GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Inn with Hotel (name not mentioned) V. A public authorty responsible for food quality control (name not mentioned)
The applicant runs an inn with a hotel in the urban area of the respondent (a public authority responsible for food quality control). In March 2019, the initiative "TopfSecret" requested via an internet platform ("Frag den Staat") the respondent to disclose information on the last two food regulatory audits of the applicant’s business. After hearing the complainant, the respondent issued a decision, that it would disclose this information within ten days. The applicant filed an action against the decision, requesting i.a. a temporary injunction to prevent the disclosure of the audit results. The Administrative Court Regensburg ordered the temporary injunction of the action. Subsequently the respondent lodged an appeal with the VGH München, requesting to set aside the order of the Administrative Court Regensburg and reject the applicant's request for a temporary injunction. Does the respondent’s decision to grant the initiative "TopfSecret" access to information on the Applicant’s food regulatory audits comply with the German Consumer Information Act (Verbraucherinformationsgesetz - VIG)? Does this decision or the subsequent private use of the information violate the Applicant’s right to data protection under the GDPR and/or other fundamental rights? The VGH München held that as far as the disclosure of information by the respondent constitutes processing of personal data within the meaning of Article 4 (1) and (2) GDPR, this would be justified under Article 6 (1)(c) and (3). The court also found that the VIG complies with Article 86 GDPR: The provisions of this opening clause are taken into account by the Consumer Information Act with its graduated regulatory model which considers mutual interests of both the consumer requesting access and the data subject concerned. Insofar as the complainant fears that the third party or the internet platform will breach data protection laws in the event of subsequent use of the information disclosed, such a breach would no
Court case XXV C 2596/19
The data subject was the owner of the vehicle which was involved in the road collision. On the date of collision the vehicle was insured in terms of civil liability of motor vehicle holders. After the collision, the insurer handled the loss adjustment. The injured party in the subject traffic collision approached the insurer to send documentation regarding the loss. The insurer's employee sent to the injured party scans of the loss documentation, which were not anonymized, i.e. including the name of the data subject, her residence address, PESEL number, telephone number, and vehicle data. Later on, the insurer notified the data subject of the above incident, as a result of which personal data may have fallen into the wrong hands. Upon receipt of the above information, the data subject changed her cell phone number and stipulated to the bank that withdrawals from her bank account could only be made on her personal instruction. She was afraid of the negative consequences of having her personal data disclosed by the insurer, i.e. that someone would call her and that her data would be passed on. The injured party in the traffic collision did not contact the data subject or file a claim in court against her. The insurance company paid the injured party compensation under the data subject's insurance contract. The representative of the data subject requested the insurance company to pay the amount of PLN 10,000 as compensation due to the violation of the protection of the claimant's personal data by unauthorised disclosure to third parties. In its reply, the insurance company refused to accept the data subject's claim, arguing that the transfer of the claimant's personal data to the injured party was based on provisions of law. Whether there has been an unlawful transfer of personal data to a third party? Did the scope of personal data provided to the third party comply with the data minimization principle? The District Court in Warsaw held that under specific regula
Court case 8598127 KK EXPL 20-357
An individual had a credit history with the bank, at the term of which he could pay his debts due to reasons for which he cannot be held responsible. the bank registered his name under several codes at the BKR. The individual asks for the removing his data from the BKR. the bank refuses to send this request. the balance of interest was to be assessed, between the interests of the users not to be registered, and the interest of the society (banks and credit agencies) to assess the profile of their customers. The tribunal confirmed that the data could be processed under the legitimate interest basis (ARTICLE 6(1)(f) GDPR). The tribunal weighted the different interests at stake and decided in favor of the complainant since he could prove that his bad credit scoring was due to unfortunate circumstances. The tribunal order the bank to request the BKR to remove several codes under which the plaintiff as registered.
Court case 1 L 134/20
A regional supervisory authority requested access to an association’s board meeting minutes as well as an external auditor’s report in the context of an investigation into the association’s managing director’s conduct. The association refused to submit the requested information entirely and unredacted, partially relying on privacy rights. The supervisory authority acknowledged the potential legitimacy of redactions where merely personal data was concerned, but claimed that redactions went far beyond this, and included information on employment contracts and pay crucial to the performance of their rights and duties as supervisory authority. The documents had also been requested by the regional audit office (Landesrechnungshof). Could the association refuse to submit information to their supervisory authority based on data protection laws? The regional court found, inter alia, that the association could not rely on privacy regulations as an objection to submitting the documents requested by their supervisory authority. The court confirmed applicability of § 2 (1) 1 BbgDSG (Brandenburgisches Datenschutzgesetz – regional privacy law Land Brandenburg), corresponding to § 3 BDSG (Bundesdatenschutzgesetz – Federal Data Protection Act) and implementing Art 6 (1) e) GDPR, as a basis for access to personal data by a supervisory authority. It further concluded that the element of necessity, as required by the applicable provisions, was met for the specific case.
ING Bank N.V.
Appellant is a customer of ING who had his personal data registered in ING's Internal Referral Register ("IVR") in 2013 for the period of 8 years. In 2017 appellant's credit card request was rejected by ING because of the record in IVR. Before 2013 the appellant had opened and closed 15 business accounts on behalf of different companies, two of which were closed with a negative balance. Appellant claims that ING has no legal basis for registering his personal data in the IVR. The Court upheld the decision of the Court of First instance: 1) registering appellant's personal data in the IVR was necessary to protect legitimate interest of ING and to protect integrity and security of the bank sector. The Court took into account ING's adherence to the Code of Conduct for the Processing of Personal Data by Financial Institutions ("Gedragscode Verwerking Persoonsgegevens Financiële Instellingen"); 2) IVR is an internal register of ING, appellant failed to demonstrate that the record in the IVR has prevented him from getting financial services at other institutions; 3) the fact that appellant was added to the register in 2013, but noticed this only in 2017 was quite significant, according to the Court. ING has added appellant's personal data to its internal register on good grounds and in compliance with the Code of Conduct and the GDPR.
Gambling hall operator
The plaintiff, an interest grouping for gambling machines production companies, had noticed that on several occasions the defendant, a gambling hall operator, had not verified the identity of players at their entries. As a result, there was no alignement with the Hessian system OASIS listing of all banned players. Among other things, the defendant argued that it would be contrary to the GDPR to verify the identity of all players, especially if they turned out not to be banned, making the processing of data unlawful. Is it contrary to the provisions of the GDPR for gambling hall operators to verify the identity of non-banned players at their entries? The Higher Regional Court of Frankfurt points out that, according to Article 6(1)(e) GDPR, a data processing is to be considered lawful if it is necessary for the performance of a task carried out in the public interest. As articles 6(2) and 6(3) GDPR allow the Member States to introduce more specific provisions to adapt the application of the rules of Article 6(1)(e) GDPR, the Hessian legislator made use of this possibility through § 6(1) of the Hessian gambling law. As such, the processing of data for protection of players and combating gambling addiction is lawful because it is carried out in public interest. Beyond that, a gambling hall operator can and even must verify all identities at their entries, not only those of the banned players, in order to fulfill the primary purpose of the data processing.
Court case 4354/19.7T8CBR-A.C2
The plaintiff considers that he is eligible to be qualified as a 3rd Degree Administrator and 2nd Class Administrator, as verified under the terms of Law-Decree 101/80, of 8 May, namely because the defendant is remunerating other workers with a higher remuneration when the work provided by them is equal in nature, quality and quantity to that provided by the author, and the constitutional and universal principle of equality of “for equal work, equal wages” (Article 59 of the Portuguese Constitution) is being violated. After the pleadings were closed, the Plaintiff requested from the Court access to personal data of other workers. The request was issued, of which the following stands out: “(…) The Plaintiff requires (...) the Defendant be notified to join the Work Contracts of other workers that he identifies, as well as the respective salary receipts." Now, in the case of people who are not even part of the present case and having in mind the Data Protection Law, the claim was rejected by the lower Court. As for the joining of salary receipts of workers who are not part of these records, and in view of the Data Protection Law, the lower Court ordered that those receipts be removed and returned. Not complying with what was decided by the Tribunal Judicial de Coimbra (lower Court), the plaintiff appealed to the Tribunal da Relação de Coimbra (Coimbra Court of Appeal). The Portuguese Deputy Attorney General requested that the appeal be dismissed. Considering the conclusions of the allegations that, as is known, the Court of Appeal had to decide whether: #The order under appeal is null and void. #The addition of employment contracts and salary receipts to other workers who are not part of the process violates data protection laws. The content or contents of the salary receipts is framed in the definition of personal data contained in Article 4(1) of the GDPR because they contain “information relating to an identified or identifiable natural person (“data subject”)…” and its treatment (Article 4(2) of the GDPR) is only lawful if, as far as the case is concerned, “it is necessary for the purpose of the legitimate interests pursued by the controller or by third parties, except if the holder's fundamental interests or rights and freedoms prevail that require the protection of personal data, especially if the holder is a child”. The processing of personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or union affiliation , as well as the treatment of genetic data, biometric data to uniquely identify a person, is prohibited, data relating to health or data relating to a person's sexual life or sexual orientation, and this prohibition does not apply “if treatment is necessary to declare, exercise or defend a right in a judicial proceeding or whenever the courts act in the exercise of their jurisdictional function”- Article 9(1) and (2)(f) of the GDPR. If it is true that, in this case, these workers are not parties to the lawsuit, it is no less true that all people, whether or not they are parties to the cause, have a duty to collaborate to discover the truth, namely, providing whatever is required - Article 417(1) of the (New) Civil Procedural Code, in which case, the reasons for refusal referred to in paragraph 3 of the aforementioned rule are not verified. If, in order to achieve the intended purpose (to know if there is a violation of the aforementioned constitutional principle), it is necessary to add the salary receipts in order to be able to prove the amount of wages earned by other workers, it is no less certain that this combination may entail an intrusion into the private lives of these workers as the receipts may contain other information such as, for example, union dues, insurance and alimony payments and absences from work, whose knowledge is not essential or indispensable for be able to decide on the alleged violation of the constitutional principle of “for equal work equal pay” Thus, if the joining of the salary receipts is adequate, or necessary, for the exercise by the author of a right in a judicial process, that is, to prove the amount of the salaries in order to be able to conclude for the violation or not from the said principle, it cannot be forgotten that such a merger, in the terms referred to, may result in a violation of the reserve of private life, all depending on the content of such receipts. For this reason, considering the conflicting rights that it is urgent to safeguard, bearing in mind the balance criterion that must preside over the analysis of this type of situations, within the legal framework in force, it is decided that the salary receipts must be filed together provided that only the amount of the salary is included, including all its remuneration components, omitting the reference to any other elements that, in addition to the amount of the remuneration, may be included in them. Terms in which it is decided to judge the appeal well founded, according to what the defendant must be notified to proceed with the aggregation of the receipts of salary of the data subjects, under the terms and with the limitations contained above.
Ligue des droits de l'Homme
The NGO « Ligue des droits de l’Homme » brought an action for interim measures under L 521-2 of the code of Administrative justice (“CAJ”), before the administrative judge of first instance of Versailles to remove fixe and portable thermal cameras installed in Lisses’ municipal offices and used in the entrance of schools to monitor the body temperature of agents and citizens. The NGO also required to suspend the execution of the decision allowing the installation of both kinds (fixed and portable cameras). After confirming that the GDPR applied, the judge of first instance issued an order rejecting the request. Thus, the NGO appealed the order before the Council of State (Conseil d’Etat) and requested mainly to annul the order, grant its request at first instance and enjoin the city of Lisses to adopt any appropriate measure to indicate that the processing of body temperature remains optional, under Art. L 521-2 CAJ. By virtue of Art. 521-2 CAJ, the interim relief judge may order any measures necessary to safeguard a fundame The supreme Court had to assess whether the right to the protection of personal data included in the right to privacy, constitute a fundamental freedom within the meaning of L 521-1 CAJ. Thus, if the judge could enjoin the city of Lisses to suspend the execution of its decision and remove the thermal cameras. Although the portable thermal cameras do not record personal data, the judge clarified that the decision based on the information captured by the thermal cameras must be regarded as a processing, within the meaning of Art. 4 GDPR. Indeed, the city report to the teachers and pupils the need to leave the school depending on the highness of the body temperatures captured. Furthermore, the judge held that the body temperature was accurate enough to identify individuals and must be regarded as a sensitive personal data under the GDPR. Regarding the lawfulness, the judge rejected all the legal bases claimed by the city and hold that the
Court case 1 S 1739/20
Due to the Corona pandemic, the Land Baden-Württemberg issued a regulation with measures to contain the Corona virus as well as a special regulation for restaurants and alike. According to these regulations, one has among others, the obligation to leave contact details when visiting a restaurant. A data subject complaint about the obligation of these regulations to provide contact details when visiting a restaurant, stasting that the purpose to process special categories of data according to Article 9 (1) GDPR is not proportional and necessary, as there are less restrictive measures like shorter opening hours and restrictions on how many people can be in a restaurant at the same time and the voluntarily provision of data for contract tracing. Moreover, it has been claimed that there is not enough protection for the personal data as personnel is not trained and changes a lot. Additionally, the data retention period of four weeks is too long. The obligation to provide contact details when visiting restaurants, as regulated in § 2 (3) CoronaVO Gaststätten, is likely to be constitutional and compatible with the provisions of the basic data protection regulation.
Court case VSL Sodba PRp 345/2019
The controller is accused of violating the provision of Article 8 of ZVOP-1 because the responsible person obtained personal data of vehicle owners or users in contravention of Article 10 of ZOdv. Is Slovenian law still applicable if it is more detailed than the GDPR or does the GDPR prevail anyway. The Court of Appeal agrees with the Court of First Instance's finding that the direct application of the GDPR does not constitute a violation of Article 6 (1) (c) as a misdemeanor, with the result that the GDPR from the point of view of misdemeanor law, as part of criminal law, is more lenient for the perpetrator and the court is justified in applying the principle of legality from the second paragraph of Article 2 of ZP-1 on the basis of point 1 of the first paragraph of Article 136.
Court case VSL00035084
A representative of a company obtained the personal data, including the names, surnames and addresses, of 51 owners of motor vehicles registered in Slovenia, and forwarded the obtained data to the company. He forwarded this information on the basis of Article 10 of the Slovenian Law on Advocacy (ZOdv). The authority found that the forwarding of the data was in breach of this law, because the representative did not acquire the data for reasons permitted in the ZOdv, i.e. for performing an act of the legal profession for an individual case where the data was required. The decision of the authority was appealed to the Ljubljana District Court. As the court of first instance, it considered that Article 6(1)(c) GDPR (processing on the basis of complying with a legal obligation) did not apply to this case. The Slovenian DPA (Informacijski pooblaščenec) disagreed with the court's assessment. Does Article 6(1)(c) apply here? The VSL agreed with the finding of the court of first instance and dismissed the appeal as unfounded. In its reasoning, the VSL noted that while Article 6(2) GDPR permits Member States to maintain or introduce more detailed provisions in order to adapt the application of GDPR rules for processing done under Article 6(1)(c), this does not permit Member States to regulate Article 6(1)(c) in such a way "indefinitely".
Google (the controller), offers the services Google Maps and Google Earth to its users. Both services enable users to see the satellite images of the data subject's property which was photographed by Google. When searching by entering the address of the property, the red location pin is not directly on the property but on the street. However, when entering the GPS coordinates, the red location pin is directly on the property. The aerial photograph shows the location and size of the residential building, as well as various facets of the property (green areas, roof area, terrace, garden). The data subject had requested Google to pixelate or make unrecognizable his property in both services. The data subject claimed that the satellite images were his personal data. Furthermore, he argued that the controller could not rely on the fact that they were using data that could be obtained from commercial and public sources, as he had not authorised either Google Maps or third parties to take or publish the photographs of his property. The Regional Court of Itzhoe (LG Itzehoe) rejected the data subject's claim. It held that the interest of the controller in continuing to use the image outweighs the interest of the data subject in making the property unrecognisable. First, the court recognized the need of the general public to look at the world from the above through the controller's services. The individual reasons for which the users do this are irrelevant in the present case, since mere access to any kind of information source is already protected. If many data subjects' properties were made unrecognizable, the information content of the images would decrease significantly. Second, the court established that the interest of the controller outweighs the interest of the data subject in this case due to the lack of a concrete connection between the image of the residential property including the address entry and the data subject as a person. It is undisputed that the
Court case 19A1286
A STIB user was fined because he did not validate his ticket before entering the bus, although he had a valid transportation ticket. He was sued by the STIB before the local judge (Juge de paix). Is the processing of data of the users compliant with the GDPR ? The judge considered that the processing of the data of the users including the data on their journeys, even if stored in two separate databases, was not in line with the GDPR, because the explicit purposes were not determined in advance, and because the legal basis for doing so was not clear. As a consequence, the judge decided that the fine should not be paid.
Court case 2020/813/A
GRAYDON wrongly associated Mrs. KAHN’s name with the EGAR company. Consequently, on 31 July 2019, Mrs. KAHN was requested by a bailiff to pay the amount of 537.02 euros on behalf of EGAR as part of the mandatory annual contribution. Mrs. KAHN claimed the existence of a misidentification and challenged the lawfulness of the processing of her personal data. She requested the deletion of all her personal data appearing in GRAYDON’s file. Does a misidentification of a data subject in connection with a specific company in a register and a request for deletion arising from this data subject necessarily imply that any processing of his/her personal data in this register is unlawful under article 6 GDPR? The Tribunal declared the action admissible and observed that GRAYDON spontaneously deleted Mrs. KAHN's personal data in connection with EGAR. However, the Tribunal stated that the processing of her personal data by GRAYDON in relation to other legal persons is not automatically unlawful. Despite the withdrawal of consent by Mrs. KAHN, GRAYDON may base the processing of personal data on a legitimate interest (Article 6(1) GDPR).
Court case 10 Sa 2130/19
The employer runs a radiology practice and until 1 August 2018 had been using printed time sheets to keep track of how many hours the employees had worked. The employee who is a party to the case has refused to use the new fingerprint time-tracking system, and continued to manually write down the worked hours on the old time sheets. The employer then issued several warnings to the employee, urging him to use the new system. On 5 October 2018, the employee received a first written warning from his employer, urging him to start using the fingerprint system. Despite the warning, he refused to do so and continued using the printed time sheets. On 26 March 2019, the employee received a second warning which threatened with the possibility of immediately terminating his employment if he continues to refuse using the fingerprint system. Were the employer's warnings rightfully issued, and the processing of the fingerprint data lawful in accordance with Article 9(2)(b) GDPR? Both courts decided that the employer had to remove the warnings issued towards the employee, and that the employee was not obliged to use the fingerprint system and therefore did not violate his duties. The courts first stated that the only possible legal grounds for the processing operation could be Articles 9(2)(a) or (b). As the employee clearly did not give his consent, the courts did not elaborate further on Article 9(2)(a). With regards, to article 9(2)(b), the first instance court (ArbG Berlin) carried out a three-step assessment, based on: - the suitability of the biometric procedure for the purposes of the employment relationship - whether there were less intrusive means of attaining the purpose - a comprehensive weighing of interests The court concluded that an employer's interest in biometric access control systems to areas with sensitive business, production, and development secrets would be more likely to prevail than in the context of a time-tracking system. Therefore, in this case th
Natural person (complainant)
The plaintiff, an Austrian resident, had asked the Austrian social security administration to inform him about the status of his son's insurance, a boy living under the care of his mother in Italy. After a survey of both the mother and child's social security administrations, the Austrian administration informed the plaintiff that his son was not entitled to Austrian social security, since the place of residence of the child was not Austria. Following this, the plaintiff lodged a complaint with the Austrian DPA (Datenschutzbehörde Österreichs), claiming that the confidentiality of both his and his son's personal data had been breached by the illicit transfer of said data from the Austrian to the Italian social security administration. However, the Austrian DPA dismissed the complaint, arguing, regarding the alleged breach of his son's personal data, that the plaintiff was not authorized to act on behalf of the child and, regarding the alleged breach of the plaintiff's own personal data, that the Austrian social security administration had to share the data with third parties, especially with the Italian social security, as part of the inquiry into the entitlement of the Austrian social security of the plaintiff's son. 1) Can a parent lodge a complaint with a DPA on behalf of their child when the other parent has not given their consent for that purpose? 2) Does the transfer of data from one European social security administration to another constitute a breach of confidentiality? The Federal Administrative Court started by confirming that the Austrian DPA was right to dismiss the part of the complaint lodged by the plaintiff on behalf of his son. Indeed, the plaintiff lacked power of representation in this regard and could not produce evidence of the mother's consent for a joint complaint. Beyond that, it was also shown that the mother alone - contrary to the sayings of the plaintiff - had the right of custody of the child. The Court then pointed out that data processing and possible transfer to third parties in the context of an administrative procedure would always be considered legitimate if they are necessary for establishing and confirming relevant facts. Since a person resident in the European Union can only be entitled to social security in one member state at a time, the Austrian social security administration was in its right to communicate with the Italian social security administration on the matter, in order to clarify the situation of the plaintiff's son pursuant to Article 11 of the regulation on the coordination of social security systems. In doing so, the Austrian social security administration also had to communicate data relating to the plaintiff himself. In accordance with Article 6(1)(c) GDPR, this data processing in form of a data transfer could be considered necessary for compliance with a legal obligation to which the controller is subject and not a breach of confidentiality of the plaintiff's data. Hence, the data protection authority was also right to dismiss the plaintiff's complaint on that regard.
AVROTROS
Fraudulent ads using names and pictures of Dutch celebrities are shown on Facebook and Instagram since October 2018. The Claimant, who is a presenter of the news and current affairs programme broadcasted by AVROTROS, is one of the celebrities affected. In November 2019 a similar lawsuit was won by another celebrity, forcing Facebook to implement strict controls and take down fraudulent bitcoin ads. However, in March and April 2020 the Claimant saw similar fraudulent ads with his picture and name: this time the ads referred to the Corona crisis. The Claimant and AVROTROS asked the Court to order Facebook to: 1. To find and take down fraudulent ads within 5 days from this judgement; 2. Share information, identifying the advertisers behind these ads within 7 days from the judgement. Information should include name, email, phone number, date and time of registration, IP addresses and other user and payment data Facebook has in its possession. Facebook claims that the measures they already have in place are good enough and that it is not possible to filter out all fraudulent ads. On the second point, Facebook did not have specific objections, however the company believed that only Facebook Ireland could share this data and only on a Court’s order. The Court ruled that the measures Facebook has put in place to detect and remove fake/fraudulent ads were enough. On the second point, the Court considered the existing case law in the Netherlands. In 2004 the Amsterdam Court of Appeal ruled that an obligation for the service provider to provide data to a third party may be justified if the following conditions are met: a. the possibility that the information is unlawful and harmful to the third party is sufficiently established; b. the third party has a real interest in obtaining the data; c. there is no less drastic way to retrieve the data; d. the balance of the interests of the third party and the internet service provider is in favor of the third party. The Court ruled, that all these conditions were met in a present case and article 6(1) of the GDPR gives room for such data sharing.
Stichting Nijestee (Nijestee foundation)
The housing corporation Stichting Nijestee submitted non-anonymized judgments against the Claimant and her deceased father in proceedings against another tenants. According to Nijestee a court order is public unless legal exception apply. The Claimant has brought forward her private information by herself via a public procedure, after which it was included in the judgement. According to Nijestee they had reasonable grounds for using that judgement in another procedure. Nijestee also believes that data processing is permitted if certain conditions allowing it are met, and it has not been demonstrated that this was not the case. Claimant is of the opinion that Nijestee acted unlawfully towards her and her diseased father. She asked the Court to prohibit Nijestee from sharing her personal data contained in a judgement. The Court did not take into consideration the Claimant’s complaint about the processing of her father’s personal data because the Claimant had failed to explain why that processing was unlawful against her. The Court considered that it was possible that the personal data provided by Claimant to a court for the purpose of obtaining a judgment had been made available in a public court order. However, the Claimant’s consent to further dissemination of her personal data cannot be assumed from this. The Court therefore ruled that, in the absence of consent or any other legal basis, the sharing of the Claimant’s personal data by Nijestee was unlawful. Nijestee was also prohibited from sharing Claimant’s personal data with other parties, like co-tenants and other housing corporations.
Stichting De Huismeesters
The housing department of Groningen has a policy according to which the renting agreement can be terminated where the tenants were found to cultivate cannabis in the place allocated to them. They are then put on a list where they are banned from applying to a new housing during 3 years. The Appellant was evicted from her rental home because of her cannabis plants, a record of which was made by the housing corporation, followed by a 5-year prohibition for the Appellant to rent homes. Her personal data along with the reason for the contract termination (cannabis cultivation) was supposed to be shared with other local organizations and housing corporations according to the agreement against home cultivation of cannabis. On 17 November 2015 the Court of First Instance ruled, among others, in favor of the Appellant’s objection against the sharing of her data according to the agreement and reduced the 5-year prohibition to 2 years. Both Appellant and the Huismeersters Foundation appealed this decision in the Court of Appeals on several points. One tenant was expelled from his house on this basis and considered that the processing of his data was not compliant with the GDPR. The controller put forward Article 6(1)(b), (c) and (f) GDPR as potential legal bases. Main questions from data protection perspective were: • Is the Huismeestes Foundation allowed to share (personal) data of Appellant with other participants of the agreement because Apellant has been evicted from her social rental home due to a hemp farm? • Does a record of the reason of eviction (cannabis) constitute data relating to criminal convictions and offences according to Article 10 GDPR? The Court ruled that the record of the reason of eviction does not constitute data relating to criminal convictions and offences. In this case the record was made by assigning code 2 (2=cannabis) in the field “reason of registration”. According to the Court, this simply marks cannabis being grown in the rental home
Butcher shop chain
An internet platform ("Frag den Staat") requested the respondent (a public authority responsible for food quality control) to disclose the results of food regulatory audits regarding one of the complainant's butcher shops. This information would also contain personal data. After hearing the complainant, the respondent issued a decision, that it would disclose this information to the internet platform within ten days. The complainant filed a lawsuit against that decision with the Administrative Court München, requesting i.a. a temporary injunction to prevent the disclosure of the audit results. The Administrative Court München waived this lawsuit. Subsequently the complainant appealed with the VG München, requesting to prohibit the respondent from publishing the information. Does the German Consumer Information Act (Verbraucherinformationsgesetz - VIG), which grants consumers access to certain information in connection with quality checks of consumer goods comply with the opening clause in Article 86 GDPR if the disclosure involves personal data? The court held that the VIG complies with Article 86 GDPR: The provisions of this opening clause are taken into account by the Consumer Information Act with its graduated regulatory model which considers mutual interests of both the consumer requesting access and the data subject concerned. Insofar as the complainant fears that the internet platform will breach data protection laws in the event of subsequent further use of the information disclosed, such a breach would not be attributable to the respondent. In addition, the court held that Article 8(5) of the Regulation (EU) 2017/625 (Official Controls Regulation) only constitutes minimum requirements for allowing the disclosure of the results of official controls. It does not apply where there is a legal obligation to publish or disclose such information ("without prejudice to situations where disclosure is required by Union or national legislation"). Hence, the cou