GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 21 October 2026 · Updated daily
plaintiff 1
The data subject had a car insurance and suffered an incident. They reported the incident to the insurance company, the controller. The controller alleged that they provided incorrect information about the collision and considered the report as a fraud. It then registered the data subject in two databases: the CBV of the Dutch Association of Insurers (used by insurers to coordinate investigations and perform analyses) and the external referral register (used by financial institutions when assessing insurance applications and claims). The data subjects sought to cancel both registrations, but the controller denied to do deregister them, so they filed an action before the Court. The Court had to determine whether these registrations should be cancelled under the provisions of the GDPR, namely Articles 21(1), 17(1), and Article 6(1) (e) and (f). First, the court referred to the provisions of the Protocol Incident Warning System Financial Insitutions 2021, specifically Article 5(2)1 which lists the requirements for deletion of registers. In the present case, tt concluded that a fraud was indeed committed and stated that this qualified as a criminal offence under Article 350 of the CPS. Therefore, the Court considered that the principles of proportionality and subsidiarity were respected and that the controller had a legitimate interest in protecting the financial sector from fraud. No violation was found and the data processing was considered as legal.
Court case 2 O 186/22
The data subject contracted a private health insurance with the controller. The controller informed the data subject that their insurance premiums would increase. The data subject received the corresponding insurance certificates from the controller. Subsequently, the data subject unsuccessfully requested additional supplementary information about the increase of premiums. Consequently, the data subject decided to sue to controller, arguing that the controller is obliged to give them access to the supplementary information pursuant to Article 15 GDPR. Additionally, the data subject referred to other court proceedings which held invalid comparable premium increases from the same insurance company, to clarify the reasons for their claim for supplementary information. The court dismissed the claim based on Article 15 GDPR. It held that the access request constituted an abuse of rights (Section 242 of the German Civil Code). According to this principle, an exercise of a right is not permitted if, among other things, the claimant takes advantage of a formal legal position or asserts something in which he or she has no self-interest worth protecting. According to the intention of the data subject, the requested information is to serve exclusively the pursuit of benefit claims. This is a purpose completely unrelated to the purpose of Article 15 GDPR. According to recital 63 of the GDPR, the right of access under Article 15 GDPR serves the data subject to be aware of the processing of their personal data and to be able to check its lawfulness. Thus, Article 15 GDPR is intended to enable a lawfulness check on data processing operations. The data subject should be able to assess the scope and content of the stored data. Moreover, the information received through Article 15 GDPR also serves to enable the data subject to exercise further rights under the GDPR, in particular the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, and the right to restriction of processing under Article 18 GDPR. The court therefore rejected the claim of the data subject as the they had no relevant data protection interests: "not even as a reflex".
Court case 9 O 158/21
The plaintiff, who suffered severe shoulder pain and had an unstable biceps tendon, underwent surgery at the defendant hospital on 10 January 2019. Despite an elective medical agreement with the defendant anesthesiologist, he did not participate in the surgery due to unavailability. Post-surgery, the plaintiff reported numbness in her left cheek and speech difficulties, which she claimed were initially dismissed by the hospital staff. Subsequent medical evaluations found no acute issues, but a suspected hypoglossal nerve palsy was diagnosed. The plaintiff declined the recommended corticosteroid therapy. On 16 February 2019, the plaintiff requested full disclosure of her medical data under GDPR from the hospital, which provided her treatment documentation, claiming it was complete. In November 2019, she initiated an independent evidence procedure, resulting in an expert report. The plaintiff claimed the surgery caused nerve damage due to faulty intubation and positioning and that the hospital's response to her complaints was inadequate and delayed. She also alleged insufficient information on corticosteroid therapy, leading to her rejection of the treatment, and claimed ongoing health issues and job loss due to the surgery complications. The court dismissed the plaintiff's claims, ruling that no treatment errors occurred during the surgery or in the hospital's response to her complaints. The expert testimonies confirmed that the surgery and postoperative care were conducted according to medical standards. The court found the plaintiff's positioning and intubation during surgery to be proper and the complications she experienced to be rare, inherent risks not resulting from malpractice. The documentation of the plaintiff's care was deemed sufficient, and the plaintiff's claim of earlier complaint communication was unsupported. Regarding the GDPR claims, the court held that the hospital had provided all required personal data and adequately fulfilled its disclosure o
Court case 22/01253
A patient (the data subject) was treated in a hospital. Because she believed that an error had been made, she held the hospital liable. The hospital involved its liability insurer. On behalf of this liability insurer, a doctor from another hospital assessed the data subject's medical file. He checked whether the treatment had been carried out correctly. This doctor did not see the data subject nor was she involved in the investigation in any other way. The data subject found out that this other doctor had made an assessment of the treatment and tried to get access to the findings. The doctor who made the assessment refused her access. The data subject then filed a disciplinary complaint against this doctor with the Regional Medical Disciplinary Tribunal. The Regional Tribunal declared the complaint unfounded. The data subject appealed against this decision to the Central Medical Disciplinary Tribunal. The data subject argued that she should get access to the medical assessment based on the inspection rights from the Medical Treatment Contracts Act (MTCA) laid down in the Dutch Civil Code (article 7:456 BW). However, the Central Tribunal held that the data subject could not appeal to these rights, as an exception in the MTCA was applicable (article 7:464 BW). According to the Central Tribunal, the nature of the legal relationship (the trial) between the data subject and the hospital opposed this. It explained that the hospital had the right to prepare their defence against the data subject's liability claim 'in freedom and seclusion'. In that context, they must also be able to call in another doctor to assess the course of treatment, without the data subject being able to inspect the findings. The Central Tribunal therefore held that there was no obligation to make the medical assessment available to the data subject and declared the complaint unfounded. As a rule, decisions of the Central Tribunal cannot be appealed. However, cassation is possible if it is in the
Court case 202006960/1/A3
The data subject submitted an access request with the municipality of Westerveld (controller). The controller responded that a name and postal address were insufficient to verify his identity and it needed additional information from the data subject. The data subject then wrote the controller that it would file an appeal against the controller for not responding to his request in good time if it did not respond soon. The controller responded that it already did, and re-sent its previous letter. The data subject therefore submitted an appeal with the court for not responding in good time. The Court considered that by not identifying himself, the data subject was partly responsible for the fact that no decision was made. It noted that the data subject did not argue that the controller's request for additional information was unlawful. The Court held that the data subject's appeal constituted an abuse of procedural rights and deemed the appeal non-admissible. The data subject appealed the court's decision at the Council of State. The Council of State heard the case together with three similar appeals from the data subject, namely 202004183/1/A3, 202006929/1/A3 and 202006950/1/A3 (see comments). Both parties were present at the hearing. During the hearing, the data subject argued that he had not abused his procedural rights. Contrary to the court's consideration, he did argue that the controller's request for additional information was unlawful. The data subject stated that the fact that he did not respond to the controller's unlawful request did not make his appeal an abuse of his procedural rights. The Council stated that abuse of procedural rights is only present if a right or power was used so blatantly without reasonable purpose or for a purpose different from that for which they were granted, that the use of those rights or powers shows bad faith.RvS 19 November 2014, ECLI:NL:RVS:2014:4135. A more or less excessive reliance on government offered facilities does not in itself constitute an abuse of rights.RvS 27 January 2016, ECLI:NL:RVS:2016:157. However, the frequency with which a given right or power is used combined with other circumstances, may contribute to the conclusion that an abuse of rights has taken place. In this regard, the Council noted that the data subject lodged thirteen appeals for requests submitted to different municipalities. The Council noted that the controller rightfully considered a name and PO box insufficient to establish his identity. The controller was therefore entitled to ask the data subject for further information pursuant to Article 12(6) GDPR.RvS 9 December 2020, ECLI:NL:RVS:2020:2927. The data subject did not disputed this either. The Council followed that the data subject did not respond to invitations from any of the municipalities to make contact. Nor did he choose to wait for the decisions on his requests. He immediately loged appeals after his notices of default, followed by requests for periodic penalty payments. Considering the data subject's procedural conduct, the Council believed that the data subject was only out to collect penalty payments. The Council also took into account that at the data subject only expressed concerns about the question whether the periodic penalty payments awarded would be paid at the hearing, but not about whether he would still receive his personal data. Therefore, the Council held that in the present case there were compelling grounds to establish that the data subject abused his right to appeal against the failure to decide in due time on his requests, as referred to in article 3:13 and read in conjunction with article 3:15 of the Civil Code. The appeal at the Council is unfounded and the Court's judgement should be upheld.
ELQ Portefeuille I B.V.
The data subject owned a house with his ex-wife that was financed with a mortgage from the controller. After the divorce, the data subject sold the house and retained a residual debt of €61,502.89. The data subject then became depressed and was unable to work. In 2013 and 2014, he received a reduced income under the Dutch Sickness and Benefits Act. Following debt mediation, the data subject repaid €12,224.96 over three years. The controller wrote off the remaining €49,354.75, and the debt was discharged on October 5th, 2021. On June 8th, 2022, the data subject was once again employed and with his current partner, he signed a purchase agreement for a new house. The couple had until 5 September 2022 to come up with the necessary funds to complete the purchase, but they were denied a mortgage because the data subject's previous debt with the controller was still registered in a credit registry. On 4 July 2022, the data subject requested the controller to remove his name from the credit registry so that he could obtain a new mortgage. On 12 July 2022, the controller rejected the data subject's request. The data subject then filed a claim at the District Court of Amsterdam requesting that it to order the controller to remove his name from the credit registry. The legal basis for processing the data subject's personal data was Article 6(1)(f) GDPR: a credit registry protects the legitimate interests of consumers against excessive lending and protects lenders against borrowers who cannot or will not repay their loans. The Court took no issue with this legal basis, and the data subject did not dispute these legitimate interests. That being said, the data subject still had the right to object to processing under Article 21 GDPR and have his personal data deleted from the registry under Article 17 GDPR so long as these legitimate interests did not override his right to erasure. Weighing these interests, the Court considered that the data subject ran into financial problems not because of irresponsible borrowing or a pattern of excessive spending, but because of unfortunate personal circumstances. Furthermore, he had taken responsibility for paying off his debts to the extent that he was able, had returned to stable employment, and was seeking a loan to purchase a house within his current means. The data subject thus represented a low financial risk and had a significant interest in taking out a mortgage. While the controller had written off a substantial amount of the data subject's debt, the Court found that this single circumstance could not be decisive. It held that the interest of the data subject in moving on with his life and buying a new home with a new partner outweighed the controller's general interest in keeping the data subject's debt registered for the usual span of time. The Court thus granted the data subject's request, ordering the controller to remove the data subject's name from the credit registry. The controller had agreed to comply with the Court's judgment. However, the controller was ordered to pay the data subject's legal fees, estimated at €1,461.18.
Court case 2 Sa 16/21
The case concerned the validity of two ordinary notices of termination issued by the former employer of the plaintiff, and the continuation of the plaintiff's employment with the second defendant. Among various claims in the proceedings, the plaintiff argued that their former employer violated their Article 15 GDPR obligations as a data controller. The plaintiff requested information under Article 15 GDPR from its former employer as a data subject. On 25 January 2021, they received an email response from the data protection officer of the data controller's parent company. The email included a reference to an attachment with the requested information. The plaintiff claimed that this constituted a violation of the GDPR, since they did not receive the information from the data controller, but from the data protection officer of the parent company. Furthermore, they claimed that the reference to the attached appendix in the email was not transparent. The plaintiff sought information from the former employer pursuant to Article 15 GDPR, the provision of copies of the personal data processed, and damages for violations of the GDPR. Concerning the "person responsible" for the provision of information The court held that the information was provided by the "person responsible", even though the sender of the information letter was not the controller itself, but the data protection officer of the parent company. According to Article 12 (1) GDPR, a controller must only take "appropriate measures" so that the notification obligation pursuant to Article 15 GDPR is fulfilled. This can be done by a delegated agent, which the data protection officer in the case at hand is. Concerning the form of the provision of information The court held that the information provided by email was sufficient. Pursuant to Article 12 (1) GDPR, the information must be provided in writing or in another form, if necessary also electronically. No formal requirement applies. Almost all correspondence in the employment relationship between the data subject and the data controller was conducted electronically by email. Therefore, the provision of information by email was appropriate.
Court case 4 C 1845/21
The controller is an architect, building biologist, energy consultant and real estate expert. In 2020, the controller prepared an expert opinion on the value of a property on behalf of the data subject's former wife in the context of a family law dispute. The data subject who had not given prior consent was made identifiable in the expert opinion as the owner of the property by stating his full name. In 2021, the data subject sent an access request to the controller, to which the latter replied without attaching the expert opinion as such to the letter. With several more letters, the data subject claimed damages while calling the controller names and threatening exposure to the Architects' Chamber and the Data Protection Authority. With further letters, he targeted the controller's lawyer. Before the court, the data subject claimed that the information provided was incomplete because it lacked the expert opinion as such. He argued that data relating to any third persons could simply be redacted in the document. The controller claimed that the requested information was not included in the right to access and that any further information would infringe other parties' rights. In any case, the request was unfounded and excessive. The District Court of Pforzheim managed the case. The court dismissed the data subject's claim, agreeing with the controller. First, it held that the data subject's right to access had been fulfilled by the controller. According to the court, the scope of information owed under Article 15 GDPR is dependent on the controller's intention. Once the controller has given the information in accordance with what they believe constitutes the entirety of the data processed, the suspicion that the information provided is incomplete or incorrect cannot justify a claim to information to a greater extent. Essential for the fulfillment of the right to information is therefore the - possibly implied - declaration by the controller that the information is complete. Furthermore, the data subject had not demanded a copy of the expert opinion or the file in his access request. Since the controller had expressed his intention of fulfilling the access request by stating that other data of the data subject had not been processed, the court concluded that there was no valid claim to further information. The court left the question of whether the data subject could demand a copy of the data or whether third parties' rights could be respected by redactions unanswered. Instead, it held that, in any case, the access request had been manifestly unfounded and excessive in the sense of Article 12(5) GDPR. According to the court, it was clear from the overall context that the data subject was primarily using the right to information under Article 12 GDPR to harass the controller and his legal representatives by threats and insults.
Court case 12 W 23/22
The data subject made a request upon Article 15 (3) GDPR to get access to her treatment Data from the time from 14th December 2020 to 19th February 2021. He has already received a Paper File in which X-Ray, MRI, and CT reports were missing. The data controller, a hospital where the data subject has received her treatment, has claimed, that she has received the X-Ray, MRI and CT reports on a Compact Disc (CD) in a PDF Format File, along with all the other documentation. The data controller has claimed €6,000 as the dispute value for the violation of Article 15(3) GDPR. The Regional Court in Cottbus has set in his decision the value on €1,000. The Higher Regional Court of Brandenburg confirmed the decision of the Regional Court in Cottbus. The court held that the data controller has partially fulfilled his obligation to provide the access to the data subjects’ own data since the majority of the Data requested was already provided in paper form, from which she could already get an insight into her treatment at the data controller’s institution. Due to this, the court held, that the value of the dispute could not be valued as high as it was claimed by the data subject. The court has dismissed the appeal and upheld the first-instance judgement.
T-Mobile Netherlands B.V.
The data subject had a phone subscription with T-Mobile (controller). The Central Bureau of Statistics (CBS) conducted statistical research with large datasets acquired from T-Mobile. T-Mobile stated that no personal data was shared with the CBS since all data had been anonymised. The data subject doubted statement from T-Mobile. He submitted an access request for the personal data T-Mobile processed for the CBS’s research. T-Mobile rejected the request stating that it had not processed any of the data subject’s personal data in this regard. Since the data subject was convinced that T-Mobile had to comply with his request, he brought the issue before the court. In an [https://gdprhub.eu/index.php?title=Rb._Oost-Brabant_-_C%2F01%2F371762_%2F_EX_RK_21-90_%28interim_decision%29 interim decision] the court held that T-Mobile violated Article 15 GDPR because any anonymisation process involves processing of personal data at least in the initial phase. The Court stipulated that T-Mobile had to indicate the exact nature and origin of the processed’ personal data. Although T-Mobile claimed that it had deleted that data, it submitted no proof of this. The court decided to suspend the proceedings and T-Mobile was given the opportunity to submit additional documents. T-Mobile submitted these additional documents in the case at hand. However, the data subject stated that these documents still did not include all the information requested. The court mostly adhered to its interim decision. It held that T-Mobile did provide all the information required under Article 15(1)(a), (c), (d), and (g) GDPR. The court found that an email where T-Mobile's director of Intelligence & Insights stated that "the data had been deleted" sufficient evidence of that fact. As there was no data, it could not be provided to the data subject. However, T-Mobile did not provide sufficient information about automated decision-making and profiling (Article 15(1)(h) GDPR). The Court ordered T-Mobile
unknown data subject (complainant before the DSB)
The data subject and his wife were in divorce proceedings. The wife mandated a chartered accountant (controller) to calculate her (future) alimony claims against the data subject. According to the data subject, the controller's report on the alimony claims was partially based on data that was not publicly available, especially data on the financial situation of a private foundation that was one of the data subject's sources of income. The data subject accused the controller of having obtained this data unlawfully. In July 2018, the data subject requested access under Article 15 GDPR from the controller, especially asking for information on the source of the data and a data copy. As the controller did not reply to the access request, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB) in August 2018. Before the DSB, the controller argued that the report on the alimony claims was based on documents provided by the data subjects wife. The data subject contested to have ever handed any information concerning the private foundation to his wife. The controller did not provide access to the data subject in the course of the procedure before the DSB. In April 2019, the DSB issued a decision and held that the controller had failed to comply with the data subject's access request and ordered the controller to comply or to inform the data subject of the reasons for not doing so under Article 12(4) GDPR. The controller appealed the decision, arguing that it could not comply with the data subject's access request because that would violate its statutory professional secrecy obligation under § 80 WTBG 2017 (Wirtschaftstreuhandberufsgesetz 2017) in connection with Article 15(4) GDPR, as the data subject's wife had not waived this secrecy obligation. The BVwG dismissed the appeal and upheld the DSB's decision (with some minor edits). It held that the professional secrecy obligation under § 80 WTBG 2017 does not provide a gen
Hamburgische Krebsregister (Hamburg Cancer Registry)
The parties are in dispute about Hamburg Cancer Registry data processing and data transfers procedures. The data subject was diagnosed with breast cancer in 2019 and is a resident of the federal city-state of Hamburg. Treating physicians are legally obliged to transfer personal data of their cancer patients to the Cancer Registry. The Hamburg Cancer Registry (HKR) is an independent department of the regional Authority for Science, Research, Equality and Districts. Task of the registry is to identify cancers to be recorded in relation to the population, i.e. occurrence and frequency of diseases and their distribution according to age, sex and place of residence. Transferred data contains name, health insurance number, residence, data of birth, sex, sometimes personal habits (e.g. smoker) and health related data like diagnose, start, length and result of treatment. The data is processed in a confidential (physical) area within the HKR. Moreover, to pseudonymise the data, a set of hash-based control numbers will be automatically generated for every data set. Only the employees of the confidential area have access to the unencrypted personal data. Health related data sets will be shared with other cancer registers and cancer combating organizations on the federal level. The regional law applied here is the Hamburg Cancer Registry Act (HmbKrebsRG). The concerned data subject received a data protection declaration of consent and privacy information with her treatment contract from the hospital. The data subject gave consent to all data transfers at the end of April 2019. In March 2020, the data subject received a request from the University of Lübeck to take part in a cancer-study. According to the letter, contact was made, because the data subject was registered in the HKR. Subsequently, the data subject submitted a right to access request to the HKR. According to the HKR, the data subject received a complete overview of the stored data. This overview contained a
The Board of Mayor and Aldermen of the Municipality of Amsterdam, Education, Youth and Care
The data subject was an undocumented immigrant who lived in a shelter. He invoked his right to access and requested a copy of all his personal data processed by the municipality (controller), including internal emails and messages regarding the data subject (Articles 12 and 15(1) GDPR). He also requested access to personal data which was processed by the controller's employees using certain services, for example Microsoft (Office 365 and Exchange), Facebook (Whatsapp, Messenger), Telegram and Signal. His goal was to get insight in how the controller was monitoring and assessing him, to determine, among other things, which shelter should be offered to him. The controller asked the data subject to specify his access request, to which the latter did not reply (more precisely, the data subject stated that he was not able to specify his request any further because he did not know the specifics of the processing). The controller answered the request by providing a general overview of the personal data processed and three partially anonymized copies of documents. Being not satisfied with the controller's response, the data subject filed an action before the competent court. During the procedure, the court also revealed that the data subject had already send multiple similar access requests to the same controller in the past. The court concluded that the controller's answer to the access request was sufficient. The court found that the data subject had not sufficiently specified his access request. The general nature of his request would have placed a disproportionate burden on the controller, considering the large amount of personal data processed, which would result in disproportionate amount of time and financial resources spent by the controller to search for the requested personal data. The court also considered here that the data subject had already filed multiple similar requests in the past. Also, the controller had asked the data subject to specify his requ
Court case 4 K 836/21
The plaintiff sought the correction of a naturalisation certificate. He had been naturalised by the defendant (a German administrative body) on 28 July 2005. The naturalisation certificate was in the name of S. K., born on xx.xx.1967 in Khost/Afghanistan. However, it turned out that he had given false information about his identity when requesting naturalisation. He had been living in Germany since 1995 with false personal data from Afghanistan and naturalised with these personal details. In truth, however, he was a Pakistani citizen with the name S. R., born on xx.xx.1966. The applicant submitted a Pakistani identity card, a Pakistani birth certificate and a family registration certificate with details of his wife and children and requested that the naturalisation certificate be amended to read S.R., born xx.xx.1966 in N./Pakistan. The defendant informed the applicant that his request could not be granted. The naturalisation certificate had become effective despite the mistake in identity. The cause of the incorrectness of the certificate was that the plaintiff had given incorrect personal details. The naturalisation was thus not null and void, but only afflicted with defects which, however, were accepted for reasons of legal certainty after the expiry of the time limit of section 35 of the Basic Law. The defendant elaborated that there were many cases in which the naturalisation certificate contains a different name from the one the naturalised person uses, for example in the case of a name change after marriage. In this case, the naturalisation certificate is not corrected. Instead, the holder of the certificate is expected to prove to the relevant authorities that he or she is the person whose name appears on the certificate. The Administrative Court Stuttgart held that the plaintiff could not rely on Article 16 GDPR to rectify his naturalisation certificate. The court pointed out that according to Article 16 GDPR, the data subject has the right to demand th
Court case 11 ZB 22.895
The plaintiff owns a secondhand car dealership. One of the plaintiff's vehicles, driven by an unknown person, exceeded the permitted speed of 50 km/h. The police administration office sent the plaintiff a witness questionnaire and asked for the personal details of the responsible driver. The plaintiff stated that the person in the picture was not recognizable to him. The vehicle in question had been for sale and he had given it to persons unknown to him for test drives. He had always asked for a valid driver's license, which he only took a look at to make sure the person is allowed to drive. For reasons of protection of personal data, he did not store the data. The fine proceedings were then discontinued, but the authorities wanted to impose a requirement to keep a record of people driving cars that are registered in his name on the plaintiff. This can be imposed as an obligation under Article 31a StVZO - Road Traffic Licensing Regulations, if in the past a person who has more cars registered in his name, has failed to identify the driver of one of his cars. In the proceedings that followed, the plaintiff claimed that even if he did store the data for the period of the vehicle being driven by the other person, he would erase it pursuant to Article 17 GDPR after the drive. He argued that if it was not intended to buy the car, there was no actual legal basis under the GDPR to store such data. The Higher Administrative Court of Bavaria (VGH München) held that the plaintiff was required to document test drives and that this obligation was not contrary to Article 6(1) GDPR. Pursuant to Article 6(1)(f) GDPR, a controller may use the legal basis of legitimate interest even if those legitimate interests are pursued by a third party. Hence, the applicable legal basis for the plaintiff (the car dealer) was Article 6(1)(f) GDPR as the police, a third party, had a legitimate interest in fulfilling the tasks incumbent upon them in the public interest, which include the pro
Municipal Executive of Bladel
The controller is the Municipal Executive of Bladel (an administrative body). The data subject is a dog trader (and her partner). In 2013, the police started an investigation to combat malicious dog trading. The data subjects were included in a report that was drawn up regarding this investigation. The investigation resulted in an enforcement action in 2016. The data subjects started administrative and civil proceedings on the (lawfulness of the) enforcement action. In March 2018, the data subjects submitted a request for erasure at the controller, concerning their personal data laid down in said report. The controller denied this request by decision of October 2018. The data subjects appealed this decision up until the Administrative Division of the Council of State. The Division found that the controller's decision lacked substantive reasoning and ordered it to issue a new one. The controller denied the data subjects request again by decision of November 2020. It held that retention of the personal data was necessary pursuant to Article 17(3)(e) AVG, to substantiate it's defense in the civil proceedings started by the data subjects. The data subject appealed this decision, stating that the controller cannot invoke the exception of Article 17(3)(e). She argued that the Article specifically refers to the establishment, exercise or substantiation of a legal claim, however it does not include the defense against one. The Division noted that not only the wording, but also the context and purpose should be considered when interpreting EU legislation (HvJ Tarola). This required a comparison of the different language versions (HvJ Consorzio). The Division found that the English, German and French version of Article 17(3)(e) all had a much broader scope than the Dutch text. They contained some translation of the word 'defense,' (defence; Verteidigung; défense) while the Dutch version merely used the word 'substantiation' (onderbouwing). The Division further noted that in case of these differences in translations, it must consider the objective and purpose of the legislation for a uniform interpretation (CJEU Kraaijveld). The objective is the protection of natural persons when processing personal data (Recital 1&2), however this must be balanced with other fundamental rights recognized in the Charter (Recital 4). In particular, the Division followed, Article 47 of the Charter, which included the right of defense (CJEU Otis). Thus, the German, English and French versions of Article 17(3)(e) were more consistent with the purpose of the AVG. The Division held that, contrarily to what the data subject argued, Article 17(3)(e) AVG does include the defense against a legal claim. Therefore, the appeal was unfounded.
Osakidetza-Servicio Vasco de Salud
The data subject submitted a complaint to the Basque DPA following the inclusion of unrelated sensitive medical data (her gender reassignment) in a report about her injured foot. After investigating, the DPA issued a warning to the controller, Osakidetza-Servicio Vasco de Salud, for violating the principle of data minimisation Article 5(1)(c). The controller appealed the decision to the Administrative Court No. 2 of Vitoria-Gasteiz, which upheld the appeal. The DPA then appealed that court's decision to the Administrative Chamber of the High Court of Justice of the Basque Country, which upheld the DPA's appeal. Finally, the controller appealed the High Court's decision to the Spanish Supreme Court. Before the Supreme Court, the controller argued that, in light of the fact that the personal data had been lawfully collected, the data subject was required to exercise her right of restriction of processing Article 18 GDPR before she could file a complaint with the DPA. As a secondary point, the controller argued that the DPA disregarded relevant circumstances, namely that the medical records were intended only for the data subject. Ultimately, the Court rejected the controller's arguments and dismissed the appeal. The Court first addressed whether, in a case where the controller carries out a processing activity that the data subject considers to be excessive and data has been already collected, the data minimisation principle from Article 5(1)(c) GDPR is directly enforceable, or whether the data subject must first exercise the right to the restriction of processing provided for in Article 18 GDPR. As explained by the Court, Article 18(1) GDPR, in particular in paragraph (d), is linked to Article 21(1) GDPR, which guarantees the right to object to processing. Both rights are of a temporary nature and relate to a disputed deletion of personal data collected on the basis of Article 6(1) (e) or (f). At no point had the data subject sought the deletion of her personal dat
Stichting Eega Plus
The data subject used to work for Eega (controller), a company that guides disabled people towards employment. After termination of the data subject's employment, her employer restricted her access to the laptop as it was still in the data subject's possession. The controller filed a claim in interim relief proceedings demanding the return of the laptop. The data subject did not object to the laptop being returned. However she wanted to delete her personal data from the laptop first and invoked her right to privacy. The data subject filed a counterclaim to demand that she would be given the chance to erase her personal data from the laptop. The controller did not consider this a reasonable demand because (1) the laptop was meant for work-related purposes only (so not for storing personal information). In addition, (2) access to the laptop would give the data subject unauthorised access to its confidential work environment. The controller thus also invoked its right to protection of privacy-sensitive information. The District Court of Overijssel (Rechtbank Overijssel - Rb. Overijssel) concluded that both claims were partly justified. The controller’s claim was not fully justified, as the controller did not dispute that the laptop contained personal data of the data subject. The fact that the data subject was not allowed to put these data on the laptop was irrelevant. It was still personal data within the meaning of the GDPR and therefore protected by this Regulation. The data subject’s counterclaim was not fully justified, as granting her access to the laptop would give her access to the controller’s digital work-environment. This contained personal data for which the controller was responsible (other employees, clients). The Court held that the solution must be found in the middle. The Court proposed that laptop would be taken to the controller. Someone other than the data subject or the controller could then erase the data subject's personal data from the laptop. The data subject may be present during this process.
The Federal Office of Economics and Export Control
The data subject is engaged in the dealing of firearms which are subject to a prohibition with a reservation of permission. Moreover, as became known in a separate court decision, the data subject is afraid of becoming a victim of kidnapping or robbery. The Federal Office of Economics and Export Control, the data controller, is the supervisory authority of the data subject in regards to the German laws on war weapons and has largely switched to electronic legal transactions via its communication portal: the electronic war weapons register. The data subject contacted the controller and complained that future information on the electronic war weapons register should only be transmitted by e-mail which is encrypted by a special software and objected to the current form of transmission as a precautionary measure under Article 21 GDPR and requested a restriction of processing under Article 18 GDPR. Additionally, the data subject complained about the controller's email communication, pointed out that the messages contained personal data within the meaning of Article 4(1) GDPR, and requested appropriate technical and organisational measures in accordance with the state of the art, such as end-to-end encryption, as well as the restriction of the processing pursuant to Article 18(1)(d) GDPR. The controller promised to carry out an examination but continued to use email to communicate with the data subject. The data subject took this as an occasion to apply for an exemption from the legally obligatory electronic notification of his weapon dealings. Eventually, his application was rejected and he was asked to continue using the controller's online portal for future notifications. As a response, the data subject brought an action for injunction before the Administrative Court of Frankfurt am Main concerning the controller's data transfers. The controller asked the court to reject the data subject's notion, reasoning that the data processing was justified by Article 6(1)(e) GDPR. Moreover, the GDPR would not contain a basis for the claim for the injunction sought by the applicant. At most, a general claim for injunctive relief under public law could be considered. However, the transfer of data had been necessary for the performance of the tasks of the public bodies to which the data had been transferred. The court rejected the data subject's action for injunction. It ruled that there is no infringement of rights due to an unlawful impairment of the legal positions of the applicant for a claim for injunctive relief under public law. There is a necessary legal basis for the processing of personal data and the processing, as to its legality and constitutionality, is not subject to any serious doubts by the court. The German EGovernment-Law, which purposefully expands electronic communication and also is the basis for the electronic war weapons register, is a democratically legitimised decision that does not conflict with the GDPR. With regard to the data subject's demand for higher encryption, the court has already stated in one of its decisions (15 July 2022 - 5 L 1281/22.F) that, in the case of electronic communication in connection with the notification of war weapon stocks to the Federal Office of Economics and Export Control, end-to-end encryption is currently sufficient. A higher level encryption is not necessary. Moreover, insofar as the data subject is particularly concerned with e-mail correspondence, the security standard of transport encryption demonstrated in the proceedings also satisfies the standards for the area of the electronic war weapons register.
Court case 8 O 1280/21
The data subject had lost his insurance certificates. He therefore sent an access request under Article 15(1) GDPR to the insurance provider (the controller) to obtain them. The Regional Court of Erfurt (LG Erfurt) held that the question of whether Article 15 GDPR may be used for non-data protection-related requests or whether it is an abuse of rights is controversial and the case law is not consistent on the matter. Therefore, it requested a preliminary ruling from the CJEU on the following questions: 1. Is Article 15(3) GDPR in conjunction with Article 12(5) GDPR to be interpreted to the effect that the controller is not obliged to provide the data subject a first copy of his personal data processed by the controller free of charge if the data subject does not request it for purposes referred to in the first sentence of recital 63 to the GDPR (namely to become aware of the processing of his personal data and to be able to check its lawfulness) but instead pursues another - non-data protection-related but legitimate - purpose? 2. If the answer to question 1 is no: a) Can a national provision of a Member State which was adopted before the entry into force of the GDPR be considered as a restriction on the right to a free copy of the personal data processed by the controller under Article 23(1) GDPR? b) If the answer to question 2a is in the affirmative: Is Article 23(1) GDPR to be interpreted as meaning that the rights and freedoms of other persons referred to therein also include their interest in being relieved of the costs associated with the provision of a copy of data pursuant to the first sentence of Article 15(3) GDPR and other expenses caused by the provision of the copy? c) If the answer to question 2b is affirmative: In the doctor-patient relationship, does the provision of a copy of the patient's personal data from the patient's file always and irrespective of the specific circumstances of the individual case give the doctor a right to charge the pati