GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 21 October 2026 · Updated daily
Tax Authority
In 2020, the data subject requested access to data concerning him from the tax authority (the controller) after a tax audit had been carried out on his wife. The controller replied that the data processed in this context did not concern the data subject. In February 2021, the controller reported a data breach to the competent supervisory authority. In the course of the tax audit, the case handler had sent the data subject's mobile phone number to his wife's work email address via unencrypted email without his consent. Subsequently, the data subject filed a complaint with the German Federal Data Protection Authority (BfDI). In March 2021, the data subject filed an action for information. In particular, he desired information on all data about him stored by the controller since 1972, a copy of the data and the deletion of all data. The Finance Court Berlin-Brandenburg fully rejected the data subject's claim. First, regarding the data subject's right to access pursuant to Article 15(1) GDPR, the court held that the data subject was not entitled to the requested unlimited and unspecified data disclosure. It stated that this right against controllers who process large amounts of data only exists if the request is sufficiently specified. The court rejected the data subject's view which mainly referred to the wording of the provision. Instead, it made a systematic argument. The court used Recital 63(7) GDPR and a comparison with Article 14(5)(b) GDPR according to which the fulfilment of information obligations vis-à-vis a person affected by a data collection from third parties can be omitted if the provision of this information proves to be impossible or would require a disproportionate effort. Here, the court emphasised that some scholars even apply Article 14(5)(b) GDPR analogously to Article 15(1) GDPR even though it did not create an analogy itself. In particular, the court argued that, if Article 15(1) GDPR had to be interpreted widely, the exercise of comprehensi
Court case 202100213/1/A3
Controller is the municipality of Eindhoven. The data subject found out that an email that they sent to the municipality on 15 January 2017 (in which they complained about their neighbours), had been forwarded and had ended up with their neighbours, without blacking out their email-address. Because they had not given consent for this, and the processing for personal data was not necessary to fulfil a public interest, the data subject requested the municipality to (1) rectify personal data mentioned in letters of 7 April 2016 and 14 November 2018, and (2) compensation for damages caused by forwarding their personal data without a legal basis. After the municipality had rejected the request, the data subject [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBOVE:2019:1827 brought the issue before court]. The District Court of Oost-Brabant dismissed this appeal, after which the data subject appealed this judgement before the Council of State. On appeal, the data subject argued that (1) The municipality had exceeded the decision period of one month as per Article 12(3) GDPR for their request to rectify the personal data, (2) the municipality should have also rectified personal data in the letter of 14 November 2018, and (3) The District Court had wrongly considered that the data subject was not entitled to compensation. The Council of State rejected the appeal. First, the Council stated that the municipality complied with the data subject's access request within the decision time of one month as per Article 12(3) GDPR. Second, the Council of State held that the right to rectification of personal data pursuant to Article 16 GDPR only applies to inaccuracies that can be easily and objectively ascertainable. Since the letter of 14 Novemer 2018 concerned impressions and conclusions with which data subject did not agree, the Council found that the rejection of the request for rectification was well-founded. Lastly, although it is not disputed between parties that the forwarding of email of 13 January 2017 without removing data subject's email address was unlawful, [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RVS:2020:899&showbutton=true&keyword=ECLI%3aNL%3aRVS%3a2020%3a899 the Council of State had previously considered] that a violation of the GDPR does not automatically entitle the data subject to compensation. Because the data subject could not plausibly demonstrate that the infringement caused damages, this ground of appeal was also rejected.
unknown data subject (complainant before the DSB)
In June 2018 the data subject sent a request under Article 17 GDPR to the credit reference agency, requesting the erasure of all processed data on previously unsettled debts. The data subject stated that all debts have been settled in 2013 in the course of fulfilling a payment plan resulting from insolvency proceedings. After the credit reference agency refused the erasure, the data subject filed a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB) in July 2018. The credit reference agency argued before the DSB that the data were still relevant for correctly assessing the data subject's creditworthiness under Article 5(1)(d) GDPR. Deleting the data would lead to incorrect results. In addition, the credit reference agency's interests under Article 6(1)(f) GDPR would outweigh those of the data subject. Furthermore, the credit reference agency demanded that the DSB would not deviate from Austrian case law prior to the applicability of the GDPR, according to which payment experience data could be stored for up to 7 years after the respective debt has been settled. The DSB partially upheld the complaint, ordering the credit reference agency to erase the data on a €497 debt from their database as it had been settled in February 2013. Regarding data on a €481 debt which had been settled in April 2018, the DSB rejected the complaint, as it considered this data still necessary to assess the data subject's creditworthiness and agreed with the credit reference agency that the processing can be based on Article 6(1)(f) GDPR. The credit reference agency filed an appeal against the the DSB's order to erase the data on the €497 debt. The BVwG upheld the DSB's decision. It emphasized that at the point of the decision of the BVwG, the debt had been settled for more than 9 years. Consequently, it considered the data to be to no longer relevant for assessing the data subject's creditworthiness. The BVwG also mentioned that even under case law prior to
Court case 13 U 84/19
The data subject is a user of the social media platform F (controller). The controller was of the opinion that two comments posted by the data subject violated the terms and conditions ("F's Community Standards"). As a consequence, the controller deleted the two comments and restricted the abilities of the data subject's profile temporarily. It also made a note of haven taken these measures against the data subject in case of future violations. The data subject filed a law suit against the controller. In this law suit the data subject requested, among others: 1. that the controller will be ordered to restore the two comments, 2. that the measures of the controller will be declared illegal, 3. that injunctive relief will be granted, 4. that the controller will be ordered to rectify the data so that the existence of a breach of the terms is deleted from the record and the counter recording the number of breaches is reset and 5. that damages will be awarded. The Regional Court Hannover dismissed the claim of the data subject entirely. The data subject appealed this decision. The appellate court - the Higher Regional Court Celle (Oberlandesgericht Celle - OLG Celle) - amended the judgement and granted the requests 1-3, but still denied the requests for rectification (4) and damages (5). After establishing that the data subject did not violate the terms and conditions, the court focused primarily on the application for rectification. The court concluded that the note of the controller about the deletion of the comments and the restriction of the account is not "inaccurate" data according to Article 16 GDPR, because the deletion and restriction of the account have indeed taken place. Furthermore, the court found that there is no indication that the controller actually stores a note in which it deems its measures to "have been proven lawful"[explicitly phrased this way by the court - see Comments on this]. The court further reasoned that even if the controller would have stored such a note, the data subject would still have no right to rectification under Article 16 GDPR, because the content would be a legal assessment and not a fact. The court concluded that legal assessments are opinions and opinions of private persons are, as far as they do not contain any factual elements, excluded from the scope of Article 16 GDPR because of the freedom of speech. The court then clarified that the controller's opinion would obviously have no legal effect. Only the court's ruling in the context of the application for a declaration (application 2 of the claim) has a binding legal effect on the question of the (un)lawfulness of the controller's measures. Regarding the application for damages, the court determined that the data subject is not entitled to damages under sentence 1 of Article 82(2) GDPR because the controller's measures - regardless of their contractual permissibility - did not constitute a violation of the GDPR. The court found that the data subject consented to the processing of the data. It, eventually, reasoned that the controller's breach of contract itself (the unlawful deletion of the comments) does not make the processing of the data unlawful.
Zakelijk Energie Beheer B.V.
The controller is Zakelijk Energie Beheer B.V., a company that (claims to) offer(s) customers to find the right energy provider. On 19 March 2021, the data subject was called by controller with an offer to join an “energy collective”, which he refused. On the same day, he requested the controller access to his personal information pursuant to Article 15, and to restrict the processing of his personal data pursuant to Article 18 GDPR. On 29 July 2021, the data subject received a reply to his access request. However, he received this reply from a third party, namely Regionaal Energie Beheer, which stated that it “obtained the personal data of [data subject] from marketing partners, through market research, surveys, etc.” and that, “in order to be able to offer its products and services, it needs the personal data of [data subject], for example in order to establish and maintain a relationship with him or to comply with legal obligations.” Moreover, this third party explained they share his personal data with (other) third parties and that they collected his personal data from the website https://www.enqueteloket.nl on 28 January 2021. The data subject then brought the issue before Court, and, among other things, requested the Court to order the controller to comply with the access request, to fulfil their information obligations under Article 14 GDPR, to erase his personal data, and to notify which recipients have received a notification pursuant to Article 19 GDPR. Moreover, he requested € 10,000 as compensation for his damages and the Court to refer preliminary questions to the CJEU regarding the notion of ‘damage’ in Article 82 GDPR. The District Court partially acknowledged the data subject’s claims. First, the Court considered that the data subject filed an access request with the controller, but got a response from a third party (Regionaal Energie Beheer), and not from the controller. Hence, the Court granted the data subject’s request to order the controlle
Stichting Bureau Krediet Registratie
The controller is Stichting Bureau Kredietregistratie (BKR), which manages the credit registration register (CKI). This register provides an overview of creditworthiness of people. Data subject has autism and has several registrations in the CKI, because of numerous payment arrears and neglected payment obligations, with several credit providers. These registrations make it impossible for them to find investors for their company, because investors find data subject not to be creditworthy enough. On 3 May 2021, data subject requested the BKR to remove all registrations relating to them from the CKI. The BKR rejected this request because it is only responsible for correct processing of the personal data it receives from the credit providers, and data subject had to submit their request to the providers. Data subject brought the action before Court, claiming that personal data were processed unlawfully. In particular, (1) the BKR processes their personal data without a legal basis, (2) the retention period of the registrations is too long, (3) the manner of registration of special codes referring to the registration is inadequate, (4) the accessibility of their personal data is insufficiently verifiable, and (5) the CKI does not meet the necessity requirement. Moreover, they requested the Court to order the BKR to remove all registrations relating to them from the CKI, because their interests overrode the interests of the BKR. Lastly, they claimed the BKR cannot simply refer them to the credit providers because the BKR is also a controller. Regarding the first claim that personal data is processed unlawfully First, the Court stated that, referring to a recent judgement of the Dutch Supreme Court, it is clear that the BKR has a legitimate interest to process data subject’s personal data, pursuant to Article 6(1)(f) GDPR. Second, the Court found that, although it is not laid down in law, the retention period of 5 years does not violate Article 5(1)(c) GDPR, because
Court case III OSK 4763/21
The proceedings started with a complaint made to the Polish DPA (UODO) in which a data subject claimed that the processing of their personal data by a non-standardised securitisation fund (fund) was not justified and lacked legal basis on the grounds that the debt being collected by the fund was non-existent. The plaintiff therefore requested that all of their personal data be removed from the fund’s database in accordance with Article 17(1) GDPR. The personal data obtained by the fund included: name, surname, date of birth, gender, national identification number, correspondence addresses, telephone number, e-mail address, as well as information on the claim broken down to financial components, including principal amount, interest and bank account number dedicated to debt repayment, the date of the contract and the date of termination of the contract. The UODO decided that the processing of personal data by the fund was lawful, since the fund acquired the debt from an original creditor in the performance of a contract under Article 28 GDPR. The UODO stated that as a debtor, the data subject must consider that their right to privacy may be limited in connection with the recovery of debts. The UODO emphasized, however, that it had not examined the factual elements regarding the existence of the debt or its amount, which are issues that should be determined by civil courts. The claimant, which disputed the existence of the debt, specifically complained about receiving importunate telephone calls by the fund. With regards to these allegations, the UODO explained that this issue must be considered in the context of established practices applied by debt collection agencies. The UODO, therefore, decided that the fund was not obligated to grant the data subject's erasure request, since it had a legitimate interest and legal basis for processing the data. The data subject appealed this decision to the Voivodship Administrative Court in Warsaw, on the basis that the UODO inco
Veilig Thuis
Controller is Stichting Veilig Thuis, a public organisation that deals with cases or suspicions of (suspected) domestic violence or child abuse. The data subject is a 11-year-old child that had been missing school several times. After Veilig Thuis received reports from the data subject’s school regarding truancy, it sent the mother an email, in which it stated (among other things) that “Veilig Thuis has made the agreement with the obligatory education officer that she will contact Veilig Thuis if the safety of the child is jeopardised again or continues to be so (e.g. when you do not accept the help that is offered)”. The mother did not agree with the wording and requested to rectify the dossier, pursuant to Article 16 GDPR, by removing the word “again”. Moreover, she requested to have the whole dossier erased, pursuant to Article 17 GDPR. Veilig Thuis rejected both requests, which led the mother to [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBZWB:2021:1970&showbutton=true&keyword=C%2f02%2f381362+%2f+HA+RK+21-16 bring the matter before court]. The District Court of Zeeland-West-Brabant, however, rejected the appeal. Regarding the deletion request, it decided that it cannot be assumed that the interests of the child’s legal representative (the mother) and the child will always coincide. Moreover, it noted that Veilig Thuis had been involved with the family for some time, had concerns about the child’s school negligence. Thus, it found that Veilig Thuis had a reasonable chance to judge that the substantial interest of the child required that Veilig Thuis saved the data, and that this substantial interest of saving the data outweighed the interest of the mother to erase the data. Regarding the rectification request, the Court considered that the right to rectification is not meant to correct or remove impressions, opinions, research results and conclusions with which the person concerned does not agree. The District Court, however, did not order the mother to bear the cost of proceedings. Both the mother and Veilig Thuis appealed this judgement: the mother on the grounds that the erasure request must be honoured, and Veilig Thuis on the grounds that they should not pay their own costs of proceeding since they won the case. First, the Court of Appeal rejected the appeal. It considered that Veilig Thuis processes personal data and carries out a task in the public interest and for reasons of public health, as follows from the Dutch Social Support Act 2015 (Wmo). Therefore, Article 13(3)(b) and Article 17(3)(c) GDPR apply, and the deletion request must be assessed on basis of the Wmo. After the assessment, the Court confirmed District Court’s Decision, since it considered that the substantial interest of Veilig Thuis outweighed the interest of the mother. Second, the Court of Appeal did not order the mother to pay the cost of proceedings made both in the first instance and in the appeal proceedings. It considered that the right to an effective remedy, pursuant to Article 79 GDPR, entails that “irrespective of the outcome of the substantive side of the appeal, if a difference of opinion regarding the implementation of the [GDPR] is actually at issue.” The Court considered the height of the costs (€ 5,856.00) and found that it was disproportionate to order the mother to pay the costs of proceedings because this would preclude her right to an effective remedy.
Law firm
The data subject is a client of a law firm, acting as a controller. The controller sued the data subject for payment of attorney's fees. The data subject counterclaims for their right of access pursuant to Article 15 GDPR, in particular to provide a copy of the personal data pursuant to Article 15(3) GDPR, as well as their right to receive compensation for damages suffered pursuant to Article 82 GDPR. The controller is of the opinion that it already provided the data subject with a copy of personal data as all incoming and outgoing documents were sent to the data subject without undue delay. Furthermore, it claimed that there is only a right to copies of those data that contain concrete information about the data subject. The controller also believes that the claim is time-barred. According to the data subject, the controller did not provide a copy of all personal data. The right to a copy of the personal data also includes a copy of the manual files of the controller. The data subject claims that they are entitled to the payment of damages suffering for the delayed and still incomplete provision of the personal data. The court held that the data subject is entitled to claim for the controller to receive a copy of all personal data including a copy of personal data contained in the manual files. Since the counterclaim was served to the controller on 4 February 2021 and thus before the expiry of a standard limitation period of three years, calculated from the entry into force of the GDPR, the claim cannot be time-barred. The court further held that the data subject is not entitled to claim compensation for the delayed right of access. The violation of the GDPR alone is not sufficient to trigger a claim for damages. Rather, the data subject affected by a data protection violation must have suffered a noticeable disadvantage. There must be an objectively comprehensible impairment of personal interests that carries a certain weight and of a certain significance. It is undisputed that the non-material disadvantages referred to in Recital 75 GDPR did not arise for the data subject.
DSB (Austria)
The data subject has requested access to their personal data under Article 15 GDPR. The controller (Arbeitsmarktservice Österreich) did not fulfill the request at first. Later – during the administrative proceeding – the controller, however, did. Thereupon, the DSB (Austria) informally closed the proceeding. The data subject objected to the termination of the proceedings on the grounds that the answer to their request was too late and was insufficient. The DSB maintained its decision arguing that the data subject has no right to have a past violation of the GDPR determined and that the assertion of insufficiency is be regarded as a new submission under § 13(8) AVG since it changes the substance of the matter. The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision and reasoning of the DSB. First, the court elaborated on Article 15 GDPR though these statements were not necessary for the decision of the case. It held that a data subject has no general duty to cooperate, but at most an obligation to specify if the controller processes a large amount of data and the data subject makes a very general request or is only interested in specific information or data processing. In these cases, the controller can request clarification from the data subject, but has no right to do so. The data subject may nevertheless insist that all data be disclosed. This means that the two-stage information procedures that occur in practice, in which the data controller initially only provides information on master data and only provides comprehensive information at the express request of the applicant, are perfectly permissible, provided that the applicant is made aware of this fact. Second, the court determined that the DSB was not allowed to close the proceedings informally but should have issued a formal notice according to § 24(6) BDSG because the data subject had objected with reasons against the termination of the proceedings. Third, the court stipula
Court case W211 2234354-1
The data subject had requested access under Article 15 GDPR from the controller (a credit reference agency). The controller replied on the request but provided only very superficial information about the processing logic involved and the significance and the envisaged consequences for the data subject (Article 15(1)(h) GDPR). In particular, it remained unclear to the data subject as to how the controller had calculated certain credit scores. Consequently, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB). The DSB upheld the complaint and ordered the controller inter alia to provide the data subject with meaningful information about the logic involved in the creation of the credit scores, as well as the significance and the envisaged consequences of these scores for the data subject. The controller filed an appeal against this decision with the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG did not decide on the appeal but suspended the procedure. It held that of the main questions of the procedure was, whether the calculation and disclosure of a credit score by a credit reference agency as such qualifies as a "decision, which produces legal effects concerning the data subject or similarly significantly affects the data subject" within the meaning of Article 22 GDPR. As the Verwaltungsgericht Wiesbaden had already requested the CJEU's preliminary ruling under Article 267 on that matter, the BVwG decided to wait for the CJEU's ruling before further trying the case.
Court case 2 AZR 235/21
The data subject is an employee of the controller. The controller terminated the employment contract because of allegations against the data subject which had been made in a specially set up platform of the controller to uncover mismanagement within its business. The data subject filed a lawsuit against the termination of the contract in which he, among the others, requested access to his data under Article 15 GDPR. The data subject won the lawsuit with regard to the termination of the contract. The part relating to Article 15 GDPR was separated from the rest of the lawsuit. The data subject limited its application under Article 15(1), (3) GDPR to data on his "personal performance and conduct" which is "not stored in his personal file". The Regional Labor Court Baden-Württemberg (Landesarbeitsgericht Baden-Württemberg - LAG Baden-Württemberg) upheld the claim. The Federal Labor Court decided that the claim was inadmissible according to § 253(2)(Nr. 2) ZPO (Code of Civil Procedure) since the request to access was not specific enough. The court affirmed that a claim must be so specific that it can be enforced later on, otherwise uncertainty would be created for the defendant and the enforcement authorities. The court further reasoned that the use of terms which are subject to interpretation is only allowed if, on the one hand, further specification is not possible or reasonable for the plaintiff, and, on the other hand, there is no doubt for the parties as to their meaning, so that the scope of the application and the judgment is certain. The court found that it was possible for the data subject to specify its request because his submissions showed that he actually knew which data he wanted access to. Furthermore, it found that "personal performance and conduct" and "not stored in his personnel file" are not sufficient specific terms as they are not defined by law or jurisprudence and don't have a definite common meaning.
Court case W176 2245370-1
The controller operates a doctor search and evaluation platform. The data subject is a doctor for skin and venous diseases. In December 2019, the data subject used the reporting function of the platform to request the deletion of a user's review pursuant to Article 17(1) GDPR. The controller did not remove the disputed review from the platform, but instead published the controller's request for deletion on the platform, arguing that there is a legitimate interest for the publication of this information under Article 6(1)(f) GDPR. The data subject objected to the publication and lodged a complaint with the Austrian Data Protection Authority (DSB). The Austrian Data Protection Authority (DSB) disagreed with the controller's view. It stated that, generally, such evaluation platforms and the associated processing of personal data are covered by the right to freedom of expression in accordance with Article 10 ECHR and Article 11 CFR. It further reasoned that, usually, the added social value created by the evaluation platform or the interests of the broader public outweigh the interests of the data subject, so that the publication of comments by users of this platform can in principle be based on Article 6(1)(f) GDPR. The DSB, however, concluded that, since the data subject used the report function and not the comment function of the page, the use of the data was intended exclusively for the purpose of reporting and, therefore, the data subject did not reasonably have to expect the publication of the data. Consequently, the DSB found that the legitimate interests of the controller or the platform users (i.e. the patients) did not outweigh the legitimate interests of the controller and, therefore, the controller violated the data subject's right to deletion. The controller appealed this decision. The Federal Administrative Court of Austria (Bundesverwaltungsgericht - BVwG) agreed with the position of the DSB. In particular, it confirmed the balancing of interests performed by the DSB. Furthermore, it held that the controller was obliged to delete the published request for deletion under Article 17(1)(d) GDPR and that the controller could not invoke Article 17(3) GDPR, because non of its requirements were met in the case at hand.
Nauta Dutilh
The controller is Nauta Dutilh, a law firm. The data subject is a former advisor of a government institution, the “House for Whistleblowers” (the House), which is a public organisation where whistleblowers can report “societal abuses” and which investigates the treatment of whistleblowers. Between September 2018 and May 2019, the data subject reported several suspicions of wrongdoings, concerning the general functioning of the House, and the appointment procedure of their chairman. On 2 May 2019, the data subject reported internal (confidential) suspicions of wrongdoings to two newly appointed board members of the House. On 21 May 2019, the data subject was suspended, after which he was formally fired on 26 July 2019. The data subject suspected that the chairman and two board members which he contacted, had been advised by the law firm Nauta Dutilh, the controller in this case. On 25 July 2019, the data subject made an access request with the controller, and requested a copy of his personal data pursuant to Article 15 GDPR. The controller confirmed that they processed his personal data (name, last name, address, email-address, and picture), but also stated that they cannot provide all information due to professional confidentiality. The data subject brought the case before Court, requesting the Court to order the controller to provide him and the Dutch DPA with a copy of all personal data relating to him and all processing thereof processed by Nauta, and all information listed in Articles 13, 14, and 15 GDPR. However, the Court considered that the controller’s professional confidentiality limits the data subject’s right of access pursuant to Article 23 GDPR, and did not find any violations. The data subject then filed an appeal. The Court of Appeal rejected the appeal. First, it confirmed the argumentation of the Court of first instance. The Court of first instance stated that the right of access can be restricted by a legislative measure pursuant to Article 2
Hoist Finance
On 1 February 2010, the data subjects obtained credit of €28,500 from the credit lending company "Hoist Finance” (the controller). Soon after the agreement, first arrears in payment occurred in September 2010. Since these payment arrears still existed in 2014, the controller notified the data subjects that this could lead them to register these arrears with the Bureau Credit Registration (BKR), and subsequently did so. The debt further increased and the data subjects and controller set up a debt repayment scheme. In 2019, the controller exonerated the data subjects from paying a part of the controller's interest. Ultimately, in 2020, the debt was completely settled. However, the payment arrears, and the notification of exoneration of a part of the controller's interest, were still registered with the BKR. Moreover, these registrations would not be deleted from the BKR's database before October 2025. The data subjects requested the controller to explain the proportionality and subsidiarity of the BKR registration, and to have the registration deleted. The controller, however, argued that the registration sufficed these requirements and rejected the erasure request. Because the data subjects experienced financial issues from the registration, i.e. because they had troubles getting a mortgage, they brought the issue before Court. The District Court Amsterdam upheld the claim. First, the Court noted that, currently, there is debate in the judiciary about the legal basis registering payment arrears with the BKR: either Article 6(1)(c) GDPR or Article 6(1)(f) GDPR. The Court referred to the [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:PHR:2021:831&showbutton=true&keyword=ECLI%3aNL%3aPHR%3a2021%3a831 conclusion of Advocate General] in a similar case that ended up before the Dutch Supreme Court, in which the AG concluded that Article 6(1)(f) GDPR is the correct legal basis. The District Court followed the reasoning of the AG and noted that, therefore, the
Regional Public Health Service (RDOG) Hollands Midden
The controller is the managing board of the Regional Public Health Service (RDOG) Hollands Midden. The data subject is a person who was reported anonymously to the Care and Nuisance Reporting Centre of the Municipal Health Service (GGD) Hollands Midden. This Reporting Centre discussed the report in their meeting, and decided that this was not a task for them, so they closed the file. However, controller also received a notification of this report, and registered this notification in their system by mistake. Moreover, the controller did not inform data subject about this notification. After the data subject became aware of the existence of the notification at the beginning of 2020, they wanted to find out who reported them. Hence, they filed an access request pursuant to Article 15 GDPR, after which they received a copy of the report that was made. However, because the report was anonymous, a passage containing personal data of the person who reported them, was omitted. Data subject wanted to know the identity of this person, so they could pursue further legal claims against them, and brought the action before court. The Court rejected the appeal. First, it stated that the controller wrongfully did not inform the data subject regarding the notification, violating Article 13(1) GDPR. The controller, however, had already acknowledged this, apologised to the data subject and adjusted the work process to avoid a similar situation in the future. Second, the Court considered data subject’s claim to know the identity of the person who reported them. It stipulated that the GDPR is not intended for this purpose, since the purpose of the right to access is to enable the data subject to inform themselves of the processing of their personal data and to check the lawfulness thereof. According to the Court, it is not the controller’s task to enable the data subject to improve their legal claim against another entity, via the GDPR. Moreover, the Court stated that, pursuant to Article 15(4) GDPR, the right of access cannot infringe the rights and freedoms of others, and, pursuant to Article 23(1)(i) GDPR, this right may be restricted (in brief) on account of the rights and freedoms of others. Hence, the Court found that the removal of personal data of the third parties was justified for the sake of their privacy. It even stated that the controller supplied more information than needed under the GDPR, since the mere notification that data subject’s personal data was processed, would have been sufficient.
Court case 2021-17
The data subject had been convicted of accessing, possessing and publishing images and videos containing sexual assaults on children. The criminal offences had taken place over a period of 20 years. During this time, the data subject worked as a psychiatrist and as an expert witness in cases relating to family and children welfare. After having served their prison sentence, the data subject contacted Google and asked to have five search results removed from the search engine. The data subject argued that the search results had a severe negative impact on them and their children. Google denied the request, stating that the search results were a matter of public interest. The data subject brought the case before Datatilsynet (The Norwegian Data Protection Office). Datatilsynet concluded that Google had to delete the search results. Google filed an appeal, and the case was brought before the Privacy Appeals Board (PVN). The PVN had to consider only two of the five search results, as the rest had been deleted before the start of the proceedings. The PVN first remarked that Google as a controller had a legal basis for their processing in article 6(1)(f) GDPR. However, according to article 17(1)(c) and article 21(1) GDPR, upon receiving an erasure request from the data subject, the search engine company would have had to delete the search results unless there were overriding legitimate grounds for not doing so. The PVN highlighted that the controller had the burden of proof when it came to such legitimate grounds. The PVN then noted that when a person working closely with children as a public figure is convicted for sexual offences relating to children, there is an obvious legitimate interest in making this information accessible to a wider audience. Although the legitimate interest is reduced over time, the PVN considered the time passed in this case (almost 4 years) to be rather short. On the other hand, the PVN argued that the search results contained information on
HOIST FINANCE AB
This case concerns an interlocutory judgment in the case [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBAMS:2021:174&showbutton=true&keyword=C%2f13%2f694440%2fKG C/13/694440/KG ZA-20-1118 MvW/JE dated 21 January 2021], in which the interim relief judge of the District Court of Amsterdam referred questions to the Dutch Supreme Court for a preliminary ruling pursuant to Section 392 RV. Controller is Hoist Finance. The data subject had taken out a loan with the controller. The controller claimed this credit after payment arrears had occurred. Because payment arrears had occurred, the data subject was registered in the Central Credit Information System (CKI) of the Credit Registration Office (BKR) with a special code "A". This special code was then adjusted in the following months do display that the claim had been claimed, and that the amount exceeded a certain threshold. After the debt had been settled, and the processor notified the controller of this, the controller ensured the data subject that it would have the entry removed from the BKR registration, which indicated that the amount of the claim exceeded a certain threshold. Because the controller did not comply with the request, the data subject submitted another request, which was rejected by the controller. The District Court of Amsterdam referred the following preliminary questions were put to the Supreme Court: 1. Must the processing of specific personal data by a credit institution, by means of an individual registration in the system of BKR, be assessed in accordance with the provisions of Article 6(1)(c), Article 6(1)(f) GDPR, or both provisions? 2. Does the answer to Question 1 mean: a) that the person whose personal data have been recorded is not entitled to invoke the right to erasure provided for in Article 17 GDPR? b) that person is not entitled to a right of objection as referred to in Article 21 GDPR? 3. If the answer to Question 2b means that, in the case of a BKR registration, there is no right of objection within the meaning of Article 21 GDPR, does that mean that Article 35 of the Implementing Act General Data Protection Regulation (UAVG) plays no role in the legal proceedings to have that registration removed? The Supreme Court decided that Article 6(1)(c) GDPR cannot serve as a legal basis for the processing of personal data in the CKI of the BKR, and that such processing must be examined in accordance with Article 6(1)(f) GDPR. The answer to the second question was therefore that the data subject whose personal data have been registered with the BKR, is entitled (a) to erasure as referred to in Article 17 GDPR and (b) to the right of objection as referred to in Article 21 GDPR. The first question To answer the first preliminary question, the Supreme Court first assessed whether there was a legal obligation to process the personal data, and examined Article 4:32 (1) of the Financial Supervision Act (Wft) which creates this legal obligation. This provision prescribes that a creditor, in this case the controller, participates in the credit registration system. Article 4:34 of the same Act contains the duty of care to prevent excessive lending and the investigation of the financial position of the data subject. In the Netherlands, the performance of these duties by lenders is translated into registration in the BKR's CKI. The CKI, however, has no legal basis. It is based on self-regulation by the financial sector, which is accepted by the legislator. Article 3(4) of the CKI General Regulation states that the processing of personal data in the CKI is based on Article 6(1)(f) GDPR, because the processing is necessary to serve the legitimate interests of the BKR and its business customers. Furthermore, the Supreme Court assessed whether the processing could be based on Article 6(1)(c) GDPR, because Articles 4:32 and 4:34 Wft oblige credit providers to participate in, and consult a credit registration system. The Court noted that Article 6(3) GDPR read in conjunction with Recital 41, requires that the Member State legislation, in such a case, "should be clear and precise and its application should be foreseeable to persons subject to it". The provisions do not suffice this requirement, since it is not specified which personal data must or may be registered in the CKI, what the conditions for such registration are, and under what conditions and within what time limits, personal data must be deleted. This is all regulated in the CKI regulations, but these regulations have no legal basis. Therefore, these provisions do not create a legal obligation within the meaning of Article 6(1)(c) GDPR. The second and third question Since Article 6(1)(f) GDPR is the legal basis for the controller's processing of the personal data in the CKI, the answer to the second preliminary question is therefore, that the data subject whose personal data have been registered in the CKI is entitled exercise his right to erasure, Article 17 GDPR, and right to object, Article 21 GDPR. The third question will not be discussed since it is based on the assumption that there is no right of objection.
Google LLC
Google LLC (the controller) had asked the Administrative Court of Helsinki to overturn [https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_918/154/2019 the Finnish DPA's decision], according to which the controller had been ordered to remove outdated search result links from Google Search. The controller filed the appeal claiming that the search results were necessary for exercising the right of freedom of expression and information within the meaning of Article 17(3)(a) GDPR. The controller also stated that there were compelling legitimate grounds to keep the search result links available to the public under Article 21(1) GDPR, as the data subject acted in a public role. The DPA argued that the date indicated in the news articles to which the search result links led did not guarantee that the reader understood the information as describing past events. Thus, a reader who ignored the date of the news article could think that the police was still seeking information about the data subject's whereabouts. The Court found that the controller processed the personal data for the purposes of its legitimate interests in accordance with Article 6(1)(f) GDPR. Therefore, the data subject must be considered to have objected to the processing of their personal data on grounds relating to their particular situation in accordance with Article 21(1) GDPR. In this respect, the Court considered that the data subject could be considered to have a public role in terms of balancing the interests between the right to privacy and freedom of expression due to the commission of a serious crime. The data subject could also be considered to have a public role as CEO and board member of a real estate agency. The Court noted that the news articles to which the search result links led indicated the date on which the news had been published. Thus, the fact that the general public might mistakenly believe that the arrest warrant against the data subject was still valid could not be given decisive weight in the balancing of interests. In light of this, the Court held that the data subject's right to privacy did not override the public interest in access to information concerning the data subject. As a result, the Court overturned the contested decision and the order contained in it to remove the search result links.
Court case AWB- 20_5521
Controller is the municipality of Zundert. Data subject requested access to the personal data that was being processed by the municipality pursuant to Article 15 GDPR. In particular, they requested to provide them with a list of all data carriers, whether available in paper or other form, and by additionally providing them with copies or extracts of those data carriers. The controller provided the data subject with an overview of the personal data relating to them processed during the period from 3 October 2017. However, the controller refused to provide copies and extracts of documents. Data subject was not content with the summary of their processed personal data, and objected to the decision. This objection, however, was declared unfounded by the controller. Hence, the data subject appealed to the District Court and argued, inter alia, that providing merely a summary of the processed data was an insufficient reply to his request. The controller argued that data subject should have given a copy of the underlying files on which the summary was based. The Court rejected the appeal. First, it considered that, although it became clear (also from data subjects' explanation at the hearing) that the data subject used the access request to gain access to documents, which the municipality had refused to disclose on the grounds of the Government Information (Public Access) Act (Wob), the municipality did not take this data subjects' intention in the decision. Second, the Court held, referring to the judgement of 3 March 2021 of the Council of State (RvS), that Article 15(3) GDPR is not intended to ensure the data subject access to administrative documents containing personal data. Although an administrative body can decide to provide a copy of these documents, it is under no obligation to do so. The Court affirmed that an the municipality has sufficed by providing an overview.