GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Court case 22/03293
In the present case, the data subject had made an application after the six-week time limit laid down in Article 35(2) UAVG. The facts are as follows. The data subject had taken out a student loan in 2002, and consequently, the details of it were registered in the Dutch Central Credit Registration Office (BKR). This body keeps records of private parties that have taken out credit. In early 2018, the data subject had applied for a loan and was denied due to the financial records on their credit history kept by the BKR. On 27 June 2018, the data subject submitted an objection to processing (Article 21 GDPR) to BKR. By a letter dated 23 July 2018, BKR responded in the negative, refusing to comply with the objection. On 30 October 2018, the data subject made a request to the court to order the controller to comply with the request made under Article 21 GDPR. The Court at first instance dismissed the application because it fell outwith the 6-week time limit under Article 35 UAVG. The data subject appealed this decision. The main question brought before the Court was whether it was possible to raise an objection to the procesing of personal data in summary proceedings following the six-week time limit set out by Article 35(2) of the UAVG (Uitvoeringswet Algemene Verordening Gegevensbescherming). The UAVG is the Dutch national transposition of the GDPR. Article 35 UAVG implements Article 79 GDPR, and provides: "1. If the decision on a request as referred to in Article 34 has been taken by a body other than an administrative body, the interested party may apply to the court with a written request to order the controller to comply with the request referred to in Articles 15 to 22 of the Regulation. 2. The application shall be made within six weeks of receipt of the answer from the controller. If the controller has not replied within the time limits referred to in Article 12, paragraph 3 of the Regulation, the submission of the application shall not be subject to a period." O
Court case W211 2261980-1
The data subject concluded a contract with an app operator (the controller) in 2017 for the use of a health and fitness app, which she used until 2021. The data subject submitted a request for a transfer of her training data from 2020 in a structured, commonly used and machine-readable format by virtue of Article 20 GDPR. The controller refused to do so because her request referred to an outdated version of the app which had been discontinued in the meantime, that is, the data were no longer synchronised to the servers of the controller and were only locally saved and processed on the data subject's device. Yet, the old app could still be used locally, hence, data processing only took place on the users' devices but the controller did not have access to the data and could thus not process them. Furthermore, users could access and download all of their training and health data from the website of the controlller, which the data subject did. The users were notified of this change in a sufficient way. However, the data subject argued that she had not been properly informed of the changes regarding the processing and, as a layperson, she could not have known the difference. Furthermore, she pointed out that the "raw data" provided was not useable for the average user and that the controller kept processing her personal data because her contract with the controller had never been amended nor terminated. The Austrian DPA (DSB) dismissed the complaint based on the fact that essentially no data was processed by the controller between 2020 and 2021 and thus Article 20 GDPR could not apply. Dissatisfied with the DSB's decision, the data subject filed an appeal with the BVwG, restating the arguments she had broguht before the DSB. The BVwG held that after the date of the discontinuation, the data subject's training data was no longer saved and processed on the servers of the controller and data processing only continued on the device of the data subject through her own acti
Court case 4 ZB 23.1056
The data subjects in this case are co-owners of a property with two residential units with a total of six residents. A water meter was installed inside their house in order to record the property's total water consumption. The calibration validity of the water meter expired in 2020. The controller is a municipal special purpose association that operates a public water supply system. The association committee decided in 2019 to replace installed analog water meters with electronic water meters equipped with radio modules - which can be read remotely. This should have taken place in 2021 as part of the regular exchange of water meters. The municipal special purpose association informed the complainants about the expiration of the calibration period and the intended replacement of the water meter. The data subjects denied access to their property and objected to the installation of an electronic water meter with a radio module, making reference to their right to objection under Article 21(1) GDPR. With a notice, the controller obliged the data subjects to grant one of his employees access to the water meter, stating that in case of non-fulfillment they would impose a fine. The controller submitted that, among others, the requirements for an objection under the GDPR were not given in this case. The data subjects, however, continued to refuse access to their property and filed a lawsuit against the controller's decision for violation of their fundamental and privacy rights. The Administrative Court Bayreuth (VG Bayreuth) held that the notice of the municipal special purpose association was based on the statutes governing the public water supply facility. The installation of electronic water meters did not violate their fundamental rights to informational self-determination or to inviolability of the home, included in the Constitution of the Federal Republic of Germany. It also did not violate the provisions of the GDPR. For these reasons, the VG dismissed the case. Co
Court case 3 S 13/23
A data subject bought a TV and a wall mount from an electronics shop (the controller) and, upon returning the wall mount, she received the price of the TV back, which was more expensive. After acknowledging the mistake, one employee tried to contact her autonomously using her private Facebook account via Facebook Messenger, which is not a common practice of the controller. After unsuccessfully asking the controller to provide her with information regarding the employees who contacted her, the data subject filed a first-instance application with the Local Court of Bühl (Amtsgericht Bühl - AG Bühl). Among others, the data subject sought an injunction to obtain information on which employees (name and surname) of the controller had been given access to her personal data and to prohibit those employees to further use her personal data. The AG Bühl held that employees cannot be seen as ‘recepients’ according to Article 15 GDPR, and thus the data subject does not have a right to obtain from the controller information about their identity. The AG Bühl thus dismissed the action and the data subject appealed the decision to the LG Baden-Baden. The LG Baden-Baden, making reference to the CJEU Judgment in CJEU - C-579/21 - Pankki S, acknowledged that employees of a data controller cannot, in principle, be regarded as recipients under Article 4(9) GDPR. However, this only applies when employees process data under the supervision and following instructions of the employer. In the case at hand, the employee acted in her private capacity, thus outside the supervision of the employer and contravening its instructions. For this reason, the LG Baden-Baden held that the employee who privately contacted the data subject should be seen as a ‘recepient’ under Article 4(9) GDPR. Therefore, the data subject has a right to obtain from the controller information about the recipient (i.e. the employee’s name and surname) according to Article 15(1)(c), in particular, insofar as this informa
Court case 51 C 206/23
The controller in this case is the owner of an online shop selling PC software, computer accessories and other items. On 29 June 2022, a data subject ordered €77 worth of items but did not make the payment. For this reason, the controller sought to engage a debt collection agency to enforce the payment, unsuccessfully. Hence the controller sued the data subject before the District Court of Düsseldorf (Amtsgericht Düsseldorf -AG Düsseldorf). In the course of the same procedure, the data subject asked the controller to obtain access to his personal data pursuant to Article 15 GDPR and to receive a copy of his data under Article 15(3) GDPR. The controller did not fulfil the request of the data subject, who filed a counterclaim in order to obtain access to his personal data. The controller submitted that it could not respond to the access request, because the data subject failed to prove his identity and it also claimed that the counterclaim constituted an abuse of right by the data subject. The data subject, thus asked the court to order the controller to comply with his request under Article 15 GDPR and to award him damages in the amount of at least €1,000 pursuant to Article 82 GDPR. As regards the counterclaim of the data subject, the AG Düsseldorf held that the controller had no legitimate reason to refuse to comply with his access request. The court clarified that the controller could not rely on the fact that the data subject failed to prove his identity. As a matter of fact, the court held that a controller may only ask for identification under Article 12(6) GDPR if there are reasonable doubts about the identity of the data subject, which could not be proven in this case. Hence, the court held that the controller violated Article 15 GDPR and this gave rise to a right to compensation for non-material damages under Article 82(1) GDPR. In calculating the amount of immaterial damages due, the court held that this should not depend on how economically powe
Court case 202201620/1/A3
The data subject’s home was photographed in 2012 for the purposes of a tax valuation, under the Property Valuation Act. The photographs were initially processed lawfully (for tax valuation), but then afterwards put in a database and used for other purposes. The Municipal Executive of Breda (the controller) held these photographs and initially was the body responsible for tax valuations. In 2019, the Municipal Executive of Breda transferred these responsibilities to the West Brabant Tax Authority of Breda, which then became the competent public body for handling tax valuations in Breda. On 26 April 2020, the data subject (appellant) requested the Municipal Executive of Breda (the controller) to erase the photographs from their internal database. The photographs were focused on the architectural features of the home and the overall state of the property. However, from these photographs, the data subject’s license plate could be seen, as well as framed family photographs in the home. On 15 May 2020, the Municipal Executive of Breda refused to erase the photographs, because the database that they were held in was transferred to the West Brabant Tax Authority of Breda and erased from the Municipal Executive’s systems. The data subject objected to the Municipal Executive’s refusal and made a formal complaint against the Municipal Executive’s decision through its internal disputes system. On 24 November 2020, the Municipal Executive declared the claim unfounded and rejected the data subject’s request for damages. On 4 February 2022, the data subject appealed the Municipal Executive’s decision in court. The Court dismissed the appeal and declared the case inapplicable. The data subject appealed this decision. On 4 July 2023 the appeal was declared admissible by the Netherlands’s Administrative Jurisdiction Division of the Council of State (the country’s highest administrative court). The Court’s decision addressed two key issues, the applicability of the GDPR to th
Belastingdienst
The data subject is the owner of multiple companies that were subject to several investigations that subsequently led to him losing subsidy grants. The data controller filed a request to access all information related to him and his companies in the Tax Authorities' records to understand why the grant was lost. The data subject specifically inquired about any information on him that was processed by the Tax Authority's Fraud Signalling Provision (FSV) and whether he was being subject to automated decision-making. The Tax Authority confirmed that the data subject’s personal data was held by the FSV and indicated that the information was not used for automated decision-making or profiling. The Authority denied the data subject access to information held by the FSV because there was an ongoing investigation into the legality of the systems used by the Tax Authority. Following the rejection, the data subject appealed the decision and requested access to information about him in eight of the Tax Authority's systems, including the FSV. In a decision of 10 January 2022, the Tax Authority rejected the appeal and stated that the request fell outside of the scope of the initial request and that access could not be granted due to the ongoing investigation. The data subject appealed the decision of 10 January 2022 to the Gelderland District Court. The Court first evaluated if the controller met the obligation to grant access to data according to Article 15 GDPR. In this instance, the controller is the Minister of Finance, as they are responsible for the oversight of the Dutch Tax Authority. Given the first request's broad nature, which requested information from FSV and similar systems controlled by the Tax Authority, the Court acknowledged that ongoing investigations into these systems prevented the Authority from providing access to them. However, the Court ruled that the controller was required to confirm whether the data subject's personal data was held in systems used by the Tax Authority. Next, the Court considered whether the data subject's second request made in their appeal fell within the scope of the first access request and if the controller was obligated to comply with it. The Court held that the first request's broad nature meant that the request regarding the eight specified systems were not an expansion of but a clarification of the original request. The Authority's refusal, based on the ongoing investigations of the FSV and similar systems, was deemed not to be a reasonable basis for refusing the access request. The Court held that if specific systems could not be accessed, the controller should specifically explain to the data subject why this was, rather than offering a generalised answer. Therefore, the Court concluded that the controller was obligated to meet the data subject's request and that the Authority's grounds for refusal were invalid. Lastly, the Court assessed whether the data subject had received a sufficient response about the use of his data for automated decision-making or profiling, in line with Article 22 GDPR. Given that the data subject's information was identified in the FSV's systems, he held the right to be informed about the existence of any automated decision-making. The Court argued that simply informing the data subject that his information was not used for automated decision-making or profiling was not sufficient and that, in this regard, the data subject had the right to inspect and validate the use of his information. As a result, the Court annulled the Tax Authority's decision of 10 January 2022 and instructed the Minister of Finance to issue a new decision regarding the data subject's appeal within six weeks of the Court decision.
Court case 15 U 184/22
The dispute involved a data subject seeking complete access under Article 15 GDPR from the controller (a hospitla). Initially, the claim included multiple defendants and medical liability claims, which were dropped in favour of the data disclosure claim. The data subject alleged that the first defendant had not provided complete information, particularly concerning data shared with their liability insurance company. The Higher Regional Court Cologne held that the data subject was entitled to complete access under Article 15 GDPR. The court found that the previous access was incomplete, especially regarding the internal correspondence with the liability insurance. The data subject's claim for damages under Article 82 GDPR was, however, dismissed due to the lack of concrete demonstration of the alleged immaterial harm.
Dutch DPA
The Dutch Data Protection Authority, the defendant in this case, received multiple complaints regarding DPG's (a magazine publisher) practice of requesting ID verification for data erasure requests. DPG clarified that ID verification was solely for erasure requests made outside of its online platform. The defendant subsequently levied a €525,000 fine on the data controller due to a violation of Article 12(2) GDPR. The DPA found that requesting ID verification to facilitate an erasure request was disproportionate, and contrary to the obligation of facilitating the exercise of the right to access and deletion. DPG appealed the DPA's decision, and argued that the DPA's interpretation of Article 12(2) GDPR was wrong. They submitted that their privacy policy outlined their obligation to identify data subjects before facilitating erasure requests, and allowed that parts of the ID, such as the citizen service number and photo, might be hidden. Moreover, DPG argued that imposing the fine contradicted the principle of legal certainty (lex certa), and that the amount was contrary to the principle of proportionality. The Court deliberated whether DPG adequately facilitated the exercise of GDPR rights for the purposes of Article 12(2) GDPR. This provision obliges controllers to "facilitate the exercise of data subject rights under Articles 15 to 22." The Court interpreted "facilitation" in the context of Article 12(2) GDPR, in connection with Recitals 59 to 64 GDPR, concluding that data controllers must provide an accessible system for the exercise of data subjects' rights without introducing unnecessary obstacles. Firstly, though DPG was obligated to validate the identity for data erasure requests, their rigid procedure required an ID copy for every request, irrespective of the data involved. This approach was disproportionate because it did not differentiate between requests concerning sensitive and non-sensitive data, and requested ID verification for all types of r
DSB (DPA)
The data subject's business profile appeared on an online platform operated by the controller. The profile displayed his name, address, telephone number, opening hours, profile pictures and information about peak visiting times. In 2020, the data subject submitted a request seeking the erasure of his personal data. He argued that he had not consented to the processing and that some of the published data were inaccurate. In particular, he claimed that profile pictures had been wrongly associated with his business profile. In 2021, the data subject lodged a complaint with the Austrian DPA against the controller. He alleged violations of his right to rectification (Article 16 GDPR), his right to erasure (Article 17 GDPR) and the right not to be subject to a decision based solely on automated processing (Article 22 GDPR). He argued that the controllers had rejected his erasure request and that the automatic assignment of profile pictures involved unlawful automated processing. The DPA asked the data subject to provide evidence of a rectification request and of a request concerning Article 22 GDPR. The data subject replied that his statements about inaccurate data should be treated as an implicit rectification request. He also argued that Article 22 GDPR did not require a prior request to the controller. The DPA rejected the complaint concerning Article 16 GDPR and Article 22 GDPR, as it found that the data subject had never submitted a rectification request or a request under Article 22 GDPR to the controllers, only a deletion request. During the proceedings, the controllers removed and corrected some information. However, the data subject maintained that incorrect profile pictures and opening hours continued to appear because of automated updates. First, the court held that the right to rectification under Article 16 GDPR generally required a prior request to the controller. The court noted that the data subject must identify which data are inaccurate and explain how they should be corrected. The data subject only requested erasure under Article 17 GDPR and merely stated that some data were inaccurate. He did not specify how the allegedly incorrect profile pictures or opening hours should be corrected. The court also rejected the argument that Article 5(1)(d) GDPR imposed a standalone obligation on the controllers to correct the data without a rectification request. The court held that such an obligation only arose where the controller could concretely determine the correct data. In this case, the data subject had not provided sufficient information to enable a correction. The court therefore confirmed that the absence of a rectification request constituted a missing procedural requirement for a complaint under Article 16 GDPR. Second, the court noted that Article 22 GDPR may prohibit certain automated decisions even without a request from the data subject. However, the court held that the profile picture assignment did not amount to profiling or automated decision-making, as it did not evaluate personal aspects of the data subject within the meaning of Article 4(4) GDPR. The court further held that the display of incorrect profile pictures was not a decision under Article 22 GDPR because the processing did not produce legal effects or similarly significant effects for the data subject. The court considered that the incorrect images could at most cause irritation or mild embarrassment. It found no evidence that the images affected the data subject’s legal position, reputation or business activities in a significant way. The court therefore dismissed the complaint.
Court case 9 Sa 73/21
The data subject was employed by the controller, a company. After an alleged disciplinary offence, the data subject got a warning signed by the owner (and only shareholder) of the company. In particular, the letter stated that the data subject stored confidential information about the company on a USB pen drive. The owner of the company had found the USB and confiscated it. The data subject asked for access to their personal data, including the content of the USB, claiming ownership over the latter. They also asked the warning to be erased under Article 17 GDPR. Finally, the data subject claimed their right to compensation for damages suffered as a consequence of the unlawful processing. The owner declared that data originally stored on the USB were backed up and erased from the pen drive. They refused to grant access to the data and to delete the warning. The court of first instance rejected the data subject’s claims. No erasure under Article 17 GDPR could be asked to the controller, as the employment relationship between the parties had meanwhile expired. Article 15 GDPR was not applicable either, since the data subject did not own the content of the USB, namely the confidential information unlawfully collected from the company. Therefore, there was no right to compensation pursuant to Article 82 GDPR. The data subject appealed the decision before the Regional Labour Court of Baden-Württemberg (Landesarbeitsgericht Baden-Württemberg, LAG Bade-Württemberg) Concerning the right to erasure of the data subject, the court overturned the first instance judgement. The court noted that a warning was no longer necessary after the termination of the employment contract between the data subject and the controller. Therefore, Article 17(1)(a) GDPR applied. Concerning the right to access, the court clarified that the case at issue was a case of co-controllership. The employer (the company) was clearly controller within the meaning of Article 4(7) GDPR. However, the owner th
Court case 3 Sa 33/22
The data subject was employed as a wrapping technician by the controller, a company in the advertising technology industry. While employed, the data subject agreed to the production of photos and a promotional video which featured him prominently. After leaving the company on 1 May 2019 to work for a competitor, the data subject requested the controller multiple times to cease using and delete the photos and video featuring him, but the controller initially did not comply. On 21 February 2020, the controller finally removed the materials after receiving multiple formal requests from the data subject’s legal representative. The data subject sought non-material damages under Article 82 GDPR due to these violations, including the unauthorized use of their image for commercial purposes. The LAG Baden-Württemberg decided that the delayed response to an access request under Article 15 GDPR does not constitute non-material damage in itself. The court clarified that a mere breach of GDPR provisions is not sufficient to establish a claim for damages under Article 82 GDPR. The rationale is that the law requires concrete evidence of harm beyond the violation of GDPR regulations. First, the court held that the controller’s unconsented use of the data subject's image post-employment violated Article 17 GDPR, justifying a compensation of €10,000 due to the significant damage to their personality rights along with the commercial exploitation without permission. Second, it addressed the data subject's request for detailed information on all personal data processed by the controller under Article 15 GDPR. The court noted this request lacked the specificity required by § 253(2) No. 2 ZPO. Consequently, it ruled that a general request for all personal data does not meet the necessary clarity and precision. Finally, the court rejected the claim for additional damages due to the delayed compliance with the access request, ruling that no non-material damage was proven by the data subj
Court case 322 C 3109/23 (2)
The plaintiff - the data subject, suffered damage to his vehicle with the vehicle identification number, which is insured with the defendant, on 28.03.2022. The defendant processed and settled this claim as the liable insurer on the basis of a cost estimate submitted by the plaintiff. The calculated repair costs excluding VAT amounted to EUR 3,351.93. The defendant then forwarded the following information to the HIS Information System (HIS - Hinweis- und Informationssystem, a federal directory of the German insurance industry); Date of the fictitious settlement, reporting body, Motor vehicle Reference number of the reporting body, The defendant - the data controller, did not delete or arrange for the deletion of the entry despite a request from the plaintiff or his attorney of record. The data subject claims that the entries in the HIS directory are incorrect, as their vehicle was repaired and therefore there is no fictitious settlement of the damage. Moreover, there was no need for storage due to the repair carried out. In this case, the parties were arguing if the data of the data subject could be deleted upon Article 17 GDPR from the federal Notice and information system, since there was no reason to retain the Data in the system, since the insurance paid for the repair. The court held that, in the case of a fictitious settlement of vehicle damage exceeding EUR 1,500, the comprehensive insurance of the policyholder is authorized to report the occurrence of a fictitious settlement, the amount of the incurred damage, and the vehicle identification number to the HIS Information System. Even in the case of a (flat) claimed repair of the damage with a remaining diminished value, there is still an overriding interest in this reporting, and therefore, no deletion under Article 17 GDPR is required. Even in the event of a proper and expert repair, a balancing of interests under Article 6(1)(f) GDPR indicates a continued interest of the insurer in reporting the data to
Court case 10 U 1633/22
The data subject and the controller were bound by an insurance contract. The controller increased the premium and the data subject claimed that such an increase was unlawful. Therefore, the data subject made an access request, to which the controller refused to reply. The data subject challenged the lawfulness of the premium increase in court and contextually asked the judge to order the controller to provide access to the requested information. The court of first instance dismissed the data subject’s access claim, stating that the latter was merely instrumental to prove the unlawfulness of the premium increase, without any autonomous data protection purpose. The data subject appealed the decision. The Higher Regional Court of Koblenz (Oberlandesgericht Koblenz – OLG Koblenz) overturned the first instance judgement. First, the court stressed how information concerning premium increases in an insurance agreement, like in general all contract details related to an individual, are personal data within the meaning of Article 4(1) GDPR. Second, the court referred to the CJEU judgement in case C-487/21 to clarify the scope of the data subject’s right to a copy of their personal data pursuant to Article 15(3) GDPR. The data subject had a right to a faithful and understandable reproduction of all their personal data processed by the controller. The court also pointed out how the right to a copy shall enable the data subject to enforce further data protection rights, such as right to erasure, rectification or objection. Finally, the court stated that the controller could not rely on Article 12(5) GDPR to avoid to reply to the access request. As a matter of fact, that is possible only insofar as a request is manifestly unfounded or excessive. It was uncontested by the controller that personal data were processed, therefore the request was not manifestly unfounded. Regarding the “excessiveness” of the access request, the court of first instance held that it did not dire
Stichting Bureau Krediet Registratie (BKR)
In May 2018, Stichting Bureau Krediet Registratie (BKR, the controller) began charging a fee to data subjects for requesting access to their data in a digital format. Data subjects could obtain a paper copy of their data for free, but only once a year. Following the DPA’s investigation, the controller has modified its processes. Since April 2019 data subjects have been able to access their data for free. In addition, in March 2019 the controller changed the number of times a year data subjects can receive a paper copy of their data by post. The Dutch DPA found that this practice was an infringement of privacy legislation, and imposed a fine of €830,000. controller then appealed in court. The court ruled that controller violated both Article 12(2) and Article 12(5) GDPR. The court found that controller's policy of limiting free access to once a year and charging for electronic access was inconsistent with the GDPR's requirements. The court emphasized that the GDPR requires data controllers to facilitate individuals' rights to access their data easily and free of charge, especially when data is processed electronically. The court rejected controller's argument that the GDPR's rules were unclear, stating that controller, as a professional organization, should have been aware of its obligations. The court acknowledged that the violations were related and reduced the fine by 20% due to the interconnected nature of the breaches. However, the court also found that the original fine of €830,000 was disproportionate and further reduced it to €668,000.
Uitvoeringsinstituut Werknemersverzekeringen
The data subject requested the Employee Insurance Agency (a governmental organisation, controller), to delete her phone number because she no longer wanted to be contacted by them. She also requested the erasure of her phone number from two messages stored in the digital 'mailbox' of the controller. The controller deleted her number for contacting purposes, but refused to delete her number from the digital mailbox. It argued that these documents were part of its social security files and had to be stored on the basis of a legal obligation arising from the Archiefwet (Archive Law). The data subject brought an action with the Court of Noord-Holland (case 20/4820). The Court considered that the controller was not obligated to delete the phone number from its files. She appealed this decision with the Council of State, claiming that the controller unlawfully processed her data and that it was not necessary to store it. In her view, the Archiefwet did not provide a legal basis for processing in the specific case and it breached the principles of minimisation, lawfulness and necessity. The Dutch Council of State considered that the data subject did not bring additional arguments than in first instance and that the Court of Noord-Holland adequately motivated its decision. The Council of State also held that if there is a legal obligation to store files in the exercise of official authority vested in the controller, then the right to erasure under Article 17 is not applicable as long as the retention period runs, as stated in Article 17(3)(b). Archiving as such does not breach the GDPR. Consequently, the Council declared the appeal unfounded.
Court case HAA 21/6573
On 20 May 2021, the data subject (claimant) received a letter from the Dutch Inland Revenue, notifying him that he had been unlawfully registered in the Dutch Inland Revenue's (Belastingdienst) database - the Fraud Signalling Facility (FSV). The controller in this case was the minister of Finance, as the Dutch Inland Revenue is under the administration of the ministry of Finance Overall, the use of this facility did not comply with the GDPR, as too many employees had access to the data and the data retention period was too long. Some individuals’ data was wrongly included and wrongly used. The controller attempted to rectify this by revoking tax employees' access to the FSV on 27 February 2020 and removing it as a point of use from the Tax Administration's implementation of (tax) legislation. In a letter dated 25 June 2021, the data subject objected to the recording of his data in the FSV. In this letter, he made an access request under Article 15 GDPR, a data rectification request under Article 16 GDPR, and an erasure request under Article 17 GDPR. The controller responded on 22 July 2021, partially responding to the access request (Article 15 GDPR), but refusing the requests made under Articles 16 and 17 GDPR. The data subject brought claims against the incomplete response to his data access request, and refusal of data rectification and erasure requests. The court found no violation of Article 15 GDPR, but found a violation of Articles 16 and 17 GDPR. Firstly, the controller’s response was GDPR-compliant for the purposes of Article 15 GDPR. An incomplete response to an access request was not inherently a violation of Article 15(3) GDPR. The controller had provided a summary of the data subject’s personal data, along with an explanatory note outlining the processing purposes. In reaching its conclusion, the court referenced CJEU judgment of 4 May 2023 (ECLI: EC: C: 2023: 369), wherein it was established that Article 15(3) GDPR does not confer the right to obtain a copy of complete documents if these are not necessary to enable the data subject to effectively exercise the rights conferred on him by the GDPR. This response was sufficient to fulfil the specificity requirements of Article 15(3) GDPR, thus there was no violation of Article 15(3) GDPR. Secondly, the controller’s failure to enforce the data subject’s erasure request was a violation of Article 17 GDPR. Given that the data subject’s data was unlawfully processed to begin with, they were entitled to the erasure of their personal data under Article 17(1)(d) GDPR. Moreover, the court concluded that the controller had no grounds to argue the application of Article 17(3) GDPR, which outlines instances where a controller may lawfully refuse an erasure request. The court found that “the defendant (controller) could not reasonably have considered it necessary to retain the claimant’s personal data in connection with archiving, investigation or legal proceedings.” Thirdly, the court found that the controller’s refusal to rectify the data subject’s data was a violation of Article 16 GDPR. However, the right to rectification under Article 16 GDPR was to be disregarded in this case, as the data subject’s erasure request was upheld. The controller (defendant) was ordered to reimburse the data subject’s court fees and legal costs.
Bundespolizei
A plaintiff servant who worked for the defendant sued to get his ability to work reinstated, as allowed by German law (Section 46 BBG). The lawsuit was most likely against the German government, but the court decision (which hasn't been made public yet) didn't clarify this. The dispute centered on whether certain documents should be removed from the man's personnel file and other police records. These documents included disciplinary files, a statement about a "reactivation review," and related information. Both the plaintiff and the defendant disagreed with the initial court ruling issued by the Administrative Court of Regensburg (judgment of January 25, 2023) and appealed. The plaintiff wanted more documents deleted, while the defendant appealed to keep the "reactivation review" statement. The court ruled in favor of the defendant. The court found that the documents were relevant to the plaintiff's employment history and should be kept. The court also found that the plaintiff did not have a legitimate interest in having the documents removed. First there is a moot point: Even if the court ruled in the plaintiff's favor, it wouldn't change anything. The defendant already agreed to remove the documents. Also there is no legal basis: the laws cited by the plaintiff (§§ 112 & 113 BBG and GDPR) don't guarantee removal of documents unless proven false or irrelevant. Personnel files aim to present a complete picture of the employee's history, including disciplinary actions. Removing documents generally goes against this goal. There is only an exception for serious misconduct: only serious misconduct accusations might warrant removal to allow for future career advancement without the burden of past issues. In simpler terms, the court ruled that since the documents were already being removed, there was no need for a formal decision.
Court case 2 AZR 296/22
The controller fired the data subject for having declared to be in the workplace when they had actually left the office. To substantiate this claim, the controller used images from the video surveillance system. The data subject objected to the decision before a labour court, claiming that data obtained in violation of the GDPR could not be used in a labour procedure against the data subject. In particular, the controller did not fully comply with their obligation to inform in accordance with Article 13 GDPR. The court of first instance upheld the data subject’s position. The controller appealed the decision and lost also in second instance. Therefore, they brought the case before the German Federal Labour Court (Bundesarbeitsgericht - BAG). The court further acknowledged that in principle, according to Article 17(1)(d) GDPR, personal data shall be deleted when they were unlawfully processed – in this case ‘collected’. However, Article 17(3)(e) GDPR provides for an exception for those cases in which processing is still necessary for the establishment, exercise or defence of legal claims. The court pointed out that Article 17(3)(e) GDPR also requires a balancing of interests oriented by proportionality. As a matter of fact, the defence of one’s rights before courts is a fundamental right enshrined in Article 47 of the European Charter of Fundamental Rights. Thus, the data subject’s fundamental rights to privacy and data protection (Articles 7 and 8 of the Charter) should be seriously threatened in order to justify an erasure. The impact of a video surveillance system on a data subject is that the latter’s self-determination could be impaired. However, in the case at issue the data subject was not limited in their behaviour by the video surveillance. To the contrary, despite aware of the cameras, they committed a disciplinary offence. What the data subject invoked to limit the use of the recording as evidence was not a constitutionally protected right, as data prot
Court case W252 2246581-1/6E
The data subject filed a complaint against the controller - a credit ranking agency. In the original procedure before the Austrian DPA, the data subject claimed that their rights resulting from Article 15(1)(h) GDPR were infringed as the controller did not sufficiently inform them about the logic and algorithm used for the processing of their personal data in the context of an automated decision about the data subject's creditworthiness. The controller replied that the processing at issue was not 'automated decision-making' pursuant to Article 22 GDPR, but only 'light profiling' under Article 4(4) GDPR. Therefore, the controller claimed that Article 15(1)(h) GDPR did not apply in the first place. Moreover, the controller argued that the algorithm regulating profiling could not be disclosed, being part of business secrets of the company. The Austrian DPA upheld the complaint and issued a decision against the controller, ordering the latter to provide access to the information requested by the data subject. The controller appealed the decision with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG), stating that they provided the data subject with sufficient information. The court upheld the controller's appeal. First, the court noted that, according to Article 15(1)(h) GDPR, in case of automated decision-making the controller shall provide the data subject with an explanation about the logic behind the processing. However, this 'logic' shall not be understood as the algorithm or mathematical formula underlying the automated decision. Rather, the controller shall provide the following pieces of information: a) categories of personal data and why they are relevant to the creation of the profile; b) how the profile is created by automated means, with specific regard to the statistical method used; c) why the profile is relevant for the decision; d) how the profile is actually used in the context of the decision. In the case at issue, the c