GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Der Standard (the controller) is an Austrian daily newspaper. The website implemented a pop-up window, which gave the data subject the option of consenting to the use of cookies for web analysis and advertising, or to pay a monthly subscription and access the website without advertising (also known as “Pay or Okay”). A data subject chose the option of accepting cookies, as they did not want to take out a paid subscription, but also regularly deleted their cookie history because they did not want to be tracked. The data subject brought a complaint to the DPA on 13 August 2021, arguing that they had been forced to consent to extensive processing of their data or take a paid subscription. The data subject was represented by noyb. Furthermore, the blanket consent to all data processing does not comply with the GDPR. The controller argued that data processing for advertising purposes was necessary for the provision of its services. In addition, the “Pay or Okay” model was permissible, according to a previous decision of the DPA. Finally, the uniform consent to several data processing operations was permissible under the GDPR. In its decision on 29 March 2023, the DPA stated that the “Pay or Okay” model followed by the controller violated Article 5(1)(a) GDPR and Article 6(1)(a) GDPR, as it lacked granularity. This meant that the data subject could not choose which processing activities to consent to, and was forced to consent to all processing activities (or pay a subscription fee). In addition, the DPA ordered the controller to delete the data subject’s personal data if it was still processed within a month of the decision. However, the DPA dismissed the data subject’s request to issue a processing ban. The controller appealed the decision to the Federal Administrative Court, contesting the decision that there was a violation and the order to delete the data. The data subject also appealed the decision, contesting the decision to dismiss the request to issue a proce
The data subject filed a complaint with the Austrian DPA on March 16, 2022. alleging that the controller violated his right to access under Article 15 GDPR by providing incomplete details about the specific recipients of their data or the reason why the disclosure of the specific recipients was not possible pursuant to Article 15(1)(c) GDPR., and by failing to provide a copy of the data or offering inadequate justification as to why issuing a copy was not possible under Article 15(3) GDPR. The authority upheld the complaint and ordered the controller to provide the requested information within four weeks or to adequately justify why this could not be done. The controller requested a suspension of the proceedings pending the outcome of another decision, but this request was rejected. The controller appealed the DPA’s decision. Meanwhile, the data subject has passed away. The Court upheld the appeal and annulled the contested decision because the data subject, a natural person, lost his party status in the proceedings upon his death. Since data protection rights are highly personal and extinguish upon the death of the data subject, they cannot be transferred to any legal successor, in accordance with the [https://www.ris.bka.gv.at/Dokument.wxe?ResultFunctionToken=ba0008f7-3b36-4f83-83ee-7878707b664e&SkipToDocumentPage=True&Abfrage=Vwgh&Entscheidungsart=Undefined&Sammlungsnummer=&Index=&SucheNachRechtssatz=False&SucheNachText=True&GZ=Ra+2016%2f04%2f0044&VonDatum=&BisDatum=29.09.2025&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Dokumentnummer=JWT_2016040044_20160418L00 case law of the VwGH]. The extent of a person’s participation in an administrative procedure depends not only on their status as a party but also on their party capacity, that is, their ability to hold procedural rights and obligations. If the party who initiated the proceedings before the administrative authority dies, the contested decision must be te
The controller is GGNET, a mental health care institution operating in the Netherlands. The data subject sought medical treatment there after a reference by her general practitioner. The practitioner also forwarded to the controller the data subject’s medical records. After her first session with the social psychiatric nurse of the controller, the data subject decided she didn’t want to continue with the treatment and asked for her medical record to be deleted. The controller informed her that it deleted her medical records but retained a record regarding the erasure request. The data subject filed a complaint before the DPA (Autoriteit Persoonsgegevens-AP) requesting that the controller was ordered to delete the record regarding the erasure request. The DPA rejected her complaint, ruling that the controller could retain this record for the management of its health care services and under the medical treatment contract with the data subject, as referred to in Article 9(h) GDPR. The data subject challenged the decision of the DPA before the court of first instance (Gelderland District Court). The court dismissed the appeal as unfounded, affirming the DPA’s decision. Then, the data subject appealed against this ruling before the Highest Administrative Court (Council of State), claiming that the court of first instance misjudged the case. She claimed that the court did not recognise that the DPA should have taken enforcement action against the controller. According to the data subject, the record of the deletion request was not necessary for the management of the controller's health services nor there was a treatment agreement between the parties since she did not receive any treatment. The court held that the data subject’s right to erasure referred to in Article 17 GDPR could not be satisfied. First, it stated that the retention of the deletion request was necessary for the controller to manage its service, and in particular in order to justify why it no long
The data subject filed a complaint on 07.05.2024 with the Austrian Data Protection Authority (DSB), alleging that an Estonian company located in Tallinn, Estonia, had failed to fully respond to a request for access under Article 15 GDPR. By 12.02.2025, more than six months later, the DSB had not issued a decision. As a result, the data subject filed an inactivity complaint with the DSB, arguing that it had failed to act within the legally required time. By letter dated 17.02.2025, the DSB informed the data subject that the complaint had been forwarded to the Estonian supervisory authority, which would assume responsibility as the lead supervisory authority. By letter from the DSB dated 20.02.2025, the inactivity complaint was transmitted to the Federal Administrative Court. It stated in particular that, due to cross-border processing, the Estonian supervisory authority is allegedly the responsible authority under the procedure referred to in Article 60 GDPR, and that the decision-making period is suspended for the duration of this procedure, in accordance with national procedural law. The Court dismissed the inactivity complaint as unfounded. Under Austrian procedural law, specifically [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20008255&FassungVom=2025-02-02&Artikel=&Paragraf=8&Anlage=&Uebergangsrecht= § 8(1) VwGVG] and [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A2P24/NOR40262693?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=dsg&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=24&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=12.09.2024&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=f3119544-88f3-40ff-a7b3-a77e97056d8d § 24 DSG,] an inactivity
An employee (in the following referred to as the controller) was employed by a company as a cosmetologist. Part of their work allowed them to access, among other things, the personal data of clients. When entering into an employment contract, the controller signed a confidentiality agreement and a declaration confirming they were familiar with regulations related to personal data protection. The controller later began running their own business. They were dismissed from the company as a result from an investigation into another employee. The company found that an employee used the controller’s login details to access clients’ personal data (considered a trade secret) without permission, and later transferred this data to the controller. The employer brought a criminal complaint to the Court. In terms of data protection, the Court applied [https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU20180001000/U/D20181000Lj.pdf Article 107 of the Polish Data Protection Act] (Dz. U. 2018 poz. 1000), which implemented the GDPR. Under [https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU20180001000/U/D20181000Lj.pdf Article 107], a person who processes personal data without a legal basis or authorisation may be held criminally liable. The Court found that the controller used their access rights as an employee to download clients’ data (including contact information and health data) through another employee, in order to use said data for their own business activities. The employee who accessed the data on behalf of the controller was also found liable under [https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU20180001000/U/D20181000Lj.pdf Article 107]. The Court ordered the controller to pay a total of PLN 2,000 (approximately €470). The Court took into consideration the social harm and the aim of having a deterrent effect. However, the Court also considered the controller's lack of criminal record as a mitigating effect.
Association Mousse (referred to as “Mousse”) filed a complaint with the DPA against SNCF Connect (a platform allowing people to purchase rail travel documents, the controller). The controller required data subjects to choose between “Mr” or “Ms” when purchasing tickets on its website. Mousse argued that this was unlawful under Article 5(1)(a) GDPR, as the controller did not have a legal basis to process this data. In addition, requiring this information violated the principle of data minimisation (Article 5(1)(c) GDPR), as well as the controller’s transparency obligations (Article 13 GDPR). The DPA dismissed the complaint, stating that the controller had not violated the GDPR. Furthermore, the controller had a valid legal basis to process data subject’s genders under necessity for the performance of a contract (Article 6(1)(b) GDPR). Finally, processing this data complied with the principle of data minimisation, as addressing data subjects in a personalised manner was an accepted practice in commercial, civil and administrative communications. Mousse appealed the decision to the Court, arguing that an accepted practice does not mean it is necessary for the performance of a contract. Furthermore, the obligation to disclose one’s gender is a violation of the right to respect for private life, and risked potential discrimination against the data subject. The Court decided to stay its proceedings and refer a preliminary question to the CJEU. In its decision (C-394/23 Mousse), the CJEU found that the generalised processing of passengers’ genders was not necessary for the performance of a contract or for the legitimate interest of personalised commercial communication. Following the CJEU decision, Mousse requested the Court to issue guidelines regarding the issue, and argued that the CJEU decision implied the DPA decision should be overturned. The controller requested the Court to clarify whether it could still process the data for specific services, or offer a choice
The data subject is a member of the parliament for the party Die Linke. The controller is a state party described as "right-wing extremist small party". The data subject announced a demonstration against governmental actions at the town’s square and a few days later the controller published a post on Telegram and printed flyers announcing a demonstration at the same place and time and for the same cause as the other demonstration. In their announcement they called for a united demonstration and listed the data subject’s name amongst the names of far-right party leaders. The data subject filed a case before the Regional Court (District Court of Leipzig - LG Leipzig) arguing that his good reputation and credibility as politician had been significantly impaired by the fact that the announcement has wrongly given the impression that he was cooperating with a "right-wing party". He requested an injunctive relief and claimed immaterial damages for the violation of his personality rights and privacy rights, under Article 82 GDPR. The Regional Court awarded him €10,000 in immaterial damages and ordered the controller to delete the post. Following the controller’s appeal before the Court of Appeal (Higher Regional Court of Dresden - OLG Dresden), the court overturned the Regional Court's judgment and dismissed the action. It held that the violation of the right to personality did not reach the degree of relevance required for the granting of a monetary compensation and a claim from Article 82 GDPR was also out of the question because this article is not relevant in the area of political debate. The data subject appealed this judgement before the Federal Court of Justice (BGF) pursuing his claim for monetary compensation. The Federal Court of Justice held that the data subject was not entitled monetary compensation against the controller from any legal point of view. First, it held that the controller did not violate the data subject’s right to personality, under na
A company (the controller) was operating a video surveillance system, consisting of a total of nine external and indoor cameras. After an anonymous complaint, the DSB opened administrative criminal proceedings and found that the controller had unlawfully processed personal data in the period from March 2022 to at least May 2022 and data subjects located in the following reception areas were recorded, including during payment transactions and PIN code entries. In fact, approximately 637 PIN entries were estimated to have been recorded. The processing of personal data carried out by the video surveillance system considered from the DSB not to be proportionate to its intended purpose and to go beyond what was necessary for the intended purpose of the surveillance, without a relevant legal basis and in defiance of the principle of fairness and data minimization violating Article 6(1), Article 5(1)(a) and Article 5(1)(c) of the GDPR respectively. As a result, the appellant was fined €1.5 million with an additional €150,000 in procedural costs. The controller appealed, arguing that some footage did not contain identifiable personal data, that many customers used payment methods not requiring PIN entry or covered it during entry, and that surveillance was necessary for security purposes. It also claimed the fine was disproportionate, particularly because the turnover of the parent company was improperly considered in its calculation. It requested the penalty decision to be fully repealed and the proceedings discontinued, or alternatively, that the penalty be reduced to a warning, or at least that the fine be adjusted to a proportionate and appropriate amount. On 2024 the Appeal submitted further to the Federal Administrative Court. The Court partially upheld and partially dismissed the appeal. Specifically, it found that the video surveillance system violated 5(1)(a), 5(1)(c), and 6(1) GDPR due to the lack of a valid legal basis and excessive data collection. It argued
The data subject took out a life insurance policy with the controller, an insurance company. Between 2008 and 2020, a few letters containing the data subject’s personal and financial data were mistakenly sent to a third party. In June 2021, the data subject took proceedings to the court of first instance (Circuit Court) claiming that the controller acted negligently and in breach of duty, causing the data subject “distress, upset, anxiety, inconvenience, loss and damage”. The data subject sought a declaration that that the controller violated the GDPR, implemented by Data Protection Act 2018, and the Data Protection Acts of 1988 and 2003, and further sought damages for negligence and breach of duty. However, the court of first instance dismissed the case on the grounds that the data subject had not obtained authorisation from the Personal Injuries Assessment Board (PIAB), an independent body which was set up to make personal injuries claims faster and cheaper. (In most personal injury claims in Ireland, it is required to obtain an authorisation from the PIAB, before taking a claim to court.) The data subject appealed the decision before the court of appeal (High Court), limiting his claim to data breaches that allegedly occurred after the implementation of the GDPR in 2018. He also contended that his claim was not an action for personal injuries as that term is used in the [https://www.irishstatutebook.ie/eli/2003/act/46/section/12/enacted/en/html section 12 of the Personal Injury Assessment Board Act 2003] (the 2003 Act). Instead, it was a claim for non-material damages under the GDPR. The High Court upheld the Circuit court's decision that the PIAB authorisation should have been obtained first and ruled that the action should be dismissed. However, the data subject was granted leave to appeal to the Supreme Court regarding the question of whether a claim for damages for “distress, upset and anxiety” arising from an alleged data breach, falls within the statut
The data subjects were clients of the controller, a tax consultancy firm. In August 2019, the data subjects informed the controller by email that their previous address had changed and provided their new one. In July 2020, the data subject instructed the controller to prepare their income tax return declaration for 2019. The data subject’s contact details from the previous tax return, which still contained their former address, were automatically imported. For this reason, the tax return was sent to the previous address. The new residents of the house opened the envelope containing the relevant documents. The data subjects filed a case before the court of first instance (Local Court Wesel - AG Wesel) requesting compensation for immaterial damages from the controller in the amount of €7,500 each. They claimed that the disclosure of their personal data, including health data, to third parties made them feel exposed and stigmatised causing them pain and suffering. The controller claimed that even if the new residents had opened the letter and taken note of its contents, which is disputed, this was not attributable to it. According to the controller, this was an independent and punishable act of the third parties which had interrupted the causal chain of the controller's actions. First, the court ruled that the controller violated the principle of accuracy Article 5(1)(d) GDPR by not deleting the data subject’s former address from the database in its entirety. It was irrelevant that the address was automatically inserted by a program since it was the controller’s obligation to ensure that the address was no longer stored in the system at all. The court pointed out that a breach of the accuracy principle also constituted an unlawful processing of personal data. Second, the court held that that the data subjects already suffered loss of control of their data. Whether the third parties interrupted the causal chain of events by opening the letter without authorisati
The Federal Press Office operated a fan page on the social network Facebook, provided by Meta Platforms Inc., where it provided information about current political activities of the Federal Government. When users visited the page, cookies could be placed on their end devices. In 2023, the Federal DPA (BfDI) prohibited the Federal Press Office from operating its fan page because the design of the cookie banner used by Meta was not GDPR compliant. It held that the Federal Press Office was regarded a joint controller, together with Meta, responsible for ensuring that the data processing regarding cookies was based on a sufficient legal basis such as consent. Therefore, not only Meta, but also the Federal Press Office, as the operator of the fan page, was legally obliged to obtain the consent of the respective visitor. Both the Federal Government and Meta appealed against the DPA's decision addressed to the Federal Press Office before the court of first instance (Cologne Administrative Court-VG Cologne). The court held that under the GDPR, Meta and the Federal Press Office were not joint controllers for the contested data processing. Meta was solely responsible for obtaining the consent of visitors of the fan page for the placement of cookies. It ruled that the Federal Press Office's contribution to the storage and reading of cookies was limited to the operation of the page. In particular, the Federal Press Office could not specify any parameters for the placement of the cookies and the analysis of the data collected. In the opinion of the court, the mere facilitation of data processing does not constitute the necessary joint determination of the means of data processing. Consequently, the Press and Information Office of the Federal Government was permitted to continue operating its Facebook fan page.
The data subject was placed in the persoonsgerichte aanpak (PGA), a local multi-agency intervention programme in Amersfoort aimed at tackling repeated public disorder and safety issues. The police had referred him in December 2022 following multiple complaints of nuisance and repeated negative encounters, documented in a formal police report. His personal data was shared between various municipal partners under the PGA privacy covenant. In February 2024 the municipality informed the data subject that his PGA file had been closed due to the absence of further incidents, but that his data would remain stored for two years. The data subject objected, arguing that his inclusion in the PGA was unfounded, had damaged his reputation, and that continued storage constituted unlawful processing. He sought cessation of the processing under Article 21 GDPR. The municipality rejected his objection, upholding the continued retention of the data. The Court held that the processing of personal data pursued a task of public interest under Article 6(1)(e) GDPR, namely maintaining public order and safety. It accepted the police reports and the PGA expert’s assessment as a sufficient basis for the referral, and held that keeping the data for two years was proportionate to allow swift intervention if problems re-emerged. Although it was held that the data subject had a valid interest in challenging the lawfulness of the processing, the Court concluded that the municipality had demonstrated compelling legitimate grounds that outweighed his personal interest under Article 21 GDPR. The Court found that the municipality had not explained its decision properly at the time, so it formally struck down that decision. However, because the data processing itself was lawful, the outcome remained the same and the data could continue to be stored. The data subject’s appeal was therefore technically successful, but it did not stop the processing. The municipality was ordered to refund the court fe
The data subject lodged a complaint with the Austrian Data Protection Authority (DSB), alleging a violation of its right of access under Article 15 GDPR. Specifically, the data subject requested information from the controller about the recipients and categories of recipients to whom its personal data had been disclosed. In response, the controller provided a general list of all potential recipients but did not specify individual recipients. The DSB held that the controller had violated Article 15 by providing incomplete information. The controller appealed this decision to the Federal Administrative Court. The Court upheld the controller’s appeal. Referring to CJEU case law, the Court confirmed that data subjects have a right to be informed of specific recipients under Article 15(1)(c) GDPR, unless identification is impossible or the request is manifestly unfounded, in which case only categories of recipients must be provided. Applying this standard, the Court found that the controller had fulfilled its obligation by naming all potential processors, explaining the purposes of data transfers, and identifying processors who had not received the data. Since the specific recipients could not be identified due to a lack of documentation, documentation that is not legally required, the Court concluded that the information provided was sufficient and complete.
In March 2020, the data subject concluded a postpaid mobile phone contract with a telecommunications provider (controller). The following day, the controller reported the existence and terms of the contract, including its type, duration, and the parties involved (positive data) to SCHUFA, a credit information agency. It did not report any payment default information (negative data). The data subject was informed about this practice in the contractual documentation. On October 2023, the data subject became aware of the entry, following an access request to SCHUFA under Article 15 GDPR. The data subject brought a case before the court of first instance (Regional Court Nürnberg-Fürth-LG Nürnberg-Fürth) claiming that the transfer of his positive data was unlawful because he never provided his consent. Furthermore, the unlawful transmission of his data to SCHUFA caused him emotional distress, reputational concern, anxiety and a loss of control over his personal data. He also referred to an earlier rejection of a credit application for a television purchase (valued at approximately €800) and argued that the SCHUFA entry had contributed to this outcome. The data subject sought: # compensation for material and immaterial damages under Article 82 GDPR; # a cease-and-desist order against further transmissions without consent; # a declaration of liability for potential future damages. The controller defended that the processing was lawful, arguing that the data was limited to positive contractual information, that the transmission was necessary for fraud prevention and credit risk assessment in mass-market telecommunications services, and that Article 6(1)(f) GDPR provided a valid legal basis. The court of first instance dismissed the action as unfounded stating that the data subject had no claim against the controller for the damages sought under Article 82(1) GDPR, as he had not been able to prove to the court's satisfaction that he had suffered material or non-material da
The data subject submitted a request to the Minister for Legal Protection (now: the State Secretary for Justice and Security) to erase the files of her two sons held by the controller, the Child Protection Council (RvdK), pursuant to Article 17 GDPR. The files contained documents regarding the termination of her parental rights to both her children. On 15 September 2021, the Minister rejected the erasure request, arguing that the records should be retained under the Dutch Archives Act, and on 14 February 2022, he rejected the objection lodged against it. The data subject filed an appeal before the court of first instance against the decision of the Minister. By judgment dated 22 December 2022, the court dismissed it as unfounded. It held that the processing of the data subject’s children’s personal data was necessary for the fulfillment of a statutory processing obligation pursuant to Article 17(3)(b) GDPR. The data subject filed an appeal before the highest administrative court (Council of State-Raad van State). She argued that since the custody termination order for her youngest son had been lifted the files must be deleted because their content was incorrect and therefore unlawful. She further argued that the measure of custody termination for the eldest son should also be lifted because it was based on the unlawful RvdK files. The court held that the data subject did not present any reasons why the processing of the personal data was unlawful, nor has there been any such evidence. She is therefore not entitled to the erasure of the personal data in the RvdK files under Article 17(1)(d) GDPR. It also pointed out that these proceedings could not lead to a judgment on the measure to terminate custody. The court also ruled that RvdK was obliged by statutory law to retain the contested personal data in the files for the envisaged time period, according to the Dutch Archives Act. In the case of a custody order the time period would be 100 years. This means that,
The ruling relates to the procedural aspects of a cross-border case involving Meta Platforms Ltd. The full summary for the case is available here. = In May 2018 a Facebook user (the complainant) lodged a complaint against Meta Platforms Ireland Ltd with the Austrian DPA. In her complaint, she claimed that the collection of personal data via Facebook violated several rules of the GDPR, including Articles 6 and 9. Short after the complaint was filed, the Austrian DPA held that the case was cross-border in nature and forwarded the complaint to the Irish DPA as the lead supervisory authority. In 2021 the Irish DPA submitted a draft decision to all EEA supervisory authorities. Some of them raised “reasoned and relevant objections” to the draft within the meaning of Article 4(24) GDPR. The DPC decided not to follow some of those objections and, therefore, referred the matter to the EDPB under the GDPR’s consistency mechanism. The EDPB decided the matter in December 2022 with its Binding Decision 3/2022. Following the Binding Decision, the Irish DPA decided the complaint and fined Meta €210,000,000 over the unlawful processing of personal data for targeted advertising on Facebook. = After the dispute resolution procedure of the EDPB the complainant requested access to the case file relating to her complaint. She invoked several provisions of EU primary and secondary law, including Article 41(2)(b) of the EU Charter of Fundamental Rights (“Right to good administration”). The EDPB replied with an email to the complainant (from now on: “the Contested Decision”), granting the complainant access to some of the documents relative to the procedure based on [https://eur-lex.europa.eu/eli/reg/2001/1049/oj EU Regulation 1049/2001]. However, the EDPB held that the complainant had no right of access under Article 41(2)(b) CFREU. As a result, the EDPB only granted the complainant access to parts of the file. The complainant considered that the EDPB violated her rights and filed an
The data subject concluded a contract with a telecommunications company (controller) for the provision of telecommunications services . The controller provided the data subject with a leaflet, informing him about the transfer of data regarding the conclusion of the contract (positive data) to credit information agencies. On the same day, the controller transmitted the name, date of birth and address of the data subject as well as the contract number and the date to Schufa, a credit information agency. In the meantime, the data subject was involved in consumer insolvency proceedings, for failing to settle personal loans. The data subject later became aware of the data transfer to Schufa and filed a case before the court of first instance (Regional Court of Singen - AG Singen). He maintained that the transfer was unlawful because he never provided his consent and climed immaterial damages of least €500, under Article 82(1) GDPR. He alleged that due to the data transfer he suffered from anxiety, a sense of loss of control over his data and worried about his creditworthiness, which affected his sleep and therefore his quality of life. The controlled argued that he transmission of positive data to credit information agencies was permissible for reasons of fraud and over-indebtedness prevention and that the data subject was not entitled to any damages. The court rejected the case as unfounded. First, it held that the data subject had no claim for damages arising from Article 82(1) GDPR because the processing of personal data was lawful, under Article 6(1)(f) GDPR. The transfer of the data subject’s contractual data was necessary for reasons of fraud, identity theft and over-indebtedness prevention, thus serving the legitimate interest of the controller. Second, the court ruled that the data subject did not suffer immaterial damage from the data transfer. It pointed out that since he was involved in consumer insolvency proceedings, there were serious doubts that hi
The data subject runs a business in the hospitality industry. A tax authority (controller) received an anonymous report against the data subject. The tax authority subsequently carried out a cash register inspection on the data subject which did not result in the finding of any wrongdoing. The data subject requested from the tax authority access to her tax files in order to gain knowledge of the content of the anonymous report, on the basis of her right to inspect files under the national fiscal code, but the tax authority rejected the request. She also made an access request under Article 15 GDPR, but the tax authority refused to provide the data about the anonymous report. In August 2023, the data subject appealed the decision of the tax authority before the tax court of first instance (Berlin-Brandenburg tax court). She requested access to the files and information on the content of the anonymous report by sending her a copy, or, alternatively, by informing her about the content, in accordance with Article 15 GDPR and the national fiscal code. The tax court dismissed the action, holding that the data subject was not entitled access to the file, because she did not have a right to inspect files under the national fiscal code and also the provisions of the national fiscal code preclude the exercise of Article 15 GDPR if the provision of information would compromise the performance of the authority. The data subject filed an appeal with the Federal Fiscal Court (BFH), claiming that her rights under the GDPR override the national fiscal code provisions. The court rejected her request to access the file both under her alleged right to inspect the files under the national fiscal code and her right to receive a copy of the notification under Article 15 GDPR, and dismissed the appeal as unfounded. First, it pointed out that the national fiscal code does not contain a provision according to which there is a right to inspect files but depends on the discretion
The municipality of Bremen (controller) operates of a public waste disposal system. By its decision in January 2022 , the controller issued a waste fee notice for the year 2022 in the total amount of €176,82 against the data subject with regard to his property. In February 2022, the data subject filed an objection against this fee notice before an appeal authority of the controller, arguing that the fee notice had been issued fully automatically, in violation of Article 22 GDPR, and was therefore unlawful. He claimed that his personal data had been processed fully automatically and unlawfully, resulting in an individual administrative decision detrimental legal effects. He also objected to the fully automated processing of his personal data. The controller rejected the data subject's objection as unfounded, in amendment to the fee notice produced by a clerk, dated 8 March 2023. According to the controller, Article 22 GDPR did not apply in the present case, as there was no automated decision in the individual case within the meaning of the provision. The mere program-supported calculation of fees according to a fixed fee schedule does not constitute a decision within the meaning of Article 22 GDPR. In any case, a possible breach of a legal reservation was cured by the notice amending the fee notice. In April 2025, the data subject filed an action before the court (Administrative Court of the Free Hanseatic City of Bremen-VG Bremen) where he challenged the fee notice (consisting of the original fee notice as amended by the later notice produced by the clerk). He persisted that his personal data had been improperly subjected to illegal automated processing, without the involvement of a human being, by the controller, which led to a decision with a direct legal effect on him. The data subject requested that the fee notice was set aside due to a violation of Article 22 GDPR. First, the court found that the initial decision of the controller of January 2022, regardin
The data subject was a user of the controller’s France-based music streaming service since 2015. The controller used an Israel-based company as a processor on the basis of an agreement pursuant to Article 28 GDPR. Their agreement foresaw that upon termination of their contractual relationship the processor must sent back all personal data it processed on behalf of the controller and then arrange the deletion of all copies retained by it or its sub-processors in 21 days. The processor engaged a group affiliate as a sub-processor, without ensuring a proper sub-processing agreement. In November 2020, the contractual agreement between the controller and the processor was terminated. with a deletion confirmation only being received in February 2023. In November 2022, the controller became aware of a hacking incident that exposed customer personal data, including names, birthdates, and email addresses, which were offered for sale on the darknet. The controller submitted a personal data breach notification to the DPA and informed the data subjects accordingly. The data subject filed a case before the court of first instance (Regional Court Duisburg - LG Duisburg) demanding immaterial damages. The Regional Court Duisburg rejected the case as unfounded, citing lack of proof of damage and insufficient evidence of actual data exposure. The data subject filed an appeal before the court of appeal (Higher Regional Court of Düsseldorf - OLG Düsseldorf). In the meantime he was able to obtain the leaked list on the darknet and prove that the data published therein concerning him originated from the controller. He claimed that the controller was not allowed to transfer the data to the processor at all, it did not check whether its processor had deleted the data, and there was no contractual relationship between the processor and sub-processor. The data subject requested for: - Compensation for non-material damages for data protection violations in the amount of €3,000,