject this constituted unlawful processing of personal data under the GDPR. The controller explained that the guard activated the camera only after the data subject repeatedly refused to leave a restricted seating area, that the recording was communicated to the data subject, that a red indicator light signaled recording, and that the footage was deleted once its purpose of identifying the individual for possible civil action had been fulfilled. The DPA held that it was no longer possible to clarify whether the data subject had been aggressive or whether the bodycam had only been activated after the announcement. The DPA therefore assumed that the security guard had acted in accordance with its operational policy. It decided to rejected the complaint, finding that the recording was justified under Article 6(1)(f) GDPR as necessary for the controller’s legitimate interests of protecting property and ensuring safety. The data subject then appealed the decision of the DPA before the court of first instance (Administrative Court of Ansbach - VG Ansbach). The court upheld the DPA’s decision, holding that the DPA had sufficiently investigated the matter and properly exercised its discretion under Articles 57 and 58 GDPR. It found no violation of the GDPR, noting that the processing was proportionate and limited to a specific incident. The data subject appealed again
BOSCO is a tool used by the Spanish Ministry for Ecological Transition (MITECO). Electricity companies use BOSCO to automatically check whether vulnerable consumers qualify for assistance for their electricity bill. In 2018 Fundación Ciudadana Civio (referred to as “Civio”, a nonprofit organisation) requested from MITECO access to technical documentation and source code in order to audit how automated decision-making took place. According to Civio, a significant number of people were denied access to this social bonus even if they seemed to meet the requirements. People also did not receive an explanation on why their request was denied. Civio filed a complaint with the Transparency and Good Government Council (CTBG), after not receiving a response from MITECO. The CTBG granted Civio access to technical specifications and test results, but denied access to the source code on intellectual property grounds. Under national law ([https://www.boe.es/buscar/act.php?id=BOE-A-2013-12887#top the law on transparency, access to public information and good governance, or LTAIBG]), the right to access to public institutions may be limited if it harms professional secrecy and intellectual property. Civio appealed the decision to the Court of First Instance and High Court. Both courts denied access to the source code, on the grounds that it violated intellectual property rights. The right to access could also be limited in this case due to the security implications of disclosing the source code; according to the Court, the vulnerabilities found in the code could be used to access databases connected to BOSCO (such as those managed by the Tax Authority and Social Security). Civio appealed the decision to the Supreme Court. Civio argued that the courts had misinterpreted [https://www.boe.es/buscar/act.php?id=BOE-A-2013-12887#a14 Article 14(1) LTAIBG] to completely limit the right to access; the courts did not consider that the limit must be necessary and proportionate, especially
On 16 May 2025, the data subject made an access request to the controller by letter. On 20 May 2025, the controller informed him that his letter had been received and that his request was being examined, but clarification could take time. On 23 June 2025, the data subject brought a case before the court of first instance (Administrative Court Düsseldorf -VG Düsseldorf), claiming that the controller failed to satisfy his request. The court pointed out that the one month deadline in Article 12(3) GDPR only refers to the provision of the status report on the measures taken pursuant to the request. According to the court, it does not set a deadline for the fulfillment of the rights or claims of the data subject enshrined in Articles 15-22 GDPR. In this case the controller provided the data subject with a status report in due time. Therefore, it complied with its obligation to inform the data subject of the measures taken to satisfy his request for information within the one-month period pursuant to Article 12(3) GDPR. The court found the action inadmissible.
In June 2017, the Single Resolution Board (SRB) adopted a resolution scheme in respect of Banco Popular Español SA. In order to determine whether the shareholders and creditors affected by the resolution action would have received better treatment if that bank had entered into normal insolvency proceedings, SRB asked Deloitte, an auditing and advisory company, to carry out the valuation. Once that valuation was drawn up, in August 2018, the SRB adopted a preliminary decision on whether compensation needed to be granted to the shareholders and creditors (participants), and launched a right to be heard process in order to allow it to adopt a final decision. The participants were invited to express their opinions using an online registration form which permitted SBR to verify their status as affected shareholders and creditors. In the context of that procedure, in June 2019, the SRB transferred some of those comments, in the form of pseudonymised data bearing an alphanumeric code, to Deloitte. Later in 2019, a number of affected participants submitted complaints to the European Data Protection Supervisor (EDPS). They alleged that the SRB had failed to inform them that the data collected through their responses on the forms would be transmitted to third parties, in breach of the terms of its privacy statement. In its decision in November 2020, the EDPS held that the pseudonymous data shared by the SRB constituted personal data because the SRB shared the alphanumeric code that allowed linking the replies to the participants. It found that Deloitte was a recipient of personal data and therefore SRB had infringed the obligation to provide information laid down in Regulation 2018/1725 by not including it in the privacy policy. The SRB brought an action for annulment of the EDPS’s decision before the General Court of the European Union, arguing that the information transmitted to Deloitte did not constitute personal data. The General Court of the European Union uph
The data subject is a police officer, holding various positions at the Internal Security directorate-general of the Bulgarian Ministry of the Interior (controller). In March 2016, investigative proceedings were commenced concerning an unknown offender in connection with an offence of theft. A few days later, the data subject was arrested and after being detained in police custody for 24 hours, he was released. Subsequently, he was neither placed under formal investigation nor charged, but he was the subject of several investigative measures, which in the course of 2016, were suspended without the offender having been identified. The controller stored the data about the criminal investigation on his personnel file, as provided by the ministerial instruction relating to personnel files, issued as a regulatory act pursuant to the statutory authorisation provided for in the Law on the Ministry of the Interior (ZMVR). The data subject continued his duties as a police officer and took part in selection procedures for promotion to other posts within the Ministry but he was rejected. The data subject brought an action before the Sofia District Court (Sofiyski rayonen sad) seeking compensation for non-material damage for the fact that he has not been promoted or transferred to other duties on account of his having been a suspect in the investigation. In addition, he asked that his name be erased from the database kept by the controller, in which he is mentioned as a suspect. In this context the court decided to stay the proceedings and to refer some questions to the CJEU for a preliminary ruling, regarding the interplay of the GDPR with the Law Enforcement Directive (LED), and more specifically regarding the storage of data concerning the official in his personnel file. The questions were combined and reformulated by the AG as follows: # whether Article 2(1) GDPR and Article 9(1) LED are to be interpreted as meaning that the GDPR applies to the storing, by a public autho
In 2017 (before the GDPR entered into force), a data subject requested an online physician search platform (the controller) to erase their data. The controller refused, and the data subject brought a claim before a civil court. The data subject requested the controller to erase their data again after the GDPR had entered into force. This request was refused, and the data subject filed a complaint with the Austrian DPA. The DPA dismissed the complaint, on the grounds that they had previously brought the same matter before a court. According to the DPA, filing parallel or consecutive claims with a supervisory authority and a court was incompatible with the remedial mechanism under the GDPR. At the time, the civil court had not reached a final decision. The data subject appealed the decision to the Federal Administrative Court (Bundesverwaltungsgericht, or BVwG), who dismissed the appeal. The BVwG stated that the one-year limitation period under Austrian law had passed, and therefore, the data subject did not have the right to file a complaint with the DPA. The fact that the GDPR had entered into force did not interrupt the limitation period. Both the data subject and the DPA appealed the decision of the Court to the Supreme Administrative Court (Verwaltungsgerichtshof, or VwGH). The VwGH disagreed with the reasoning of the BVwG; the limitation period only started after the controller rejected the data subject’s second erasure request, after the GDPR had entered into force. The VwGH stayed proceedings and requested a preliminary ruling from the CJEU. The question was based on the Case C-132/21, in which the CJEU held that the right to lodge a complaint with a supervisory authority (Articles 77(1) and 78(1) GDPR) may be exercised independently from the right to a judicial remedy against a controller or processor (Article 79(1) GDPR). The VwGH requested the CJEU to clarify the relationship between the remedies, and specifically, whether a DPA can reject a complaint
The data subject ("IP") was a candidate in a staff selection process for the bank Quirin (‘the controller’), which took place via an online portal. An employee of the controller, using the online portal's messaging service, erroneously sent a third party a job offer only intended for the data subject disclosing details about the data subject's salary exceptions and the salary offered to them. The data subject brought an action before the Regional Court seeking an order that the controller refrain in future from processing, either by itself or through third parties, his personal data relating to the selection process, ‘if that processing occurs as it did in the message sent via the online portal’. The data subject also claimed non-material damages. The Landgericht (Regional Court) partially upheld the application, however the data subject pursued all his claims in full through two instances. Against that background, the Federal Court of Justice (Bundesgerichtshof - BGH) referred six questions to the CJEU for a preliminary ruling: # May the data subject require the controller to cease and desist further unlawful onward transfer of personal data under Articles 17 or 18, or any other provision GDPR, if the data subject does not request the controller to erase the data, where unlawful processing of personal data has already taken place? # If the answers to Questions 1 is in the affirmative, does the right to obtain a prohibitory injunction under EU law exist only if a risk of recurrence exists? # If the answers to Questions 1 is in the negative: Must Article 84 GDPR, in conjunction with Article 79 thereof, be interpreted as permitting the national court to confer on the data subject a right to obtain a prohibitory injunction against the controller prohibiting further unlawful onward transfer of those data in accordance with the provisions of national law? # Do simple negative feelings (such as discontent, annoyance, anxiety and fear) fall within the meaning of moral da
= The Schrems II ruling of the CJEU annulled the Commission’s adequacy decisionCommission Implementing Decision (EU) 2016/1250 of 12 July 2016. that declared that the US offered an equivalent level of protection for personal data. Following the decision, the EU and the US established the Trans-Atlantic Data Privacy Framework (DPF). The DPF is a set of legal acts which, altogether, aim to address the shortcomings in US protection of European data highlighted by Schrems II. In particular, the DPF established: * a Privacy and Civil Liberties Oversight Body (PCLOB) with oversight powers on the activities of intelligence agencies * a Data Protection Review Court (DPRC) with the power to review and overturn the PCLOB’s decisions. Based on the new safeguards introduced with the DPF, the Commission considered that the US offered an adequate level of data protection and adopted a new adequacy decision allowing for data flows ([https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj/eng Commission Implementing Decision 2023/1795 finding an adequate level of protection ensured by the United States]). The decision allowed EU entities to transfer data to US-based recipients on the basis of Article 45 GDPR (as long as the recipients were certified under the Data Privacy Framework programSee point 2.1.1. of the adequacy decision. A similar limitation was also in place for the Privacy Shield, i.e. the pre-Schrems II data transfer framework.). = In October 2023 French citizen Pierre LatombePhilippe Latombe is a Member of the French Parliament and a Commissioner for the French DPA (CNIL). However, he acted as a private citizen. filed an annulment action with the CJEU against the new adequacy decision from the commission (from now on: ´the adequacy decision´). Contrary to the Commission’s findings, Latombe claimed that the US did not ensure a sufficient level of protection for personal data in the context of third-country data transfers, as required by Article 45(2) GDPR. In particular,
The Disputes Chamber of the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit – GBA) adopted a decision concerning Mediahuis NV in connection with an asset deal for the sale of Jobat’s activities. Jobat was a job platform operated within the Mediahuis group, with Mediahuis acting as its controller. In the course of the asset sale, Mediahuis transferred Jobat’s user database, containing personal data of jobseekers and employers, to the buyer, Hors BV. A data subject complained that this transfer was unlawful under the GDPR, as Mediahuis had not identified a valid legal basis or properly informed the affected users. The GBA found that Mediahuis had failed to conduct a proper and documented assessment of the legitimate interest it relied upon under Article 6(1)(f) GDPR. The GBA also found that Mediahuis had not properly informed data subjects as required by Article 5(1)(a), Article 12, and Article 13 GDPR. Mediahuis appealed the decision before the Market Court (Court of Appeal of Brussels). It argued that the GBA had breached the principle of legal certainty , misinterpreted the definition of “processing” under Article 4(2) GDPR, and violated Mediahuis’s rights of defence. Mediahuis also claimed that the GBA had not been consistent with its own dismissal policy and that the complaint constituted an abuse of rights. The Court dismissed the preliminary arguments of Mediahuis. It held that the data subject had not abused their rights and that the GBA retained discretionary power to decide whether or not to dismiss a complaint under Belgium law and Article 57(1)(f) GDPR. The Court clarified that controllers have no “right to dismissal” and that the GBA did not need to justify a decision not to dismiss a complaint. However, the Court found several substantive flaws in the GBA’s decision. It ruled that the Disputes Chamber had given contradictory reasoning by treating the data transfer as both a separate “processing” under Article 4(2) GDPR and a mere step
The Public Employment Service (the controller) is a body responsible for implementing the federal government’s labour market policy. The controller developed a model for calculating jobseekers’ labour market opportunities (“AMAS”), as a tool for advisors to use in assessing jobseekers’ labour opportunities. This model uses data subjects’ personal characteristics (e.g. age, gender, education, previous career) to predict their future chances of integrating into the labour market. The controller planned on making its use mandatory from 2021 onwards. However, it also implemented measures to ensure that AMAS was used as a secondary opinion only; for example, advisors were trained to use AMAS and assess labour market opportunities independently. Advisors were also obliged to explain data subjects the conclusions reached by AMAS, and discuss any possible concerns. The DPA initiated an ex officio investigation, and prohibited the controller from processing personal data using AMAS because the controller did not have a suitable legal basis. Furthermore, the processing was profiling within the meaning of Article 4(4) GDPR, and the prohibition of automated decision-making under Article 22 GDPR applied in any case. The controller appealed the decision to the Federal Administrative Court (BVwG), who annulled the decision of the DPA. According to the BVwG, the controller is allowed to carry out this processing of personal data in accordance with national law. The DPA appealed the case to the Supreme Administrative Court (VwGH)You can read the GDPRhub summary here: VwGH - Ro 2021/04/0010-11. The VwGH stated that there was a possibility that AMAS constituted automated decision-making within the meaning of Article 22(1) GDPR. This was the task of the BVwG to investigate; according to the VwGH, the processing would be prohibited if there was automated decision-making unless the exceptions under Article 22(2) GDPR were met. The Court first stated that AMAS engaged in profiling in
The data subject was a Dutch real estate entrepreneur who was criminally convicted. Google (the controller) was the operator of the internet search engine Google Search. When the name of the data subject was searched on the controller's search engine, results included an URL that referred to an article, in which it was stated, among other things, that they had criminal convictions. The data subject filed a complaint against the publisher of the article with the Netherlands Press Council, and the Press Council rejected the complaint, ruling that the publication did not violate the data subject’s privacy rights. Also, the data subject sent multiple requests to the controller to remove the URL linking to the article, and the controller rejected all of these requests. Finally, the data subject asked the court to order the controller to remove the specific URL that links to this article from its search results when someone searches for their name. The data subject stated that the article contained old and inaccurate information, and that it was harmful for their reputation and their ability to do business. They also stated that there was no strict public need for these details to remain accessible, and the controller lacked overriding legitimate grounds for processing this data. The court rejected the data subject’s request to remove the URL from the controller, finding that they failed to prove that a substantial portion of the information was manifestly inaccurate. The court clarified that the processing of personal data by a search engine is justified under Article 6(1)(f) GDPR, and that Article 17 GDPR grants a right to erasure only if processing is incompatible with the GDPR. Article 17(3)(a) GDPR makes clear that the right to removal does not apply when processing is necessary for freedom of expression and information, requiring a balancing test between with the data subject’s right to privacy and data protection. Article 21 GDPR allows individuals to object
A national of India, the data subject, lodged an application for international protection with the responsible Austrian authority, the controller, which was dismissed and a return decision was issued. Consequently, the data subject’s data was entered into the Schengen Information System (SIS), a system used to track return decisions for third-country nationals unlawfully staying in the EU. The data subject remained in the Schengen area and did not leave. Furthermore, he requested that the Austrian authorities delete his SIS entry, claiming that Portugal had promised him a residence and work permit if the SIS entry was removed. The controller refused to delete the SIS record because the return decision was still valid, the data subject had not left the EU and Portugal had not officially notified Austria of any residence permit grant or consultation as required. The data subject further lodged a complaint with the Austrian Data Protection Authority (DSB) for an alleged violation in the right to erasure under Article 17 GDPR. The DSB dismissed the complaint, finding the SIS data processing lawful. Then, the data subject appealed the decision to the Federal Administrative Court (BVwG). The appeal was dismissed as unfounded. The court held that the SIS entry was lawful under the relevant legislation and there was no legal ground for deletion. Moreover, the right to erasure did not apply, because the SIS processing was required to fulfill a legal obligation under Article 6(1)(c) GDPR and was performed in the exercise of official authority under Article 6(1)(e) GDPR, falling under the exception of Article 17(3)(b) GDPR. The court also clarified that the processing also met the exception under Article 9(2)(g) GDPR for sensitive data.
A data subject filed twenty data-protection complaints between April 2021 and August 2024 against twelve different controllers, alleging violations of the GDPR rights to access, confidentiality, erasure, rectification, and restriction of processing. These complaints were submitted as free-form email attachments rather than using the authority’s structured form, and they consistently contained accusatory, hostile, and often insulting language toward the controllers and toward the Austrian Data Protection Authority (DSB). In many of the complaints, the data subject claimed that access requests had been ignored or incompletely answered, that deletion requests were not fulfilled, or that data had been unlawfully processed or disclosed. Also, the data subject frequently used derogatory expressions combined the GDPR allegations with extensive personal attacks, and repeatedly demanded “as high penalties as possible.” The DSB refused to process the complaints, arguing that the complaints were excessive, abusive, and not genuinely aimed at protecting GDPR rights. The data subject further appealed this refusal to the Federal Administrative Court (BVwG). The court dismissed the complaint and held that the DSB lawfully refused to process the twenty complaints under Article 57(4) GDPR on the ground that they constituted excessive and abusive requests. The Court emphasized that, under CJEU case law, supervisory authorities may refuse to act when complaints are objectively abusive, particularly when the data subject’s dominant intent is unrelated to GDPR-protected purposes. Although a mere quantity of complaints cannot be the sole basis for refusal, the data subject’s pattern, combined with clearly retaliatory and hostile motives, satisfied the requirement of proving misuse. The Court found that the data subject used GDPR procedures as a means of personal confrontation, not to vindicate data-protection rights, and thus his conduct fell squarely within “excessive” and “abusive”
A data subject was employed by the controller for several years. In 2010 the controller and the data subject signed also a loan agreement. Before concluding the loan agreement, the controller carried out a credit check which resulted in a classification of the data subject’s creditworthiness, nevertheless, a further processing of data of the data subject for the purposes of automated decision-making including profiling did not take place. The controller terminated the employment on 2018. On 2020, the data subject filed a complaint against the controller for allegedly failing to provide complete information and to comply with the request of the data subject for the transfer of the data under Article 15 and 20 GDPR. At a later stage in the proceedings, the data subject withdrew the complaint relating to the exercise of rights under Article 20 GDPR. Although the controller provided several sets of documents between 2018 and 2020, the data subject claimed these were incomplete according to Article 15 GDPR, that the controller’s responses were insufficient and the legal basis for data processing was not clearly explained. The data subject also claimed that its loan-related information was only partially provided and the automated processing of its personal data for credit analysis constituted profiling under Article 4(4) and 22 GDPR. The controller stated that it had provided extensive data in paper and electronic form in a comprehensive and structured manner, that some data were unavailable or withheld to protect third-party rights and that information on the systematic analysis of credit risk was a trade secret. On 19 October 2021, the DPA partially upheld the data subject’s complaint, finding that the controller had violated the data subject’s right to information, because there was no reference to the processing purposes within the meaning of Article 5(1)(b) GDPR and the legal basis was not clear , and also the controller could not rely solely on business or trade se
The data subject is a widely known actor and professional voice actor. The controller operated a YouTube channel with an associated online shop. The controller published two political satire videos on YouTube. The videos used an AI-generated voice that closely imitated the data subject’s voice. Viewers in the comments identified the voice as that of the data subject. The videos ended with references to the controller’s online shop, which sold merchandise linked to the channel’s political positioning. On 28 September 2023, the data subject contacted the controller and objected to the use of his voice. He requested cessation of use and reimbursement of legal costs. The controller submitted a cease-and-desist declaration but refused to pay damages, arguing that the voice was synthetic, lawfully acquired from an AI provider, and used for satire rather than advertising. The data subject claimed that the AI-generated voice constituted use of his personal voice, that the processing occurred without consent, and that it created the impression that he endorsed the videos and products. He sought compensation equivalent to his usual licensing fees and reimbursement of legal costs. First, the court held that the controller unlawfully interfered with the data subject’s right to his own voice. Although the voice was AI-generated, it closely imitated a distinctive personal characteristic attributable to the data subject. The court considered that a significant part of the audience would associate the voice with the data subject, which was sufficient to establish personal attribution. Second, the court addressed the issue under data protection law and noted that the use of an AI-generated voice imitating a real person can qualify as processing of personal data. The court examined Article 6(1) GDPR and found no valid legal basis. The data subject had not given consent under Article 6(1)(a) GDPR. Contractual necessity under Article 6(1)(b) GDPR was irrelevant. The controller relied
The data subject submitted an access request under Article 15 GDPR to Dun & Bradstreet Austria GmbH, a credit information agency, requesting information about how her personal data was being processed. The data subject subsequently lodged a complaint, claiming that the right of access had been violated by the credit information agency for not providing complete or correct information in response to the access request and its subsequent updates. The DSB partially upheld the complaint for violation of the right of access under Article 15 GDPR by the credit information agency and found that it violated the data subject’s fundamental right to data protection : a) Regarding the categories of personal data processed, b) Concerning the credit environment data of the data subject, c) With respect to the weighting of influencing factors used in the automated decision-making, and d) As to the scope and intended effects of automated decision making. The credit information agency lodged an appeal to the Federal Administrative Court, which, partially upheld the appeal regarding points a, b, and d and dismissed the appeal as unfounded regarding point c, emphasizing that the credit information agency violated Article 15(1)(h) GDPR by not providing sufficient information about the logic of automated processing and weighting of factors. The credit information agency then filed an appeal to the Austrian Supreme Administrative Court (VwGH), arguing that it had not violated Article 15(1)(h) GDPR. The VwGH suspended the case, awaiting rulings from the CJEU in SCHUFA Holding (Germany) and Dun & Bradstreet Austria (Austria), which dealt with similar issues around credit scoring and automated processing under GDPR. The Austrian Supreme Administrative Court (BVwG) dismissed the appeal. Under Article 15(1)(h) GDPR, data subjects have the right to meaningful information about automated decision-making and to exercise this right, automated decision-making as defined in Article 22(1) GDPR mu
The defendant, through a webshop, entered into a contract with a Croatian telecommunications provider using another person's personal data without that person's knowledge or authorization. She subsequently purchased a mobile phone, which she retained for her own use, and failed to pay the due instalment amounts totalling EUR 546.44. The prosecution argued that such conduct breached the GDPR and amounted to the unauthorized use of personal data under Croatian criminal law. At the same time, it claimed that the defendant had also committed the criminal offence of fraud under the Croatian Criminal Code. The court held that the defendant committed a criminal offense against privacy. Because the defendant intentionally used personal data without permission and without a valid legal basis under Article 6(1) GDPR, the court held that she committed the criminal offense of violation of privacy under Article 146(1) of the Croatian Criminal Code. The court sentenced her to a prison term of four months. Additionally, the court found that the defendant intention was to obtain unlawful pecuniary gain for herself by misleading Croatian telecommunications provider using another person's personal data without that person's knowledge or authorization. The court held that she committed the criminal offense of violation of property under Article 236(1) of the Croatian Criminal Code. The court sentenced her to a prison term of six months. Ultimately, the Court used relevant articles of Croatian criminal code and combined the sentences into single nine-month prison term. It then imposed a suspended sentence, so the prison term would not be executed if the defendant did not commit another crime within a two-year probation period. The court explained that it could revoke the suspended sentence if the defendant committed another offense that resulted in imprisonment. The court also ordered her to pay €140 in procedural costs. It held that this sanction was sufficient to prevent future vi