GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 21 October 2026 · Updated daily
CJEU case C-154/21 Österreichische Post (Information regarding the recipients of personal data)
A data subject sent an access request to the Austrian Post (the controller) to obtain information about what personal data about him was processed as well as whether it was disclosed to third parties, and if yes, who these recipients were. The controller provided a generic response regarding the recipients of personal data, only referring to a general website naming activities of the recipients, such as telephone directories or marketing actors. The controller did not inform the data subject about the specific identity of the recipients. Consequently, the data subject took action before Austrian courts in order to obtain information about specific recipients. Both the court of first instance and appeal dismissed the action by stating that Article 15(1)(c) GDPR gives the controller disrection to choose whether they wish to provide information about 'recipients' or 'categories of recipients' only. In the meantime, the controller provided information with regards to the categories of recipients, which included charities, NGOs and political parties, but refused to reveal their identity. The Austrian Supreme Court decided to refer the matter to the Court of Justice of the European Union (CJEU, the Court) in order to obtain clarification on the interpretation of Article 15 GDPR. The Supreme Court asked the following preliminary question: 'Is Article 15(1)(c) of the GDPR to be interpreted as meaning that the claim is limited to information on categories of recipients if specific recipients have not yet been determined in the case of planned disclosures, but the right to information must necessarily also extend to recipients of these disclosures if data have already been disclosed?' Advocate General Pitruzzella noted that provisions of EU law must be interpreted in a way as to ensure their effectiveness. Since Article 15 GDPR provides a genuine right of access, it is a necessary pre-condition for the exercise of other data subject rights under the GDPR. Moreover, it follows from the contextual reading of Article 19 GDPR, that the controller must inform data subjects of specific recipients of their personal data. However, since the right to data protection is not absolute, the right to receive information on specific recipients may be limited to categories of recipients if the controller proves that the data subject request was manifestly unfounded or excessive (Article 12(5)(b) GDPR). The CJEU agreed with the reffering court that it was unclear from the wording of Article 15(1)(c) GDPR whether there is a relationship of priority between ‘recipients’ and ‘categories of recipients’ as they are listed side by side. However, from the context in which the provision is placed as well as the reading of Recital 63 GDPR, the data subject must have a right to know and be informed, in particular of the recipients of personal data. The Court pointed out Recital 63 GDPR does not mention that this right can be limited to only categories of recipients. Further, the Court noted that any processing must comply with Article 5 GDPR, including the principle of transparency (Article 5(1)(a) GDPR). Following the Opinion of the Advocate General, the CJEU held that, unlike Articles 13 and 14 GDPR, Article 15 GDPR provides an actual right of access (not just right to information) for the benefit of the data subject so that they must be able to choose whether to be provided with information on specific recipients or with information on categories of recipients. Furthermore, the right of access necessary to exercise other data subject rights effectively and to obtain remedies. Thus, the data subject must have the right to be informed of the identity of the specific recipients when their personal data have already been disclosed. According to the CJEU, this interpretation is confirmed by Article 19 GDPR. Namely, the data subject has the explicit right to be informed by the controller of the specific recipients of the data concerning him or her, as part of the controller's obligation to inform all recipients of the exercise of the rights that the data subject has under Articles 16, 17(1) and 18 GDPR. The Court also made reference to Recital 10 GDPR and [https://fra.europa.eu/en/eu-charter/article/8-protection-personal-data Article 8 of the Charter of Fundamental Right of the EU.] From the objectives of the GDPR, which include safeguarding the right to data protection, it follows that that the data subject also has the right to obtain from the controller information on the specific recipients to whom personal data concerning him or her have been or will be disclosed in the future. However, the right to data protection is not absolute and and requires a balance of interests at stake. Hence, the right of access may be limited to information on categories of recipients if it is not possible to communicate the identity of the concrete recipients, especially if they are not yet known. Additionally, the Court held, in line with Article 12(5)(b) GDPR, the controller may only inform about categories of recipients if the request is manifestly unfounded or excessive. In conclusion, the CJEU held that a controller is obliged to provide the data subject with the actual identity of recipients, unless it is impossible to identify those recipients or the controller demonstrates that the data subject’s requests for access are manifestly unfounded or excessive.
Court case C/16/536914 / HA RK 22-78
The controller is a Dutch public broadcaster. On their website, they offer a forum, on which registered people can post articles and respond to other articles. The data subject was since 2015 a member of the form and published over 20.000 posts on the forum. On 14 June 2021, the data subject requested access to the posts, in which, according to the controller, he was guilty of picking a personal fight and writing an off-topic post. On 3 February 2022, the controller banned the data subject, because of a fight with another member on the forum. On 21 February 2022, the data subject requested access to information on which house rules he allegedly broke, the messages that allegedly broke these house rules, the opening post of the topic and other posts by others, insofar as they are relevant to establish the violation, any comments on the posts, the comments made by this third party about the data subject that also violated the house rules. On 7 March 2022, the data subject repeated his access request to the controller. On 25 March 2022, the data subject started an action by application (“verzoekschrift”) at the the District Court of First Instance of Central Netherlands (“Rechtbank Midden-Nederland”). The data subject requested the court to order the controller provide a copy of his personal data as requested in his access request, but also all the information under Article 15(1) GDPR. The data subject further requested the court to impose a penalty. The controller argued that the data subject had no right of access, because the data subject’s profile name was not personal data. As it was a pseudonym and not the actual name of the data subject, the data subject was not identifiable. Moreover, the controller invoked journalistic exception under [https://wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=43&z=2018-05-25&g=2018-05-25 Article 43 of the Dutch national implementation law of the GDPR] (“Uitvoeringswet Algemene verordening gegevensbescherming – UAVG
Klarna Bank AB
A data subject submitted an access request to Klarna Bank AB (the controller). However, the controller did not provide all the requested personal data, including information regarding recipients to whom personal data of the data subject had been disclosed. After an unsuccessful follow-up request, the data subject filed a complaint with a German DPA. The complaint was transferred to the Swedish DPA in an Article 60 GDPR procedure. The Swedish DPA held in decision DI-2021-10263 that the controller should provide information about the actual recipients, not only categories of recipients, when the data subject expressly requests it. The DPA reached this conclusion by interpreting Article 15(1)(c) GDPR in light of the principles of fairness and transparency (Article 5(1)(a) GDPR) as well as the provision under Articles 19 GDPR. Thus, the DPA reprimanded the controller for a violation of Article 15 GDPR. The controller appealed this decision before the Stockholm Administrative Court. The controller argued, among others, that Article 15(1)(c) GDPR should be interpreted as allowing the controller to choose whether to give access to categories of recipients or specific recipients in a manner similar to the information requirements in Articles 13(1)(e) and 14(1)(e) GDPR. The Stockholm Administrative Court (the Court) recalled that Article 15 GDPR gives an individual the right to be informed as to whether a controller is processing personal data relating to them and, if so, to be provided with tailored information about the processing. The Court stated that it is up to the data subject to make the choice whether to exercise their right to know the recipients or categories of recipients to whom personal data were disclosed. The Court held that Article 15(1)(c) GDPR must be interpreted as obliging the controller to satisfy the data subject's request to the best of its abilities. If the data subject expressly requests access to information regarding the actual recipients of
Court case W176 2247074-1
The controller's business was the assessment of individuals' creditworthiness. For this purpose, the controller stored personal data in a database. One of these individuals was the data subject. In addition to the data subject's personal and address data, the controller saved a note about the data subject's bankruptcy proceedings in its database. Based on the outcome of such proceedings, the data subject's bankruptcy payments had to be concluded by 2018. In 2019, the data subject requested the controller to delete all negative entries related to his the creditworthiness. The controller rejected the request. Subsequently, data subject lodged a complaint in 2020 which, essentially, focused on the (i) rights to rectification (Article 16 GDPR), (ii) right to erasure (Article 17 GDPR), (iii) right to restriction of processing (Article 18 GDPR), and (iv) right to object to processing (Article 21 GDPR). All rights used by the data subject served the overarching goal of stopping or limiting the controller's processing. Moreover, the data subject argued that after three years of the conclusion of bankruptcy proceedings and after the related payments had ended, credit assessment companies have to delete an affected data subject's personal data. (It was unclear on what basis the data subject came up with the time span of three years.) The controller responded that the right to data protection had not been breached. In regards to (i) the rectification request, the controller reasoned that as interests of the parties would have to be balanced, a three year retention period could not simply be assumed. In regards to (ii) the right to erasure, the controller based the legitimacy of its processes on the sanctioning of the process through Austrian national law, namely, [https://www.ris.bka.gv.at/Dokument.wxe?Abfrage=Bundesnormen&Dokumentnummer=NOR40032660 § 152 GewO], which regulates the disclosure of information by credit ranking agencies, and [https://www.ris.bka.gv.at/eli/rgbl/
Rotterdam Municipal Board
The plaintiff, in search of employment, participated in a reintegration program managed by the Board. Believing the program was providing insufficient assistance, they requested access and further rectification to all the personal data related to 'monitoring', 'logging', 'control', and 'detection' for the period from January 6, 2017, to January 6, 2018. While providing the documents in their possession, The Board stated they do not have any data in relation to the access request and further rejected the request for rectification on 7 July 2021, citing that they are not obliged to rectify professional opinions and impressions. The plaintiff objected to the rejection of their requests, which the Board declared inadmissible and partly unfounded on 18 February 2022 through a decision. In the case at hand, the plaintiff appealed the aforementioned decision. Access to Data (Article 15 GDPR): The court held that the board conducted a reasonable search and provided all available documents. The mere suspicion of additional data was not sufficient to prove they existed, and the burden of proof of such documents lied with the plaintiff. Right to Rectification (Article 16 GDPR): The court agreed with the board that professional opinions, impressions, and conclusions are not subject to rectification. The data the plaintiff wanted to rectify fell into this category and could not be altered. Procedural Conduct: The court found that any delay in the board's decision-making was reasonable under the circumstances and in accordance with existing procedural law and cases. Conclusion: The court dismissed the plaintiff's appeal, ruling that the board had complied with its obligations under the GDPR. The plaintiff was not entitled to further data access, rectification, or compensation. Thus, the court rejected the claims for damages, including those based on alleged violations of the GDPR and delays in the procedure. The court also declined to refer preliminary questions to the Court of Justice of the European Union, stating it was unnecessary for resolving the case.
Court case 8 U 165/22
The case concerned, among other things, a data subject's Article 15 GDPR access request to acquire supplementary information about their increased insurance premiums from their private health insurance provider. The health insurance provider was the concerned controller in this case. As, at the time being, had often been the case in Germany, the court of first instance (in this case, the Regional Court Stade), had held that the access request was "excessive" since, contrary to Recital 63 GDPR, the request did not serve to further data protection related matters. Therefore, the lower court had had decided that the controller had a right to refuse the request under Article 12(5)(b) GDPR. The data subject appealed the decision. OLG Celle, a court of second instance, overturned the decision of the lower court in respect to its holding on the excessiveness of the data subject's access request. Contrary to the Regional Court of Stade, OLG Celle argued that Recital 63 GDPR - which states that the purpose of the right to access is to make data subjects aware of the processing of their personal data and to give them the possibility to verify the lawfulness of the processing - only mandates that the requested information concerns personal data in the sense of Article 4(1) GDPR. Moreover, OLG Celle also held that a singular access request can never be excessive for the purposes of Article 12(5) GDPR as the GDPR only described the case of frequent repetition as a standard example for the assumption of an excessive application. Moreover, OLG Celle stated that the GDPR does not have any requirements which data subjects have to meet to justify their access requests. "The motivation of the plaintiff is irrelevant because the regulation does not make the right to information dependent on a specific objective of the claimant and accordingly the access request does not have to be substantiated", so the court. Consequently, OLG Celle overturned the decision in this respect.
jameda GmbH
The controller is a private company, running a compare-and-review website for healthcare practitioners. The data subject is a dentist, whose personal data (name, academic title, field of practice, address, and telephone number of the office) was published through an online profile of her on the controller's website. The data subject did not consent to this data processing. Pursuant to Article 17(1)(d) GDPR, the data subject requested that the profile on the website of the controller should be deleted. The controller did not comply with the request. Consequently, the data subject brought the case to court. The courts of first and second instances held that, in view of the current design of the rating portal, the data subject was neither entitled to the deletion of the profile nor to an injunction against the publication of such a profile. There was no unlawful data processing by the controller since the weighting of the conflicting interests required by Article 6(1)(f) GDPR was in favour of the controller. The data subject decided to appeal the case again on the same grounds. This time to the German Federal Court of Justice (Bundesgerichtshof - BGH). The German Federal Court of Justice confirmed the decision of the previous courts. It held that the data processing was lawful upon Article 6(1)(f) GDPR since the interests of the data controller and the general public outweighed the interest of the data subject. By collecting, storing and passing on the ratings, the data controller provides the public using the portal with an insight into personal experiences and subjective assessments of patients of the respective practitioner, which readers can take into account in their own choice. Moreover, the controller's business model was supported by the right to conduct a business pursuant to Article 16 CFR. Additionally, pursuant to Article 11 CFR, the general public has a right and interest to freely express their opinions. The court also held that the rating of practitioners was lawful since, in their professional sphere, practising healthcare professionals must be prepared for observation of his conduct by the wider public because of the effects his activity has on others, and for criticism of his performance.
Court case PVN-2022-14
A company (the controller) inspected the e-mail inbox and automatically forwarded an e-mail of its former employee (the data subject) after she had objected to processing of her personal data under Article 21 GDPR. The data subject filed a complaint with the Norwegian DPA, claiming that there was no legal basis for accessing and processing her e-mails in such a form. The DPA initiated proceedings and asked the controller for explanation. After not receiving any information past the deadline, it rendered a decision. The DPA held that automatic forwarding of the contents of the data subject's e-mail box could not be based on Article 6(1)(f) GDPR nor any other valid legal basis. The controller did not comply with its duty to carry out a balancing of interests after the data subject had objected to the processing, under Article 21 GDPR. Finally, the DPA held that the controller did not comply with its duty to inform the data subject of the forwarding of her e-mails, violating Article 13 GDPR. The DPA concluded that the infringements were intentional and serious. Hence, the DPA imposed a NOK 100,000 fine on the controller. It also ordered the controller improve internal control and routines for access to employees' and former employees' e-mail boxes. The controller appealed this decision to the Norwegian Privacy Appeals Board (Privacy Board). First, the Privacy Board considered whether the DPA had been correct in imposing a fine on the controller. It recalled that Article 83(1) GDPR obliges DPAs to ensure that the imposed fines are effective, proportionate and dissuasive. In this regard, the Privacy Board held that illegal forwarding of e-mails is a violation of the basic principles of lawfulness and transparency (Article 5(1)(a) GDPR). When basic rules for the protection of employees' privacy are disregarded as in this case, the violations must be regarded as serious. Therefore, the DPA was correct to impose a fine on the controller. Second, the Privacy Board conside
WhatsApp Ireland Ltd
Following the entry into force of the GDPR, the Irish DPA received complaints from users and non-users (the data subjects) of the ‘WhatsApp’ messaging service concerning the processing of personal data by WhatsApp Ireland Ltd (the controller). The Irish DPA, in its capacity as lead supervisory authority, started an investigation into the controller’s compliance with the obligation of transparency and the obligation to provide information with regard to individuals. Following that investigation, the Irish DPA submitted a draft decision to all the other supervisory authorities of the Member States concerned. Since no consensus was reached on that draft, the Irish DPA referred the matter to the European Data Protection Board (EDPB). On 28 July 2021, the EDPB adopted a binding decisionbinding decision 1/2021 of the EDPB of 28 July 2021, in which it ruled on the matters which, in its view, had been the subject of relevant and reasoned objections by some of those authorities. After receiving that decision, the Irish DPA adopted a final decision on 20 August 2021, in which it found that the controller had infringed certain provisions of the GDPR. The Irish DPA imposed corrective measures on the controller, in particular administrative fines for a cumulative amount of €225 million. The controller, in parallel, challenged the final decision before an Irish court and requested that the Court annul the contested decision in its entirety or, in the alternative, annul the relevant parts of that decision. As a preliminary point, the Court mentioned three conditions that must be met for an applicant (other than the ‘privileged’ applicants pursuant to Article 263(2) TFEU) to challenge an act, where it is not the addressee. First, the act must have binding legal effects capable of affecting the interests of the applicant by bringing about a distinct change in his legal position. Second, the act must be of direct concern to the applicant and, third, the applicant must be individually concerned by that act. = In that regard, the Court considered that the contested decision did not in itself change the controller’s legal position. Unlike the final decision of the Irish DPA, the contested decision was not directly enforceable against the controller. It constituted a preparatory act in a procedure, which must be closed by the adoption of a final decision. Moreover, the Court held that the contested decision had no legal effect against the controller that was independent of the final decision of the Irish DPA. All the assessments made in the binding decision were repeated in the final one, and the binding decision had no effect that was independent of the content of the final decision. Thus, the fact that an intermediate act expressed the definitive position of an authority that would have to be taken up in the final decision, did not necessarily mean that that intermediate act itself changed the applicant’s legal position. = The Court noted that, in the light of the nature of the contested act, which is an individual act, the controller was individually concerned by the contested decision. It related to certain aspects of a draft final decision of the Irish supervisory authority concerning it specifically. Contrary to what was argued by the EDPB, the contested decision was not limited to setting out principles or the interpretation of certain provisions of the GDPR that might concern any controller. In the contested decision, the EDPB ruled on the controller’s compliance with some of its obligations under the GDPR, regar a form of processing carried out solely by WhatsApp, and rules on certain corrective measures to be imposed on WhatsApp, in particular on certain aspects of the determination of the administrative fines to be imposed on it. The contested decision is thus specific to the controller. Even though it included a statement or reiteration of principles and interpretations of a general nature. = Next, the Court observed that the controller was not directly concerned by the contested decision. The Court noted that a measure was of direct concern to an applicant who is not an addressee, if it (1) directly affected that applicant’s legal situation and, (2) left no discretion to its addressees, who were entrusted with the task of implementing it. Such implementation being automatic and resulting from EU rules without the application of other intermediate rules. Regarding the first condition, the Court recalled that the contested decision was not enforceable against the controller in a way that would impose obligations on the controller without further procedural steps. The Court held that, the contested decision was not the final step of the full procedure provided for by the GDPR. With regard to the second condition, the Court found that it left a measure of discretion to the Irish DPA as to the content of the final decision, in particular to establish the amount of the administrative fines. Lastly, the Court noted that the inadmissibility of the controller’s action was consistent with the logic of the system of judicial remedies established by the TEU and the TFEU. The Court stated that the TFEU established a complete system of legal remedies designed to ensure judicial review of the legality of acts of the European Union, in which the national courts also participate. In particular, the possibility of bringing a direct action for annulment before the CJEU, or of making a request for a preliminary ruling. Individuals can challenge the validity of such an act before the national court. The national court, in turn, was able to make a request to the Court of Justice for a preliminary ruling. Individuals can however not, by reason of the conditions for admissibility, directly challenge EU acts before the Courts of the European Union. The Court stated that the logic of that system was that the judicial action of the Court of Justice of the European Union and that of the national courts complement each other effectively. The Courts of the European Union and the national courts should not be required to rule concurrently, in parallel proceedings, on the validity of the same EU act. In conclusion, the Court, for the first time, ruled on an application for annulment of a binding decision of the EDPB. The Court dismissed the action brought by the controller as inadmissible, because (1) it was not directed against an act that is open to challenge under Article 263 TFEU and (2) the controller was individually, but not directly concerned by the contested decision, within the meaning of the criteria for locus standi laid down in that article. The validity of the contested decision may be examined by a national court hearing an action against the subsequent final decision that closes the procedure and is adopted at national level.
Court case 2022/AR/556
On 4 April 2022, the Belgian DPA issued [https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-47-2022.pdf decision 47/2022], in which it fined Charleroi Airport €100,000 for the use of thermal cameras and temperature checks for COVID-19 detection purposes. The DPA held that the controller lacked a lawful ground for processing these special category data, see the [https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_47/2022 GDPRhub summary]. The controller appealed this decision with the Market Court. The controller questioned the impartiality of the DPA by referring to several reports in the national press. These reports showed an appearance of partiality, according to the controller, which was enough to call the decisions of the DPA into question. The nature of these news reports were not specified in the ruling. The controller further argued that the DPA had misued its powers. According to the controller, the DPA had stated multiple times in the press that the controller did not have a legal basis for its use of thermal cameras. However, the DPA did not issue any opinion of give recommendations to the controller so that it could improve its processing. The controller stated that it would have followed the instructions of the DPA if the DPA had taken a clear position regarding the legality of the controller's processing. The controller had also requested the anonymization of the decision. Despite this, the decision was published alongside a press report. According to the controller, the choice to publish a non-anonymised decision and to publish press report alongside it constituted a misuse of power by the DPA. The controller also stated that the DPA had misued its powers with regard to the determination of the fine. The controller also argued that the DPA did not properly apply the criteria described in Article 83 GDPR for determining the fine and had not consulted the EDPB Guidelines regarding Article 83 GDPR ([htt
Court case 12 U 305/21
The defendant (and simultaneously controller) is a private company which provides health insurance services. The plaintiff (and data subject) is one of their costumers. Under the insurance agreement, the defendant could adjust the insurance premiums. At an unspecified time, the defendant decided to do so. In response, the plaintiff sought information from the defendant about the increased contributions. He requested information and documents regarding all contribution adjustments from January 1, 2011. The defendant refused the request. Subsequently, the plaintiff engaged in court proceedings. He argued that even though he had a statement of reasons, a document provided by the controller which outlined the reasons for the premium increases, he had lost the insurance certificates and accompanying documents from the years 2011 to 2020. This information would be necessary to calculate whether the increase of insurance premiums was legitimate. The plaintiff based his right to receive information, among other things, on Article 15 GDPR. The court of first instance decided to reject the claim and argued that Article 15 GDPR only provides data subjects with the right to have summaries of their processed personal data but not concrete documents, files or records. The data subject decided to appeal the court's decision. The court of appeal upheld the decision of the lower court by stating that the concerned access request cannot be supported by Article 15 GDPR. First, it pointed out that, according to Article 15 GDPR, controllers must provide a data subject with the personal data which is processed by them. The right of the data subject to receive information serves the purpose of becoming aware of the processing of the data and to check its lawfulness. Second, the court deemed the plaintiff's use of Article 15 GDPR an "abuse of rights". The court argued that the purpose of Article 15 GDPR was for data subjects to obtain an overview of the personal data processed by
Court case LEE 22/1758
A data subject received a letter from the Dutch Ministry of Finance (controller) stating that they (the data subject) had been included in the Fraud Identification Facility (FSV), a filing system used by the controller. In the letter the controller elaborated further that the FVS did no longer exist and informed the data subject of the possibility to access their data as well as the possibility of them having suffered damages due to inclusion in the FSV. The data subject filed an access request with the FSV. On 19 October 2022 the controller answered to the data subject’s request, providing an overview of all their personal data contained in the FSV in accordance with Article 15 GDPR. The data subject considered this answer as incomplete and appealed this decision stating that they want to know the reason for being included in the FSV as well as that they have suffered damages from being wrongly included. In its defence, the controller stated that the platform did no longer exist, it was therefore not possible to find out how the information ended up in the system. The court held that the data subject had to prove the existence of further information than what was included in the answer to the access request. In this case, the data subject did not sufficiently demonstrated the existence of further personal data than provided by the controller. The court found the appeal to be unfounded.
Court case PVN-2022-12
The parent of a school pupil (the data subject) was concerned that the municipality (the controller) violated children's privacy rights on a number of occasions. The parent sent a request to the controller under Article 15 GDPR, to access the data subject's student file but the request was denied. The parent informed the Norwegian DPA about this rejection as well as the alleged violations on behalf of the controller. She believed to be exercising her right under Article 77 GDPR to lodge a complaint with a supervisory authority. The DPA did not open an investigation into the individual complaint but advised the parent to contact the controller's data protection officer. Later on, the parent was informed that the DPA had started an ex officio investigation into the controller's routines for internal control and information security. The DPA stated that that the questions put to the controller were related to the municipality's duties as data controller, and not to the data subject's rights. The DPA completed the investigation and proceedings without an order or fine against the controller. The parent complained to the DPA about this decision using an internal administrative appeal, which is possible under the Norwegian [https://www.sdir.no/en/shipping/legislation/laws/procedure-in-cases-concerning-the-public-administration/ Public Administration Act]. However, the DPA rejected this complaint by stating that the parent was not a party to the ex officio investigation against the controller and could not appeal the decision. Under a national administrative law procedure, the parent's case was referred to the Norwegian Privacy Appeals Board (Privacy Board). The Privacy Board had to assess whether it was correct of the Norwegian DPA to reject the parent's complaint. It recalled that the DPA chose to open an ex officio investigation. In these proceedings, no individual decision was made, as the DPA, after obtaining the controller's explanation, gave guidance and then closed the case without giving any order. Neither the municipality nor others had the right of appeal under the [https://www.sdir.no/en/shipping/legislation/laws/procedure-in-cases-concerning-the-public-administration/ Public Administration Act] against this decision. However, the Privacy Board considered whether the DPA had acted lawfully when it received a notice or a complaint about possible data protection rights breaches, but decided to process the case further without treating the data subject as a party. The question of the individual's right to be recognised as a party to proceedings under the GDPR was considered in a case before the Förvaltningsrätten in Stockholm ([https://gdprhub.eu/index.php?title=FiS_-_13308-22 Case 3308-22]). Förvaltningsrätten pointed out that it is incompatible with EU law if the individual, by not being recognised as a party to the case, would be in a disadvantageous position with regard to their rights under the GDPR. According to the Privacy Board's assessment, the situation was different in this case. The Privacy Board considered that the Norwegian DPA acted reasonably in assuming that the parent's inquiry was a general notice about the controller's handling of personal data, not a complaint under Article 77 GDPR. The Privacy Board held that the fact that the data subject's parent was not satisfied with the DPA closing the case without issuing an order, did not change her status in the ex officio investigation (to which she was not a party), nor did it give her any right to appeal. Consequently, the Privacy Board dismissed the appeal.
Court case UTR 21/2729
The data subject used to be an employee at the municipality (controller) until 8 July 2008. On 6 May 2021, the data subject requested rectification of all changes made until this date in their files. The central question of this ruling is whether or not the data subject's request could be seen as a rectification request within the meaning of the GDPR. The court ruled that the data subject’s request to rectify changes made to his employee file could not be classified as a request within the meaning of Article 16 GDPR. The court stated that Article 16 GDPR is limited to rectifying incorrect personal data and completing personal data which is incomplete. The court stated that this was not the initial intention of the data subject, who only made his request more specific at the hearing for this ruling. However, even with this clarification, the data subject was not able to prove that his request was a rectification request within the meaning of Article 16 GDPR. The court also noted that the request did also not qualify as a request for getting access to personal data (Article 15 GDPR), erasing personal data (Article 17 GDPR) or restricting the processing of personal data (Article 18 GDPR). The court concluded that the data subject's request was not a request within the meaning of the GDPR. Therefore, a (lacking) response from the controller to this request was not a "decision" (Besluit) within the meaning of Article 6(2)(b) of the General Administrative Law Act (Awb), a Dutch administrative law provision. The data subject's request itself could also not be regarded as an "application" (aanvraag) in the sense of Article 1(3)(3) Awb either. Because of the fact that both the request from the data subject, as well as the (lacking) response from the controller did not fall under these national provisions, the appeal was deemed inadmissible by the court.
Mollie (data controller)
The data subject was the director of two foundations engaged in activities with regard to the Islam. Foundation 1 focussed on, among other things, arranging funerals in accordance with Islamic rules. Foundation 2 focussed on promoting and disseminating knowledge about the Islam. The data subject was also the Ultimate Beneficial Owner (UBO) for both foundations.see comment Both foundations used Mollie B.V. (the controller) as a payment service provider. To be in compliance with the Money Laundering and Terrorist Financing (Prevention) Act (Wwft),Mollie B.V. conducted a customer due diligence, where it requested and obtained data on the data subject in his capacity as the UBO for both foundations. Following a periodic inspection, the controller terminated its services to both foundations. It stated that the account was no longer a good fit due to recent changes in legislation and its internal policies. Later, the controller informed Foundation 1 that the service was terminated, partly due to its affiliation with foundation 2, as it had become aware that foundation 2 might have used its payment system for improper purposes. Foundation 1 contested the termination in court. However, in a preliminary ruling, the Court held that the controller lawfully terminated the contract. The data subject then submitted multiple access requests with Mollie B.V. which, in turn, denied all of them. Therefore, the data subject brought the matter before the court. The data subject requested the Court to order the controller to provide him with all personal data relating to him in the context of the customer due diligence. More specifically data relating to him (i) in his capacity as UBO, (ii) regarding signals received by the controller, (iii) regarding transactions, and (iv) regarding the risk profile drawn up and risk classification. The data subject further requested the purposes for processing, the categories of personal data concerned and the recipients of his data. In addition,
Proximus NV
Proximus, a provider of telecommunications services provider in Belgium, also provides telephone books and telephone enquiry services for the public (hereinafter "directories"), according to the Law about Electronic Communication. These directories contain the name, addresse and phone number (hereinafter "information") of the different public telephone services providers (hereinafter "operators"). Other directories, published by third parties, exist. The information of these subscribers are communicated regularly to Proximus by the operators, except those of subscribers who expressed their wish not to appear in the directories published by Proximus. In Belgium, the distinction between the subscribers who want to appear in a directory and those who don't, is in practice expressed by assigning a code in the registration of each subscriber, namely "NNNNN" to the subscribers whose information can appear, and "XXXXX" to the subscribers whose information stays confidential. Proximus transmits the information it receives to other providers of directories. The complainant is a subscriber of the telephone service operato Telenet, who is active on the Belgian market. Telenet does not provide directories but transmits the information of its subscribers to providers of directories, among them to Proximus. The 13th January 2019 this subscriber demanded Proximus not to have appear his information in the directories published either by Proximus or by third parties. Following this demand, Proximus modifiier the status of this subscriber in its information system, so that the information of that subscriber should not made public any more. The 31st January 2019, Proximus received from Telenet a periodic update of the data of the subscribers of the latter. This update contained new data of the concerned subscriber, which were not indicated as confidential. This information was handled automatically by Proximus and were registered in a way that they appeared again in the directory of this latter. The 14th August 2019, after having found that his phone number was published in the directories of Proximus and of third parties, the concerned subscriber demanded again from Proximus not to have his data appear. The same day, Proximus responded to the complainaint that it deleted his data of the directories and contacted Google that the relevant links to the Internet site of Proximus be deleted. Proximus also informed this subscriber that it transmitted his information to other directory providers and, thanks to the mothly updates, these providers were informaed about the demand of the complainant. At the same time, the above mentioned subscriber sub,itted a complaint eith the APD against Proximus, on the basis that, in spite of his demand that his information should not appear in the directories, his phone number appeared notwithstanding in certain of these directories.. The 5th September 2019, the concerned subscriber and Proximus had other exchanges concerning the publication of the data of this subscriber in the directory of third parties. In this context, Proximus underlinet that it transmits the information of its subscribers to other providers of directories, but it has no view about the internal operating procedures of these providers. The 30th July 2020, after a contradictory procedure, the "chambre du contentieux" (the administrative conflict resolution body of the APD) has adopted a decision imposing on Proximus corrective mesures and applied on it a fine of 20 000 euros for the violation, among others, of article 6 GDPR, read in combination with article 7 of the same Regulation and of article 5, second paragraphe of the Regulation mentioned and in conjunction with article 24 of the same. In particular, the APD firstly ordered Proximus to comply appropriately and immediately with the withdrawal of consentbe the concerned subscriber and to fulfil the demands of this subscriber, exercising his right to erasure of the data related to him. The APD has, subsequently, ordered Proximus to take the aprropriate technical and organisational measures to ensure that the processing of personal data it conducts should complay with the requirements of the GDPR. Finally, the APD ordered Proximus to stop transmitting these data illegally to other providers of directories. The 28th August 2020, Proximus introduced an appeal against this decision before the "hof van beroep te Brussel" (Appeal Court of Brussels, Belgique). According to Proximus, according to article 45, third paragraph of the Law about Electronic Communications, the consent of the subscriber is not required, but the subscribers have to demand themselves not to appear in the directories, according to a system called "opt-out" In the absence of such a demand, the concerned subscriber can effectively appear in these directories. Following from this, according to Proximus, no "consent" of the subscriber is actually necessary in the sense of Directive 95/46 or of the GDPR. Being of the opposite view, the APD argues, in substance, that article 12, second paragraph of Directive 2002/58 and article 133, first paragraph of the Law about Electronic Communication require the "consent of the subscriber", in the sense of the GDPR in order that the providers of directories could process and transmit their personal data. Article 12(2) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, read in conjunction with point (f) of the second paragraph of Article 2 of that directive and with Article 95 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as meaning that ‘consent’ within the meaning of Article 4(11) of that regulation is required from the subscriber of a telephone service operator in order for the personal data of that subscriber to be included in publicly available telephone directories and directory enquiry services published by providers other than that operator, and that that consent may be provided to that operator or to one of those providers. Article 17 of Regulation 2016/679 must be interpreted as meaning that the request by a subscriber to have his or her personal data withdrawn from publicly available telephone directories and directory enquiry services constitutes making use of the ‘right to erasure’ within the meaning of that article. Article 5(2) and Article 24 of Regulation 2016/679 must be interpreted as meaning that a national supervisory authority may require that the provider of publicly available telephone directories and directory enquiry services, as controller, take appropriate technical and organisational measures to inform third-party controllers, namely the telephone service operator that has communicated its subscriber’s personal data to that provider and the other providers of publicly available telephone directories and directory enquiry services to which that provider has itself supplied such data, of the withdrawal of the subscriber’s consent. Article 17(2) of Regulation 2016/679 must be interpreted as not precluding a national supervisory authority from ordering a provider of publicly available telephone directories and directory enquiry services – which has been requested by the subscriber of a telephone service operator to cease disclosing personal data relating to him or her – to take ‘reasonable steps’, within the meaning of that provision, to inform search engine providers of that request for erasure of the data.
Court case C/05/404834 / HA ZA 22-245
The controller advises and guides companies on matters such as brand positioning, corporate identity, business models and revenue models. The data subject had a business that facilitates spaces for retreats, trainings and workshops. The controller believed that the data subject wrongfully failed to pay its invoice, and it claimed payment of the invoice, among other things. The data subject disputed this and refused to pay the additional invoices. Therefore, the controller took the matter to court. To substantiate their defence, the data subject requested the Court to order the controller to provide digital copies of all recordings it made of conversations and (Zoom) video conferences between them, pursuant to article 843a of the Code of Civil Procedure (CCP) and/or Article 15 GDPR. The data subject stated that during the Zoom-calls, they were notified by an on-screen notification at the beginning of the call that it would be recorded. Concerning the data subject's claim under Article 15 GDPR, the Court noted that the controller stated, with reasons, that a significant portion of the requested recordings could not be provided, because they did not exist. The Court held that it was the data subject's responsibility to assert and provide evidence that the controller actually had these recordings available. The data subject, however, did not provide such evidence. The Court deemed it not plausible that the controller had more recordings at its disposal than it claimed to have, and rejected the claim under Article 15 GDPR on this point. Regarding the residual recordings, the Court pointed out that Article 15(3) GDPR gives the data subject the right to be provided with a copy of the personal data being processed. The Court followed that this right does not automatically entitle a data subject to access a copy or transcript of the original document on which their data is recorded. For example, a data subject is not entitled to the latter, in so far as the objective pursued by that right of access can be fully satisfied by another form of provision (CJEU 17 July 2014, [https://curia.europa.eu/juris/document/document.jsf;jsessionid=631861F6D8464B82ECD05BDA33A08736?text=&docid=155114&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=1904724 ECLI:EU:C:2014:2081]). The Court recalled that, in its defence against the counterclaim, the controller stated that if the data subject wanted to know if and what personal information it stored relating to them, they could have sent an access request to the controller. The Court came to the conclusion that the data subject did not request such access to their data prior to their claim. Moreover, the data subjects did not substantiate that they were not able to check whether their personal data was correct and lawfully processed by relying on the rules in Article 15 GDPR. In addition, the court concluded that the data subject did not clarify their intent to safeguard the rights of others whose personal data was also processed in the conversation. Hence, the controller could not provide the data subjects access to the full Zoom conversations. In other words, the Court held that the GDPR does not oblige the controller to provide the defendants with access to the records to the extent claimed by the data subjects. The Court thus also rejected this claim. Therefore, The Court denied the data subjects’ claim based on Article 15(3) for the access to the Zoom-call recordings. The Court did grant the data subject's claim under article 843a CCP for two Zoom calls.
Claimant
The data subject made an access request to the municipality of Sluis (controller) on 18 August 2020. The controller responded on 24 September that they found no personal data related to the data subject and that it planned to reject the request. It also asked the data subject to specify their request by 9 October 2020, suspending it until that date. The data subject responded on 29 September 2020, requesting the controller to issue a decision and taking the point of view that the controller had exceeded the deadline. On 28 October 2020, the controller officially denied the request. The data subject sent another letter on 12 November 2020, requesting the controller to issue a decision based on his previous letter. On 20 December 2020, the data subject submitted a formal objection with the controller for not taking a decision for periodic penalty payments in a timely manner. The controller rejected the objection. The controller also sent the notice of objection to the court to treat as appeal. The Court initially ruled the appeal inadmissible, as the court fee had not been paid in time. The data subject objected to this decision, stating that he was not able to pay the fee. The objection was upheld on 17 September 2021. The initial ruling did not go into the request for penalty payment's. The Court found that the data subject made access requests to six other municipalities, for which the data subject also claimed penalty payments. On top of this, no clear purpose of the access request could be deduced. The data subject was not known by the controller and did not make use of the possibility to specify his request. Last, the data subject never objected to the controller's decision to deny the access request from 28 October 2020. The Court held that since data subject only made an access request and the subsequent request for a decision on periodic penalty payment's for monetary gains. Therefore, the data subject abused legal instruments. As a result, the Court ruled
Swedbank AB
The data subject was a client of a bank (the controller). In 2020, the controller terminated their bank account based on "poor customer knowledge". Consequently the data subject filed a lawsuit against the controller in order to be allowed to open bank accounts again. In the course of the proceedings, the data subject requested access to a voice recording of their call with the controller. However, the controller refused access to the voice recording and provided the data subject with access to a transcription of the recording instead. The Court started by recalling that the supervisory authority has an obligation to process complaints. It is nevertheless clear from the wording of Article 57(1)(f) GDPR that the authority has a certain amount of freedom to choose in which cases to investigate. It is therefore not clear that the data subject will receive a legally binding decision in relation to a personal data controller from a DPA. This suggests that the authority's handling of complaints cannot replace a data subject’s right to bring an action to court. The Court of Appeal therefore concluded that it was competent to hear the case. Further, the court stated that the the right of access it not about the data subject being able to check whether the bank carried out its risk assessments correctly, but about the data subject's interest in their personal data being processed lawfully. Article 15(3) GDPR on the right to obtain a copy aims to ensure this interest and does not extend beyond that. Thus, the data subject was entitled to a copy of the personal data in such a form that they could exercise their rights under the GDPR. According to the Court, it follows from case law, with reference to Case C-212/13 and C-345/17, that pictures and sounds constitute personal data. Hence, a voice recording should be deemed as personal data. In line with Article 15(3) GDPR, the data subject had the right to receive a copy of their personal data as it is a prerequisite for other r
ING
The data subject was registered at 'Bureau Krediet Registratie' (BKR, an agency for debt registration) by a bank (controller). The registration meant the data subject had a high risk profile. This registration would make it harder for the data subject to receive loans. According to this registration, the end date of the data subject's debt was 22 September 2020. The data subject stated various reasons for the fact that she had been in debt during this time, such as a failed relationship and issues at work. The data subject purchased a house on 19 July 2022. She stated that she needed financing quickly, and demanded that the controller would delete the credit registration at the BKR. She stated that she had regained her financial stability since 2020 and would move to a better house, which was the reason why she needed the mortgage. The controller declined to delete the registration. It stated that it didn't decide in the data subject's favour after conducting a balancing exercise. The District Court of First Instance of Amsterdam noted that the controller had rejected a request from the data subject according to Article 21 GDPR. The court stated that under Article 21(1) GDPR, a data subject has the right to object to processing if they provide concrete reasons for their 'specific situation'. The data subject has to prove the facts surrounding this specific situation when necessary. Controllers on the other hand must provide their legitimate interest when a data subject makes a claim under Article 21(1) GDPR. It must balance its own compelling legitimate interests against the fundamental rights or freedoms and interest of the data subject. The court held that this balancing exercise could also include circumstances which occurred after the credit registration. The court held that the controller had two compelling legitimate interests: (1) to warn other creditors of the risk and (2) protecting the consumer against accumulating too much debt. The data subject