GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Online Pharmacy
The controller operates an online pharmacy located in Germany. The pharmacy allowed customers to order medical products with or without a customer account. For any order without an account, however, customers were required to enter their title (Ms./Mr.) and their date of birth in the online form. After receiving a complaint from a data subject, the LfD (DPA of Lower Saxony) investigated the case. The controller argued that information on the date of birth was required to ensure the full legal capacity of the customer and was therefore necessary to perform the contract. Furthermore, obtaining the birth date was required to comply with legal obligations. Since medications were generally associated with health risks and side effects and they must be dosed appropriately for the customer’s age. In terms of the title, the controller argued that collecting such data would allow for a more customer-friendly communication and therefore serve an overriding legitimate interest. The DPA found that the blanket collection of such data irrespective of a gender or age specific application of the ordered medication violates the principles of lawfulness and data minimization. Accordingly, the corresponding query must be omitted if it is not necessary for a gender- or age-appropriate dosing. Furthermore, the controller lacked to mention the purpose of collecting gender data to pursue legitimate interests which violates the principle of transparency. Consequently, the DPA ordered the controller to refrain from the collection of such information in the online ordering process where the necessity of such information is not indicated by the type of the medication ordered. The Administrative Court of Hanover held that the DPA’s order against the online pharmacy is lawful and does not violate the controller’s rights. While the controller has special contractual duties to provide information on their products and proper use, including an age-appropriate dosage, this does not justify the collection of the date of birth for all orders. Many products in the controller’s assortment (e.g. plasters, bandages, creams, etc.) were applicable irrespective of the customer’s age. In such cases, the processing of the birth date cannot be founded on Article 6(1)(b) GDPR. Similarly, there is no evident legal obligation to obtain this data for non-prescriptive medication that does not require an age-dependent dosage in terms of Article 6(1)(c) GDPR. Similarly, the court held that the collection of data on the gender and birth date within orders of such products could not be based on Article 6(1)(f) GDPR. Regarding the birth date, asking for the age of majority represents a milder mean instead. In terms of the title, a gender-neutral communication may be addressed. However, the controller had already taken measures during the procedure, adding an option of “do not specify” in the title section along with additional information in their privacy policy.
unknown data subject (complainant before the DSB)
The data subject is a retired employee of the municipality of Innsbruck. According to the data subject, the municipality had unlawfully disclosed the data subject's data in the course of a court procedure, inter alia by sharing them with an attorney which represented the municipality. The data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB). The municipality argued before the DSB that the disclosure of the data subject's data to the attorney had been necessary for the exercise of legal claims and therefore for the purposes of the legitimate interests under Article 6(1)(f) GDPR. The data subject was heard on this statement and filed a submission, arguing that Article 6(1)(f) GDPR does not apply on the municipality as it qualifies as a public authority. The DSB invited the municipality to submit a statement on this reply. The municipality filed a statement (mostly repeating their previous arguments) which was in turn again provided to the data subject who issued yet another submission (also mostly repeating their arguments). In September 2019, the DSB issued its decision, rejecting the complaint. In essence, the DSB (for unknown reasons) did not assess the case under Article 6 and 9 GDPR but held that the disclosure of data under § 1 Austrian Data Protection Act (DSG) was lawful. In particular, Austrian law allowed for parties to be represented by an attorney, which included the sharing of personal data. The data subject filed an appeal with the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG did not issue a decision on the merits of the case but remitted it to the DSB, ordering it to establish the facts of the case properly. It held that the DSB failed to assess which personal data of the data subject had actually been shared with the attorney. Furthermore, the Court pointed out that the DSB had also failed to establish when and how the respective data were shared with the attorney. In particular, the BVwG criticized that the DSB merely invited the parties to exchange submissions but took no further steps to objectively establish the facts of the case. Lastly, the BVwG held that the DSB failed to take into account Article 6(1)(e) and Article 9(2)(f) GDPR in their legal assessment but merely held that § 1 DSG had not been violated. The DSB will now have to follow the BVwG's orders, establish the facts of the case and assess it under Article 6 and 9 GDPR.
Court case 25 NE 21.2634
A student applied to the Higher Administrative Court of Bavaria (Bayerischer Verwaltungsgerichtshof - BayVGH) seeking a suspension of the laws mandating verification of the Covid-19 vaccine and testing certificates in schools. The student claimed that she did not consent to the processing of her personal health data, and as only unvaccinated persons are tested, her vaccination status gets known to students as well as teachers. She claimed that considerable social pressure is being put on unvaccinated persons and in such circumstances, voluntary consent as per Article 9(2)(a) and 7 GDPR, does not remain meaningful. On the basis of low incidence and hospitalization risks, the student claimed that there was no cross-border health risk, and Article 9(2)(i) GDPR could not be applied in the present case. Rejecting the application, the Higher Administrative Court of Bavaria held that Art. 9(2)(i) GDPR applies. For the definition of “serious cross border threats” the court referred to Art. 168 TFEU and Decision No 1082/2013/EU of the European Parliament and of the Council. Art. 3(g) Decision No 1082/2013/EU defines “serious cross-border threat to health” as a life-threatening or otherwise serious hazard to health of biological, chemical, environmental or unknown origin which spreads or entails a significant risk of spreading across the national borders of Member States, and which may necessitate coordination at Union level in order to ensure a high level of human health protection. Due to the latest developments of the pandemic the requirements of this definition are fulfilled. With regard to the argument of social pressure on unvaccinated students the court was of the opinion that the burdens imposed by the processing of personal data are not disproportionate to the benefits accruing to the general public. The risk of stigmatisation may be countered with educational measures.
Basaren Drift AS
In May 2018, an employee at a restaurant lodged a complaint against camera surveillance at the work place. One year later, the Norwegian DPA (Datatilsynet) requested additional information from the company running that restaurant (the Company). Even though the Company replied within a few weeks, the DPA did not follow up again until March 2020. After receiving more information from the Company, it took another five months before the DPA managed to issue a preliminary decision, which included an injunction to end the camera surveillance due to the lack of a valid legal basis as per Article 6(1)(f) GDPR and a fine of €30,382 (NOK 300,000) for breaching Article 6(1)(f), 13 and 24. After the Company shared its comments and objections to the preliminary decision, the DPA issued a final decision where the fine was reduced to €20,255 (NOK 200,000) due to the company's financial situation under the COVID-19 pandemic. The Company argued that the administrative fine was too high and therefore appealed the decision before the Norwegian Privacy Appeals Board. After reviewing the case, the DPA decided to uphold its decision, and the case was submitted to the Privacy Appeals Board (Personvernnemnda, PVN) for consideration. The PVN agreed with the DPA that the the Company had infringed Article 6(1)(f) GDPR because of the absence of a valid legal basis for the processing of personal data through the installation of surveillance cameras. However, the PVN considered that the breach of Article 6 GDPR as not as serious as the DPA had found. In the opinion of the PVN, the breaches of Article 13 and 24 GDPR were more serious. After an overall assessment, the PVN concluded that the amount of the administrative fine for such violations should be limited to €10,127 (NOK 100,000). After considering the length of the procedure, however, the PVN decided to annul the fine altogether due to the DPA's long case processing time (i.e. in total, almost three years).
Gegevensbeschermingsautoriteit (Data Protection Authority)
A shop owner tied admission to a loyalty scheme to the presentation of an eID (i.e. a Belgian electronic identity card). A data subject refused to provide his eID, considering that such data processing was excessive and not proportionate when taking into account the purpose of the processing. The data subject further filed a complaint before the Belgian DPA (APD/GBA) for being deprived of the advantages conferred by the loyalty scheme. On 17 September 2019, the Belgian DPA fined the shop owner for requiring customers to present their eID in order to obtain a loyalty card and imposed a fine of €10,000. The shop owner appealed that decision. The imposed fine of €10,000 was later annulled by the Court of Appeal of Brussels, because (i) the new eID legislation could not be applied retroactively ; (ii) the fine was not sufficiently justified and (iii) the data linked to the eID of the Complainant had actually not been processed by the shop owner, since the data subject had refused to provide such eID. The Belgian DPA contested the legality of such a decision before the Supreme Court of Belgium. The Supreme Court annulled the decision of the Court of Appeal of Brussels because it considered that the Court of Appeal did not correctly apply the law. The Supreme Court considered in particular that the Court of Appeal of Brussels erred in law by not properly considering whether the compulsory reading of an identity card as the only mean of creating a customer loyalty card is contrary to the principle of data minimisation under Article 5(1)(c) GDPR, and contrary to the obligation to obtain the freely given consent of the data subject under Article 6(1)(a) GDPR, when refusal to provide such data results into a disadvantage for the data subject (such as not being able to obtain discounts). The Supreme Court stated that the Court of Appeal should have considered the loss of an advantage in assessing whether consent is freely given under GDPR. It also confirmed that the Belgi
President of UODO
Applicant is the President of the Polish DPA (UODO) and defendant is a school (hereafter: controller). This appeal resulted from a decision by the DPA, in which it ordered the controller to remove certain processed' personal data of the complainant. The complainant is a teacher whose contract got terminated by the controller (her employer). She had received a notice of termination of her employment together with a statement of reasons, the content of which contained processed' personal data concerning her and her husband. She considered that she had never provided this personal data to the employer, and that this was not in line with the GDPR. Hence, she filed a complaint with the Polish DPA (UODO). In the justification for the termination of employment, the controller presented personal data obtained from public registers concerning the assets and income from complainant's business activity and agricultural activity, as one of the reasons for the termination. Furthermore, it stated that the processing of the this data resulted from the obligation to comply with all the orders imposed by law in terms of justifying the termination of the employment relationship for reasons beyond the employer's control (collective redundancies). In its decision, the DPA referred to the position of the Supreme Court in their judgement of 19 April 2019 (I PK 20/18), in which it held that the criteria for assessing the reasonableness of termination, such as family, personal or financial situation, do not fall within the concept of the reason for termination. They only constitute criteria for assessing the decision's legitimacy. In the light of the above, the DPA stated that the controller had no legal basis to process complainant's personal data obtained from publicly available public registers in the text of the termination notice, and thus violated Article 6 GDPR. Hence, the DPA ordered the controller to delete complainant's personal data concerning her assets and income from her business and agricultural activities. The controller appealed to this decision and brought the complaint to the administrative court. The Court held that the DPA did not fulfil its obligation to correctly assess the processing criterion indicated by the school, because in order to make such an assessment it is not sufficient to cite the Supreme Court's decision concerning the reasons for termination of the employment contract. According to the Court, this assessment must find support in the case under consideration, which was lacking in the justification of the decision. Regarding the Supreme Court judgment cited by the DPA, the Court indicated that there are also judgments interpreting the issues related to the selection of the criterion for termination in a different manner, as there is a divergence in the case law in this respect. The first position, which the court in the present case found to be correct, indicates that when terminating an employment contract by notice, the employer must indicate the criteria it used to terminate an employee's contract. The Court pointed out that, in this case, the controller included these criteria in the termination notice, apart from the main reason for termination (redundancy). Among these criteria, was the criterion of financial situation, which was supported by the personal data from public records and an open declaration of assets. The Court held that the controller had a legitimate interest in processing this data, and therefore could rely on the legal basis in Article 6(1)(f) GDPR. Hence, the Court found that the DPA's decision violated the law and annulled the DPA's decision.
Minister of Agriculture, Nature and Food Quality
The appellant is the owner of an arable farm ('the partnership'). The defendant is the Minister of Agriculture, Nature and Food Quality. The Minister informed the partnership that its name, address details and so-called Chamber of Commerce number will be passed on to the Sector Organisation for Arable Farming and that the partnership can object to this on the basis of the GDPR. The Minister wished to provide this information from the partnership to the Sector Organisation for Arable Farming so that it could implement a 'Joint Research and Innovation Programme', as part of which agricultural companies are required to register and make financial contributions. The partnership requested that its data not be passed on. They believed that the transfer of her data was contrary to the GDPR, because she did not consent to it. The information had originally been collected as part of an annual report about agricultural and technical data that is mandatory for the appellant's company. As part of that report, it explicitly denied permission to transfer data to "trade associations". The court in this appeal had to determine whether the Minister may pass on this information about the partnership to the Sector Organisation for Arable Farming. The court in turn assessed the lawfulness of (1) the original processing and (2) all further processing. (1) The original processing consisted of the Minister obtaining the agricultural and technical data of the partnership per Article 24 of the Agriculture Act in order to carry out a task of public interest as referred to in Article 6(1)(e) GDPR. The purpose of collecting this agricultural and technical data is the agricultural census, which describes the structure of the Dutch agricultural sector for the purpose of research and the development of policy. Of the data obtained for this purpose, the minister only wants to pass on the name, address and so-called Chamber of Commerce number of the partnership to the Sector Organisation for A
SIA 'SS'
In the opinion of AG Bobek, data such as phone number and car chassis number must be considered as personal data in the sense of Article 4(1) GDPR when relating to identified or identifiable individuals selling their cars via a specialized website. AG Bobek is also of the opinion that Article 6(1)(c) GDPR and Article 6(3) GDPR do not preclude national rules from laying down, without any limit in time, an obligation for Internet advertising service providers to communicate certain personal data to a tax authority, as long as there is a clear legal basis in national law for such a type of data transfer and the data requested are suitable and necessary for the tax authority to complete its official tasks. SIA ‘SS’ (‘the applicant’) is a company specialized in online advertising services. Private individuals may post and advertise various products on the applicant's website ([https://www.ss.com www.ss.com]) with a view of selling them. These products may include vehicles such as second-hand cars or motorbikes. On 28 August 2018, the director of the Latvian Tax Inspection Office (‘the defendant’) sent to the applicant request for information on the basis of Article 15(6) of the Law on taxes and duties. In that request, the defendant asked the applicant to renew the defendant's access to information, and in particular information on (1) the telephone numbers of advertisers ; (2) the chassis numbers of vehicles featured in advertisements published on the applicant’s website, and (3) information on advertisements published in the ‘Motor Vehicles’ section of the website during the period from 14 July to 31 August 2018. The applicant was asked to send the information electronically, in a format that would allow the data to be filtered and selected. The applicant was also asked to include the following information in the data file: a link to the advertisement, advertisement text, make of vehicle, model, chassis number, price, vendor’s telephone numbers. The applicant lodg
Coop Finnmark SA
This case is an appeal of the decision DT-20/01790 by the Norwegian DPA (Datatilsynet), in which it fined a store approximately €40,340 (NOK 400,000) for the unlawful disclosure of personal data from a surveillance footage, thus breaching Article 5(1)(a) GDPR and Article 6. The complainant argued that the size of the administrative fine imposed, was too high and therefore appealed the DPA's decision. After reviewing the complaint, the DPA decided to uphold it, and the case was therefore was submitted to the Privacy Appeals Board (Personvernnemnda) for consideration. Personvernnemnda (PVN) agreed with the DPA that the infringement in question was correctly defined as a breach of Article 5(1)(a) GDPR and Article 6(1)(f). However, the PVN did not agree that the infringement was as serious as interpreted by the DPA, quoting specifically the short duration of the footage (3 seconds), that it did not show any faces or the theft itself, did not concern any personal data as per Article 9 GDPR or Article 10 and was deleted after a few days. The PVN noted that forwarding the footage and the fact that it involves children, are aggravating circumstances, however there was no evidence that the data subjects were harmed in any way. After an overall assessment, the PVN concluded (under doubt) that an administrative fine for such a violation should be around €5042 (NOK 50,000), however they also removed the fine entirely due to the DPA's long case processing time (over two years). Following the PVN's decision, the complainant submitted a claim for coverage of their legal costs related to this case. The PVN agreed and awarded the complainant €6959 (NOK 69,000), cf. [https://www.pvn.no/pvn-2021-15 PVN-2021-15].
Court case III OSK 4727/21
The Polish DPA issued a decision ordering a health care institution to delete the personal data of a former employee stored on the hard drive of the company computer which he used during his employment. The DPA concluded that, in the present case, none of the prerequisites of Article 6(1) and Article 9(2) GDPR authorising the health care institution to process the complainant's personal data after termination existed. The health care institution argued that it needed to process the personal data of former employees in order to defend itself against possible civil claims, but the DPA explained that such a reason does not have legal justification as a basis for processing under the GDPR. Personal data cannot be processed 'as a back-up' with the assumption that the data may be useful in the future, and stored up until the statute of limitations for civil law claims. The DPA held that there were no grounds entitling the employer to process the data to defend itself from hypothetical claims in the future. This decision was appealed by the health institution to the Voivodship Administrative Court in Warsaw, which dismissed the complaint. The appellant further appealed against the judgment to the Supreme Administrative Court and requested that the contested decision be suspended. The appellant claimed that it was necessary to suspend the execution of the contested decision, since its execution would produce effects for the applicant which are impossible to reverse (via the destruction of potential evidence). The Polish Supreme Administrative Court sided with the Polish DPA, and held that the appellant did not prove premises justifying the suspension of the execution order of the appealed decision issued by the DPA. It held that reference to the processing of the complainant's personal data in order to defend against any claims is not legally justified and does not constitute a premise entitling to the processing of personal data. In the opinion of the Court, the risk of the possibly erroneous classification of the processing of personal data by the applicant as unlawful does not justify the suspension of the execution of the decision ordering the removal of personal data of the participant in the proceedings. Through a sort of balancing test, it reasoned that the risk to the rights of the data subject if the data is stored is greater than the risk to the applicant if the data is deleted.
EQUIFAX IBERICA S.L.
In its decision AEPD - PS/00451/2019, the Spanish DPA (AEPD) fined Equifax, a credit agency, €75,000 for unlawful processing of data. Equifax appealed this decision with the Spanish National High Court (Audiencia Nacional, "AN"). The court declared that the decision issued by the AEPD, since the DPA had carried out a correct interpretation of the GDPR and the [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 Spanish Data Protection Act]. Since the controller had failed to block the data included in the credit file for 30 days, as the Data Protection Act requires, the controller was processing the data unlawfully, and could therefore not rely on any legal basis. Additionally, the court noted that the controller had alleged that, since the Data Protection Act had entered recently into force, they had not been able to implement a proper blocking system, and they did not have the means at the time to block the data; so the controller had acknowledged that they had not carried out the blockage. The court also remarked that the fine was proportional, since the DPA had taken into account the circumstances of the case and had imposed a proportionate and justified fine, in accordance with Article 83(5) GDPR.
Luxembourg Police
An asylum seeker (X), born in Moldavia but having lived his entire childhood in Syria, applied for international protection in Luxembourg in November 2019. At the time of entry, X was still a minor and was accompanied by his mother. During the interrogation conducted by the police, X fainted and the police searched his phone without his consent, including pictures. In February and April 2021, whilst X had reached the legal age of majority, he was heard by an agent of the Ministry of Immigration regarding his situation and the reasons behind his request for international protection. On 1 June 2021, the Ministry rejected his request, on the ground that X had a connection with Moldavia, where he could return, in application of Article 28(2)(c) of the Luxembourg law of 18 December 2015 regarding international protection. X appealed that decision before the Administrative Tribunal of Luxembourg, arguing among others that the police force had illegally processed his personal data, including sensitive personal data, because they did not have any valid legal basis under Article 6 GDPR and/or Article 9 GDPR. Regarding the processing of personal data in general, the Tribunal first recalled that processing of personal data is allowed when such processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e) GDPR), as long as this is laid down in national law (Article 6(3)(b) GDPR). The Tribunal then looked into Article 12(5) of the Luxembourg law on Internal Protection, which states that: "The [police] may, if necessary, carry out a body search of the applicant and a search of the objects he is transporting. (...) [T]he body search of the applicant's shall be carried out by a person of the same sex, with full respect for the principles of human dignity and physical and psychological integrity. Any object useful for examining the request may be retained (...)." Having r
Autoriteit Persoonsgegevens
The Dutch DPA (the Autoriteit Persoonsgegevens, or 'AP') imposed an order subject to a periodic penalty payment on the municipality of Arnhem ('the Municipality'). The Municipality had infringed the then applicable Personal Data Protection Act (Wet bescherming persoonsgegevens or 'Wbp') by storing and retaining the personal data of individuals who disposed their waste in underground containers on the card readers attached to the containers. The order required the Municipality to open all underground containers without the use of a card, and to delete all personal data already stored and retained no later than 1 October 2017. On 14 March 2019, the AP decided to lift the order subject to penalty payments imposed on the Municipality at the request of the Municipality. The Municipality wanted the underground containers to be accessible only to residents and businesses of the Municipality, and therefore wanted to open a new waste card system. With the new system, residents are given a card with an internal chip code which is linked to their residential address. When the card is held in front of the card reader, the chip code is processed and compared to a whitelist of chip codes. To do this, the chip code is stored on the card reader's volatile memory. It is then converted almost instantly into a generic 9999 number, and removed from the whitelist when the container is closed. The AP could not foresee any violation of the GDPR by this new system, namely because data may be processed on the basis of Article 6(1)(e) GDPR, which states that a controller may process personal data which is lawful and necessary for the performance of a task carried out in the public interest. In a decision of 16 July 2019, the AP dismissed an objection made by an appellant against the decision to lift the order as unfounded as unfounded. In a judgment of 5 September 2019, the District Court of Gelderland ('the District Court') declared an appeal lodged by the appellant against the decision
Court case M 32 K 20.2879
The main legal question in this case was whether a data controller is obliged to grant data subjects access to certain official documents, including environmental information in connection with an approved geothermal probe, in light of the applicable Bavarian Environmental Information Act (BayUIG). In order to balance the interests of the controller (i.e. confidentiality) with the public interest (i.e. access to information), the national legislator should pay attention to the recitals of the GDPR and to Article 86 GDPR which concerns public access to official documents, as well as Article 6(2) GDPR and Article 6(3) GDPR which provides Member States with the possibility to adopt specific provisions allowing for certain types of processing activities. In light of Recital 154 and Article 86 GDPR, it appears that the GDPR requires the principle of public access to official documents to be taken into account when it is applied. Public access to official documents can be viewed as a public interest. The ruling court has no concerns that the national provisions of the BayUIG in question, an information access law in accordance with Article 6, Paragraph 2, last half-sentence, Paragraph 3, Clause 3, last half-sentence, Article 86 GDPR, are compatible with the provisions of the GDPR (for the conformity of the VIG with the GDPR see BayVGH, Bv 15.4.2020 - 5 CS 19.2087 - juris Rn. 25; for the conformity of the IFG, UIG and VIG with the GDPR see Schnabel in Simitis / Hornung / Spiecker gen.Döhmann, Datenschutzrecht, 1st edition 2019, Rn. 41 ff.) And therefore the information access granted here according to the BayUIG does not contradict the GDPR. The Administrative court of Munich points out the relevant facts about the relation of the GDPR to European and National Information Access Claims. There are no provisions of the EU GDPR to conflict with the right to information according to the BayUIG. Like all EU regulations, the GDPR enjoys direct validity and priority over national law in all member states. It must therefore be taken into account when using the BayUIG.
Court case 6Ob87/21v
The credit reference agency (the defendant) collected past payment data on the data subject (the plaintiff) in order to provide other parties with a credit score reflecting their risk of non-payment. In this regard, the defendant stored data on the plaintiff regarding several unpaid online shopping invoices from 2017 and 2018. While the plaintiff caught up with the payments later on, the data on such invoices are to remain stored as “positively settled” for a ten years’ period in the defendant’s system. The plaintiff requested the defendant to delete all the payment data relating to them. They argued that there was no further necessity to process such data since all entries have been positively settled. Moreover, the invoices amounts were insignificant and the plaintiff’s financial situation has improved considerably. The plaintiff argued therefore, that the incomplete and outdated data would unreasonably hinder their participation in economic life. According to the plaintiff, such impairments cannot be based on data that is up to ten years old. The defendant argued that the processing the data was legitimate. The purpose of the data processing is to grant other companies access to such data, given their need to assess the payment behaviour of potential customers when entering into a credit risk. Deleting such data would distort the accurate representation of the plaintiff's creditworthiness. The interests of the defendant and related third parties would outweigh the plaintiff's interest in deletion. The Austrian Supreme Court (Oberster Gerichtshof - OGH) decided, that the plaintiff's claim for erasure cannot be based on the ten-year storage period, since as part of an individual assessment, it may only examine the storage period in the particular case. Beginning with the first entry on unpaid invoices in 2017, therefore only an period of storage of approximately 3 years can be considered. In this regard, the OGH found that the plaintiff failed to provide convincing arguments against the legal opinion of the preceding lower courts' judgements. Accordingly, it is precisely necessary to record payment experience data over a longer period of time in order determine trends and avoid mere "snapshots". It is essential to ensure an objective, transparent and truthful information about customers’ ability and difficulty to pay, to minimize risks of third-party lenders. The OGH upheld the opinion by the lower courts, that the overall effect of the stored information does not ultimately cut off the plaintiff’s participation in economic life. In fact, the data is still relevant for their creditworthiness and thereby still relevant to the credit scoring agency and related third parties. Accordingly, the OGH rejected the erasure request of the plaintiff, given that it found no violation of Article 5(1)(c)(e) GDPR and a prevailing legitimate interest of the defendant according to Article 6(f) GDPR.
Max Schrems
In the proceedings, the plaintiff filed a total of 12 applications. The court ruled on 6 of these applications by partial judgment of 23 June 2021. The proceedings were interrupted with regard to the remaining 5 applications until the CJEU has ruled on the preliminary ruling proceedings initiated by order of 23 June 2021. An overall short summary can be found [https://noyb.eu/en/breaking-austrian-ogh-asks-cjeu-if-facebook-undermines-gdpr-2018 here]. This order for preliminary ruling only concerns applications 5 to 9, so that only the relevant facts are presented in a very abbreviated form below. The facts relevant for the proceedings already decided by partial judgment are presented there. The plaintiff is Max Schrems. The defendant is Facebook Ireland. Facebook provides a platform on which more than 2.2 billion users worldwide can upload data and respond to data uploaded by other users. This includes text posts, pictures, videos, events, comments, "likes", tags on photos and much more. The court explains all the functions of the Facebook platform. In particular, it explains that users network with each other in so-called "friendships". Practically all information from all users is linked to each other - especially via the friendship network. This linking allows an evaluation of the individual user beyond the data provided by the user himself. The research into the "preferences" and the "profile" of the users does not only include interests or information provided by the user himself, but all personal data available to the defendant. Facebook does not generate any content itself and only provides the infrastructure (free of charge). Facebook receives the (linked) personal data. The economic model of the defendant is to generate revenue through personalised advertising and commercial content based on the same preferences and interests. For this purpose, Facebook provides so-called business tools, which in turn can be differentiated into three tools described by the
Mircom International Content Management & Consulting (M.I.C.M.) Limited
A content management company (Mircom) submitted a request for information against Telenet, an internet service provider, to a Belgian Court. The request sought a decision requiring Telenet to produce the identification data of its customers on the basis of IP addresses collected, by a specialised company, on behalf of Mircom. The internet connections of Telenet’s customers had been used to share films in the Mircom catalogue, on a peer-to-peer network, using the BitTorrent protocol. Telenet challenged the request. The Belgian court submitted a request for a preliminary ruling to the CJEU. Although most of the debate is centered around intellectual property law, data protection law is also involved. First, it asked the Court whether the sharing of pieces of a media file containing a protected work on that network constitutes a communication to the public under EU law. Secondly, it sought to ascertain whether the holder of intellectual property rights, such as Mircom, which did not use them, but claimed damages for alleged infringements, could benefit from the measures, procedures and remedies provided for by EU law in order to ensure that those rights are enforced, for example by requesting information. Thirdly, the referring court asked the Court of Justice to clarify the question of the lawfulness, first, of the way in which the customers’ IP addresses have been collected by Mircom and, second, of the communication of the data requested by Mircom from Telenet. (1) (a) Can the downloading of a file via a peer-to-peer network and the simultaneous provision for uploading of parts thereof … (which may be very fragmentary as compared to the whole) (‘seeding’) be regarded as a communication to the public within the meaning of Article 3(1) of Directive 2001/29, even if the individual pieces as such are unusable? If so, (b) is there a de minimis threshold above which the seeding of those pieces would constitute a communication to the public? (c) is the fact that seeding can take place automatically (as a result of the BitTorrent client settings), and thus without the user’s knowledge, relevant? (2) (a) Can a person who is the contractual holder of the copyright (or related rights), but does not himself exploit those rights and merely claims damages from alleged infringers – and whose economic business model thus depends on the existence of piracy, not on combating it – enjoy the same rights as those conferred by Chapter II of Directive 2004/48 on authors or licence holders who exploit copyright in the normal way? (b) How can the licence holder in that case have suffered “prejudice” (within the meaning of Article 13 of Directive 2004/48) as a result of the infringement? (3) Are the specific circumstances set out in Questions 1 and 2 relevant when assessing the correct balance to be struck between, on the one hand, the enforcement of intellectual property rights and, on the other, the rights and freedoms safeguarded by the [Charter of Fundamental Rights of the European Union], such as respect for private life and protection of personal data, in particular in the context of the assessment of proportionality? (4) Is, in all those circumstances, the systematic registration and general further processing of the IP-addresses of a “swarm” of “seeders” (by the licence holder himself or herself, and by a third party on his or her behalf) legitimate under Regulation [2016/679], and specifically under Article 6(1) [first subparagraph] (f) thereof? In the first place, the Court clarified that the uploading of pieces, previously downloaded, of a media file containing a protected work using a peer-to-peer network constitutes ‘making [a work] available to the public’, even though those pieces are unusable in themselves and the uploading is automatically generated when the user has subscribed to the BitTorrent client sharing software in giving his or her consent to its application after having duly been informed of its characteristics. In the second place, the Court considered that Mircom, as holder of intellectual property rights on the discussed content, may benefit from the measures, procedures and remedies provided for by EU law for the exercise of those rights, unless that holder’s claim is abusive. In the third place, the Court held that EU law does not preclude, in principle, the systematic registration, by the holder of intellectual property rights, of IP addresses of users of peer-to-peer networks whose internet connections have allegedly been used in infringing activities, or the communication of the names and of postal addresses of users to that holder or to a third party for the purposes of an action for damages. However, initiatives and requests in that regard must be justified, proportionate, not abusive and provided for by a national legislative measure which limits the scope of rights and obligations under EU law. The Court states that the latter does not impose an obligation on a company such as Telenet to communicate personal data to private individuals in order to be able to bring proceedings before the civil courts for copyright infringements. However, EU law allows Member States to impose such an obligation.
Ministère de l'économie, des finances et de la relance
A public officer asked for personal data to be removed from his appointment notice as published on the Ministry's website since it mentioned his status as a disabled person. The Ministry however refused to do so, on the ground that French law requires the publication of such information. The French Council of State ('CE') held that, although the data had to be published for compliance with the law, such information was not necessary in relation to the purpose to be achieved, and should therefore be removed from the Ministry's website, in compliance with the principles of purpose limitation and data minimization (Article 5(1)(b) and (c) GDPR). However, the CE held that information about the existence of a disability could not be considered as health data when it didn't mention the type or gravity of the disability, and that Article 9 GDPR therefore did not apply to this type of data.
Court case 200.280.852/01
The case concerns a civil dispute between the plaintiffs Central Student Council (CSR) at the University of Amsterdam ('UvA'), the Student Council at the Faculty of Economics and Business (FSR) of the UvA, and an individual student against the defendant, the UvA. The outbreak of Covid19 caused the Dutch government to close the universities on 16 March 2020. Due to the closure, it was not possible for the UvA to hold exams on site. After some research and testing, the UvA decided to use an online proctoring tool, essentially a monitoring software called Proctorio. This software allows the university to monitor student behaviour at home while they are taking the exam to see if the student is attempting to cheat on the exam. Proctorio is installed as a browser plugin. It continuously records the test taker's webcam, microphone, and screen. In addition, the software monitors the student's behaviour to detect unusual behaviour, such as if the student often looks away from the screen, or if there is ambient noise in the room that might indicate that someone else is in the same room with the student, or if the student types more or less than other test takers. The software also monitors the computer's internet traffic, the presence of secondary monitors. The plaintiffs took the university to court by filing a motion for a preliminary injunction with the District Court of Amsterdam. The district court ruled in favour of UVA, finding that the government's COVID-19 measures did not allow for suitable alternatives and that the surveillance had a legal basis in Article 6(1)(e) GDPR. The plaintiffs appealed to the Court of Appeals Amsterdam Court, seeking an ordinary ruling (not a preliminary injunction). Before rolling out the software in a real-world scenario, the UvA conducted three simulated tests in April 2020. In the meantime, the UvA asked its own DPO (Data Protection Officer) for advice and received a positive response. The UvA then conducted a DPIA (Data Protection Impact Assessment) to identify data protection risks and find mitigation measures. The CSR sent a letter to the UvA's Executive Board, which was described in the judgement as "unsolicited advice". In this letter, the CSR strongly opposed the use of proctoring, recommended against the use of room scanning, and recommended that the UvA provide students who cannot/would not use proctoring with alternative means of taking exams without delaying their studies. The UvA's Executive Board decided on 11 May 2020 that online proctoring would be used for exams during the Covid19 pandemic if there were no suitable alternatives. The use of online proctoring in non-pandemic situations would require a new decision by the board.
Sky Österreich Fernsehen GmbH
The claimant is an Austrian consumer protection institution (Verein für Konsumentinformation). It filed a Verbandsklage pursuant to § 28 of the Austrian Consumer Protection Act (KSchG) to stop the use of three (general terms and conditions) clauses with the Commercial Court of Vienna (HG Wien). A Verbandsklage is a form of popular action in which associations are granted standing not to assert the violation of their own rights, but of the rights of the general public. Clause 1: Pursuant to Sky's terms and conditions, consumers are obliged to immediately notify Sky of any changes to the data provided and notices sent to the last known address of consumers shall be deemed received. However, Sky customers received a letter with the Clause 1 informing them that their customer data should be passed on to Austrian Post for verification. If the data stored at the post office did not match the Sky data, the Sky data should be updated. Consent for the data comparison was not obtained from the customers. Sky rather invoked the legal basis of Article 6(1)(f) GDPR. If data subjects are against the verification, they should explicitly object to it. Clause 2: The second clause dealt with the transfer of data and with storage periods. Among other things, it was stated here that data may be transferred to third parties who have a contractual relationship with the subscriber (e.g. IPTV providers) and to service providers who provide services on behalf of Sky. It also stated that Sky stores the data within the statutory retention periods (in particular according to the Austrian Company Code (UGB) and the Austrian Federal Tax Code (BAO)). Clause 3: Finally, Sky's general terms and conditions stipulated that further framework data from the subscription contract may be processed for the purpose of direct advertising. The court ruled that all clauses violate the GDPR and are therefore invalid. = First, the court found that the VDI itself may assert the infringement. In particular,