GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Österreichische Datenschutzbehörde (Austrian DPA)
On 17 February 2020, a data subject (the complainant) lodged a data protection complaint under Article 77(1) GDPR for breach of the right of access under Article 15 GDPR by a company. By decision of 22 April 2020, the DPA refused to deal with the data protection complaint under Article 57(4) GDPR on the basis that between 28 August 2018 and 7 April 2020, the complainant had submitted 77 data protection complaints that were essentially the same and regularly contacted by phone the DPA. Thus, the complainant brought an action against the decision before the Austrian Administrative Court, which, on 22 December 2022, upheld the complaint and annulled the DPA decision because it could not be said with certainty from Article 57(4) GDPR when a request is ‘excessive’, but it could be derived that they had to be frequent but also ‘manifestly vexatious or abusive in nature’, which the DPA had not demonstrated. The DPA challenged this judgement before the Supreme Administrative Court (Supreme Court). On 6 July 2023, the Austrian DPA requested the Supreme Court to refer a question to the CJEU, namely, whether the concept of ‘request’ in Article 57(4) GDPR could be interpreted as also covering ‘complaints’ under Article 77(1) GDPR. The Supreme Court stated that the concept of ‘requests’ within the meaning of Article 57(4) GDPR is not defined more precisely in the GDPR. Nonetheless, Article 57(2) GDPR and Article 57(3) GDPR suggest that the concept also includes complaints under Article 77(1) GDPR since the handling of complaints is a primary task of any supervisory authority, which should facilitate their submission and provide services free of charge. Additionally, if the CJEU would answer affirmatively, the following questions were referred. Firstly, the Supreme Court noted that carrying out an extremely large number of complaints does not constitute an abusive assertion of rights. However, an abuse of the right conferred by Article 77(1) GDPR could be claimed if a data subject pursues objectives such as lodging a complaint to harm the controller or placing an undue burden on the supervisory authority. However, it referred the question to the CJEU because the concept of ‘excessive’ in Article 57(4) GDPR cannot be answered beyond doubt based on its wording or context. Thus, it asked if Article 57(4) GDPR must be interpreted as meaning that, for requests to be ‘excessive’, it is sufficient that a data subject has merely carried out a certain number of requests, complaints under Article 77(1) GDPR, to a supervisory authority within a certain period, irrespective of whether the facts are different or the complaints concern different controllers, or whether a data subject must also have an abusive intention on top of the frequent complaints. Secondly, the Supreme Court expressed doubts concerning the application and interpretation of Article 57(4) GDPR since they are not obvious. It asked if Article 57(4) GDPR must be interpreted as meaning that the supervisory authority can freely choose whether to charge a fee based on the administrative costs of processing it or refuse to process from the outset in situations of ‘excessive’ complaint. If not, what circumstances and criteria must the supervisory authority consider.
Court case 466856
A data subject was registered in the information system of the company [https://www.verifone.com/ Verifone], a payment service provider (controller). After changing her identity, she requested a court in the USA to order the rectification of her customer account data (surname, first name, email) and of her data appearing in other documents such as orders. The court refused, and the data subject referred the matter to the French DPA (CNIL). The CNIL contacted the controller to ask it to rectify the data subject's customer account data, which it did for the customer account data but not for the other documents. The CNIL considered that the documents drawn up before the change of identity did not need to be rectified retroactively because the change of identity happened later. The data subject took the CNIL's decision to the Conseil d'Etat (Supreme Administrative Court). For the documents drawn up before the identity change, the Conseil d'Etat considered that the data could not be considered as inaccurate since they were accurate at the time and for the purpose of the processing. These documents therefore did not contain any inaccuracies that should have been corrected under Article 16 GDPR. Consequently, the Conseil d'Etat upheld the CNIL's decision, considering that the CNIL correctly applied Article 16 GDPR.
Pankki S
J.M. (the data subject), a former employee and a customer of a bank in Finland (the controller), had learned that his customer data had been accessed by members of the bank’s staff on several occasions in 2013. The data subject had doubts of the lawfulness of those consultations. In May 2018, the data subject - who had in the meantime been dismissed from his post within the bank - made an access request asking the controller to inform him of i.) the identity of the persons who had consulted his customer data, ii.) the exact dates and iii.) the purposes of those consultations. The controller refused to disclose the identity of the employees who had carried out the consultation operations, on the ground that such information constituted the personal data of those employees. There was a suspicion of a conflict of interests in relation to the data subject which the controller said required processing of the data in question. The data subject then applied to the Finnish DPA for an order that the controller should provide him with the information requested. The Finnish DPA sided with the controller and considered that such log data constituted personal data relating to the employees who processed the data and rejected the application. Thereafter, the data subject brought an action against that decision before the Administrative Court of Eastern Finland. The Court referred to the CJEU for a preliminary ruling asking, essentially whether the log data generated during processing operations, in particular the identity of the controller’s employees, is covered by Article 15 GDPR since those log data might prove necessary to a data subject to assess the lawfulness of the processing of his or her data. Firstly, the CJEU found that a data subject has the right under Article 15(1) GDPR to obtain information from the controller relating to consultation operations carried out on the data subject’s personal data and information concerning the dates as well as purposes of those consulting operations. Secondly, the CJEU held that the employees of the controller cannot be regarded as being ‘recipients’, within the meaning of Article 15(1)(c) GDPR when they process personal data under the authority of that controller in accordance with its instructions. However, even though employees are not regarded as recipients, it was noted that by the CJEU that information relating to the persons who have consulted the data subject’s personal data that are contained in the log data may constitute personal data under Article 4(1) GDPR of the data subject, that enables the data subject to verify the lawfulness of the processing of his or her data and in particular to satisfy him or herself that the processing operations were actually carried out under the authority of the controller and in accordance with its instructions. After stating the above, the CJEU, furthermore recalled that the right of access should not adversely affect the rights or freedoms of others. Even if the disclosure of the identity of the controller’s employees to the data subject may be necessary for that data subject in order to ensure the lawfulness of the processing, it is nevertheless liable to infringe the rights and freedoms of those employees. In the event of a conflict between, on the one hand, i.) the exercise of an access right and, on the other hand, ii.) the rights or freedoms of others, a balance will have to be struck between the rights and freedoms in question. Consequently, the CJEU found that Article 15(1) GDPR does not lay down a right to the data subject to obtain the identities of the employees who carried out the consultation operations under the controller's authority and in accordance with its instructions, unless that information is essential in order to enable the data subject effectively to exercise the rights under the GDPR and provided that the rights and freedoms of those employees are taken into account.
Lääkäriklinikka Estetic Oy
The controller (Lääkäriklinikka Estetic Oy, a medical clinic) had asked the Administrative Court of Helsinki (the Court) to overturn the €5,000 administrative fine imposed by the Finnish DPA and the DPA's decision, according to which the controller had not implemented the data subject's access request. The controller filed the appeal claiming that it had already fulfilled the data subject's access request as far as it concerned the personal data it processed. The controller emphasised that it did not have access to the patient records of another company whose surgeon had treated the data subject at the controller's premises. The controller argued that the DPA should have requested an explanation from the other company as well, because the data subject was not a patient of the controller, but a patient of the other company. The controller also stated that the DPA's actions had not been based on a sufficient and appropriate investigation. The DPA emphasised that the data subject had received treatment from the controller at the controller's premises and that the controller had not informed the data subject that their patient records are in the possession of another company. The DPA also stated that the controller had not instructed the data subject to request their personal data from another company or otherwise informed the data subject about the matters related to the controllership of their personal data. The Court noted that, despite the opportunity reserved for it, the controller had not sufficiently demonstrated that some other entity had acted as a controller of the personal data generated in connection with the treatment that took place on its premises. In its appeal, the controller had not denied that the data subject had received treatment from the controller. Thus, the Court stated that the controller had to be considered as a controller within the meaning of the GDPR. In light of this, the Court agreed with the DPA that the controller had violated Articl
Court case 11 U 9/23
The plaintiff (data subject) objected to premium increases by the defendant, a private health insurer (controller). The data subject requested information regarding possible premium adjustments from 2012 in order to demonstrate that the premium increases were invalid. In particular, the data subject brought a claim for access to personal data under Article 15(1) GDPR, which related solely to the value of the triggering factor for the recalculation of the premium in the tariff at issue. The triggering factor is the percentage threshold by which the cost for insurance services or mortality probabilities must have changed in order for the insurer to be able to increase premiums for health insurance policies such as the one at stake.cf. § 203(2) Insurance Contract Act (Versicherungsvertragsgesetz - VVG) sentences 1 and 3 in conjunction with § 155(3) sentence 2 Insurance Supervision Act (Versicherungsaufsichtsgesetz - VAG) and § 155(4) sentence 2 VAG, respectively Muschner, in Langheid, Rixecker, Versicherungsvertragsgesetz, § 203 VVG margin number 23a (2017 Munich). The request for access was therefore aimed solely at being able to examine the legality of the premium increase. According to the data subject, the controller did not fully reply to the access request. After the Frankfurt (Oder) Regional Court dismissed the action as unfounded, the data subject appealed to the Brandenburg Higher Regional Court (OLG Brandenburg). (1) The court held that the value of the triggering factor for the recalculation of the insurance premium does not constitute personal data within the meaning of Article 4(1) GDPR as it is a mere calculation parameter without direct reference to the data subject, and hence does not fall within the material scope of the GDPR. (2) In an obiter dictum, the court also held that, even accepting the idea that the factors at issue constitute "personal data", the controller has a right of refusal under Article 12(5)(b) GDPR for abuse of the right of access
Court case W252 2237416-1
The data subject made an access request with the controller – a mail services provider. The controller delivered targeted political advertisements and the data subject why they were assigned to certain political affinities. However, in the data subject's view, the controller’s reply was not complete. For example, it did not contain the sources of the data and how the data subject was associated with certain political preferences for the purpose of political advertising. The data subject lodged a complaint with the Austrian DPA. The Austrian DPA upheld the complaint and found a violation of Articles 12(1) and 15(1)(g) and (h) GDPR, as the controller did not provide information about the sources and about how the affinity between the data subject and certain political groups had been inferred. The controller appealed the decision, arguing that the information asked by the data subject was not personal data but only “marketing classifications” to which neither profiling within the meaning of the GDPR nor Article 22(1) GDPR applied. The court upheld the controller's appeal. First, according to the judges, the sources were duly disclosed in the answer to the access request. The disclosure was also transparent and comprehensible, complying with the requirements of Article 12(1) GDPR. Second, concerning the alleged violation of Article 15(1)(h) GDPR, the court found that the controller provided sufficient information to understand the logic behind the automated decision-making pursuant to Article 22(1) and (4) GDPR. As a matter of fact, data processed were address, age and sex of the data subject; the method used a “statistical” one; and the purpose of the processing was to avoid to deliver irrelevant advertisement to the data subject. The court did not concern itself with the problem whether the processing at issue was profiling, nor with the issue whether the “marketing classifications” were actually personal data. The court stated that the disclosure of the algorithm
The plaintiff was a user of the defendant's social media plattform. He registered his profile with his phone number and didn't change the preset visibility option to "not visible". This option is set to "visible" in order to get found by phone number, the users get informed about this during registration. Business Insider on 4/3/2021 published an article reporting about scraping of phone numbers from the defendant's platform by unknown third parties. On July 2, 2021, The plaintiff sent a letter to the defendant demanding payment of damages and a cease and desist order, the defendant responded to the plaintiff's letter on September 30, 2021. On November 25, 2022, The Irish Data Protection Commission fined the defendant for violating the GDPR with €265 million for violating the GDPR and ordered the defendant to take remedial action. The plaintiff has not yet been the victim of identity theft; her account at the defendant's platform has also not been taken over by unknown third parties. The plaintiff has since changed the settings in her account so that her telephone number can no longer be accessed via the contact import tool. The plaintiff argues that she has been victim of a data breach, received (but did not answer) several calls from outside the country, that she lost control over her data and was in big worries about misuse of her data. She mentioned that she's getting a lot of strange short messages with apparent fraud attempts. This was due to missing security controls on the defendant's platform. The defendant argues, that the claim was to dismiss as the claims were too vague and the claim for a declaratory judgment lacked interest. The requirements for a claim for damages under Article 82 GDPR were not met since scraping was not hacking. In addition the defendant argued the loss of control alleged by the plaintiff was not sufficient. The claim is inconcise: text messages and calls from the beginning to mid-2019 described by the plaintiff are not necessarily
ING
In 2018, the data subject secured a loan from ING bank (the controller). Following this, several unauthorized activities occurred on his checking account, and the controller subsequently placed registrations with respect to the data subject in the Dutch Central Credit Information System (CKI). These registrations contained payment behaviour data, among other things the fact that for a certain period, the data subject was unable to fulfill their payment obligations set out with the controller. The data subject objected the CKI registrations on the basis of Article 21 GDPR, explaining that it had an impact on a loan he was taking out for a new house. The controller denied the request and further considered it as inadmissible under national provisions. The court dismissed ING's plea for inadmissibility under national provisions. The court then clarified that under national law, credit providers are mandated to process personal data and participate in the Central Credit Information System. The aim of the provision is twofold: firstly, it seeks to protect consumers from over-indebtedness and secondly, shield creditors from non-paying borrowers. The court added that the rejection of a request for data deletion under Article 21 GDPR needs to be justified by a compelling legitimate interest, subject to the principles of proportionality and subsidiarity. Legitimate interest must be assessed on the basis of currently known facts and circumstances of the case, including those after the CKI registration. The court pointed out that the data subject had inconsistent debt repayment patterns but fully cleared his debt in 2023 (i.e. after the CKI registration). In the balance of interest, the court considered that the controller's interest in maintaining the registration outweighed the data subject's interest in their removal. Consequently, the court dismissed the appeal.
Mayor of Maastricht
The data subject in question received official communication from the Mayor of Maastricht, indicating their placement on the "Top-X" list. This list is composed of individuals or groups identified as causing disturbances or engaging in criminal activities. Subsequently, the mayor denied the data subject’s request to be removed from this list. There were two main grounds for the refusal: firstly, the data subject was not actively cooperating with law enforcement agencies and continued causing a nuisance. Secondly, the individual was not partaking in the necessary mental health services that could potentially prevent future disturbances. As such, the Mayor deemed it appropriate to maintain the individual's listing as a precautionary measure to mitigate potential future disruptions. The Court assessed whether the Mayor's processing of personal data constituted a violation of the principle of legality, and whether the Mayor was obligated to delete the data subject's personal data. In its assessment of the potential principle of legality violation, the Court highlighted that data processing is one of the responsibilities of a Mayor for fulfilling a task in the public interest, as specified by Section 172 of the Municipalities Act. Therefore, the public interest exception to the lawful processing of data under Article 6 (1) (e) of the GDPR is fulfilled. The Court further reasoned that the safeguards, which ensure data processing does not exceed what is necessary, established under Articles 8 (1), 5 (4, 5), 6 (1), and 11 (1) of the Covenant ICOV, comply with the requirement of collection of data for specific, explicit and legitimate purposes in Article 5 (1) (b) GDPR. The Court held that the Mayor was not obligated to delete the data subject's personal data, based on the exception provided in Article 17 (3) (e), which allows a rejection of a data deletion request when the data is being processed for a task of public interest.
DSB (Austria)
The controller – CRIF – was a company that provided its client with information concerning the creditworthiness of third parties. The data subject asked the controller to provide them with a copy of their data undergoing processing. The controller replied by submitting a summary with the list of such personal data. In the context of a complaint before the Austrian DPA, the data subject lamented that this was not sufficient. However, the supervisory authority held that the controller did not violate the GDPR. The data subject appealed the DPA decision and the court referred the matter to the CJEU. The preliminary question concerned the scope of the right to a copy of data undergoing processing pursuant to Article 15(3) GDPR. According to the CJEU, the GDPR does not contain any definition of “copy”. However, this word, in its usual meaning, indicates a “faithful reproduction or transcription of an original” in opposition to a “purely general description” of data. The true question, however, was whether Article 15(3) GDPR covers “extracts from documents or even entire documents or extracts from databases”. The copy does not refer to the document as such but to the personal data undergoing processing, which must be complete. The Court stressed that the right to a copy – originally not provided by the data protection directive – aims to enable the data subject to protect their rights and interests under the GDPR. As the protection of data subjects’ rights is the rationale behind the right to a copy (and more in general behind the principle of transparency) a copy of data undergoing processing must reproduce data “fully and faithfully” in a manner that enables the data subject to exercise their rights. In conclusion, the right to a copy under Article 15(3) GDPR entails that data subject must be given a faithful and intelligible reproduction of all their personal data. This may include, to the extent that it is necessary to protect their rights and interests, copies of extracts from documents, entire documents or extracts from databases.
CNIL
On March 27, 2018 the Data Subject filed a complaint on CNIL againt Euronext group, specifically addressing the handling of her personal data by the Irish Stock Exchange, her employer, a subsidiary of Euronext. On March 28, 2022, the case was closed by CNIL because the Authority understood that the Irish Data Protection Authority is the one competente for addressing the issue, since the Data Subject employer, the Irish Stock Exchange, is a company located in Ireland. In addition, the Data subject and personal data processed was limited to this location. Dissatisfied with this outcome, the Data Subject sought annulment of the CNIL's decision for abuse of power and requested that the CNIL be instructed to sanction the companies involved. The Conseil d'État rejected the Data Subject's request, upholding the CNIL’s decision to close the complaint. The Court found that the CNIL correctly applied GDPR regulations, specifically Article 55 and Article 56, which dictate that in cross-border data processing situations, the Lead Supervisory Authority is generally that of the main establishment of the controller, unless the data processing is confined to a single member state and significantly affects individuals only in that state. In this case, the CNIL determined that the relevant data processing was indeed cross-border, handled by a central office in France, but the complaint was specific to the Data Subject employment in Ireland, making the Irish Data Protection Authority solely competent to address it.
UZ
An applicant (data subject) lodged an application for international protection with the Federal Office for Migration and Refugees in Germany (‘the Federal Office’). The Federal Office rejected the application, relying on the electronic ‘MARIS’ file which it had compiled, and of which contained the personal data relating to the applicant. The applicant bought an action against the Federal Office before the Administrative Court in Wiesbaden, Germany (Verwaltungsgericht Wiesbaden). The electronic ‘MARIS’ file was sent to court in the context of a joint procedure under Article 26 GDPR, via the Electronic Court and Administration Mailbox. However, the lawfulness of such transfer was questioned by the Court as the Federal Office was unable to evidence an arrangement of the respective responsibilities of the joint controllership, despite a request made to that effect by the Court. Furthermore, the Court expressed doubt that the maintenance of the electronic MARIS file with the combined provisions of Article 5(1) and Article 30 GDPR due to the Federal Office failing to produce a complete record of processing activities relating to that file upon request. The Court decided to stay the proceedings and refer the following questions to the CJEU: (1) whether the failure of a controller to comply with the accountability principle (Article 5(2)) amounts to ‘unlawful processing’ which would enable an individual to exercise their right to erasure or rectification under Article 17(1)(d) and 18(1)(b) GDPR. In particular, the controller in this case failed to maintain a record of processing activities (ROPA) pursuant to Article 30 GDPR and lacked an arrangement for joint procedure in accordance with Article 26 GDPR. (2) whether the fact that the data subject has given his or her express consent or objects to the use of his or her personal data in the context of judicial proceedings can affect the possibility of those data being taken into account. If that court were unable to consi
Court case 20 U 146/22
The data subject and the controller – an insurance company – litigated about the lawfulness of some premium adjustments in the data subject’s insurance policy. In this context, the data subject made an access request with the controller in order to obtain information on the basis of which the adjustments were triggered. The controller refused to comply with the data subject’s access request. The court of first instance aligned with the controller and declared the data subject’s action inadmissible. The Higher Regional Court of Hamm (Oberlandesgericht Hamm – OLG Hamm) upheld the court of first instance’s decision. The court did not exclude that in principle some of the information requested by the data subject were personal data within the meaning of Article 4(1) GDPR. Nevertheless, in this case the controller had the right to disregard the request in light of Article 12(5)(b) GDPR, as the latter was excessive. To ascertain whether an access request is excessive it is necessary, among others, to verify if the request pursues the goal of Article 15 GDPR, to be read in light of recital 63. In particular, an access request should enable a data subject to be aware of any processing operations concerning their personal data and check the lawfulness of said processing. In the present case, the data subject used instead the access request for a purpose which did not fall within the scope of data protection, namely to check whether premium adjustments were lawful under insurance law. The court stressed that this does not automatically entail that the data subject shall motivate their access request or distinguish between data protection purposes and other purposes. However, in cases where it is clear that the only purpose of the request is not related to data protection, the controller has a right to refuse to comply with the request. Finally, the court acknowledged that the issue could be the object of a preliminary reference to the CJEU. However, being the OLG Hamm not a court of last instance, such a preliminary reference is not mandatory pursuant to Article 267 TFEU. In light of the above, the court rejected the data subject’s claim.
Court case 332 O 243/21
The data subject and the controller – an insurance company – had a civil proceeding concerning the increase of the contributions the data subject was expected to pay to be insured with the controller. In particular, the data subject claimed that such increases were illegitimate. To prove this point, the data subject requested access to their personal data pursuant to Article 15 GDPR. The controller denied access. Therefore, the data subject requested the Regional Court of Hamburg (Landgericht Hamburg – LG Hamburg) to order the controller to provide access to the information at issue. The court adjudicated on the access request in the context of the broader civil proceeding pending between the parties. The court rejected the data subject’s claim. In particular, the court found that the controller could refuse to consider the data subject’s access request pursuant to Article 12(5)(b) GDPR. As a matter of fact, the request was ‘excessive’ and could be framed as a case of abuse of right. According to the court, the purpose of Article 15 GDPR is expressed by Recital 63 of the Regulation, which clearly states that an access request should enable a data subject to become aware of data processing involving their data and check the lawfulness of processing operations. In the present case, the data subject tried to Article 15 GDPR for a purpose that had nothing to do with data protection. The dispute between data subject and controller was in reality only an insurance law dispute.
Authoriteit Persoonsgegevens
On 17 May 2020, the data subject exercised their right of access (Article 15 GDPR) at the Dutch Tax Authority, de belastingdienst (controller). The controller refused to provide access to the relevant files, which lead the data subject to file a complaint with the Dutch DPA on 17 June 2020. On 25 March 2021, the DPA rejected the complaint of the data subject. The reason for the rejection was not specified in this decision. On 2 November 2021, the data subject appealed the decision. According to Dutch administrative law, the DPA itself had to assess this appeal (in Dutch: bezwaar). On 3 May 2022, the DPA requested the controller to provide information regarding the data subject to assess this appeal. The controller replied on the same day and provided details about ongoing financial procedures between the controller and the data subject. On 2 June 2022, the controller made a decision regarding the data subject's access request. It is not clear from this ruling if the controller provided access and if so, in what from. On 11 July 2022, the DPA agreed with the appeal of the data subject and warned the controller for not answering the access request within the time limit, in violation of Article 12(3) GDPR. The data subject, who was apparently not satisfied, appealed this decision to the District court of Den Haag (in Dutch: Beroep). On 18 October 2022, the data subject filed another complaint with the DPA against the controller because it provided information to the DPA on 3 May 2022. In his appeal, the data subject filed claims against both the DPA and the tax authority. Regarding his claim against the controller, the data subject stated that the controller never informed him about its decision of 2 June 2022 regarding the access request. The data subject claimed a compensation of €25,000. Regarding his claim against the DPA, he stated that the DPA did not properly execute its tasks under the GDPR. For this, the data subject requested €25,000 for imma
Court case 45717
A data subject found that an American company (controller) had collected personal data about him and was marketing it on its website. The data subject contacted the controller about this, who responded with an automated message asking him to fill in an identity verification form in order to process his request. On 8 July 2020, the data subject requested the Luxembourg DPA to order the controller to comply with his request. He believed that the controller had violated Article 15 GDPR for not handling his access request correctly and 27 GDPR for not having an establishment in the EU. The DPA asked the data subject to provide correspondence with the controller. In August 2020, the DPA informed the data subject that it would no longer deal with his request as the controller was US based and the DPA therefore had no power to impose measures under the GDPR. The data subject insisted that the controller offered services on the internet and that a simple search via a search engine would find his personal data on the controller's website. He also asked why the DPA felt it did not have the authority to investigate in the US. On 16 October 2020, the DPA replied by letter that it had contacted the controller but that without its response it was impossible to proceed. It also repeated that it had no means of action against a US based controller. The data subject, represented by noyb, appealed this decision of the DPA to the administrative Court (hereafter the Court) to have the DPA's letter reversed or annulled. He considered that he had a standing to act under Article 78 GDPR, especially since his data was still present on the controller's site. He argued he was therefore damaged by the DPA's decision not to pursue with his request. The data subject also argued that the DPA had violated Article 77 GDPR. Finally, he explained that the controller did not provide a copy of his access request, reason why he could not provide this document. First, the Court considered that the data subject only submitted the controller's automatic reply and not the rest of the correspondence, which prevented the Court from knowing the content of his request. Second, with regard to the handling of the complaint, the Court considered that the DPA requested additional information from the data subject and communicated with him by email. It also provided explanations for not pursuing its examination. It therefore de facto dealt with the complaint and did not violate Article 77 GDPR. The Court added that Article 57(f) GDPR does not impose on the DPA an obligation to open an investigation or use its enforcement powers as soon as a controller is the subject of a complaint. The Court therefore considered that the case had to be analysed under Article 78 GDPR. In this respect the court considered that the DPA letter informing the data subject that it would not initiate proceedings against the controller was not directly affecting the personal and financial situation of the data subject. Since the data subject did not provide enough documents to prove his request to the controller, his complaint with the DPA was limited to asking the DPA to request in his place information under Article 15 GDPR. According to the Court, the data subject retained his rights under Article 15 GDPR, thus, he did not suffer any damage from the refusal of the DPA. The Court added that under Article 79 GDPR, a prior referral to the competent supervisory authority is not a condition to obtain compensation for damages resulting from the violation of data protection. Third, regarding the violations by the controller, concerning Article 27 GDPR, the Court considered that the fact that the controller did not have an establishment in the EU did not constitute a violation of the data subjects right to data protection but could only constitute an obstacle to the exercise of his rights. As for Article 15 GDPR, the Court considered that the data subject did not prove that he was prevented from exercising his rights. The automatic response of the controller indeed included an email address he could have contacted. According to the Court, it implied that the data subject could not rely on a violation of Articles 15 and 27 GDPR which would be perpetuated by the refusal of the DPA to intervene. In conclusion, the Court held that the refusal of the DPA to intervene did not cause a violation of a personal right of the data subject. The action was therefore inadmissible for lack of standing.
Court case 16 U 10/22
The data subject was an entrepreneur managing a worldwide chain of hotels. Since 2012, the data subject went through a series of insolvency proceedings. After that, when their first name and surname were entered in a Google search, the autofill system completed the search key with the word “bankrupt”. The same word was used in some of the webpages whose URLs Google indexed under the data subject’s name. The data subject requested Google to delist some URLs linking them with the insolvency, arguing that the content of such pages did not match reality. Google refused to delist the URLs by arguing that there was a public interest in keeping that information available. Therefore, the data subject brought action against Google for violation of their right to erasure under Article 17(1)(d) GDPR. Alongside with delisting, the data subject asked for the deletion of the word “bankrupt” in Google’s autofill function. The court of first instance partially upheld the data subject’s claim and ordered Google to amend its autofill function. On the other hand, the court rejected all the other claims concerning URLs delisting. Both the data subject and the controller appealed the decision. The Supreme Regional Court of Frankfurt (Oberlandgericht Frankfurt am Main) rejected the data subject’s appeal. According to the court, the legal requirements set forth in Article 17 GDPR were not met, as the controller’s freedom of information prevailed on the data subject’s right to erasure. Facts described in the URLs listed by Google, despite not accurate from a strictly legal perspective, had do be understood as expression of a subjective opinion. According to the judges, the use of the word “bankrupt” does not trigger nuanced legal considerations in the mind of the average internet user. On the contrary, it expresses both a general situation in which a certain person cannot pay their debts – which was true in the present case – and a (negative) judgement that cannot be proved or disproved
Klarna Bank AB
On 28 March 2022, the Swedish DPA (IMY) fined Klarna AB (the controller) €730,000 (SEK 7,300,000) for not providing data subjects with adequate information related to their processing activities. IMY found that the controller violated the GDPR in the following respects: * It did not provide information about the purpose and the legal basis for data processing relating to the service "My economy", * It provided incomplete and misleading information about the recipients of different categories of personal data when they were shared with Swedish and foreign credit reference agencies. * It did not provide information about which countries outside the EU/EEA personal data was transferred to, and where and how data subjects can access or obtain documents regarding safeguards that applied to the applicable transfer. * It provided incomplete information about retention periods and the criteria to determine these periods. * It provided inadequate information about the data subjects' rights which did not comply with the principle of transparency, in particular the rights to request from the controller the erasure of personal data under Article 17 GDPR, to restrict processing of personal data Article 18 GDPR, to data portability under Article 20 GDPR and to object to the processing under Article 21 GDPR * Its privacy policy lacked meaningful information about the logic, significance and foreseen consequences of automated decision-making, including profiling, under Article 22(1) GDPR. The controller appealed the decision to the administrative court, challenging the basis of IMY's decision. It claimed, in particular, that IMY relied heavily on non-binding guidelines. The controller argued that both Swedish and European administrative law fundamentally require that an intervention (especially fines) against an individual may only take place if there is clear support in binding statute. Despite this, the controller claimed that it has been fined too heavily for violating non-binding guidelines. The controller also argued that the fined should be reduced as a result of IMY's failure to adequately process the case, which weakened the controller's ability to defend itself. It claimed that it took IMY approximately three years to process the case, with two years of inactivity.
Minister van Financiën
On 20 April 2020, the data subject exercised his right of access and information under Article 15 GDPR by sending a request to the Minister of Finance. He was asking more specifically whether his data were processed in the fraud alert system "Fraude Signalering Voorziening" (FSV) and/or other undisclosed databases. In the affirmative, he requested a copy of such data. The Minister stated in his answer that no personal data could be found in the FVS. The data subject considered this answer insufficient and asked the Minister to reconsider its position. He claimed that the Minister could not limit the data search to FVS alone, but also had to consult all other systems in response to his request. He didn't refer to specific system, arguing that he could not be aware about their names or even existence, some of which possibly being secret or undisclosed to the public. In this respect, he refered to a report by KPMG mentioning a possible existence of non identified systems used by the tax authorities. In addition, the data subject claimed that the Minister did not provide sufficient information regarding the search method used. The Minister refused to give further information. As a consequence, the data subject lodged an action with the District Court of Amsterdam, which declared the appeal unfounded. He therefore appealed before the Council of State against the decision of the District Court of Amsterdam The Council stated that the report of KMPG, which mentions possible systems that have not been identified, does not imply that it is plausible that there are other systems whose existence is kept secret by the tax authorities and the Ministry. Next, the Council of State confirmed that in his answer to the request of access and information the Minister has provided sufficient insight into how he searched for personal data and indicated that other search methods would have led to a similar result. For the above reasons, the Council of State declared the appeal unfounded and upheld the contested decision.
Court case 22PA01320
The data subject was admitted urgently to the hospital after an anxiety crisis. On arrival, she was treated by a psychiatrist who wrote a report. This report mentioned elements of the personal and family life of the data subject. Some months later, she was admitted urgently to another hospital. A doctor also wrote a report in which personal details were mentioned, including data about her sexual and professional life. The data subject considered that the processing was unlawful since she had not given her consent to the collection. She also considered that the collection of her data was not necessary for the performance of the hospital's care mission and that she had not been informed of her right to rectification. She nevertheless exercised her right to rectification by letter without result. The data subject therefore brought an action before the Administrative Tribunal of Paris to obtain damages for moral prejudice resulting from an infringement of her privacy. The court rejected her claim and she appealed to the Administrative Court of Appeal (Cour administrative d'appel de Paris). The arguments of the hospitals are not explained in the decision. The Court explained that according to national law, hospitals must draw up a medical file for each hospitalised patient. This file must include among other things the information received from the patient and the reasons for hospitalisation. According to the Court, the information received in this case by the two hospitals allowed the psychological state of the data subject to be assessed and medical decisions to be taken. This data could therefore be entered in the data subject's medical file and processed in accordance with Articles 6(1)(e) and 9(2)(h) GDPR. The processing therefore had a legal basis and did not have to be based on consent. The Court added that under Article 17(3)(c) GDPR, the hospitals could decide not to erase the data in question. Indeed, the data was useful in order to assess the data subjec