GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
367 results · Showing 361–367
Österreichische Post AG
The Austrian postal service ("Österreichische Post AG", a private stock company, of which 52,9% is owned by the Republic of Austria) also sells data for direct marketing purposes ("list brokerage"). These lists include names and addresses and other factors that are largely generated using other public information and predictive models. The postal service also sold data that included a likeliness of the political affiliation (similar to: 45% social-democratic, 20% conservative, 5% Green Party). This was mainly intended for postal mailings by said political parties. The data was generated using public information about voting behavior in each voting district in Austria, aga and alike and was sold publicly. The postal service mainly relied on § 151 of the Austrian Business Code of 1994 ("Gewerbeordnung 1994", GewO) that regulates address brokers. The national law does not differentiate between different types of data, but limits the use solely to marketing purposes. The postal service took the view that predictions about the political affiliation of a data subject does not itself constitute "special categories of data" under Article 9 GDPR. A data subject (Dr. Christian Wirthensohn, a privacy lawyer) made an access request, receiving a copy of his alleged political affiliations (a percentage per political party). He sued the postal service for € 2.500 in emotional damages for a number of alleged violations (illegal processing of data, lack of data minimization, delayed access to data, lack of information). What is the relationship between national laws (like § 151 GewO) and GDPR? Is a prediction of a political affiliation a "special category of data" under Article 9(1) GDPR? How much are the damages under Article 82 GDPR in this case? The Court found a violation of the GDPR, as the data falls under Article 9 GDPR and awarded € 800 in emotional damages. The Austrian Business Code cannot override Article 9 GDPR. There are no rules on the calculation of damages in GDPR, so it is a matter of the Court's discretion to assess the amount. No violation of the principled of data minimization. There is no emotional damages in delayed access to data or a lack of information, therefore the additional € 1.700 were not granted.
Deutsche Bank Italia
Deutsche Bank S.p.A. asked a customer to provide his sensitive data in order to sign a contract for a bank account. The customer initially accepted the clause included in the contract, but then he withdrew his consent. As a result, the bank interrupted the service. The Court had to assess whether this sensitive data was necessary for the Bank in order to conclude a contract for a bank account. The Court found that the processing of the customer's sensitive data was not necessary for the execution of the relevant contract. Such a clause violates the principle of data minimization as provided for in Article 5(1)(c) GDPR. Consequently, according to Article 1418 of the Italian Civil Code, the contractual clause was declared invalid as contrary to mandatory rules.
Legelisten.no AS
In 2017, the Norwegian DPA Datatilsynet found that a company "Legelisten", running an anonymous review website of healthcare personnel, lacked a legal basis for processing and instructed them to allow said personnel to opt out of being listed and reviewed, in addition to several other instructions. Both the initial complainant and Legelisten responded to the DPA's decision with complaints. The DPA considered both complaints, but did not find any grounds to change their decision. Consequently, the case was submitted to the Norwegian Privacy Appeals Board, who considered comments from the initial complainant, Legelisten, the Norwegian Consumer Council, and the DPA. The Board focused their assessment on the lawfulness of processing of personal data on the website Legelisten.no. First, they considered the applicable law, as the GDPR had entered into force since the initial complaints dating back to 2012. They found that the GDPR would indeed apply. The Board reviewed several aspects relating to the case in question, summarised below. = The Board agreed with the DPA's finding that Legelisten is the controller for all processing of personal data related to their site (as listed above), for both users and the healthcare personnel, because they in all these instances determine how the personal data will be processed (the purpose) and the means (technical platform, layout, which processors to use). = The Board agreed with the DPA's finding that there were no exemptions or derogations for processing carried out for journalistic purposes in this case. = The DPA found that Legelisten lacked a legal basis for processing contact information (email address) of users submitting reviews, because they could not rely on consent as this was not found to have been provided voluntarily. The Board agreed that email addresses will often reveal the identity of a person and is, as such, personal data, and that information related to visits to or contact with specialist healthcare pers
Deutsche Post AG
The German Customs Authority, through a self-evaluation questionnaire, requested of Deutsch Post AG, all those natural persons who are in charge of managing customs matters (or those responsible for dealing with such matters) to send, among other things, the Tax Identification Numbers and the details of the tax offices responsible for their taxation. The German Customs Authority stated that, if there were no cooperation, it would be impossible to determine whether the requirements, which were laid down in the German Customs Code as well as in the Commission Implementing Regulation (2015/2447/EU), were satisfied. If it would be impossible to make that determination, then the German Customs Authority is obliged to revoke any customs authorisations held by Deutsche Post. Deutsche Post AG expanded upon the nature and extent of the personal data of third parties that must be submitted so that an undertaking can qualify for the customs status of an authorised economic operator (AEO). According to EU Regulation 2015/2447, customs authorities shall, after recognising the status of AEO, provide to the customs user some simplifications. For example, customs authorities shall not re-examine those criteria which have already been examined when granting the status of AEO. Deutsche Post AG claims that individuals who are undertaking affected by the fulfilment requirements raised by the German Customs Authority, are numerous. It also claims that some of those individuals are unwilling to agree to the transmission of their personal data. The third claim of Deutsche Post AG was that the collection of Tax Identification Numbers is neither necessary nor appropriate for determining the reliability of an entity, in terms of customs law, and the verification of the individual tax situation of all the individuals affected is disproportionate in relation to the objective. The main argument of the German Customs Authority is that the exchange of these data is necessary to ensure unmistakeable identification of the persons in charge of customs duties, as well as that the exchange of this information is provided only if the entity has evidence of serious or repeated infringements of the tax legislation and only on a case-by-case basis. The CJEU held that the reading of the provisions of the German Customs Code, or the provisions of the Commission Implementing Regulation (2015/2447/EU) indicates a list of affected individuals, whose list is exhaustive. The persons specified are solely the applicant, the person in charge of the applicant or exercising control over its management, and the employee in charge of the applicant's customs matters. Furthermore, it is stated that an applicant for AEO status should provide, annexed to the prescribed form for an application for that status, the names and positions within the applicant's organisation of a more extended list of natural persons than that to be found in the second subparagraph of Article 24(1) of Implementing Regulation 2015/2447. In order that customs authorities may respond to an application for AEO status, the provision implies that the applicant should be permitted access to data that makes it possible to establish that none of the natural persons specified have committed any serious infringements or repeated infringements of customs legislation and taxation rules and/or have any record of serious criminal offences relating to his economic activity. So the point is if the practice of those authorities involves the processing of personal data, within the meaning of Article 4(2) of Regulation 2016/679, EU legislation on the protection of that data must be respected. More particularly, the personal data must, under Article 5(1)(b) or 5(1)(c) of Regulation 2016/679, be collected for specified, explicit, and legitimate purposes and must be adequate, relevant, and not excessive in relation to those purposes, the processing of that data being lawful, under Article 6(1)(c) of that regulation, only if it is necessary for compliance with a legal obligation to which the Data Controller is subject. Inter alia, that entails an obligation to inform the data subjects of the transfer of that data. The CJEU considered the subsequent collection of that personal data by customs authorities in order to make a decision regarding an application for AEO status to be clearly necessary in order to comply with a legal obligation. To that extent, that data is collected, and therefore processed for specified, explicit, and legitimate purposes. Also, this data collection must be adequate, relevant, and not excessive in relation to the purposes for which that data is collected. In the CJEU's view, the fact of the customs authorities granting AEO status to an operator, in reality, is the equivalent of delegating to that operator some of the customs legislation control functions. Consequently, it is vital that before that status is granted, those authorities can obtain information on the reliability of the applicant for that status. Finally, regarding the level of responsibility of the persons in charge of managing customs matters or those responsible for dealing with such matters, it seems right that customs authorities require the questionable process of tax data collection, before granting of AEO status to an applicant.
Court case AWB - 18 _ 3073
The employer communicated sensitive data (pro justicia reports) to third parties without a legal basis and asked for damages. These were refused by the employer in the first place. The court order the employer (the Minister of Justice) to pay 300 # of damages for violation of the data protection legislation, considering that the privacy-sensitive personal data have ended up with a small group of professionals, i.e. employees and members of the Disciplinary Board, and that they have a duty of confidentiality by virtue of their position. This does not detract from the fact that the plaintiff's privacy has been violated and that this has understandably been perceived by the plaintiff as unpleasant and disadvantageous. All things considered, the court deems compensation of €300 to be fair.
Court case 8 C 130/18
A person received a spam email and asked from the sender a total amount of damages of EUR 500; the defendant acknowledged the claim in the amount of EUR 50 and the claimant still pursued the claim for an additional amount of at least EUR 500 of immaterial damages. The defendant contested the claim and asked the court to dismiss the claim. The defendant argued that the claimant had not suffered anything more than "minimal" damages. The court held that the infringement of GDPR as such without damages as a consequence thereof will not give rise to a claim for damages and that "minimal damages" do not give raise to damages under Article 82 GDPR. The decision is based on German literature on the GDPR.
Court case 11 O 1741/18 UWG
The defendant was a lawyer who ran her website. The applicant alleged that the website was not adapted to the requirements of the GDPR, because it did not contain all the legally required information about the processing of personal data (currently resulting from Article 13 GDPR). In addition, it violated the law on unfair competition (the applicant was also a lawyer). The Court prohibited the defendant from using her unencrypted website, related to her activity as a lawyer, without a data protection declaration compliant with the GDPR. The Court found that the defendant's action violates unfair competition laws.