GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
The controller is the provider of a social network based in the United States. It stores personal data on several different servers, some of which are in the US. The data subject is a user of the controller’s social network, which made an access request under Article 15 GDPR. The controller partly refused to provide the data subject with information under Article 15 GDPR. The refusal concerned possible access to data by US intelligence services. The controller referred to national law (Section 702 of the US Foreign Intelligence Surveillance Act of 1978), under which it is forbidden for the controller to provide the data subject with such information. The data subject sued the controller before the court of first instance (Regional Court of Bonn, Landgericht Bonn - LG Bonn) for, inter alia, €1,500 in non-material damages for the allegedly illegal transfers of personal data to the U.S. Furthermore, he claims another €1,000 in non-material damages for the refusal of the controller to provide the data subject with a copy of his personal data under Article 15 GDPR. The controller claimed that the data transfer to the US was justified, because it is necessary for the performance of the contract, which follows from the nature of a digital, international, social network. It also insisted that is was not permitted to provide information regarding the access of US intelligence services. The court found that the lawsuit was partly inadmissible and partly unfounded. First, the court found that the personal data transfers to the US between the coming into effect of the GDPR until the 9 July 2023 had been legal under Article 49(1)(b) GDPR. Since 10 July 2023 they were and are legal under Article 45(1) GDPR due to the adequacy decision by the European Commission. Second, the court followed the argument of the controller that it was in the very nature of an international social network that personal data can potentially be accessed world wide and therefore need to be able to be
The controller is a company that is active in metal processing. Its factory building consists of a production hall where steel is processed, a break room, two offices, and an adjoining storage room. There are 34 video cameras in those spaces which cover the entire area 24 hours a day and the video footage is kept for at least 48 hours. Cameras are also positioned in the offices. However, the parties disagree on whether the cameras in the offices are merely "dummy" devices. The cameras are capable of filming in high resolution. Images from the video feeds can be evaluated “live” while they are being recorded. Information signs regarding video surveillance are located at every access door. Employees consent to video surveillance through a short, general clause in their employment contract. The data subject was an employee working with machinery in the production hall who's workplace was located a few metres away from a surveillance camera. The camera surveillance was the subject of a legal dispute between the controller and the data subject before the Labour Court Dortmund in 2023. The dispute was resolved through a settlement agreement. As part of the settlement, the controller agreed to provide the data subject with information about the video surveillance. However, after receiving this information, the data subject claimed that it was incorrect and insufficient and that the stated purposes of the video surveillance did not justify its extent. In 2024, the data subject pursued his claims with his lawsuit, which was filed with the court of first instance (Labour Court Dortmund). He demanded that the controller would provide the correct information and cease video surveillance. In its decision of 2024, the court of first instance dismissed the right of access claim and upheld the rest of the claim ordering the controller to pay the data subject €15,000 in compensation for a serious unlawful infringement of the data subject's personal rights. In the meantime the e
In October 2018, a data subject requested access under Article 15 GDPR from a credit information company (the controller, later merged into another entity). The controller provided a three-page response, listing basic personal data, addresses, financial details, and references to sources. It also denied conducting automated decision-making within the meaning of Article 22 GDPR. The data subject lodged a complaint with the DPA in December 2018, claiming the access was incomplete and failed to explain how data were linked to processing purposes, recipients, or legal bases. They also argued that automated decision-making and profiling (credit scoring) were taking place, contrary to the controller’s denial. The DPA failed to decide within the statutory time limit, leading the data subject to file an inactivity complaint. The case was then transferred to the Federal Administrative Court (BVwG). The Court stayed proceedings until the CJEU issued its preliminary ruling in case C-203/22 (Dun & Bradstreet). Following the preliminary ruling, the controller argued that it provided sufficient information to the data subject, as the CJEU had concluded that a controller did not need to provide a mathematical formula (algorithm) or a detailed description of each step of the automated decision-making process. In the case that the Court concluded it needed to provide further information, the controller argued that this would involve disclosing trade secrets. The Court partly upheld the complaint. It found that the controller had violated Article 15(1)(a) GDPR by failing to provide sufficiently specific information about the purposes of processing. According to the Court, the controller had provided information on the purposes that was too vague. Specifically, statements such as “improving user-friendliness” or “marketing purposes” did not meet the requirements under Article 15, 5(1)(b) or Article 12(1) GDPR. The Court stated that the controller had not clarified what data was us
In 2021, two data subjects requested the deletion of their personal data related to their Covid-19 vaccination records and Covid-19 personal data held at the National Institute of Public Health and the Environment. The controller, the Minister of Public Health, Welfare and Sport, provided them with two options to confirm their identity: by sending either a scan of their passport or by physically identifying themselves before the Ministry. The data subjects did not use either option and the controller subsequently rejected their requests. The data subjects filed a complaint before the court of first instance. The court ruled that the minister was justified in dismissing the objections as unfounded. It ruled that the minister was entitled to disregard the requests on the ground that the identity of the persons concerned could not be established. Plus, while the Covid-19 measures were still in effect, deletion of the vaccination data would make it impossible for an individual to prove that they where vaccinated via the government application for Covid-19. The data subjects appeal the decision of the court of first instance before the Council of State. The data subjects argued that the identification options given by the minister were unreasonable since by sharing a copy of their passports they incurred many risks. Second, physical identification at the Ministry unreasonably burdens the data subject. Third, they proposed the alternative to be identified with the last three digits of their BSN, combined with telephone verification. First, the court stated that the controller should take all reasonable measures to verify the identity of a data subject who is making a request referred to in Articles 15 to 21 GDPR and can request further information regardless of whether he has doubts about the identity (Article 12(6) GDPR and https://gdpr-info.eu/recitals/no-64/ Recital 64). Furthermore, the court ruled that the minister had discretion to the manner in which it es
In April 2025, Meta Platforms Ireland Limited (Meta) publicly announced that it would use personal data from its users' public profiles to train artificial intelligence from 27 May 2025, unless users object to this processing. In May 2025, the German Consumer Rights Organisation "Verbraucherzentrale NRW" (plaintiff) brought an interim injunction case against Meta before the High Regional Court of Cologne, to prevent the processing of publicly provided user data. Following a preliminary and summary examination, as part of the interim proceeding, the High Regional Court of Cologne held that Meta did not breach the GDPR or the DMA, noting that this assessment is consistent with the regulatory assessment by the Irish DPA responsible for Meta. The Hamburg DPA (Hamburg Commissioner for Data Protection and Freedom of Information) stated at the hearing that the use of user's personal data for AI training purposes is legally possible. The court held that the processing is lawful within the meaning of Article 6(1)(f) GDPR, even without the data subjects' consent, and that Meta pursues a legitimate interest by using the data for the training of artificial intelligence systems. He further pointed that the fact that large amounts of data, also from third parties including minors and sensitive data within the meaning of Article 9 GDPR, are processed, does not outweigh this consideration. The High Regional Court of Cologne rejected the interim measure.
The case originated before the Regional Court of Düsseldorf (LG Düsseldorf, 12 O 171/22), where the plaintiff sought non-material damages under Article 82 GDPR, access to information under Article 15 GDPR, and a cease-and-desist order. The dispute concerned Platform A., a social media provider that, by default, allowed profile lookups through mobile phone numbers without requiring explicit user consent. This design enabled a 2019 automated data scraping attack, during which attackers randomly generated mobile numbers and matched them with publicly available user data, such as names and profile identifiers. In 2021, the scraped dataset, including the plaintiff’s mobile number, was found on a publicly accessible online database. Platform A. acknowledged the breach publicly only in 2022. In reaction to the incident and to mitigate further exposure, the plaintiff changed her mobile number between 2021 and 2024, and has pursued claims for loss of control over her personal data and ongoing concerns about potential misuse. The Court held that the unauthorized scraping and disclosure of the plaintiff’s mobile phone number that was linked with publicly available profile data, constituted a loss of control over personal data, and therefore a compensable non-material damage under Article 82(1) GDPR. Under Article 82(1) GDPR, the court reiterated that “loss of control” alone constitutes non-material damage, without requiring proof of actual or tangible misuse. This position aligns with recent ECJ rulings (C‑590/22, C‑340/21) and national precedent from the German Federal Court of Justice (BGH VI ZR 10/24), which held that temporary or one-time loss of control may suffice for damages. In this case, however, the court only awarded €75 in damages, acknowledging that the scraped data was not highly sensitive. Further, the court rejected claims for declaratory relief regarding future harm, reasoning that no further material damage was likely due to the plaintiff’s change of phon
A dentist (the data subject) found a listing of her on Google My Business (GMB) in 2017, which included personal data, reviews and ratings related to her professional activity. The data subject requested Google France to delete the reviews and remove the reviews function from her listing. After a refusal from Google France and Google LLC, the data subject brought a case to the Chambéry regional court. This court ordered in 2019 Google France, Google LLC and Google Ireland to disclose the authors of the negative reviews. After being unable to remove half of the negative reviews, the data subject brought a request for interim relief to the Paris Regional Court in order to delete the listing. This was refused, and the data subject brought the request to delete to the Court of Chambéry. In 2022 this Court stated that the Google companies did not have a legitimate interest in processing the data subject’s data without her consent. Google had also not complied with the principles of fairness and transparency. Finally, the Court ordered the Google companies to delete the data subject’s listing on GMB. The Google companies were also jointly liable for non-material and procedural damages. The Google companies appealed the case the same year. The Google companies argued that the processing was justified by the legitimate interest of providing users with the means to evaluate professionals and receive information about their work. Furthermore, Google France argued that the case was inadmissible, as it was not involved in the Google services in question. The data subject argued that Google France operates the services based on case law Google Spain, and requested the Court of appeal to uphold the reasoning of the previous Court. The Court first stated that Google France did not have standing in this case, as it was not the operator of the search engine or the owner of the www.google.fr domain. According to the Court, the terms of service refer to Google Ireland, and the corre
An employer (the controller) accessed the email address of an employee (the data subject) over suspicions of internal fraud. It was later discovered that the data subject committed no fraud. The data subject filed a complaint with the DPA. She claimed that her right to data protection was violated and request the DPA to impose a fine. The DPA held that the controller violated Articles 5, 6, 13 and 14 GDPR. On these grounds, the DPA issued a reprimand against the controller and an order to bring internal processes into compliance. The DPA did not impose a fine. The data subject filed an internal appeal before the Personvernnemnda (the Privacy Appeals Board of the DPA). In her appeal, she challenged the DPA’s decision not to fine the controller. The Board held that the data subject had no standing for appealing the decision and dismissed the appeal on procedural grounds. In this regard, The Board considered that the DPA’s decision put an end to the controller’s violation. On this basis, the Board held that the DPA’s decision not to inflict a fine, did not produce tangible and factual effects for the data subject. This, in turn, led to the conclusion that she was not a party to the decision and could not bring an appeal. The data subject further challenged the Board’s decision before the Sivilombudet (the Norwegian Parliamentary Ombud). She claimed that the Board was wrong in finding that she had no right to challenge the merits of the DPA’s decision. The Sivilombudet held that the data subject could challenge the DPA’s decision, and that she had the right to challenge both its procedure and its merits. In particular, she had the right to a review of the correctness and proportionality of the corrective measures inflicted by the DPA. On these grounds, the Sivilombudet ordered the Board to re-examine the data subject’s appeal, ensuring a full review of the DPA’s decision. = The Sivilombudet observed that the domestic rules on internal appeals against the DPA were not
IAB Europe (“IAB”, short of Interactive Advertising Bureau) is an association of undertakings active in the field of digital advertising such as publishers, ecommerce and marketing companies and intermediaries, including major international players such as Microsoft and Google. IAB is established in Belgium and operates on a European level. IAB developed the “Transparency & Consent Framework” (“TCF”). The purpose of the TCF is to make the processing of personal data for online advertising compliant with data protection requirements. To this end, the TCF provides a set of technical standards and rules (in the form of contractual obligations) for companies in the sector. In particular, the TCF specifies how publishers, advertisers, and intermediaries should use the OpenRTB protocol, a widely used Real Time Bidding (“RTB”) system. RTB consists in the instant and automated online auction of users profiles for the purpose of selling and purchasing advertising space online. When an internet user visits a webpage where advertising space is available, the server sends the user’s data to a platform where advertisers automatically and instantly place bids. Advertisers place their bids based on some characteristics of individual users visiting the page (such as their location, marketing profiles, and browsing history). The bid winner displays their customer's advertising in that specific advertising space. The whole process involves a mass exchange of personal data. For this operation to be possible, users are (in principle) asked to express their advertising preferences when they first visit a publisher’s website. These preferences are collected by websites (more specifically, by each website's Consent Management Platform) and stored in a string called Transparency and Consent string (‘TC string’). The TC string is subsequently shared with advertisers and data brokers, in order to inform them of the user's preferences. At the same time, the CMP writes a cookie called eucon
The data subject was an employee, the controller was the employer. On 14 January 2022, the data subject requested access to personal data from the controller under Article 15 GDPR. They did not respond. On 28 January 2022, the controller terminated the employment. On 17 February 2022, the data subject lodged a complaint with the Data Protection Authority (DPA) under Article 77 GDPR. The data subject alleged that the controller had failed to answer the access request, had taken unauthorised photographs, and had a copy of their vaccination certificate. On 24 February 2022, the employment relationship ended by a court settlement before the Labour Court. The settlement stated that all claims arising from the employment relationship and its termination, whether known or unknown and regardless of their legal basis, were settled, except for employment documents. By entering the settlement, the data subject agreed to not pursue further claims. After the settlement, the controller informed the DPA that it had not received an access request from the data subject, had not taken photographs, and had destroyed the vaccination certificate after the employee left. The data subject continued to raise issues with the DPA, including access to time-tracking data and alleged inaccuracies in the controller’s provided documents. The controller later provided partially redacted time-tracking data. On 26 July 2022, the DPA closed the administrative procedure, as it considered that the data subject no longer had a right of access under Article 15 GDPR because the settlement didn't allow for this claim. The data subject challenged the DPA’s decision before the Administrative Court. On 10 July 2024, the court dismissed the action. The data subject appealed. First, the court held that the right of access under Article 15 GDPR was, in principle, waivable. Although Article 8(2) of the Charter of Fundamental Rights protects the right of access, the court noted that data protection law is base
A data subject owned a vehicle that was involved in a road collision. The data subject’s insurer (the controller) handled the claim settlement and calculated the damages. However, the controller disclosed personal data of the data subject to the other person involved, and accidentally paid part of the compensation meant for the data subject to the other person. The data subject brought a case to the court. The data subject argued that they felt stress and concern for their security as a result of the loss of control over their personal data, and requested compensation. The controller argued that the case should be dismissed, as the data subject failed to identify the legal basis for the claimed amount and failed to indicate whether they were seeking compensation or damages from the proceedings. Furthermore, the controller argued that the data breach occurred due to a human error, and could not have been prevented. The court found a violation of Articles 24 and 32 GDPR. According to the court, the fact that an employee had mistakenly forwarded a document containing a data subject’s data was already sufficient to demonstrate that the controller had not implemented appropriate measures to ensure security of processing. In terms of damages under Article 82(1) GDPR, the fear of misuse or dissemination of their data can be sufficient. Applied to this case, the court stated that the controller caused the data subject non-material damage by transferring an unnecessary amount of data to a third person. Finally, the fact that the data breach happened as a result of a human error was irrelevant. In calculating the damages, the court considered that while the data subject’s fear was justified, the damage was also limited; this is because the data was not made public or processed further unlawfully. Therefore, the court ordered the controller to pay the data subject PLN 1,500 (approximately €350) in damages.
The data subject operated a company that supplied explosives to German security authorities. The controller is a Municipality in Germany. The data subject and the controller were involved in a legal dispute before the Administrative court. In 2025, owing to the sensitive nature of his business, he requested the controller to refrain from transmitting his personal data in unencrypted form, and in 2016 the controller assured him that such transmissions would not take place. Nevertheless, between April 2019 and December 2020 the controller sent several unencrypted documents via fax containing data subject's data to the Administrative Court. The documents consisted of seven acknowledgments of receipt containing the data subject’s surname, case designations and file numbers, but no address, financial, or other sensitive business information. The data subject filed a case before the Regional Court (LG Osnabrück) claiming €17,500 in non-material damages under Article 82 GDPR. He argued that the controller was not allowed to send the faxes in an unencrypted form, but rather send the acknowledgements of receipt exclusively by post. He claimed that if intercepted, such data could potentially reveal his connection to explosives as well as his home address and thereby increase the risk of kidnapping, robbery, or extortion. The Regional Court found an infringement and awarded €7,000 in non material damages. The Higher Regional Court (OLG Oldenburg) upheld this award, reasoning that the controller violated Article 6(1)(f) GDPR, since the data subject's interests worthy of protection outweighed the controller's interest in transferring the acknowledgements of receipt unencrypted by electronic means. The court found that the data subject was exposed to increased abstract risk of criminal offenses against his person due to his professional activity, taking into account that no other person with the same surname lived in that area. It also found a violation of Article 18(1)(d) an
The controller is the operator of a debt collection company that serves clients from the energy sector, among others. On 16 July 2019, the controller notified SCHUFA, a credit information agency, of a claim against the data subject by his electricity supplier that was enforced by an order issued by the local court on the same day. On 12 November 2019, SCHUFA deleted the negative entry made on the basis of a report. The data subject filed a case with the court of first instance (Regional Court Mainz-VG Mainz) claiming that the controller’s notification of the claim to SCHUFA was unlawful because the controller did not wait for the objection period of the enforcement order to expire before doing so. The negative score created by SCHUFA as a result of the controller’s notification led to massive economic consequences and disadvantages for him, including the termination of his credit cards by his bank and the threat of failure of real estate financing. At first instance, the data subject requested, among other things, that the controller be ordered to pay him damages at least €10,000. The court of first instance partially granted his application and ordered the controller to pay him €5,000. Both parties appealed before the court of appeal (Higher Regional Court Koblenz-OLG Koblenz). The court of appeal dismissed the action in full. It held that the data subject failed to demonstrate that compensable immaterial damage had occurred. A mere threat of material damage or the fear of material damage is not sufficient in itself if no further consequences result from this, which was not apparent in the present case and was not substantiated by the data subject. It is not apparent how the alleged termination of his credit cards by the bank actually impaired the data subject’s economic freedom of disposition or how other infringements had occurred his general lifestyle. Overall, he failed to demonstrate how the "damaging event" specifically affected him. The data subject appe
On 24 January 2023, the data subject made a rectification request to the State Secretary for Justice and Security (controller), regarding a report drafted by the Dutch Child Protection Board (Raad voor de Kinderbescherming, RvdK). The report contained the results of a professional assessment of the data subject’s parenting capacity, contributing to the subsequent placement of the child under the supervision of child protection services and out of the data subject’s custody. The data subject argued that the report contained factual inaccuracies, misleading terminology (such as “psychiatric issues”, “substance use”), and painted an incorrect picture of her due to the absence of important events in the timeline of the report. In 16 November 2023, the controller rejected the rectification request. It claimed that the contested data did not qualify as personal data under the GDPR because they were impressions and opinions that had been received in connection with the RvdK's investigation. The data subject made an objection to the decision of the controller. After the reassessment of the request, some terms were adjusted, e.g. “psychiatric issues” was replaced with “psychological issues”. However, the controller rejected the request in part, maintaining that much of the content reflected professional impressions or third-party statements, mainly the opinion of the father of the child, not subject to rectification under Article 16 GDPR. The data subject filed an appeal before the court of first instance (District Court of Midden-Nederland) against the controller regarding the partial rejection of his request. The court found that the disputed data did not meet the threshold for rectification. It held that, from settled case law by the highest administrative court, it follows that not all inaccuracies are eligible for correction under Article 16 GDPR. The inaccuracies must be easy and objective to determine to qualify for rectification. The court held that the cont
In 2021, the data subject concluded a postpaid telecommunications contract with a telecommunications provider (controller), which included a discounted purchase of an expensive mobile phone . The controller transferred the data regarding the registration of the data subjects’ mobile phone contract to SCHUFA, a German credit reference agency. The data are considered “positive data” (i.e. non-adverse contractual information). In September 2023, the contract was terminated. In October 2023, SCHUFA deleted the data about the data subject. The data subject brought legal proceedings against the controller before the court of first instance. They argued that the controller transmitted his data unlawfully as the transmission had occurred without their explicit consent and did not qualify for any other lawful basis under Article 6 GDPR. They also asserted that the controller had not adequately informed them of the transmission. The data subject requested the following relief from the court: a. Non-material damages due to the transfer of their contract data to SCHUFA. b. An injunction preventing future transmission of positive data to SCHUFA. c. A declaratory finding of liability for damages under Article 82 GDPR. d. Reimbursement of legal expenses under GDPR as immaterial damages. They also sought to refer the matter to the CJEU for clarification. The court of first instance rejected the data subject’s claim. In 2024, the data subject appealed the decision before the court of appeal (Oberlandesgericht Koblenz-OLG Koblenz). The court ruled the claim to be wholly unfounded. First, the court decided that the controller lawfully transmitted the data subject’s data to SCHUFA. The controller pursued the legitimate interest of fraud prevention and ensuring creditworthiness assessments (Article 6(1)(f) GDPR), serving the socio-economic interests of the telecommunications industry. More specifically, the court stated that the rights of the data subject at this case ‘
In 2022 the Berlin Administrative Court issued a ruling. The ruling included statements about the plaintiff (the data subject). In particular, the ruling stated that they were in arrears with the payment for their pension plan and that they received unemployment benefits for a while. Non-profit legal database OpenJur (the controller) provided a free digital legal database. In the context of this activity, the controller published the ruling of the Administrative Court in its database. The controller did not remove the data subject's name from the ruling before publishing. The data subject found the ruling on the database and requested the controller to remove it. The controller anonymized the ruling by removing the data subject's name but refused to remove the ruling. The data subject filed a lawsuit with the Regional Court of Hamburg. They claimed for damages and sought an injunction for the controller to remove the ruling from the database. First, the Court clarified that the controller's activities were journalistic in nature and, therefore, fell within the scope of Art. 85(2) GDPR (national exemptions for journalistic activities) and the relative German laws[1]. In this regard, the Court noted that the controller did not simply publish rulings. On the contrary, the controller carried out an editorial activity by choosing the decisions to publish, requesting unpublished decisions from courts, and providing summaries for the decisions. Then, the Court clarified that the controller's activities were lawful under national law. In particular, the Court noted that the Berlin Administrative Court was a "privileged source" of information. The Hamburg Court held that in relying on such a source, the defendant acted justifiably and was under no obligation to conduct subsequent research[2]. For these reasons, the Court dismissed both the damage claim and the request for injunctive relief.
The EDPS brought an appeal against an order of the General Court ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=277141&pageIndex=0&doclang=en&mode=req&dir=&occ=first&part=1 T 578/22]) which ruled that an action for annulment brought by the European Data Protection Supervisor (EDPS) against Articles 74(a) and 74(b) of [https://eur-lex.europa.eu/eli/reg/2016/794/oj/eng Regulation (EU) 2016/794] as amended by [https://eur-lex.europa.eu/eli/reg/2022/991/oj/eng Regulation (EU) 2022/991] was inadmissible. The General Court had found that the EDPS did not enjoy the locus standi enjoyed by Member States and on certain EU Institutions as in [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12012E/TXT:en:PDF Article 263(2)-(3) TFEU], and may only challenge the validity of the contested provision if they fulfil the conditions laid down [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12012E/TXT:en:PDF Article 263(4) TFEU]. The EDPS had claimed that the contested provisions had the effect of retroactively legalising certain practices of the European Union Agency for Law Enforcement Cooperation (Europol) in the field of data protection, against which the EDPS had found its decision of 3 January 2022. The provisions confer on Member States the possibility to retroactively authorise Europol to process large data sets which have already been shared with Europol prior to the entry into force of the amending Regulation. This, the EDPS claimed, impacted their independence. In their appeal, the EDPS argued that the General Court should have recognised their right to legal standing to challenge the contested decision, irrespective of the requirements of [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12012E/TXT:en:PDF Article 263 TFEU]. The failure to do so, they argued, would deprive an independent supervisory authority, within the meaning of Article 8(3) of the Charter, of the right to proceedings before a court to protect in
The data subject is an employee of the controller, a Germany-based company, belonging to an international Group whose parent company is based in the US. In 2017, the Group introduced a new cloud-based HR software for testing, as a new uniform personnel information management system throughout the group. The provisional agreement for the new software stipulated that its use for personnel administration during the test period was prohibited and that and only certain personal data could be used at that point like surname, first name, date of joining the Group, place of work, business telephone number. Contrary to the agreement, the controller uploaded the data subject’s, salary information, private residential address, date of birth, marital status, social security number, nationality and his tax ID to the Group’s cloud which were processed there till 2019. The data subject filed a case before the Labour Court claiming that the processing of real personal data was not necessary for testing purposes but rather so-called dummy test data was sufficient for the test phase. In any case, the controller processed data beyond what was permitted in the agreement. He claimed compensation in non material damages in the amount of €3,000. The Labour Court (ArbG Ulm) dismissed the action and the Regional Labor Court (LAG Baden-Württemberg) dismissed the data subject’s appeal. In 2022, the data subject further appealed this judgement before the Federal Labour Court. The Federal Labour Court, requested a preliminary ruling from the CJEU on legal questions concerning the interpretation of Article 88(1) GDPR in connection with agreements for the purposes of employment pursuant to the Federal Data Protection Act (BDSG) Section 26 para. 4 Federal Data Protection Act (BDSG). The CJEU ([https://curia.europa.eu/juris/liste.jsf?language=de&jur=C,T,F&num=C-65/23 C-65/23]) stated that that national rules adopted for the processing of personal data in the employment context must comply
The data subject booked a train ticket from the controller for travel on 16 October 2022. During the journey, their ticket was scanned during routine inspection. On 19 October 2022, the data subject filed an access request under Article 15 GDPR, seeking a full copy of all personal data related to the ticket, including how, when, and on which trains the ticket was used, and whether it had been validated. The controller responded by providing booking data but did not include details from the ticket inspection ("inspection data"). According to the controller, inspection data are generated when staff scan tickets. These records contain the ticket order number, time of inspection, train number, and scanner ID. They are used in a background system for plausibility checks (e.g. reuse or use of cancelled tickets) but are not linked to a name or passenger by default. Only in case of anomalies are inspection data connected to booking records (which include names). No such anomalies occurred in the data subject's case, and therefore no linkage between the inspection and booking datasets was established. The datasets are deliberately stored separately for privacy reasons. Despite this, the data subject insisted that the information about the ticket inspection and any validation constituted personal data, and filed a lawsuit seeking full access, including any data revealing actual ticket usage. They also demanded a sworn statement of completeness and proposed referring questions about the German Civil Code to the CJEU. The court held that the access right under Article 15 GDPR did not extend to the inspection data in this case. These records could not be considered personal data of the data subject because no identifiable linkage to them had actually occurred. Although the order number can technically be used to identify a person, such linkage only happens in case of anomalies (e.g. suspected fraud). Since none were present, the data remained unlinked and, in the court’s view,
In September 2019, the data subject submitted an access request to the controller, the German Tax Authority (Finanzamt – FA), under Article 15(1) GDPR and Article 15(3) GDPR. The controller responded by providing him with his personal data. The data subject deemed the information incomplete and repeated the request asking for copies of enforcement measures. In December 2019, the controller rejected the request for copies of enforcement related data with a formal decision, which did not include any information on legal remedies. On 25 February 2021, the data subject filed an action against the decision of the controller with the Fiscal Court (Finanzgericht Nürnberg), requesting that the controller be ordered to provide information on his personal data within the meaning of Article 15(1) and 15(3) GDPR and claiming that restrictions under national procedural rules conflicted with EU law. The Fiscal Court dismissed the action as inadmissible for exceeding the statutory time limit. The data subject appealed to the Federal Fiscal Court (Bundesfinanzhof – BFH), claiming that the GDPR does not set a deadline for bringing an action and could be brought at any time as in civil proceedings. He further claimed that no prior administrative proceedings were required since it is an action for performance. In any case the action for the provision of information pursuant to Article 15 GDPR may not be restricted by the requirements for bringing an action in the Fiscal Court Code (FGO). The Court dismissed the appeal and upheld the lower court’s finding that the claim was time-barred and procedurally inadmissible. It held that the response of a public body to an access request under Article 15 GDPR constitutes an administrative act. Therefore the action to compel a public body to provide a response is subject to the FGO. According to the FGO, when a data subject receives a negative decision from an administrative body with no legal remedy instruction provided, such as the rejec