GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
In 2024, a data subject filed a complaint to the DPA regarding the right to erasure of stored payment history data. The controller, a credit reporting agency, updated the data subject’s credit score following an out of court proceedings in 2019. The data subject’s request for a loan was rejected on the basis that banks received the information “Score value 0 - no calculation possible” when requesting information about the data subject. This value was an error as a result of the controller not being able to correctly assign a numerical value to the out of court proceedings. The entries analysed by the DPA and Court were the ones on the completion of out of court settlement and “Score value 0: No calculation possible”. In its decision, the DPA applied the reasoning of CJEU case law (the SCHUFA case) to conclude that the processing of payment history also constitutes a serious interference with the fundamental right to privacy and data protection ([https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12012P/TXT Article 7 CFR and Article 8 CFR]). The DPA then applied national law on time limits in processing of data related to insolvency procedures, arguing that the controller should have deleted the data relating to the out of court settlement. By not deleting this information the controller was violating the data subject's right to erasure under Article 17 GDPR. The controller disputed the DPA's reasoning and brought an appeal to the Federal Administrative Court. The controller argued that the SCHUFA case did not apply, because it related to publicly accessible data. It also claimed that the data processing was not a serious interference with the data subject's fundamental rights. The Court upheld the decision on the DPA regarding automated processing, but dismissed the reasoning on processing of payment history. The Court upheld the arguments of the controller, and stated that the facts of the current case differ in essential elements
The Federal Union of Consumer Organisations and Associations (Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband eV), a German consumer association, brought an action before the Regional Court of Berlin (Landesgericht Berlin – LG Berlin), claiming that Meta Platforms Ireland Ltd (the controller) failed to comply with the legal requirements to obtain valid consent from the users of its app centre under the GDPR because the controller had not fulfilled its information obligations. The action was brought independently of a specific infringement of a data subject’s GDPR rights and without a mandate from a specific data subject. The LG Berlin upheld the action; the controller appealed this decision before the Higher Regional Court of Berlin (Kammergericht Berlin – KG Berlin). This appeal was dismissed and the controller further appealed the judgement of KG Berlin before the Federal Court of Justice (Bundesgerichtshof – BGH). The BGH had doubts as to the admissibility of the action brought by the Federal Union. Therefore, it referred a question to the CJEU for a preliminary ruling on the interpretation of Article 80(1), 80(2) and 84(1) GDPR. The CJEU ruled on 11 July 2024 in C‑757/22, Meta Platforms Ireland (Representative action) that a violation of the controller’s information obligation can be subject to a representative action under Article 80(2) GDPR. The BGH ruled - implementing the CJEU's decision -, that qualified entities are authorized, pursuant to the [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html German Unfair Competition Act (Gesetz gegen den unlauteren Wettbewerb - UWG)] and the [https://www.gesetze-im-internet.de/uklag/ German Injunctive Relief Act (Unterlassungsklagegesetz - UKlaG]), to bring legal action before the civil courts for violations of information obligations pursuant to Article 12(1) GDPR in conjunction with Article 13(1)(c) and (e) GDPR, regardless of the specific violation
A pharmacist sold non-prescription but pharmacy-only medicine through Amazon requiring customers to enter their name, delivery address and the information necessary for the individualization of the medicines. On the basis of the German Act against Unfair Competition ([https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Gesetz gegen den unlauteren Wettbewerb – UWG]), a competitor sought an injunction prohibiting the controller from selling pharmacy-only but non-prescription medication through Amazon unless customers could express their consent to the data processing in advance. The competitor alleged that the sale through Amazon was unlawful under the GDPR as it did not ask for the prior consent of the customer’s as required under Article 9(2) GDPR for the processing of sensitive data. The Regional Court granted the claim. The first Court of Appeal dismissed the defendant's appeal. The defendant pursued its motion to dismiss the action with the appeal granted by the Court of Appeal. The BGH stayed the proceedings and referred the case to the CJEU for a preliminary ruling. The CJEU on 4 October 2024 held in C-21/23, Lindenapotheke that information entered by customers when ordering pharmacy-only medical products constitutes health data, even when the products are prescription-free. The Court further found that the GDPR does not preclude national law enabling a controller’s competitors to challenge GDPR infringements in court as prohibited unfair commercial practices. The court implemented the CJEU's decision. Thus, it held, that if a customer orders prescription-only medications via a pharmacist's account on Amazon, health data is collected and processed within the meaning of of the Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG) and Article 9 GDPR. Additionally, the court held, that the processing of order data without express consent pursuant to Article 9(2)(a) GDPR constitutes a violation of a market conduct regulation pursuant to the
The plaintiff is a nationwide umbrella organisation of consumer centres in Germany. It is a qualified organisation to bring collective redress actions according to german law. The contoller is Google Ireland Ltd, the provider of Google services in the EEA. To use some of the services provided by the defendant, a ‘Google account’ is required. At the sign up process, after users have first entered personal data to create an account, they must choose between 2 "personalisation settings”, “express personalisation" or "manual personalisation". “Express personalisation" consists of a 1 step page that permits personalised advertising while the "manual personalisation" consist of 5 steps that allow the user to select the personal data they want to share. When users log in to their Google account, after completing the registration process, they have the possibility to modify the duration of data storage and reduce it to 3 months. In June 2022 the plaintiff sent the controller an unsuccessful warning letter, arguing that with this sign up process for a Google account, the controller violated Article 5(1)(a) and Article 6(1)(a) GDPR since there is a lack of a voluntary, transparent and informed consent for a specific purpose. More specifically; a. The user does not have the option to refuse giving consent in the case of "express personalisation" and that the user is also unaware that they have the option of not giving consent if they return to "manual personalisation". b. In the context of "manual personalisation", the use of personal data in the "personalised advertising" area cannot be completely deselected, as the controller processes the user's "general location" for advertising purposes. c. There is no transparent list of the defendant's services for which consent is given and therefore lack of a specific purpose. d. The design of the consent process is confusing and unclear, in particular the use of "personalisation" instead of "consent" to the use of data. The co
In the German sugar market, Nordzucker and Südzucker, together with a third significant producer, had constituted the dominant forces. Each company operated primarily in distinct geographical areas, with the market having been traditionally divided based on the locations of their factories and the associated transport costs. Agrana, a subsidiary of Südzucker, had occupied a prominent position as the principal sugar producer in Austria, operating with a considerable degree of autonomy in the markets it served. The accession of new Member States to the European Union in 2004 had engendered concerns among German sugar producers regarding increased competitive pressure from entities established in these new Member States. In response to these concerns, representatives from Nordzucker and Südzucker had engaged in a series of meetings beginning in 2004. During these meetings, the parties had agreed not to compete in their traditional core sales areas in order to mitigate the impact of the new competitive pressures. In late 2005, Agrana had observed that a Slovak subsidiary of Nordzucker had commenced the delivery of sugar to industrial customers in Austria, customers that had heretofore been exclusively supplied by Agrana. Agrana's managing director brought this matter to the attention of Südzucker's sales director. Subsequently, Südzucker's sales director had contacted Nordzucker's sales director to discuss these deliveries and their possible implications for the German sugar market. In response to these developments, both the German and Austrian competition authorities had initiated investigations. * In September 2010, the Austrian authority brought an action before the Oberlandesgericht Wien (Higher Regional Court, Vienna, Austria) seeking a declaration that Nordzucker had infringed Article 101 TFEU and the corresponding provisions of Austrian law, and also the imposition of two fines on Südzucker, one of which to be imposed jointly and severally on Agrana. The materi
The data subject is an individual whose personal data (name, address, date of birth) are stored in the Austrian Central Population Register. The controller is a company responsible for collecting broadcasting fees and is legally allowed to receive population-register data to identify liable fee payers. In May 2020, it became public that a hacker was offering large quantities of Austrian register data for sale. The controller issued a press release informing the public about the incident and clarifying that it was unclear whether the leaked data came from its systems. It also notified the Data Protection Authority (DSB) under Article 33 GDPR, but it did not individually notify potentially affected persons. The data subject did not know in 2020 whether he was affected. In 2023, he learned that his data had indeed appeared in the leaked dataset. To understand what data the controller was processing, he submitted an Article 15 GDPR access request on 4 March 2023. The controller warned of delays due to high workload and ultimately responded only on 24 May 2023. Believing that the controller had exceeded the legal response period, the data subject instructed a lawyer to file a complaint with the DSB. He paid the lawyer €200. He then brought a civil action claiming €200 in material damages for attorney’s fees and €200 in non-material damages arguing that he had to hire a lawyer and since DSB proceedings do not provide cost reimbursement, he considers these expenses a recoverable financial loss under Article 82 GDPR. He further claims that the defendant breached Article 34 GDPR by not notifying him of the 2020 data breach and as a result, he spent around 240 hours dealing with anger, worry, and efforts to obtain withheld information, justifying non-material harm. The first-instance civil court rejected the material-damages claim as inadmissible, holding that administrative procedure costs are normally borne by the parties. It dismissed the non-material-damages claim becaus
The data subject was a user of a platform provided by the controller. An unknown third-party used the possibility of finding user accounts through the users’ phone numbers for scraping the platform by randomly generating phone numbers and searching for users, on the basis of a default setting set by the controller. The data subject was affected by this data "scraping incident", that resulted in loss of control of their data. The data subject filed a lawsuit with the first instance court. At first instance, the court ordered the controller to pay the data subject €500 for non-material damages and granted the requests for declaratory and injunctive relief. Both parties appealed the decision of the court of first instance before the Higher Regional Court of Celle (Oberlandesgericht Celle – OLG Celle). The court amended the decision of the court of first instance. It ordered the controller to pay the data subject the amount of €100 pursuant to Article 82(1) GDPR and established that the controller is obliged to compensate the data subject for all material future damages. However, it confirmed the court of first instance's order to cease and desist from any further infringements of this provision under penalty of a fine, to refrain from disclosing personal data of the data subject’s side to third parties, in particular the telephone number or other non-public data points, on the basis of a default setting set by the controller and to refrain from processing the data subject's telephone number on the basis of consent, which was obtained due to the confusing and incomplete information provided by the controller. First, the court held that the controller violated the principle of data minimisation pursuant to Article 5(1)(b), Article 5(1)(c) and Article 25(2)(b) GDPR. Following the lead decision of the German Federal Court of Justice (Bundesgerichtshof - BGH) - VI ZR 10/24 from 18 November 2024, the court held that the mere loss of control over one's personal data as a
The controller is a publishing house that publishes newspapers and content on the Internet at www.noz.de. The controller uses a consent banner (so-called cookie wall) on its website. The defendant is the DPA of Lower Saxony (LfDI). In 15 November 2022, the DPA carried out a technical test on the controller’s website and found that when it was first accessed, without prior consent, the US service Google Tag Manager was contacted meaning that user data were transmitted to Google’s US server and data were stored on the user's device. Also, a consent banner titled "optimal user experience" appeared with the options to "Accept all", in the middle of the banner, or "Accept & close x", at the top right (the x referring to the symbol used to close a window). In order to refuse consent users had to scroll down, select the "Settings" button and at the window opened on a second level, the user must check whether the opt-in controls are switched off in order to then select the "Save selection" button. On 23 November 2022, the DPA issued a decision ordering the controller; a. To implement the requirements for effective consent in accordance with Article 4(11) and Article 7 GDPR, insofar as this is necessary for the lawfulness of the use of local storage objects, tracking technologies and third-party services; b. To obtain effective consent for the Google Tag Manager service integrated in the website in accordance with Section 25 (1) of the german Telecommunications-Digital Services Data Protection Act (TTDSG) and Art. 6(1) (a) GDPR or to remove the service; and c. To comply with the orders within 1 month. The DPA argued that the consent was not fully informed and voluntary in accordance with Article 4(11) GDPR. At the first level of the banner there was no literal mention that the buttons "Accept all" and "Accept & close x" provide two options for granting consent and also there was no option to refuse consent. On December 2022, the controller filed a case before Adm
The parties are disputing the validity of insurance premium increases in a private health insurance policy. The data subject holds a health insurance policy with the controller, who made premium adjustments. To the extent still relevant for the appeal, the data subject requested information regarding all premium adjustments made by the controller to the insurance contract between 2014 and 2019. The Regional Court dismissed the action. The Higher Regional Court, dismissing the data subject's further appeal, ordered the controller to provide access by partial judgment. The appeal court held that the access request is justified both with regard to the requested information and the related documents in the form of insurance policies and corresponding supplements; the basis for the claim is Article 15(1) GDPR in conjunction with Article 15(3) GDPR. With the appeal the controller continues to pursue its motion to dismiss the action. The court held, that a right to copies of the information submitted for the purpose of premium adjustment in the form of insurance policies and supplements to the insurance policy, does not follow from Article 15(1) and (3) GDPR. The court confirmed it's conclusion of BGH - IV ZR 177/22, that the supplements to the insurance policy, as a whole, do not constitute personal data of the policyholder. The court had previously held, that while letters from the data subject to the controller are to be classified as personal data in their entirety, since the personal information already consists of the fact that the data subject has made a statement in accordance with the letter, conversely - as is relevant here - letters from the controller to the data subject are personal data only insofar as they contain information about the data subject. Accordingly, only the personal data of an insurance policy is not categorically excluded from the scope of application of Article 15(1) GDPR. However, as the data subject did not limit his asserted claim and
Amazon processed personal data for interest-based advertising without proper consent and failed to provide clear information or an easy opt-out mechanism.
The data subject is pursuing claims against the controller inter alia for damages, information and injunctive relief based on alleged data protection violations by the controller in connection with so-called data scraping on the social network. operated by the controller. The platform provided the technical possibility of using a variety of digit sequences similar to common phone number formats to search for matching users on the social network. If a generated number matched a user's stored mobile phone number, their public user information was assigned to the entered number and retrieved. Starting in January 2018, unknown persons exploited this opportunity to massively steal data from user accounts, which also affected the data subject. In 2021, stolen data appeared on the internet. The controller confirmed to the data subject that, according to its information, the "user ID," first and last name, and gender had been extracted from the data subject's individual data through scraping. For a more detailed summary of the facts and the leading decision in these scraping cases see BGH - VI ZR 10/24. = The court found that although the controller violated the GDPR, the data subject did not suffer any compensable non-material damage as a result. The court held, that contrary to the controller's view, the searchability of the data subject's user profile using his mobile phone number was not necessary within the meaning of Article 6(1)(f) GDPR or Article 6(1)(b) GDPR as it was not essential to fulfilling the main purpose of the user agreement cited by the controller – mutual findability for networking purposes. Additionally, the court found that the linking of the privacy settings in the terms of use as well as the privacy tools and help area pages of the platform did not provide any transparent information about the searchability using the mobile phone number. The court held, that the data subject did not have to concern himself with these information options, but w
The data subject is a trans person who was granted refugee status in Hungary. When applying for this status, they pointed out that they identified as male and relied on their transsexuality as the ground for their recognition as a refugee. However, the Hungarian National Directorate-General for Immigration Policing (Országos Idegenrendészeti Főigazgatóság, the controller) recorded them in the register as female. In 2022, the data subject, pursuant to Article 16 GDPR, submitted a request to the controller to rectify the asylum register in two particulars: a change of the name under which they had been registered and a change of gender from female to male. On 11 October 2022, the controller rejected the request, arguing that the documents provided by the data subject did not prove that they had undergone gender reassignment surgery and that the applicant’s gender had changed. Therefore, the data subject brought proceedings before the Budapest High Court (Fővárosi Törvényszék). This court, having doubts regarding the interpretation of Article 16 GDPR, stayed the proceedings and referred the following questions to the CJEU: # Must Article 16 of the GDPR be interpreted as meaning that, in connection with the exercise of the rights of the data subject, the authority responsible for keeping registers under national law is required to rectify the personal data relating to the gender of that data subject recorded by that authority, where those data have changed after they were entered in the register and therefore do not comply with the principle of accuracy established in Article 5(1)(d) of the GDPR? # If the answer to the first question referred is in the affirmative, must Article 16 of the GDPR be interpreted as meaning that it requires the person requesting rectification of the data relating to his or her gender to provide evidence in support of the request for rectification? # If the answer to the second question referred is in the affirmative, must Article 16 of the GD
A data subject applied for a loan with a Polish credit institution, the controller. After reviewing the loan conditions, they decided not to proceed and requested the cancellation of their application. Despite this cancellation, the data subject continued to receive marketing communications and alerts from the controller and related entities. The data subject objected to the processing of their personal data on multiple occasions and submitted requests under Article 15 GDPR to obtain information about which entities received their data, the purpose of sharing it, and the legal basis for processing. They also requested the deletion of their personal data. The controller did not respond adequately, providing unclear information or referring the data subject to third parties. As a result, the data subject lodged a complaint with the DPA. The DPA issued a final decision warning the controller for violating Article 6(1), Article 5(1)(b) and Article 5(1)(e) GDPR. The DPA also found that the controller failed to meet the obligations under Article 15(1) and Article 15(3) GDPR by providing incorrect information and failing to supply a copy of the personal data. Following the DPA’s decision, the data subject requested that the controller pay PLN3,000 (€709,95) in compensation and issue a written apology for violating their personal rights, including the right to privacy and protection of personal data. The court upheld the claim in its entirety, finding that the controller unlawfully violated the data subject’s personal right to privacy under Articles 23 and 24 of the Polish Civil Code, rather than directly under the GDPR. The court clarified that personal data, as defined under Article 4(1) GDPR, is not in itself a personal right, but the improper handling of specific personal data can constitute a violation of the right to privacy. The court explained that the burden of proof of the absence of unlawfulness lies with the defendant and proceed to assess whether the contro
The controller for the case is Azienda Sanitaria Friuli Centrale (ASUFC), a local health authority. In 2020 the local government of Friuli Venezia Giulia issued a resolution that required the controller to carry out a large-scale analysis of Covid-related health risks for the resident population of the region of Friuli (the data subjects). During this analysis, individuals from vulnerable populations (such as the elderly) were assigned a score representing their vulnerability to covid. The results were disclosed to medical practitioners for the purpose of preventive intervention- especially with regards to vaccination priority. The processing was based on health data, including information in the data subjects’ electronic health file. The local government gave precise instructions to the health authority, including the instruction to appoint specific processors. The DPA investigated the processing and held that it was unlawful. Additionally, the DPA held that the controller violated its transparency obligations and failed to carry out a DPIA. On these grounds, the DPA fined the controller €50,000. The decision was later annulled by the civil courtCivil courts are competent to review the DPA’s decisions (see Art. 152 d. lgs. 196/2003). This is an exception to the general rule that administrative decisions are reviewed by administrative courts. (Tribunale di Udine). Contrary to the DPA’s findings, the Court held that the processing was lawful and that a DPIA was not required under the GDPR. The GPDP challenged the civil court’s decision with Italy’s Supreme court (Cassazione). Contrary to the lower court’s findings, the Cassazione held that the controller unlawfully processed sensitive data. In this regard, the Court first noted that Italian law lists different purposes for the processing of health data within the electronic health file. Among those, only the purposes related to individual treatment (i.e.: “prevention, diagnosis, health care, and rehabilitation”) ar
During the COVID-19 pandemic, the Office (Amt der Tiroler Landesregierung), an auxiliary administrative entity in the service of the Governor and the Provincial Government of Tyrol, sent a ‘vaccination reminder letter’ to all adults residing in the Province of Tyrol who had not yet been vaccinated against that virus. For the purpose of identifying the addressees of those letters, the Office appointed two private companies, which conducted a cross-check of data in the central vaccination register and the patient index, which referred to their residential address. One of those addressees of the vaccination reminder letter (the data subject), filed a complaint with the DPA against the Office alleging unlawful processing of his personal data. Before that authority, the Office stated that it had the status of ‘controller’ and that it was responsible for the letter sent to data subject. The DPA found that the Office had violated the GDPR when it had consulted the data of the data subject in the vaccination register to send the ‘vaccination reminder’ even though it did not have a right to access that register or the patient index. The Office appealed that decision before the Federal Administrative Court (Bundesverwaltungsgericht - BVwG) which held that the Office had the status of controller on the basis of national law but did not have a right to consult the vaccination register for the purposes of sending a reminder letter. Consequently the Office brought an appeal before the Supreme Administrative Court (Verwaltungsgerichtshof -VwGH). That court found that, to enable it to rule in the case before it, it must be determined whether the Office, in the context of that case, has the status of ‘controller’, within the meaning of Article 4(7) GDPR and decided to stay the proceedings and to request a preliminary ruling asking in essence: * whether Article 4(7) GDPR must be interpreted as meaning that it precludes national legislation which designates, as controller, an auxiliar
A mobile phone operator refused to enter into a contract with the data subject. The reason for that was alleged lack of sufficient creditworthiness. The phone operator verified the data subject creditworthiness using services of Dun & Bradstreet Austria GmbH (previously: Bisnode Austria GmbH). The data subject requested the Austrian DPAto obtain the information on the logic involved in automated decision-making performed by Dun & Bradstreet. The DPA ordered Dun & Bradstreet to disclose that information. Dun & Bradstreet appealed the DPA decision with Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The court partially upheld the DPA decision. Dun & Bradstreet violated Article 15(1)(h) GDPR because they didn’t disclose neither the information requested by the data subject, nor sufficient reasons justifying the request rejection. Within the enforcement proceedings the City Council of Vienna, acting as an enforcing authority, rejected the case, claiming Dun & Bradstreet already provided the data subject with the information. The data subject challenged the City Council decision before Viennese Administrative Court (Verwaltungsgericht Wien - VGW). Due to doubts regarding interpretation of Article 15(1)(h) GDPR this court ourt decided to stay the proceedings and refer the following questions to the CJEU for a preliminary ruling: # What requirements as to content does information provided need to satisfy in order to be regarded as sufficiently “meaningful” within the meaning of Article 15(1)(h) GDPR? # Is the right of access granted by Article 15(1)(h) GDPR related to the rights guaranteed by Article 22(3) GDPR to express one’s point of view and to challenge an automated decision taken within the meaning of Article 22 GDPR in so far as the scope of the information to be provided on the basis of an access request within the meaning of Article 15(1)(h) GDPR is only sufficiently “meaningful” if the party requesting access and the data subject for the purpos
Panoptes Sweden AB ("Panoptes") is a news agency, which engages engages in the collection, processing, analysis and presentation of information, including personal data. Panoptes sells the personal data to its customers (e.g. newspapers, magazines and broadcasters). In the course of its business, Panoptes requested the Swedish Court of Appeal to disclose to them a large number of documents related to different people's criminal convictions, to then use them in their capacity as a news agency. In response to this request, the Court of Appeal required Panoptes to guarantee that the requested documents would will be used for journalistic purposes and that the personal identity numbers, names and addresses of individuals will not be made available to the public or paying customers. Panoptes filed an appeal against that response of the Court of Appeal to the Supreme Court. The Court established that the question to be answered was whether the information requested by Panoptes was confidential and, if so, whether its disclosure could be subject to reservation. This matter concerns the relationship between [https://www.government.se/contentassets/2ca7601373824c8395fc1f38516e6e03/public-access-to-information-and-secrecy.pdf Chapter 21.7 of the Swedish Public Access to Information and Secrecy Act] (hereinafter: the Act) and the GDPR. Background considerations [https://www.government.se/contentassets/467ef1335aac404c8840c29f9d02305a/act-containing-supplementary-provisions-to-the-eu-general-data-protection-regulation-sfs-2018218/ Section 7(1) of Chapter 1 of the Swedish Data Protection Act] provides that, in data disclosures covered by the Act, there is no need to comply with the GDPR. In fact, requiring GDPR compliance would restrict the authorities' obligations to disclose personal data. The Court however recognizes that, when applying national law, EU law must be respected. Such an obligation stems from Article 85 GDPR and Article 86 GDPR, requiring to balance freedom o
The controller is a credit information agency that collects information from different sources to calculate an individual’s creditworthiness. This information is accessed by third parties. The controller contractually obliges its contractual partners (such as debt collection agencies) to inform it (as a credit information agency) about payment defaults of data subjects. The debt collection agency informed the data subject of the transfer of their data to the controller in 2020, and since then, the controller stored entries on the payment history data of the data subject. The payments were later settled and the entries reflected this. However, the controller refused to delete them when the data subject requested their erasure. The data subject argued that their economic progress was impaired as a result, and brought a complaint to the DPA. The controller argued that the processed data was still necessary for credit checking purposes. The DPA upheld the complaint in June 2024, and stated that the controller had violated the data subject’s right to erasure. Furthermore, the controller was not permitted to store payment history data beyond its settlement, and was required to delete the entries. According to the DPA, further processing of the data was unnecessary, because the claims had already been settled in full. The controller appealed the decision to the Federal Administrative Court, arguing that this payment history was necessary to calculate reliable information about an individual’s creditworthiness. The Court first stated that the controller could only rely on legitimate interests (Article 6(1)(f) GDPR) as a valid legal basis for processing, meaning national law (such as Section 152 of the Industrial Code) or other legal bases under Article 6(1) GDPR were not valid. The Court then examined the case law on balancing the legal interests of data subjects and credit information agencies. Jurisprudence of the Court and the Administrative Court have consistent
The data subject owed broadcasting fees to the Bavarian public broadcasting authority for services since 2013. In 2021, the public broadcasting authority engaged P. GmbH, a debt-collection agency, to recover outstanding payments. In response to an information request by the data subject under § 11(8) RBStV, the broadcaster confirmed that such agencies could receive personal data as processors within the meaning of Article 28 GDPR. After learning this, the data subject requested access to the controller–processor agreement concluded between the broadcasting authority and P. GmbH, arguing that he was entitled to verify whether it met the formal and substantive requirements of Article 28(3) GDPR. This request was rejected by the broadcasting authority. The data subject then brought an action before the Administrative Court of Munich (VG München), which dismissed the claim, holding that neither § 11(8) RBStV nor the GDPR provided any legal basis for such an inspection right. The data subject subsequently filed an application for leave to appeal with the Higher Administrative Court (VGH München). The Court dismissed the data subject's application for leave to appeal and upheld the decision of the lower court. The Court held that neither the GDPR nor the national broadcasting law (§ 11(8) RBStV) conferred any right for individuals to inspect a controller–processor agreement concluded under Article 28 GDPR. The Court held that the authority to verify compliance with Article 28 GDPR lies exclusively with the competent supervisory authority under Article 51 GDPR, not with private individuals. For data subjects, Article 15 GDPR provides a right of access only to their own personal data, not to contractual documents between a controller and its processor. Accordingly, the Court found that the plaintiff lacked a legitimate legal basis for inspecting the contract, and that the broadcasting authority had lawfully refused the request.
The data subject applied for a credit card in 2008 and was granted it. In July 2020, the bank (controller) requested that the data subject identify themselves online by providing a copy of their ID and a digital selfie. A bank employee would then compare the two images and approve it. The data subject was informed that this was necessary to comply with the provisions of the Fourth Anti-Money Laundering Directive (AMLD) and failure to do this would result in their card being terminated. In late July and early August, the controller contacted the data subject, again requesting that they verify their identity through the online portal. On 17 August 2020, the data subject was informed that their credit card agreement would be cancelled in November 2020, unless they verified their identity before then. In September 2020, the data subject sued the controller in the Subdistrict Court of Amsterdam, which declared some of her claims as inadmissible and dismissed others. In August 2021, the data subject appealed to the Amsterdam Court of Appeal. The data subject sought, inter alia, the restoration of their credit card, the payment of compensation, and a declaration that the bank’s proposed method of identification is unlawful. In March 2024, the Amsterdam Court of Appeal upheld the decision of the lower Court. The data subject then appealed to the Supreme Court. The data subject argued that the processing of biometric data in the identity verification procedure is unlawful under Article 9(1) GDPR and that the appellate court had erred in finding that the controller could retain copies of their ID after the verification had been performed. The Parket opined that the verification of the data subject’s identity in this method did not constitute biometric processing, falling under Article 9 GDPR. The Parket reasoned that the identification of the individual in this process is performed by an employee of the controller, not by software. The processing operation was therefor