GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
ING Bank
The Court of Milan rejected a claim brought by the data subject against the controller, ING Bank, relating to the non-compliance with an access request made on the basis of Article 15 GDPR. The Court accepted the arguments of the controller, who denied having processed the data subject's data, and stated that they failed to prove that the bank was the controller in relation to the processing of their data. On this basis, it rejected the claim. The data subject challenged the decision with appeal to cassation, arguing that there was a wrong application of Articles 12 and 15 GDPR. The DPA highlighted that Article 12 GDPR burdens the controller with the obligation to provide data subjects with information regarding the existence of personal data as a result of the access request presented by them. Therefore, contrary to what was decided by the first instance, Ing Bank should have provided a complete reply to the access request within one month or at least should have asked for a deadline extension. The DPA stressed the incontrovertible fact that Ing Bank had not met the request for access to the documents, making it impossible for the data subject to know whether it possessed their personal data and to verify the legitimacy of the data collection. According to the Court of Cassation, the controller should have responded to the request, even if the response was a negative one. Contrary to what was held by the first instance Court, it held that the burden of showing whether or not it is processing personal data is on the controller and not on the data subject making the request. Similarly, it emphasized that, pursuant to Article 12(5) GDPR, the controller has the burden of demonstrating the manifestly unfounded or excessive nature of the request. In any case, the Court of Cassation stated, from the literal wording of the last-mentioned provision it clearly emerges that the controller must always acknowledge the request, even in negative terms, as it cannot hide behind a non liquet. In the Court's view, the challenged decision unlawfully burdened the data subject with demonstrating that the controller was in possession of their personal data, which amounts to the burden of producing diabolical proof. Therefore, it held that the decision inverted the burden of proof which, clearly and for the aforementioned reasons, must instead be placed on the recipient of the access request, who has at least the obligation to respond to it, even if in negative terms. For these reasons, the Court enunciated the following principle of law: "With regard to personal data processing matters, the subject burdened with the obligation to provide an answer in relation to the possession (or not) of the data is the recipient of the access request, who always have to reply, even if in negative terms, expressly declaring to be, or not, in its possession".
Polismyndigheten
The data subject made an access request to the Police Authority (note: the decision does not specify which authority exactly) to receive information on how their personal data was processed by the National Operations Department. In response, the Police provided certain personal data of the data subject (file number, type of investigative task, type of offence, the data subject's role in the case, and the processing unit). Additionally, the Police gave the data subject information about what kind of data are normally processed similar cases. The Police refused to provide any further information with reference to Chapter 4, Section 5, of the Swedish Criminal Data Act (brottsdatalagen, the Swedish law implementing Directive (EU) 2016/680) and Chapter 5, Section 1 of the Swedish Data Protection Act (dataskyddslagen). The Police argued that such further information is covered by secrecy obligations, and that providing such information could jeopardise ongoing investigations, other police actions or future activities. The data subject presented that they only had received a summary of the processing activities, but did not receive access to their personal data. Also, the data subject stated that the Police had not provided information about the purposes of the processing activities for which their personal was processed. The Police viewed that the appeal should be dismissed. The Police argued that, in their view, 1) the GDPR does not give the data subject a right to obtain a copy of the information if the right to information can be ensured by other means. Secondly, the Police stated that 2) they did not have information of the actual recipients of the data subject's personal data in archived criminal investigations. The Police said that it could only provide the data subject with information about the categories of recipients. Additionally, the Police argued that, in their view, 1) the data subject does not have a right to know who has provided information of the data subject, and that 2) the Police had indeed informed the data subject about the purposes of the processing activities. Firstly, the Court established that 1) according to Chapter 4, Section 3 of the Swedish Criminal Data Act, the data controller must inform the person who requests it, without undue delay, provide written information on whether personal data concerning him or her is being processed. Secondly, the Court established that 2) Article 15 GDPR includes essentially equivalent regulations. The Court assessed if the Police had provided sufficient information and access to personal data in accordance with the Swedish Criminal Data Act Chapter 4 Section 3 and Article 15 GDPR, as applicable. The Court viewed that the GDPR applies to processing in archived criminal investigations, and that the Swedish Criminal Data Act applies to processing in ongoing criminal investigations. The Court held, that Article 15(1)(c) GDPR must be interpreted as meaning that the right of the data subject to get access to personal data concerning him or her means that the controller is required to provide the data subject with information of the actual identity of the recipients, unless an exemption under Article 12(5) GDPR applies. The Court viewed that this interpretation of the GDPR can also provide guidance for the interpretation of the meaning of recipients or categories of recipients under the Swedish Criminal Data Act. Firstly, the Court stated that the information provided by the Police was too general, as the Police has provided only information on the categories of personal data normally processed in those kind of criminal investigation cases. The Court ruled that the Police had therefore not fulfilled the requirements of Article 15 GDPR or the Chapter 4 Section 3 of the Swedish Criminal Data Act. Secondly, The Court did not question the Police’s argument that, with regard to archived criminal investigations, they don't have information about the actual identities of recipients of the data. With regard to the ongoing criminal investigation activities, the Court viewed that the Police did not indicate any reason why they only provided information on the prospective recipients and not the actual recipients. The Court decided that the Police had not fulfilled its obligations either in this respect under Chapter 4, section 3 of the Criminal Data Act and Article 15(1) GDPR, but that the Police had provided sufficient information about the purposes of processing. The Court annulled the lower courts' decision in the aforementioned parts, and the case was returned to the Police for a new assessment.
Ola Drivers
Request by drivers to Ola Netherlands BV for access as referred to in Article 15(1) AVG to certain personal data concerning them (including 'ratings' given by passengers) and for information as referred to in Article 15(1)(h) AVG (information on the existence of automated decision-making within the meaning of Article 22 AVG). Protection of passengers' personal data. Is adaptation of the initial access request possible in the court proceedings? Request for information on, inter alia, the 'fraud probability score' used by Ola, the 'earning profile' as well as the allocation of rides to drivers. Scope of the right to information under Article 15(1)(h) GDPR. Does the request for information concern decisions which have legal consequences for the drivers or otherwise significantly affect them? Can Ola invoke an exception to the drivers' invoked right to information? In what way must the information request be acted upon? Drivers also request portability of certain personal data under Article 20 GDPR. The court: Annuls the contested decision insofar as it rejected the request of [appellant sub 1] et al. concerning: a) the initial request of [appellant sub 1] et al. based on Article 15(1) GDPR for access to the GPS data concerning them; (b) the initial request by [appellant subsection 1], based on Article 15(1) GDPR, for access to the driver device data relating to them: device details, IP address, device mobile number, login time and frequency and time of usage site/application/services; (c) [appellant sub 1]'s initial request, based on Article 15(1) GDPR, for access to personal data concerning them as referred to in paragraph 3.29 under a to d; (d) the initial request by [appellant subsection 1] c.s., based on Article 15(1)(h) GDPR, for information about the existence of automated decision-making within the meaning of that provision, in so far as that request relates to the creation of the fraud probability score, the earning profile and the allocation of journeys; and
Uber drivers
Request by Uber drivers to Uber for information under Article 15(1)(h) GDPR (information on the existence of automated decision-making within the meaning of Article 22 GDPR) after their accounts were deactivated by Uber; scope of the right to information under Article 15(1)(h) GDPR. Are the deactivation decisions based solely on automated processing? Can Uber rely on an exception to the information right invoked by the drivers? How should the information request be acted upon? The Court orders Uber to grant the information requests of [appellant sub 1] , [appellant sub 2] and [appellant sub 4] based on Article 15(1)(h) of the AVG within one month of service of this order in the manner described under par. 3.28, subject to a penalty payment in the amount of €4,000.00 for each day or part thereof that Uber fails to comply with this order.
Court case 200.295.747/01
This decision is the result of an appeal (and incidental appeals) filed against a decision from the District Court of Amsterdam (available on GDPRhub). The District Court ordered Uber to provide its drivers with information regarding the their rating by passengers but rejected several other requests for information under Article 15. The different drivers had different requests in appeal. This included information about device data, driver's profile (i.e. an internal note Uber employees use to transfer customer service requests from drivers to other Uber employees), tags (labels in the custumer service system), reports per journey (reports based on passengers' feedback), individual ratings per passenger, upfront pricing (automated system that calculates the price for a ride in advance based on various factors) and batched matching system (automated system which links drivers to passengers). Under Article 15, they also requested information about the recipients, the processing purposes, categories of personal data and existence of automated decision-making referred to in Article 22. Some drivers also requested portability within the meaning of Article 20. Uber argued among other things that the qualification as personal data depended on whether the information in question was or not intended for internal consultation and deliberation. The Court assessed each request to determine if they fell into the scope of Article 15(1). Its assessment can be summarized as follows. For the access to the driver's profile, the Court considered that it contains a representation of the driver's specific request. The driver's profile constituted personal data and therefore falls within the scope of Article 15(1). Concerning access to the tags, the Court stated that it contained information about the relevant driver and therefore also falled within the scope of Article 15(1). Regarding the reports per journey and the individual ratings, they are both based on feedback by pa
Court case 5 Sa 1046/22
The parties disputed a data access request under Article 15 GDPR and claims for damages. The plaintiff, employed since 1990 and accused of workplace misconduct, requested access to interview records involving allegations against them. The defendant provided redacted copies of processed data. The plaintiff sought unredacted copies and damages, claiming the redactions obstructed proof of alleged workplace harassment. * Article 15 GDPR grants the right to access personal data, including unredacted data, irrespective of the plaintiff's intent for obtaining the data. * Section 34(1) BDSG alongside Section 29(1) BDSG limits data disclosure when third-party confidentiality or interests are at stake. * Employers must justify non-disclosure by proving that revealing specific data harms their interests or those of others.
Court case Ro 2019/04/0232
The data subject made an erasure and a rectification request to the controller – a credit ranking agency. The controller deleted all the data concerning the data subject. The data subject lodged a complaint with the Austrian DPA for excessive erasure and violation of the right to data rectification. The Austrian DPA upheld the complaint with regard to the excessive erasure and rejected the part concerning data rectification. In particular, rectification was no longer possible after the controller deleted all the data subject’s personal data. The data subject appealed the decision before the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The court rejected the appeal and overturned the DPA decision also in the part concerning the alleged excessive erasure. According to the court, the data subject’s claim that the erasure was excessive was based on the fact that the complete lack of information on the data subject in the databases of the controller could be interpreted by a third party as lack of creditworthiness. The court rejected this argument and stated that due to the complete lack of personal data following the erasure no processing could take place: mere assumptions by third parties that are based on non-existence of certain data do not constitute processing and are therefore not subject to the GDPR. Therefore, right to erasure pursuant to Article 17 GDPR was not violated. Again due to the lack of information after the deletion, the right to rectification pursuant to Article 16 GDPR did not come into play at all. The data subject appealed the decision before the Supreme Administrative Court. The Supreme Administrative Court dismissed the appeal. The court acknowledged that a data subject has in principle the right to a partial deletion pursuant to Article 17 GDPR. However, this does not entail that a complete deletion of data by the controller violates the right to erasure. As a matter of fact, the controller – at least in this case – was u
Österreichische Post AG
The controller was a logistics and postal service provider also active in the fields of direct marketing and address publication. The data subject requested the controller to provide access to personal data concerning them pursuant to Article 15 GDPR. Deeming the controller’s reply insufficient, the data subject went to court to enforce their right to access. The data subject asked a full disclosure of which data were effectively shared and with whom, as the controller’s reply did not comply with the principles of accuracy and comprehensibility under Article 12(1) GDPR. During the civil proceeding it became clear that the controller processed and shared with third-parties data concerning the data subject’s marketing profile and potential political affinities with third-parties. However, the controller did not disclose the identity of specific recipients in the access request, but only their broad categories (e.g. advertising companies, IT-companies, NGOs). The controller denied that statistical data about data subjects’ political and philosophical affinities (the so-called marketing profiles) were personal data covered by the GDPR. The controller also replied that it could not disclose recipients’ identity because of several reasons, such as business confidentiality and a disproportionate effort on its side, as it did not keep a record of all the disclosure operations. Also, the controller argued that there is no obligation to disclose the identity of specific recipients under the GDPR, but only the categories of recipients. The first instance court upheld the controller’s defense. The court of appeal confirmed this judgement, stating that the GDPR gives the controller a free choice whether to share specific recipients or broad categories of recipients. As the controller disclosed such categories during the first instance proceeding, Article 15 GDPR was not violated. The Austrian Supreme Court sent a preliminary reference to the CJEU, which decided the case with j
Court case 31 C 2043/22 (78)
After failing a language test, a data subject requested the test provider (controller) to provide her a copy of her examination paper under Article 15(3) GDPR. The controller offered the data subject to consult her paper at its office but refused to provide a copy. It argued that the majority of the paper did not contain personal data under the meaning of Article 4 GDPR and that it had an interest in secrecy that justified its refusal to provide a copy under Article 15(4) GDPR. Unsatisfied, the data subject brought an action with the Amstgericht Frankfurt (local Court of Frankfurt). First, the Court did not follow the controller's argument concerning the non-personal nature of the data included in the paper. Indeed, the answers of the data subjects and the comments of the examiner constituted personal data under Article 4 GDPR. The test questions however were not personal data. Second, the Court weighed up the right of the data subject to obtain a copy and the interest of the controller in secrecy under Article 15(4) GDPR. It considered that the test questions constituted trade secrets within the meaning of national provisions and that the development of these language test represented a complex procedure involving considerable economic effort. These tests are used in naturalization procedure and due to a lack of secrecy, there could be a risk that the examination would no longer be considered sufficient to determine language skills for this purpose. As a result, the entrepreneurial freedom of the controller could be threatened. The Court therefore considered that on the basis of its interest to secrecy, the controller could refuse to provide a copy under Article 15(4) GDPR. It also took into account that the right to access was not entirely denied since the data subject could consult her paper at the controller’s office.
Court case W292 2248134-1
A data subject sent an access request to 16 different controllers in multiple countries pursuant to Article 15 GDPR. Deeming the reply of these controllers not sufficient, the data subject lodged several complaints with the Austrian DPA. In the context of one of these complaints, the supervisory authority held that the request was excessive and dismissed it pursuant to Article 57(4) GDPR. The data subject appealed the decision before the Austrian federal administrative court supported by the non-profit noyb. The data subject lodged a complaint with the Austrian DPA for an alleged violation of Article 15 GDPR by one of the controllers. The DPA dismissed the claim on the basis of Article 57(4) GDPR. According to such provision, a DPA may charge a reasonable fee or refuse to act when a data subject’s request is either manifestly unfounded or excessive. Article 57(4) GDPR specifically mentions the case of repetitive claims. The federal administrative court pointed out to the fact that 16 almost identical complaints by the same data subject and in a time span of 7 months was a considerable amount of work for the supervisory authority. Another relevant point in assessing whether the claim was excessive was the fact that several controllers were based outside Austria and sometimes outside the EU. Due to the cooperation mechanisms envisaged by Articles 56 and following GDPR, the Austrian DPA would be forced to invest a large amount of resources in dealing with the data subject’s request. Concerning the controllers that were not based in the EU, the DPA was instead fully dependent on the availability to cooperate of other (when existent) supervisory authorities. The fact that in some cases only one day elapsed between the month envisaged by Article 12(3) GDPR as a deadline for the controller’s reply and the complaints was also an element suggesting that the request was excessive. In light of the above, the federal administrative court endorsed the supervisory authority
Court case 1 Sa 148/22
In this case, the data subject, a 1972-born individual, applied to the controller, an eCommerce company selling garden and Indoor furniture, for a position. The data subject, with a diverse career background including roles in banking, IT security, and sales, highlighted his qualifications in a structured email application. Despite following up, the controller rejected the application. On 14 June 2021, the data subject claimed age discrimination and demanded compensation of €1,500, and refused a subsequent interview invitation. Additionally, on 14 September 2021, the data subject requested detailed information about stored personal data under Article 15 GDPR. The company responded on 21 September 2021, stating that no further data beyond the email correspondence was stored. The data subject pursued legal action for damages under Article 82 GDPR and argued that information used by its legal representatives from an online database violated his right to informational self-determination and should be deleted. The court held that the data subject's claims were unsubstantiated, dismissing the case on grounds of abuse of rights. Firstly, the court determined that the data subject used the GDPR and the General Equal Treatment Act (AGG) claims purely to obtain compensation, a purpose not aligned with the intended spirit of these laws. Although the court confirmed that the data subject had followed the appropriate procedural timelines (e.g., filing within the three-month period as required by the AGG), it nonetheless ruled the actions as abusive under § 242 of the German Civil Code (BGB). Next, the court acknowledged some GDPR violations by the controller, noting a partial failure to provide information required by Article 15 GDPR and Article 13 GDPR. However, it found these insufficient to warrant damages under Article 82 GDPR, especially since these claims appeared to be integrated as part of a larger strategy for financial gain rather than genuine data protection concern
Minister of Finance (Dutch Tax Administration)
A data subject made an access request with the Dutch Tax Administration (the controller). The controller decided to deny the request. The data subject raised several objections against this decision, but the controller declared it unfounded. The data subject appealed this decision. The Court considered the appeal grounded and ordered the controller to fulfill the access request. Following this first decision, the controller answered the request with a general indication of the personal data it processed and for what purpose (information usually available in privacy policies). It also provided the data subject with their most commonly processed personal data. Last, the controller generally referred to Article 13(4), Article 14(5) and Article 23 GDPR for possible non-disclosure. The data subject found the answer incomplete and lodged a further appeal to the Court. In an attempt to explain why some information had not been included in the response, the controller argued that the response was based on what it could find on its general system. The other IT systems had not been searched, because there were too many and this would therefore constitute a disproportionate burden. The District Court of Rotterdam held that searching a general system was not sufficient. The Court found that the controller's view that there were too many systems was not supported by evidence, unsubstantiated, and insufficient reasoning to suffice with the limited search it conducted and that the controller's general reference to grounds for exemption in the GDPR was insufficient. The controller had therefore not complied with the data subject's request. Furthermore, the Court held that the controller should have specified purposes, recipients and sources per Article 15(1). The mere listing of the personal data found, followed with a general explanation of how the Tax Administration handles personal data was not enough. The Court held that this did not allow the data subject to verify the lawfulness of processing under Article 15 GDPR. The Court declared the appeal well-founded, annulled the contested decision and ordered the controller to make a new decision, taking this judgement into account.
Court case 3 Ca 150/21
This case relates to an employment dispute between a fireworks company, the controller, and a former employee; the data subject. The data subject was initially a managing director of the company and, later on, a sales manager. The company imported fireworks and sold them to re-sellers who then sell these fireworks to ‘end-users’. While being employed by the company, the data subject also ran his own business outside of work, selling the fireworks directly to these 'end-users'. The employment dispute between the parties concerned two main issues: the payment of incentive-based bonuses; and a post-contractual non-competition clause. The data subject sought to recoup unpaid bonuses, while the controller argued that the data subject’s actions, in running this business outside of work, violated the post-contractual non-competition clause; a claim the data subject refuted as there was an agreement in place that they were allowed to engage in this business while they were an employee of the company. During this dispute, the data subject submitted an Article 15 GDPR access request in order to obtain personal data held by the company concerning him. The controller refused to provide this information, and the data subject did not receive it until 20 months later, when the controller disclosed the documents as part of the lawsuit. The data subject claimed that their former employer had violated Articles 12 and 15 GDPR, by failing to respond to the request, and sought non-material damages in the amount of €10,000; calculated as €500 for every month the controller failed to respond. With regards to the data protection aspect of this case, the court held in favour of the data subject, finding that the controller had violated Article 15 GDPR, and its obligations under Article 12 GDPR. The court found that the data subject was entitled to €10,000 in non-material damages, as Aricle 82(1) GDPR allows for such damages and that a violation of the GDPR itself is sufficient for compensation to be awarded. It was also pointed out that the significant interest the plaintiff has in the information, and that damages in these cases can have an important preventative and deterrent effect.
Court case III OSK 6781/21
The controller is a publisher who made an online publication containing personal data of the data subject, which could still be found in the websites archives. The data subject requested deletion of this information from the archive based on their right to be forgotten (Article 17 GDPR) but the controller denied the request for undisclosed reasons. Subsequently, the data subject complained to the Polish DPA, claiming that the controller had no legal basis to publish the respective personal data. Polish law provides exemptions from the applicability of the GDPR for journalistic activity, based on Article 85(2) GDPR. According to [https://lexlege.pl/ochr-danych-osob/art-2/ Article 2(1) of the Polish Data Protection Act], most of Chapter II and III of the GDPR do not apply to press materials. The DPA argued that the publication was a manifestation of 'journalistic press activity' and therefore did not need a legal basis under the GDPR based on the exception contained in [https://lexlege.pl/ochr-danych-osob/art-2/ Article 2(1) of the Polish Data Protection Act]. Hence, the DPA refused to open administrative proceedings against the controller and rejected the complaint. The data subject (the plaintiff) complained in national court against the DPA's (the defendant) decision to not initiate proceedings. The dispute essentially concerned two issues. First, whether the maintenance of a particular publication on the publisher's portal - in the archives - constituted 'press activity' which partially excluded the applicability of the GDPR. Second, whether Article 17 GDPR applied also in matters relating to press activity. With regards to the first issue, the Provincial Administrative Court in Warsaw ruled that any publication, no matter when released, also when containing personal data, is to be considered press material. Concerning the second point, the Court recalled Article 17(3) GDPR, which excludes the application of the right to be forgotten when it is 'necessary' for
Bank
The case entailed a dispute between a bank (the data subject) and a tax office (the processor). In 2019 the plaintiff, here the bank, had received a letter from the tax office, here the data processor, which informed the plaintiff about results of certain tax investigations in relation to investment funds in which the plaintiff was custodian. The plaintiff sent the tax office a letter on the basis of Section 91 of the Fiscal Code to exercise his right to be heard and for inspection of those fails. The tax office rejected the letter and also following objection of the bank. In response the plaintiff filed a lawsuit with the Munich Finance Court against the rejection of the information on the basis of Article 15(3) GDPR. The bank was aiming to obtain a copy of its data processed by the tax office and annul the earlier decision of the tax office. The tax office rejected the claims of plaintiff and provided that right to inspect the files or to receive a copy of the content of the files concerned does not fall under the scope of Article 15 GDPR. Furthermore, the tax office was ofmthe opinion that a claim for the information had already expired as the plaintiff already had the needed information. The FG München dismissed the claim. It held that, even though data subject would have a right to a acess under Article 15 GDPR, then it does not extend to current circumstances. The court held that GDPR does not vest the data subject with a right to full texts within a file, especially if the files contain unrecorded source data. The court ruled that the right to information under GDPR extends in the present case only to the input data processed for the specific tax assessments. The court was of the opinion, that the tax office had done all that is necessary and that is required by law by providing the plaintiff with the documents on capital gains and there are no reasons to doubt about the truthfulness of the tax office. The plaintiff can exercise rights stemming from procedural provisions of the Fiscal Code The plaintiff can have an access to the documents, which were submitted to the court by the tax offixe. Consequently, the court held that GDPR does not grant the bank, here the data subject a right to inspect the files to which latter requested access to. The reason for no acess comes from restrictions, which apply to tax records.
Court case 1 K 6024/20
The data subject held a property insurance policy with a controller, insuring against storm damage. The Controller is member of the Association of the German Insurance Industry and reports to the Insurance Industry's Reference and Information System. On 15 March 2019, the data subject submitted eight photos claiming storm damage to his property and the controller compensated the €2,840 claimed damage. Subsequently, on 17 December 2019, 3 February 2020, and 1 March 2020, the data subject filed additional claims using the same photos. The controller refused payment for these claims and subsequently canceled the insurance policy and reported the data subject to the informa HIS GmbH, operator of the Insurance Industry's Reference and Information System, indicating "anomalies in the claim process." The data subject filed a complaint with the DE-HE DPA, which transferred it to the DE-BW DPA as lead authority for the customers insurance. The DE-BW DPA ordered the controller to delete the entry in the Insurance Industry's Reference and Information System, arguing the controller lacked legitimate interest under Article 6 GDPR#1f. The VG Stuttgart overturned the DE-BW DPA's decision, stating that the controller had a legitimate interest under Article 6 GDPR#1f to report the anomalies to the Insurance Industry's Reference and Information System. The court emphasized that the legitimate interest does not require an actual fraud attempt, only that fraud-related anomalies exist according to Insurance Industry's Reference and Information System's guidelines. The court held that the data subject's insurance company was entitled to assess and manage risks based on potential fraudulent behavior. The repeated use of identical photos for separate claims indicated a significant probability of fraud, justifying the controller’s actions. Further, the data subject's rights did not outweigh the insurance company's legitimate interests. First, the court held that the controller’s processin
Court case 14 Sa 359/22
An employer dismissed an employee for having allegedly faked their sick leave. The employer also refused to provide access to the employee’s personal data following an access request pursuant to Article 15 GDPR. The data subject brought action against the controller for unjustified dismissal and claimed non-material damages under Article 82 GDPR for failure to reply to the access request. The court of first instance upheld the data subject’s claim and granted €1,000 of compensation for violations of Article 15(1) GDPR. The controller appealed the decision, arguing that there was no basis for the claim. The data subject appealed the decision, too. In the data subject's opinion, damages awarded were not sufficient. The Regional Labour Court of Hessen (Hessisches Landesarbeitsgericht) confirmed that the controller disregarded their duties pursuant to Article 15 GDPR, as they did not provide access to requested information within the deadline set forth in Article 12(3) GDPR. This led to liability for non-material damages. The Court completely refused the idea that Recital 146 GDPR can be interpreted as limiting the applicability of Article 82 GDPR to processing operations infringing the Regulation. To the contrary, non-compliance with an access request can give rise to damages because it occurs in the context of a processing, even if it cannot be considered "processing" itself. In addition, the Court denied that non-material damages require a certain degree of seriousness to be taken into account. The court of appeal also increased the total amount of the compensation to €2,000. The court stressed that damages have a special and general preventive function, alongside with a compensatory one. However, an even higher compensation was not admissible, as the lack of reply to an access request merely entails insecurity and lack of control over personal data, but not a violation of the data subject’s personality rights.
Court case W252 2248013-1
In this case an individual was seeking to exercise data subject rights on behalf of his deceased father, against a bank (the controller). The individual in question had submitted an access request to the bank and subsequently made a complaint, dated 1 October 2018, alleging that the information he received from the controller was incomplete. In particular, he asserted that his father’s bank details were not included, even though he had inherited the data subject rights of his father. On 19 August 2021 the DPA rejected the complaint, the individual subsequently appealed this decision to the Federal Administrative Court (BVwG), on 24 September 2021. The BVwG dismissed the appeal in its entirety. In doing so, the Court referred to Recital 27 which clarifies that “this regulation does not apply to the personal data of deceased persons”. Furthermore, the court outlined that “an assertion of the right to information (right to access) under Article 15 GDPR on behalf of the father through his son as heir, is out of the question…. The fundamental right to data protection or the right to information is a highly personal right that only the data subject can exercise themselves… Accordingly, highly personal rights cannot be inherited”. Accordingly, the data subject had no right to access this data under Article 15 GDPR.
Court case 4 Sa 201 22
In June 2020, the data subject made an access requesto to the controller, her employer, pursuant to Article 15(1) GDPR. The controller rejected the request and refused to provide information. Shortly afterwards, the employment relationship ended between the parties. In November 2020, the data subject asserted her claim for a copy of her personal data processed by the controller within the meaning of Article 15(3) GDPR. In addition, she judicially demanded compensation for non-material damages of at least €5,000 pursuant to Article 82 GDPR, as the controller had not complied with the obligation to provide the requested data in time. In the first instance, the Bamberg Labour Court awarded the data subject a claim for payment of non-material damages in the amount of €4,000 pursuant to Article 82(1) GDPR in conjunction with Article 15 GDPR. In the opinion of the Labor Court, violations must be effectively sanctioned and the damages must have a deterrent effect in order to help the GDPR achieve its purpose. The judgment was appealed by the controller. During the appeal, the controller argued that the data subject was motivated not by concerns regarding the use and processing of her personal data, but rather by a desire for personal gain. The controller requested that the lower court's judgment to be revised accordingly. The State Labour Court Nürnberg upheld the controller's appeal. On the basis of Article 82(1) GDPR, the data subject was not entitled to compensation for non-material damages from the controller, as the data controller's actions did not meet the legal definition of data processing under Article 4(2) GDPR. As a matter of fact, a violation of Article 15 GDPR regarding the obligation to provide information does not automatically entail the controller's liability in terms of damages. To the contrary, any claim for damages under Article 82(1) GDPR requires an unlawful data processing as defined under Article 4(2) GDPR. Cases of incorrect or delayed inform
Court case W176 2248585-1
This case concerns an access request submitted by a data subject, under Article 15 GDPR, to a money transfer and payment services company which primarily offers consumer and digital money transfers, the controller. The access request was submitted on 24 July 2019. On 16 December 2019, the data subject filed a complaint with the relevant DPA. The controller responded on 21 February 2020 that it had complied with the access request “in full and good time”. At this point in proceedings, the data subject was able to see, from the controller’s statement, that the controller had used an online platform to comply with the access request. The data subject had previously received two emails through this online platform, but did not want to open them as the sender was not known to her at the time and the controller had not informed her that they would be using this system. According to their submissions to the DPA, the data subject had concerns over this platform, and did not want to use it, as it required her to create an account and provide an ID card. She therefore requested that the controller send a physical copy of the requested information via a trackable express courier service, the controller agreed to do so. The proceedings before the DPA continued and, in a submission dated 2 August 2021, the data subject asserted that the controller had not provided the information via courier as agreed. The DPA held in favour of the data subject, finding that the controller had violated Articles 12 and 15 GDPR, and ordered them to provide the information within 4 weeks. The controller appealed this decision to the Federal Administrative Court (BVwG), essentially alleging that the DPA had issued its decision unlawfully and on the basis of inadequate findings of fact. The controller submitted that the data subject had submitted the access request on 24 July 2019, then on 8 August 2019 the controller asked for proof of identity, which the data subject provided on 16 August 2019. Aft