GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
= The data subject visited a website operated by a media company (the controller). Upon opening the website a cookie banner showed up. This cookie banner was designed in such a way that a reject button was “hidden” in a second layer. The cookie banner’s first layer presented only an option to accept the cookies or to manage the options. The cookie manage option was presented as a link. When the data subject clicked on the accept button, they also agreed to pre-ticked options, visible only within the cookie management link. The reject button was a part of the second layer of the cookie banner (within the cookie management link). The data subject lodged a complaint with the Austrian DPA (DSB), claiming the controller violated, inter alia, Article 5(1)(a) GDPR and Article 6(1)(a) GDPR. The data subject was represented by noyb. The controller argued to the DPA that the website provided access to online newspaper articles. Because of that, the processing activities were carried for journalistic purposes and the DPA was not competent to hear the case. The DPA eventually issued a decision, ordering the controller to modify the cookie banner so that its first layer offered an option to close the cookie banner without giving consent. This option had to be visually equivalent to the accept button. The DPA rejected the applications of the data subject regarding the deletion of its data, an order to stop unlawful processing and establishing the violation of data confidentiality (“Recht auf Geheimhaltung”) following from Section 1 of the [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563 Austrian Data Protection Act (Datenschutzgesetz - DSG)]. = The controller appealed the DPA’s order to introduce an equivalent reject option in the first layer of its cookie banner to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The Federal Administrative Court dismissed the appeal by the controller. That court held, that the controller’s processing activities
The controller, a major private bank, failed to properly report a data subject's loan settlement to SCHUFA. Despite the data subject making regular payments, the controller’s automated system did not record them correctly, resulting in inaccurate reports being sent to SCHUFA. Following a complaint, the DPA issued a reprimand against the controller for violating Article 5(1)(d) GDPR, which mandates accurate data processing. The controller argued that the violation occurred before the GDPR came into effect, thus it should not apply. Even if the GDPR were to be applicable, the controller contended that it had taken appropriate corrective actions and that it should not be held accountable for the errors in the automated system. The controller seeks to have the warning lifted by the Administrative Court of Düsseldorf (VG Dusseldorf). The DPA maintains that the controller’s failure to ensure accurate reporting violates the GDPR. The court held that the DPA’s reprimand against the controller was justified. It found that the controller failed to ensure the accuracy of the personal data transmitted to SCHUFA, as required by the GDPR. The court emphasized that under Article 5(1)(d) GDPR, personal data must be accurate and kept up to date. The controller continued to report inaccurate balance information to SCHUFA after the debt was settled in February 2018, violating the principle of data accuracy also after the GDPR came into effect. The court noted that while the controller may have processed the data with a legitimate interest, the failure to correct inaccuracies in the data subject’s data within a reasonable time violated the principle of data accuracy. The controller did not demonstrate sufficient efforts to correct or delete the incorrect data after the debt was settled, which violated the accountability principle as laid out in Article 5(2) GDPR as well. While the DPA could have imposed a fine under Article 83 GDPR, the court found that the DPA’s decision to issue a
The controller is a credit rating agency calculating credit scores based on personal data. The data subject filed a criminal complaint against the controller in April 2023 for allegedly unlawful storage of payment defaults and allegedly criminal conduct by its employees. As a response, the controller temporarily suspended the provision of information regarding the data subject's data to third parties. The criminal proceedings were eventually discontinued, however the controller only learned that during the ongoing civil proceedings. The controller informed the data subject that it would not disclose his data set again until he gave his written consent and waived any subsequent claims that might arise from the credit rating (damages/compensation for pain and suffering). The data subject did not make such a declaration. The data subject requested - inter alia - that the controller be ordered to pay the data subject non-material damages pursuant to Article 82 GDPR, because the controller failed to transmit the current credit score calculated by the controller in particular to two banks contrary to their right to data portability under Article 20(2) GDPR. Additionally, the data subject claimed, that the controller had a contractual obligation to forward the data. The controller requests that the action be dismissed. The controller argued, that even if potential contractual partners had refused to enter into credit-related agreements with the data subject, the corresponding damages would not have been caused by the controller or by the information it failed to provide. The court held, that the data subject is not entitled to damages under Article 82(1) GDPR. = The court found, that the controller had not violated the GDPR as according to Article 20(1) GDPR, the data in question must have been made available to the controller by the data subject to establish an obligation to transfer the data (i.e. the right to data portability). However, the data to be disclosed is no
The data subject filed a complaint with a DPA regarding a GDPR violation. When the DPA did not decide to the data subject's satisfaction the data subject initiated administrative court proceedings to order the DPA to take effective supervisory action. Regarding this proceeding the data subject was issued an administrative court cost statement, to which it filed an objection at the Administrative Court of Schwerin (Verwaltungsgericht Schwerin - VG Schwerin). The data subject argued that Article 57(3) GDPR, which ensures cost-free procedures before the DPA, should also apply to judicial proceedings. The VG Schwerin dismissed the objection. The data subject then appealed the court’s decision to the Higher Administrative Court. The Higher Administrative Court clarified that Article 57(3) GDPR only applies to tasks performed by the DPA, such as handling complaints and taking action based on data protection law. The court emphasized the difference between administrative proceedings before DPAs and judicial proceedings. It relied on Section 188 of the German Code of Administrative Court Procedure ([https://www.gesetze-im-internet.de/englisch_vwgo/englisch_vwgo.html#p0866 Verwaltungsgerichtsordnung - VwGO]) to determine the rules regarding court costs, finding that this provision is conclusive on exemptions for court costs and does not include exemptions for GDPR related claims. Thus, it reached the conclusion that Article 57(3) GDPR does not cover judicial proceedings, which are a separate legal process governed by national law. In its ruling, the Higher Administrative Court rejected the appeal, affirming that Article 57(3) GDPR, which guarantees cost-free procedures before DPAs, does not extend to judicial proceedings. The court stated, that it did not find it necessary to refer the question of judicial costs for GDPR claims to the CJEU.
It is disputed to what extent the plaintiff (data subject) can demand information from the tax office (the controller) in accordance with Article 15 GDPR. The data subject requested "the disclosure of copies of all stored information" relating to him with reference to the GDPR, whereupon the controller sent various overviews. In this regard, the data subject complained that not all relevant documents had been made available in accordance with Article 15 GDPR. The controller interpreted this as a request for comprehensive inspection of the files, which was officially approved. The data subject then requested information pursuant to Article 15 GDPR. The controller declared its willingness to allow the inspection of the files to fulfill the access request. However, the sending of all files was refused. Before the Thuringian Fiscal Court (Thüringer Finanzgericht - FG Thüringen) the data subject pursued his access request under Article 15(1) GDPR and the provision of copies pursuant to Article 15(3) GDPR. The controller sent the data subject various overviews during the legal proceedings. The FG dimissed the data subject's claims. After that the data subject was granted access to the files concerning the proceedings. With the appeal to the Federal Finance Court (Bundesfinanzhof - BFH), the data subject complained that the access request was not yet fulfilled. It claimed, that the listing of internal agency processes does not constitute the provision of information and that the access request cannot be countered with the objection of disproportionate effort. The controller requested that the appeal be dismissed because the access request had already been complied with and because Article 15 GDPR does not give rise to any further right to full access to the files. The court held, that the first instance court had erred in assuming that the controller could object to the access request on the grounds that the required provision of information would involve disproportion
On the 14 October 2022, the data subject alleged a violation of his right to access under Article 15 GDPR by the controller. The Austrian DPA (Datenschutzbehörde – DSB) however rejected the complaint on the 18 October 2022. The DSB detailed that the data subject had lodged his first complaint on the 3 September 2018 and since then he had followed it with 73 other complaints. The DSB held that although Article 57(4) GDPR does not specify the meaning of “excessive”, it certainly indicates that a high number of complaints can be considered excessive. The DSB went on to say that the initiated proceedings were legally complex and the statements made by the data subject were very detailed which meant that a lot of resources would be necessary for the assessment of the case. As Article 57(4) GDPR enables the supervisory authority to choose between implementing a fee or refusing to process the complaint, the DSB found itself validated in its decision to reject the complaint. The data subject appealed the decision of the DSB to the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The data subject posed that the DSB had given no legal justification for the rejection of the complaint proceedings. The BVwG paused its assessment of the matter until the conclusion of the CJEU case C-416/23 which had been referred to the CJEU by the Supreme Administrative Court of Austria (Verwaltungsgerichtshof – VwGH). The CJEU in C-416/23 held that placing a numerical threshold on complaints would undermine the data subject's rights. The BVwG held that the DSB had failed to carry out an investigation into whether the data subject had abusive intensions. The BVwG found that there were no indications on an abusive intension of the data subject. Therefore, the BVwG concluded that the rejection of the complaint had been unlawful. The BVwG reverted the case back to the DSB for an adequate assessment of the claims.
Meta Business Tools transmitted data to third parties without user consent, violating consent requirements for third-party tracking.
On 17 February 2020, the data subject lodged a complaint with the Austrian DPA. He complained that the controller had not responded to his access request under Article 15 GDPR for access within one month. On 22 April 2020, the DPA made the decision to refuse to act on this complaint, arguing that it was “excessive” under Article 57(4) GDPR. The DPA observed in particular that, over a period of about 20 months, the data subject had sent it 77 complaints arguing that various controllers failed to respond within one month to his requests for access or erasure. Also, the DPA highlighted the fact that the data subject regularly contacted the DPA by telephone in order to report additional facts and to make additional requests. The data subject brought an action before the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). On 22 December 2022, the BVwG upheld the data subject’s action. It held that, in order for requests to be "excessive” under Article 57(4) GDPR, it is not enough that these requests had been made repeatedly and frequently, but it is also needed that they had been manifestly vexatious or abusive. The DPA appealed this judgement before the Supreme Administrative Court (Verwaltunsgerichtshof – VwGH). This court decided to stay the proceedings and refer the following questions to the CJEU for a preliminary ruling: # Must the concept of “requests” in Article 57(4) GDPR be interpreted as meaning that it also covers “complaints” under Article 77(1) GDPR? # Must Article 57(4) GDPR be interpreted as meaning that, for requests to be “excessive”, it is sufficient that a data subject has merely addressed a certain number of requests to a DPA within a certain period of time, irrespective of whether the facts are different and/or whether the requests (complaints) concern different controllers, or is an abusive intention on the part of the data subject required in addition to the frequent repetition of requests (complaints)? # Must Article 57(4) GDPR be in
Association Mousse lodged a complaint with the French DPA (CNIL) after a data subject purchased rail travel documents from SNCF Connect (the controller). The controller required customers to enter their title (Madame / Monsieur) when they purchased travel documents. The complaint argued that the controller should not collect this data or that, at the very least, it should offer customers additional options such as ‘neutral’ or ‘other.’ The controller argued that knowing the sex of the data subject permitted it to personalise communications in accordance with commonly accepted practices in commercial communications. It also stated that the processing permitted it to adapt the services it provided (such as providing access to women-only carriages on night trains). On 23 March 2021, the CNIL found that the controller’s processing did not violate the GDPR. It found the processing lawful under Article 6(1)(b) GDPR, viewing it as necessary for the performance of the contract to supply transport services, and considered the processing consistent with the principle of data minimisation. Association Mousse brought an action for annulment of the CNIL’s decision before the Conseil d’État. In addition to reiterating its legal basis and data minimisation challenges, it pointed out that the processing infringed the right to travel without disclosing one’s title, the right to respect for private life and freedom to freely define one’s gender expression. It also noted that in countries who recognize nonbinary civil statuses, the indication does not correspond to reality and may prove contrary to the principle of accuracy. The Conseil d’État stayed the proceedings and referred two questions to the CJEU. # In assessing whether data collection is consistent with Article 5(1(c) GDPR and Articles 6(1)(b) and (f) GDPR, may account be taken of commonly accepted practices in civil, commercial and administrative communications (here, the collection of data relating to consumers’ titles)? #
An individual, the controller, broadcasted a live stream with a video footage, installed on their initiative, of their village on their website. This livestream was taken with two cameras and broadcasted on the controller´s website. Multiple data subjects advanced complaints before the DPA due to the filming of private houses in the controller´s livestream. Consequently, the DPA started an investigation and, eventually, imposed a fine of €500 to the controller due to the lack of a legal basis for the processing as per Article 5(1)(a) and 6 GDPR. The DPA upheld the decision after the controller´s objection. Thus, the controller appealed the decision in front of the Rechtbank Noord-Nederland (hereinafter: District Court) and argued that the processing activity could be based on an legitimate interest in accordance with Article 6(1)(f) GDPR. The District Court admitted the appeal to the DPA decision. Data processing under Article 6(1)(f) GDPR The District Court started its analysis by stating that it is undisputed that personal data was processed. The controller claimed that the processing was based on a legitimate interest as per Article 6(1)(f) GDPR. The controller listed different legitimate interests at stake in the case at hand: - The controller ´s own interest to promote the old village, national monuments and iconic buildings; - Different local authorities´ interest to attract tourists for economic gains, - The interest of the Municipality of De Fryske Marren as the municipality´s bridge operator uses the live stream when operating bridges; - The neighborhood police officer´s interest in using the live stream to determine the duty rooster; - The social interest of sick, elderly and interested people at home to watch the activity in the centre from home. To support this claim, the controller brought a petition of 941 people asking to keep the live streaming going. - Third parties´ interest to maintain public order and safety through the processing. On
A husband and a wife (data subjects) opened a personal bank account with a bank (the controller). The controller processed inter alia their name, surname, personal identification number (PESEL), address, phone number, martial status. After changing the account type, the data subjects requested the controller, in writing, to stop sending advertising material and bank statements on their address; also, they withdrew the consent for data processing. The consent had covered data processing, including archiving personal data by the controller. The controller refused to comply with the request, claiming they were unable to identify the senders of the request. The data subjects were asked to use an online service, the helpline or file the request in person. The controller explained the bank statements referred to data subjects’ account. The data subjects refused to use one of communication channels suggested by the controller. Again, data subjects upheld their request and consent withdrawal. Although the controller closed the data subjects' account and claimed to cease processing of their data, the data subjects received another mail with bank statements and information about new deposit accounts. In one of the letters sent to data subjects, the controller informed them, that the processing was based on controller’s legitimate interest to establish, exercise or defend legal claims i.e. Article 6(1)(f) GDPR. The data subject filed a complaint with the Polish DPA (UODO). The DPA found the controller didn’t comply with the data subjects’ request (treated by the DPA as objection under Article 21 GDPR) and unlawfully processed their data for marketing purposes. Hence, the DPA issued a warning to the controller for violation of Article 6(1) GDPR, Article 12(2) GDPR, Article 12(3) GDPR, Article 21(3) GDPR. Moreover, the DPA ordered deletion of data subjects’ data. The controller brought an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyj
The data subject, a user of a popular music streaming service (the controller), sued the controller after her personal data (such as her name, email address, and usage preferences on the platform) was exposed in the darknet. After the controller's service provider (the processor) mishandled the data by transferring it to an unsecured environment it was accessed by hackers and published on the darknet. The contract between the controller and the processor concluded in 2020 while the breach occurred in 2022 affecting data sets dated back until 2019. The incident was reported to the French DPA (CNIL) in November 2022 but individual notifications were sent out only in early 2023. The contract had specific requirements for maintenance of adequate security measures and data deletion. The controller admitted that a data breach occurred but claimed it was caused by actions outside their control and post termination of the contract and that they relied on the announcement made by the processor that all their data would be deleted. They also argued that former employees of the processor mishandled the data after the service contract was terminated. The data subject argued that the breach led to significant distress. She noticed an increase in phishing and spam emails targeting her and reported that the breach caused anxiety, sleep disturbances, and a lot of time spent securing her online accounts and changing passwords. The data subject also raised concerns that the controller failed to provide timely information about the breach. The company advised users to change their passwords as a precaution but did not give the data subject the full information she had a right to under GDPR, particularly regarding what specific data was affected and who accessed it. The court held that the controller failed to properly monitor its data processor's compliance with data protection obligations according to Article 28 GDPR, especially concerning the deletion of personal data. The co
A data subject was an employee of a heating and air conditioning business. The data subject ceased working at the company, however, was still able to access the company’s premises and computers through their managing director for several years. The company brought a case against the data subject, on the grounds that the data subject had sold equipment belonging to the company through eBay. The company sought damages based on this. The German Landesarbeitsgericht Niedersachsen (Higher Labour Court, Lower Saxony) stayed proceedings and requested a preliminary ruling from the CJEU. The data protection issue in this case is that the company became aware of the transactions by accessing the data subject’s private eBay account (how the company received the ID and password is disputed). According to the Court, the company collected and stored the data unlawfully. The Court also considered that it carried out data processing in assessing the evidence during the proceedings, and asked for clarification regarding national legislation for judicial data processing activities and their legal bases. The Court referred the following questions: # Do national provisions involving an independent judicial processing activity under public interest (Article 6(1)(e) GDPR) fulfil the certainty requirements under the EU Charter of Fundamental Rights and the GDPR if it interferes with the fundamental rights of a (third) party? # Can a court rely solely on Article 17(3)(e) GDPR to process personal data? If yes: ## Does this still apply if the initial data collection is unlawful? ## Does the principle of fairness (Article 5(1)(a) GDPR) restrict the applicability of Article 17(3)(e) GDPR? ## Must Article 17(3)(e) GDPR be interpreted as an exception to the prohibition of using unlawfully obtained data for judicial purposes? # Regardless of the questions above: ## Must the court carry out a comprehensive proportionality test in accordance with the principles of necessity and data minimisat
Several data subjects were subject to suspension proceedings by the Austrian Anti-Doping Legal Commission (ÖADR). Under Austrian law, the National Anti-Doping Agency (“NADA”) publishes the names of persons who have been suspended on its website. For the duration of the suspension, the website includes information such as the athlete’s name, sport practised, infringement of anti-doping rules, and the duration of the penalty. The ÖADR publishes the same information in a press release, with the addition of the prohibited substances involved. For this summary, both authorities are referred to as the controllers. The data subjects filed a complaint with the DPA on the grounds that the controllers refused their request to cease displaying their names and practised sports. They also argued that the controllers were processing sensitive data within the meaning of Article 9 and 10 GDPR, and that the undifferentiated publication system was incompatible with Article 6(3) GDPR. The DPA dismissed the complaint. In particular, one of the data subjects’ complaints was rejected on the grounds that the relevant data had not been published yet. The data subjects appealed the decision to the Federal Administrative Court (BVwG). The controllers argued that publishing the information in their website was lawful, as it was based on the legal bases of legal obligation (Article 6(1)(c) GDPR) and public interest (Article 6(1)(e) GDPR). The BVwG stayed proceedings and requested a preliminary ruling from the CJEU. The BVwG referred the following questions: # Does the GDPR apply to the making information relating to athletes’ anti-doping violations publicly available through websites? If yes: # Does information that an individual has committed a specific anti-doping violation fall under the scope of data relating to health within the meaning of Article 9 GDPR? # Does the GDPR preclude national legislation from publishing the information mentioned above, if it does not make it possible to in
= Under Swedish lawYttrandefrihetsgrundlagen (1991:1469) (Constitutional Law on freedom of expression). the Swedish Agency for the Media can issue publications certificates which confers constitutional protection to the activities of the holder. Such certificates can also be issued for the publication and maintenance of databases of personal dataYttrandefrihetsgrundlagen (1991:1469) (Constitutional Law on freedom of expression), Chapter 4, Paragraph 1.. Swedish lawLagen (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning, 1:7 (Law (2018:218) laying down supplementary provisions to the EU GDPR, Chapter 1, Article 7). provides for broad GDPR derogations for certain activities covered by the permit, as an implementation of Article 85 GDPR ("Processing and freedom of expression and information"): * The GDPR and the Swedish Law on data protection do not apply when they would conflict with the constitutional protection afforded by a publication certificate. * Additionally, specific Articles of the GDPR and the Law on data protection - including all of Chapter VIII of the GDPR (Remedies, liabilities and penalties)- do not apply to the processing of personal data that takes place for journalistic purposes or for academic, artistic or literary creation. As a result of these broad exemption, data subjects have limited remedies available when the processing of their data is covered by a publication certificate. In particular, Swedish lawLagen (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning, 9:1. provides that in such cases, controllers can only be held liable for damages when the processing of personal data constitutes defamation. = Legal Newdesk Sweden AB, formerly Garrapatica AB (the controller), holds such a certificate. The controller maintained a database (Lexbase) where personal data, including criminal convictions, are stored. The data were made available to third parties for payment. A data subject challenged the process
The background In 2021 Hungary adopted "Law LXXIX of 2021 adopting stricter measures against persons convicted of paedophilia and amending certain laws for the protection of children" ("the amending law"). The law introduced a number of rules to restrict the access of minors to content portraying or promoting gender identities that do not correspond to the sex assigned at birth, sex reassignment or homosexuality. The law also introduced new rules for access to public documents, requiring public bodies to allow broad access to information about individuals convicted of sexual offences against children. The alleged purpose of the law was to protect minors. In 2021 the Commission sent a formal letter to Hungary contesting the amending law's compliance with EU law. After some unproductive back-and-forth, the Commission escalated the case to the CJEU, requesting the CJEU to declare the amending law incompatible with EU law. The European Commission filed four pleas, claiming that Hungary violated of a long list of provisions from primary and secondary EU lawThe Commission alleged the violation of Articles 1, 7, 8(2), 11 and 21 CFREU; Article 2 TEU; Article 56 TFEU; Article 3(2) of the Directive on electronic commerce; Articles 16 and 19 of the Services Directive, Article 9(1)(c)(ii) of the AVMS Directive; and Article 10 GDPR.. Only the Commission's fourth plea invokes data protection law- specifically, Article 8(2) CFREU ("Protection of personal data") and Article 10 GDPR ("Processing of personal data relating to criminal convictions and offences"). The fourth plea: Article 10 GDPR The alleged violation of the GDPR relates to the amended law's rules on access to information about individuals convicted of sexual offences against children. The law amended the "Law on the criminal record system" and made documents about sexual offences accessible to a broad audience. Under the new rules, any adult who is either a relative or a guardian of a minor ("authorised person"), has t
Fédération internationale de football association (FIFA) is a Switzerland-based non-profit that acts as the global governing body for football. A large number of football clubs and national football associations are member of FIFA and bound by its regulations. In January FIFA published the FIFA Football Agent Regulations (FFAR). FFAR regulated the conduct of player’s agents. In particular, FFAR provided maximum limits to agents’ remuneration and prohibited specific types of contractual arrangements between clubs, agents, and agencies. In order to ensure compliance with these rules, Article 12 FFAR required agents to disclose certain information to FIFA. In particular, agents had to disclose: * Information about any agreement with a client, other than a representation agreement; * Information on any arrangement between agents to cooperate in the provision of their services, or to share the revenue or profits of their services; * Information about their relationship with agencies, including the names of all of the agency’s employees. Additionally, FIFA would make the information available to a number of stakeholders including agents, players, and football clubs. Three applicants (an agent, a company acting as a players’ agent, and the Vice-President of a players’ agents’ associations) challenged FFAR in the Regional Court of Mainz (Germany). The Court referred four questions to the CJEU for a preliminary ruling. In essence, the Court asked the CJEU whether the FFAR was compatible with Articles 101 TFEU (prohibition on cartels), 102 TFEU (prohibition on abuse of a dominant position), 56 TFEU (freedom to provide services), and 6 GDPR (legal bases for processing personal data). With regards to Article 6 GDPR specifically, the referring court essentially asked whether there was a lawful basis under the GDPR for a collection of personal data, such as required under the FFAR’s mandatory disclosure rules. The referring question did not specify what legal basis had to be ex
The data subject filed an access request for their personal data related to a legal dispute. The municipality of Utrecht ("controller") published the data online, including the addresses of the data subject and his neighbours. The data subject lodged a complaint with the Dutch Data Protection Authority (AP) on 24 July 2021. Following the complaint, the controller removed some of the personal data, making the infringement of privacy minor. The AP concluded that there was no violation of the GDPR and emphasized that the controller had discretion under Article 5(1) of the Woo (Wet open overheid) to disclose information contained in public documents. The data subject appealed the AP's decision on both procedural and substantive grounds. While the initial claim concerned the AP’s failure to decide on time, he also raised legal arguments, including that the authority had not investigated sufficiently, that the publication of address data violated the GDPR, and that the AP should have conducted an independent GDPR assessment separate from the Woo framework. The appeal was found manifestly inadmissible, and the court issued its judgment without a hearing. The court pointed out that the matter at hand had already been decided in a previous judgment (ECLI:NL:RBMNE:2023:6538). That case, decided under the Woo, had already balanced privacy interests against the public interest in transparency, concluding that disclosure of the address data was lawful. In the present case, the court declined to re-examine the issue because the data subject requested the same balancing to be repeated under the GDPR, without introducing any new facts or legal grounds. As the Woo is recognised as applicable national law under Article 86 GDPR, the previous assessment sufficed. The AP was therefore entitled to rely on the prior Woo-based judgments, and no separate GDPR investigation was required. The court ordered the AP to pay the €437,50 procedural costs because the AP had issued the decision too
The controller CRIF GmbH operates a credit agency and processes personal data of the data subject in question for this purpose. The credit rating information about the data subject is not based on any payment history but only on general data such as address, age and gender. The controller purchased data on the data subject's first and last name, address and date of birth from X. X operates an address publishing and direct marketing company. The data subject did not consent to the processing of that data. The data subject cannot successfully run its business without appearing in the controller's database, because just that fact of not appearing reduces creditworthiness. Therefore the data subject did not pursue deletion but only the termination of processing by the controller of data from X. The court of first instance held, that the controller had wrongfully processed the data subject's personal data and ordered an injunction. It held, that the controller had inappropriately used data for the purpose of assessing creditworthiness, which had originally been collected for the purposes of address publishing and direct marketing by X. The controller therefore should have informed the data subject in accordance with Article 14 GDPR that it collects data from third parties. The court stated that [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10007517&FassungVom=2025-01-25&Artikel=&Paragraf=151&Anlage=&Uebergangsrecht= § 151 Trade Regulation] (Gewerbeordnung - GewO) - privileging data collected by address publisher and direct marketing companies - does not constitute a legal basis for the (further) processing of data because it is not a legal provision within the meaning of Article 6(1) in conjunction with Article 6(4)(h) GDPR, but only a standard under commercial law . The court did not find a connection between the original purpose of the address publisher - and the new purpose of credit assessment. The court found it irrelevant, that t
On the 8 January 2019, the Austrian DPA (Datenschutzbehörde – DSB) launched an investigation into the actions of the Austrian postal service as it also had a business license for address publishing and direct marketing. Media reports had claimed that the postal service (the controller) sold data concerning the political affinities of data subjects to third parties. The controller ran a platform entitled “Adress Shop” on which it sold personal data to legal entities. The datasets included names and addresses but more importantly it included data subjects’ affinities to certain things such as an affinity to moving house, an affinity to organic products or how frequently a data subject receives packages. The purpose of the data processing was to sell this data to third parties who would use it for marketing purposes and therefore could avoid scattering losses. In order to create this database, the controller abused its position as postal service provider. In the postal service contract provided to data subjects the controller had included a notice stating that data subject are agreeing to their personal data being processed for marketing purposes. The contract however also included a box which could be ticked in order to refuse the data processing for marketing purposes. One of these affinities was concluded through an affinity score concerning the main political parties in Austria. For example, data subjects would be assessed with either a “very low”, “low”, “high” or “very high” affinity towards the SPÖ (the Socialist Party of Austria), the ÖVP (the Conservative Party of Austria) or any other major political party. The controller calculated this score through combing anonymous survey results, socio-demographic data (e.g., age or level of income and education) and voting results of particular region. On the 20 Febuary 2019, the DSB alleged that the controller had unlawfully processed sensitive data under Article 9 GDPR. The DSB found that the controller could no