GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Court case 410d C 197/20
The data subject is a lawyer and the controller is a website named Beratungsflat. The lawyer received an email from Beratungsflat and the email said that Beratungsflat offered legal advice by lawyers by telephone via its website, www.beratungsflat.de. The email also stated that Beratungsflat cooperated with lawyers, and they were remunerated by it for this telephonic advice. At the end of the e-mail, Beratungsflat asked whether the lawyer would be interested in offering legal advice by telephone via Beratungsflat's website and invited them to contact Beratungsflat if they were interested. Beratungsflat had obtained the email address of the lawyer from the contact page of their law-firm's website. The contact page of the law firm's website also contained a marked notice that the processing or use of data for purposes of advertising or market or opinion research by any means of communication is objected to and that no advertising mailings or calls are desired. In normal text, the law firm's website further stated that the use of contact data published in the imprint or comparable information, including e-mail addresses, by third parties for the purpose of sending information not expressly requested is not permitted, and legal action is reserved. On the day the email in question was received, the lawyer sent a cease and desist notice to Beratungsflat and claimed damages of €500. Subsequently, Beratungsflat refused to issue the cease-and-desist declaration and to make the payment. Accordingly, the lawyer approached the Local Court Hamburg-Bergedorf seeking a direction prohibiting Beratungsflat from contacting and/or having contact made with them by email for advertising purposes without their express consent, on pain of an orderly fine of up to €250,000 for each case of culpable infringement, or alternatively up to six months' imprisonment, with the orderly imprisonment to be carried out for the Beratungsflat on the Beratungsflat's managing directors. The lawyer also s
Tenant
The complainant is the Municipality of the City of Vienna (Wiener Wohnen) and the respondent is a tenant of the complainant. On 31 August 2019, the tenant informed the police that children had broken a window. In addition, he informed the complainant about the damage to the general parts of the property (window in the staircase). On the phone, the complainant stated that they would commission an emergency service and have the damage repaired. Shortly afterwards, an "electrician" called the respondent, saying he had been commissioned to repair the damage. Since the respondent generally had a secret number and had changed it for security reasons he never allowed to pass on his telephone number to third parties (electricians). He had not been asked about this, nor had he been informed of the transfer, so that he could have objected to it. When the respondent complained via telephone, he was told that the complainant usually compared the data and passed it on to technicians so that they could contact the detector. The tenant then submitted a complaint to the Data Protection Authority (DSB) which found that the respondent's right to secrecy had been violated by unlawfully transmitting personal data of him to a commissioned company and disclosing it to the latter. The complainant then appealed against this decision at the Federal Administrative Court claiming that it followed from the obligations arising from sections 1096 and 1097 of the General Civil Code that the landlord may use vicarious agents to remedy the reported defects "and may therefore also provide them with the telephone number of the tenant who has reported a defect". Therefore, the justification of Article 6(1)(b) of the GDPR would be given. Was the transmission of personal data (mobile number) to the commissioned company considered to be necessary for the performance of a contract and did it comply with the conditions laid down in Articles 5 and 6 GDPR? The Federal Administrative Court held that th
Austrian Postal Service (fined controller)
The facts and cirumstances that lead to the fine can be read in the summary of BVwG - W258 2217446-1, another decision of the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG) dealing with different legal issues of the same case. Based on the unlawful processing of data on the "affinity for a political party", the DSB imposed a 18 Mio Euro fine on the Austrian Postal Service. In detail, the DSB held the Austrian Postal Service responsible for violating *Article 5(1) GDPR *Article 6 (1) GDPR *Article 6(4) GDPR *Article 9 GDPR *Article 14 GDPR *Article 30 GDPR *Article 35 GDPR and *Article 36 GDPR. The fine was issued directly against the Austrian Postal Service as controller under Article 4(7) GDPR without establishing culpable conduct of natural persons acting on behalf of the Austrian Postal Service. Based on this omission, the Austrian Postal service appealed against the fine. Can the DSB impose a fine under Article 83 GDPR directly on a legal person, without having to investigate and establish culpable conduct of natural persons acting on behalf of the legal person? Are the national rules of administrative penal law of any relevance to this question or is it to be answered solely under the rules of the GDPR? The BVwG held that the provisions of the Austrian Administrative Penal Act (Verwaltungsstrafgesetz - VStG) and the Austrian Data Protection Act (Datenschutzgesetz - DSG) apply on fines imposed by the DSB under Article 83 GDPR: Pursuant to Article 83(8) GDPR, the exercise by the supervisory authority of its powers under Article 83 GDPR shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process. In light of this provision, the BVwG held, that national procedural rules are in fact to be applied when imposing a fine for a GDPR violation. According to the BVwG, the DSB had violated § 44a and § 45 VStG and § 30 DSG by not establishing culpable con
Conseil national de l'ordre des médecins
[https://gdprhub.eu/index.php?title=Article_9_GDPR Article 9(3) GDPR] provides that health data may be processed for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services, when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies. Under the terms of [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000037090304/ Article L. 6113-7 of the French Public Health Code], health establishments, whether public or private, shall analyse their activity. In compliance with medical confidentiality and patients' rights, they implement information systems that take into account pathologies and treatment methods in order to improve knowledge and evaluation of their activity and costs and to promote the optimisation of the range of care offered. Practitioners practising in public and private healthcare institutions transmit the personal medical data required to analyse the activity and bill for it to the doctor responsible for medical information for the institution under conditions determined by regulation after consultation with the National Council of Physicians (Conseil national de l'ordre des Médecins). The practitioner responsible for medical information is a doctor appointed by the director of a public health establishment or the deliberative body of a private health establishment if there is one, following the opinion of the medical commission or medical conference. The conditions of this designation and the methods of organisation of the medical information function, in particular the conditions under which staff placed under the authority of the practitioner in charge or the statutory auditors acting in the context of the legal mission of certification of the accounts mentioned in Article L. 6145-16 may contribute to the processing of data, are set by decree. The [https://www.legifrance.gouv.fr/loda/id/JORFTEXT000037864547/2020-12-08/ decree of 26 December 2018] clarifies these provisions. It authorises and regulates access to patients' data for the purposes of analysing the activity, its invoicing and the control of this invoicing by the statutory auditors and external service providers. In this context, the National Council of Physicians (Conseil national de l'ordre des Médecins) is seeking the annulment of this decree by the French Supreme Administrative Court (Conseil d’Etat). In the present case, the dispute concerns the following points: *Did the publication of this decree require prior consultation of the National Council of Physicians with regard to [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000041721097/ Articles L. 1112-1] and [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000037090304/ L. 6113-7 of the French Public Health Code]? *Did the publication of this decree require prior consultation of the data protection authority (Commission nationale de l’informatique et des libertés – CNIL) with regard to Article 11 of the French Data Protection law, as in force at the date of the contested decree? *Does the processing carried out in accordance with [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000037090304/ Article L. 6113-7 of the French Public Health Code] and the [https://www.legifrance.gouv.fr/loda/id/JORFTEXT000037864547/2020-12-08/ decree of 26 December 2018] comply with [https://gdprhub.eu/index.php?title=Article_6_GDPR Articles 6], [https://gdprhub.eu/index.php?title=Article_9_GDPR 9(3)] and [https://gdprhub.eu/index.php?title=Article_25_GDPR 25 GDPR]? To reach the cancellation of the decree, the Supreme Administrative Court retained the following points. = Contrary to what has been argued by the National Council of Physicians, the Supreme Administrative Court emphasizes that the provisions of the Public Health Code and the French Data Protection law did not require prior consultation of the National Council of Physicians and the DPA on the contested decree. = The Public Health Code requires the accounts of public health establishments to be certified by an auditor. Thus, charged with a legal obligation of certification, the law grants statutory auditors a right of access to personal health data collected by the doctor in charge of information for the establishment as part of the analysis of the activity. In this respect, the Supreme Administrative Court emphasises that access to all health data from patients' medical files is necessary for the accomplishment of this mission, for a sample of files enabling the reliability and traceability of the data used to calculate the institution's revenue to be verified on a random basis, from patient admission to invoicing. In the present case, the Court notes that the decree provides a number of guarantees to ensure that access to this data does not exceed that which is strictly necessary for the performance of the statutory auditors' mission (consultation without modification of the data, appropriate information for patients, conservation limited to the duration strictly necessary for this mission, limited access to data only necessary for the mission, reminder of the obligation of medical secrecy). However, recalling the provisions of [https://gdprhub.eu/index.php?title=Article_6_GDPR Articles 6] and [https://gdprhub.eu/index.php?title=Article_25_GDPR 25 GDPR], the French Supreme Administrative Court stresses that the mission of the statutory auditors could have been carried out on the basis of data subject to appropriate technical and organisational protection measures (such as pseudonymisation of data) to ensure the protection of the data subject's right to medical confidentiality. Accordingly, the Court therefore concludes that the contested decree is unlawful. = Recalling the rule laid down in [https://gdprhub.eu/index.php?title=Article_28_GDPR Article 28 GDPR], the Court stresses that the external service providers cited by the decree must be considered as processors within the meaning of the Regulation. The French Supreme Administrative Court outlines that the decree provides certain guarantees governing the mission of external service providers (they are placed under the responsibility of the doctor responsible for medical information, are subject to the obligation of medical confidentiality, may only access the data necessary for their mission, and may not keep the data made available by the establishment beyond the duration strictly necessary for the activities entrusted to them by contract). However, the Court emphasises that the decree has not provided for technical and organisational measures to ensure that the only data processed, with sufficient guarantees, are those necessary for the purposes of the processing. Additionally, the Court stresses that the decree has not provided for provisions to ensure that they actually carry out these activities under the authority of the practitioner responsible for the medical information. The Court therefore concludes that the decree is unlawful, due to the absence of sufficient guarantees to ensure that access to the data does not exceed that which is strictly necessary for the exercise of the mission recognised by law.
VoetbalTV
VoetbalTV, an initiative of the Royal Dutch Football Association (KNVB) and broadcasting company Talpa Network, is recording and broadcasting amateur football. The Dutch DPA fined VoetbalTV for processing personal data without a valid lawful basis. The Dutch DPA published guidance in which it states that a legitimate interest is only legitimate if it stems from a legal provision. Also, a purely commercial interest can never be a legitimate interest, according to the Dutch DPA. VoetbalTV appealed the decision. Does a legitimate interest (Article 6(1)(f) GDPR) need to stem from a legal provision and can a purely commercial interest result in a legitimate interest? The court does not agree with the restrictive interpretation of legitimate interest by the Dutch DPA. Any interest can be a legitimate interest as long as it is not against the law (negative test). The Dutch DPA should have performed a balancing test in order to balance the interests pursued by VoetbalTV against the interests or fundamental rights and freedoms of the data subjects. Because the DPA did not perform such a balancing test, the court annulled the decision and the imposed fine. The court annulled the decision and decided to judge the case itself (Article 8:72a Dutch General Administrative Law Act). Then the court decided to not take a new decision in order to replace the annulled decision, noting that the fine is now completely off the table.
Court case W274 2224363-1
The complainant is an officer of the court guard. The co-participant was in prison and had contact with the complainant there. After his release from prison, the co-participant made public statements in the media and mentioned, inter alia, the complainant's details. In particular, in a Facebook post he mentioned the name and function of the complainant in connection with his trade union affiliation, which revealed the political views of the complainant. It is not known how the co-participant had information about the complainant's trade union affiliation. The complainant lodged a complaint with the supervisory authority. The co-participant requested that it be dismissed, pointing out that his statements related to journalistic activities, which fall under the exceptions for the protection of personal data. The DPA concluded that it was not possible to establish a link between the Facebook post and the co-participant's journalistic activity, but the authority did not grant protection to the complainant's rights. It pointed out that the interests of the co-participant stood above the interests of the complainant, since the Facebook post concerned prison misconduct and the co-participant had acted within the framework of freedom of expression. In addition, the complainant's personal data had been published on a publicly accessible website, so the co-participant had not gained access to them unlawfully. The applicant appealed to the court. The Court upheld the appeal and held that the content published by the co-participant on Facebook infringed the complainant's right to protection of personal data. The court ordered that the content be removed from Facebook.
Hotel Gaming BV
To prove his claims in a litigation against Hotel Gaming, the plaintiff wishes to have witnesses heard. Those witnesses were former employees of the defendant. The plaintiff however does not have the necessary address details and dates of birth for the witness calls, and Hotel Gaming refuses to provide these details to the plaintiff. In an incidental claim, the plaintiff therefore requests the District Court to order Hotel Gaming to inspect and copy the salary specifications of its former workers or to otherwise provide their address details and dates of birth. Hotel Gaming disputes the plaintiff's claim that he has a "legitimate interest" under article 6(1)f of the GDPR and that this legitimate interest outweighs the data subjects' (former employees called as witnesses) interest in privacy protection. Hotel Gaming argues in this respect that the security of its former workers is at stake, because the plaintiff might try to intimidate them after obtaining their personal data. Is the processing of the requested personal data lawful on the basis of Article 6(1)f of the GDPR or should the data subjects' interests or fundamental rights take precedence? In other words, must the importance of finding the truth give way to the importance of confidentiality? Pursuant to the Dutch Code of Civil Procedure, the plaintiff has a right of inspection and a copy of documents vis-à-vis the person who has them at his disposal, except if there are compelling reasons not to do so. The District Court is of the opinion that, although providing the requested data constitutes an invasion of the privacy of the defendant's former workers, this invasion is not sufficiently serious to be regarded as a compelling reason within the meaning of the Dutch Code of Civil Procedure or to be judged contrary to Article 6(1)f of the GDPR. The District Court considers that a "legitimate interest" should be considered present if the requested data are relevant to the plaintiff's determination of his legal position (not only if the requested data contain relevant information to support the plaintiff's assertions). This is the case here, as the testimony of a witness can contribute to the finding of the truth in civil proceedings. When outweighing the legitimate interest of the plaintiff, the District Court states that the data requested by the plaintiff do not relate to any sensitive personal data. The data in question are moreover included in the Basic Registration of Persons and can be consulted by the plaintiff's lawyer without the intervention of Hotel Gaming. Hotel Gaming has insufficiently substantiated the fear of intimidation of witnesses by the plaintiff. The Court therefore condemns Hotel Gaming to provide a copy of the most recent salary statement of its former workers. However, the requested data may only be provided to the extent necessary to fulfill the purpose of the legitimate interest of the plaintiff, namely the proof of his statements by means of witnesses. In order to be able to summon witnesses, it is sufficient to have the names, addresses and dates of birth of the witnesses. The other information mentioned in the salary specifications is not necessary and should therefore be made illegible by Hotel Gaming. Assuming that the witnesses will be summoned by the plaintiff's lawyer, the District Court moreover considers that it is not necessary to provide the salary specifications to the plaintiff in person. The requested information may only be provided by Hotel Gaming to the plaintiff's lawyer.
Orange România SA
The CJEU ruled that consent is not valid if a contract contains a clause stating that the data subject has been informed of, and has consented to, the collection and storage of a copy of his or her ID for identification purposes, when the contract could be misleading as to the possibility of concluding the contract if the customer refuses to consent to the storage of the ID. Consent is also not valid if data subjects must complete an additional form setting out that refusal.
Court case 2 ME 426/20
The complainant, as a private individual, took part in a citizens' movement in his city which, among other things, demands an immediate end to all coronavirus-related activities. The complainant was a speaker at the meetings of the citizens' movement. In addition, he made numerous contributions to the citizens' movement's chat group. The chat group itself was critical of the topics of masks, vaccination, 5G radiation, and the detection and threat of the Sars-CoV2 virus. The applicant also took part in a demonstration on 1 August 2020 in Berlin under the slogan 'End of the pandemic - Freedom Day'. In this context, he appeared on the same day as a guest on a talk show broadcast on YouTube, mentioning his employer (the university). As an answer to the above activities of the complainant, the General Students' Committee (AStA) published on its webpage an article criticising the behaivour and opinion of the complainant (an employee of the university) to the coronavirus pandemic. The article points out, among other things, that there is no place at the university for a person who is hostile to science and publicly speaks out against all scientific knowledge about the existing pandemic and denies its threat, and thus, at least indirectly and by association, supports certain nationalistic and rightwing views and political parties, including the denial of the Holocaust. The complainant demanded that the publication of the above statements be removed and not published again. He said he had never claimed to support nationalistic and rightwing views and political parties, including the denial of the Holocaust. The General Students' Committee (AStA) did not act in accordance with the above request, so the applicant filed a complaint with the administrative court. Before considering the complaint, the defendant slightly changed the content of the information provided in the article. The Administrative Court Osnabrück dismissed the complaint and found that there was no unlawful infringement of the applicant's personal rights or of the provisions on personal data protection. The complainant filed an appeal to the Superior Administrative Court Lüneburg. Did the General Students' Committee (AStA) have the right to publicly criticise its employee's actions? Has there been defamation of the complainant or a breach of data protection legislation? The Court found the appeal to be unfounded and pointed out that the General Students' Committee (AStA) is authorised to critically examine in public any views of a university employee which are assessed as conspiracy-theoretical - in this case on the coronavirus pandemic. This was based on § 20 para 1 sentence 4 to 6 NHG. But also Article 9(2)(e) GDPR woud not prevent the General Students' Committee (AStA) from publishing their article, at least insofar as the university employee made public statements with reference to his or her activities at the university itself.
Court case 51 O 513/20
The plaintiff was the owner of a flat in a residential complex, where the first defendant was the property manager in charge until 31 December 2019. The second defendant was the external DPO appointed by the property manager. There was a legionella infestation in the residential complex, which also affected the plaintiff's flat. In June 2019, all 97 flat owners were invited to an owner's meeting to discuss, amongst other things, the legionella infestation. The invitation included details on which flats were affected by the infestation, with the plaintiff's name and flat. The plaintiff asked the property manager to redact or remove this information. Although this was not done before the meeting, the meeting notes themselves did not mention either. Consequently, the plaintiff sued the defendants and claimed that he had suffered non-material and material damages, like damage to his reputation. In addition, a potential buyer of his flat had cancelled the purchase due to the information about the legionella infestation he had received from the informed owners. The plaintiff further submitted that the second defendant (the DPO) had admitted the infringement in his email and was therefore also liable on the basis of this admission of guilt. The plaintiff also claimed the the parties had violated the GDPR when passing on his e-mail address to their legal representative without his consent. Furthermore, the plaintiff's email address was visible in the transparent field of a letter sent by the defendant's representative to the plaintiff. The first defendant claimed that the listing of the plaintiff's flat and his name as owner was permissible under data protection law. The disclosure of the email address was also permissible under GDPR. The second defendant argued that as a DPO he was not a controller within the meaning of Article 4(7) GDPR. The Regional Court dismissed the action. The Court decided that the plaintiff was not entitled to claim damages, beacuse there was
La Quadrature du Net
On May 13th, 2019 the French government adopted a decree 2019-452 allowing the creation of a common biometric authentication system for several government and public service websites applicationshttps://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038475477/. This system is part of the FranceConnect project which allows to login public service websites using your login and password of another public service websitehttps://franceconnect.gouv.fr/. The french organization La Quadrature du Net (LQDN) which promotes digital rights and defends freedom of citizens challenged the legality of the decree. The organization argued that the decree is not based on a lawful consent as described in article 4(11) and article 7(4) GDPR and required in article article 9(2)(a) when dealing with sensitive data. LQDN also argued that the data collection was disproportionate to the purpose of the processing. On this topic, LQDN asked the Conseil d'Etat to refer two preliminary questions to the CJEU: *Should the assessment of the validity of the consent be made at the level of each service subject to personal data processing, independently of the existence of another "equivalent" service or at the level of all "equivalent services"? *Are the biometric data collected and processed by a mobile application using facial recognition technology for authentication purposes from certain public services and their partners adequate, relevant and not excessive in relation to the purposes for which they are collected and processed? Lastly, LQDN claimed that the decree was adopted in violation of the procedure required in the then [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037090141/2019-05-12 section 27] of the law n° 78-17 Informatique & Libertés (since replaced by [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037822860 article 31(II)]) and [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000006527486/2019-07-01 section 22] of the French 1958 Constitution. Does the
Court case II SA/Wa 310/20
The President of the Office for Personal Data Protection (PUODO) found that L. Sp. z o.o. ("the Company") infringed the provisions of Article 5(1)(a)GDPR, Article 5(1)(f)GDPR in connection with Article 5(2) GDPR, i.e. the principles of lawfulness, data integrity and confidentiality and accountability in connection with Article 28(1) GDPR, Article 28(3) GDPR, Article 28(10) GDPR and Article 29 GDPR, with regard to the processing of data from video surveillance systems used in the Residential Community without legal basis in the form of an agreement on entrustment of processing. The DPA stated that in the course of the proceedings the indicated shortcomings in the process of personal data processing were eliminated, but nevertheless imposed on the Company an administrative fine in the amount of PLN 8000.00 due to the duration of the violations. The DPA emphasised that, in the absence - in the data processing entrustment agreement of May 2018 concluded by the Housing Community - of entrusting the Company with the processing of data, including the determination of the purposes and means of processing of the data derived from the video surveillance system used at the property, to which the Company actually had access within the framework of the proper performance of the contract for the administration of the common part, pursuant to Article 28(10) GDPR, the Company was deemed to be the controller with regard to this process in the period from May 2018 to September 2019, i.e. until the date of conclusion of Annex No. 1 to the aforementioned contract. The Company appealed against the decision to the Provincial Administrative Court. Was it legitimate to consider that the Company was the controller of personal data in relation to the processing of video surveillance data? The Provincial Administrative Court Warsaw dismissed the appeal and held that on the basis of the factual findings, the PUODO stated correctly that the Company infringed the provisions on the protecti
A tenant (defendant)
The defendant had lodged a complaint with the DPA, claiming that the plaintiff, a property management organization, had disclosed their data to a third party without consent or any other legal basis. Originally, the defendant had sent an email from his professional mailbox to the plaintiff about a piece of furniture placed in a common area of a property managed by them. Following this, the plaintiff got in touch with the landlord of the property on the matter, who in turn asked if he could get the contact details of the defendant in order to discuss the matter directly with him. For this purpose, the plaintiff forwarded the email message of the defendant - including his professional email address - to the landlord. The defendant argued in its complaint before the DPA, that he had not been consulted prior to the data disclosure to the landlord and that he had been violated in his right to confidentiality, especially with regard to his professional contact details. The DPA granted the defendant’s complaint and found that the personal data, which was indicative of the defendant’s professional activity, should not have been disclosed by the plaintiff to a third party. The plaintiff appealed this decision arguing that, by forwarding the email and all data of the defendant it contained, they were only fulfilling their legal obligation pursuant to the national housing property law to disclose the contact details of a tenant at the request of a landlord. Does the disclosure of the professional email address of a tenant to a landlord constitute a violation of the tenant’s confidentiality? The Federal Administrative Court of Austria confirmed the Data Protection Authority’s decision by reminding the plaintiff that they could have had established contact between the parties involved in other ways, e.g. by referring to the postal address of the tenant, and that the disclosure of the professional email address could not be reconciled with the principle of data minimisati
Court case 2-03 O 356/20
It follows from the court decision that the applicant rents a property from the defendant company. Most probably (this does not result directly from the decision) there was a dispute between the parties concerning the tenancy contract (probably the tenancy rent) and the defendant wanted to distribute the applicant's personal data related to the tenancy contract by publicly displaying the contract. Due to the urgency of the case and the threat to the claimant's personal data, the claimant filed a demand with the court to issue an injunction prohibiting the defendant from making the contract public. Can a person affected by illegal data processing (outside the journalistic/editorial area) assert claims for data protection by way of a civil law injunction claim? The court found that a person affected by illegal data processing (outside the journalistic/editorial area) may pursue claims for data protection by means of a court injunction. Such claims are not blocked by Article 79 GDPR. Furthermore, the court considered that the lack of correspondence among the parties in the time between the letter of warning and the application in the preliminary injunction procedure does not lead to the rejection of the application, but only to the obligation of the court to examine it.
Court case W214 2230473-1
The complainant was the beneficiary of a property on which there was an apartment building with numerous tenants. The alleged controller was the tenant of one of the flats and, in the course of installing a security door in the public corridor area of the property in question, had also had a functioning surveillance camera installed. According to the complainant, only the alleged controller had access to the recorded images and the possibility to use them, and this behaviour drastically interfered with the rights to respect for the private and family life of the other tenants, in particular to the confidentiality of the data concerned, as no one other than the alleged controller had access to this data and no one knew what happened to the images. The other tenants and the owner of the house had not given their consent, which was why the recordings were, in the applicant's opinion, inadmissible under section 12(4)(1) of the Data Protection Act. Therefore, she filed a complaint with the DPA, asserting a violation of the right to confidentiality. After an investigation, the authority dismissed the complaint on the grounds of violation of the right to secrecy and the right to deletion as unfounded and rejected the applications for uninstallation of the camera, for an order to refrain from future interventions and for the initiation of administrative penal proceedings. The authority found that there had been a burglary at the address mentioned, which was why the co-participant, in agreement with his son, had installed the video camera in question in 2010. The video camera was located on the first floor and was directed at the entrance to the flats XXXX and XXXX. The camera was non-functional and served as a deterrent against burglars. The other party had not used the video camera to take any pictures showing the complainant. In its assessment of the evidence, the DPA summarised that the statements of the co-participant were credible and that there was also no apparent r
Court case 1 K 584/19.MZ
The plaintiff owns a LED billboard on his private property next to a shopping mall. The billboard is monitored by four CCTV cameras to protect it against vandalism. The DPA (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz) ordered to remove camera 1 that filmed a public street and to shut down camera 2 during opening hours of the shopping mall because it filmed the parking lot. Cameras 3 and 4 had to be repositioned so they do not capture the public street, the parking lot and adjacent residential building. The correct defendant is the DPA itself according to § 20(5)(2) and § 20(4) BDSG. The Court held that even if it is possible that a camera records personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership the requirements of Art. 9 GDPR do not apply because the plaintiff did not seek to process that kind of data. The legality is thus determined by Art. 6 GDPR. In the absence of consent under Art. 6(1)(a) GDPR, a balance of interests according to Art. 6(1)(f) GDPR is required. The legitimate interests pursued by the plaintiff (protection of his property) are overridden by the fundamental rights and freedoms of the data subjects who are filmed by camera 1 on a public street. The DPA was allowed to issue a reprimand, Art. 58(2)(b) GDPR. On the basis of Art. 58(2)(f) GDPR, the DPA was not entitled to order the removal of camera 1 but only the shutdown. According to Art. 58(2)(d) GDPR the DPA was entitled to order the shutdown camera 2 during the opening hours of the shopping mall and to reposition cameras 3 and 4.
Court case 200.274.447_01
The employer used the location system of the company to match the location data with information contained in the time-sheets of the employee. Since this information showed that the encoded times did not match, the employee was dismissed. The Court refused to grant compensation to the employer or to reinstate the employer for the violation of his data protection rights under the GDPR.
Court case VerfGH Lv 15/20
In the Saarland, Art. 2 § 3 CP-VO regulated contact tracing. This tracing serves to interrupt chains of infection. The aim is to find out who may have had close contact with an infected person so that he/she can be placed in (self-)quarantine and tested in order to avoid infecting other people unintentionally. Those responsible for catering, cultural facilities and events, indoor playgrounds, church services and funerals, sports and other related events according to Art. 2 § 6 CP-VO, hotels and other accommodation providers as well as prostitution businesses are obliged to do to keep the information: - First name and surname, - Place of residence - Accessibility and - the arrival time of one representative of each household present They must be handed over to the health authorities on request. It is also provided that these data are to be deleted within one month. The standard does not lay down any requirements for the organisation of the collection of contact data. In the field of gastronomy, in particular, this often leads to the fact that subsequent guests can recognise and remember who has visited the company before them and how they can be reached via telephone number, e-mail address or postal address. This is a significant interference in the right to data protection. By recording, storing and possibly also passing on address and contact data, citizens - holders of fundamental rights - could be indirectly deterred from attending certain events or places. Indeed, the idea can be frightening if it is precisely documented and, if necessary, the state is informed from when to when one has visited which restaurant, political, religious or cultural event. According to the Constitutional Court of the Saarland, such a far-reaching, serious interference with the fundamental right to data protection cannot be decided by government decree. A parliamentary law is also necessary, because it is not (any longer) a short-term emergency situation, but a regulation which i
Administrative body: Regional Inspectorate for Environment and Water - Montana
Regarding administrative procedure for investment proposals, a data subject was provided with a protocol for granting access to information in accordance with RIEW Montana internal documentation. The protocol contained personal data the data subject did not consent to, and he saw that there are other protocols signed by other people. RIEW Montana presented internal documents in regards to processing of personal data. Was the principle of data minimisation violated by RIEW Montana? The Supreme Administrative Court decided that there was a violation of the principle of data minimization.
Court case II SA/Wa 809/20
Polish DPA became aware of irregularities in the processing of personal data of pupils of the primary school consisting in the collection of fingerprints of children using the services of the school canteen. The school explained that it uses a biometric reader which is placed at the entrance to the school canteen and which identifies children who take meals in the school canteen in order to verify that they have paid for the meal of the day. The school indicated that it obtains the biometric data of its pupils on the basis of the written consent of the parent (legal guardian). The school further informed that upon termination of the contract for the use of lunches in the school canteen, the data needed for fingerprint identification, i.e. the string of bytes stored in the reader, is deleted. Polish DPA also found that, according to the lunch policy posted on the website of the canteen run by the school, pupils without biometric identification let everyone through and wait at the end of the queue , and once all pupils with biometric identification have entered the canteen, the admission of pupils without biometric identification begins one by one. As a result of the analysis of the collected evidence, the Polish DPA ordered the school to delete personal data in the area of digitized information on fingerprint characteristics of children using school canteen services, ordered the school to stop collecting personal data in the area of digitized information on fingerprint characteristics of children using school canteen services, and imposed a fine on the school in the amount of PLN 20,000.00 for the violation found in the decision. As the DPA argued, the common law provisions indicate the type of data that a school may obtain from its pupils, but none of them authorises the processing (acquisition and collection) of pupils' biometric data, the processing of which is in principle prohibited under Article 9(1) of the GDPR, for the purpose of the provision of school canteen services. Can the consent of a parent (legal guardian) be a legal prerequisite for the processing of biometric data? Whether pupil data obtained by the school which includes information on fingerprint characteristics and which has been processed into a digital record constitutes biometric data within the meaning of Article 4(14) of the GDPR? The court held that the DPA, had properly accepted that the pupil data acquired by the school, which included information about fingerprint characteristics processed into a digital record, constituted biometric data within the meaning of the provision of Article 4(14) of the GDPR. The court found that the written statements in which the parents of the pupils to whom the biometric data pertained gave their consent to the processing of the data for the specified purpose in an unambiguous and unquestionable manner - testified to the fulfilment of the prerequisite of Article 9(2)(a) of the GDPR. The court stated that the processing of data to a slightly broader extent than the minimum necessary shall be regarded as admissible, provided that the processed data are closely related to the achievement of the purpose (e.g. facilitate its achievement). Consequently, the court held that it could not agree with the DPA that the school's processing of pupils' biometric data was incompatible with the principle of minimisation in Article 5(1)(c) of the GDPR.