GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
VGZ
De 'Regenboog Apotheek' (Rainbow pharmacy) is a pharmacy which provides its patients with so-called 'tapering strips'. These strips are used when patients stop taking certain kinds of antidepressants and ADHD-medication, as suddenly stopping can cause severe withdrawal symptoms. Tapering strips need to be made by hand for individual patients, and are therefore expensive. Health insurance company VGZ refuses to pay for these strips despite insistence of the pharmacy that they are legally obliged to do so. This dispute has led to the termination of the contract between the Regenboog pharmacy and VGZ. The pharmacy then placed an ad in a local newspaper, informing their patients that they might need to switch to a different health insurance company. In this ad, the names and work telephone numbers of two employees (who work at the purchasing department of VGZ) were included. In a separate letter to all patients using ADHD-medication, this information was repeated. Was the pharmacy allowed to publish the names of employees of the purchasing department of the health insurance company? The Court ordered the publication of the personal details of the employees unlawful, as a legal basis was missing. The Regenboog pharmacy was ordered to send a follow-up letter to all patients who had illegally received personal details, pointing them to the general customer service number of VGZ.
Sociale Verzekeringsbank
The Sociale Verzekerinsbank (Social Security bank, hereafter SVB) sends personal data of all newly born children in the Netherlands to the 'toeslagen' (welfare benefits) department of the tax office in a 'start-message'. The start-messages are shared on the basis of an agreement between the SVB and the tax office. Data includes the BSN-number (a state-issued identity number), date of birth and country of residence of the child. The SVB has this data as it is responsible for paying out the general child allowance, to which all parents/caretakers are entitled. The tax office is responsible for paying out the 'kindgebonden budget' (child-related budget), an extra allowance for relatively low-income families. The data in the start-messages is used to quickly decide on applications for the child-related budget. The claimant has a daughter born in 2016, whose personal data was shared by the SVB with the tax office in a start-message. The claimant's daughter does not qualify for the child-related budget. The court considered whether the child's personal data was legally shared with the tax office under the GDPR, and where it was not, whether the representative of the child have a right to monetary compensation. It held that whilst there was an infringement of the GDPR, the claimant is not entitled to compensation as damages could not be proven. The court considers that there is a proper legal basis in the law for sharing the data in the start-messages in the form of Article 38 of the Algemene wet inkomensafhankelijke regelingen (General law on income-related schemes) which requires state organs to share all relevant information with the tax office which they may need to fulfil their obligations. However, the data sharing through start-messages as required by the agreement between the SVB and the tax office is excessive. The court considers that data of all children is shared, whereas only about 42% of them qualify for the child-related budget. The agreement could therefo
Court case W214 2219800-3
The controller issues identity cards and passports. The data transmitted for this purpose are in any case stored for the duration of the validity of the identity documents. The data subject reported losing an identity card ("old ID"), which was subsequently blocked. He then applied for a new identity card ("new ID") using the same photograph, which was still valid at the time of the decision. The photograph relating to the new ID was still stored at the time of the decision. The same photograph was also stored in the data set of the old ID, even though it had been blocked for more than three years. In a complaint to the Austrian DPA (DSB), the data subject requested, among other things, the deletion of these photographs. The DSB did not follow the data subject in this respect. The data subject filed an appeal against this with the Austrian Federal Administrative Court (BVwG). The BVwG ruled, among other things, that the controller is obliged to delete the photograph relating to the old ID. However, during the period of validity of an identity document, photographs may be stored. = The court first dealt with the question of whether photographs are biometric data within the meaning of Article 4(14) GDPR. In this regard, it stated that photographs serve to uniquely identify the person to whom the identity document is issued. This does not change if queries from the identity document register are carried out according to other criteria. In the end, however, the court leaves the qualification as biometric data open, since their processing would in any case be lawful under Article 9(2)(g) GDPR. The processing of biometric data was provided for at the statutory level by the Austrian Passport Act 1992 (PassG) for reasons of substantial public interest. = The court stated that there was no obligation to delete the data concerning the new identity card. Such obligation cannot exist during the period of validity of the identity card. After the expiry of the validity, § 22
Court case C/10/603827 / KG ZA 20-816
The parties are related to each other. Defendant 1 believes that the takeover of the family business by her siblings was done to her disadvantage and that she is entitled to compensation. Defendant 2 (the husband of Defendant 1) sent emails to friends, family and business contacts of the business in question. That email described the Defendants’ side of the conflict, as well as also mentioned the names of all other involved family members, including the names of the wives of the siblings of Defendant 1, and the phone number of one of them. Can Defendants be ordered to refrain from processing of personal data relating to other family members with an order to pay a penalty of € 10.000,00 for each violation, to be increased by € 1.000,00 for each day that the violation continues? The Defendants argue that this prohibition is formulated too broadly and cannot be allowed. The Court ruled that in this case the sharing of the personal data via email or posting them on public websites/social media constitutes personal data processing under GDPR and that it was done without a legal basis. Given that it’s a family matter, the Court did not order the Defendants to pay a penalty. The Court ordered the Defendants to refrain from sharing personal data of plaintiffs, including via emails, website or social media posts, SMS or by any other means.
unknown (claimant)
The defendant conducts (i.a.) business as an address publisher under § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) and sells personal data for third-party marketing purposes. Starting in 2017, the defendant had created information on the presumed "affinities for political parties" of the entire Austrian population. This was done by gathering and combining information from anonymized polls and statistics on election results via an algorithm. As a result, individuals were assigned to one or more marketing groups and classifications regarding political affinity depending on their place of residence, age, gender, etc. The defendant had (i.a.) assessed that the claimant was likely to be interested in the far-right Austrian Freedom Party (FPÖ). After the claimant had learned this (following an access request under Article 15 GDPR), he filed a lawsuit against the defendant. He requested (i) an injunction that the defendant had to refrain from processing data on his presumed political opinions and (ii) € 1,000 in damages since he considered the alleged affinity to the FPÖ an insult, shameful and highly damaging to credit. The defendant had not disclosed the claimant's data to third parties. By 04.06.2019, the defendant had erased all data on "affinities for political parties", including those of the claimant. Throughout all court instances, the defendant argued that data on the "affinity for a political party" do not qualify as personal data, let alone special categories of personal data. The first-instance court (Landesgerichts für Zivilrechtssachen Wien) upheld the request for an injunction but rejected the request for damages, stating that the threshold for compensable immaterial damage had not been reached. The second-instance court (Oberlandesgericht Wien) confirmed this judgment. Both claimant and defendant appealed against this decision: the claimant appealed against the rejection of his request for damages, the defendant against the injunction to refrain from processing the claimant's data. # Do data on the "affinity for a political party" qualify constitute personal data under Article 4(1) GDPR? # If so, do they qualify as special categories of personal data under Article 9 GDPR? # Is the defendant obliged to refrain from processing the claimant's data on the (presumed) affinity for a political party in the future? # Is the claimant entitled to damages under Article 82 GDPR? Regarding the the claimant's entitlement to damages under Article 82 GDPR, the Austrian Supreme Court (Oberster Gerichtshof - OGH) requested a preliminary ruling from the CJEU under Article 267 TFEU. See here for further details. The OGH consequently only decided on the disputes described in points 1, 2 and 3. The OGH confirmed the lower courts' judgments: # The relevant data constitute personal data under Article 4(1) GDPR. Even though they have been created using non-personal data (polls, statistics) the defendant assigned the "affinity for a political party" to individual natural persons - such as the claimant. If the alleged affinity is actually correct is not relevant. Neither is the fact, that it only expresses the assumed likeliness of a data subject to be interested in a certain political party and not the data subject's actual political beliefs or voting behaviour. In its reasoning, the OGH referred to its judgment 6Ob127/20z (that deals with marketing classifications by the defendant) and the Austrian Federal Administrative Court's (Bundesverwaltungsgericht - BVwG) decision W258 2217446-1 (that also concerned the processing of data the "affinity for a political party" by the defendant. # The data also qualify as special categories of personal data under Article 9 GDPR. The OGH agreed with the BVwG's reasoning in W258 2217446-1 and held that that the purpose of Article 9 GDPR is to protect data subjects from the risk of severe discrimination as a result of processing certain kinds of data. As alleged data on political preferences already harbour the potential for discrimination, they must be treated as data on political opinions pursuant to Article 9 GDPR. # The OGH also upheld the lower courts' injunction. Article 79 GDPR foresees an effective judicial remedy where the data subject considers their rights under the GDPR violated. According to the prevailing opinion among legal scholars in Austria and Germany this includes includes injunction suits. The processing of the claimant's data on the "affinity for a political party" was unlawful due to the lack of the claimant's consent under Article 9(2)(a) GDPR. The facts that the defendant had deleted the claimant's data on his "affinity for a political" party" does not exclude the danger of the defendant creating such data again in the future. Furthermore, the defendant never gave up its standpoint that the processing of the claimant's data was lawful. Hence, the OGH held that there was a danger of repetition and upheld the injunction.
ADHEOS
In February 2020 the French minister of the interior enacted the [https://www.legifrance.gouv.fr/loda/id/JORFTEXT000041615919/ Decree No. 2020-151 of 20 February 2020 authorising the automated processing of personal data known as "mobile note-taking application"] (Décret n° 2020-151 du 20 février 2020 portant autorisation d'un traitement automatisé de données à caractère personnel dénommé «application mobile de prise de notes» (GendNotes)). The app should be used on the occasion of preventive actions, investigations or interventions necessary for the exercise of judicial or administrative police missions. Among the data that can be collected is information relating to alleged racial or ethnic origin, political, philosophical or religious opinions, trade union membership, health or sexual activities or orientation. A group of human rights organisations filed a complaint with the French Constitutional Court. Is the "GendNotes" App of the French national police force (Gendarmerie nationale) unlawfully processing special category personal data? The French Highest Administrative Court held that the decree infringed Article 4 of the [https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460/ Law of 6 January 1978], implementing GDPR in France, the Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data and Article 8 CFR, as it excessively infringed upon the right to respect for private life and the correlative right to protection of personal data, without providing appropriate safeguards for their protection in terms of the purpose of the processing and the nature of the data collected, as well as excessive data retention period, data sharing and data security. The Court discussed whether the decree violated Article 4 (a) GDPR, Article 4 (b) GDPR, Article 4 (c) GDPR, and Article 4 (e) GDPR and Article 9 GDPR. According to the Court, the processing of data did not comply with the principle of purpose limitation, as data is collected for future investigations or proceedings. However, the Court did not find a violation on the collect of special category data, given the fact that the decree establishes that this data can only be processed in case of "absolute necessity". Additionally, the Court noted that, even if the decree provides a limitation for the storage of the data, in practice this can be ignored, as the data may be used in different or further investigations, that would impede its erasure. However, they found that the decree was lawful in this regard, given that it clearly stated a retention period of 3 months to 1 year. Taken the above-mentioned into account, the French Highest Administrative Court decided that the data processed by the French national police force can no longer be used "in other data processing, in particular by means of a pre-information system". Therefore, the Court held: #In Article 1° of the decree, the words "in other data processing, in particular by means of a pre-information system," are cancelled out. #The State will pay €3,000 to every claimant. #The rest of the application is rejected. The allowance to collect special category data is not overruled, as the Court argues that the decree only allows it when it is "absolutely necessary". #This decision will be notified to the claimants: the Ligue des droits de l'homme, the associations Homosexualités et socialismes and Internet Society France, the associations Mousse, Stop Homophobie, Adheos and Familles A, the association AIDES, the Syndicat de la magistrature, the Syndicat des avocats de France, the Conseil national des barreaux, the Quadrature du Net and the International League against Racism and Anti-Semitism, the Prime Minister and the Minister of the Interior.
NederWoon Verhuurmakelaars B.V.
In May 2019, a hacker obtained unauthorised access to the webserver and website of Nederwoon.nl and exported personal data of users of the website to his personal computer. The hacker was found guilty for unauthorised intrusion in a different case. The plaintiff argued that NederWoon is in breach of Article 5 GDPR because the plaintiff's personal data should have been deleted because it was no longer necessary in relation to the purposes it was processed for, and because there were no appropriate technical and organisational measures in place to protect the data. The plaintiff therefore requested a compensation for the damages due to a breach of the GDPR. NederWoon claimed that there was no breach of the GDPR and that there was no damage on the plaintiff's side. The court held that the plaintiff must prove why Article 5 GDPR was breached. The simple fact that a hacker obtained access to personal data does not mean that NederWoon was acting in breach of Article 5 GDPR. Furthermore, the plaintiff must prove that he in fact has (immaterial) damages on his side. A breach of the GDPR does not automatically lead to damages. (Also see: [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:HR:2019:376 Dutch Supreme Court (Hoge Raad) ECLI:NL:HR:2019:376]). The simple statement that the plaintiff experienced distress is insufficient without further elaborating on why this bothered him or how the distress expressed itself. Because the damage was not substantiated, the claims cannot be upheld. Therefore, the breach of the GDPR is not further discussed.
Court case ROT 19/3036
The controller engaged DEX Online Services to automate its membership administration, which contained personal data of the plaintiff. He also offered its members the opportunity to use the Yogibit app to gain access to their own data, so that they can, for example, deregister and register for lessons. On January 30, 2019, the plaintiff filed a complaint with the Dutch DPA against the controller. The DPA rejected the complaint by decision of 27 February 2019, because it found no obvious violation of the GDPR . Plaintiff has objected to this rejection. According to the DPA, both the controller and DEX Online Services have complied with the claimant's request for removal within the meaning of Article 17 of the GDPR. The controller has a valid basis for the processing of the plaintiff's personal data and it has not been shown that his personal data has been processed in the YogiBit app. In appeal, the plaintiff argues that the controller should have first explicitly requested permission from him before his personal data would be provided to DEX Online Services. According to the plaintiff, the defendant has forgotten to look at the definition of 'consent', as set out in Article 4 (11) of the GDPR . Additionally, it was not necessary for the controller to enable DEX Online Services for its student administration. According to the plaintiff, the controller could also have chosen to hire a secretary. In addition, the plaintiff stated that as a free EU citizen he has the right to choose whether he wants to go along with the choice of the controller for that third party. Plaintiff argued that it was up to DEX Online Services to ascertain that the controller complied with the conditions set out in Article 6 of the GDPR . In his view, on the basis of Article 5(2) GDPR the controller has an accountability obligation and must be able to demonstrate compliance with Article 5, first paragraph, of the GDPR . The plaintiff argued that the decision did not provide evidence of such com
Court case II SA/Wa 1340/20
An individual lodged a complaint with the supervisory authority against the company, claiming that the company had unlawfully processed his personal data in connection with a car rental contract (including by means of a copy/scan of his identity card and driving licence). The company stated that it obtained the complainant's personal data from the complainant himself in connection with the conclusion of the car rental agreement, including his first name, surname, address, identity card number, driving licence number and telephone number, which it currently processes in its IT system designed for comprehensive servicing of car rental companies. The company submitted that it currently processed the complainant's personal data solely for the purpose of possibly establishing, investigating or defending against claims related to the car rental, on the basis of Article 6(1)(f) GDPR. Following an administrative investigation, the supervisory authority ordered the company to delete the complainant's personal data in terms of name, surname, address, identity card number, driving licence number. The DPA questioned the basis indicated by the Company for processing the complainant's personal data, as it did not appear from the evidence that the complainant had filed a claim against the Company or that the Company had asserted any claims against the complainant in court that would justify the Company's right to retain and process the complainant's personal data in connection with its safeguarding and assertion by the complainant or the Company. The Company appealed to the court. The court dismissed the controller's appeal against the supervisory authority's decision. The court pointed out that the legal basis for the processing of personal data listed in the provision of Article 6(1)(f) GDPR applies when the controller does not have the consent of the data subject, there is no provision which could constitute a basis for the processing of personal data, and when the controller
Autoriteit Persoonsgegevens
The Amsterdam District Court upheld a decision by the Dutch DPA to deny Booking.com's request for prior consultation. The court ruled that the Spanish DPA is the competent supervisory authority, as the personal data would be collected to comply with a Spanish tax law.
Court case Case No. 5888-20
The Swedish DPA carried out an investigation of the Upper Secondary School Board in Skellefteåmunicipality and its pilot project at a high school that used facial recognition to record student attendance. The cameras installed with this technology use biometric personal data to uniquely identify natural persons. Such biometric personal data qualifies as particularly sensitive personal data (under Article 9 GDPR) concerning children. According to Article 9(1), the processing of such data shall be prohibited. The prohibition does not apply if the data subject consents to the processing of personal data for a specific purpose (Article 9 (2). For a consent to be valid, it must have been given voluntarily. Following an initial decision by the Swedish DPA, holding that the Board had violated the GDPR, the Upper Secondary School Board contended that students and their guardians provided valid consent to use of the facial recognition technology and appealed to the Court of Appeal. Following the appeal, the Court of Appeal in Stockholm upheld the decision of the Swedish DPA. The Upper Secondary School Board appealed the decision to the administrative court but the administrative court dismissed the appeal, finally rendering the decision of the Swedish DPA final. The Swedish DPA (IMY) held that the use of facial recognition technology to register student attendance is in violation with Articles 5, 9, 35 and 36 GDPR. It explained that students cannot provide meaningful consent to such data processing because of their dependence on school services. While there is a legal basis for administering the attendance of students at school, there is no legal basis to perform the task through the processing of sensitive data. The technology amounts to an intrusion of student integrity and is thus disproportionate to the task of measuring attendance. Furthermore, the DPA considered that the risk assessment reported by the Upper Secondary School Board did not meet the requirements o
KPN
Plaintiff was removed from the National Interpreters Registry after claims of fraud. The Tolk- en Vertaalcentrum Nederland (Dutch Interpreters and Translation centre), a intermediary company where plaintiff had an account, claims that plaintiff fraudulently put out, accepted, and then cancelled interpreting assignments, inducing the centre to pay him cancellation fees. As a result hereof, plaintiff was removed from both the centre and the national registry, and lost income. Plaintiff disputes that he put out the cancelled assignments, and claims that the Court should order KPN, an Internet Service Provider ('ISP'), to hand over information on the users of the IP addresses from which the assignments were created. This would allow plaintiff to prove that others put out the assignments, and claim damages from them. The Court considers that (in line with Dutch jurisprudence, see [http://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:HR:2005:AU4019 HR 25 november 2005, ECLI:NL:HR:2005:AU4019 (Lycos/Pessers)]) under certain circumstances ISPs can be forced to hand over subscriber information to injured parties. This allows them to bring actions before civil courts. This is in line with Article 6(1)f GDPR, as it necessary for the purposes of protecting the legitimate interests of a third party. However, in the present case, claimant fails to demonstrate that the 37 IP addresses logged by the intermediary company belong to one or more data subjects which have indeed fraudulently put out assignments. First of all, KPN only holds on to IP information for six months whereas all the assignments were put out in the period between 2017 and 2019. Secondly, the claimant received at least €3000. It is not credible that the claimant simply did not notice these charges before he was removed from both the intermediary and the national registry. Therefore, it seems unlikely that receiving the subscriber information will help claimant in his disputes with both organisations. As the con
Canary Island Cars, S.L.
In the appealed AEPD's decision, [https://www.aepd.es/es/documento/ps-00385-2018.pdf PS/00385/2018], two customers had the same name, what caused a failure when verifying customer details, what caused Canary Islands Cars, a rental car company, to incorrectly use the information of customer A to create a car rental contract for customer B, who then committed a traffic offence. Subsequently, the details of customer A were incorrectly passed on to the Directorate General for Traffic (DGT). Once the DGT contacted the complainant, she/he realised that the contract that Canary Island Cars provided to the DGT for the purposes of issuing the fine was dissimilar to the one she/he had initially signed. Based on the mismatch of information, the complainant appealed the fine upon receiving it. The AEPD noted the following in decision [https://www.aepd.es/es/documento/ps-00385-2018.pdf PS/00385/2018]: "Knowing that there may be different names and surnames, the defendant has elements to verify identity by the national ID number (DNI), number that matches that of the driving licence, customer number or printing of the copy of the contract, among others. Although these verifications are normally carried out by the employees, it should be noted that in this case they were not carried out. If any of the three elements had been verified, the defect could have been detected in its origin. In other words, the identification document must be required at the right time to make the procedure effective”. The car rental company decided to appeal the case before the Spanish National High Court (Audiencia Nacional). In their appeal to this resolution, Canary Islands Cars argued that the accuracy principle had not been breached because the associated name was correct. The car rental company alleged that this was a human error and a fortuitous event. It also argued that the sanction imposed was disproportionate. Was the resolution of the AEPD decided in error? Should the appeal of Canary Island Cars be granted? When analysing the appellant's arguments, the National High Court (Audiencia Nacional) noted that "The mere coincidence of name and surname does not justify the creating of the car rental contract with the data of another person... especially when you have the person in front, to whom the car is handed over and several people or phases intervene: preparation of the contract, data collection and delivery-verification of the vehicle, delivery of a copy of the contract, payment, procedures in all of which must verify the identity of the contracting party and in this case no diligence is accredited". The National High Court dismissed the appeal and declared that the resolution was in accordance with the law with express imposition of the payment of the procedural costs to the appellant.
Gegevensbeschermingsautoriteit
The complainants, Johnny Ryan, Pierre Dewitte, Jeff Ausloos, Bruno Bidon, Panoptykon (NGO), Bits of Freedom (NGO) and La Ligue des Droits de l'Homme, filed several complaints against the Interactive Advertising Bureau Europe (IAB Europe) for various GDPR violations (including the principles of legality, transparency and fairness, minimisation and security among others). In total, 4 complaints were filed before the ADP and 5 before other data protection authorities through the IMI (Internal Market Information) system. These complaints were therefore joint into one investigation. An interlocutory decision, changing the language of the proceedings to French was made on 08/01/2021. Some parties did not agree with this and asked the Market Court to change the language to Dutch and to use full French text (some words where not in French). The parties reached an agreement before the Court of Appeal of Brussels (commercial section) had to render a judgement. The parties reached an agreement which made any interference from the Market Court obsolete.
Data protection authority of Saarland (defendant)
Following the complaint of two petitioners claiming that the plaintiff had contacted them for direct marketing purposes, even though they had not consented to the processing of their personal data to this effect, the supervisory authority for data protection in Saarland, the defendant, ordered a limitation of the processing and an erasure of the unlawfully processed personal data of the petitioners by the plaintiff pursuant to Article 58(2)(f) and Article 58(2)(g) GDPR. The plaintiff had not been able to prove that the consent of the petitioners had been obtained in accordance with the requirements of Article 7(1) GDPR. The argument presented by the company, alleging that the petitioners' consent had been collected at the time of their participation in a lottery and confirmed via e-mail as part of a so called "double opt-in process", were not considered sufficient by the supervisory authority. The authority pointed out that the plaintiff should have been able to prove that the consent actually originated from the person contacted for direct marketing purposes, which had not been the case in the present matter. Furthermore, the authority underlined that the plaintiff could not justify a legitimate interest pursuant to Article 6(1)(f) GDPR, which would allow them to process the petitioners' data without their consent, the petitioners not having any business relationship with the plaintiff and therefore no reasonable expectation to be contacted by the plaintiff's company. In this context, contacting the petitioners for direct marketing purposes without their prior consent even qualified as unreasonable harassment under § 7(2)(2) of the national competition law (UWG). The plaintiff appealed the decision of the supervisory authority before the administrative court of Saarland (VG Saarlouis), arguing amongst other things that the orders could only be considered contradictory because of the reference to requirements from data protection as well as competition laws which
MERCADONA S.A.
Two persons were sentenced to prison by a Criminal Court of Barcelona for violent robbery in a Mercadona supermarket. The were also prohibited from entering the supermarket for two years. Mercadona asked the court to allow them to use a system processing biometric data to monitor the entrance of the supermarket and stop them from accessing, as doing it with traditional means (i.e. instructing the security personnel to do it) would be too burdensome and virtually impossible. In order to justify this, they alleged a public interest based on the [https://www.boe.es/buscar/act.php?id=BOE-A-2014-3649 Spanish Private Security Act] and on a legitimate interest to ensure compliance with the judgment of the criminal court. The criminal court rejected the petition, against which the supermarket chain filed an appeal before the Barcelona Court of Appeal (Audiencia Provincial de Barcelona). They argued that: * Even if the category of biometric data is recognized in the GDPR as specially protected data, it does not exclude its use, provided that it is carried out with all the relevant security measures. The controller understands that the proposed security measures do not harm the rights of the data subjects, since, although the biometric data of all users entering one of the establishments are processed, the system instantly (within 0.3 seconds) detects the convicted individuals; while no biometric data of any person who has not been prohibited from entering the place will remain in the system, that will be immediately erased and will never be used. * The purpose of the legislator in the development of the GDPR is not only to protect the rights of natural persons but also the free circulation of data, taking into account the progress of technology. That is why it would be completely ineffective to try to solve a problem such as the control of those individuals with an entry ban by just showing the image of these individuals to dozens of employees of establishments so that they
IDdesign A/S (now ILVA A/S)
In June 2019, the Danish Data Protection Agency (DPA) expressed severe criticism of IDdesign A/S for the violation of the Article 5(1)(e) of the GDPR, namely, the failure to delete personal information of approx. 350,000 customers in its old IT-system. The personal data included the customers´ names, addresses, telephone numbers, email addresses and order history. The company was reported to the police. The Prosecution Service decided to pursue the case further in a court. The DPA and the Prosecution Service recommended a fine of DKK 1.5 million, which was calculated based on the entire group turnover and by taking into consideration the company´s intentional failure to delete the data. The court considered whether the company violated the Article 5(1)(e) of the GDPR (storage limitation principle) and determined the amount of fine for the violation. The court found that the company, in breach of the Article 5(1)(e) of the GDPR, kept the data of around 350,000 customers for longer than is necessary for the purposes for which it was collected. According to the Danish Consolidated Bookkeeping Act (in Danish - Bogføringsloven) the data must be deleted after 5 years. However, the court concluded that the violation has been committed through negligence. With respect to the calculation of the fine, the court disagreed with the proposed charges and concluded that amount should be calculated based on the company´s own turnover, and not on the entire group. Moreover, while calculating the fine amount, the mitigating circumstances under the Article 83(2) should be taken into consideration, such as: *the company has not breached the GDPR before, *the breach involved only general personal information, *any data subjects suffered damage as a result of the infringement, *negligent character of the infringement, *the company has taken considerable steps to ensure compliance with the GDPR. The court imposed a fine of DKK 100,000.
Court case 200.278.124/01
In 2011 Rabobank loaned 70K EUR to the appellants with a monthly payment of 700 EUR. At that time one of the appellants had a well-paid job, which he lost in 2013 and he hadn't been able to find another job after that. Financial problem followed, and the appellants ended up selling their house and taking an additional loan from their son to settle the debt payment scheme with the mortgage company and Rabobank. As a result of the above, Rabobank made a record about the appellants' situation in the CKI in 2018; the registration is schedules to be removed in 2023. In 2019 the appellants sent a letter to Rabobank requesting it to remove the registration, based on GDPR Articles 16 and 17 in combination with articles 21 and 6. Rabobank rejected the request and this decision was upheld by the Court. Appellants are challenging this decision of the Court. Should Rabobank remove the appellants' credit registrations from the CKI register? Regarding the legal basis of processing, the Court ruled that the applicable legal basis in this case is legal obligation under articles 4:32(1) and 4:34 of the Financial Supervision Act (Wet op het financieel toezicht). The Court pointed to the extensive considerations given to this matter by the Court of Appeal of 's-Hertogenbosch in a similar case. This means that the appellants cannot exercise their rights to erasure (Article 17 GDPR) and objection to processing (Article 21 GDPR), so appeal based on these articles was dismissed. When deciding on the necessity and proportionality of keeping the CKI record, the Court considered the following: 1) The appellants themselves admitted that they were hindered by the registration, they were not in a distressing situation as a result of the registration; 2) One of the appellants has enjoyed good income for a long time, but that income did not protect him from a difficult financial situation; 3) The appellants have not sufficiently demonstrated that they have done everything in their power to
Cdiscount
On 6 September 2018, the CNIL issued a Recommendation on the processing of credit card data in the context of online purchase of goods and services. The recommendation provides that: (1) Credit card data can only be processed in order to complete a transaction in connection with the performance of a contract; (2) The storage of such data in order to facilitate subsequent payments is only possible if: *(a) The data subject has expressed prior and explicit consent; or *(b) Has taken a subscription offering access to additional services, thus intending to enter in a regular commercial relationship. Cdiscount, a marketplace website, requested the CNIL to modify those rules. It argued that websites should also be able to store credit card data of customers who can reasonably foresee their data will be stored, on the basis of their purchasing frequency. The CNIL did not meet the demand. Cdiscount is thus seeking the annulment of the decision before the French Administrative Supreme Court. Did the CNIL exceed its remit when interpreting Article 6 GDPR in its Recommendation? Did the CNIL, by requiring prior and explicit consent, wrongly considered credit card data as a special category of personal data (Article 9 GDPR)? Does the data controller have a legitimate interest to process credit card data of recurring purchasers under Article 6(1)(f)? Can the recommendation be annulled on the ground that it creates a distortion of competition with foreign economic operators that are not subject to similar legislation? The Supreme Administrative Court dismisses the appeal, on the following grounds. = The Court holds that the CNIL acted within its power when interpreting Article 6 GDPR. This power is derived from (Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés). These provisions designate the CNIL as Supervisory authority for France under Article 51 GDPR. They also expressly grant the CNIL power to issue guidelines and recommendations
Court case 18 U 2822/19 Pre
The defendant's parent company with its registered office in California operates the social network "www.f...com. For users in Europe, the defendant is the provider and contractual partner. The plaintiff maintains a private user account with the defendant. According to the defendant's current terms of use: "When people stand behind their opinions and actions, our community is safer and more accountable. For this reason, you must do the following: - Use the same name you use in your daily life." The plaintiff had originally given himself the profile name using a pseudonym. In March 2018, the defendant asked the plaintiff to verify his name within the next seven days. The plaintiff was told that after this period, he could not log back in until he updated his name. He was asked the question, "Is ... the name you also use in everyday life?" Under "Your answer", the following alternative was given: "Yes, confirm the name" or "No, change the name". On 23.03.2018, the plaintiff was blocked by the defendant. After he changed his profile name to "...", the block was lifted on the same day. The plaintiff requested the defendant to declare that its terms of use in the scope of the obligation to use a clear name did not apply to the plaintiff. Moreover the plaintoff requested to allow the profile name to be changed to his pseudonym. The defendant did not comply with these requests. The plaintiff has taken the case to court. In its final judgment of 2 May 2019, the Regional Court dismissed the action in its entirety. The plaintiff has appealed. Has the defendant's General Terms and Conditions violated section 13(6) of the German Telemedia Act (TMG) or Article 4(7) GDPR and Artcicle 25(1) GDPR? The Higher Regional Court Munich dismissed the appeal and found that the plaintiff cannot derive a claim to the use of a pseudonym in the context of his own profile from the nature of the contract of use concluded with the defendant. The Court held that the defendant's policy on cl