GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
In 2021, the Canal+ Group (controller) carried out commercial prospecting by electronic means, targeting approximately 3.9 million people. The controller did not directly seek the consent of the persons concerned. Instead, they contacted people whose personal data and consent for marketing purposes had already been collected by two partner internet service providers (ISPs) through data collection forms. The ISPs' subscribers were invited to check a box to give their consent to the use of their personal data for prospecting purposes by the ISPs’ "partners". The names of these partners were not specified in the form, nor were they accessible via a hyperlink or by any other means. The CNIL (French DPA) conducted multiple inspections. On 12 October 2023, the DPA found that the controller had failed to comply with their obligation to obtain valid consent from the individuals concerned for the purposes of electronic marketing, in violation of Article 7 GDPR. The controller brought an action for annulment of this decision before the Council of State. The Council of State considered that this dispute raised a question as to whether the consent given by the data subject to a first collector, allowing their data to be used by a category of recipients for the purpose of electronic prospecting, can be regarded as informed consent within the meaning of Article 4(11) of the GDPR, read in conjunction with articles 13(1) and 14 of the same Regulation, and article 13 of the Directive of 12 July 2002 on privacy and electronic communications. A further question arises as to whether the degree of specificity of the term « category of recipients » is significant, or whether, as in the present case, it may simply refer to any « partner » of the initial data collector. The Council of State considered that these questions are decisive for the resolution of the dispute and present serious difficulties. The Council of State therefore referred the matter to the Court of Justice of the Eur
A telecom provider (the controller) concluded a contract with a customer (the data subject). Afterwards, the controller forwarded the subject’s data to the credit information agency SCHUFA Holding AG. The disclosure of the data were base on the controller’s interest in preventing fraud. The data subject brought an action with the Regional Court of Würzburg. He claimed that the disclosure of his data was unlawful. So, he required compensation for non-material damages under Article 82 GDPR, injunctive relief, and a declaration that the controller would be liable for all future material and non-material damages caused by the disclosure. The Regional Court of Würzburg dismissed the requests. The data subject then appealed the ruling with the Higher Regional Court of Bamberg. The Court dismissed the request and held that the controller lawfully disclosed the data to Schufa. In its analysis of the controller’s legitimate interest, the Court referred to the three requirements laid out by the case law of the Court of JusticeCJEU, Case C-252/21, Meta Platform and Others, 4 August 2023, margins 105 and following (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=276478&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=60751 here]). and held that they were fulfilled in the case at hand. First, the Court held that the controller had a real and legitimate interest in avoiding fraud. In this regard, the Court pointed out that many individuals conclude a large number of phone plans in a short time, without paying for those plans, in order to keep the phones that come with them. Credit information agencies such as the controller can help telecom providers avoid such frauds. Furthermore, the Court pointed out that Recital 47 GDPR lists fraud prevention as an example of a legitimate interest of the data controller. Then, the Court held that the processing of the data was necessary to prevent fraud. In the Court’s view, it was not apparent that less
Following the expiration of the prescribed time limit for submission of annual declarations of assets of judges, public prosecutors and investigating magistrates and their families, the Inspectorate at the Bulgarian Supreme Judicial Council requested the Sofia District Court to lift the banking secrecy of several judges and public prosecutors, as well as their families. The Inspectorate is comprised of an Inspector General and a panel of ten Inspectors. At the time, the terms of office of the Inspectorate members had been expired for two years and there was no provision in national law limiting the permissible extent of the extention of their duties . The referring Court was unsure as to whether the continuation of the performance of their duties by the Inspectorate past the expiry of their term undermines the independence of the Office under EU law and unsure as to the interplay between the provisions in the Bulgarian Constitution and the GDPR, and referred the following questions: (1) Must the second subparagraph of Article 19(1) TEU, read in conjunction with the second paragraph of Article 47 of [the Charter], be interpreted as meaning that it is per se or under certain conditions an infringement of the obligation incumbent on Member States to provide effective remedies sufficient to ensure independent judicial review for the functions of an authority which can impose disciplinary penalties on judges and has powers to collect data relating to their assets and liabilities to be indefinitely extended after the constitutionally stipulated term of office of that body comes to an end? If such an extension is permissible, under what conditions is that the case? (2) Must Article 2(2)(a) of [the GDPR] be interpreted as meaning that the disclosure of data covered by banking secrecy for the purposes of verifying assets and liabilities of judges and public prosecutors which are subsequently made public constitutes an activity which falls outside the scope of [EU]
On 10 November 2023, an ambulance service (the controller) transported a patient (the data subject) during a medical emergency. In the course of this operation, the controller collected personal data through the data subject's e-card. This included the data subject’s name and address. The stated purpose for this initial data collection was to provide emergency services. On 11 December 2023, the controller sent a postal donation request to the data subject for paramedic training, referencing the prior emergency transport. On 26 December 2023, the data subject filed a complaint with the DPA. They argued that the data used included health data within the meaning of Article 4(15) GDPR, meaning the controller could not rely on legitimate interests (Article 6(1)(f) GDPR) to further process the data. Moreover, the processing for direct marketing without consent violated the GDPR and their right to confidentiality of their personal data. In a response dated 13 March 2024, the controller argued that the change of purpose was permissible under Article 6(4) GDPR. The further processing complied with Article 14 GDPR because said change was noted in the footer of the donation letter. Furthermore, the controller contended that no special category data (Article 9 GDPR) was processed. On 1 July 2024, the DPA upheld the complaint. It found that the further processing of the data subject’s information for the purpose of sending a donation request violated their right to confidentiality under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597 National data protection law (DSG)] and was unlawful under the GDPR. Strikingly, the DPA found that the data constituted personal data under Article 4(1) GDPR and also as health data under Article 4(15) GDPR. None of the exemptions under Article 9(2) GDPR applied, rendering the further processing unlawful under Article 9(1) GDPR. Even if the data in question had not qualified as health data, the DPA fou
Meta Platforms Ireland Ltd. brought an action before the General Court seeking an annulment of [https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion_202408_consentorpay_en.pdf Opinion 8/2024 of the EDPB of 17 April 2024 on valid consent in the context of “consent or pay” models implemented by large online platforms]. They also sought compensation for the damages suffered as a result of the opinion under [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12012E/TXT:en:PDF Article 268 TFEU]. The EDPB argued that the Court should dismiss both the action for annulment and compensation as inadmissible and order Meta to pay costs. The EDPB claimed that the contested opinion is not a challengeable act that it was not of direct or individual concern for Meta. The EDPB further argued that the opinions adopted under Article 64 GDPR differ from the binding decisions under Article 65(1) as they do not, on their own, create legal effects. Meta argued that if such opinions were inadmissible, the autonomy of EU law would be undermined. Meta highlighted that data subjects may bring legal proceedings on the basis of such opinions before courts in the EEA, but not the EU, and that those courts cannot refer questions to the Court of Justice under [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12012E/TXT:en:PDF Article 267 TFEU]. This creates, Meta argued, a risk of conflict in the interpretation and application of EU law. Meta also argued that if their action for annulment was declared inadmissible, this would lead to a breach of its right to effective judicial protection as enshrined in Article 47 of the Charter. Finally, Meta submitted that the opinion produces binding legal effects. In support of this, Meta highlighted the limited discretion afforded to supervisory authorities under the opinion and claimed that it demonstrated the EDPB’s desire to force its views upon the Data Protection Commission (DPC), Meta’s lead supervisory authority. The C
In March 2020, the Ombudsman requested the DPA to initiate proceedings regarding several laws that introduced an obligation for judges and prosecutors to declare their membership in an association, which would then be included in a Public Information Bulletin. The declarations of membership included associations to churches, religions, political parties, and functions similar to trade unions. The Ombudsman argued that the law was unconstitutional. In addition, the Ombudsman requested that the DPA issue an order restricting the processing of this data, specifically to prohibit the publication in the bulletin until proceedings were complete. The DPA dismissed the case in April 2020. The DPA stated that Article 6(1) GDPR provided a legal basis for the processing based on a legal obligation (Article 6(1)(c) GDPR) and necessity for the public interest (Article 6(1)(e) GDPR). Finally, the DPA stated that it did not have the competence under Article 57 GDPR to decide on the issue of constitutionality; this was a matter the Ombudsman should have taken to the Constitutional Court. The Ombudsman appealed the decision to the Court of First Instance, arguing that the DPA should have also considered whether the law fulfilled the requirements of public interest and proportionality under Article 6(3) GDPR. The Court upheld the reasoning of the DPA, stating that law has a legal basis in accordance with the GDPR. According to the Court, GDPR does not give the DPA broader powers, since the this was not foreseen by the EU legislator or provided by national law. The Ombudsman appealed the case to the Provincial Administrative Court, who dismissed the case. The Ombudsman requested the Court to reconsider, or alternatively, the Supreme Administrative Court. In addition, the Ombudsman requested the Supreme Administrative Court to refer a preliminary question to the EU Court of Justice (CJEU). The Provincial Administrative Court referred the case to the Supreme Administrative Court. I
An association, les Licornes Ceélestes, brought an action before the Conseil d’Etat (Supreme Administrative Court) seeking, on a interim basis, the suspension of the execution of an order of the CNIL authorising the European Medicines Agency (EMA) to implement automated processing of the personal data of the general population in France for a study on the incidence and prevalence of pathologies within the framework of the “DARWIN EU” project. In the alternative, they sought a referral of questions to the CJEU concerning the validity, in light of the Charter, of Commission Implementing decision (EU) No 2023/1995 (authorising the EU-US Data Privacy Framework. The organisation claimed that the requisite urgency condition for such interim relief is satisfied as the propose processing concerns the health data of 10 million French people which would be hosted by Microsoft. This would necessitate transfers to the US where, they allege, there are insufficient guarantees as to the protection of personal data. The organisation further argued that there exists doubt as to the legality of the Commission’s decision to authorise the transfer, that it contains serious errors of law, fact and assessment by stating that no transfer to the US will take place when Microsoft cannot technically guarantee that the processing will occur solely in the EU. The organisation noted that the authorisation which permitted “technical usage data” to be transferred to the US incorrectly regarded this type of data as not constituting personal data. The Court noted that the standard required for the awarding of interim relief in this scenario is that the contested administrative decision causes a sufficiently serious and immediate harm to a public interest and whether it is sufficiently serious to warrant intervention pending a full hearing on the matter. Although acknowledging the risk of a request for access to the data by the US, the Court characterized this risk as “hypothetical” in light of t
In a combined case, two data subjects sought an order from the Amsterdam District Court for preliminary relief prohibiting LinkedIn (controller) from using tracking cookies on their website. The data subjects claimed that LinkedIn deployed two tracking cookies (li-gc cookie & b cookie) on their devices without having first received consent, as required under both the Dutch implementation of the ePrivacy Directive (Telecommunicatiewet (Tw)) and Article 6(1) GDPR. This action was filed on March 12 2025. In support of their claim, the data subjects relied upon a HAR study (a file within which network traffic is recorded) which allegedly showed that the two cookies in question were deployed before the data subject’s had given consent. Alongside this HAR file, the data subjects also submitted a report by an IT and security specialist who confirmed their claims. These cookies, it was claimed, were tracking cookies used by LinkedIn for their Real Time Bidding (RTB) system which allows for the display of targeted advertisements on their platform. LinkedIn denied the data subject’s claims. In their defense, they argued and both cookies were technically necessary, thus not requiring prior collection of consent under the Tw or the GDPR. They submitted that the li-gc cookie is used to store and retrieve website visitor cookie preferences and the B cookie is deployed to prevent fraudulent traffic and detect abuse on their platform. LinkedIn further argued that, in any event, both data subjects had given consent to the use of non-technically necessary cookies. In support of this, they produced screenshotted proof of the fact that the data subjects had consented to the question “Can LinkedIn and third parties use cookies to deliver relevant advertisements (including jobs) to you on and off our services and to measure the display and effectiveness of the advertisements?”. During the proceedings, the data subjects argued that they were not aware that the provision of consent as f
An employee of the Croatian Pension Institute (controller) provided an employer with information about the work history and potential pension size of one of their employees (data subject) without the data subject’s knowledge or consent. The employer then used this information to pressure the data subject into retirement in order to avoid formal termination procedures and the paying of required severance payments. The data subject suffered extreme emotional distress due to fear of loss of her livelihood and took sick leave. The data subject later had to find alternative employment. The data subject brought a claim for non-material damage against the controller for the emotional distress caused by the alleged improper disclosure of her personal data. During the trial before the Kutina Munuicipal Court, the controller argued that the data subject could not show evidence of damage and that, in any event, the personal data in question was not sensitive and would be known to any employer. The Court rejected the controller’s contention that the personal data in question was not sensitive. In doing so, the Court accepted that a data breach had occurred, as there was no lawful basis for the disclosure. Accordingly, the Court found that the controller had violated Article 6 & 24 GDPR. The Court accepted that the emotional damage suffered by the data subject warranted the awarding of monetary compensation and ordered the controller to pay the data subject €1,500.
A controller brought an action before the Administrative Court of Zagreb seeking annulment of a decision made by the Agencija za zaštitu osobnih podataka (Croatian DPA) where they were fined €2,500. The contested decision had found that controller had infringed Article 13 GDPR by using CCTV in and outside of their premises, a kebab shop, with signage only being visible upon entering the store. It was also found that an outdoor terrace had no signage at all. The controller argued that the fine amount was excessive and requests annulment of the decision and its adoption without the fine. The controller further agued that in relation to the outdoor terrace, this area is only accessible through the shopping centre where there are existing signs highlighting that CCTV is in operation. The controller contended that a warning under Article 58(2)(1) GDPR in lieu of a fine would have been more appropriate in the circumstance. The DPA argued that the decision was taking lawfully and based on a correct application of the law. The DPA noted that the small notices were not visible to data subjects before entering the recording perimeter and the notice published on the controller’s website was insufficient and did not include the contact details of the controller. The DPA further submitted that they were obliged to impose and administrative fine in the circumstances as a more lenient sanction in this case was not provided for under the law. The Court firstly highlighted an inconsistency in the contested decision. The DPA had at one point highlighted the existence of CCTV in the outdoor terrace, but further on in the decision, failed to include this area in the list of areas covered by CCTV. The Court further noted that although the decision found an infringement of Article 13 GDPR on the part of the controller, there were no reasons for this provided in the decision. The Court was further critical of the lack of clarity in the DPA’s decision as to the existence or the absence o
The data subjects held health insurance with a provider. After failing to meet their payments and incurring medical expenses, a civil claim was initiated between the data subjects and their insurance provider. During the course of the proceedings, third-party stakeholders were allowed to submit financial and medical documents for consideration by the court which concerned the data subjects. On June 1st 2023, the data subjects filed a complaint with the AP (Dutch DPA), alleging that the third parties were wrongfully allowed to provide the documents in the civil proceedings. The DPA assessed the data subject’s complaint but did not conduct a full investigation, claiming firstly that the complaint was not a GDPR issue, and secondly, that the DPA cannot act sufficiently effectively to resolve the dispute. After the data subject’s objection, the DPA examined the complaint. The DPA assessed the necessity of inclusion of the medical and financial documents by the third party and found that there existed a legitimate interest. In September 2023, the DPA rejected the data subject’s claims that the processing of these files was prohibited on the grounds of Article 9 GDPR, noting that the processing was necessary for the substantiation of a legal claim. The data subjects appealed this decision to the District Court of Central Netherlands. In their appeal, they sought that the DPA’s decision be overturned and that they be provided compensation for the unlawful use of their personal data. The data subjects claimed that the documents, by their nature, should disallow their inclusion in the court proceedings by the third party. The documents reveal the medical service which the data subject’s have used and also reveal the specific medication taken by one of them. The Public Prosecutor issued their advice to the Supreme Court. The Public Prosecutor advised that the third parties did hold a legitimate interest for the inclusion of the documents in the civil proceedings. The Pub
A data subject filed a lawsuit against a hotel and service company (the controller), seeking PLN 50,000 (€11,500) in compensation for the alleged unlawful use of her image and an injunction prohibiting its use on an outdoor billboard. The data subject had been employed by the controller from 1 April 2017 to 30 September 2017. She claimed that in 2019 her image appeared on the billboard for approximately three months without her consent. She sent three letters requesting the removal of the image and compensation. While the controller removed the image, it refused to pay compensation. The data subject relied on Article 82 GDPR, Articles 23 and 24 of the Civil Code (Kodeks cywilny) and Article 81 of the Act of 4 February 1994 on Copyright and Related Rights (Ustawa o prawie autorskim i prawach pokrewnych), arguing that her personal rights were infringed and that her former employment did not constitute consent. She also stated that the image appeared on the defendant’s Facebook profile from 29 September 2017 to 23 November 2020 without her consent. The controller argued that it was not liable because it had commissioned an external company to produce the advertisement. It claimed that the data subjects had given verbal consent to participate in a professional photo, and that her image appeared only as a minor background detail, which did not require consent under Article 81(2)(2) of the Act on Copyright and Related Rights. The controller also stated that the data subject could not be identified from the billboard and that any liability for infringement rested with the advertising company. The court held that the data subject did not consent to the use of her image for advertising purposes. It established that she participated in the photoshoot under instructions from her supervisor, believing only her hands would appear, and that no consent was given for the publication of her face. The court argued that the controller made the decision to publish the image and is
A credit information agency (the controller) stored data regarding three undisputed and settled claims against an individual (the data subject) for a total of about €750. The last of these claims dated to February 2022 and was paid in December of the same year. In November the data subject reached out to the controller and requested the erasure of the claims. The controller only erased the oldest claim and refused to delete the other two, claiming that the retention was justified under the legal basis of its legitimate interest. The two remaining claims were updated with a settlement note. Additionally, creditworthiness scores were calculated based on the claims and were disclosed to a number of third parties: several banks, an energy supply company, and a telecommunications company. The data subject requested the Regional Court of Cologne to order the erasure of the two remaining claims. The data subject also required compensation for immaterial damages. The Regional Court dismissed both request and held that the legitimate interest of the controller justified the retention of the data for three years. The data subject challenged the ruling and claimed that the legitimate interest of the controller did not justify the storage of settled claims for longer than six months. In this regard, the data subject referenced the case law of the EU’s Court of Justice. The controller requested the Court to dismiss the appeal. It argued again that it had a legitimate interest in storing the data, based on empirical analyses showing a correlation between an individual’s paid debts and their risk for insolvency. The controller also argued that the retention complied with a relevant code of conduct drafted by the Association of credit information agencies and approved by the Hessian DPA. The Court reversed the first instance ruling: it held that the storage of the data was unlawful and awarded non-material damages. On the lawfulness of the data storage The Court held that the con
The controller, IGC, a French construction company, hired the data subject, M. [E], as a branch manager on 8 July 2004. The controller dismissed the data subject for gross misconduct on 16 December 2019. The controller relied upon an IP address captured in IT log files as evidence of serious misconduct. The data subject contested the dismissal. The Agen Court of Appeal accepted the controller’s evidence and upheld the data subject’s dismissal on 10 January 2023. The data subject appealed the Agen Court’s judgment to the Court of Cassation (highest appeal court for civil and criminal cases in France). The Court analysed whether an IP address captured in IT log files is personal data within the meaning of Article 4(1) GDPR and whether a controller's use of those logs to identify an employee for disciplinary control is lawful under Articles 5 and 6 GDPR. On 9 April 2025, the Court of Cassation firstly reaffirmed that IP addresses are personal data as they allow the indirect identification of a natural person within the meaning of Article 4(1) GDPR. Secondly, the Court of Cassation noted that processing must be lawful, fair and transparent as per Article 5(1)(a) and purpose bound as per Article 5(1)(b) GDPR. In this case, the Court found that the controller processed the IP address in the IT logs for the purpose of individual discipline measures and that the data subject did not consent to the controller using the IP address in the IT logs for that purpose. The Court of Cassation deemed the processing not to be in compliance with Article 5(1)(a) GDPR and Article 5(1)(b) GDPR. Therefore, the Court quashed and annulled the Agen decision in full. The Court referred the case back to the Pau Court of Appeal. Finally, the Court of Cassation ordered the controller to pay €2,000 to the data subject.
A data subject brought a complaint to the DPA in April 2022. The data subject requested an address publisher and direct marketing company (the controller) to delete all their personal data and no longer process it in the future, referring to both Article 17 GDPR and Article 21 GDPR. The controller deleted data at the request of the data subject, however later notified them that the data had been re-collected in an response to an information request by the data subject. The data was also transferred to direct marketing companies and address publishers. The DPA upheld the complaint in March 2023, and stated that the controller processed the data unlawfully by reusing it for direct marketing purposes. According to the DPA, the data subject made a clear wish of wanting to prevent their data being processed for marketing purposes, and therefore the controller had violated Article 5(1)(a) GDPR and 5(2) GDPR in conjunction with Article 21(2) GDPR. The DPA saw no need to determine whether the data subject had carried out a request for erasure or a request for erasure and objection; according to the DPA, the request clearly showed the will of the data subject. The controller appealed the decision to the Federal Administrative Court in April 2023. It argued that it had complied with the data subject’s deletion request; by completely deleting the data, it also deleted the data subject’s request to delete it. Therefore, re-collecting the data was a possibility. According to the controller, if the data subject had not requested to completely delete the data, it would have simply “blocked” the data from future processing. Furthermore, the data subject’s data was re-collected due to research performed by the controller. It is important to note here that the controller did not inform the data subject of the distinction between blocking the use of data for future marketing purposes and deleting the data (and potentially re-collecting it). The Court first stated that in order for
On December 7 2021, the data subject initiated court proceedings against Apple Distribution International Ltd. (controller) on the grounds that they failed to comply with their access request. The data subject requested, in particular, access to the specific recipients of their data, the contents of any disclosures or transmissions of their data, the storage period for their or criteria for determining it, and specific information under Article 15(2) GDPR. In response to the access request, the controller included some files which were incomplete and incomprehensible to the data subject. Furthermore, information about advertising placements were not provided and the data subject was not informed about which of the data subject’s data was fed into the advertising algorithm. Finally, the data subject was given complex data structures and records containing links which could not be decrypted. The controller denied the claim and argued that they had fully complied with the data subject’s access request. The controller argued that they do not keep detailed records documenting which specific personal data was disclosed to different recipients or processors and stated that their retention periods are determined with reference to the purposes for each processing activity. The controller also acknowledged that they make third country transfers via standard contractual clauses, despite the data subject not having been given any information on these in response to their access request. An expert witness attested to the fact that some of the data provided was incomplete, that the controller had further data relating to the data subject, and noted that some of the structures of the data provided were so convoluted that he himself could not decipher them. The Court accepted the evidence provided by the expert witness and ruled that the controller had violated the data subject’s right of access. The Court regarded the violation as “serious” in nature. The court ordered the con
The City of Espoo (controller) had implemented Google Workspace for Education in the primary schools under their remit. The controller relied on Article 6(1)(c) GDPR to do so, believing the measure necessary for compliance with their legal obligation to organise basic education. On 30th December 2021, the Finnish DPA held that Article 6(1)(c) GDPR did not provide a valid lawful basis for the processing in question, and the use of the e-learning platform was not in compliance with the GDPR. The DPA noted that processing based on the ground of legal obligation must explicitly refer to the nature and purpose of the processing. The DPA commented that the Basic Education Act does not refer to the nature of the processing or require the implementation of an e-learning platform, thus leaving the controller with significant discretion in fulfilling their obligation and rendering the use of this provision as a legal obligation inappropriate. During the investigation, the DPA also highlighted the fact that this processing operation involved the collection of large amounts of data (including sensitive data) of children who are vulnerable data subjects, both while they are at home and at school. Also, the amount of data processed was far higher than that which would be processed under a traditional pre-school education arrangement. Additionally, the controller had to accept Google’s standard terms and conditions which limited their ability to control the processing taking place. The DPA therefore concluded that the use of such an e-learning platform cannot be automatically considered necessary and proportionate to allow the controller to justify the processing without having performed a case-by-case assessment in light of their obligation to organise basic education. On 30th June 2023, the Administrative Court rejected the controller’s appeal against the decision. The Court reasoned that the Basic Education Act does not define the means of processing and thus leaves the cont
L.H. lodged a request with the Ministry of Health (the controller) for information concerning the identification of persons (the data subjects) who had signed contracts for the purchase of COVID-19 screening tests concluded by the controller, as well as certificates relating to those tests and demonstrating that they may be used on the territory of the EU. The controller partially granted L.H.’s request redacting the forename, surname, signature and position relating to the data subjects who had signed certificates on behalf of the legal persons concerned and, in some cases, the email address, telephone number and website of those legal persons. The reason to justify the redaction was the protection of the personal data of the data subjects referred to in those certificates, in accordance with the requirements of the GDPR. According to the controller, the data subjects operate from China and the United Kingdom, where the legal persons issuing the certificates are registered, and that the domicile of those is unknown to it. It is therefore impossible for the controller to inform and consult them on that subject. Czech case law provides for an obligation to inform or obtain the opinion of data subjects concerned by a disclosure request. L.H. brought an action for annulment of the controller’s decision to disclose only redacted information before the Prague City Court. The court upheld that action, holding that the controller could not refuse, as a matter of principle, to disclose information constituting personal data because it cannot first inform or obtain the opinion of the data subjects. The controller brought an appeal on a point of law against the decision before the Czech Supreme Administrative Court, which is the referring court. In that context, the that court stayed the proceedings referred in essence the following questions to the Court of Justice for a preliminary ruling: # Must Article 4(1) and (2) GDPR be interpreted as meaning that the disclosure
In March 2021, a data subject (represented by noyb) filed a complaint to the DPA against an address publisher and direct marketing company (referred to as the address publisher or the controller) and a credit information agency. The data subject submitted a request for information (Article 15 GDPR) to the address publisher and several credit information agencies in Austria. The address publisher was named as the source of the data; it had collected it for the purposes of exercising the trade of address publisher, however, it also transferred data as part of a contractual agreement with the credit information agency. This agency processed data (name, date of birth and (partially historical) addresses) for the purpose of assessing the data subject’s creditworthiness. The credit information agency has an additional business license for address publishing and direct marketing. In the complaint the data subject argued that this processing violated the principle of purpose limitation (Article 5(1)(b) GDPR in conjunction with Article 6(4) GDPR). The data subject had not provided data to the controller and was not informed of the changes in the purpose of data processing. Furthermore, the way in which the credit score was calculated was unclear to the data subject. The address publisher argued that its business license allowed it to process personal data and disclose it to third parties. In its decision, the DPA stated the controller had violated the principle of purpose limitation because it collected data for marketing purposes, but transferred data to the credit information agency for the purposes of credit rating. The DPA also stated that the data subject had no subjective right for the DPA to impose a processing ban. The data subject appealed the second point of the decision, arguing that a processing ban is the only way to effectively prevent future unlawful data processing. The controller appealed the first point of the decision, arguing that it amended the agreem
The data subject was a fire prevention officer working for the Irish Health Service Executive (HSE) and was provided with a work phone to be used for work purposes. In May 2021, the HSE suffered a significant data breach and ransomware attack which compromised a large number of HSE computers and devices, including the data subject’s work phone. In June 2021, the data subject noticed that his personal email account and personal cryptocurrency account, both of which he had accessed on his work phone, had been compromised. Cryptocurrency to the value of €1,400 had been stolen. After being left unsatisfied with the HSE’s response to a complaint he had filed in relation to the incident, the data subject complained to the DPC on 15 December 2021. In an email to the data subject about the issues he raised, the DPC noted that the HSE was not the data controller in respect of the data subject’s non-work-related personal data which was on the work phone as the device was only supposed to be used for work purposes. It was found that there was “no basis” upon which the HSE could be considered the data controller when the personal data (personal email and cryptocurrency account) was stored on the device without the HSE’s knowledge or agreement. On 15 August 2022, the data subject sought a judicial review before the High Court of the DPC’s decision. The data subject claimed that the work-related data comprised “personal data” under Article 4(1) GDPR, that the HSE was the data controller in respect of it in accordance with Article 4(7) GDPR, and that the DPC had erred in their findings in respect of their decision. This, according to the data subject, rendered their decision “unreasonable” in accordance with the test laid out in Meadows v Minister for Justice, Equality and Law Reform [2010] 2 I.R. 70. This decision established some criteria for which an administrative decision can be judicially reviewed in Ireland. The data subject also claimed that the DPC had failed in their ob