GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 21 October 2026 · Updated daily
Court case W252 2239742-1/11Z
The complainant saw his right of access violated, since video recordings of therapy sessions had not been sent to him. The DPA dismissed the complaint as unfounded. Consequently, the complainant filed an appeal against this decision. The BVwG did not (yet) take a decision on the merit of the case but stalled the procedure it filed a request for preliminary ruling on the question the interpretation of Article 15(3) GDPR in August 2021. See decision BVwG - W211 2222613-2/12E. Once the CJEU has passed its judgment on the matter, the BVwG will resume the case.
Court case 5 O 1954/21
An insurance policy holder (the claimant) had a private health insurance with an insurer (the defendant). After the defendant made certain premium adjustments within the framework of the existing health insurance contract, the claimant initially unsuccessfully requested information on premium adjustments from the defendant. The claimant then asserted that he had the right of access to information from the defendant under Article 15 GDPR concerning the years 2018, 2019, and 2020 to the effect that the defendant had to inform him of the amount of the respective premium adjustments and the information transmitted for this purpose in the form of insurance certificates. The Regional Court Kassel (LG Kassel) first considered if the amount of a health insurance premiums constituted personal data. It held that it could not be regarded as personal data as it does not reflect the individualized insurance protection of the insured persons, taking into account their health conditions. It merely provides information on the price of the insurance cover for a particular person as laid down in the insurance contract. Even though there are individual tariffs for the premium amounts, it does not enable the identification of an individual. Therefore, the amount a person spends on their health insurance cannot be regarded as personal data. Consequently, the claimant had no right to access under Article 15 GDPR. Second, the Court considered whether the claimant could have invoked their Article 15 GDPR rights if the data in question had been personal data. It held that, in light of Recital 63 GDPR, the intent and purpose of the right of access is to make the data subject aware of the processing of personal data and enable them to verify the lawfulness of data processing. The claimant, however, invoked Article 15 GDPR exclusively to examine and check the premium adjustments made by the defendant for possible mistakes which the protective purpose of the GDPR does not cover. Consequently, the Court held that such use of Article 15 GDPR would amount to an abuse of rights and hence is not allowed.
Court case 28 O 168/22
The controller is an operator of a search engine. If a user used specific keywords in a name-based search, the search engine showed search results that contained the following wording: "T ENTREPRENEUR, CMO AND VICTIM OF DOMESTIC VIOLENCE BY I, BOYFRIEND AND INVESTOR IN HER COMPANY I come from a privileged background, a loving family, I have a higher college degree, I’ve been an entrepreneur for as long as I can remember, I’m a CMO, I speak 5 languages fluently… and I was in an abusive relationship with a venture capitalist. The emotional abuse escalated into physical abuse and on the 23rd of April 2021 I ended up in hospital and he was incarcerated.” Images of the data subject were also included. The data subject requested an interim injunction stopping the search engine from listing search results containing the quote and his images. The Regional Court of Cologne (LG Köln) held that the application for an interim injunction is admissible and well-founded. The proceedings were brought against the controller on the basis of Article 79(2) GDPR. On the merits, the court ruled that the operator of a search engine is considered to be the controller within the meaning of Article 4(7) GDPR and that the controller is requested to delete the data subject’s personal data as the requirements of Article 17(1)(c) GDPR and Article 17(1)(d) GDPR are met. The processing of the data subject’s personal data in this case is not necessary for exercising the right of freedom of expression and information under Article 17(3)(a) GDPR. In particular, the rights of the data subject under Articles 7 and 8 of the Charter of Fundamental Rights of the EU (CFR) were in this case held to outweigh the freedom of the controller to conduct a business under Article 16 CFR and the freedom of expression and information under Article 11 CFR. In conducting the balancing exercise, it was decisive for the court that the data subject made it credible that the cited statements were untrue or opinions with an untrue factual core and that the data subject has still not been legally convicted for the alleged assaults. Therefore, the interests of the data subject were held to outweigh the interests of the controller.
Minister for Legal Protection
The controller was the Minister for Legal Protection. The 2 data subjects have been in a relationship since 2020 and are expecting a baby. On February 2021, they were investigated because they were expecting a baby by the Child Care and Protection Board (RvdK), after a Request for Investigation (VTO) from Child Protection Overijssel (JBOV). The RvdK made a report following this request. The report included two attachments, containing a timeline from June 2013 to November 2020, and a forensic psychological investigation of data subject 1. On March 2021, the data subjects requested the controller to erase the attachments, as they were in their view no longer relevant. They concerned information on data subject 1, her ex-partner and the children they have together. They argued that this was separate from the investigation regarding the baby they were expecting. Moreover, they stated that the JBOV promised them orally to leave the past alone. The controller denied this request, as the RvdK needed the information for the exercise of its statutory task of public interest. The data subjects objected this decision, which the controller declared unfounded. The data subjects then filed an appeal at the court. In the appeal, the data subjects stated that there were no compelling legitimate grounds to process the attachments, that outweigh their interests. They argued that processing cannot be necessary, as the information is seriously outdated and obsolete. They also argued that retention of the data is not important with respect to the RvdK's task of public interest. They felt that it was disproportionately invasive of their privacy for the purpose served. The controller contested these arguments and stated that the importance of conducting a proper investigation outweighed the invasion of the data subjects' privacy. The Court stated that while the attachments relate to the past, this did not make them outdated. It followed that they contained information on data subject 1's parenting skills, which may be of importance to the current investigation. The fact that they also contained information about her ex-partner did not change this. The Court held that processing the personal data in question was necessary for fulfilling the task of public interest of the RvdK (Article 17(3) GDPR). Therefore, the controller did not have to comply with the request for erasure (Article 17(1) GDPR). The Court held that the appeal was unfounded and upheld the challenged decision.
unknown data subject (complainant before the DSB)
In January 2020, the data subject requested access under Article 15 GDPR from an Austrian credit reference agency (controller). The controller replied that it processed (among other data) eleven database entries on the data subject, concerning debts that had not been settled on time. The debts ranged between €42,70 and €186,84. At the time of the reply to the access request, all debts had been settled; some already in July 2014, others only in September 2019. Furthermore, the controller processed eight data sets on (former) addresses of the data subject. The data subject requested the controller to erase all data, arguing that she had not been able to get a loan to buy furniture for her apartment due to a low credit score assigned by the controller as a consequence of the processed data on previous debts. The data subjected also stated to have been employed for over a year with a high income and that she had been able to settle all debts. Hence her creditworthiness should be considered restored. The controller erased a database entry on a €72,95 debt from 2019, but refused to delete anything else, arguing that there was no reason for erasure under Article 17 GDPR as the processing was still necessary and lawful under Article 6(1)(f) GDPR. In June 2020, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB), arguing that further processing of the data was not necessary due to the low amount of the individual debts and the fact that all debts have already been settled. Hence, the interests of the data subject also outweighed those of the controller under Article 6(1)(f) GDPR. The controller contested these arguments but erased two further database entries on previous debts (on a €37,70 debt and a €46,45 debt, both settled in 2014) and several old addresses. In September 2020, following a further exchange of submissions before the DSB, the controller deleted four more database entries (on debts ranging from €85,40 to
The City Government of the Municipality Maastricht
The controller is the City Government of the Municipality of Maastricht. The data subject used to work for the controller. The data subject filed an access request but found the controller’s response insufficient. After the controller rejected her objection, the case was brought to the Court. The Court found that the controller violated general principles of good administration. The Court gave the controller the opportunity to rectify its mistakes and ordered the controller to make a new substantive decision on the data subject’s access request within six weeks. If the controller were to refuse access, it must explain why refusal was necessary and proportionate. The Court extended the deadline in a second interlocutory decision. In the new substantive decision, the controller provided an overview of each specific processing of the data subject‘s personal data. However, it omitted several details about the data subject, in particular about her as a former employee. The controller weighed the interests of the employee and the rights and freedoms of others and based this omission on Article 15(4) GDPR in combination with [https://wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=41&z=2018-05-25&g=2018-05-25 Article 41(1)(i) Implementation Act GDPR]. The controller provided the information it omitted to the Court. The Court justified the omission in an interim decision of 20 December 2021. This judgement builds on those interlocutory judgements. The Court upheld the data subject’s appeal from the contested decision because of violations of the principles of good administration, and it annulled the decision. However, it also upheld the legal consequences of the annulled part of the contested decision, as the defects of the contested decision had been remedied. Then, the Court considered the data subject’s appeal to the new substantive decision. First, the Court stipulated that Article 15(1) GDPR does not include a right to access every specific processing of personal data. An overview of the specific processing operations can be sufficient. It must, however, specify which information is processed, for which purpose, who receives the data, where it comes from, and, if possible, the envisaged storage period. Moreover, the Court considered that controllers might need to investigate the processing operations to provide all of the requested information. The Court held that this particular does not have to be reflected in the overview provided to the data subject. Second, the Court rejected the data subject's arguments that (1) a specific list was missing from the overview of processing operations, (2) the controller’s investigation was incomplete, and (3) that the controller should have kept emails which contained her personal data. The Court stated that the list the data subject referred to was legitimately omitted. Moreover, it did not follow the data subject in her argument that the controller’s investigation was insufficient because the receipt of personal data had not been registered. In this regard, the Court stipulated that the controller did not have to keep the emails it sent to its attorney that contained the data subject's personal data. Hence, the Court rejected the appeal to the new substantive decision.
SCHUFA Holding AG
The controller is the SCHUFA Holding AG, the biggest German credit rating agency. The data subject is as a businessman operating an one-man business in the steel pipe trading sector and working as a commercial agent as a side-job. In the past, insolvency proceedings had been initiated against the data subject which was published - as required under German law - on the insolvency announcement portal "www.insolvenzbekanntmachungen.de". On March 25 2020, these proceedings were terminated. Under § 3(1) of the German Insolvency Announcement Regulation (InsoBekV) (a provision implementing and specifying EU insolvency law) entries in the insolvency announcement portal must be deleted not later than six months after the termination of the insolvency proceedings. The respective entry on the data subject was deleted during this period in the portal. The controller, however, stored the information about the insolvency proceedings in their own database even after this period. As a result of these records, the data subject was not able to switch his health insurance, rent an apartment or conduct business without prepayment. On 30 November 2020, the data subject requested the controller to stop disclosing the personal information from his insolvency proceedings to third parties and delete the information. The controller rejected the request of the data subject. It argued that its customers have a legitimate interest to know that the data subject had been insolvent during the time of the insolvency proceedings even after the six months period has elapsed. It considered a three years storage period appropriate as laid down in the "Rules of conduct for the review and deletion periods of personal data by the German credit agencies" ("Verhaltensregeln für die Prüf- und Löschfristen von personenbezogenen Daten durch die deutschen Wirtschaftsauskunfteien") ("Rules of Conduct"), an internal policy of the association of the biggest German credit rating agencies ("Die Wirtschaftsauskun
Court case W214 2233132-1/13E
A data subject made an access request with an address publisher and direct marketing company, the controller, asking it specifically to provide him with information about his data stored in relation to "political preference" and about the recipients of his "target group" data. As the controller only partially complied with the access request, the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde, DSB) claiming a violation of his right to access under Article 15 GDPR. The DSB partially upheld the complaint of the data subject, stating that (1) the controller did not fully comply with his access request and ordered the controller to (2a) disclose to the data subject the names of the recipients of his personal data, (2b) provide him with comprehensible information on the terms of the advertising groups, in particular about the key terms used, relevant parameters, and their allocation to the data subject, and (2c) to provide generally understandable information about the term "possible target group - academics" to the data subject. The controller appealed the decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG), claiming that it is not obliged to disclose the names of the recipients of the data subject's personal data, as that would mean disclosing its sales channels and customer relationships. The BVwG started evaluating the case but then suspended the proceedings, pending the decision of the CJEU in case C-154/21 and issued only a partial decision on 17 May 2022. In the first partial decision n. W214 2233132-1/13E, the BVwG limited its decision to points (2b) and (2c) of the DSB's decision. In this respect, the court agreed with the controller stating that the DSB had gone beyond what was requested by the data subject in his complaint. In fact, the data subject's complaint under Article 77 GDPR was very clear and limited in scope. However, the DSB went on to assert a violation of Article 12 GDPR and Ar
Court case 20 U 295/21
The data subject has a health insurance contract with the controller. The controller increased the premiums during the contract. The data subject payed the increased premiums for a while but then filed a lawsuit against the controller demanding a refund as well as access to all supplements to the insurance policy and all notification letters sent to him during the contractual relationship under Article 15 GDPR. The court of first instance, the Regional Court of Aachen (Landgericht Aachen – LG Aachen), ruled in favour of the data subject. The controller appealed this decision arguing that the right to access under Article 15 GDPR does not grant a right to access to documents but its only purpose is to make the processed data transparent. Moreover, it argued that granting the access to such a wide extent would amount to an inadmissible discovery of evidence which is contrary to the civil procedural principle that each party must bring forward its evidence itself. Lastly, the controller also invoked the excessiveness of the request under Article 12(5) GDPR alleging that the data subject uses Article 15 GDPR only to verify the validity of the premium increases and not to verify the lawfulness of the processing. The Higher Regional Court of Köln (Oberlandesgericht Köln – OLG Köln) rejected the arguments of the controller and upheld the lower court’s judgement. First, the court referred to case law by the German Supreme Court (Bundesgerichtshof – BGH decision from 15.06.2021, case no. VI ZR 576/19) to establish that personal data under Article 4(1) GDPR means information which by virtue of its content, purpose or effects, is linked to a specific person. The court then concluded that the supplements to the insurance policy as well as the notification letters meet these requirements. For the supplements the court found that they show the content and conditions of the insurance cover provided to the data subject by the controller. Regarding the notification letters the court reasoned that they are also sufficiently linked to the data subject because they inform the respective policyholder of a change in his insurance contract on a certain date. Second, the court found that the right to a copy under Article 15(3) GDPR is independent from the right to access under Article 15(1) GDPR and is to be construed extensively. Consequently, the court held that Article 15(3) GDPR gives the data subject a right to a copy of the data in its raw form. Third, the court rejected the arguments of the controller. It concluded that the controller was neither under [https://www.gesetze-im-internet.de/bgb/__242.html § 242 BGB (German Civil Code)] nor under Article 12(5) GDPR allowed to reject the request as excessive. It also rejected to limit the scope of Article 15(3) GDPR teleologically, only because the request was aimed at verifying the lawfulness of premium increases and not at verifying the lawfulness of the data processing. It reasoned that the overall purpose of the GDPR is to protect all rights and freedoms of the individual against harm and risks arising from the processing of personal data, and not only the rights and freedoms enshrined in data protection law. Therefore, the court concluded that the data subject pursues a recognizable legitimate interest when using Article 15(3) GDPR to reduce an asymmetric level of information between himself and the controller in order to protect his rights. Moreover, the court found that there is no way to verify that the data subject is indeed only interested in the copy of his data to check the validity of the premium increases and is not also concerned about the protection of his data. Consequently, the court noted that it is unreasonable to make the right to access dependent on an unverifiable assertion about the inner motivation of a data subject. The court also rejected the controller's argument that granting the access would amount to an inadmissible discovery of evidence, because the inadmissibility of discovery is a procedural concept which cannot be transferred to a material claim such as Article 15 GDPR. Lastly, the court allowed the appeal to the Federal Court of Justice ([https://www.bundesgerichtshof.de/EN/Home/homeBGH_node.html Bundesgerichtshof] - BGH), Germany’s highest court of civil and criminal jurisdiction, because of the fundamental importance of the legal matter and the inconsistency of case law on this matter [see Comment section].
Court case 15 K 194/20
The controller was a regional tax authority in Bavaria, the Bayerisches Landesamt für Steuern (BayLfSt). The BayLfSt held tax dossiers concerning the tax case of the data subject. These dossiers contained internal correspondence, third party statements, notes, and handwritten comments from itself and other Bavarian tax authorities, namely the lower regional tax authority Finanzamt Neu-Ulm and the higher regional tax authority Bayerisches Staatsministerium der Finanzen für Landesentwicklung und Heimat (BayStMFLH). These dossiers also included a complaint via email by the data subject against the BayStMFLH from 2016 and complaints, a challenge on grounds of bias and a demand for a penalty against employees of the Finanzamt Neu-Ulm from 2019. The data subject requested access to dossiers from the Finanzamt Neu-Ulm on 28.10.2019. The BayLfSt received a request to access under Article 15(1) GDPR on 07.11.2019. The data subject wanted to access information on which department processed the dossiers. The data subject specifically requested a colour copy with the aim to differentiate between notes of responsible employees. On 17.12.2019, the data subject received a reply from BayLfSt. The BayLfSt confirmed that it held information about the complaints, the correspondence between the data subject and the authorities, and the correspondence between both authorities. The BayLfSt also confirmed the existence of internal notes and internal correspondence between the two authorities (Finanzamt Neu-Ulm and BayLfSt) concerning the data subject's access request in the dossiers. No further information was disclosed. The reply included instruction on the right to appeal. On 13.01.2022, the data subject filed a lawsuit against the Finanzamt Neu-Ulm and the BayStMFLH in regard to the notice of rejection from 17.12.2019. The court registered the lawsuits separately. The case under consideration is the law suit against the BayLfSt. The data subject based his demands on the suspicion that
Controller
The data subject was a former managing director of the controller. Following a complaint from the data subject accusing the controller of restoring data on his work laptop after termination, and thus violating his rights to access, erasure, restriction, and objection. In its decision, the DPA held that, in principle, an employer could not consult private emails of his employees, even if the company forbade the use of its tools for personal use. The DPA outlined that there were exceptions to this principle, for example in the case of pending legal proceedings and that the legitimate interest in defending itself in court constituted a valid legal basis for the processing of data. The DPA therefore considered that the controller had a legitimate interest for the processing of the data subject's data for the five previous years. In conclusion, the Belgian DPA ordered the controller to comply with the GDPR and imposed a €7,500 fine. The controller filed an appeal with the Belgian Court of Appeal arguing that the DPA’s decision was not reasonable and proportionate and, thus, had to be annulled. The controller firstly pointed out that the DPA did not specify if the data targeted was exclusively the data relating to the data subject’s private life or the professional data. Furthermore, it stated that the DPA did not justify the choice of a five years time period for the validity of the legitimate interest. It considered that it continued to have a legal interest in the processing since two other proceedings were pending between the controller and the data subject. In its defense, the DPA argued that its choice of setting the time limit for the legal basis of legitimate interests at five years was reasoned and based on a balancing test. It however left open the starting point of this period, which would be determined during the implementation of the corrective measures. The Court noted that the contested decision did not fix the starting point for the five year
BF (insured/data subject)
The controller was an insurer, and the data subject was one of its policy holders. In 2012, the data subject subject suffered a whiplash injury in a car accident and was later diagnosed with "post-traumatic depressive adjustment disorder with somatization." In 2014, the data subject filed a claim with the controller for occupational disability; the data subject had been self-employed as a management consultant and energy technician. The controller rejected the claim on the basis that the data subject had not provided adequate proof of disability. On October 28, 2015, the data subject applied to the district court of Wels for a conditional payment order to be issued against the controller. At the time of the DPA's decision, the civil proceedings were suspended. In 2016, the controller offered the data subject a one-time payment of €25,000, which the data subject rejected. The insurance contract between the two parties was terminated in October 2017. On May 13, 2019, the data subject emailed an access request, requesting specifically the "risk assessment" associated with her contract and the "reserve amount" associated with her disability claim. In a response dated Nobember 27, 2019, the controller asked the data subject for an explanation of what she meant by those terms. On April 26, 2020, the data subject filed a complaint with the Austrian DPA alleging that the controller had violated her right of access and additionally requested all of her personal data processed by the controller. The controller responded that it had answered the data subject's access request to the best of its ability and that the terms she used were not meaningful to the firm. The controller claimed the data subject believed she was entitled to an insurance payout and was abusing data protection law for her benefit in the related civil procedure. As the complaint was the first time the data subject had requested all her personal data, the controller sent a 200-page response including among others her tariff type, the surrender value paid out, her responses on a medical questionaire, and payment history. The data subject disagreed that this information was comprehensive, insisting that, because the controller had offered her a settlement, it must have calculated a case-related accrual amount. The controller denied this, explaining that accrual amounts were calculated in aggregate, not on a specific, case-by-case basis. On June 7, 2021, the DPA rejected the data subject's complaint because it had responded to her access request with all the information available to it; the missing information she continued to request was never available to the controller. The data subject appealed, requesting an on-site investigation of the data held by the controller. The Court rejected the data subject's appeal. It concluded that the data subject's complaint was based on the alleged incompleteness of the controller's response to her access request (missing an assessment of the subject's health and the calculation of the settlement). The Court noted that, in regards to the missing health data, the controller had supplied the data subject with the only information it had, which were the questionaires and medical documents she had personally submitted. Regarding the calculation of the offered settlement, the Court held that these calculations were trade secrets under the DSG because they were secret, had commercial value, and were protected with appropriate confidentiality measures. Article 15(4) GDPR provides that the right to access is not absolute and that access requests shall not adversely affect the rights and freedoms of others, and Article 4(6) DSG specifically makes exception for business or trade secrets. The DPA held that the controller had in fact provided all the personal data it had on the data subject and was not obliged to share the process by which it assessed this information and calculated the settlement it offered her. The rejection of the data subject's appeal was deemed final, as the legal situation was sufficiently clear as to not cause any difficulty in interpretation.
College van Burgemeester en Wethouders Den Haag
This case is between a data subject and the city government of The Hague (the controller). In 2019, the data subject requested access to her personal data pursuant to Article 15 GDPR. The controller partially complied with the request on 6 November 2019, after which the data subject claimed that not all information within the scope of her access request had been provided to her. Eventually, on 15 December 2020, the controller provided her with more documents. According to the data subject, however, this was not enough because the scope of her access request included all e-mails that were sent by the (so-called) “youth director”. This is a government employee who functions as a main contact person between a family and the different governmental agencies. The city government, however, stated that these emails could no longer be found in the system, since the respective youth director is no longer employed, and his personal email inbox is no longer available. Moreover, other youth directors could not find any other emails that relate to the data subject, in their common email inbox. According to the data subject, this was negligence on the side of the controller. Hence, she brought the issue before Court. The Court rejected the claim. The Court stated that the data subject did not make a plausible claim that the city government did not fully comply with the access request. In this regard, the Court considered that the city government had already conducted a new search in 2020, which led them to provide more documents on 15 December 2020. According to the Court, it was not implausible that there are no more emails to provide to the data subject. Moreover, the Court stipulated that it is not relevant that the personal inbox of the former youth director may have contained personal data relating to the data subject’s children. After all, the Court stipulated that the controller provided all information that is required under Article 15 GDPR.
Stichting Bureau Krediet Registratie
The controller is Stichting Bureau Krediet Registratie (BKR), which manages the credit information register (CKI). This register provides an overview of the creditworthiness of people since credit providers (banks etc.) can register (severe) debts of individuals. There were three registrations related to the data subject in the CKI, with special codes that indicated that there had been several payment arrears. In 2021, the data subject requested the BKR to have these registrations and/or these special codes erased, but the controller refused. The data subject then brought the issue before Court, which granted his claim and ordered BKR to erase the codes. The controller then appealed this decision. After some initial hesitations, the controller removed the codes from the registrations, but added a new code “9 Dispute”. The data subject then requested the controller to remove this new code because he claimed that it also negatively affected his creditworthiness (even more than with the previous codes), but the controller refused and explained that this code had been added to explain that the removal of the special codes is still disputed in court (namely: the appeal). After the data subject was refused credit from a credit provider because of this new special code, he brought the issue before court to have this code “9 Dispute” erased pursuant to Article 17(1)(d) GDPR, and to keep having this code erased. The Court decided that the registration was unlawful and ordered the controller to remove the special code “9 Dispute” from the registration pursuant to Article 17(1)(d) GDPR. First, it considered that the data subject did not explain what the legal basis was to have the actual registrations removed (rather than only the special codes that are linked to the registrations), or why this should follow from the circumstances of the case. Hence, it rejected the claim to have the actual registrations removed. Second, it considered that the claim to have the special co
1) unknown data subject (complainant before the DSB)
In February 2019, an insolvency procedure was opened in relation to the data subject and published in the national insolvency registry (Insolvenzdatei). After the data subject had learned, that a credit reference agency (controller) had collected that data on him and was storing it in its creditworthiness database, he sent an erasure request under Article 17 GDPR to the controller, which refused to erase the data, arguing that it was allowed to process the data under Article 6(1)(f) GDPR. Consequently, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB) against the controller. The DSB dismissed the complaint, holding that the controller has a legitimate interest under Article 6(1)(f) GDPR to collect and process data on insolvency procedures in order to assess the data subject's creditworthiness. The data subject filed an appeal against that decision with the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG dismissed the appeal and upheld the DSB's decision. It held that data on insolvency procedures are apt information to assess an individual's creditworthiness. The BVwG then referred to established BVwG case-law (see e.g. BVwG - W211 2225136-1, BVwG - W274 2232028-1/3E or BVwG - W214 2228164-1) according to which the rules of the Capital Requirements Regulation ([https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02013R0575-20210930 Regulation 575/2013]) should be taken into account when assessing the legitimate storage duration for data on payment defaults or insolvencies. As a result, the BVwG held that the controller is allowed to store data obtained from the Insolvenzdatei for a five-year period after the clearance of the underlying debts.
Police Rotterdam
This dispute was between a divorced father (the data subject) and the chief of police of Rotterdam (the controller). In 2020, the data subject found out that Veilig Thuis (an advice and reporting centre for domestic violence and child abuse) had registered two reports on him in their database. The first registration stated that he had committed domestic violence and that subsequently he was temporarily denied entrance to the home he had previously shared with his ex-wife. According to the data subject, these allegations were unfounded. According to the data subject, the second registration was also inaccurate since the report did not adequately state that his ex-wife had moved to a new place with their son, without informing him of the new location. He requested to have the first report deleted, and the other rectified, but Veilig Thuis refused. The data subject then brought the issue before Court, which decided that Veilig Thuis did not have a substantial interest in retaining the personal data, and that it had to delete the first report and amend the second one. Because Veilig Thuis had received the information from the Rotterdam police, the data subject subsequently requested the police to delete the inaccurate personal data and rectify the reports. The police, however, claimed that the information was accurate, and refused to rectify their files on the data subject. The data subject then brought the issue before the District Court of First Instance of Rotterdam (hereinafter the Court), basing his claim on Article 12 GDPR on transparent information, communication and modalities for the exercise of the rights of the data subject, and his right to obtain from the controller the rectification of inaccurate personal data pursuant to Article 16 GDPR. The Court upheld the claim. Regarding the first registration (on alleged domestic violence), the Court considered that, in 2019, the police had decided not to further investigate the allegations of domestic violence brought forward by the data subject's ex-wife. Hence, the Court stated that the report needed to be rectified in the sense that it must speak of "alleged" domestic violence. Moreover, the Court found that it must clearly follow from the report that the temporary ban to enter his previous home was instated by the judge in the divorce procedure and had nothing to do with the alleged domestic violence. Regarding the second registration, the Court found that the report did not accurately display that the new address his ex-wife had moved into with their son, and that he was not provided this information. The Court concluded that the personal data held by the Police was inaccurate, and ordered the police to grant the data subject's right to rectification and correct it.
Paul Strobach
The controller is a railway company. It has video cameras installed in some of its trains which are active during the operation of the trains. The recordings are automatically deleted after 48 hours. The data subject boarded one of these trains on the 27th of April 2021. By email of the same day the data subject requested the controller to hand over the video footage and, to this end, not delete it. The controller, however, deleted the data within the deletion period of 48 hours and, therefore, refused to provide the requested information to the data subject. As a consequence, the data subject filed a lawsuit with the District Court of Pankow (Amtsgericht Pankow - AG Pankow) requesting damages in the amount of €350 according to Article 82 GDPR. The District Court rejected the claim of the data subject. It held that the controller did not violate Article 15(1) GDPR. It found that the controller's refusal to answer the request of access was legitimate according to [https://www.gesetze-im-internet.de/bgb/__275.html § 275(2) BGB] (German Civil Code) under which a debtor can refuse performance insofar as this requires an effort which, taking into account the legal relationship of the parties and the requirements of good faith, is grossly disproportionate to the creditor's interest in performance. The court concluded that, since the data subject was already aware of the processing, its circumstances and its content, the purpose of Article 15 GDPR was already largely fulfilled. Furthermore the court reasoned that, because of the short retention period of 48 hours, a loss of control of the data subject over his personal data was not apparent. The data subject had also requested the restriction of the processing under Article 18(1)(c) GDPR in order to prevent the controller from deleting the footage while the access request was handled. On this point, the court found that preventing the automatic deletion and filtering out the recording of the data subject would have tak
Court case 25 K 2138/19
In March 2019, the data subject requested rectification of his registered address from the controller, a municipality. According to him, he had lived at different addresses in the 1980s which did not show up in the record. The controller refused, arguing that it had no further data about the data subject and that the file had been archived already, meaning that it could not be edited anymore. In April 2019, the data subject brought an action against the controller in court. He argued that the controller had no good reason or legal basis to refuse the rectification. The controller claimed that the data subject had not proven that the data were inaccurate. Since the dates concerned were over 30 years in the past, it had no obligation to keep further documents or records since the retention periods had expired in the meantime. Furthermore, the data subject had violated his obligation to register every relocation which would have allowed a correct and seamless documentation of this information. The Administrative Court of Cologne (Verwaltungsgericht Köln - VG Köln) dismissed the data subject's claim. Initially, the court discussed whether the claim was inadmissible because it doubted that the data subject had a legitimate interest for legal relief in the first place. Such interest does not exist when the lawsuit can obviously not bring a plaintiff any legal or factual advantages. It criticised that the data subject had not substantiated why he had an interest in the rectification of data older than 30 years. It further agreed with the controller that it was partly the the data subject's own fault that the register was not up to date because he himself failed to comply with his obligations to re-register after each relocation. However, the court did not finally decide on the admissibility because it found the claim to be unsubstantiated anyhow. First, the court established that the only basis for the data subject's claim was Article 16 GDPR, as [https://www.gesetze-im-internet.de/bmg/__12.html § 12 Bundesmeldegesetz (BMG - Federal Registration Act)] clarifies. Then, it held that the legal requirements of Article 16 GDPR were not fulfilled. According to the court, Article 16 GDPR requires that the data processed by the controller are objectively incorrect, and, at the same time, the data designated to replace the inaccurate data must be factually correct itself. While the court did not rule out the possibility that the data held by the controller were inaccurate, it found that the data subject did not prove that the data provided by him was factually correct, because the documents submitted by him partly contradicted his previous statements. Since the burden of proof was on the data subject, the court dismissed his claim.
Google Ireland Ltd.
The data subject is a freelance artist. She is in a dispute with Google Ireland Limited about her entry in Google Local Listing, a service displaying local business listings on a map on Googles first page results. On her website she disclosed information about her private life, including personal data such as phone number and address. Google Local Listing processed the information from that website and disclosed them on Google Maps or in a sidebar in Google Search. The data subject used a web form provided by Google LCC and requested the deletion of the entry. The deletion request was ignored at first by the defendant. Subsequently, the data subject's attorney submitted a written warning and an injunctive relief. The data subject also demanded the compensation of her attorneys fees. Google subsequently deleted the entry without signing the injunctive relief and without compensation. The data subject argued that the disclosure of her personal data occurred without her cooperation and that data protection law entitled her to receive an injunctive relief from the defendant. The lower regional court in Munich (Landgericht München I) took the view that, although the data subjects demand of deletion was justified, Article 17(1) GDPR supported no indemnification claim – the court rejected her demand of compensation. The court decided further that Article 17(1) GDPR is not only an entitlement of removal, but also an entitlement of injunctive relief, because an injunctive relief could counter a potential risk of recurrence. Therefore, the data subject is entitled to demand an injunctive relief. The lower court convicted the defendant to refrain from any future disclose the personal data of the data subject in the Local Listing service. The defendant appealed the decision of the lower court. The Higher Regional Court Munich (Oberlandesgericht München) overturned the decision of the lower court and dismissed the data subjects claim for an injunctive relief. The Higher Regi
Court case 4 U 1905/21
The controller is a private health insurance company. The data subject is a customer of the controller. The parties are in dispute about the validity of several increases to the insurance premiums. The data subject filed a lawsuit with the Regional Court of Leipzig (Landgericht Leipzig - LG Leipzig) requesting the refund of overpaid premiums as well as information on all adjustments to the premiums in the form of notification letters sent to the data subject and supplements to the insurance policy. The controller rejected both claims. The Regional Court of Leipzig dismissed the data subject's claim almost entirely. As a consequence, the data subject appealed this decision to the Higher Regional Court of Dresden (Oberlandesgericht Dresden - OLG Dresden). The Higher Regional Court of Dresden dismissed the plaintiffs appeal. The court found that the right to access cannot be used to obtain information about premium increases. For its reasoning the court exclusively quoted a decision of the Higher Regional Court of Hamm (Oberlandesgericht Hamm - OLG Hamm) from the 15th November 2021 (case nr. 20 U 269/21). In the quoted decision, the OLG Hamm held that a controller is allowed to reject a request to access under Article 12(5)(b) GDPR as "excessive" if the request's sole purpose is to verify the validity of premium increases instead of verifying the lawfulness of the processing of personal data. In its reasoning the OLG Hamm found that the term "in particular" in Article 12(5)(b) GDPR shows that there can also be other circumstances than the repetitiveness of a request which can render a request "excessive". The court further referred to Recital 63 and established that the purpose of the right to access is to be aware of, and verify, the lawfulness of the processing of personal data. Therefore, the Court considered a request whose sole purpose is to verify the validity of premium increases instead of verifying the lawfulness of the processing of personal data excessive