GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Redacted version
This case is an appeal of a decision by the Norwegian DPA, in which the Norwegian DPA fined a company (the controller) about €12,000 (NOK 125,000) for conducting an unlawful credit rating in breach of Article 6(1) GDPR, and required them to implement a policy for conducting credit ratings per Article 24 GDPR. The controller disagreed with the DPA on the first part of the decision, pertaining to the fine, and asked the supervisory authority to reconsider its position. After the DPA had reviewed the case again, they found no grounds to change their decision and so, as per Norwegian procedures, referred the case to the Privacy Appeals Board. The unlawful credit rating was conducted by the company's managing director, who was in conflict with the data subject in an inheritance dispute. In their comments to the Privacy Appeals Board, the company's attorneys claimed that the managing director had to be seen as a 'third party' and that the credit rating was lawful because he pursued a legitimate interest. The Privacy Appeals Board reviewed the case and agreed, first, with the DPA in that an acquiring company also acquires the prior (acquired) company's controller's responsibilities, even if the breach occurred before the company was acquired. Next, they noted that the relevant lawful basis of the processing in question (the credit rating) is Article 6(1)(f) GDPR, legitimate interests, and that it is the company who has the agreement with the credit rating agency and, thus, a legitimate interest in obtaining credit rating information. The Privacy Appeals Board noted that it is obvious that the managing director obtained credit rating information for use in the private inheritance dispute and not for the company's legitimate interests. They also concluded that the case is not related to a "third party" as defined in Article 4(10) GDPR and that this claim builds upon an obvious misinterpretation of the legal text. The Privacy Appeals Board held that the managing director'
Ziggo bv
The controller is Ziggo bv. The data subjects are customers of Ziggo. Ziggo is the largest internet service provider in the Netherlands. Stichting BREIN is dedicated to claims against copyright infringements on behalf of its members. BREIN states that more than 200 e-books are made available to the public through an 'open directory' with an IP-address made available by Ziggo. BREIN demands Ziggo to send a warning to the user to which the IP-address belongs for said copyright infringement. Ziggo refuses to send such a message. Alternatively, BREIN wants Ziggo to provide NAW-data (name, address and residence) of the user of the IP-address. This will enable BREIN to send the letter independently. BREIN also demands all of the above for every customer of Ziggo that infringes on the copyright of its members through an open directory in the future. BREIN states that the copyright infringement in question is established. In addition, BREIN states that Ziggo does not need a permit from the Dutch DPA nor a DPIA for these actions. Ziggo disputes these notions. The Court notes that it cannot establish that the user of the IP-address made the copyright infringement. In the hypothetical situation that an infringement would be established, the Court held that Ziggo would still need a permit from the DPA pursuant to Article 33(4)(c) UAVG. First, to connect the IP-address and NAW-data in order to send a warning and second, for the provision of NAW-data to BREIN. BREIN's argument that no personal data is processed by Ziggo on behalf of BREIN was disregarded by the Court, as Ziggo would use the IP-address provided by BREIN to connect the IP-address and NAW-data on behalf of BREIN. Furthermore, the Court held that Ziggo would need a DPIA (Article 35 GDPR). The Court also dismissed BREIN's argument that this is not obligated because it only constitutes an IP-address and not the processing of large amounts of criminal data. The Court stated that the (possibly large) amount of person
Belastingdienst
This dispute is between a tax payer (data subject) and an inspector of the Dutch Tax Authority (the controller). The data subject was mentally ill and his parents provided the care and assistance he needed. On his tax return, the data subject used several deductions for specific care costs. The Tax Authority, however, deemed these deductions unlawful and issued corrections in 2013. Since then, his tax returns were manually audited and corrected in 2016, 2017 and 2018. The data subject was also included in the database 'Fraud Notification Facility' (FSV). After rejecting the data subject’s objection to these corrections, the case was brought to court. During the proceedings, the data subject expressed the suspicion that he had been the subject of ethnic profiling. As a result, the deductions for specific healthcare costs had been unjustly scrutinised for years. He followed that this suspicion was confirmed by a letter from the Tax and Customs Administration (dated 27 May 2021), stating that his data had been included in the database FSV. The data subject argued that his inclusion in the database did not comply with the GDPR. The Court stated, with reference to a judgement of the Dutch Supreme Court, that if the Tax Authority finds that deductions were incorrectly applied in a tax return, it can manually check that individual's tax returns of the following years.[https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:HR:2021:1748&showbutton=true&keyword=ECLI%3aNL%3aHR%3a2021%3a1748 HR 10 December 2021, ECLI:NL:HR:2021:1748] In principle, this also applies if that observation leads to the storage of the taxpayer's data in a database, and even if that data processing is in itself unlawful. The court held that this may be different if the audit results from a risk selection based on a criterion that violates a fundamental right of the data subject (such as a violation of the prohibition of discrimination on the basis of origin, orientation, or religion). However, the Court found no evidence that the data subject’s tax returns were assessed on such a criterion. The mere fact that the data subject’s personal data were unlawfully processed in the FSV database could not by itself lead to a reduction or annulment of the Tax Authority’s assessments. The Court found the appeal unfounded.
Court case W176 2249328-1/4Z
The controller was the parent company of a conglomeration that operated a cross-company and cross-sector customer loyalty programme. Customers at participating retail outlets could register as members, collect points on the basis of their purchases and subsequently redeem them to receive discouts and other perks. The controller processed personal data obtained from participants in the loyalty program to, among others, automatically generate consumer profiles to create targeted ads. The controller claimed consent as the legal basis for this processing pursuant to Article 6(1)(a) GDPR and in its privacy policy stated that this consent was voluntary and could be revoked at any time. The DPA initiated an official investigation and, based on the results of this investigation, also initiated administrative penal proceedings against a subsidiary of the controller. On 26.7.21, the DPA fined the subsidiary €2,000,000 for using legally invalid consent and thus unlawfully processing the personal data of participants in its loyalty program. The subsidiary appealed to the Federal Administrative Court (BVwG). The DPA also initiated administrative penal proceedings against the controller (the parent company), fining it €8,000,000 for the unlawful processing of personal data relating to the loyalty program. The controller also appealed this decision to the BVwG, arguing that, among others, there was not only a lack of the necessary elements of the offence but that the controller could not be found at fault for the violation. The Court stayed proceedings pending a ruling by the European Court of Justice (CJEU) in C-807/21 - Deutsche Wohnen SE. In that case the Higher Regional Court Berlin (KG Berlin) referred the following questions: 1) Is Article 83(4) to (6) 1 to be interpreted as incorporating into national law the functional concept of an undertaking and the principle of an economic entity, as defined in Articles 101 and 102 TFEU, as a result of which, by broadening the principle of a legal entity underpinning Paragraph 30 of the Gesetz über Ordnungswidrigkeiten (Law on administrative offences; ‘the OWiG’), proceedings for an administrative fine may be brought against an undertaking directly and a fine imposed without requiring a finding that a natural and identified person committed an administrative offence, if necessary, in satisfaction of the objective and subjective elements of tortious liability? 2) If Question 1 is answered in the affirmative: Is Article 83(4) to (6) to be interpreted as meaning that the undertaking must have intentionally or negligently committed the breach of an obligation vicariously through an employee (see Article 23 of Council Regulation (EC) No 1/2003 1 ), or is the objective fact of breach caused by it sufficient, in principle, for a fine to be imposed on that undertaking (‘strict liability’)?
Autoriteit Persoonsgegevens
On 17 August 2018, the data subject requested that the Dutch DPA takes enforcement action against a cinema (the controller) on the basis of the GDPR, because the cinema no longer accepted cash payments. As a result, the purchase of a cinema ticket was only possible by means of a debit card payment at the box office or through the cinema’s website. Snacks and drinks could also no longer be paid for with cash. Personal data, namely the bank account number, the amount and the payment date, were processed for these debit card payments in addition to the visitor's name, email address, telephone number, transaction data and IP address when purchasing via the cinema’s website. The data subject believed that he should be able to go to the movies anonymously as there is no necessity for the processing of personal data. On 16 April 2019, the Dutch DPA denied the data subject’s request to take enforcement action against the controller. The DPA also dismissed the data subject’s objection on 27 November 2019 as it believed that the GDPR had not been violated. The processing of personal data when purchasing a ticket or snacks and drinks was considered necessary for the performance of a contract (Article 6 (1)(b) GDPR). The processing of personal data as a result of visiting the website was considered necessary for the maintenance and improvement of the website (Article 6(1)(f) GDPR). According to the DPA, there was no reason for enforcement action. The District Court of First Instance of Gelderland considered whether the DPA was entitled to concluding that the cinema had not violated the GDPR and hence had no authority to take enforcement action. First, the court considered the processing of personal data when paying with a debit card for the purchase of a cinema ticket or snacks and drinks, and iDeal when purchasing a cinema ticket through the website. Processing of personal data may be lawful if it is necessary for the performance of a contract under Article 6(1)(b) GDPR.
Minister of Finance
The controller is the Minister of Finance. The data subject’s personal data was processed by the Tax Authority because it suspected him of not fulfilling his tax obligations. This suspicion was raised after the Fiscal Information and Investigation Service (FIOD) had carried out a criminal investigation into the data subject’s tax consultant. As a result of the Tax Authority’s investigation, the data subject had to pay additional taxes. The data subject claimed that the processing was unlawful requested the controller to erase his personal data pursuant to Articles 17(1)(d), 17(2), and 19 GDPR. The controller rejected this request. The data subject objected to the rejection. The controller declared the objection to be unfounded. The data subject then brought the case before the Court. The data subject argued that there were two instances of processing: (1) the selection of the personal data by the Tax Authority of the data collected by the FIOD, and (2) the transfer of personal data from the FIOD to the Tax Authority. The data subject claimed that the Tax Authority processed his personal data without a legal basis, and for a different purpose than it was initially collected for (by the FIOD). The controller, claimed that the selection and collection of the personal data did not fall within the scope of the GDPR, because the Tax Authority acted in the context of assistance to criminal investigations under the Police Information Act at that time. Moreover, the controller stated that there was a legal basis since the Authority had to process for the fulfilment of a statutory obligation, and the performance of a task in the public interest, even though the transfer of the personal data to the Tax Authority did fall within the scope of the GDPR, The Court rejected the data subject’s claim and held that the processing by the Tax Authority had been lawful. First, the Court stated that the FIOD’s processing of personal data falls within the scope of the LED (Directive 201
Court case M 3 E 22.667
The controller is an elementary school. The data subjects are pupils of the controller. Under the Bavarian Ordinance on Measures for the Prevention of Infection (16. Bayerische Infektionsschutzmaßnahmenverordnung – 16. BayIfSMV) , the controller required the the data subjects to show Covid-19 test certificates before being allowed to in-person classes. Moreover, pupils were obliged to wear face masks in school if they could not provide an exemption certificate by a doctor. The controller stored the certificates for 14 days, as prescribed by the Ordinance. On 31 January 2022, the data subjects requested the controller to delete the stored test certificates and stop further collecting them, which was rejected by the controller. Consequently, the data subjects filed an application for interim relief with the Administrative Court of München (Verwaltungsgericht München - VG München) on 10 February 2022 to order the school to stop storing and collecting the test and mask exemption certificates. In its statement of defense, the controller explained that it does not retain any certificates of the data subjects anymore, because it had filed a criminal complaint against the parents of the data subjects with the prosecutor's office on 7 February 2022 because of the suspicion of forgery of documents and had transmitted all the certificates as evidence in the course of the criminal complaint. The data subjects did not contest this statement of the controller. The court rejected the application for interim relief in its entirety. The court held that the application regarding the mask exemption certificates was already inadmissible when the data subjects filed the complaint, because, according to the uncontested statement of the controller, it transmitted all of the certificates to the prosecutor's office and did not store any certificates anymore. The court further reasoned that, because the duty to wear a mask in school was dropped on 2 April 2022, there were no indications su
Court case 18 Ca 6830/21
The controller is a company providing workplace health promotion services by consulting other companies on this topic and developing tailored measures for them. Its main customer base are care facilities. The controller informed its employees that due to an amendment of the German Infection Protection Act, access to care facilities was only permitted to persons that are either vaccinated, recovered or tested negative against Covid-19. The controller asked their employees to prove their vaccination status by either handing over a screenshot of the digital vaccination certificate or by presenting the vaccination card. It also informed them that a copy will be made for documentation purposes. On 03 December 2021, the data subject, who was employed as a counselor, presented her vaccination card to the controller. When asked by the HR officer whether she also has a QR vaccination code, she explained that she only has a digital vaccination certificate stored on her private mobile phone, which she did not have with her at the moment. As it was not possible for the controller to check the validity of the vaccination certificate without the QR code, the controller carried out a batch query, which means that it compared the provided vaccination data with publicly available information on the availability of vaccination batches in order to determine irregularities. It found that the vaccination data provided by the data subject was inconclusive as the first vaccination allegedly took place at a time when only elderly people were vaccinated. During a conversation with the data subject, the suspicion of forgery could not be dispelled, as she then asserted to never have stored the QR code on her phone because of data protection reasons and that she did not know whether she still had the QR code in paper form. As the data subject was unable to provide proof that the vaccination had actually been carried out, the controller terminated the employment relationship. The data subject
Court case 9436020 \ CV EXPL 21-30289
The data controller is a company that is building new houses in Zevenhuizen. People who were interested in buying these new houses could register as a candidate-buyer via the website of the controller. About 1100 people, including the data subject, signed up. During the registration, the controller collected confidential personal information of the data subjects (such as the first- and last name; place- and date of birth; email address; phone number; maximum amount they could borrow for the mortgage; yearly income etc.). In April 2021, the controller sent an email to everyone who registered for the project with an unencrypted Excel file attached, which contained the personal information of everyone who registered for the project. Following up on this mistake, the controller sent an email in which they acknowledge the data breach and an apologised for the violation of the privacy and security of the 1100 registered potential buyers. The data subject brought the issue before court and claimed immaterial damages from controller for unlawful processing of their personal data. The Court acknowledged that a substantial amount of personal data was leaked to all of the registered potential buyers. This is a form of processing (Article 4 GDPR) and it is unlawful since there is no ground for this processing (Article 6 GDPR). The controller had thus unlawfully processed the personal data of the data subject in breach of the GDPR. The Court explained that the loss of control over your personal data is a form of damage (Recital 85 GDPR). It also considered that the meaning of 'damage' has to be explained in line with the jurisprudence of the Court of Justice. While the controller claimed that the plaintiff had not suffered any legally relevant damages in line with Dutch civil law, the Court pointed out that Article 82 GDPR has to be interpreted in the context of EU law: the fact that the damages can't be directly quantified do not prevent the allocation of damages. The Court p
Court case 9435922
The controller is a company that is contracted to plan and build a new neighborhood (called the “Koningskwartier”) in the village Zevenhuizen. In 2021, people that were interested to potentially purchase a house in this neighborhood, could register on the website of the company. Approximately 1,100 persons, including the data subject, made use of this possibility. During the registration, various confidential personal data of these persons were collected, such as the first- and last name; place- and date of birth; email address; phone number; maximum amount they could borrow for the mortgage; yearly income etc. On 12 April 2021, the controller sent out an email to all persons that registered and attached an unencrypted excel file to this email, that contained all the personal data listed above. The data subject then replied to the email and notified the controller of the fact that they wanted to be reimbursed for the damages of the data breach. The controller tried to repair their mistake by sending out an email to all recipients regarding the mistake. However, they refused to comply with the data subject’s request, so the data subject brought the matter before court. The data subject requested the court to order the controller to pay him € 750 in material damages to purchase a new phone since he was being harassed by an unknown number via WhatsApp. Moreover, he wanted € 20,000 in immaterial damages because he feels “watched” and he lost his trust in other people. The controller explained this data breach was caused due to a human error and requested the Court to reject the data subject’s claim. First, the Court considered that the controller had no legal basis in Article 6 GDPR to send out an email that contained data subject’s personal data, and thus unlawfully processed the data subject’s personal data. Moreover, the Court noted that it follows from Recital 146 GDPR that the notion of “damage” must be interpreted broadly, and found that data subject’s damages
SIA SS
SIA ‘SS’ (‘the applicant’) is a company specialized in online advertising services in Latvia. Private individuals may post and advertise various products on the applicant's website (www.ss.com) with a view of selling them. These products may include vehicles such as second-hand cars or motorbikes. On 28 August 2018, the Director of the Latvian Tax Inspection Office (‘the defendant’) sent to the applicant a request for information on the basis of Article 15(6) of the national law on taxes and duties. In that request, the defendant asked the applicant to grant them access to information, and in particular to provide information on: a) the telephone numbers of advertisers; b) the chassis numbers of vehicles featured in advertisements published on the applicant’s website; and c) information on advertisements published in the ‘Motor Vehicles’ section of the website from 14 July to 31 August 2018. The applicant was asked to send the information electronically, in a format that would allow the data to be filtered and selected. The applicant was also asked to include the following information in the data file: a link to the advertisement; the advertisement text; make of vehicle; model; chassis number; price; and the vendor’s telephone numbers. The applicant lodged an administrative complaint challenging the request for information. According to the applicant, the requested information constituted personal data within the meaning of Article 4(1) GDPR and its disclosure was not justified by the law. The applicant argued, in particular, that the defendant, in its capacity as controller, did not comply with the principle of proportionality or the principle of minimisation enshrined in Article 5(1) GDPR. The defendant dismissed the applicant's complaint and upheld the request for information. The dispute escalated before the national courts. In this context, the referring court referred the following questions to the CJEU: 1. Must the requirements laid down in the General Data Protection Regulation be interpreted as meaning that a request for information issued by a tax authority, such as the request at issue in this case, which seeks the disclosure of information containing a considerable amount of personal data, must comply with the requirements laid down in the General Data Protection Regulation (in particular Article 5(1) thereof)? 2. Must the requirements laid down in the General Data Protection Regulation be interpreted as meaning that the Tax Administration may depart from the provisions of Article 5(1) of that regulation even though the legislation in force in the Republic of Latvia does not empower it to do so? 3. For the purposes of interpreting the requirements laid down in the General Data Protection Regulation, can there be considered to be a legitimate objective justifying the obligation, imposed by a request for information such as that at issue in this case, to provide all of the data requested in an undefined amount and for an undefined period of time, in the case where there is no prescribed expiry date for the fulfilment of that request for information? 4. For the purposes of interpreting the requirements laid down in the General Data Protection Regulation, can there be considered to be a legitimate objective justifying the obligation, imposed by a request for information such as that at issue in this case, to provide all of the data requested even if the request for information does not (or does not fully) specify the purpose of disclosing that information? 5. For the purposes of interpreting the requirements laid down in the General Data Protection Regulation, can there be considered to be a legitimate objective justifying the obligation, imposed by a request for information such as that at issue in this case, to provide all of the data requested even if that request relates in practice to absolutely all data subjects who have published advertisements in the ‘Motor Vehicles’ section of a portal? 6. What criteria must be used to verify that a tax authority, acting as controller, is duly ensuring that the processing of data (including the collection of information) is compliant with the requirements laid down in the General Data Protection Regulation? 7. What criteria must be used to verify that a request for information such as that at issue in this case is duly reasoned and occasional? 8. What criteria must be used to verify that personal data are being processed to the extent necessary and in a manner compatible with the requirements laid down in the General Data Protection Regulation? 9. What criteria must be used to verify that a tax authority, acting as controller, ensures that data are processed in accordance with the requirements laid down in Article 5(1) of the General Data Protection Regulation (accountability)? On 2 September 2021, AG Bobek rendered his opinion in this case. With regard to the first question, the CJEU analyzed whether the provisions of the GDPR should be interpreted in the sense that the collection of information containing a significant amount of personal data by the Tax Authority of a Member State is subject to the requirements set forth in this regulation, especially those provisions provided for in Article 5(1). First, it acknowledged that the information requested by the Tax Authority constitutes personal data under Article 4(1) GDPR. Similarly, it recognized that the collection, consultation, disclosure by transmission or any other way of making personal data available constitute 'processing' within the meaning of Article 4(2) GDPR. In the present case, the CJEU highlighted that the Tax Authority requested an economic operator to communicate and make available personal data that the latter is obliged to provide and make available under the terms of national legislation. At the same time, according to the CJEU, the communication and making available of said data by the economic operator in question involves 'processing'. Second, the CJEU rejected the application of the exception provided for in Article 2(2) GDPR, considering that, when requesting personal data for tax collection or the fight against tax fraud, the Tax Authority should not be considered a 'competent authority' within the meaning of Article 3(7) Directive 2016/680. Therefore, such requests do not fall under the exception provided for in Article 2(2)(d) GDPR, as this data is not collected for the specific purpose of initiating criminal proceedings. Thus, it concluded that the activity is subject to compliance with the principles relating to the processing of personal data set out in the GDPR, notably those of Article 5 GDPR. As for the second question, the CJEU assessed whether the provisions of the GDPR should be interpreted in the sense that the Tax Authority can derogate the provisions of Article 5(1) even if such power has not been conferred on it by the national law of the relevant Member State. As a preliminary point, the CJEU emphasized that the GDPR aims to ensure a high level of protection for natural persons in the Union. For this purpose, chapters II and III set out, respectively, the principles governing the processing of personal data and the rights of the data subject that any processing of personal data must respect. The Court recognized that Article 23 GDPR authorizes the Union and the Member States to adopt legislative measures that limit the scope of the obligations and rights provided for by Article 5. However, such a limitation must respect the essence of fundamental freedoms and rights and constitute a necessary and proportionate measure in a democratic society to safeguard important objectives of general public interest of the Union or of the Member State concerned, including in the budgetary and fiscal fields. In this regard, the CJEU also stated that the regulations that allow such interference must provide for clear and precise rules that regulate the scope and application of the measure in question and impose minimum requirements, so that the persons whose data have been transferred have sufficient safeguards to effectively protect such personal data against the risk of abuse. Consequently, the Tax Authority of a Member State cannot derogate from the provisions of Article 5 GDPR in the absence of a clear and precise legal basis in Union or national law that provides for the circumstances and conditions under which the right to data protection may be limited. It therefore concluded that the Tax Authority of a Member State cannot derogate from the provisions of article 5(1) GDPR when that right has not been conferred on it by a legislative measure, within the meaning of article 23(1) GDPR. As for the third to ninth questions, the CJEU assessed whether the provisions of the GDPR should be interpreted in the sense that the Tax Authority of a Member State is prohibited from requiring the provision of this information in a generic way, regarding all personal data, without specify the purpose of the request. The CJEU recalled that article 5(1)(b) GDPR provides that personal data must be collected for specific, explicit and legitimate purposes. Such a requirement, as follows from Recital 39 GDPR, means that the purposes must be identified, at the latest, at the time of collection of personal data. In the present case, the CJEU noted that the communication of personal data is not directly based on the national tax law, but results from a request from the competent public authority. Therefore, it is necessary for that request to specify the purposes of that collection in the light of the public interest or the exercise of public authority. This is necessary to enable the addressee of said request to verify that the transmission is lawful and also to enable the courts to carry out legality control. In addition, it recalled that Article 5(1)(c) GDPR establishes that personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Thus, the controller, even when acting as a public authority, cannot proceed in a generalized and undifferentiated manner to the collection of personal data. On the contrary, they must refrain from collecting data that are not strictly necessary for the purpose of the processing activity. Therefore, it is for the Latvian Tax Authority to demonstrate that, in accordance with Article 25(2) GDPR, it has sought to minimize as much as possible the amount of personal data to be collected. For these reasons, the CJEU finally concluded that tax authorities of a Member State may request information containing personal data, provided that such data are necessary in light of the specific purposes for which they are collected and the period of collection of said data does not exceed the duration strictly necessary to achieve the general interest intended.
Tina Turner
Tina Turner sued the organiser of a tribute show called "Simply The Best - Die Tina Turner Story" for injunctive relief. In her opinion, the photo and the name of the show gave the impression that she would be standing on stage in person or supporting the show. The question was whether the double looked too much like the original and whether advertising posters with her photo and the title "Simply The Best - The Tina Turner Story" gave the impression that the superstar herself was involved. In the first instance, the Regional Court of Cologne (LG Köln) held that the personality rights of Ms. Turner outweighed the artistic rights of the organiser. The Higher Regional Court of Cologne (OLG Köln) overturned this decision and held that the artistic freedom (Kunstfreiheit) outweighed the personality rights of Ms. Turner, who appealed against this ruling. The German Federal Court of Justice held that a claim for injunctive relief with regard to the use of Ms. Turner's likeness is not applicable on the grounds of the German Civil Code in conjunction with §§ 22, 23 KUG (Art Copyright Act). While the Court agreed with the previous instances that the pictures of the plaintiff constituted personal data pursuant to Article 4(1) GDPR, it based its decision on §§ 22, 23 KUG. Under the KUG, it is permissible to take and publish photos of people without their consent if it is in the "higher interest of Art", i.e. if the artistic value of such creation outweighs the personal rights of the person pictured. However, the Court did not decide on the relationship between the KUG and the GDPR. It rather left open the question whether the use of the plaintiff's image for the defendant's posters was for "artistic purposes" within the meaning of Article 85(1) and (2) GDPR and whether the conditions set out therein for the adoption or continued application of national provisions (i.e. the KUG) were fulfilled with regard to the constellation of the case in dispute. The Court merely held that Ms. Turner could base a claim for injunctive relief neither on the KUG nor on the GDPR because the comprehensive weighing required by both Article 6(1)(f) GDPR and §§ 22, 23 KUG led to the same result. It was true that the defendant had used a likeness of the plaintiff on each of the posters in the sense of § 22 (1) KUG. The depiction of a double was also to be regarded as a portrait of a famous person if - as in the case at issue - the impression was given to a not inconsiderable part of the public that the double was the famous person himself. However, this was not clear from the posters as they did not make any statement on this and were not ambiguous in this respect. The use of the portrait was permissible pursuant to § 23(1)(4) of KUG since it had not been made at the request of Ms. Turner, its dissemination or display served a higher artistic interest and the act of dissemination did not infringe any legitimate interest of her within the meaning of § 23(2) KUG. The same resulted from § 23(1)(1) KUG.
Bayerisches Landesamt für Datenschutzaufsicht
The controller runs a gym. The defendant is the Bavarian DPA (BayLDA). The controller and the BayLDA were in dispute about the lawfulness of a video surveillance with six video cameras in the training rooms and the counter of the gym. The controller argued that the video surveillance served to prevent and solve thefts and damage to property, which had occurred several times in the past. In addition, the video surveillance served to prevent sexual harassment, as a continuous presence of the staff in all rooms could not be guaranteed. After a client of the controller requested the BayLDA to stop the video surveillance, the BayLDA issued a notice. It required the controller to refrain from observing the training areas with video cameras pursuant to Article 58(2)(f) GDPR. After that, the controller replaced the the video cameras with dummy cameras. The BayLDA argued that, while the legal basis for the video surveillance can generally be Article 6(1)(f) GDPR, the conditions were not met in the present case. In particular, the video surveillance was not not necessary as the controller could have considered less restrictive means such as increased staff and anti-theft devices. The controller argued that, due to the contractual relationship with the clients, it also had a secondary obligation to ensure their safety, in particular by preventing or solving thefts and assaults through video surveillance. In addition, the data subjects would be informed about the monitoring via signs and the general terms and conditions, thereby also consenting to the video recordings. The controller claimed that, after replacing the video cameras with dummy cameras, it could expect yearly damages in the amount of €10,000 to €15,000 since the clearance rate without the video camera was almost zero. The court held that the video surveillance was not lawful and that the BayLDA was entitled to require the controller to refrain from using video cameras in training areas pursuant to Article 58(2
Court case 4 U 111/21
The plaintiff (subcontractor) was a company providing cleaning staff to the defendant (general contractor). In this dispute, the plaintiff claimed the payment of an amount of € 9,837.71 from the defendant as remuneration for cleaning work by their employees of the defendant's properties. The defendant invoked a right of retention with regard to a claim for the provision of evidence of the payment of the minimum wage to the plaintiff's employees working in the defendant's properties. The parties also signed a contract which stated that the plaintiff is obliged to pay the minimum wage according to the German Minimum Wage Act (Mindestlohngesetz). According to this contract, the defendant had the right to demand up-to-date evidence of this at any time (e.g. submission of timesheets, payrolls, lists of employees). In case of non-submission of requested evidence, the defendant was entitled to withhold payments due. The plaintiff stated that they had fulfilled their obligation to provide evidence by submitting declarations from their tax advisor, according to which the minimum wage was paid. They also stated that the submission of their employees' pay slips, in particular, was precluded by the GDPR since the disclosure of such data would be a violation. The Higher Regional Court Brandenburg held that the declarations of the tax advisor were not evidence which could proof that the plaintiff has actually paid the minimum wage to the employees working on the premises of the defendant. According to the court, the plaintiff was not prevented by the GDPR from providing the defendant with evidence of the payment of minimum wage to the employees. On the contrary, this form of processing of personal data of the plaintiff's employees was, insofar as the limits of necessity and data economy are observed, permitted pursuant to Article 6(1)(f) GDPR. The Minimum Wage Act (Mindestlohngesetz) also includes the provision that in business relationships such as that between the palintiff
The plaintiff is a minor. A person unknown to the plaintiff opened an account on the social media platform Instagram at an unknown time with the user name "plaintiff_was_hacked". Pictures were posted on the account showing a young woman dressed only in underwear, with her face covered by a smartphone. The photos contained statements that gave the impression that the person depicted was interested in a variety of sexual contacts. After the plaintiff was recognised by other persons and approached about the content of the account, she reported the account to the platform operator and it was blocked. The plaintiff requested the Regional Court of Flensburg (LG Flensburg) to order both Instagram and the telemedia service provider to disclose information about the owner of the account, including their IP-address, based on the old German Telemedia Act. She claimed that she needed the requested information to enforce civil law claims in the form of injunctive relief and claims for damages for violations of personal rights against the owner of the user account. The LG Flensburg dismissed her application as the plaintiff had no substantive right to information against Instagram. Furthermore, it held that a general right to information against telemedia services as "non-interferers" did not exist under the current legal situation. A complaint at the same court was not successful either. The plaintiff appealed that decision at the Higher Regional Court of Schleswig-Holstein (OLG Schleswig). Before the OLG Schleswig, she requested that Instagram be allowed and obliged to provide her with the user's IP address used for uploading the posts and images retrievable, together with the exact upload time, their name, e-mail address, the IP address last used to access the account, and the user's telephone number. The appeal succeded with regard to the inventory data, but not regarding the IP addresses. The OLG Schleswig applied § 21(2) Telecommunication Telemedia Data Protection Act
Bild
On November 9, 1989, Günter Schabowski, member and spokesman for the Politburo of the Socialist Unity Party of Germany (SED - party in power in the eastern part of Germany during the cold war) read out the new travel regulations of the German Democratic Republic (DDR) at a press conference live on television. During the press conference he was asked by an Italian and German reporter about the date when the new regulations will come into force. Mr. Schabowski, looking a little perplexed at first, answers "To my knowledge - that is immediately, without delay". The new travel regulations allowed people to travel to foreign countries, especially Western countries, more easily than before. Immediately after the press conference thousands of East-Berlin's residents were flocking to the border, demanding their opening. The wall dividing Germany fell. The piece of paper, also known as the "Schabowski Note", from which Mr. Schabowski was reading the new travel regulations is now owned by the "Haus der Geschichte" Foundation in Bonn. The Foundation had bought the note in 2015 for 25,000 euros. The seller demanded anonymity, which the Foundation also assured him. But the path of how the note came to the first and later to the second seller, who sold it to the Foundation, is not completely clear. Mr. Schabowski´s family said that the Note was given to someone to take a closer look at it, but never given away permanently, they have asked the person to give it back, which did not happen. A journalist from the “Bild” Newspaper filed a lawsuit to disclose the wording of the agreement between the Foundation and the second seller and the name of both sellers. The Foundation refused to provide the information on the grounds that the seller had been promised anonymity as part of the contract. This provision was binding only between the second seller and the Foundation, the first seller did not insist on anonymity. The Administrative Court of Cologne (Verwaltungsgericht Köln - VG Köln) held that the Foundation was obliged to disclose the names of both sellers to the journalist, but not the wording of the agreement. The court reasoned that the journalist could invoke the right to information ("pressrechtlicher Auskunftsanspruch") under [https://www.gesetze-im-internet.de/gg/BJNR000010949.html Article 5(1)(S. 2) GG (German Constitution)] which outweighs the second seller's interest to anonymity. The fact that the foundation promised anonymity to the second seller cannot derogate the journalist's right to information. The court also found that GDPR does not prevent the claimant from exercising their basic right. In this regard the court referred to Article 6(1)(f) GDPR to highlight this point, although not directly applicable to public bodies. Eventually, the court held that the Foundation was not obliged to disclose the wording of the agreement with the second seller because this would amount to an access to files, which is not covered by the right of the press to information.
J*Club
The controller operates a cross-company and cross-sector customer loyalty programme called "J*Club". Customers of participating retail outlets can register as members, collect points based on their purchases and subsequently redeem these points to receive discounts, etc. According to the privacy policy, the legal basis for the processing is consent pursuant to Article 6(1)(a) GDPR which is voluntary and can be revoked at any time. In October 2019, the Austrian Data Protection Authority (DSB) conducted ex officio investigations and found that the controller's procedure did not fulfill the requirements of consent, therefore Article 6(1)(a) GDPR could not be used as a legal basis for processing. Since the controller had not made use of other legal bases, the processing was unlawful. The controller appealed that decision before the Federal Administrative Court (BVwG). It argued that it had used legitimate interest, Article 6(1)(f) GDPR, beside consent as a legal basis. Subsequently, in December 2019, the DSB amended its decision. It held that 1) the request for consent by the controller does not meet the requirements pursuant to Article 4(11) GDPR and Article 7 GDPR and that no other legal basis can be considered and the aforementioned processing is therefore unlawful. 2) the controller shall be prohibited from processing personal data for the purpose of profiling within the scope of Clause 1 and 3. 3) the complainant shall be granted a period of six months to implement point 2. The BVwG granted the controller's appeal and annuled the decision in its entirety without replacement. It held that the DSB had incorrectly only based its decision on the lack of consent and not on other possible legal bases, thus not performed an exhaustive investigation. According to the BVwG, the sole examination of the legal basis of consent could not necessarily establish a violation of the principle of lawfulness and thus also no entitlement to the remedial power under Article 58(2)(d
Stichting BREIN
Stichting Brein is a foundation involved in collectively counteracting and preventing copyright infringements. Ziggo is one of the largest internet service providers (ISPs) in the Netherlands. In december 2020, Brein started the "FLU-warning campaign". The aim of this campaign was to send warning letters to holders of IP addresses of which Brein, using special software, had found that they had uploaded copyright infringing material via BitTorrent for at least two times in a span of four weeks. Since Brein only had the IP address of these uploaders, and not their name and address details, it needed the cooperation of ISPs to link an IP address to name and address details. Ziggo, however, did not want to cooperate voluntarily. Hence, in this interim relief proceeding, Brein requested the Court to order Ziggo to forward Brein's warning letters to the relevant Ziggo customers. The interim relief judge rejected Brein's request because Ziggo does not (yet) have a permit as listed in Article 33(4)(c) Implementation Act, to process the IP addresses. First, the Court noted that the IP-addresses are personal data for both Ziggo and Brein, referring to CJEU-cases Breyer and Mircom, since Brein has the legal means to force Ziggo to hand over name and address details related to a specific IP-address. Secondly, the Court considered that the IP addresses are personal relating to criminal offences, Article 10 GDPR, because copyright infringement is a criminal offence according to Article 31-33 Dutch Copyright Act. Even though there is barely any prosecution on the basis of these offences, [https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/ontwerpbesluit_dutch_filmworks.pdf the Dutch DPA has previously held] that processing of personal data of persons against whom there is a more or less well-founded suspicion of acts that infringe a copyright, must be regarded as the processing of personal data regarding criminal offences. Third, the Court marginally assessed
Court case II SA/Rz 1539/21
The Director of a public school was requested to provide a comprehensive set of information related to the members of its public education board. The information requested included, inter alia, the name, age, completed academic education, position held, and remuneration. The Director provided the information requested, but refused to disclose the members' remuneration, claiming that the provision of this information would violate the employee's privacy and data protection rights. Upon request to review the decision, the Director upheld it. The Director explained that information related to the expenditures of a public body on the remuneration of its employees is indeed public information, but that this did not imply that the employees would consent to the publication of their names and individual remuneration. Referring to a decision of the Polish Supreme Court in case [https://orzeczenia.nsa.gov.pl/doc/389F848379 I OSK 695/14], the Director pointed out that what is considered public information is the amount of public funds allocated to a given position as a base salary, not the exact remuneration a particular person receives (which may include many other elements, such as social benefits, deductions, etc.) The claimant appealed this decision with the Head of the Municipality, which in turn upheld the contested decision, pointing out that individual remuneration attached to a specific name is personal data under Article 4(1) GDPR. Additionally, the Head of the Municipality maintained that according to Article 11 of the Polish Labour Code, an employer is obliged to respect the rights and dignity of employees, including their right to privacy, and therefore to keep salary information secret. In view of the above, the claimaint filed a complaint before the The Provincial Administrative Court in Rzeszów (Wojewódzki Sąd Administracyjny w Rzeszowie - WSA Rzeszów). The WSA Rzeszów overturned the decision from the Head of the Municipality. The court held that the remun
Employee
Plaintiff A is a former employee of defendant C. Defendant C accuses plaintiff A of a series of misconducts in connection with their employment, namely: (1) to have made false statements when concluding their emplyoment contract, (2) to have breached data protection regulations by having her husband draw up the duty roster and, thereby, providing an unauthorized person access to the personal data of other employees, (3) to have instructed other employees to provide care services to clients beyond the allowed limited field of acivity of said employees, (4) to have repeatedly postponed appointments with new clients without reason, and (5) to have stopped working for several afternoons without permission to pursue private activites. Plaintiff A disputes these assertions and claims that after the termination of the employment relationship between plaintiff A and defendant C, defendant C made an active effort to contact potential future employees of plaintiff A to inform them of the disputed misconducts and is filing for injunctive relief. The court ordered the defendant to cease and desist from actively approaching potential future employers of the plaintiff to make their claims. It pointed out that both the protection of personality guaranteed by Article 1 and 2 of the German basic law as well as the legal basis for the processing of personal data of Article 6(1)(f) GDPR (the legitimate interests of a data controller or a third party) require a balancing of interests between (1) the rights of a former employer to provide information to a new employer about the performance and conduct of a former employee and (2) the personality and data protection rights of an employee. It held that while in principle employers are entitled to forward information regarding the employee's performance and conduct, none of the claims, to the extent that they were substantiated by defendant C, met the necessary proportionality threshold of the German basic law and the GDPR to entitle defendant C to actively contact potential future employers of plaintiff A.