GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Court case 3 O 17493/20
The data subject is a private person who visited the website of the controller. The controller used Google Fonts in a way that the dynamic IP address of the data subject was automatically transferred to Google's server in the USA. Google Fonts is a library which includes over 1300 different fonts and can be embedded in a website by its operator. The Regional Court of Munich (Landgericht München - LG München) held that the transfer to Google via Google Fonts violated the GDPR and, therefore, the data subject's right to constitutional right to informational self-determination. As a consequence, it granted injunctive relief according to § 823(1) BGB in conjunction with § 1004 BGB (analogously) and awarded damages in the amount of €100. At first, the LG München determined that injunctive relief requires a violation of rights and a risk that this violation may occur in the future again (risk of repetition). The court found the transfer of the IP address to Google without the consent of the data subject (Article 6(1)(a) GDPR) is an infringement of the data subject's constitutional right to informational self-determination. It came to the conclusion that a dynamic IP address is to be considered as personal data (Article 4(1) GDPR), as the controller has an abstract opportunity to determine the data subject. It also held that the processing is not justified under Article 6(1)(f) GDPR since Google Fonts could be used without having a connection to Google's servers. It rejected the arguments of the controller that the data subject should have masked their IP address, because this would run contrary to the objective of data protection law to protect data subjects by imposing obligations on the entities which are processing data, and not make data subjects responsible for their own protection. The court further affirmed that the risk of repetition is factually presumed, when a violation of rights has been established. It found that this presumption was not rebutted by t
Der Hessische Landesbeauftragte für den Datenschutz und die Informationsfreiheit
The data subject is a lawyer that is employed by the company A. In August 2018, he suffered a severe stroke due to which he has continuously been on sick leave since then. In a labour court case against his employer in 2019, the employer hired a lawyer who disclosed information about the data subject's health during the proceedings. The data subject classified this as a violation of the GDPR because it was a special category of personal data (Article 9(1) GDPR) that should not have been processed. The data subject requested the Hessian data protection authority to intervene against the alleged data protection violations. The data protection authority refused to take action. The Administrative Court of Wiesbaden dismissed the data subject's claim. It held that, in the context of a labour court dispute, both the employer and the lawyer instructed by it are entitled to name and explain any health data of the employee. This applies all the more if the employee is the plaintiff and has brought the relevant circumstances into the proceedings himself. First, it clarified that the lawfulness of the data processing of health data in legal proceedings is assessed according to Article 6(1)(f) GDPR and Article 9 GDPR. Second, lawyers are data controllers within the meaning of Article 4(7) GDPR with regard to their presentation in court proceedings. As independent organs of the administration of justice in their capacity as advisors and representatives, they themselves bear the responsibility for the content of the pleadings in terms of liability and design. Third, according to the court, in their pleadings, attorneys pursue the legitimate interest of fulfilling their contractual obligation with the client (cf. § 3(3) Federal Lawyer's Act [Bundesrechtsanwaltsordnung - BRAO]). The activity of a lawyer would be impossible if he were not basically allowed to present what the client informs him of. They would even expose themselves to the risk of attorney liability if, contrary
German Federal Office for Migration and Refugees (FOMR) - Bundesamt für Migartion und Flüchtlinge (BAMF)
In 2016, the data subject entered Germany and applied for asylum. The asylum application was made on grounds that the data subject had converted from the Muslim to the Christian faith and feared being arrested for reasons of faith in the home country. In the application, the data subject credibly demonstrated that, due to the conversion, he would face state persecution if returned to the home country and refugee status was subsequently granted. In 2021, the German Federal Office for Migration and Refugees (FOMR) reassessed the data subject's refugee status. In a request for information with a deadline subject to a €500 fine, the FOMR asked the data subject to explain, how his interest in the Christian religion had been developing since refugee status was granted or whether the data subject had tried to convince other people of the Christian faith. In addition, the data subject was asked to provide evidence of a conversion to Christianity and of any involvement in a church congregation. The data subject filed a suit against this course of action. The Administrative Court had to decide, inter alia, whether the FOMR’s request for participation was incompatible with Article 9 GDPR. The administrative court decided that the request for information was compatible with GDPR requirements under EU law. The court did not find a breach of the processing of special categories of personal data under Article 9 GDPR. Article 9(1) GDPR prohibits the processing of special categories of personal data, such as religious or philosophical beliefs, unless the processing is, inter alia, necessary under Article 9(2)(g) GDPR for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The court held that under § 73(1) German Asylum Act (AsylG),
1. unknown data subject (co-participant and complainant in the procedure before the DSB)
The data subject alleged a violation of Article 5 GDPR by the complainant and brought his complaint to the Data Protection Authority (Datenschutzbehörde - DSB). They claimed that the president of the complainant had discussed his person in confidential telephone calls with various offices. According to him, the information discussed was suitable to portray him negatively. The complainant argued that the oral discussion at a general meeting was not subject to the material scope of Article 2 GDPR. Furthermore, it argued, that even in case of the application of the GDPR, Article 5 hat not been violated. The DSB decided in favour of the data subject. The court did not decide on the subject matter. Instead, it repealed the contested decision and referred it back to the DSB in accordance with § 28(3) VwGVG. It concluded that the reasoning of the DSB's decision had been too superficial. According to the court, the decision showed a lack of investigation since the DSB had not even presented what type of personal data had been processed.
Holland Car Company B.V.
The controller is Holland Car Company, a company which deals in exclusive cars. It fired one of their employees (data subject) for urgent reasons. It had recorded a telephone call of the data subject with a client. In this call, the data subject discussed selling one of their own cars to the client, which their employment contract does not allow. The data subject had no knowledge of their calls being (potentially) recorded, nor did the client. The data subject felt that this was a breach of their privacy because it had not consented to the recording of their calls. The controller, however, stated that this recording was allowed as it suspected the data subject of breaking its employment contract and using the Company contacts to plan its own business. On top of that, it had informed their employees that calls could possibly be recorded. The data subject brought the action before court. First, the District Court considered that the controller could only record the employees conversations if it had a legitimate interest pursuant to and if this is necessary and proportional. Hence, it appeared the Court referred to Article 6(1)(f) GDPR. Moreover, it must also be clear, for both the employee and the client, that the conversation is recorded (including start and end moment), as well as the reason for the recording, retention period and that the recording is adequately secured. Moreover, the Court noted that secret recordings can only be done in exceptional circumstances, such as the suspicion of criminal facts or abuses within the organisation. If there are no such circumstances, the controller must obtain consent for these recordings. Hence, it appears the Court referred to Article 6(1)(a) GDPR. The Court stipulated that the fact that employees were informed that calls could be recorded, does not constitute as consent. After considering the controller's arguments, the Court assessed that the controller's arguments did not justify the exceptional circumstances, and
Court case 440376
DataJust is an AI-based technology aiming at evaluating compensation harmonisation in the judicial system as well as establishing indicative references for compensation. It thus collects several type of information on case-law regarding compensation between January 1st 2017 and 31st December 2019. Data collected and processed includes name of individuals, except the parties, identifying elements, information on damages, and personal information on professional and financial situation. Right to opposition does not apply as stated in Article 6 of the decree. In order to set up the system, the government adopted a decree on March 27 2020 laying out DataJust functioning. Several complainants, including NGOs, challenged the legality of DataJust on several grounds including lawfulness of processing, unauthorized use of sensitive data, violation of the data minimisation principle as well as inadmissible restriction of data subjects' rights. The CE approved DataJust decree on several grounds. First, the decree explains explicitly the legitimate interest to process the data as required in Article 4 of the loi du 6 janvier 1978. Ends of the data processing are fully vindicated and legitimate as it is only on a short period of time (2 years), it has an all-encompassing approach (both amicably and judicial dispute resolutions are taken into account) and it facilitates access to case-law. Complainants also put forward that DataJust was using data collected for other purposes which would be incompatible with Article 5(1)(b) GDPR and Article 6(4) GDPR. The CE dismissed that claimed by recalling that both DataJust and first data collection involve dispute settlement purposes. Second, for what concerns the use of health data and other very sensitive data, the CE pointed out that the processing is based on Article 9(2)(g) GDPR and Article 6 of the loi du 6 janvier 1978 and that there was a substantial public interest in simplifying access to jurisprudence through an algorithm. T
Consumentenbond
On 26 November 2018, the Consumentenbond (a Dutch non-profit organisation which promotes consumer protection), on behalf of consumer [A], filed [https://www.consumentenbond.nl/nieuws/2018/gezamenlijke-actie-europese-consumentenorganisaties-tegen-google a complaint with the Dutch DPA], the Autoriteit Persoonsgegevens (AP), against Google LLC. The complaint was part of a joint action with other European consumer organisations, such as the umbrella organisation BEUC and the Norwegian, Swedish and Czech consumer associations. The complaint concerned the unlawful tracking of the consumer’s location by the consumer’s Samsung galaxy A3 smartphone, which runs the operating system Android (by Google). According to the complaint, crucial information was hidden and users were guided by dark patterns to consent to share their location, in violation of Article 5 GDPR, Article 6 GDPR, Article 7 GDPR, Article 13 GDPR, and Article 25 GDPR. The DPA, however, claimed that the Irish DPA (the DPC), is the leading supervisory authority pursuant to Article 56(1) GDPR, because the complaint concerns cross-border processing and Google’s European headquarters is located in Ireland. On 5 June 2019 and 2 September 2019, the DPA notified the Consumentenbond and the consumer that the Irish DPA was investigating the complaint and further information would follow. On 26 November 2019, the Consumentenbond and consumer served the DPA with a notice of default for failing to make a timely decision, but the DPA replied on 2 December 2019 that the notice was premature since they had until 2 December 2019 to reply. Moreover, they informed the Consumentenbond and consumer that Google had made changes related to the complaint and additional evidence in relation to the consumer had to be filed before 6 January 2020. The DPA kept informing the Consumentenbond and consumer every three months, on 27 Febryary 2020 and 27 May 2020, of the “progress” by the DPC, stating that an update would follow in three months. Finally, on 30 November 2020, two years after the complaint was filed, [https://www.consumentenbond.nl/nieuws/2020/consumentenbond-naar-rechter-om-google-zaak the Consumentenbond brought the case before Court] because the DPA had still not taken a decision. The Court discussed two matters: (1) whether the Consumentenbond can be regarded as a stakeholder within the meaning of Article 1:2, third paragraph, of the General Administrative Law Act (Awb), and (2) whether the decision by the DPA failed to decide in due time on the enforcement request. The Consumentenbond claimed it is a stakeholder. The DPA, however, claimed this is not the case because “the statutory objectives of the claimant are too general to be able to also protect the interest of the protection of personal data or privacy of third parties in an administrative law procedure.” The Court, however, found that the statutory objectives are not too general, and that the Consumentenbond has shown with their activities to focus on the prevention of abuses in the area of consumer privacy. According to the Court, these privacy interests are so intertwined with the general interest of the Consumentenbond, that this interest is included in the statutory objectives. Hence, the Court concluded that the Consumentenbond is a stakeholder. The Court further examined whether the DPA failed to decide the matter in a timely manner. In this respect, the Dutch DPA considered that, since the Irish DPA is now the leading supervisory authority and is investigating the complaint, it (the Dutch DPA) can no longer investigate the complaint on their own behalf. Moreover, the Court referred to the reasoning of the Court of Midden-Nederland in its judgement of 15 October 2020, regarding the question within which term the DPA must decide on the request for enforcement. The Court found that the decisive factor was that “the complaint has become part of a large and complex investigation into the cross-border processing of personal data”, and the (Dutch) DPA can therefore not determine “the scope and path of the investigation”, or set a date for the decision. Moreover, because the DPA informed the Consumentenbond every three months, it fulfilled its obligations. Hence, the Court concluded that the DPA has not failed to decide in due time on the enforcement request.
DSB (Austria)
The data subjects and the controller are neighbours. The controller has its business located at the beginning of the street section whereas the data subjects’ business is at the end of the section which is a dead end. They are entrenched in a neighbourly dispute for years. The controller installed two self-triggering cameras on its premises pointing towards the data subjects’ business and capturing the street. The camera took pictures of the data subjects without their consent. The reasons given by the controller for installing the cameras were as follows: * constant loitering of one of the data subjects around the premises of the controller * taking pictures of the premises * numerous (about 300) complaints to the trade authorities concerning the business of the controller * throwing of rubbish bags over the fence (which the court did not see as proven) The court confirmed its view that special national provisions on video surveillance and image processing are inapplicable since the GDPR lacks an opening clause for them (cmp. BVwG W211 2210458-1/10 https://gdprhub.eu/index.php?title=BVwG_-_W211_2210458-1/10). The court held that the surveillance is not justified under Article 6(1)(f) GDPR. To the court it was not clear how image recordings could deter people from filing unjustified reports because people are in principle free to be in public traffic areas, even if it amounts to loitering, and free to file reports with the authorities on the basis of observations made in public traffic areas. Furthermore, the court reasoned that installing cameras could also not be an effective and therefore not an appropriate measure against the taking of photos by means of personally-held cameras, because they could in no way prevent such behavior. Furthermore, the court mentioned that even if “the throwing of rubbish bags over the fence” were proven, the processing would not have been justified under Article 6(1)(f) GDPR since the captured space is exceeding the general recomme
Court case 1 B 72/21
The data subjects notified the competent local authority (controller) about three public assemblies they were organising on the 4th, 11th and 18th of December 2021 to protest against the COVID-19 policies. On December 14th a press representative sent an email to the authority asking for the names of the data subjects. The authority, however, refused to provide the information on the grounds of the data subject's right to privacy. As a consequence, the press representative filed for interim relief in court on the same day to learn the names and full addresses of the data subjects. The Administrative Court of Osnabrück (Verwaltungsgericht Osnabrück - VG Osnabrück) granted interim relief regarding the names and the residential areas, which the data subjects live in, but not regarding their full addresses. The court held that the plaintiff has a right to information according to [https://www.nds-voris.de/jportal/?quelle=jlink&query=PresseG+ND+%C2%A7+4&psml=bsvorisprod.psml&max=true § 4 NPresseG] (Press Law of the state of Lower Saxony) and that the GDPR does not preclude this right. § 4(1) NPresseG obliges authorities to provide representatives of the press with the information which they need to fulfill their task. § 4(2)(no. 3) NPresseG lays down that access can be denied by the authority if it would infringe a private interest which deserves protection. The court concluded that the interest of the public to information outweighs the interest of the data subjects to privacy, including the their right to informational self-determination, because the topic of COVID-19 is of paramount public interest right now and the data subjects have placed themselves in the public eye by organising the assemblies. The court further reasoned that the GDPR does not preclude the plaintiff's right to information because § 4 NPresseG is to be seen as a legal basis for the processing under Article 6(3),(1)(c) or (e) GDPR and because the GDPR and the processing for journalistic purposes
Court case 4 U 1278/21
In this case, the first controller is a collection agency which obtained an enforcement order from a court against a person with the same name as the data subject. During the enforcement procedure the debtor could not be found at the address which was originally stored with this first controller. As a result, the first controller asked a second controller to find out where the debtor lived. After its research, the second controller gave the first controller the personal information belonging to the data subject, thinking it was the actual debtor's data. This information included the data subject's name, date of birth and address. It turned out that the data subject and the debtor were father and son, and had the same first name and surname. The data subject (the father) requested and erasure of his data to both controllers since he was not the actual debtor they were searching for. He also requested injunctive relief to stop the controllers from processing his data in the future. Furthermore, he filed a complaint with Regional Court of Hannover (Landgericht Hannover - LG Hannover) claiming damages in the amount of €10,000 for potentially being registered as a debtor in Schufa's database, which is Germany's biggest credit agency. The controllers argued that they were allowed to process the data and obliged to retain it according to German tax law. Furthermore, they stated that the storage of the data was justified in order to avoid future confusions, which was not only in their own interest, but in the data subject's interest as well. Additionally, one of the controllers noted that the data subject was sufficiently protected from being held liable for his son's debt, since the data is marked as invalid in their database. The LG Hannover rejected the data subject's claim, who in turn appealed this decision with the Higher Regional Court of Dresden (Oberlandesgericht Dresden - OLG Dresden). The OLG Dresden overturned this decision, and ordered the deletion of the d
Coolblue B.V.
Controller is Coolblue B.V., a company that sells (electronic) products. Data subject was employed at Coolblue between 8 August 2017 and 7 August 2020. During that time, with data the subject’s permission, Coolblue took photographs of the data subject in the context of promotion/marketing. Pictures of data subject were seen on approximately hundred Coolblue-vans, and they also featured in a promotional video on Coolbue’s YouTube channel. After the termination of the contract, data subject, among other things, claimed that Coolbue should (again) have requested data subject’s consent for the use of the promotional material, since it contained their personal data. According to the data subject, Coolblue had no legal basis to process their personal data, since data subject revoked their consent on the 20th of November 2020, pursuant to Article 7(3) GDPR. The Rotterdam Court of First Instance rejected data subject’s claim that Coolblue had no legal basis to process their personal data. First, it considered that the use of data subject’s pictures and video’s falls within the material scope of the GDPR, since personal data is being processed. It noted that data subject revoked their consent pursuant to Article 7(3) GDPR, and Coolblue could therefore not rely on Article 6(1)(a) GDPR as a legal basis for the processing of data subject’s personal data. However, the Court stated that, although Coolblue could not rely on the data subject’s consent, it could rely on Article 6(1)(f) GDPR, if their legitimate interest to process the personal data override the data subject’s fundamental rights and freedoms do not override the legitimate interest of Coolbue. In that regard, the Court noted that Coolblue had a commercial interest, that this interest is legitimate, and that the costs for Coolblue would be unreasonably high, and the impact on their business enormous, if the photograph of data subject could no longer be used. Moreover, Coolblue also accommodated data subject’s inte
Legelisten.no AS
In 2012, a company "Legelisten.no AS" launched a website where people could submit anonymous reviews of healthcare personnel. From the same year, the Norwegian DPA Datatilsynet received multiple complaints from affected individuals. In one case in 2015, the DPA held that Legelisten did not have a legal basis for processing personal data related to the website reviews and, further, that Legelisten had to offer an opt-out arrangement for healthcare personnel not wanting their personal data published on the website. The decision was appealed to the Norwegian Privacy Appeals Board, who overturned parts of the DPA's decision, importantly relating to the (lack of) legal basis and the opt-out arrangement. Following this, the Norwegian Medical Association brought an action to the Norwegian courts, claiming that the website had no legal basis as per Article 6(1)(f) GDPR for registering and publishing subjective user reviews of healthcare personnel. After a balancing of the legitimate interests safeguarded by the website operator Legelisten against the interests of the healthcare personnel, the Supreme Court agreed with the Privacy Appeal Board's decision and found that Legelisten had a legal basis for the processing as per Article 6(1)(f) GDPR. The Court emphasised that Legelisten.no is an important source for the general public to acquire information about healthcare providers. The measures taken to limit privacy concerns also satisfied what could reasonably be expected. Thus, the DPA's initial decision was overturned and the appeal appeal against the Privacy Appeals Board's decision was rejected.
DSB (Austria)
The two data subjects of this case are minors. They are visiting a private kindergarten. The private kindergarten gave – with the consent of the legal guardians of the data subjects – a list to the municipality of its seat (the controller) which consisted of the name, date of birth and date of admission of all kids attending the kindergarten. Because the municipality did not want to bear the costs for children having their residence in another municipality, it sent a letter to all parents requesting them to take the letter to the municipality of their residence and ask for their financial support. This letter consisted of the already mentioned list as well as another list which additionally contained the days of absence, overall days and the calculated share of costs of each child. The controller did not ask the legal guardians of the data subjects for their consent before sending the letter out to all parents. The data subjects – represented by their legal guardians – filed a complaint with the DPA. The DPA sustained the complaint. The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision of the DSB. The court concluded that the head of the kindergarten was a third party according to Article 4(10) GDPR with respect to the sending of the letters. The consent given to the head of the kindergarten did not extend to the municipality and did not encompass the disclosure of the data to the other legal guardians.
Deutsche Wohnen SE
On 30 October 2019, the Berlin Data Protection Authority (DPA) fined Deutsche Wohnen SE 14,500,000 € for violating Article 5(1)(e) and Article 25(1) of the GDPR, as the company's archive system was structurally unable to delete unnecessary data. Deutsche Wohnen, a publicly listed real estate enterprise managing around 163,000 housing units and 3,000 commercial units through its subsidiaries, processed tenants' personal data, including proof of identity, health and social insurance information, tax data, and details of previous tenancies. The DPA, on its own initiative, conducted an inspection and found that the controller's subsidiaries were storing tenants' personal data without ensuring the ability to delete data that was no longer necessary. The DPA initially ordered Deutsche Wohnen to delete the data by the end of 2017, but the company claimed deletion was impossible due to technical and legal reasons. It argued that the old data would need to be migrated to a compliant system that met statutory retention requirements. Despite an ongoing exchange between the company and the DPA, a follow-up inspection in 2020 revealed no substantial progress in rectifying the GDPR violations. The DPA then issued a penalty order, citing that, from 25 May 2018 to 5 March 2019, Deutsche Wohnen had deliberately failed to take measures to enable the deletion of unnecessary data. The authority also imposed further fines for the continued storage of personal data relating to at least 15 tenants. Deutsche Wohnen appealed the decision, and on 18 February 2021, the Regional Court of Berlin overturned the DPA’s decision, arguing that under German law (specifically Paragraph 30 of the Law on Administrative Offences, OWiG), only natural persons could be subject to administrative fines, not legal entities. The Court held that while the actions of representatives could be attributed to the legal entity, there was no evidence of individual responsibility among Deutsche Wohnen’s representatives. Thus, the company could not be fined. The Berlin Public Prosecutor’s Office appealed this decision. The Kammergericht Berlin, the referring court, is now called upon to rule at final instance. The KG Berlin decided to suspend proceedings and referred the following preliminary questions to the CJEU: (1) Is Article 83(4) to Article 83(6) GDPR of the GDPR to be interpreted as incorporating into national law the functional concept of undertaking and the functionary principle associated with Articles 101 and 102 TFEU, with the consequence that, by extending the principle of legal entity on which Paragraph 30 of the OWiG is based, a fine procedure may be conducted directly against an undertaking and the penalty is not imposed on the determination of a person identified by a natural and identified person: if applicable, a fully tort, committed administrative offence is required? (2) If the answer to Question (1) is in the affirmative, must Article 83(4) and Article 83(6) GDPR be interpreted as meaning that the undertaking must have culpably committed the infringement mediated by an employee (see Article 23 of Council Regulation (EC) No 1/2003 of 16 December 2002 implementing the rules on competition laid down in Articles 81 and 82 of the Treaty), or is an objective breach of duty attributable to the company ("strict liability") already sufficient in principle for a fine of the company?
Vienna police officers
In their complaint to the DSB (Austria) the data subjects, both police officers, together with other colleagues, alleged a violation of the right to secrecy. The complainants carried out an identity check. In its course they had been filmed with several smartphones by the persons checked (controllers). The first complainant had repeatedly informed the controllers that it was a criminal offense to publish the video material. However, this was ignored and the material was published on social media (Facebook and Instagram) without making the data subjects unidentifiable. The controllers wanted to draw attention to ethnic profiling or accuse the complainants of such a procedure, as they felt discriminated by the identification, which in their opinion was only based on the colour of their skin. In the videos the controllers did not only make remarks to the effect that the identification of the complainants was done on racist grounds, but also used insulting words towards the complainants. The complaint was partially upheld by the DSB and it was found that the respondent had violated the second complainant's right to secrecy by publishing a picture of the complainant’s on his Instagram profile and thereby violated the complainant's right to secrecy by at least publishing a picture of the first complainant on his Instagram profile. For the rest, the complaint was dismissed. The Federal Administrative Court (Bundesverwatungsgericht – BVwG) stated that the image recordings were in any case personal data of the complainants pursuant to Article 4(1)GDPR, as the identification of the data subjects was possible. Through the publication, the respondents had also processed the personal data of the complainants within the meaning of Article 4(2) GDPR and, as the operators of their Instagram and Facebook profiles, were also to be qualified as data controllers under data protection law pursuant to Article 4(7) GDPR for their respective profiles. Furthermore, the posting of the
German Football Association (Deutscher Fußball Bund, DFB)
The German Football Association (DFB) (controller) has issued a regulation for player agents. Player agents are consultants for professional footballers, e.g. for the arrangement of club transfers. The player agent regulation contains a provision according to which players or football clubs are obliged to disclose details of the remuneration of player agent services to the DFB or similar bodies. A director of a player agency (data subject) claimed injunctive relief against this disclosure requirement under [https://www.gesetze-im-internet.de/bgb/__1004.html §§ 1004,] [https://www.gesetze-im-internet.de/bgb/__823.html 823 German Civil Code] (BGB) in conjunction with Article 6(1)(f) GDPR. In their opinion, the disclosure requirement violates Article 6 GDPR. The Higher Regional Court of Frankfurt am Main (OLG Frankfurt) balanced the interests of the parties pursuant to Article 6(1)(f) GDPR. It found that, within the framework of the balancing of interests of Article 6(1)(f) GDPR, the data subject's interests lie in the confidentiality of the requested data. On the side of the controller, who issues the regulations, the legitimate interest of transparency and traceability of arrangements of player transfers is pursued in order to exclude that sports operations are not dominated by unjustified financial interests of third parties. The OLG Frankfurt concluded that the interests of the defendant prevail.
Court case 4 U 1158/21
The data subject applied for membership in an association. On instruction of the association’s managing director, a background search was carried out on the data subject. The investigation revealed information on previous criminal convictions of the data subject. The association's executive board was informed of these findings and the association subsequently refused the membership application. The data subject considered that the controller violated Article 10 GDPR since the personal data regarding their criminal convictions was not processed under official supervision. Hence, they requested payment of damages for pain and suffering totalling €21,000. The Regional Court of Dresden confirmed this violation but only awarded damages in the amount of €5,000. The Higher Regional Court of Dresden had to decide whether the amount of damages for pain and suffering was appropriate. The Court upheld the decision of the trial court on the unlawfulness of the processing of personal data. Because the controller could have asked the data subject to provide self-disclosure or a police clearance certificate, there was a less intrusive alternative of data processing. Hence, the processing was not necessary and the controller could not rely on Article 6(1)(f) GDPR. Moreover, the Court confirmed that, in addition to the company, its managing directors are also to be regarded as "controllers" within the meaning of Article 4(7) GDPR. On the award of damages, the Court pointed out that, under Article 82 GDPR, any assessment of harm must include the nature, gravity, duration of the breach, degree of fault, measures taken to mitigate the harm caused, previous breaches and the categories of personal data concerned. According to Recital 146, the concept of harm is to be interpreted in the light of the ECJ’s case law "in a manner fully consistent with the objectives of this Regulation". The Court stipulated that the principle of effectiveness does not exclude exemplary damages, and that
CJEU case C-687/21 Saturn Electro
The case concerns a customer of Saturn whose appliance and purchase documents, while in the shop, were mistakenly given to another customer. The first customer seeks compensation for this error. The District Court of Hagen referred the following questions to the CJEU for a preliminary ruling: 1. As no automatic legal effects are specified, is the compensation rule enacted in Article 82 GDPR invalid in the case of non-material damage? 2. Is it necessary, for the purposes of the right to compensation, to establish the occurrence of non-material damage, to be demonstrated by the claimant, in addition to the unauthorised disclosure of the protected data to an unauthorised third party? 3. Does the accidental disclosure of the personal data of the data subject (name, address, occupation, income, employer) to a third party in a paper document (printout), as the result of a mistake by employees of the processing undertaking, suffice in order to establish infringement of the GDPR? 4. Where the undertaking accidentally discloses, through its employees, data entered in an automated data processing system to an unauthorised third party in the form of a printout, does that accidental disclosure to a third party qualify as unlawful further processing (Article 2(1), Article 5(1)(f), Article 6(1) and Article 24 GDPR)? 5. Is non-material damage within the meaning of Article 82 GDPR incurred even where the third party who received the document containing the personal data did not read the data before returning the document containing the information, or does the discomfort of the person whose personal data were unlawfully disclosed suffice for the purpose of establishing non-material damage within the meaning of Article 82 GDPR, given that every unauthorised disclosure of personal data entails the risk, which cannot be eliminated, that the data might nevertheless have been passed on to any number of people or even misused? 6. Where accidental disclosure to third parties is preventabl
Personal Data Authority
This matter concerns an appeal to the Administrative Jurisdiction Division of the Council of State in which the data subject stated that his right to privacy was violated by the fact that he could only purchase a bus ticket by card (as opposed to cash payment). He previously raised a request to the AP (the DPA) to take action against Connexxion Openbaar Vervoer N.V. for the decision to abolish cash payments, through application of the GDPR. This request was denied and underlies the current appeal. On appeal, the data subject argued that “the court erred in finding that the processing of personal data is necessary for the performance of a contract” in that: 1. The data subject did not enter into an agreement with Connexxion “of his own free will” and that consent for the processing of his personal data was not given freely and unambiguously as Connexxion has a monopoly on which public transport users depend. He argued that the General Conditions for City and Regional Transport 2015 are insufficient to serve as a legal basis within the meaning of Article 6(1)(b) GDPR. 2. The purpose of the data processing is not well-defined, explicit and justified. 3. The effect on safety of banning cash payments is not clear as this measure is one of a group consisting of 23 measures. In establishing which data is being processed, the Court took note of the fact that Connexxion uses a Payment Service Provider (PSP) to process its financial transactions and applies the PAN Masking technique to secure these transactions. This technique only provides the last four digits of the bank account number to be stored at Connexxion while the preceding digits are anonymized. The Court further noted that a contract is established when the passenger boards the bus and the mere fact that the passenger has no choice as to whom he concludes this contract with does not negate the existence of said contract. It went on to consider whether there is an agreement in place and held that “there is no ev
Autoriteit Persoonsgegevens
The data subject owns an apartment in an apartment complex. The Association of (home) Owners (hereafter: VvE), of which the data subject is a member, decided to replace the old surveillance cameras with new ones. According to the data subject, the new surveillance system led to an invasion of her privacy. She also stated that the new cameras could process biometrical data (which is sensitive data, Article 9(1) GDPR). The VvE argued that the purpose of the camera surveillance is to protect the property of the common parts as well as the flats. They added that incidents of burglary and damage had occurred in the past, and that these new cameras are an appropriate security measure. Then, the VvE stated that this measure is not disproportionate since the cameras do not show the public road and do not process more data than is necessary. Moreover, the VvE claimed that protecting the property of the VvE and its residents cannot be achieved in any other way. Lastly, the VvE argued that their legitimate interest (Article 6(1)(f) GDPR) outweighed the data subject's interest of privacy since data subject is only filmed when she is in common areas, the VvE has built in sufficient safeguards (technical and organisational), and people passing by are notified of the surveillance via a sign. The data subject filed a complaint with the AP (Dutch DPA) and, after the DPA rejected the complaint, brought the action before court. First, the Court considered whether the measure was necessary by assessing the proportionality and subsidiarity of the measure. It held that the requirement of proportionality was met since the cameras do not allow the processing of biometrical data, and clear images of filmed people are justified by the fact that, in cases of damage, it needs to be clear against whom the charges are to be made. The requirement of subsidiarity was also met since the objective of the surveillance could be achieved in a less intrusive manner. Second, the Court conducted