GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 21 October 2026 · Updated daily
Court case 8 U 2907/21
The controller is a private health insurance company. The data subject is insured with the controller. The parties are in dispute about the invalidity of several premium increases as well as about the resulting claims for refunds. The data subject filed a lawsuit with the Regional Court of Ansbach (Landgericht Ansbach - LG Ansbach) requesting the refund of overpaid premiums as well as information from the controller on all adjustments to premiums in the form of insurance policies, supplements to these policies and all notification letters sent to the data subject during the contractual relationship. The Higher Regional Court Nuremberg (Oberlandesgericht Nürnberg - OLG Nürnberg) held that the data subject had no right to access under Article 15 GDPR because the controller was entitled to reject the request pursuant to Article 12(5)(b) GDPR. The court reasoned that this provision merely lists "repetitive character" as an example of an excessive request. However, the use of the word "in particular" makes it clear that the provision also intends to cover other forms of abusive requests. To assess what constitutes an abuse of the right to access, the court referred to the purpose Article 15 GDPR which according to Recital 63 is to enable the data subject to be aware of, and verify, the lawfulness of the processing. The court ruled that the data subject was obviously not interested in verifying the lawfulness of the processing but rather to check whether the adjustments made to the premiums were formally compliant with German insurance law. As a consequence, the court concluded that the request was abusive.
Mag. (FH) XXXX
A data subject made an appeal to the Federal Administrative Court concerning a decision of the Austria Data Protection authority. The authority had dismissed the data subject`s complaint about a violation of the right to rectification as unfounded. The data subject had applied for the correction of data in a legal notice (Bescheid), which was in connection with investigative actions relating to the data subject's claims for compensation under the Police Powers Compensation Act (PolBEG). Referencing a decision of the Court of Justice of the European Union (ECJ) (ECLI:EU:C:2014:2081), the Austrian Federal Administrative Court stated that personal data legally assessed by the competent state agency in an administrative matter is not considered as information about the data subject. Consequently, the court held that a correction of personal data in a legal notice cannot be based on Article 16 GDPR.
Court case W245 2247035-1/8E and W245 2251274-1/6E
The data subject was a patient in a hospital department. The controller was the head of such department. The data subject was of the opinion that there had been medical negligence during the treatment. Consequently, the data subject sent the following access request to the controller. It was titled "Application for data information in accordance with DSG, GDPR and any other conceivable legal basis", and read: "I hereby submit the request for information in accordance with § 44 DSG and thus make use of my right to receive confirmation as to whether you process personal data concerning me and if this is the case, I make use of my right, To obtain information about the personal data concerned in accordance with § 44 DSG." Although § 44 DSG does grant data subjects a right to access, according to its chapter in the DSG, it only applies to the "Processing of personal data for the purposes of the security police, including the protection of the constitution, military self-defence, the investigation and prosecution of criminal offenses, the execution of sentences and the enforcement of measures". The controller objected to the request, arguing that they were not a controller pursuant to § 44 DSG. Subsequently, the data subject complaint to the Austrian DPA. In its assessment, the DPA stated that Article 15 GDPR, the appropriate right to access in the present case, does not require any specific formulation. The only requirement for the applicability of a right, according to the GDPR, is that the addressed controller can recognize which right the data subject wished to apply. If this was the case, a controller would be obliged to respond to an access request within the time limits set by Article 12(3) GDPR. This was objectively possible in the case at hand. It was clear from the request that the data subject wanted to rely on its right to access. Therefore, the controller should not have denied the data subject its right simply because the data subject mistakenly
Court case 13 U 206/20
The case involved a data breach where a message intended for a job applicant was sent to a third party, leading to a cease-and-desist order and damages.
T-Mobile
T-Mobile is the controller and the data subject a customer. In March 2021, a Dutch newspaper (NRC) published an article about the controller and the Central Bureau of Statistics (CBS), in which it was stated that the CBS conducted statistical research with large datasets, acquired from controller. The goal of this research was to look for solutions against urban congestion in large cities. The controller issued a press statement on its website on 11 March 2021, in which it stated that no personal data was shared since all data had been anonymised. On 12 March 2021, the subject requested access to the personal data the controller processed on him for the CBS’s research, pursuant to Article 15 GDPR. The controller, however, rejected the request since it claimed that it had not processed any of the data subject’s personal data. Since the data subject was convinced that the controller had to comply with his request, he brought the issue before court. The District Court Oost-Brabant managed the case. The Court partially upheld the claim. First, it considered that the controller did process personal data when providing datasets to the CBS, since the anonymisation of their customers’ location data, is processing personal data. Hence, the Court found that the controller had to comply with the data subject’s access request pursuant to Article 15. The Court stipulated that the controller had to indicate the exact nature and origin of the processed’ personal data, i.e., by providing GPS or customary coordinates, IMSI numbers etc. Although the controller claimed that it had deleted that data, it submitted no proof of this. Hence, the Court gave the controller the opportunity to “submit a statement by their Board”. The Court also required the controller to provide the essence of the joint-controllership arrangement with CBS pursuant to Article 26(2). Second, the Court found that it was competent to assess whether the controller should be ordered to comply with the obligations
Court case 6 C 7.20
The data subject was born in Turkey. His birth was first recorded in the civil status register in the district of Kayseri as 01 January 1956 and later corrected to 01 January 1958. When moving to Germany, which has been his country of residence ever since, in 1971, the data subject stated 01 January 1958 as his date of birth. This date was entered into the controller's register of residents. In 2015, his registered date of birth was changed to 01 January 1953 in Turkey after a decision of the District Court of Kayseri. Consequently, the data subject received a new Turkish passport stating this date of birth. When the data subject requested the controller to change his date of birth in its register accordingly, the controller refused due to a lack of certainty on his actual date of birth. The data subject pursued his request before the Administrative Court of Karlsruhe (Verwaltungsgericht Karlsruhe - VG Karlsruhe) where he was successful. The controller appealed against that decision and won before the Higher Administrative Court of Baden-Württemberg (Verwaltungsgerichtshof Baden-Württemberg - VGH Baden-Württemberg). Therefore, the data subject appealed the decision at the Federal Administrative Court. The Federal Administrative Court upheld the previous instance's decision, deciding that the data subject's request for rectification was unsuccessful. First, the Court agreed that the GDPR was applicable although the data subject's request had occurred before the GDPR's entry into force. Then, it confirmed the Administrative Court's application of Article 16 GDPR. The Administrative Court had correctly assumed that, while Article 16 GDPR was applicable, it could not be established that the data subject's birth date was indeed 01.01.1953. The Court confirmed that the right to rectification means the replacement of incorrect data with correct data. Consequently, there is no right to rectification if it cannot be established which data are correct. The Court disagreed with the Higher Administrative Court on the applicable law regarding the burden of proof but still came to the same conclusion that the data subject had to prove his actual date of birth. While the Administrative Court had applied national law of evidence, the Court clarified that Article 5(2) GDPR postulates a specific law of evidence based on the principle of accountability, making national law inapplicable. According to the Court, the burden of proof is generally upon the controller in the context of Article 16 GDPR because the controller has to prove that the data it holds are correct. However, this means in turn, that the controller cannot be required to enter and further process data whose accuracy cannot be established with sufficient certainty. In such a case, the controller would be in violation of Article 5(1)(d), (2) GDPR, which cannot be asked of him. Therefore, the the burden of proof regarding the accuracy of the data designated to replace the currently processed data lies on the data subject. Since the data subject could not prove his actual date of birth, the Court decided in favour of the controller.
Google LLC
Controller Google and data subject is a plastic surgeon who had been conditionally suspended in 2016 for a lack of aftercare after an operation. Because Google then displayed search results that linked to articles about the data subject and their conditional suspension, the data subject requested Google to delete the search results pursuant to Article 17 GDPR. After Google rejected this request, the data subject brought the issue before Court, which upheld data subject’s claim. After Google appealed to this judgement, however, the Court of Appeal annulled the Court of First Instance’s judgement. According to the Court of Appeal, the right to freedom of expression and freedom of information of Google and of third parties, namely information providers and the general public, outweighed the right to privacy and personal data protection of the data subject. The data subject, however, argued that their request must be assessed on the basis of Article 10 GDPR. Moreover, the data subject also stated that they were wrongly ordered to pay the costs of the proceedings in both instances. According to the data subject, it follows from Article 47 of the Charter of Fundamental Rights and Article 79 GDPR, that they should not be ordered to pay those costs if their challenge is unsuccessful. Hence, the data subject then appealed in cassation to the Supreme Court of the Netherlands. The Supreme Court rejected the appeal. First, it considered the data subject’s argument that their request should have been assessed on the basis of Article 10 GDPR. The Supreme Court found that it was irrelevant to discuss whether the Court of Appeal should have done this. According to the Supreme Court, the Court of Appeal already assessed whether it was strictly necessary to process the sensitive data pursuant to Article 10 GDPR. Now, the Court of Appeal decided that this was the case, to protect the right to information and freedom of expression. Hence, the Supreme Court considered that the Court o
Court case 18 O 204/21
The controller is a private health insurance company. The data subject is a customer of the controller. The parties are in dispute about the validity of several increases to the insurance premiums. The data subject requested refund of overpaid premiums as well as information on all adjustments to the premiums in the form of notification letters sent to the data subject and supplements to the insurance policy to verify the lawfulness of the increases. The controller rejected both claims. Consequently, the data subject filed a lawsuit against the controller with the Regional Court of Essen (Landgericht Essen - LG Essen). The Regional Court of Essen rejected the data subject's claim entirely. Regarding the notification letters, the court concluded that the data subject has no right to access under Article 15 GDPR , because the notification letters are standardised letters sent to every policy holder and, therefore, not personal data under Article 4(1) GDPR. Moreover the court found that the controller can refuse to act on the request according to Article 12(5)(b) GDPR, because the request is excessive. The court held that the "repetitive character" of a request is just an example under Article 12(5) GDPR and that an access request can also be considered excessive if the request does not serve the purpose of verifying the lawfulness of the processing as stated in Recital 63. The court then established that the data subject's request does not serve this purpose but solely aims at verifying the validity of the premium increases.
Tenant
The controller is the landlord, the data subject the tenant of a flat, which is located in a multi-party building. In 2019, the controller informed the data subject that they wanted to carry out an inspection of the data subject's flat due to complaints about strong odours and vermin in the stairwell. After finding the flat in a state of disrepair, the controller asked the data subject to clean and clear it out. They complied immediately. They then wanted to know which of their flatmates had complained about them. After the complaints were revised on the occasion of the cleaning, the controller suggested to let the matter rest. By means of the lawsuit, the data subject, on the basis of Article 15(1) GDPR, requested information on the personal data processed by the controller concerning them, including information about which of their flatmates had complained about them, as well as the payment of damages for pain and suffering, and the reimbursement of pre-litigation legal costs. The data subject failed with their request both at the Regional Court of Ravensburg (LG Ravensburg) and the Higher Regional Court of Stuttgart (OLG Stuttgart). According to both courts' reasoning, the controller would be acting contrary to the interests of the informant under data protection law if the name of the informant was disclosed. The German Federal Court of Justice (Bundesgerichtshof – BGH) held that the data controller may be obligated to provide information to the data subject pursuant to Article 15(1)(g) GDPR, depending on whether the information about them was accurate, and referred the case back to the OLG Stuttgart. The BGH explained that the claim of the data subject would only not exist if the informant's interest in not having their data disclosed or the interests of the controller outweighed the data subject's right to information. It emphasised that due regard must be paid to both the data subject's and the informant's fundamental rights pursuant to Articles 7(1) and
This case is an appeal of a decision by the Norwegian DPA, in which they instructed Google to delete one search result, but denied the data subject's erasure request for the two other search results. The Privacy Appeals Board agreed with the DPA in that Article 6(1)(f) legitimate interest is the correct lawful basis and, in particular, their reasoning around the processing of personal data subject to Article 10 GDPR. Pursuant to Article 6(1)(f) GDPR, the Privacy Appeals Board conducted a balancing test, in which they weighed the interests of the controller and the data subject. When balancing these interests, the Board found several matters to support the data subject's erasure request. First, when a data subject actively requests erasure, cf. Article 21(1) GDPR, their interest should by default outweigh the search engine's interests. This is reinforced when Article 10 GDPR personal data is involved. Second, as the data subject was sentenced in 2011 and had served their prison time by 2016, the search results relate to old matters. Third, the personal data should be correct and up to date, cf. Article 5(1)(d), cf. the Article 29 Group's criteria number 4 and 7 in their [https://ec.europa.eu/newsroom/article29/items/667236/en WP225 guidelines]. The 2011 ruling included a ban on the right to run a business, however in 2019 a court removed this ban so that the data subject could become a general manager in the company where they had worked as a project coordinator and project leader for several years. This is the same company where they were currently working and which was planning to go public. One of the news articles where the search results were leading to, gave an imprecise description of this situation. The Board also pointed out that it is relevant whether a person is of public interest and found that the data subject is not, even though they have a leading role in a company due to go public. Finally, the Board emphasised the data subject's personal burden relating to the search results. On the other hand, the Board found there were several matters that supported the rejection of the erasure request. First, the information was of public interest, especially due to the serious nature of the data subject's crimes. Second, the information was published due to journalistic interests and its news value. Third, the information related to their work life and not their personal life. Due to the many conflicting factors in their legitimate interest assessment, the Board found the weighing of interests challenging and, as a result, four members found that there were sufficient reasons to deny the erasure request, whereas two members disagreed. As the majority decides, the Board held that the DPA's decision to not instruct deletion of two search results, was upheld.
Jameda
The controller operates a doctor search and rating platform under www.jameda.de. It posts the basic data of physicians as well as a grey silhouette as a profile picture with the notice "Only jameda customers can post a profile picture" on the portal without their consent. Users can submit ratings in the form of grades and free text comments. The controller offers doctors a paid "premium package" with which they can add a photo and additional information to their profile and with which the defendant contributes to better findability on Google. In early 2018, the data subject who is an eye specialist learned that a negative review had been posted about her on the controller's website. She was rated there as "arrogant, unfriendly, unprofessional". The data subject asked for this evaluation to be deleted and for the author to be informed. The controller refused, as well as to the deletion of the data subject's basic data. In her lawsuit, the data subject demanded the deletion of her basic data from the controller's portal. While that was successful in the first instance, the Higher Regional Court dismissed the action on appeal by the controller. The German Federal Court of Justice (Bundesgerichtshof - BGH) dismissed the data subject's appeal. The court found that the requirements of the right to erasure pursuant to Article 17(1) GDPR were not fulfilled. First, the processing was not unlawful pursuant to Article 17(1)(d) GDPR. As the processing was based on Article 6(1)(f) GDPR, the legitimate interests and fundamental rights of the data subject did not outweigh the interests of the controller. On the data subject's side, the court weighed her right to the protection of her personal data pursuant to Article 8 CFR, the not inconsiderable risks to her claim to social and professional standing (Article 7 CFR) as well as the economic success of her self-employed activity (Article 16 CFR). The court considered that the evaluations could directly affect competition with other doctors and, in the case of negative evaluations, even jeopardise the professional existence of the person evaluated. The broad impact of the controller's rating portal and the possibility of abuse by false or insulting ratings was also considered. On the other side, according to the court, the controller exercised both its own legitimate interests and the legitimate interests of the users of its platform by processing the personal data of the data subject on the platform: it acted both pursuant to its freedom to conduct a business (Article 16 CFR) and to the users' right to freedom of information (Article 11 CFR). The court emphasised the considerable interest that the public has in the information and possibilities offered on the controller's portal which can contribute to providing patients with the information they need when exercising their choice of doctor. It could fulfil this purpose only to a limited extent if it were dependent on the consent of the rated doctors, which could be withdrawn - for example in the case of a weaker rating. The court concluded that a self-employed person must be prepared for observation of their conduct by the wider public because of the effects their activity has on others, and for criticism of their performance. Furthermore, the data subject is not defenceless. She can counter untrue factual claims and insulting or otherwise inadmissible evaluations by contacting the controller and demanding the removal of the content. Second, the court held that the requirements of Article 17(1)(c) GDPR were also not fulfilled since there were overriding legitimate reasons within the meaning of Article 17(1)(c) GDPR for the processing of the data subject's personal data. The overall weighing that is also required in this respect did not lead to a different result than the weighing carried out under Article 6(1)(f) GDPR.
Redacted
This case is an appeal of the decision 20/01648 by the Norwegian DPA (Datatilsynet), in which it imposed a fine of NOK 100,000 (approx. €10,000). The defendant asked for the fine to be overturned or reduced significantly, due to the company's "critical financial state". The Privacy Appeals Board assessed if a fine could be imposed as per Article 83(5) GDPR, cf. Article 83(2) GDPR, and in which case, how large it should be. The Board agreed with the DPA that the installation of the camera was not discussed with the employees in advance, as claimed by the defendant, since there were no evidence of such discussions. The Board noted that continuously surveilling a workplace is very intrusive for the employees, and also for the customers since there were no proper signage or information about the surveillance, and finds this to be a serious violation of the GDPR. The Board agreed with the DPA in that the defendant's actions are serious and criticizable, deserving of a sanction and which justified the level of the fine. This was further substantiated by the lack of technical and organisational measures for GDPR compliance in the company.
Mrs. B
The Austrian DPA decided that the data controller specialising in credit assessments (C. Ges.m.b.H.) had to disclose meaningful information about the logic involved in the automated decision-making process concerning the data subject's data on the issue of her creditworthiness despite the algorithm being protected by trade secrets. This decision was then appealed by the data controller to the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). Reportedly, such algorithms may be protected under Article 2(1) Directive 2016/943. The right to access personal information in an automated decision under Article 15(1)(h) GDPR is given additional meaning in enabling the data subject to contest such a decision under Article 22(3) GDPR. Thus, the Federal Administrative Court upheld that the data controller had infringed the data subject’s right to access her data related to an automated decision since the controller did not provide meaningful information on the logic involved in the decision under Article 15(1)(h) GDPR. However, after the ruling, the data controller did not provide further information. Hence, the data subject made an application for enforcement to the enforcement authority, the Vienna City Council, which did not fulfil its obligation and used a power it was not entitled to, as it found that the controller had already sufficiently fulfilled its obligation to provide information, despite the controller not providing any further information. According to Austrian law, since the data controller's complaint against the decision of the executing authority was admissible, and the executing authority did not fulfil its obligation, the administrative courts of first instance must, therefore, take a decision in the present proceedings instead of the executing authority. In light of this, the Regional Administrative Court Vienna (Verwaltungsgericht Wien - VGW) attempted to answer the question of whether a data controller can refuse to provide the data subject with meaningful information related to the use of algorithms for automated decision-making under Article 15(1)(h) GDPR where (parts of) such algorithms are protected by trade secrets. The VGW maintains that the rights under Article 15(1)(h) GDPR and Article 22(3) GDPR must enable the data subject to question the validity of the information received, as well as assess whether it corresponds with profiling on them. However, it identifies a tension where the information requested by a data subject and required for their understanding of an automated decision stems from an algorithm protected under EU trade secrets law. The VGW suggests the possibility of alleviating this tension by disclosing the information concerned only to the relevant authority or court and letting them determine whether a trade secret under Article 2(1) Directive 2016/943 is present as well as whether the data corresponds to information required to be provided under Article 15(1) GDPR. The VGW holds that refusing to provide such information could constitute a violation of Article 47 CFR and can therefore only be narrowly justified, whilst maintaining that there is insufficient existing EU law and guidance to provide a clear answer on this matter. Thus, the central question it poses to the CJEU for a preliminary ruling is whether information on the functioning of the profiling must be disclosed to the data subject where such information is protected by trade secrets.
Court case 31 O 714/21
The data subject is the shareholder of two companies that were part of a German airline (hereinafter “companies”). The controller is the insolvency administrator of these companies. The accounting of the companies was done by an accounting department, respectively by an external service provider. A German Local Court ordered the seizure of the business records, in particular the accounting records. Afterwards, the controller continued to provide the data subject with access to the accounting systems. The parties dispute whether full access was granted in the process. The data subject requests that the controller shall be obliged to set up full data access by means of an interim injunction. The data subject bases the claim, inter alia, on Article 15 GDPR. The controller requests that the application for an interim injunction shall be dismissed. The court ruled that a right to access pursuant to Article 15 GDPR likely did not exist in this case. Subsequently, it did not find the urgency necessary for an interim injunction. The court did not share the data subject's view that data created or received under their management would in any case be personal data concerning them, irrespective of the detailed content. In any case, however, this did not result in any particular urgency in the sense of a ground for injunction. According to the court, there is no legal principle that the assertion of the right to information under data protection law would always be urgent or that the claimant should not be referred to assertion in the main proceedings.
Municipal administration association for water supply
A water meter with a radio module is installed at the claimant's home (data subject) by a municipal water supplier (defendant, controller). The data subject believes that the installation of the radio water meter violates their fundamental right to data protection, as the device allows conclusions to be drawn about individual water use, which constitutes personal data. At their request, the controller switched off the radio module, for which the controller imposed the costs on them in the form of an administrative fee notice. The data subject appealed the fee notice. The Administrative Court of Cottbus (VG Cottbus) held that the installation of a water meter with a radio module may already be considered data processing (Article 4(2) GDPR). Although the installation does not yet directly process data in the sense of storage, a necessary preparation, which is undoubtedly only aimed at enabling data processing, is also subject to Article 4(2) GDPR. In the present case, the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller Article 6(1)(e) GDPR. The municipal water supplier's by-laws explicitly state that it collects data on consumption via measuring equipment and that this is done using a water meter and its readout. Article 12(5) GDPR in conjunction with Article 18(1)(d) GDPR does not prevent the charging of an administrative fee for the deactivation of the radio module of the water meter if the interests of the controller outweigh those of the data subject and the customer only objects in principle to the collection of data and does not invoke any grounds under Article Article 21(1) GDPR arising from their particular situation. The mere concern for one's own data protection and fear of "forced digitisation" are only general or principled interests, but not particular or individual, so that Article 21(1) GDPR does not apply.
DSB
The controller is a municipality. The data subject owns property in the controller’s district. The data subject won a lawsuit against the controller, obliging it to connect the data subject’s property to the municipal drinking water supply. The judgement was limited to the supply needed for a single-family home. The controller complied with the judgement and connected the data subject’s property to its water supply system. It also installed an analogous water meter (not a smart meter) at the beginning of the water pipe to measure the consumption of the data subject’s property. The water meter is checked once a year by the municipality. The results are stored in the municipality’s software application which is hosted in an Austrian datacenter. The data is retained for thirty years to exercise or defend against possible legal claims. Moreover, because multiple times in the past the data subject used vast amounts of water, exceeding the need of a single-family home by far, the municipality installed a system that measured the daily consumption of the data subject. At the beginning, the system worked as follows: An incremental encoder was installed on top of the water meter. This incremental encoder sent digital signals to a programmable logic controller (PLC) at the water supply facility of the controller every time water was used by the data subject. The programmable logic controller counted the signals and if the usage of the data subject exceeded the threshold of 950 liters per day, the PLC closed the solenoid valve of the pipe, cutting of the water supply to the data subject's property. The counter was automatically reset each day to zero. After five months the controller switched to a system where the water supply was not automatically shut off by the PLC but an employee was notified to check whether the alarm was accurate and, if yes, to shut off the water supply manually. After the data subject learned about this conduct of the controller, she asked the contro
Bank
In 2019, the data subject, a bank, received a letter from the controller, the tax authority, informing it of a number of investigation results and announcing that the data subject would have to pay the taxes in the cases discovered by the investigation. Furthermore, the letter contained tax summary reports on the change of the data subject's capital gains tax filings in tax matters of various investment funds. Subsequently, the data subject applied to the controller for the right to be heard and to inspect and access the files, based on the German Fiscal Code (Abgabenordnung - AO) and Article 15 GDPR. The controller refused, arguing that the data subject already had knowledge of the files on capital gains tax and that all other documents listed were part of investigation files in criminal tax proceedings conducted by public prosecutor's office. Regarding the investigation files, the controller questioned whether Article 15 GDPR was even applicable. It stated that the data subject might be able to substantially complicate investigations if given access. The data subject argued that it did not have full knowledge of the data processed. It claimed that when balancing the parties' interests, its own would outweigh the controller's. The Financial Court of Munich (FG München) had to decide whether the data subject had a claim under Article 15 GDPR, what was the scope of the data subject's claim and whether the claim was satisfied by granting access to individual documents or providing copies. The FG München dismissed the claim. It held that, while the data subject generally would have a right to access pursuant to Article 15(1) GDPR, that did not encompass the data in question. First, the court established that the GDPR applies to the bank as a data subject since § 2a(5) AO orders the corresponding application of the GDPR to entities with or without legal capacity such as the data subject in this case. Then, the court clarified that there is no general right to inspe
Yards Deurwaardersdiensten B.V
The Dutch financial regulator, Bureau Financieel Toezicht (BFT), provided a journalist with a copy of a decision and an accompanied letter. The decision and letter had been issued by the Chamber of Bailiffs (kamer voor gerechtsdeurwaarders) in a disciplinary proceeding against a company. The BFT provided the journalist with the documents without anonymizing them. The company and two individuals (the plaintiffs) complained that this was a data breach under the GDPR. The plaintiffs demanded that it should be reported to the Dutch DPA Autoriteit Persoonsgegevens (AP). In December 2019, the BFT informed the plaintiffs that there was no need to report the incident as a data breach under the GDPR. The plaintiffs complained. In January 2020, the BFT ruled that the complaint was inadmissible, meaning that the plaintiffs didn't have the right to have the action reviewed by a court. The plaintiffs appealed the BFTs decision to declare the complaint inadmissible. In June 2020, the District Court of Midden-Nederland ruled on the appeal. The District Court reversed the BFT's January 2020 decision and ordered the BFT to issue a new decision on the objection. In addition, the District Court ruled that, as an administrative court, it didn't have jurisdiction to decide on compensation issues. The applicants appealed the District Court's decision to the Supreme Administrative Court (Raad van State). BFT filed an incidential appeal, which is an appeal filed after an opposing party has already filed an appeal. The Supreme Administrative Court held a hearing in October 2021. At the hearing, it became clear that the plaintiffs and BFT now agree that it was wrong to disclose the documents to the journalist without anonymizing them. The Supreme Administrative Court now had to answer three questions: 1) Were there any legal remedies against the BFT's decision? 2) Does an administrative court have jurisdiction to decide on applications for compensation? 3) Should the request for compensation be granted? = First, the Supreme Administrative Court examined whether the GDPR gives the company any rights on which to base its claims. The court examined the definition of personal data in Article 4(1) and Recital 14. The Supreme Administrative Court found that the GDPR only applies to natural persons and that the company, as a legal person, cannot assert any rights for data subjects. However, since the two plaintiffs were natural persons with rights as data subjects, this didn't affect the admissibility of the case. = First, the Supreme Administrative Court addressed BFT's claim that the decision was inadmissible because it wasn't a decision within the meaning of Section 1(3) of the Dutch General Administrative Act (Awb). The court held that under Article 34 of the Dutch GDPR implementation act (UAVG), the BFT's measure can only be considered an administrative decision that can be challenged in court if it's a decision concerning a data subject exercising his or her rights under Article 15 GDPR - Article 22 GDPR. The court also recalled that it's important to distinguish between the data subject's right to object to data processing under Article 21 GDPR and the citizen's right to object to an administrative decision under Article 6(4)(1) Awb. It then concluded that the BFT measures cannot be considered as an administrative decision on the exercise of the data subject's rights. The court then considered whether the BFT's actions constituted an administrative decision under other laws. It considered whether it could be an administrative decision under the Dutch Freedom of Information Act, Wet openbaarheid van bestuur (Wob). The court ruled that the action couldn't be considered a disclosure under the Wob. The journalist had never filed a formal freedom of information request. The court also found that it wasn't a publication on the initiative of the BFT, since the journalist had stated that they didn't want to publish the decision itself, but only to use the information in an article. The court then considered whether BFT had violated the Trade Secrets Act (Wet bescherming bedrijfsgeheimen). The Supreme Court ruled that this law only protects the company from lawsuits filed by its competitors, not actions that are based on administrative law. The Supreme Administrative Court ruled that BFT's decision not to report the incident as a data breach wasn't an administrative decision that could be challenged in court. The Supreme Court reversed the district court's decision. = The Supreme Administrative Court referred to previous case law and concluded that the administrative courts have jurisdiction to decide on compensation claims. The Supreme Administrative Court recalled that according to Article 8(88) Awb, the administrative courts may decide on compensation claims below €25,000. As long as the claim is below this amount, the claimant/plaintiff can choose whether to bring the case before a civil court or an administrative court. In this case, the plaintiffs estimated their damages at more than €25,000. However, they'd limited the amount of compensation they sought in court to €25,000 per person. The Supreme Administrative Court found that it was wrong for the district court to add up the plaintiffs' claims and conclude that the upper limit had been exceeded. For this reason, the Supreme Administrative Court ruled that the district court had jurisdiction to decide the issue of compensation. The Supreme Administrative Court also clarified that it's not necessary for a data subject to have exercised any of his/her rights before he/she can claim damages in court under Article 82 GDPR. = The Supreme Administrative Court found that the claimants hadn't sufficiently demonstrated the psychological injury they'd suffered as a result of the disclosure. For example, the claimants hadn't made it plausible to the administrative court that the costs were caused by the unlawful processing of their names when the documents were handed over to the journalist without anonymization. The Supreme Administrative Court also weighed that the judgment of the court case to which the documents belonged was public. Therefore, only the names of the applicants and their company had been wrongfully disclosed to the journalist. BTF had also asked the journalist not to publish the names, and they were never mentioned in the published article. Therefore, the Supreme Administrative Court rejected the request for compensation.
Autoriteit Persoonsgegevens
On 20 December 2018, the data requested access to his personal data from his previous employer, the Minister of Finance. On 5 February 2019, he filed a complaint with the Dutch DPA (Autoriteit Persoonsgegevens) to take enforcement action against the Minister, because the Minister did not timely and fully comply with his access request. At the same time, he filed administrative appeal against the Minister’s failure to make a timely decision, and brought the issue before Court. On 9 April 2019, the Court acknowledged his claim and ordered the Minister to comply with the access request, which the Minister did on 1 May 2019. On 8 January 2021, the DPA rejected the data subject’s complaint for enforcement against the Minister, for two reasons. First, because the Court had already ruled that the decision had not been made within due time, the DPA would not have to rule anymore whether or not the decision had been made timely. Second, regarding the question whether or not the request had been fully complied with, the DPA considered that this would require further investigation. However, the alleged infringement was not considered to be harmful enough, according to the DPA’s own "Policy Rules on Prioritising AP Complaints Investigation", and therefore did not handle the complaint. According to the data subject, the Court’s judgement proves that the Minister violated the GDPR and the DPA therefore had to take enforcement action. Hence, he appealed to the DPA’s rejection of his complaint, before Court and claimed that the DPA should issue a fine against the Minister. Moreover, he requested to be compensated for immaterial damages. The District Court Amsterdam rejected the claim. First, it considered that the DPA has limited resources and receives tens of thousands complaints every year. Hence, the DPA has to consider which complaints they handle, and which complaints have a higher priority to be dealt with. The Court found that it follows from Article 57(1)(f) GDPR that the DPA has this margin to decide whether or not a complaint must be dealt with. The Court also acknowledged the DPA’s argument that this case was not that important in terms of societal impact. The Court therefore rejected the data subject’s claim.
unknown teacher (claimant)
In 2019, the first defendant (the "developer") developed an app for students to rate school teachers (the "app"). In December 2019 the developer founded the second defendant (the "platform"), a limited liability company, and offered the app for download using the platform. In early 2020, the Austrian Data Protection Authority conducted an ex officio investigation into the platform's data protection conduct. This investigation was later ceased without a formal decision. The claimant was a school teacher whose name and school could be seen in the app, making him subject to ratings by users of the app. They argued that the data processing on the app violated their rights to data protection. They never consented to be subject to ratings on the app and argued that there was also no other legal basis under Article 6(1) GDPR that the app could rely on to make the data processing lawful. They further argued that the app didn't provide sufficient safeguards to prevent people other than their students to rate them. In their lawsuit, the teacher demanded the first instance court, Landesgericht Wien (LG Wien), to disallow the possible future processing of his personal data by the defendants and to order the defendants to erase the data relating to the teacher under Article 17 GDPR. The LG Wien dismissed the lawsuit, holding in essence that the legitimate interests to provide ratings on the teacher outweighed their interests under Article 6(1)(f) GDPR. Hence the court considered the processing to be lawful. The teacher filed an appeal. The second instance court, Oberlandesgericht Wien (OLG Wien), upheld the lawsuit and ordered the developer and the platform to stop the processing until it was ensured that only actual students of the teacher could rate them. It argued that, as the app offered no safeguards against unjustified ratings by random strangers, the teacher's interest under Article 6(1)(f) overrode that of the developer and the platform and the data were to be deleted un