GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
Doctor versus Online Review Platform
The data subject, a doctor, sought an injunction against the Controller, the operator of an online review platform, requiring the removal of, and prohibiting the future publication of, a notice stating that between six and ten reviews concerning his medical practice had been removed during the previous year following complaints relating to defamation under German law. The Regional Court of Cologne dismissed the application, following which the data subject lodged an immediate appeal before the Higher Regional Court of Cologne. The data subject argued that the notice was inaccurate because the reviews had been challenged on the basis that no genuine patient relationship existed, rather than on the ground of defamation. He submitted that the notice therefore created the false impression that he had complained of defamatory reviews, rendering the processing of his personal data unlawful. The Controller argued that complaints alleging the absence of a genuine customer or patient relationship fell within its internal category of complaints concerning defamation under German law and that publishing the number of removed reviews promoted transparency regarding its review moderation process. The court held that where a data subject seeks not only the erasure of personal data but also an injunction preventing its future publication, Article 17(1) GDPR provides a basis for both forms of relief. It further held that the journalistic exemption under Article 85(2) GDPR did not apply because the Controller's review platform, including the automated notices relating to removed reviews, did not process data for journalistic purposes. The court also held that the displayed number of removed reviews constituted personal data within the meaning of Article 4(1) GDPR because it related to an identified natural person. By storing and disclosing that information, the Controller processed personal data within the meaning of Article 4(2) GDPR. In assessing the accuracy of the notice under Article 5(1)(d) GDPR, the court considered how an average user would understand the information. It held that a prominently linked information page entitled "Defamation under German law" explained that the platform categorised not only false or reputation-damaging reviews, but also complaints alleging that the reviewer was not a genuine customer, as complaints concerning defamation. As the data subject did not dispute that he had successfully requested the removal of between six and ten reviews on the basis that the reviewers had not been genuine patients, the court concluded that users could readily understand the platform's use of the term and that the notice was factually accurate. The court also rejected the data subject's reliance on the Festzins Plus judgment (BGH, judgment of 21 September 2017 – I ZR 53/16), distinguishing that case because the corrective information there appeared only at the end of a lengthy and unclear text, whereas the notice in the present case contained a clearly highlighted hyperlink directing users to explanatory information specifically addressing the platform's categorisation of review removals. The court held that the Controller had legitimate interests in promoting transparency regarding its handling of review-removal requests and that publication of the notice was necessary for that purpose. These interests outweighed the data subject's rights because the notice related only to his professional activity, was presented in a factual manner, contained no criticism of his behavior and was not prominently displayed, appearing only after users selected the "Reviews" tab. Accordingly, the court concluded that the processing was lawful under Article 6(1)(f) GDPR and that the data subject was not entitled to erasure or an injunction preventing the future publication of the notice under Article 17(1) GDPR.
Court case 8 O 203/24
A German user (the data subject) brought court proceedings against two online gambling service providers (the controllers) established in Malta. They offered online casino games and sports betting services that were accessible to everyone in Germany. The data subject requested access to the data concerning him processed by the controllers in April 2024. He wanted to obtain certainty about the lawfulness of the processing of his data and determine the extent of his gambling behaviour as well as the claims to which he was entitled against the controllers. The data subject claimed in court that the controllers had not fulfilled his access request and should therefore be ordered to jointly and severally provide him access to his complete gaming and transaction data pursuant to Articles 15(1) and 15(3) GDPR. The controllers stated that they had already provided the data subject access to the information he had requested and stated that the action should be dismissed. The court held in a partial judgment that the action was admissible and largely justified. In order to pay winnings to the data subject, the controllers inevitably had to verify his identity and thus process his personal data. The court ordered the controllers to provide the data subject information about the personal data processed in context of the customer relationship, particularly data concerning the data subject’s gaming history and all transactions on his gaming accounts. The access request was not manifestly unfounded or excessive within the meaning of Article 12(5) GDPR. The court also held the controllers had not previously provided the data subject access to the required information in accordance with Articles 15(1) and 15(3) GDPR. However, the controllers were legally independent and did not operate the online gambling websites jointly. Therefore, the obligation to fulfil the access request was to be limited to their individual websites.
Kindred Group PLC
Kindred Group PLC and Risepoint Limited (the controllers) are companies that provide online gambling products. Several companies within Kindred Group PLC (Risepoint was initially in this group) offered online gambling products before a national law requiring a license entered into force. In response, several lawsuits were filed before courts regarding the validity of the gambling agreements between players and unlicensed online gambling providers. Several data subjects later requested access (Article 15 GDPR, or in the alternative, the right to portability under Article 20 GDPR) to the controller to receive information on specific transaction data and the types of games they participated in. The data subjects did not receive access and brought a claim to the court. The data subjects requested the court to hold both companies liable (jointly or separately) The court initially dismissed the claim based on the code of civil procedure, but allowed the data subjects to amend their arguments regarding the GDPR. Both companies argued that they were not controllers, and that the requests made by the data subjects were abusive. According to the companies, the data subjects requested access for the sole purpose of bringing legal actions against them. Finally, the companies argued that they did not have the obligation to comply with the requests under Article 15(4) GDPR. The court first clarified that both Kindred Group PLC and Risepoint Limited were controllers. Kindred Group PLC argued that it did not exercise any decisive influence over the purpose and means of processing. The court took into consideration the functional definition of “controller” under Article 4(7) GDPR and CJEU case law, rather than a formal definition.See cases C-40/17 (Fashion ID), margin 65; C-210/16 (Wirtschaftsakademie Schleswig-Holstein), margins 26 and 27 The court found that Kindred Group PLC was a controller for access made between May and October 2024, but not for requests made after October 2024. This is because Kindred had a unified privacy policy for companies under its group, and answered the access request from an email address containing its name. However, after October 2024, Risepoint was no longer a part of the group, and the data from Kindred had been transferred to Risepoint. The court then dismissed the controllers’ arguments, and stated that the access requests were not abusive under Article 12(5) GDPR. Under Article 12(5) GDPR, a controller may refuse a request for access if it is manifestly unfounded or excessive. However, the CJEU has clarified that a data subject does not need to justify an access request, and a controller cannot refuse a request for access on the sole ground that it serves a purpose other than obtaining information about the processing of personal data and verifying its lawfulness.See case C-307/22 (FT/DW), margin 43 In any case, the court stated that the controller bears the burden in proving that a request is manifestly unfounded or excessive. Similarly, the controllers could not rely on Article 15(4) GDPR to refuse the data subjects’ requests. The court stated that the controllers’ interest in not granting information that data subjects could use against them in court is not recognised under EU law as a basis to refuse access. While the GDPR allows for national law to restrict specific rights under Article 23 GDPR, the court stated that the restriction must be necessary and proportionate. This, however, does not apply for hypothetical situations. The court upheld the data subjects’ claim, and ordered the controllers to provide them with a copy of their transaction data. The court specified that the controllers had the obligation to provide a complete copy, in accordance with CJEU case law.See cases C-307/22 (FT/DW), margins 72-75; C-487/21 (Österreichische Datenschutzbehörde and CRIF), margin 32
Court case Us I-451/2025-10
In 2022, a Croatian media outlet published articles about a person (data subject) who was, at the time, a member of the management board of Zagrebački holding d.o.o, a City of Zagreb-owned holding company providing municipal and utility services. The articles disclosed their name, the company where they were employed, their position, gross salary, the model of their personal vehicle, the gross monthly allowance for using a private vehicle, and the amount of a fine imposed by the Croatian Commission for the Resolution of Conflicts of Interest. The data subject held the management board position from September 2021 to March 2023. The data subject lodged a complaint with the Croatian DPA, alleging that the publication infringed their right to the protection of personal data and requesting the removal of the articles. The DPA rejected the complaint and found no violation. It concluded that the published personal data were appropriate, relevant and necessary for informing the public, due to the data subject’s position at the time of publication and because the public interest prevailed. The DPA also found that the public interest in the continued availability of the articles outweighed the data subject’s request for erasure under Article 17 GDPR. It pointed out that Article 17(3)(a) GDPR stipulates that the right to erasure does not apply to the extent that the processing is necessary for the exercise of the right to freedom of expression and information. The DPA considered the Croatian Media Act, noting that it applied as a special law. The Act regulates conditions for media freedom, the rights of journalists and access to public information. The DPA determined that according to Article 8 of the Media Act, there was no violation of the right to privacy if a legitimate public interest prevailed over the protection of privacy in relation to journalistic activities. The data subject contested the DPA’s decision before the Administrative Court of Zagreb. They argued that they were not a public figure, that they no longer held any public position after 1 April 2023, and that the continued availability of the articles damaged their reputation and met the conditions for erasure under Article 17 GDPR. The media outlet stated that all published information about the data subject was obtained from publicly available sources, as they were subject to proceedings by the Commission for the Resolution of Conflicts of Interest and had also been published by the city-owned company. The media outlet argued that the case involved information of significant public interest due to the fact that they concerned an investigation that revealed misconduct of a person in a public position, who was in fact fined for that reason. They further stated that the Croatian Constitution and the Media Act granted the media the right to freely report on such information. Regarding the initial publication, the court held that the Croatian Media Act served as a legal basis for the processing of personal data under Article 6 GDPR. It found that since the data subject had performed a public duty as a member of the management board of a city-owned company, the public interest in being informed prevailed over the protection of their personal data. The media outlet therefore had the right to publish information containing personal data to the extent that the data were relevant and necessary to achieve the purpose established by law. Regarding the removal of the articles, the court held that the DPA had correctly found that there was still a relevant legal basis for the continued processing of the data under Article 6(1)(f) GDPR. It confirmed that the public interest continued to prevail, thereby justifying the continued availability of the data subject’s personal data in the articles for the purpose of public disclosure by the media. It further upheld that the conditions for erasure under Article 17 GDPR were not met, in light of the Article 17(3)(a) GDPR exception for the exercise of freedom of expression and information. The court dismissed the appeal and upheld the DPA’s decision. It also awarded €1,250 in costs to the media outlet.
Data Subject versus Regional Public Broadcasting Authority
The data subject had been liable to pay broadcasting contributions to the Controller, a German regional public broadcasting authority, since 2007. Following objections to several contribution assessment notices, the data subject submitted a request under Article 15 GDPR seeking a copy of all personal data processed about him by the Controller. The Controller responded by providing the categories of personal data and related information specified under § 11(8) of the German Broadcasting Contribution Treaty (RBStV), which governs data subject access requests relating to broadcasting contribution records, together with general privacy information. The data subject argued that the response was incomplete because it did not include copies of all documents containing his personal data, including correspondence with him and third parties. The Controller maintained that it had fully complied with its obligations under the RBStV. After the Controller declined to provide additional information, the data subject brought proceedings seeking disclosure of all personal data concerning him processed by the Controller. The Court held that § 11(8) of the German Broadcasting Contribution Treaty (RBStV) constituted a lawful restriction of the broader right of access under Article 15 GDPR pursuant to Article 23(1)(e) GDPR. It found that the national provision was a valid legislative measure, respected the essence of the fundamental right to data protection, and pursued an important public interest by ensuring the effective financing and administration of the public broadcasting system. The Court further held that the restriction was necessary and proportionate, noting that requiring the Controller to comply with the full scope of Article 15 GDPR across more than 44 million broadcasting contribution accounts would impose a disproportionate administrative and financial burden capable of undermining that public interest. The Court also held that § 11(8) RBStV satisfied the safeguards required under Article 23(2) GDPR by specifying the purposes of processing, categories of personal data, scope of the restriction, safeguards against misuse and unlawful access, the identity of the Controller, applicable storage periods and other statutory protections. Accordingly, while the Controller was required to disclose the categories of information specified under § 11(8) RBStV, it was not required to provide a copy of all personal data processed under Article 15(3) GDPR. As the Controller had already provided all information required under the national provision, the court dismissed the action.
CJEU case C-185/25 Waldfelber
The headteacher of a primary school in Austria was in charge of organising mandatory continuing training programmes for teachers at the school. The training programmes were provided by a University, which supplied schools with organisational staff known as programme coordinators. The data subject was proposed by the University as the coordinator for an upcoming training programme at the school. After being informed of this proposal, the headteacher asked a teacher about the data subject’s reputation in a face-to-face conversation. The teacher expressed a negative opinion about the data subject. The headteacher then sent an email from his professional email address, using a school computer and a designated server, to an employee of the University. In the email, he requested that another programme coordinator be assigned. He referred to the information obtained from the third party, according to which the data subject allegedly opposed the public school system and was in constant dispute with the relevant education authority. When the data subject became aware of the email, he requested access under Article 15 GDPR. In particular, he asked for the identity of the third party who had provided the information, as well as a copy of the personal data concerning him processed in the email. The headteacher refused to provide this information. He argued that he had not possessed or stored personal data concerning the data subject and had merely expressed concerns about the proposed appointment. The data subject brought legal proceedings. The first instance court dismissed the claim, and the appeal court upheld that decision. The courts found that the headteacher had acted as an executive officer of the legal entity governing the school. They also held that the means of processing, including the professional email address, server and computer, had been prescribed to him. Therefore, they considered that he could not be treated as a controller under the GDPR. The appeal court also held that there was no obligation to keep a written record of the third party’s name and therefore no obligation to disclose it. The data subject appealed before the High Court, which stayed the proceedings and referred questions to the Court of Justice. The main issues discussed in the Advocate General’s Opinion were whether a natural person acting within a public body can personally qualify as a controller under Article 4(7) GDPR, the scope of the right to know the source of personal data under Article 15(1)(g) GDPR, whether a breach of the right of access can lead to compensation under Article 82 GDPR, and whether national law may channel liability away from an individual public officer and towards the relevant public body. The Advocate General (hereinafter, AG) first assessed whether the headteacher could personally qualify as a controller under Article 4(7) GDPR. The AG recalled that the concept of controller is broad, but that it requires a person or entity to determine the purposes and means of the processing. A person who processes personal data on behalf of another person or entity, and not for their own purposes, does not normally qualify as a controller. In the AG’s view, a headteacher who processed personal data in the exercise of his duties, using official tools made available by the school, and not in his own personal interest, did not personally determine the purposes and means of processing. Instead, he acted on behalf of the school or the public entity responsible for the school. The AG therefore proposed that Article 4(7) GDPR should be interpreted as meaning that a natural person who processes personal data in the exercise of their duties, as head of an organisation, and by means of tools made available and prescribed by that organisation, does not qualify as a controller. The AG added that a different conclusion could apply if the national court found that the headteacher had acted outside the scope of his duties or for his own purposes. In that case, he could potentially be treated as a controller or joint controller. Although this conclusion meant that the remaining questions did not need to be answered, the AG still addressed them in the alternative. On Article 15(1)(g) GDPR, the AG considered whether the data subject’s right to obtain information on the “source” of personal data required disclosure of the identity of the third party. The AG accepted that an opinion or assessment about a person can constitute personal data. However, where the opinion contained in the email can be attributed to the author of the email, the source of the personal data is the author, not every person who may have contributed to the formation of that opinion. Accordingly, the data subject would not automatically have a right to know the identity of the third party who had spoken to the author of the email. The position would be different if the email merely reproduced or cited the third party’s own views. In that case, the third party could be the source of the personal data. The AG also emphasised that the right of access under Article 15 GDPR must be balanced against the rights and freedoms of others. This includes the third party’s rights to privacy, confidentiality and freedom of expression. The fact that the third party could not have foreseen that their oral statements would later become subject to data processing was considered relevant to that balancing exercise. On Article 82 GDPR, the AG considered whether a breach of the right of access could give rise to compensation. The AG took the view that Article 82 GDPR is not limited to damage caused by unlawful processing operations. It can also cover damage caused by other infringements of the GDPR, including a breach of the obligation to provide access information under Article 15 GDPR. However, the data subject would still need to prove the usual conditions for compensation: an infringement of the GDPR, material or non-material damage, and a causal link between the infringement and the damage. Finally, the AG considered the national public-liability rules. Under Austrian law, an injured party cannot bring a damages claim directly against an executive officer acting in the sovereign execution of the law. Instead, liability is channelled to the relevant public legal entity. The AG considered that Article 82 GDPR does not preclude such national rules, provided that the data subject still has an effective claim for compensation against the public entity. The GDPR requires full and effective compensation for the damage suffered, but it does not necessarily require that the individual public officer be personally liable. No administrative fine or corrective measure was imposed, as the case concerned an AG Opinion in preliminary ruling proceedings.
Court case VI ZR 375/24
A debt collection agency (the controller) sent reminders to a customer (the data subject) for delayed installment payments related to a terminated electricity contract in November 2019. The data subject considered the claimed sums to be excessive and refused to pay. The controller transmitted the information on outstanding debts of €795 and €817 to a credit information agency, which in turn made negative entries in its database. This lowered the credit score assigned to the data subject by the credit information agency. The data subject sued the controller for disclosing outstanding receivables to the credit information agency. The court of first instance ordered the controller to revoke the negative entries contained in the credit ranking database and awarded the data subject €500 in damages. The controller appealed this decision. The appellate court held that there had been no legal basis for the transmission of personal data, as the data subject had not consented to the processing and the requirements for legitimate interests pursuant to Article 6(1)(f) GDPR were not met. However, the court considered that the data subject had not suffered any non-material damage within the meaning of Article 82 GDPR. The controller appealed the case further to the Federal Court of Justice. The Federal Court of Justice dismissed the controller’s appeal and referred the case back to the appellate court. First, the court held transmitting the personal data to the credit information agency had been unlawful due to the lack of a legal basis. It pointed out that the requirements for processing based on legitimate interests laid down in Article 6(1)(f) GDPR were not met. As such, legitimate public interests in preventing the granting of credit to those who are unable or unwilling to pay could justify the transfer of data to credit information agencies. However, no meaningful indications regarding the data subject’s ability or willingness to pay could be derived from the credit information entries at issue: the controller had failed to demonstrate the debts existed in the amount claimed. Therefore, it could not rely on legitimate interests as a legal basis. Second, the court held that the data subject was entitled to the revocation of the disputed credit information entries due to the unlawful disclosure of their personal data. According to the court, this claim could be based on 1) the application of Article 19 GDPR in conjunction with Article 17(1) (d) GDPR, 2) Article 19 GDPR in conjunction with Articles 5(1)(a), 5(2), and 24(1) GDPR, or 3) national law by analogy. Third, the court held that the data subject had suffered non-material damage within the meaning of Article 82 GDPR due to the harm caused to their economic reputation. The fact that the credit reports adversely affected the data subject’s credit score, which could then be taken into account by potential contractual partners, was enough to give rise to a claim for damages. The court pointed out that the transmission of personal data to one recipient and the risk of further transmissions to third parties already constituted loss of control; the data subject did not need to prove a feeling of helplessness, fear, or anxiety to be entitled to damages.
SAINTS & STARS B.V.
SAINTS & STARS B.V. (the controller) is a company that operates several gyms. In 2025, a data subject cancelled their membership and requested the controller to erase all their personal data in accordance with Article 17 GDPR. The controller sent two general marketing emails after terminating the data subject’s membership. The controller argued that it had a legal obligation to retain the data subject’s data, as they had not paid the final invoice. The controller also claimed to have unsubscribed the data subject from its marketing emails list. The data subject brought a case to the court, requesting the court to order the controller to erase their data and pay €750 in non material damages. During the proceedings, the court informed the data subject that their claim for erasure would be rejected, as they did not file the case within the time limit set by national law. The data subject stated that they no longer wished their data to be deleted, but still maintained their claim for damages. The court first clarified that the deadline applied for the erasure claim and not the claim for damages, as the six week limit under national law applies to requests under Articles 15 to 22 GDPR. The court then stated that it was not in dispute that the controller unlawfully processed the data subject’s data to send them marketing emails. The controller processed this data without a valid legal basis under Article 6 GDPR, as the data subject did not consent to this processing. However, the court refused to award the data subject damages. Under Article 82 GDPR, a violation of the GDPR in itself is not sufficient to grant a data subject damagesSee also C-300/21 (Österreichische Post), margin 32. According to the court, the data subject did not provide evidence beyond stating they felt “genuine discomfort“ when receiving the emails after canceling their membership. This was insufficient to establish non material damage. The court dismissed the case.
HEP Proizvodnja d.o.o.
The data subject was employed by HEP Proizvodnja d.o.o., an electricity and heat generation provider (the controller), at one of its hydroelectric plants. Their work involved the maintenance of computer systems. Their employment was later terminated in April 2022. While the data subject was on sick leave, one of the computers located in their office stopped functioning. The data subject claimed that, because of this malfunction, they came to the workplace, disconnected and rearranged some equipment, and then left. According to the data subject, their office contained both work-related and private computer equipment, including devices and hard drives on which their personal data and the personal data of third parties were stored. The controller stated that the engineering workstation located in the office used by the data subject had lost its uninterrupted power supply due to equipment failure. It was necessary to turn it on and log in so that business processes could continue uninterrupted. The controller further claimed that the data subject appeared at the workplace despite warnings from their superiors that their presence was not needed, entered their workspace, attempted to tamper with the equipment and prevented other colleagues from accessing the computer data. The controller launched an internal investigation for the security incident. The controller stated that the processing of the data subject’s data was carried out by its Corporate Security Office and was necessary to maintain operational continuity and security of the facility. The data subject filed a complaint with the Croatian DPA. They claimed that, during the investigation, the controller unlawfully accessed and processed their personal data, including data stored on several computers and hard drives. They argued that some of the data stored there were private, that special categories of personal data were processed, and that the controller could tell from the names of certain files, before opening them, that they contained personal data. The controller argued that the equipment had been accessed because of a security incident affecting an engineering workstation forming part of the hydroelectric plant’s system. It claimed that the workstation was company property and that the data subject had, without authorisation, installed and removed hardware and changed passwords. The controller also alleged that the data subject had stored and sent a work project through a public network, which created a security risk. In addition, it alleged that files of a pornographic and erotic nature were found on a disk connected to the workstation during the technical and security review. The DPA rejected the complaint. It considered that the processing could not be assessed separately from the reason why the equipment had been removed. The equipment had been taken for an internal investigation into possible misconduct following a security incident in the workplace. According to the DPA, any personal data found on the equipment were accessed incidentally, since the controller could not know in advance whether the devices contained the data subject’s personal data, how much data they contained, or what categories of data were involved. The DPA also referred to Recital 20 in the context of the controller’s use of the data for evidence in legal proceedings. It found no violation of the data subject’s rights, noting that the controller had not forwarded the data to third parties or misused them. The DPA stated that the amount and categories of personal data, as well as the alleged involvement of more than one controller, were irrelevant in this case. The data subject challenged the DPA’s decision before the Administrative Court of Rijeka. The data subject argued that they had the right to access their personal data and that the controller could not deny this right based solely on an assumption about what they intended to do with the personal data once received. They also stated that the DPA had misapplied Recital 20, as there was no conflict of jurisdiction involved. They also alleged that, since more than one entity had been involved in the processing, the DPA should have examined whether the relationship between them had to be regulated under Article 26 or Article 28 GDPR. Additionally, the data subject considered that Article 9(2)(b) GDPR had been misinterpreted, as the conditions specified therein could not be met since, under Article 9(1) GDPR, the processing of special categories of personal data is prohibited. Moreover, the data subject claimed that Article 9(2)(f) GDPR did not provide a basis for an internal investigation, because an employer could not process data based on an assumption that it might be needed for legal defence. The Court noted that the controller’s actions were not aimed at processing the data subject’s personal data, but at resolving a technical malfunction. It emphasised that the computer and hard drives were located in the controller’s business premises and were connected to a workstation used by the data subject. Accordingly, it pointed out that there was no reason to assume in advance that the devices would contain the data subject’s personal data. The Court held that the processing was carried out in order to prevent damage to the controller’s computers and electronic communication systems, in accordance with Recital 49. The Court further held that the proportionality test was satisfied. The processing was limited to data contained in equipment located in the data subject’s workplace and relevant to the production process and the security incident. The Court also took into account that pornographic, erotic and entertainment files were found on a hard drive connected to the workstation. It considered that such content could reasonably be viewed as posing a risk to the functioning of the controller’s systems. The Court held that the processing was lawful under Article 6(1)(f) GDPR, since it was necessary for the controller’s legitimate interest in ensuring the functioning of the hydroelectric plant. Additionally, the Court referred to Article 6(1)(c) GDPR, considering the controller’s legal obligations regarding the security and operation of energy infrastructure in the Republic of Croatia. The court further held that the internal investigation was necessary for the exercise or defence of legal claims and in accordance with the controller’s public-interest duties to protect the network and infrastructure. Therefore, it ruled that the controller could rely on Article 9(2)(f) GDPR regarding the processing of special categories of personal data. The Court also rejected the data subject’s argument that several controllers or processors were involved. It accepted that the Corporate Security Office was an internal division within the controller’s corporate group and had conducted the investigation on behalf of the controller. Therefore, there was no need for a separate arrangement between controllers under Article 26 GDPR. The Court noted that a controller is generally required to provide a data subject with access to their personal data so that the data subject can be aware of the processing and verify its lawfulness, pursuant to Article 15 GDPR. However, it agreed that the request had to be assessed in light of the controller’s rights and obligations to protect its information and business systems. The court held that the granting of access to the data subject would jeopardize its legitimate interests. The Court dismissed the data subject’s appeal and upheld the DPA’s decision.
Data subject
The controller (the operator of multiple large social networking platforms) offered "Business Tools" that third-party website and app operators could integrate into their services. These tools transmitted visitors' personal data, such as identifiers, contact details, browsing information and interaction data, to the controller. The data subject had used the social network since 2021. He had not consented to the controller's use of personal data transmitted through these Business Tools. The data subject brought proceedings seeking, among other things, a declaration that the user contract did not permit the processing of such data, an injunction against further processing, restrictions on the use of already collected data, deletion or anonymisation of the data, and compensation under Article 82 GDPR. The first-instance court rejected the declaratory claim, partially granted an injunction concerning the storage of off-site data, and dismissed most of the remaining claims. Both parties appealed. The court distinguished between two types of processing: the collection of personal data on third-party websites and apps through the controller's Business Tools, and the storage and further processing of data after transmission to the controller. Regarding the collection of data on third-party websites and apps, the court found that the controller and the third-party website operators were joint controllers under Article 26 GDPR. The controller failed to prove that the data subject had consented. However, the court rejected the injunction request against the controller for this stage of processing because the immediate infringement resulted from the conduct of the third-party website operators. The controller had contractually required website operators to obtain a valid legal basis and had not breached any specific duties arising from Article 26 GDPR. Third, the court held that the controller unlawfully stored personal data received through the Business Tools. The controller argued that it processed the data for security and integrity purposes and relied on Article 6(1)(f) GDPR. However, the controller failed to explain which categories of data it processed, why the processing was necessary, how it was carried out, and how long the data were retained, so it failed to demonstrate a lawful basis for the storage of the data. The court therefore upheld the injunction prohibiting the controller from storing the specified personal data collected from third-party websites and apps. It also found a risk of repeated infringement because the controller had already engaged in the unlawful storage. Fourth, the court held that the data subject was entitled to restriction of processing under Article 18 GDPR. The controller had to preserve the already processed data, refrain from further use or disclosure, and retain them until the data subject requested deletion. Fifth, the court ordered the controller to delete the personal data that had been stored since 1 June 2021. Finally, the court awarded the data subject €500 in non-material damages under Article 82 GDPR for the unlawful processing of his personal data. However, it rejected the claim for higher compensation and did not award the requested pre-litigation legal costs.
Court case W298 2322178-1
A data subject made an access request to a credit information agency (the controller) in 2023. He later filed a complaint with the Austrian DPA and alleged that the controller had violated his right of access under Article 15 GDPR by providing him partially flawed and inconsistent information. In particular, the data subject claimed that no information regarding the logic involved in the calculation of credit scores were disclosed by the controller. The data subject also stated that his right to information, rectification, erasure, restriction of processing, objection and the right not to be subjected to automated decision-making under Articles 14 and 16–22 GDPR had been violated. While the controller provided further access in course of the procedure, it argued that it provided all information required under Article 15 GDPR. After the DPA initially ordered the data subject to provide more information regarding his complaint, the DPA found no infringement of the GDPR. In particular, the DPA held that the data subject limited its access request to partial information and that he failed to exercise his rights under Article 16–22 GDPR before failing the respective complaint. The data subject subsequently appealed the decision to the Austrian Federal Administrative Court. The court dismissed the data subject’s appeal. First, the court interpreted the access request narrowly and found that the controller had not violated Article 15 GDPR. It stated that the data subject had limited his access request to concern certain information only and held that the controller had provided him all such information. Second, the court could not find any infringement of Article 14 GDPR: it held that the data subject had failed to elaborate why he considered his right to information had been violated. Furthermore, the court stated that Articles 16–22 GDPR had not been infringed, as the data subject had not exercised his rights under these provisions by sending the controller a corresponding request on rectification, erasure, restriction of processing, objection or the right not to be subject to automated decision-making. In particular, the data subject failed to comply with the DPA’s order to further specify his complaint.
BF (data subject)
The data subject applied for international protection in Austria on 22 September 2022. The controller (Austrian migration authority) rejected the application on 19 October 2022, issued a return decision without an entry ban, and entered the data subject's return alert into the Schengen Information System (SIS) on 21 November 2022. On 17 July 2025, the data subject asked the controller to delete the SIS alert. The controller refused the request. On 31 August 2025, the data subject lodged a complaint with the Austrian DPA seeking deletion of the SIS alert. On 31 October 2025, the DPA rejected the complaint because the return decision remained valid, the data subject had not proved departure from the Schengen area. The data subject appealed to the court, arguing that they had voluntarily left Austria, were lawfully residing in Portugal, and were in the process of obtaining a residence permit there. First, the court held that the controller had lawfully processed the data under Article 6(1)(c) GDPR and Article 6(1)(e) GDPR because EU immigration law required Member States to enter return decisions into the SIS. Second, the court held that none of the deletion grounds under the immigration law appled, as the return decision had not been withdrawn or annulled, the data subject had not demonstrated departure from the territory of the Schengen Member States, and Portugal had neither granted a residence permit nor notified Austria of an intended or completed grant. Third, the court found that Article 17(3)(b) GDPR did not require a deletion as the processing remained necessary to comply with a legal obligation and to perform a task in the public interest. The court also noted that the processing of biometric data contained in the SIS alert was permitted under Article 9(2)(g) GDPR because Union law authorised the processing for an important public interest and included appropriate safeguards. The court therefore concluded that the controller had no obligation to erase the SIS alert, dismissed the appeal, and upheld the DPA's decision.
Court case 6Ob174/25v
The data subject made an access request to a national security authority (the controller) who had conducted multiple security assessments about him. The data subject had been informed that the security assessment in connection with his use of the federal press service’s online accreditation had resulted in a negative recommendation. The data subject stated that the controller had provided him incomplete information as a response to the access request. In the proceedings before the court of first instance, the data subject demanded the controller to provide him access to complete and correct information according to Article 15 GDPR and claimed €100 in damages. In addition, he requested a declaration of the liability of the controller due to the inadequate execution of his access request. The court of first instance rejected the claims on the grounds of inadmissibility of legal recourse. The appeals court found GDPR did not apply to the case according to the exception in Article 2(2)(d) GDPR and held that the alleged infringement must be asserted before the DPA with legal recourse to the administrative court. The data subject stated in his appeal before the Austrian Supreme Court that he had the right to assert his claims in the ordinary course of law by virtue of Article 79 GDPR. The Austrian Supreme Court rejected the appeal with regard to the access request under Article 15 GDPR. It held that the data subject would only benefit from the dual nature of legal protection by the DPA and the civil courts within the scope of application of the GDPR. The court ruled that the GDPR was not applicable in the present case: the purpose of the security assessments was to evaluate the trustworthiness of a person and provide information on whether they would commit dangerous attacks. Therefore, they clearly fell within the scope of the exception in Article 2(2)(d) GDPR. The data subject was not able to prove that his personal data had also been processed for administrative, organisational, or other purposes. Furthermore, the court referred the case back to the court of first instance with regard to the asserted claims for damages and declaratory judgment on the liability of the controller. It held that the reasons assumed by the lower courts for the dismissal of these claims were not present.
Court case 25/2823
A data subject made an access request to a law firm (the controller), regarding the data it had processed in connection to their bankruptcy proceedings. The controller responded by stating it could not find any information related to the data subject, as it later realised the data subject was not a former client but the opposing party. The controller argued that Article 15 GDPR does not oblige it to collect data from the attorney of an opposing party. Finally, the controller argued that it could limit the access request on grounds of attorney-client confidentiality and to protect the rights and freedoms of others. The data subject filed a complaint with the DPA, arguing that the controller had not properly handled their access request. The DPA considered that the controller had not violated the GDPR, and dismissed the case. The data subject appealed the decision to the court, arguing that the DPA had misinterpreted Article 15 GDPR. According to the data subject, the DPA had claimed the case fell out of the scope of Article 15 GDPR, because the data subject could obtain court documents through the court. In addition, the data subject argued that the controller could not refuse the access request completely on duty of confidentiality grounds. The court first noted that the data subject was involved in a public bankruptcy proceeding, meaning the data subject needed to know the other parties involved. The court then stated that the DPA should have investigated which rights and freedoms were protected by the restriction on the data subject’s right to access. The rights and freedoms of others are not a valid ground to deny the access request in its entirety.See the ruling of the Administrative Law Division of the Council of State dated November 5, 2025, ECLI:NL:RVS:2025:5323, margin. 5.4. The court considered that the DPA had not sufficiently investigated the case, as it had not carried out the balancing exercise of the interests involved. This was supported by the fact that the DPA had not clarified which rights and freedoms of others are actually protected by the restriction of the data subject’s right to access. The court upheld the data subject’s appeal, and ordered the DPA to issue a new decision within six weeks.
Court case 8 AZR 169/25
A company (the controller) commissioned a law firm to conduct a compliance investigation into alleged misconduct of a manager (the data subject) in August 2023. The investigation resulted in two compliance reports containing the allegations against the data subject, the names of whistleblowers and witnesses, and a summary of the findings of the investigation. The data subject claimed that she had the right to receive copies of the final compliance reports pursuant to Articles 15(1) and 15(3) GDPR. She requested access to these documents in order to verify what statements had been made about her, whether those statements were accurate, and how they had been determined. The controller refused to grant the data subject access to copies of the entire documents – it considered that its interest in maintaining the confidentiality of the compliance reports as trade secrets outweighed the plaintiff’s interest in obtaining information. The court of first instance ordered the controller to provide the data subject a copy of the earlier version of the compliance report. The appellate court dismissed the data subject’s claims. Following this, the data subject appealed before the Federal Labour Court and also requested access to an interim report related to the same investigation for the first time. The court dismissed the data subject’s appeal and held that she did not have the right to receive a copy of the final compliance reports under Articles 15(1) and 15(3) GDPR. The court held that requesting access to an interim report constituted an impermissible expansion of the claim in the appeal proceedings. Furthermore, the court held that the final compliance reports did not exclusively contain personal data within the meaning of Article 4(1) GDPR. For instance, the documents also contained legal analysis, which merely constitutes information about how the controller assesses the legal situation. Consequently, the court argued that the data subject did not need copies of the reports in their entirety in order to verify the accuracy of the personal data and the lawfulness of the processing.
DSB
The data subject, an Austrian citizen residing in Vienna, was enrolled in a distance-learning programme at a German university (the controller). When the data subject enrolled, the controller registered them under the official name shown on their identity document. The data subject experienced gender dysphoria and had chosen a gender-neutral name for themselves which was a different to their legal name. They requested the controller to rectify and replace their official name with their chosen name. They stated that the chosen name reflected better their gender identity. The controller refused the change because the data subject had not provided either an official document proving a legal name change or a dgti supplementary ID card. This is a German supplementary identity document issued by Deutsche Gesellschaft für Trans*- und Inter*geschlechtlichkeit e.V. (dgti e.V.), a German association supporting trans and intersex persons, which may certify, among other things, a chosen first name, pronouns, gender and a current photo. The controller claimed that such a document would allow it to record changes concerning pronouns and first name in its administrative system. On 6 May 2024 the data subject lodged a complaint with the Austrian DPA. They argued that the controller failed to comply with their rectification request under Article 16 GDPR. The data subject also relied on the CJEU’s judgement in [https://infocuria.curia.europa.eu/tabs/affair?lang=en&sort=AFF_NUM-DESC&searchTerm=%22C-247%2F23%22&publishedId=C-247%2F23 Deldits case(C-247/23)], which concerned the rectification of gender identity data under Article 16 GDPR. As the controller was established in Germany, the Austrian DPA considered that the Thuringian DPA was the lead supervisory authority for the cross-border processing. The Thuringian DPA held that the controller had not violated Article 16 GDPR. Because the complaint had been lodged with the Austrian DPA and the outcome was a dismissal of the complaint, Article 60(8) GDPR required the supervisory authority with which the complaint had been lodged to adopt the decision and notify the data subject. The data subject then appealed that decision before the Austrian Federal Administrative Court. They argued that the continued use of the official name resulted in misidentification and systematic misgendering. They also stated that the prerequisite to submit further documents proving the name change was excessive and disproportionate. Moreover, the data subject requested that the chosen name should at least be used in non-legally binding university systems, such as the learning platform, email address, campus card and attendance lists. The controller noted that it was legally obligated to identify students and process their data based on official identification documents. This applied, on the one hand, to the transcripts addressed in the administrative proceedings, but also to other academic achievements by students, such as individual coursework, seminar work, or work within interdisciplinary study teams. The court first confirmed that the cooperation procedure under Article 56 GDPR and Article 60 GDPR had been correctly applied. The Thuringian DPA acted as the lead supervisory authority because the controller was established in Germany. However, since the complaint was dismissed, the Austrian DPA, as the authority with which the complaint had been lodged, adopted the rejection decision pursuant to Article 60(8) GDPR. The court held that there was no violation of Article 16 GDPR. It emphasised that the accuracy of personal data must be assessed in relation to the purpose of the processing. The controller processed the official name in order to identify the student, administer the study programme, issue certificates and academic degrees that aim to be recognized outside the university and certify the student's completion of the program to third parties. The court held that in light of these processing purposes, the processed data of the data subject should be regarded as accurate within the meaning of Article 16 GDPR. Since the data subject had not officially changed their name and had not submitted any official document, the court found that the official name was not inaccurate for the controller’s stated processing purposes. It further stated that the requirement to provide proof of a name change or to present a supplementary identification document was proportionate. The court acknowledged that gender identity is protected as part of private life under Article 8 ECHR. However, it distinguished the case from Deldits. In Deldits, the issue concerned the rectification of gender data in a public register and CJEU held that a data subject requesting the correction of gender identity data may be required to provide relevant and sufficient evidence, taking into account the circumstances of the individual case, in order to establish the inaccuracy of such data. By contrast, this case concerned university administration and academic documents whose effects extend beyond the university and there was no official change of the data subject’s name. Therefore, the court maintained that the controller could continue to use the official name unless the data subject provided official proof of name change. The court further noted that the request to use the chosen name only in non-legally binding systems went beyond the original complaint.
X International Unlimited Company (Formerly Twitter International Unlimited Company)
X International Unlimited Company (Formerly Twitter International Unlimited Company) (the controller), formerly Twitter, imposed a temporary restriction on a user’s (the data subject’s) account due to the controller’s automated detection system flagging the post as potentially violating the controller’s policy against child abuse after the data subject used the words “child pornography” in a post about the European plan to combat child abuse imagery. The controller did not notify the data subject of the restriction. The data subject submitted an access request to the controller to determine, among other things, the scope and reasons for imposing the restriction. The controller lifted the restriction without informing the data subject and later on responded to the access request referring to its privacy policy. However, the data subject filed a petition in court arguing that the controller failed to respond adequately to his access request. The controller provided the data subject with information regarding the imposed restriction through a letter in January 2024 and in September 2024 provided additional access to documents and information, including to a partially redacted printout from one of its systems. In front of the first instance court, the data subject requested an order to the controller to respond to the access request under Article 15 GDPR and the request for information regarding automated decision-making under Article 22 GDPR. The court concluded that the controller must respond to the requests and provide specific information regarding “reputation scores”, labels and one of its systems. The controller appealed the first court’s judgement. The appellate court upheld the contested decision but allowed the controller to redact the names of its employees and the exact timestamps of when automated decision-making occurred in the document it was ordered to provide concerning one of its systems. In this sense, the data subject declared that he
KSV1870 Information GmbH
An individual (the data subject) intended to conclude an energy supply contract online with Go Green Energy GmbH (the energy provider). After initially receiving an email accepting the data subject as a customer the data subject's contract was automatically rejected due to an insufficient credit score provided to the energy provider by KSV1870 Information GmbH (the credit information agency or "KSV"). Therefore, the credit information agency's credit score led to the automated rejection of the data subject's application for the energy supply contract. The data subject eventually submitted a request to the energy provider requesting information under GDPR, in particular regarding the data exchanged with KSV. Furthermore, he submitted an access request with KSV under Article 15 GDPR. The data subject considered KSV’s response to his access request to be incomplete and filed a lawsuit claiming damages from KSV as well as the energy provider. The data subject claimed that he never consented to automated decision-making, but that the two controllers subjected him to such decision-making unlawfully in violation of Article 22 GDPR. Moreover, the data subject claim that the controllers relied on inaccurate information to calculate his credit rating, thus breaching the principle of accuracy under Article 5(1)(d) GDPR. The data subject argued that the refusal caused him worry, annoyance and stress, thereby resulting in non-pecuniary damage. He claimed €1,500 from both controllers under Article 82 GDPR in court. KSV claimed that it processed personal data under Article 6(1)(f) GDPR (i.e. legitimate interest) and that all data subjects have the right to request correction of their personal data used for the purpose of credit rating. Moreover, KSV argued that it only provided the energy provider with a credit rating, which was not a sufficient reason for a refusal to enter into a contract, and that it had no control over the energy provider's reasons for refusal. Therefore, KSV considered that their credit scoring could not be considered automated decision making under Article 22 GDPR. The energy provider argued that its automated decision-making was necessary due to the high number of requests for contracts it receives, and that it is permitted under Article 22(2)(a) GDPR. It further claimed that manually verifying every credit rating would be unreasonable, that it did not violate Article 5 GDPR, and that in case a human being would have reviewed the case, it would have reached the same conclusion and the subsequent rejection would have led to the same alleged stress, annoyance and concern. The Vienna Regional Court for Civil Matters found that the controllers violated their information obligations under Article 13(2)(f) GDPR and Article 14(2) GDPR since they failed to inform the data subject about the fact that they are subject to automated decision-making, the court also found a violation of the data subject's right to an explanation under Article 15(1)(h) GDPR and awarded damages under Article 82(1) GDPR in the amount of €1,500. The controllers appealed the judgment to the Vienna Higher Regional Court. The court dismissed the controllers' appeals. Credit rating as an automated decision within the meaning of Article 22(1) GDPR The court analysed the objection to the finding that the generation of the credit rating constituted an automated decision within the meaning of Article 22(1) GDPR. KSV argued that the legal or significant adverse effect on the data subject was not present, and that the latter was only minimally affected by the energy provider's refusal to conclude the contract since he concluded the desired contract with a different provider and subsequently rejected the energy provider’s offer for the contract after their case-by-case review. Thus, KSV claimed that Article 22 GDPR was not applicable and the subsequent information obligations could not have been violated either. However, the court referred to the SCHUFA II case (C-634/21) and showed that the credit rating in this case fell under the application of Article 22 GDPR, since it was a decision based solely on automated processing including profiling which produced legal effects or significantly affected the data subject in a similar manner. It further emphasised that following the CJEU’s decision in the SCHUFA II case, it is generally prohibited to calculate a probability score which plays a decisive role in the granting of a loan to the data subject pursuant to Article 22(1) GDPR. Thus, the court stated that credit rating is only currently permitted on the basis of explicit consent. Moreover, the court concluded that the credit rating calculated by KSV was also the cause of the energy provider’s refusal to enter into a contract with the data subject, causing the latter distress. Therefore, the court held that KSV is liable to the data subject for the damage. In addition, the court considered that the lack of knowledge invoked by KSV was irrelevant in regard to the energy provider’s refusal to enter into a contract with the data subject, since the credit rating was a decision within the meaning of Article 22(1) GDPR regardless if the third party, in this case the energy provider, makes a subsequent decision based on the credit rating. KSV should have anticipated, according to the court, that the credit rating would be used in the context of an automated decision. The court established that it was irrelevant to its liability under Article 82 GDPR whether the controller breached information obligations under Article 14(2) GDPR and 15(1)(h) GDPR, since the data subject did not base his claim for damages on these claims. Instead, the data subject argued that the refusal on behalf of Go Green Energy, based on the creditworthiness scores calculated by KSV, caused him anxiety, annoyance and stress, thus resulting in non-pecuniary damage. Therefore, the court dismissed this part of the appeal by KSV. Exception under Article 22(2) GDPR In addition, the appellate court discussed the exception under Article 22(2)(a) GDPR. While it accepted that the energy provider’s personal data processing can fall within the exception (i.e. it might be necessary for entering into, or performance of, a contract), the court also upheld the conclusion that such automated decision was not permissible in the end. The court stressed the importance of Article 22(3) GDPR in such situations and explained that the data subject must not only be aware of the existence of an automated decision, but also of at least the reasons for the decisions affecting them and its implications. On the basis of this, the court showed, the data subject must be able to determine the accuracy of the information involved in the decision or whether specific circumstances had not been taken into consideration, in order to be able to challenge the decisions if needed. The court pointed out that the controller has the obligation to establish an appropriate process to enable the data subject to exercise these rights. However, the court held that the energy provider could not be presumed to have met these requirements in this case based on the established facts, thus being in breach of Article 22(3) GDPR and subsequently also of Article 22(1) GDPR. Finally, the court dismissed the objections requesting a lower compensation for immaterial damages. Therefore, the court dismissed the appeal of both controllers and upheld the first court’s decision.
Unnamed data subject
The data subject requested access from a credit information agency (the controller). On 23 February 2019, the controller provided information under Article 15 GDPR, including personal data and three credit scores (Risk Indicator, Economic Index, and KKE score). The data subject argued that the response was incomplete, particularly regarding the origin of the data and the logic behind the credit scoring. The controller maintained that it had provided sufficient information, including data sources. It also argued that further details on scoring logic were protected as trade secrets and that the scores had not been disclosed to third parties. The DPA partially upheld the complaint. It found that the access response was incomplete and ordered the controller to provide more detailed information on the logic of the credit scoring. The controller appealed and assured that the scores had neither been shared with third parties nor had any effect on the data subject. The data subject could not substantiate any actual impact of the scores. First, the court assessed the scope of Article 15(1)(h) GDPR. It clarified that the obligation to provide meaningful information about the logic of processing applies at least where Article 22 GDPR is triggered. Second, the court relied on case law of the Court of Justice of the European Union to determine that Article 22 GDPR requires three elements: a decision, based solely on automated processing, that produces legal effects or similarly significant effects for the data subject. Third, the court held that while the credit scoring constituted automated processing and could qualify as a “decision”, it did not meet the third requirement. The controller had not disclosed the scores to third parties, and the scores had no impact on the data subject. Therefore, the court concluded that Article 22 GDPR did not apply. As a result, the additional transparency obligations under Article 15(1)(h) GDPR were not triggered. Finally, the court held that the controller had fulfilled its obligations under Article 15 GDPR. It annulled the DPA’s decision and rejected the data subject’s complaint in full.
CNPD
In 2018, the French non-profit organisation La Quadrature du Net filed a complaint against Amazon (the controller). The organisation claimed that Amazon could not rely on the legal basis of legitimate interest for processing personal data for targeted advertising. It also claimed that Amazon failed to respect several rights of the data subjects. On 15 April 2019, the Luxembourg Data Protection Authority (CNPD) opened an investigation as the lead DPA under the cooperation mechanism. The CNPD examined whether Amazon had a valid legal basis under Article 6 GDPR and whether it complied with transparency obligations and data subject rights under Articles 12 to 17 GDPR and Article 21 GDPR. On 15 July 2021, the CNPD adopted a decision finding multiple infringements of the GDPR. It held that Amazon did not have a valid legal basis for behavioural advertising under Article 6(1) GDPR at the time of the investigation. The CNPD also found breaches of transparency obligations and failures to respect the rights of data subjects, including the right of access, the right to erasure, and the right to object. The CNPD imposed an administrative fine of €746,000,000. It also ordered Amazon to bring its processing operations into compliance within six months and imposed a periodic penalty payment in case of non-compliance. Amazon challenged the decision before the Administrative Court (Luxembourg), arguing that the CNPD violated procedural rules, including the right to a fair procedure, the right of defence, and the principle of impartiality. Amazon also argued that the CNPD exceeded the scope of its investigation and denied access to parts of the file. On the merits, Amazon claimed that it could rely on Article 6(1)(f) GDPR (legitimate interests) and that it had complied with transparency and data subject rights obligations. The Administrative Court rejected Amazon’s action and upheld the CNPD’s decision. Amazon appealed to the higher Administrative Court. In its judgment of 12 March 2026, the High Administrative Court ruled on the appeal against the judgment of the Administrative Court of 18 March 2025, which had dismissed Amazon’s appeal against the CNPD decision of 15 July 2021. The Court first confirmed that, at the time of the investigation in 2019, Amazon’s processing of personal data for targeted advertising could not rely on Article 6(1)(f) GDPR as a legal basis. The Court also upheld the CNPD’s findings that Amazon had breached transparency obligations and failed to respect data subjects’ rights, including the right of access, the right to rectification, and the right to object. The Court considered the facts at the time the investigation was opened as the relevant reference for assessing these infringements. However, the Court identified two major shortcomings in the CNPD’s decision regarding the sanction. First, it noted that the CNPD had not assessed whether the infringements were committed intentionally or through negligence. The Court relied on recent case law of the Court of Justice of the European Union (CJEU), namely the Deutsche Wohnen and Nacionalinis judgments of 5 December 2023 (C-807/21 and C-683/21), which established that supervisory authorities must verify fault before imposing administrative fines under the GDPR. This analysis was necessary at the time the CNPD adopted its decision. Second, the Court found that the CNPD had not properly exercised discretion in determining the penalty. It observed that the authority had treated a fine as an automatic consequence of finding violations, without considering the full range of corrective measures and selecting the most appropriate one according to the principles of proportionality and effectiveness under the GDPR. Because of these shortcomings, the Court annulled the CNPD’s decision in all its aspects. It referred the case back to the CNPD so that the authority could carry out, for the first time, the fault assessment and the proportionality assessment of any potential fine. The Court emphasised that it could not itself impose a sanction without violating the principle of an effective remedy guaranteed under the GDPR. The Court confirmed that its annulment did not affect the underlying substantive findings. The breaches identified by the CNPD in 2019 remain valid. However, the Court noted that Amazon had since modified its processing operations and now relies on user consent under Article 6(1)(a) GDPR as the legal basis for targeted advertising. The CNPD confirmed that these new practices comply with the GDPR, making the original compliance orders and periodic penalties moot. The Court dismissed both parties’ claims for procedural damages and divided the costs of both proceedings equally.