GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
The data subject was employed by a company (the controller) for one month in 2016. In 2022 the data subject filed a request, asking for information about any ongoing processing of his data. The controller responded but the data subject considered the response to be incomplete: in the data subject’s view, the response did not provide sufficient details about the completeness of the copied provide to them, the duration of the data storage, and the specification of the recipients of the data. After some back-and-forth, the controller eventually provided the information he requested, two months after the initial request. The data subject asked the controller for monetary compensation for the delay. After the controller refused, the data subject sued the controller with the Labour Court, claiming damages under Article 82(1) GDPR. Specifically, the controller claimed that he suffered non-material damages over a week-long loss of control over his personal data, due to the controller's delayed response. The Labour Court awarded €10,000 in damages but the controller appealed the decision. Later, the Regional Labour Court overruled the decision and rejected the damage claim. In turn, the data controller challenged the appeal before the Federal Labour Court- Germany’s court of last instance for labour cases. Before this Court, the data subject claimed that a delay in responding to an access request, in and of itself, constitutes a loss of control over one’s data and gives rise to a claim for non-material damages under Article 82(1) GDPR. The Court upheld the appealed decision and denied damages. In particular, the Court held that the controller’s delay in responding to an access request, does not, in and of itself, constitute a loss of control (and, therefore, does not necessarily cause non-material damage). The Court used the case law of the EU Court of Justice as a starting point. With regards to the compensation of non-material damage, the CJEU held that a loss of control
A data subject submitted an access request under Article 15 GDPR to a social services authority (the Croatian Institute for Social Work, the controller), seeking full information about the processing of his personal data. The controller did not respond or provide the requested data. The data subject filed a complaint with DPA on 13 June 2024. The data subject initiated an administrative court procedure on 21 August 2024 against the DPA for a failure to act. The DPA eventually issued a decision upholding the complaint and ordering the controller to comply on 29 August 2024. The Court held that if a controller fails to provide full access to personal data in response to an Article 15 GDPR request, this constitutes a violation, and the DPA must issue a decision within the legal deadline or face judicial review for "administrative silence" (inactivity). Additionally, the court held that when the DPA issues a decision during litigation that fully satisfies the claimant’s request, the administrative dispute must be dismissed under national law and the claimant is entitled to reimbursement of legal costs — in this case, €1,250.
A kindergarten teacher (hereinafter, the teacher) has been working for the Municipality of Malý Lapáš (hereinafter, the municipal school) since January 2016. On 4 July 2023, the controller immediately terminated the teacher's employment on the basis of a serious breach of work discipline. The municipal school relied on two incidents. First, the teacher had allegedly left the workplace shortly before the end of her working hours without the consent of her superior. Second, she had published photographs of children from the kindergarten on her private Facebook profile. The photographs were taken during an overnight kindergarten event. The teacher published seven photographs alongside a post thanking a local pizzeria for providing sponsored pizza to the children. She maintained that she had tried to avoid showing the children's faces and that her intention was merely to thank the sponsor. The municipal school argued that the photographs constituted personal data and that the teacher was not authorised to publish them on her private Facebook account. Parents provided an informed consent at the beginning of each school year which permitted the publication of photographs through specified channels, including the municipality's website, the kindergarten's official website, EduPage and within the kindergarten premises. This consent did not cover publication on an employee's private Facebook profile. The teacher admitted that she did not have prior written consent from the children's legal representatives for publication on her private account. She considered the general informed consent sufficient and claimed that the parents had been aware of the planned publication. After the termination of her employment, she attempted to obtain additional consent from the parents. The teacher challenged the immediate termination before the Court and requested a declaration that the termination was invalid as well as compensation for lost wages. The Court upheld the teacher's claim and
The data subject is a user of the platform www.facebook.com provided by Facebook (now Meta), the controller. Facebook uses personalised advertising that is tailored to the online behaviour of network users. When the GDPR came into force, Facebook initially processed personal data for the placement of personalised advertising under the legal basis of Article 6(1)(b) GDPR, performance of a contract. From April 2023, Facebook changed the legal basis to Article 6(1)(f) GDPR, legitimate interest. Since November 2023, Facebook started implementing the pay or ok model, where users could choose to either consent to the use of their data for personalised advertising on its platforms or pay a subscription fee to prevent the processing. The data subject consented to the processing of his personal data for targeted advertising. In January 2024, the data subject demanded out-of-court compensation and deletion or restriction of his personal data due to unlawful processing of his personal data but he received no answer. The data subject filed a case before the Munich District Court (Amtsgericht München - AG München) claiming that Facebook processed his personal data unlawfully, in violation of Article 5(1)(a) GDPR because the processing was not necessary for the performance of the contract or to protect legitimate interests and he did not consent to the processing before November 2023. The data subject claimed that he was entitled to immaterial damages in the amount of €1,000 because receiving targeted advertising was unpleasant and frightening to him. He further demanded that Facebook would provide him with his personal data regarding his online behaviour collected before he consented to the processing in 2023, delete the data if it is processed exclusively for advertising purposes and restrict processing to purposes other than advertising, insofar as the data are necessary for platform use. First, the court held that the data subject had no claim against Facebook for n
ILVA (the controller) operates a chain of furniture stores and is part of the Lars Larsen Group (the undertaking). The total undertaking's turnover was multiple times higher than that of the controller. The controller is charged before the Danish courts with violating the GDPR in relation to the retention of the data of at least 350,000 former customers. On the recommendation of the Danish DPA, the Public Prosecutor’s Office sought the imposition of a fine of DKK1,500,000 (approximately 201,000€) on the controller. The calculation of that amount was based not only on the turnover of the controller, but also on the overall turnover of the undertaking. The Aarhus District Court (Retten i Aarhus) found that since the charges had been brought only against the controller, it was not necessary to take into account the turnover of the undertaking to determine the amount of the fine. Furthermore, the court noted that the controller was engaged in an independent retail activity and that it had not been set up by the parent company for the sole purpose of processing the undertaking's data. The Public Prosecutor’s Office appealed to the High Court of Western Denmark (Vestre Landsret), which decided to stay the proceedings and to request a preliminary ruling asking in essence, whether Article 83(4) to (6) GDPR, read in the light of Recital 150, must be interpreted as meaning that the term ‘undertaking’ in those provisions corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, with the result that, where a fine for infringement of the GDPR is imposed on a controller which is or forms part of an undertaking, the amount of the fine is to be determined on the basis of a percentage of the undertaking’s total worldwide annual turnover in the preceding business year. The AG emphasised that the notion of “undertaking” has been recently interpreted by the CJEU in C-807/21 Deutsche Wohnen. According to the CJEU, the undertaking should be understoo
A data subject filed a complaint with the Polish DPA (UODO) against a controller in May 2022. The DPA ordered the complaint to be supplemented by a description of alleged violations and expected actions to be taken by the DPA against the controller. In July 2022 the data subject filed another complaint, against another controller who allegedly unlawfully processed their data for marketing purposes. In November 2022 the DPA decided to join both proceedings initiated by the data subject. According to the DPA, the complaints referred to the same subject matter, namely unlawful phone number processing for marketing purposes. In April 2023, the DPA notified the parties that the examination proceedings were over, and the parties were entitled to present their position as to the collected evidence ([https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU19600300168/U/D19600168Lj.pdf Article 10(1) of the Code of Administrative Procedure - Kodeks postępowania administracyjnego]). In July 2023 the data subject issued a motion with the DPA to accelerate the proceedings. Afterwards, the data subject lodged a complaint against the DPA inactivity with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie - WSA Warszawie). In the meantime, in October 2023 the DPA issued a decision, closing the case at hand. The WSA Warsaw upheld the complaint. According to that court, Article 78(2) GDPR set forth a three-month term to examine the case. The DPA failed to do so. In particular, the court found the DPA took no action several times during the proceedings and that such an inactivity was not substantiated. The fact that the decision was eventually issued was irrelevant for the inactivity complaint. The DPA lodged a cassation appeal before the Supreme Administrative Court (Naczelny Sąd Administracyjny – NSA). The Supreme Administrative Court dismissed the cassation appeal. The court emphasised that the scope of inactivity covered situations when a DPA
The case concerns the transmission of a data subject's personal data by Barclays bank (the controller) to a credit rating agency (Schufa). The controller had wrongly notified Schufa about a financial claim of €4,405 existing against the data subject which in fact did not exist. After that, a different bank cancelled the data subject’s private overdraft facility forcing it to refinance €18,000 at short notice. The court of first instance had granted material damages for the additional interest the data subject had to pay for the refinancing credit, however the main subject of the appeal was non-material damages. The court found, that the controller had violated its obligations under Articles 5 and 6 GDPR by notifying Schufa about a claim that does not actually exist against the data subject. It also found, that in line with BGH, VI ZR 10/24 the notification constituted a loss of control which put the data subject into a bad light in itself constituting a non-material damage. Moreover, the court held, that the transmission inflicted an organisational burden by forcing the data subject to quickly refinance a substantial amount of money after the cancellation of the overdraft facility based on the negative entry and to pursue the clearing of such entry. The court found the amount of €2,500 appropriate to compensate those damages pursuant to Article 82 GDPR, taking account in particular the sensitive nature of wrong debt notifications. Those, the court held, could seriously damage the economic capacity of the data subject and forced the data subject to disclose its financial situation to new potential creditors.
Until 2019, personnel files for an unnamed federal institute in Hannover were managed by the employees of the State of Lower Saxony. An employee of the Institute (the data subject) objected to this practice several times and eventually filed a complaint with the DPA. Additionally, the data subject sued the Federal Republic of Germany. In her lawsuit, the data subject claimed that the processing of personal data by the employees of the State of Lower Saxony was unlawful and cause non-material damage. The Federal Republic conceded that the processing of personal data was unlawful but contested the claim for damages. The Regional Court and the Higher Regional Court both rejected the claim for damages. In particular, the Court of Appeal rejected the claim for two reasons. First, personal data was transmitted to State employees under an obligation of confidentiality. For this reason, the data subject did not lose control of their data. Second, the Court held that even if a loss of control had occurred in the case at hand, the mere loss of control over personal data did not, in itself, constitute a form if immaterial damage. The Federal Court of Justice reversed the Higher Regional Court’s findings on the damages. Throughout the ruling, the Court consistently referred to the case law of the EU Court of JusticeThe Court referred to numerous cases. See for instance: CJEU C-456/22, Gemeinde Ummendorf, 14 December 2023 (available [https://curia.europa.eu/juris/document/document.jsf?docid=280630&doclang=en here]): C-687/21, MediaMarktSaturn, 25 January 2024 (available [https://curia.europa.eu/juris/document/document.jsf?docid=282062&doclang=en here]). First, the Court held that the data subject lost control of their data due to the unlawful access of State employees. In this regard, the Court held that the fact that the State employees were under an obligation of confidentiality, did not exclude a loss of control. However, the Court held that these confidentiality obligation
The employer of a company suspected that his employee was pursuing private activities during working hours, using the company car for private purposes and not recording this as break time. The employer then hired a private detective to observe his employee on individual days. In November 2022, the detective observed him on five days and revealed multiple work violations. In particular, the employee took longer breaks at the bakery, went to private photo shoots or went to his girlfriend's place. As he worked as a ticket inspector, it was impossible for him to continue working during these periods. In order to definitively establish the suspicion, the detective was to observe the employee over a fixed period from 1 December 2022 to 16 December 2022. During this period, the employee was photographed, documented and a GPS was attached to his company car. The detective and the employer were able to establish that he had committed working time fraud totaling almost 26 hours. As a result, he was fired. The employee filed an action for protection against dismissal under national labor law, the employer counterclaimed the costs for the private detective. The court ruled that the observation of the employee by the detective was admissible under [https://www.gesetze-im-internet.de/englisch_bdsg/englisch_bdsg.html#p0222 Section 26(1) of the Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG)] and that in any case there was no prohibition on the use of evidence even if the observation was inadmissible. The second sentence of this provision reads: "Employees’ personal data may be processed to detect crimes only if there is a documented reason to believe the data subject has committed a crime while employed, the processing of such data is necessary to investigate the crime and is not outweighed by the data subject’s legitimate interest in not processing the data, and in particular the type and extent are not disproportionate to the reason." The court held, that th
The data subject is seeking compensation for a so-called scraping incident on the "F." platform operated by the controller. The scraping incident referred to the collection of personal data from the contact import tool by a third party. The controller does not rely on the data subject's valid consent in accordance with Article 6(1)(a) GDPR but claims that its specified setting of searchability to "all" is justified under Article 6(1)(b) GDPR because it was necessary to enable users to contact and network with each other. The data subject requested - inter alia - non-material damages and injunctions prohibiting further disclosure of personal data to third parties and processing of its phone number. For a more detailed account of the facts see BGH VI ZR 10/24. = The court found that by setting the default setting for the findability of a user profile based on the telephone number to "all", the controller violated its obligation under Article 5(1)(c) GDPR and 25(2) GDPR to take appropriate technical and organizational measures that ensure that personal data is not made accessible to an indefinite number of persons by default without the data subject's intervention. The court found that the default setting was not necessary under Article 6(1)(b) GDPR as it could be changed without significant impairment of the service's usability. In line with BGH VI ZR 10/24 the court found the loss of control following directly from the scraping incident in itself constituted compensable damage caused by the controller's GDPR violations, without it being necessary to prove additional noticeable negative consequences. The court positioned itself in an ongoing debate about the degree of control that the data subject had to have before a GDPR violation as for that to constitute a "loss" of control (cf. OLG Hamm - I-25 U 25/24). The court argued, that even if the data subject had previously disclosed its phone number to third parties and was unable to guarantee that it will always b
LinkedIn and associated companies placed cookies on users' devices without obtaining prior consent, violating a cease and desist order.
The data subject maintains a Facebook account. The controller (Meta) offers third-party companies so-called Meta Business Tools, to integrate them into their websites and/or apps to make it's ad-based business model more effective. If a third-party company integrates such tools data obtained from customer interactions ("events") is collected and forwarded to the controller (off-site data). This data is forwarded to the controller regardless of whether a person has a Facebook account. If the person in question is registered with a Facebook account, their off-site data is automatically linked to it's Facebook account, whereby the data subject can generally be recognised based on the digital fingerprint. The linking of the off-site data with the personal data resulting from Facebook use (on-site data) is used by the controller to personalise ads. By configuring their Facebook account settings, the respective data subject can refuse their consent to this link with the result that the off-site data is not used to display personalised advertising. However, the controller does not offer a configuration of the Facebook account that leads to the deletion of off-site data. The controller stores the off-site data transmitted to it, even if a Facebook user has not consented to its use for the display of personalised advertising. The data subject has not given his consent to the linking of off-site data with their Facebook account. The data subject visited the websites bild.de, PayPal.com, jameda.de, shop-apotheke.de, eventim.de, ikea.de, zalando.de and netflix.com which use Meta Business Tools. The data subject asserts that the controller unlawfully processed their data and demands - inter alia - the deletion or anonymisation of specific personal data and damages upon request and until that request to leave the personal data unchanged. The controller submits that the responsibility to obtain consent for the transfer of off-site data lies with the operator of the third-party
The controller purchases dental gold from dental practices. To do so, it collects the practice owner's first and last name, as well as the practice address and telephone number, from publicly accessible directories, such as the Yellow Pages. The controller uses the contact details stored in a database to contact the dental practices by telephone with the aim of determining whether the parties contacted are interested in selling precious metals to the controller. Following a dentist's report, the DPA ordered the controller to cease the collection, processing, and use of personal data of dental practice owners for the purpose of telephone advertising unless the data subject has given their consent or a business relationship with the data subject already exists. Furthermore, the DPA ordered the deletion of the data collected and stored for this purpose and instructed the controller to implement the ordered measures within two weeks of the order becoming final and to notify the DPA thereof. The controller applied to the DPA for annulment of the decision. As grounds, it essentially argued that her conduct was lawful under the GDPR, which had since entered into force, so that a new issuance of the order would not be possible. The DPA rejected the application, essentially stating that the legal situation had not changed in the controller's favor. The Administrative Court dismissed the controller's action seeking an order requiring the DPA to annul its decision. The Higher Administrative Court held that in the absence of consent under Article 6(1)(a) GDPR, the admissibility of the controller's data processing for direct marketing purposes now depends on the applicability of Article 6(1)(f) GDPR, which requires a comprehensive proportionality assessment and a balancing of the conflicting interests of the advertiser, on the one hand, and the recipient of the advertising, on the other. However, the requirements of Article 6(1)(f) GDPR are not met because the telephone adver
The data subject, a private individual, objected to the controller’s processing of their personal data. The controller, a commercial entity, had collected and processed the data subject’s personal data for marketing and profiling purposes. The data subject sent an email to the controller objecting to such a “processing or use” of his data to which the controller failed to respond The data subject claimed that the processing was unlawful and requested its cessation under Article 17(1)(d) GDPR. The data subject claimed that, when he receives messages of this nature, it gives rise to an uneasy feeling that personal data has been disclosed to unauthorized persons, precisely because the data was unlawfully used. The data subject had to deal with unwanted advertising and the origin of the data, creating a quite stressful impression of loss of control. Moreover, the controller initially did not respond after the infringement, which, from the data subject’s perspective, constituted yet another disregard of him. The controller argued that its processing was justified under Article 6(1)(f) GDPR as a legitimate interest. The lower courts had differing views on whether the processing met GDPR standards. The court stated, that a claim for non-material damages cannot be denied on the grounds that the harm does not exceed a certain severity threshold. However the court found, that the data subject did not sufficiently demonstrate that he suffered non-material damage at all. The court stated that the CJEU had clarified in several judgements that a mere infringement of the provisions of the GDPR is not sufficient to establish a claim for damages; rather, as an independent prerequisite, actual damage (caused by the infringement) must also be demonstrated by the data subject. The court elaborated that once the loss of control is established this itself constitutes the non-material damage, and there is no need for further distinct or additional concerns or anxieties on the
On the 27 May 2021 noyb filed a complaint against Clearview AI, here the controller, with the Austrian DPA (Datenschutzbehörde – DSB). Clearview AI is a company which provides a facial recognition platform allowing users to compare photos of people with images of them found online. noyb brought forward that the controller could not rely on a legal basis for the processing of personal data of the represented data subject. More importantly, noyb requested for the data processing activities of the controller to be banned by the DPA under Article 58(2)(f) GDPR. The DSB found that the controller had violated the GDPR (see DSB (Austria) - 2022-0.277.156). However, the DSB decided that the erasure of the personal data was an appropriate measure under Article 58 GDPR and that the additional prohibition therefore would not be necessary. noyb appealed the dismissal of the prohibition request to the Federal Administrative Court of Austria (Bundesverwaltungsgericht – BVwG). noyb’s argument noyb stated that the mere confirmation of a violation did not provide adequate legal protection from future unlawful data processing. noyb explained that even if the controller deleted the data subject’s personal information, it was likely that the controller would again process the data subject’s pictures as its business model is based on finding pictures of people online and processing them. Further, noyb argued that the data subject did have a subjective right to a prohibition on the processing as it was the only effective option available. The controller continuously scans the internet for pictures so if the data subject’s pictures were deleted it would only be a matter of time until they would be processed again. Additionally, a subjective right to an injunction was necessary as otherwise data subjects would have to bring a separate action for an injunction. This would put data subjects at a disadvantage particularly in regard to the cost of bringing such an action. noyb therefo
In late 2021, vaccination reminder letters were sent to uninsured persons over 18 residing in Austria who had not yet received a COVID-19 vaccine. The letters were issued in the name of various health institutions and officials, including the COVID-19 project manager and a chief physician. Numerous recipients filed complaints with the Austrian DPA, alleging unlawful access to their data stored in the central vaccination register. Following an official investigation, the DPA determined that the complainant was responsible for the data processing and had unlawfully accessed and used health data for the mailing campaign. The complainant contested this decision, arguing that it was not the data controller and that the access to vaccination data was justified under pandemic management regulations. The case was subsequently referred to the Federal Administrative Court. The Court ruled that the complainant was not the data controller within the meaning of Article 4 GDPR#7. It found that the ultimate decision-making authority regarding the purpose and means of the data processing lay with the city’s health department and the responsible city councillor, rather than the complainant. The complainant had merely executed the data processing based on political and administrative directives. The Court also held that the DPA had failed to correctly identify the data controller and had erroneously directed its decision against the complainant. Given the misleading nature of the vaccination reminder letters, which bore multiple institutional logos and signatures, the complainants could not reasonably determine the responsible party. The Court further emphasized that under Austrian procedural law, complainants are not necessarily required to specify the exact data controller when filing a complaint. As a result, the Court annulled the DPA’s decision without replacement, leaving the original complaint unresolved. The ruling clarified that the determination of the correct data contro
On 25 September 2018, the data subject signed a mobile phone contract with the controller (telecom provider), which allowed an early renewal with a new 24-month term at a lower rate. On 27 December 2018, the data subject renewed the contract under the early renewal option. The data subject later revoked the renewal, claiming withdrawal rights. The controller kept on billing the data subject for contract-related charges, which remained unpaid. On 16 September 2019, the controller reported the alleged unpaid debt to a credit rating agency (SCHUFA), although the debt was disputed and not legally confirmed, meaning that the disclosure should not have been made. Subsequently, on 27 September 2019, the controller requested SCHUFA to delete the entry of the disputed debt. However, the entry remained for nearly two years, negatively impacting the data subject's creditworthiness. As a result, the data subject was even denied a bank loan. The data subject sued the controller, claiming €6,000 in non-material damages under Article 82 GDPR for reputational harm. The Regional Court (Landgericht Koblenz - LG Koblenz) denied the GDPR-based damages, ruling in favor of the controller. On first appeal the Higher Regional Court (Oberlandesgericht Koblenz - OLG Koblenz) overturned the first ruling and awarded €500 in non-material damages for reputational harm referring to a punitive function of Article 82 GDPR. That court found that the controller violated Articles 5 and 6 GDPR by arranging the SCHUFA entry and that the data subject had suffered non-material damages as a consequence. In a further appeal by the controller disputed the amount of the non-material damages. The BGH held, that GDPR damages serve only a compensatory, not a punitive function. Thus it ruled that neither the gravity of the GDPR violation nor the question of fault can be taken into account when setting the amount of the damage. Therefore it found a legal error in the OLG Koblenz's decision, however th
During a trial involving a data subject their medical report was presented to the court. The data subject lodged a request to the DPA on 7 June 2023. The DPA closed their request in a decision of the 24 October 2023. The DPA noticed that he must not substitute the data subject in the first exercise of their rights with the controller. What’s more, the DPA declared itself incompetent to examine the relevance of the personal information involved regarding to the dispute. The 22 December 2023, the data subject lodged a complaint to the CE. The CE rendered its decision on 27 January 2025. By rejecting the data subject’s complaint, the CE confirms the legality of the DPA’s decision to close the request of the data subject. The CE notices that without a first exercise of the rights with the controller, the data subject’s request to the DPA has no object so the DPA is founded in closing the request. The CE also points out that an administration has the obligation to invite the data subject to regularize their request if it is defective in form or procedure or if incomplete ([https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367402 Article L.114-5] and [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367404 Article L.114-6 French Code of relations between public and administration]). As the absence of an object is not a formal or procedural defect, the DPA does not have an obligation to invite the data subject to regularize their request, as Articles [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367402 L.114-5] and [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367404 L.114-6 of the French Code of relations between public and administration] are not applicable. Additionally, the CE reminds that the legal ground of a processing can be the exercise or the defense of a right in a court of law. The CE underlines that this legal ground is an exception to the exercise of rights to erasure (Article 17 GDPR) and op
The data subject took a case against a telecommunications provider, here the controller, for unlawfully disclosing their data. The controller transmitted the following data to a credit rating agency, namely SCHUFA Holding AG: name, address, date of birth, start and end date of the contract, contract number and a SCHUFA ID. Upon the data subject’s request, SCHUFA informed him that information on the contract conclusion had been supplied to SCHUFA and that this information will be stored until the end of the contract. The data subject called on the controller to cease the data transfer and to pay damages, which the controller rejected. The data subject stated that he didn’t know that the controller would share this information and that this transfer brought upon him feelings of loss of control and worry. The data subject claimed for a minimum of €5,000 in damages and a declaration on claims regarding damages for future loss. The controller brought forward that with the formation of the contract, the data subject was supplied with an informational which included a notice on the transfer of data to SCHUFA. It therefore concluded that the data subject was informed about the transfer, which nevertheless was necessary for fraud prevention No legal basis The court found that the controller could not rely on any legal basis under Article 6(1) GDPR for the data transfer. The court rejected the argument that the processing could be based on the legitimate interest of fraud prevention. The court explained that prevention of fraud committed by the data subject cannot be a legitimate interest in this case as the contract has already been concluded. The controller therefore doesn’t directly benefit from transferring the data subject’s contract information but instead can benefit from an informed and detailed credit rating system in order to assess future customers to prevent fraud. The court highlighted that telecommunication providers, including the controller, have ceased
A customer (the data subject) filed a complaint against their telecom provider (the controller) after it failed to respond to their access request under Article 15 GDPR. The controller eventually responded to the request 14 months later, when the complaint was already pending. The Belgian DPA fined the controller €100,000 for violating Article 15 GDPR. The controller challenged the fine before the Belgian Court of Appeals. The Court reformed the DPAs decision and reduced the amount of the fine to €5,000. The Court found that the original €100,000 fine was disproportionate for a number of reasons: * the infraction was an isolated incident, affected a single data subject, and did not involve special categories of data; * the controller had no history of violating the GDPR; * the infraction caused no damage to the data subject but only mere inconvenience: * the infraction was not intentional; * the controller collaborated with the DPA during the investigation and implemented better procedures for handling access requests after the complaint was filed.