GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
candidate for election to the defendant's chamber (chamber of dentists)
The applicant in question is a candidate for election to the defendant's chamber (chamber of dentists) meeting in 2020. The order from the High Administrative Court was directed against the order of the Verwaltungsgericht Stade (Administrative Court Stade), which had ordered the defendant to provide the applicant without delay with the surnames, first names and postal address of the applicant's constituency in question for the purposes of election advertising. As the postal addresses that the members of the Chamber had deposited with the defendant for the purpose of postal correspondence were to be transmitted, the defendant directed its complaint precisely against this. In the present case, the Court had to assess whether the applicant was entitled to a claim of injunction for the transmission of the data in question. The Court found that the applicant was not entitled to receive the surnames, first names and postal addresses of the members of the Chamber eligible to vote for his constituency from the electoral roll. Neither the relevant electoral regulations nor the principles of free and equal suffrage allow such a claim to be derived. Moreover, there is no other norm of entitlement in the context of which the applicant's interest in the promotion of his election advertising could be affected. The latter applies in particular to the data protection provisions governing the transfer of personal data by the defendant. These are not intended, according to the court, to serve the interests of the claimant, not even in the sense of a claim for error-free exercise of discretion. The regulations legitimise encroachments on the right to informational self-determination and are intended to provide the public administration with a legal basis for data processing activities and to grant the data subjects subjective rights of defence. The function as a legal basis includes cases in which the public administration decides to satisfy a legitimate interest in informati
STICHTING ALBERT SCHWEITZER Hospital
In the context of a claim for damages after a surgery at the hospital, the patient refused to sign a document drafted by the insurer of the hospital according to which (s)he would agree to the communication of his/her personal data. The insurance company argued that such communication was necessary for the analysis of the liability of the hospital before any litigation. The Court had to assess whether there was a legal ground under the GDPR to make the communication of the medical data to the insurance company of the hospital compliant with Article 9 GDPR. The court considered that the exception under article 9.2 (f) GDPR could not justify the communication of medical data to the insurer. Indeed, the insurance company did not need the data for ‘the establishment, exercise or defense of a legal claim’ since both parties were only at the negotiation stage. The fact that the hospital chose its insurer as a third party to assess the liability of the hospital cannot also be a ground for such communication. Nor can article 6 ECHR apply to this situation since this article refers to the judicial procedure and does not provide any guarantees for the extrajudicial process.
College van burgemeester en wethouders van Harderwijk
The Dutch Council of State ruled on a claim for damages filed by a citizen whose data (name, address and residence) were processed on a forum accessed by the local authorities. This Internet forum was intended to exchange data between municipalities to prevent abuse of the Public Administration Act. The applicant involved, who filed several request to access documents, had not given his/her consent to the processing of her/his personal data on the forum and received information on the processing of these data only at a late stage of the procedure. The Council of State had to determine whether the processing of information on the internet forum access by the local authorities had a legal ground under Article 6 of the GDPR, and whether the lack of information before such processing was in line with the transparency obligations of the controller (the municipal executive of Harderwijk). The Council of State also had to rule as to whether it is competent to grant a compensation for the damage suffered by the individual and under which circumstances. The Council of State ruled that the mention the name of the applicants on the internet forum at the request of another municipality (to ensure the proper implementation of the access to document legislation and to prevent abuse of such legislation) was legitimate and allowed under Article 6 (1) (e) of the GDPR. However, the Council of State (CoS) rules that the municipality did not inform the data subject in good time, which is a violation of the GDPR. As to the claim for damages, the CoS notes that though Article 82(1) of the GDPR states that full compensation for actual non-material damage resulting from breaches of the GDPR must take place in a manner that does justice to the objectives of the Regulation, the GDPR does not specify how the non-material damage is to be determined and calculated. However, the Court of Justice has consistently held that the damage to be compensated must be real and certain.
Court case 12 Sa 186/19
The defendant offers a medical service, in which - as in the case of the plaintiff - social data in the form of health data can be processed on the basis of the request from his/her health insurance company. Since the plaintiff´s colleagues and the plaintiff are working for the IT department, his colleagues received knowledge of the plaintiff´s health data. Whether the defendant has taken appropriate and specific measures in accordance with the German Federal Data Protection Law and Art. 9 GDPR to protect health data from unauthorized access from employees. The court emphasized that the physical examination of an employee represents a significantly more serious intervention in the personality sphere of the employee than an assessment based on the file. This differentiation meets the requirements of Section 22 (2) of the German Federal Data Protection Law (“BDSG”). In the context of Art. 9 Para. 2, 3 GDPR in conjunction with Section 22 Para. 2 BDSG, there are appropriate and specific measures required. One is that only professional personnel who are subject to professional secrecy may process the health data. This is the case here due to medical and social secrecy. This is not sufficient within the meaning of Section 22 (2) BDSG, but this must be included in the assessment, whether the defendant has taken appropriate and specific measures. The access within the defendant is restricted through technical and organizational measures (Section 22 (2) No. 5 BDSG). The personal data is only accessible to people who need it to perform their tasks. The access rights are determined by assigning rights and roles related to the occupational groups. The access authorization is again divided according to the occupational group-specific role for the 36 employees of the area the plaintiff is belonging to. The court decided that the IT department is uniform and indisputable for the responsibility for the entire protected area. Further protection is granted since the access and processing history of data is logged with the information who and what action is performed on the personal data. The defendant made it further clear by internal guidelines to its employees that he/she should not simply access the plaintiff’s health data outside of the remit. The court decided that this must also have been clear for the IT department. The measures in total were sufficiently to convince the court that appropriate technical and organisational measures were taken to protect the data from the plaintiff.
Court case 11 ZB 19.991
In September 2018, a traffic offence was committed with the vehicle registered to the applicant. A witness questionnaire sent to him remained unanswered, and during a telephone interview in November 2019, the plaintiff stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons. In a later hearing, the plaintiff informed the police that an electronic driver's logbook existed, but that the consent of the data subject had to be obtained in each case for the data to be passed on, even in administrative offence proceedings. With regards to former employees, this proved to be difficult. The District Office of Freyung-Grafenau then obliged him by notice to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after expiry of the period for which it must be kept. The plaintiff challenged this decision before the Regensburg Administrative Court, but the challenge was unsuccessful because the court was of the opinion that the decision did not violate the GDPR and was also not disproportionate. In September 2018, a traffic offence was committed with the vehicle registered to the applicant. A witness questionnaire sent to him remained unanswered, and during a telephone interview in November 2019, the plaintiff stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons. In a later hearing, the plaintiff informed the police that an electronic driver's logbook existed, but that the consent of the data subject had to be obtained in each case for the data to be passed on, even in administrative offence proceedings. With regards to former employees, this proved to be difficult. The District Office of Freyung-Grafenau then obliged him by notice to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after expiry of the period for which it must be kept. The plaintiff challenged this decision before the Regensburg Administrative Court, but the challenge was unsuccessful because the court was of the opinion that the decision did not violate the GDPR and was also not disproportionate. The court found that the issue in the present case is not whether the claimant was obliged to provide the data, but whether he was entitled to do so (as the defendant correctly pointed out). According to settled case law, notification of a traffic offence committed with a vehicle constitutes an obligation for the owner of the vehicle to cooperate, as far as possible and reasonable, in identifying the responsible driver. This also applies even if he is not obliged to name the driver, for example because he has a right to refuse to give evidence or testify. The court further found that it was also not doubtful that the GDPR and the Federal Data Protection Act did not prevent the transmission of driver data to the Police Administration Office, a data processing in the sense of Art. 4 No. 2 GDPR. The court thus ruled in favour of the defendant and referred to the fact that, irrespective of the opening of the factual scope of application of the GDPR - in any event a transfer of the personal data of the responsible driver to the police would have been permissible under Article 6 para. 1, second subparagraph, letter f GDPR in order to safeguard the legitimate interests of the Police Administration Office, a third party within the meaning of Article 4 No. 10 GDPR, when weighed against the interests of the drivers. Authorities have a legitimate interest in fulfilling the tasks incumbent upon them in the public interest, which according to Art. 23 para. 1 letter d GDPR include the prevention, investigation, detection or prosecution of criminal offences, including administrative offences. The transmission authority is also compatible with the principle of purpose limitation (Article 5 paragraph 1 letter b GDPR), since the purpose of the data storage in connection with the driving of the vehicle includes the processing of official or judicial penalties. After a compatibility check pursuant to Art. 6 para. 4 GDPR, even a change of purpose would be permissible. Contrary to the opinion of the plaintiff, he was not subject to any information obligations in this context.
La Quadrature du Net
The Provence-Alpes-Côte d’Azur French region (PACA region) authorized a new virtual control access system experimentation in two high schools. This system used facial recognition technologies and was aimed at controlling and ensuring the security. Four associations challenged the lawfulness of the decision aforementioned before the Administrative judge. The Court had to assess whether the control access system processed the students’ biometric data lawfully. The Court upheld the applicants’ arguments by ruling that the decision authorizing the experimentation was unlawful. First, the Court pointed out that the facial recognition system processed underage’s biometric data without a free and informed consent. Hence, the consent was given contrary to Article 9(2)(a), read in the lights of Articles 4 and 7 GDPR. Secondly, the purposes of the processing mentioned in the disputed decision which were linked to the schools' access and security, could not fall under the scope of Article 9(2)(g) GDPR. Therefore, the Court annulled the regional decision which had authorized the virtual access control system experimentation in the two high schools.
Trade association
The defendant had offered tires for instant purchase on the website eBay where he had not provided potential buyers with information about the processing of their personal data in case of a purchase according to Article 13 GDPR. Therefore, the plaintiff, as representative trade-association of those potential buyers, lodged a complaint with the competent jurisdiction, demanding that the defendant be summoned to provide the missing information since the sell was otherwise to be considered inadmissible. Is the absence of information, such as required by Article 13 GDPR, to be considered as an unfair trade-base action, making the offer inadmissible in accordance with § 3 UWG (national law against unfair competition)? After admitting the right of action of the plaintiff as representative association of consumers’ rights, the Court points out that the absence of information of Article 13 GDPR constitutes a violation of the law and, as such, an unfair trade-base action as understood by § 3 of the national law against unfair competition (UWG). As long as the defendant does not provide the missing information, the offer is therefore to be considered as inadmissible.
Veterinarian (anonymous)
The plaintiff is a veterinarian and has concluded a billing contract and a contract processing agreement (under Article 28 GDPR) with the clearing house for veterinarians (VTX). In case of default of payment, the VTX becomes owner of the claim (assignment of claim) in order to enforce it. The pet owner's data are transmitted to VTX for accounting purposes and the possible enforcement of claims before VTX declares its acceptance of an assignment of claims. This is done without the (explicit) consent of the pet owner. After a pet owner failed to pay a ~EUR 1.000 treatment invoice of the plaintiff, the claim was assigned to the VTX without the pet owner's consent. The pet owner filed a complaint with the competent supervisory authority (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz – LfDI) which issued a warning under Article 58(2)(b) GDPR, holding that the data transmission from the plaintiff to the VTX did not meet the requirements under the GDPR. Moreover, the LfDI asked the plaintiff to confirm that in the future, he would transfer data of pet owners to VTX only with their prior consent. The plaintiff filed an action against that decision, stating in essence that the transmission of accounting data to the VTX was based on Article 6(1)(b) and (f) and Article 6(4) GDPR. Since the assignment was only completed upon acceptance by VTX, data transfers which - as here - took place before the declaration of acceptance were to be regarded as data processing on behalf of the plaintiff. Further, the plaintiff argued that the data transferred constituted health data under Article 9(1) and Article 4(15) GDPR but the transfer was nevertheless admissible pursuant to Article 9 GDPR, as the strict requirements of Art 7 DSGVO could not generally be observed in treatment contracts with doctors and were therefore systematically inappropriate. Three disputes werde adressed from a data protection perspective: #Does the transmission of a pet owner'
Αnonymous
The parties are lawyers; they are engaged in expedited proceedings for injunctive relief under unfair competition law. On 29 October 2019, the defendant addressed a letter to the Board of Directors of the Bar Association of city 1 , enclosing copies of several writs of the applicant and pointing out the suspected unethical conduct. In order to defend himself against this action, the applicant has now submitted a motion to refrain from submitting his personal data to the Bar Association. In January 2020, the regional court did not grant the application, also on the grounds that there could be no violation of the GDPR for the simple reason that the members of the bar association are bound to secrecy. This circumstance is now the subject of the present appeal. The court ruled that the appeal was unsuccessful. On the one hand, courts are authorised and, also obliged to communicate personal data ex officio to public bodies for purposes other than those of the proceedings for which the data were collected; Section 25 German Data Protection Act forms the legal basis for this. This also includes requests for arrest as well as - on an equal footing with them - also requests for injunctions as a duty to notify the competent bar association. Article 6(1)(f) GDPR does not permit such transmissions pursuant to Article 6(4) conjunction with Article 23(1) GDPR. Furthermore, the court ruled that request for an injunction is also unfounded, as there is no right to an injunction. The Regional Court had rightly rejected a claim for injunction under Section 3a of the Unfair Competition Act in conjunction with Article 79(1) GDPR. It remains to be seen whether infringements of the GDPR can be asserted by competitors at all, or whether the GDPR does not, rather, conclusively regulate the legal consequences of infringements. In any case, there is no business act within the meaning of § 2 I No. 1 Unfair Competition Act. A claim for injunction by the applicant as a competitor directl
Liquor store
In August 2018, the DPA received a complaint from a customer (the data subject) regarding a liquor store (the controller). According to the complaint, the store had required this person to let them scan their electronic ID in order to issue a customer card. After an investigation, the DPA concluded that the controller had breached the GDPR. More specifically, according to the DPA the controller: 1. Did not have a valid legal basis for processing. Consent was not freely given because no alternative was offered to the complainant, in violation of Article 6(1) GDPR; 2. Did not provide the complainant with enough information prior to the processing, in violation of Article 13 GDPR; 3. Processed more personal data than necessary, including national ID number, date of birth and gender, in violation of Article 5(1)(c) GDPR. The appeal against the DPA's decision was based on 9 points, among which was the claim that the DPA violated Article 52(1), Article 54(2) and Article 82(2) GDPR. Most importantly, the controller challenged two of the three findings of the DPA, which had led to the fine: the absence of a valid legal basis for personal data processing and the breach of the data minimization principle. They did not contest the lack of information. The Court annulled the DPA’s decision as it was insufficiently reasoned and based on a legislation that was not applicable at the time of the complaint. The Court did not have the power to order the DPA to pay back the fine, as that falls outside of its jurisdiction, but it did quash the decision imposing the fine. The Court held that, first, the DPA had no evidence to support the finding that the controller was actually processing the national ID number of the data subject. Second, the controller was not obliged to give the data subject an alternative way of creating a discount card because the relevant provision of the e-ID law was not applicable at the time. Thirdly, the Court found that no personal data processing took
Court case 17 K 3920/19
The plaintiff contests the publication of his remuneration in accordance with the Hamburg Transparency Act (§ 3 (1) No. 15 HmbTG). The plaintiff is employed by the University Medical Center in Hamburg, a corporation under public law. The defendant's financial authority informed the University Medical Center that its subsidiaries would largely fail to meet the requirements of the Hamburg Transparency Act on the disclosure of management remuneration. It is asked to influence the management and to ensure that the next year's remuneration report is published. The University Medical Center informed the plaintiff that the intention was to transmit the requested information on his remuneration and fringe benefits to the defendant. The Hamburg Administrative Court had to decide, if the publication of the remuneration of the plaintiff is lawful. Plaintiff: The plaintiff argued his legitimate interest in determining that his salary information should not be published. He argued that the Hamburg Transparency Act is not applicable and therefore, the publication of his remuneration violates his general right of personality. In addition, according to the German Federal Data Protection Law (§ 26 BDSG,) personal data of employees for the purposes of the employment relationship should only be processed if this is for the decision on the establishment of an employment relationship or after the establishment of the employment relationship for its implementation or termination or for the exercise or fulfillment resulting from a law or a Collective agreement, a company or service agreement (collective agreement) resulting rights and obligations of the representation of interests of employees. This requirement is missing here. Defendant: The defendant is of the opinion that the plaintiff's salary should be published. According to the Hamburg Transparency Act, which is applicable according to the defendant, essential company data of municipal holdings, including a description of the annual remuneration and fringe benefits for the management level, should be published. The interference with the plaintiff's personal rights brought about by the publication of his remuneration was therefore justified and proportional. Remuneration information does not concern tighter privacy, but the professional area and is therefore not highly sensitive data, especially since it does not allow any reliable conclusions to be drawn about the financial situation. Employment contract regulations would not prevent publication. The court decided that the publication of the plaintiff's remuneration does not violate data protection regulations. The court stated that, contrary to the plaintiff's opinion, the inadmissibility of data processing does not arise from a law in the German federal data protection act (§ 26 BDSG). The respective law does not conclude on the admissibility of the processing of personal data of employees, so that in any case recourse to the general regulations of the GDPR would remain possible. In this respect, the legality of the data processing results from Art. 6 (1) (c), (e) GDPR and from the applicable Hamburg transparency law (§ 3 (1) No. 15 HmbTG). The court argued that the establishment of a high level of transparency with regard to the use of public funds, which is pursued by the regulation, represents a public concern of considerable importance. The provision of the Hamburg transparency law pursues a legitimate purpose insofar as it provides for the publication of the remuneration of the management level of urban participations. This consists in creating transparency with regard to the type and scope of the use of public funds for the purpose of economic activity what gives the public the opportunity to assess the appropriateness of this use of funds. In this respect, the publication not only serves to satisfy general curiosity, but also contributes to the public opinion-forming process in a democratic society. The respective law is also suitable and necessary to achieve this purpose. In particular, a mere aggregated publication of the remuneration of a particular associated company does not create the same level of transparency with regard to the appropriateness of the use of funds in the respective individual case. After all, there can be no objection to the fact that the legislature, in the context of its prerogative of assessment, has given (reasonable) preference to the legitimate interest of transparency in the public when weighing up the opposing interests.
Erasmus University Medical Centre Rotterdam
The plaintiff asked from the Erasmus University Medical Centre Rotterdam (“EUMCR”) to provide her the DNA material of a person died in 2018 alleging that this person was her father. The deceased man had participated in a medical-scientific research at the EUMCR, prior to which he had filled in a “patient consent form”. According to this form, he expressed his wish that his body material would be treated confidentially. The EUMCR refused to provide the plaintiff the DNA material claiming that: * there is no legal basis under which it is obliged to provide this material, * the man’s wish had been expressed unambiguously, thus such a disclosure would contravene the GDPR and * it is bound by professional secrecy. The Court had to balance the plaintiff’s right to personality which includes her right to know her parents and the right of the deceased man and his family to privacy which is here protected by the EUMCR’s duty of confidentiality. The Court went through this balancing exercise and first invoked Recital 1 GDPR and Recital 4 GDPR and the definition of processing under Article 4(2) GDPR. Then, it noted that according to Article 9 GDPR and Recital 35 GDPR genetic data must be protected as sensitive data. The man’s consent to processing was only referred to the purposes of the research he participated in. Further, none of the requirements in Article 9(2) GDPR is fulfilled. The Court concluded that in this case the interest of the EUMCR must outweigh the plaintiff’s interest and the EUMCR must not provide her the DNA material. The Court rejected the plaintiff's claim.
Bisnode
"The entrepreneur conducting business activity consisting in obtaining information, including personal data of persons conducting business activity, from publicly available public registers [e.g. the National Court Register (KRS), the Central Registration and Information on Business (CEIDG), the Registry of National Economy (REGON)] and in analysing, interpreting and subsequently making this information available to interested customers, must comply with the information obligation in relation to those persons referred to in Article 14 of the General Data Protection Regulation (GDPR) by providing information directly to the data subject, as is apparent from the judgment of the Voivodeship Administrative Court in Warsaw of 11 December 2019 (ref. no.: II SA/Wa 1030/19). Moreover, according to the Voivodeship Administrative Court, the possible high cost of sending this information by post does not constitute a basis for the exemption from the information obligation. This concerns a case in which the President of the Personal Data Protection Office ordered by way of an administrative decision to fulfill the information obligation and imposed on the company an administrative fine in the amount of more than PLN 943 000 (for more information on this issue see: https://uodo.gov.pl/pl/138/786). Let us recall that the company was penalised in connection with a breach of the information obligation (Article 14 (1-3) of the General Data Protection Regulation), consisting in failure to provide the information contained in Article 14(1) GDPR and Article 14(2) GDPR to all natural persons whose personal data are processed by the company who are currently or were in the past sole traders, as well as to natural persons who have suspended their activity as sole traders. The company appealed to the Voivodeship Administrative Court against that decision. It argued, inter alia, that it was not under the information obligation resulting from Article 14 of the GDPR. The entity considered tha
Court case 4Ob84/19k
A business added names and other personal information from a list of Austrian registered psychotherapists, which had been publicly available on a federal ministry‘s website, to their own register of psychotherapists and psychotherapists in training with supervision. The commercial website offered paid features for listees including prioritisation in search results and the possibility to add further information such as links and pictures. Action was brought by an association of Austrian psychotherapists in order to stop the publishing of listee's names without consent or, alternatively, stop providing a perceived competitive advantage to paying listees. The featuring of entries was seen as misleading since it was not clearly indicated that those were part of a paid advertising package. Can the defendant rely on Article 6 (1) (f) GDPR/legitimate interest as a basis for the processing and were appropriate information requirements according to Article 14 GDPR met? Can the defendant’s activities be challenged under competition law? The Austrian supreme court (Oberster Gerichtshof der Republik Österreich - OGH) refers to § 28 of the Austrian data protection act (Datenschutzgesetz - DSG) and concludes that this exclusively grant rights for group actions by associations and other bodies in front of the national data protection authority, but not in front of courts. In addition, it finds, was the association not explicitly legitimised by its individual members to bring such action for them, nor had it claimed to be doing so. It supports this by reference to Article 80 (2) GDPR which require an explicit provision from the national legislator for action brought by an organisation without explicit commission from the data subject. Hence, due to a lack of active legitimation to bring the action, it does not review the applicability of Article 6 (1) (f) and 14 GDPR. Regarding privacy related claims based on competition law, the supreme court raises the question of general admissibility (Zulässigkeit). It does not decide on the question, instead negatively answers the question of substantial suitability of privacy rights to constitute a breach of law leading to an application of §1 of the Austrian competition act (Bundesgesetz gegen den unlauteren Wettbewerb - UWG) and hence denies the claim.
Court case W256 2214855-1/6E
Different family members live in different parts of a house. One family member installed six cameras to film different parts of the property, claiming that for example postal letters were stolen. The other family members filed a "report" (Anzeige) with the DPA. The DPA understood the "report" to be a complaint under Article 77 GDPR. The DPA asked the local district authority (Bezirksverwaltungsbehörde) to investigate certain facts on behalf of the DPA and issued an order to stop the processing of personal data. The DPA has not found which exact areas were filmed and if the complaint was actually subject to CCTV surveillance. Has the DPA investigated all relevant facts? It is crucial that the data of the complainant was de facto processed. The DPA made no such finding in the entire decision. The decision was therefore invalid and was returned to the DPA to make these investigations.
Court case 9 U 6/19
Both the plaintiff and the defendant run pharmacies. The plaintiff alleged that the defendant sells prescription-free medicines via Amazon-Marketplace, violating competition law. Firstly, the Court found that customers disclose their health data to the sales platform Amazon deliberately and there is no data transmitted by the defendant to Amazon. After Amazon has transmitted the order data, the situation is comparable with a direct order from the defendant's online pharmacy. The legislator has permitted online pharmacies. Then, the Court found that customers’ order data is health data and fall within Article 9(1) GDPR. Amazon does not collect health data stricto sensu but it can draw conclusions about customers’ health from the order data. The plaintiff pointed out that any breaches of data protection laws by the Amazon Marketplace platform are not part of this legal dispute. It is also not a question whether any data protection breaches by the platform can be attributed to the defendant. The decisive factor here is the data processing by the defendant himself. The Court finally found that there is no explicit consent by the customers as requested under Article 9(2)(a) GDPR and an implied consent cannot fulfill the provision’s requirement. Additionally, the professional code of conduct of the Saxony-Anhalt Chamber of Pharmacists obliges pharmacists to obtain written consent.
Employee Insurance Agency (UWV)
The Dutch Employee Insurance Agency (UWV) fined an employer for the late reporting of an employee's sick leave with a no-risk insurance policy. According to Article 38b of the Sickness Benefits Act, an employee can ask an employer about a no-risk policy two months after the beginning of the employment. The employee at stake had been employed for more than three years and he had had enough time to ask about the no-risk policy. The employee claimed that asking about the no-risk policy was in conflict with the data protection rules under the GDPR because it is essentially ‘data concerning health’. The Court found that Article 38b of the Sickness Benefits Act is not in conflict with the GDPR. Whether or not a no-risk policy applies is not relevant and there is no question on ‘data concerning health'. Moreover, processing under the GDPR would be permitted in this case even if there was health data and the exception of Article 9(2) GDPR would apply. The agency was therefore allowed to impose a fine on the employer.
DFW
DFW (a Dutch movie distributor) applies a protocol to its processing of personal data which was approved by the Dutch DPA before the GDPR came into force. DFW asked Ziggo (an internet service provider) to provide IP addresses of customers who according to DFW shared movies illegally. Ziggo refused to provide this information. Τhe Court had to assess whose interests prevail in this case: DFW's interest in the protection of its intellectual property rights or Ziggo's interest in the protection of the personal data of its customers. The Court found that any processing needed to be based on legitimate interests according to Article 6(1)(f) GDPR and that Ziggo had to comply with Article 6(4)(d) GDPR. The Court found that DFW had a legitimate interest and that the processing was necessary. However, the Court pursued a balancing exercise between the interests of DFW and the interests of the data subjects and found that the approved protocol was not transparent enough. Thus, the possible consequences for the data subjects of providing their data to DFW could not be estimated. DFW failed to make clear which action it would take, under which circumstances and in which manner it would inform the data subjects of their rights. The Court is of the opinion that the interests of Ziggo's customers are still insufficiently safeguarded, and it, therefore, rejected DFW’s claims confirming the ruling of the Court of First Instance. The Court based its ruling on the national civil code, Articles 4(2) and 6 GDPR, Articles 17 and 47 of the Charter of Fundamental Rights (CFR), and Articles 8 and 13 ECHR.
Court case VI ZB 39/18
The applicant does not have a user account on Facebook, nor uses the Facebook Messenger, but she found out that other users shared messages with her friends and family members. She claimed that the messages included untrue allegations about her and she requested to be provided with all the relevant data of the users’ accounts in order to support civil law claims. The German Federal Court of Justice noted, that the German Telemedia Act (TMG) covers the social network service providers, including Facebook Messenger. This Act allows the disclosure of user data by the providers for the enforcement of civil law claims and according to the Court it constitutes a necessary and proportionate measure in a democratic society as required under Article 23(1)(j) GDPR. Moreover, the exception provided for under Article 6(4) GDPR which allows processing for different purposes when it is based on Member State law is not limited to the fulfillment of a “legal obligation” or “public interest” according to Article 6(1)(c) GDPR and Article 6(1)(e) GDPR.
Manfield Schoenen B.V.
Mansfield introduced an obligatory employee fingerprint scanner on cash registers in its stores. One of the employees objected to the use of this technology based on [Article 9 GDPR] and Article 29 of the Dutch GDPR Implementation Act (“UAVG”). The store employee did not agree that the processing of the fingerprint was necessary for the authentication and security purposes. The parties asked the Court to clarify whether the use of fingerprint scanner in this case violated the right to privacy of the store sales assistant. The judge found that a fingerprint constituted indeed personal data (same authorisation system was also used for time registration purposes, which means there was a clear link between the fingerprint and a person) and that Manfield was not allowed to process fingerprints to enhance its security and fraud prevention measures. It also found that Article 29 of the Dutch GDPR Implementation Act was not applicable in this case because Manfield could not demonstrate necessity and proportionality of this processing.