GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
Istituto nazionale della previdenza sociale (INPS)
Istituto nazionale della previdenza sociale (INPS, the controller) is the Italian National Institute for Social Security. In 2021, the DPA fined the controller €300,000 for its data processing activities linked to a subsidy given during the pandemic (also called “the COVID bonus”). The DPA found that the controller had postponed its second screening of verifying the eligibility of data subjects to a later stage, on the grounds that there was a need to immediately pay the subsidy. The controller considered that politicians did not fall under the scope of eligible data subjects, as they were already enrolled in a mandatory social security scheme. The controller processed their personal data from databases to cross reference them with data subjects who had applied for the subsidy. The DPA found a violation of several GDPR principles: the principle of lawfulness (Article 5(1)(a) GDPR), data minimisation (Article 5(1)(c) GDPR), accuracy (Article 5(1)(d) GDPR) and accountability (Articles 5(2) and 24 GDPR). According to the DPA, the controller had not limited the cross referencing to data subjects that had received the allowance, but to those whose applications had already been rejected. In addition, the DPA found a violation of Articles 25 and 35 GDPR, as the controller failed to conduct a data protection impact assessment (DPIA). The DPA ordered the controller to erase all personal data that had been processed unlawfully and to carry out a DPIA before resuming its processing activities. The controller appealed the decision to the Court of Rome, and argued that the DPA’s decision was unfounded. The court upheld the appeal and dismissed the DPA’s decision. The court considered that the controller had processed data subjects’ data lawfully, as it had limited the amount of data to what was necessary to verify data subjects’ eligibility. The court also considered that the processing posed a low risk for data subjects’ rights, as the data subjects’ names were not disclosed. The DPA appealed this decision to the court. The court dismissed the appeal. The court first stated that the controller processed the data lawfully under Article 6(1)(e) GDPR (public interest) and Article 6(3)(b) GDPR. While the controller processed data of specific data subjects (politicians), the court stated that national law allowed the controller to check the eligibility of all data subjects applying for the subsidy. The controller had also obtained the personal data through public databases provided by the Chambers of Parliament and Ministry of the Interior. The court also dismissed the DPA’s arguments on data minimisation (Article 5(1)(c) GDPR). The court stated that the principle of data minimisation is not absolute, and must be balanced with other interests at stake.See also C-268/21, Norra Stockholm Bygg AB https://infocuria.curia.europa.eu/tabs/affair?lang=en&sort=AFF_NUM-DESC&searchTerm=%22C-268%2F21%22&publishedId=C-268%2F21 The court took into consideration the fact that the data was publicly available and the need to quickly verify a high number of applications during a state of emergency. According to the court, there was also no other way to check applications still under review, and concluded that there was an overriding public interest in carrying out the verification process quickly. Finally, the court considered that the controller complied with Article 25 GDPR, as it processed data lawfully and in compliance with Article 5(1)(c) GDPR. In terms of data accuracy (Article 5(1)(d) GDPR), the court dismissed the DPA’s argument that the controller’s system did not eliminate the risk of “homocodes” (identical tax numbers between two or more people). The court considered that the data collected by the Chambers of Parliament and Ministry of Interior were presumed to be accurate. The court also noted that national law foresees the risk of “homocodes” and sets specific procedures in such cases, and that no actual inaccuracies were found in the controller’s verification process. Finally, the court did not find a violation of Article 35 GDPR. The court stated that the controller did not have the obligation to conduct a DPIA, as it did not meet all the necessary criteria. According to the court, the DPA failed to explain the potential high risks of large scale processing that would have justified the need for a DPIA. Given the previous dismissed arguments, the court considered that the controller had also complied with the principle of accountability (Articles 5(2) and 24 GDPR).
Court case V ZB 90/25
A prospective bidder in a compulsory auction wanted to find out who owned the property being sold and filed a request to inspect certain files with a court (the controller). The court of first instance granted them access to the files on the condition that the names and addresses of involved parties mentioned in the files (the data subjects) as well as previously deleted land register entries would be redacted from the document. The prospective bidder appealed this decision. The appeals court held that granting access to personal data contained in the documents was precluded by national law. The prospective bidder then appealed further to the Federal Court of Justice, which also examined whether their right to inspect documents was restricted by the provisions of the GDPR. The Federal Court of Justice overturned the appealed decision. It held that the controller had to grant access to the files without redacting the personal data of potential contacts, shareholders, and creditors of rights remaining in force contained in them. The right to inspection of files followed from national law. The court held that providing access to the files without first redacting the personal data of the data subjects did not infringe the GDPR. The processing by the court granting access to the files was covered by the legal basis in Article 6(1)(e) GDPR, as it was necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The basis for the processing was also laid down by Member State law within the meaning of Article 6(3)(b) GDPR. The national provisions about the right to inspection of compulsory auction files was proportionate to the aim pursued within the meaning of Article 6(3) GDPR: first, the right to access was limited to certain parts of the file. Second, the court pointed out that providing access to the unredacted files helps bridge the information gap among prospective bidders and opens the possibility of a private sale. In addition, the court emphasised that recipients of case files in compulsory auction proceedings may not disclose the contents of the files publicly or make them available to third parties.
Federpol
Federpol (the controller) is an association of private investigators. In 2021, the DPA fined the controller for distributing a newsletter to all members containing the minutes of a meeting with its executive board. The minutes concerned a case against a member who had sent a defamatory letter. The member was identified by name. The DPA found a violation of Articles 5(1)(a) and (c), and 6(1) GDPR as the controller did not have a legal basis to process the data (including the name of the member in the newsletter). The DPA fined the controller €5,000. In 2022, the controller appealed the decision to the court of Rome. The controller argued that the processing was lawful under legitimate interest, and in any case, contractual obligation. The court dismissed the appeal and ordered the controller to pay the fine. The court considered that the controller could have informed members without naming the data subject. The controller filed an appeal to the Supreme Court. The court dismissed the appeal and upheld the reasoning of the lower court. The court followed the reasoning of the lower court, and stated that the controller could have informed its members of the case without including the data subject’s name. The court considered this processing to be disproportionate in relation to the goal. The court dismissed the controller’s argument that there was a difference between disseminating the information and communicating it to members. The court stated that, while the data subject’s name did not fall under the scope of Article 9 GDPR, the controller needed the consent of the data subject to process their data. Therefore, a resolution adopted by a general meeting or generic consent for statutory purposes did not meet the requirements of consent. The court also dismissed the controller’s argument that the fine was disproportionate. The court held that the DPA had correctly applied and justified the fine in accordance with Article 83(2) GDPR.
Tagadamedia
Tagadamedia, the controller, organised online competitions on websites it managed. In this context, it collected participants’ personal data, including names, postal addresses, email addresses and telephone numbers. It then transferred this data to commercial partners for marketing purposes in exchange for payment. The DPA, carried out an on-site inspection at the controller’s premises and later initiated sanction proceedings. The DPA found that the controller’s consent mechanisms did not allow users to give free, specific, informed and unambiguous consent to the transfer of their data to partners for marketing purposes. The controller had used different versions of consent forms. One version displayed a prominent “I agree” button, while the option to continue without receiving partner offers was only available through a less visible link in smaller text. Another version included two buttons, “I agree” and “I decline”, but the visual presentation continued to emphasise consent. The controller later proposed a new form with two similar buttons, “I agree” and “Next step”. The DPA imposed a €75,000 administrative fine for breaches of GDPR Articles 6 and 30. It also ordered the controller, under a daily penalty of €1,000, to implement a compliant form collecting valid consent for the transfer of data to partners. The controller appealed the decision before the Court. The Court partly upheld the appeal. First, the Court rejected the controller’s procedural arguments regarding the DPA’s inspection and the referral to the restricted committee. It held that the competent public prosecutor had been informed in advance of the inspection and that the restricted committee had been validly seized and convened. Second, the Court found that the controller’s rights of defence had been breached in relation to one of the violations. The DPA’s report had alleged that the controller had engaged in unfair processing under GDPR Article 5 because it led users to believe that all transfers were based on consent, while some data was transferred on the basis of legitimate interest and without an option to object. However, the final decision requalified this issue as a breach of GDPR Article 6 for failure to obtain prior consent. Since this specific legal ground had not been included in the report communicated to the controller, the controller had not been able to comment on it. The Court therefore annulled this part of the DPA’s decision. Third, the Court confirmed that the controller’s consent forms did not meet the requirements of the GDPR. It recalled that consent must be freely given, specific, informed and unambiguous, and that it requires a clear affirmative action by the data subject. Although the forms required a positive action, their design and wording were ambiguous. In particular, the “I agree” option was visually highlighted, while the alternative options were less clear or could be misunderstood by users. Therefore, the forms did not allow valid consent for the transfer of personal data to partners for commercial marketing. Fourth, the Court rejected the controller’s argument that the principle of legality of offences and penalties had been breached. It held that the GDPR rules on consent were sufficiently clear and foreseeable for a professional in the digital marketing sector. As a result, the Court reduced the administrative fine from €75,000 to €50,000, taking into account the annulment of one part of the DPA’s reasoning. However, it upheld the injunction requiring the controller to implement a GDPR-compliant consent form, subject to a daily penalty. The Court also ordered publication of its decision under the same conditions as the DPA’s decision and ordered the DPA to pay €2,000 to the controller for legal costs.
Court case Az. 1 L 3441/25
The controller had been registered in the list of qualified consumer associations since 2001. In 2021, the registration authority initiated proceedings to verify whether the controller still met the registration requirements. The controller was required to submit a list of members containing the first name, surname, date of birth and address of at least 75 natural persons (the data subjects) as part of this review procedure. The controller refused to submit a corresponding list of members on two separate occasions, stating that this requirement raised data protection concerns and that the disclosure of personal data of the members would be irreversible. In addition, the controller considered the measure to be disproportionate. The registration authority subsequently removed the controller from the list of qualified consumer associations in April 2025. The controller filed an objection against the decision, which the registration authority rejected. In December 2025, the controller submitted an application for interim relief. The court dismissed the application for interim relief. It held that the processing of personal data that is inevitably associated with the creation of a membership list and its submission to the registration authority did not raise any data protection concerns as it was lawful under Article 6(1)(c) GDPR. In this case, the controller was subject to a legal obligation to submit a list of members to demonstrate that it met the registration requirements for qualified consumer associations under national law. Furthermore, the court held the measure was in line with the principle of data minimization under Article 5(1)(c) GDPR: first, the scope of the request was limited to data indispensable for the identification of individuals. Second, the court stated that the group of data subjects was also not defined in a disproportionately broad manner.
Court case 42 K 73/25
The controller ran 29 outdoor swimming pools in Berlin. In summer 2023, the controller introduced expanded identity verification checks and video surveillance measures due to safety concerns, such as aggressive behaviour and verbal and physical attacks by potential customers (the data subjects). Swimmers aged 14 and older were only granted access to the outdoor pools upon presentation of a photo ID, and video surveillance was implemented in the entry and exit areas. The video footage was stored for 72 hours. The DPA issued the controller a reprimand in August 2025. It held that the identity checks and the video surveillance were not necessary to fulfil the controller’s duties set forth in national law or ensure safety at the swimming pools and found a violation of Article 5(1)(a) GDPR. The controller appealed the DPA decision in September 2025. The court annulled the DPA decision and held that the identity verification checks and video surveillance had been necessary for the performance of a task carried out in the public interest within the meaning of Article 6(1)(e) GDPR. First, the court pointed out that the processing operations must serve objectives in the public interest in order to be lawful under Article 6(1)(e) GDPR. The aim of both measures was to prevent criminal offences, restore safety at the outdoor swimming pools for swimmers and staff members, and to protect the lives, health, and freedom of these individuals. This requirement was therefore fulfilled. Second, the court held that the criterion of necessity was also satisfied regarding both processing operations. According to the court, there did not appear to be a less intrusive measure that would interfere less with the fundamental rights of the data subjects and improve safety at the pools just as effectively than requiring swimmers to present a photo ID upon entry. Similarly, video surveillance was deemed the only viable option to ensure safety in the exit and entry areas, where the staff were exposed to considerable danger of assaults and threats. The court deemed the restriction to the right of informational self-determination to be relatively minor, since video surveillance was only used in four pools where the risk was high, did not cover the entire pool area, and resulted in recordings that were only stored for 72 hours.
Court case Us I-4570/2023-5
The DPA had found that the controller had infringed Article 27 ZPOUZP by using CCTV inside and outside its premises without displaying a video-surveillance notice at the latest upon entry into the recording perimeter. ZPOUZP is the Croatian Act on the Implementation of the GDPR. Article 27 of this Act specifically regulates processing of personal data via video surveillance.The contested decision had further found that the controller had failed to display all relevant information required under Article 27(2) ZPOUZP, namely information about the controller and contact details through which data subjects could exercise their rights. The DPA imposed a fine €3,500 to the controller. The controller appealed this decision before the Administrative Court of Zagreb. The controller contested the legality of the DPA’s decision and requested its annulment. It argued that, as the DPA itself had acknowledged, there were several notices informing data subjects of the existence of video surveillance in the area. Therefore, according to the controller, it was incorrect to conclude that the notices were not visible upon entry into the recording perimeter. Regarding the contact point through which data subjects could exercise their rights, the controller further argued that it had clearly and sufficiently indicated that another entity, acting as processor, had been entrusted with the processing of the relevant personal data on its behalf. It pointed out that the processor’s phone number and email address had been provided. The DPA argued that it had correctly applied the law to the facts of the case. It acknowledged that several CCTV notices existed, but emphasised that the indication that the building was under video surveillance had to be visible no later than upon entry into the recording perimeter. In the controller’s case, the DPA considered that the first video-surveillance notice had been placed in such a way that data subjects would already be within a camera’s field of view before having the opportunity to see it. The DPA further noted that the controller had infringed Article 13 GDPR by failing to provide complete and clear information about its identity. It stated that data subjects had to deduce the controller’s identity solely from the email address of an individual who, among other things, was no longer employed by the controller. The DPA also considered that, by providing the contact details of its processor instead of its own contact details, the controller had infringed Article 27(2) ZPOUZP. The court set aside the DPA’s conclusion on Article 27(1) ZPOUZP. It held that the DPA’s findings did not clearly establish that data subjects would be captured by a camera before having the opportunity to see the first video-surveillance notice. Therefore, the court held that the DPA’s inspection report and accompanying photographs did not provide a sufficient basis for concluding that Article 27(1) ZPOUZP had been infringed. Regarding Article 27(2) ZPOUZP, the court upheld the DPA’s finding, noting that the notice did not clearly and intelligibly identify the controller and instead listed the name and email address of a person who was no longer employed by the controller. The court annulled the DPA’s decision in its entirety, because the unlawfulness of one part of the decision affected the legality of the imposed fine. It ordered the DPA to issue a new decision in the case.
Järvenpää parish
A data subject brought a complaint to the DPA concerning the Järvenpää parish (the controller, a religious institution). The controller sent them a letter about their right to vote in the upcoming controller's elections. According to the data subject, the printed text in the envelope allowed third parties to infer that the data subject was a member of the Evangelical Lutheran Church. The DPA dismissed the complaint, and stated that the controller had not processed personal data expressing religious or political beliefs (Article 9 GDPR). In addition, the controller had a legal basis to process the data subject’s personal data through letters. This is because the controller had the duty to ensure that information related to the right to vote reaches the data subject. Finally, the DPA stated that the postal company distributing the envelopes had a duty of confidentiality. The data subject appealed the decision to the Administrative Court, who overturned the decision of the DPA. According to the court, the envelope allowed individuals to infer that the data subject was a member of the church. This indirect information on religious beliefs fell under the scope of Article 9(1) GDPR. Therefore, the controller violated Articles 5 and 9(2)(d) GDPR, as it was not necessary to include this data on the outside of the envelope. According to the court, the controller could have fulfilled the purpose of informing data subjects after the envelope was opened. The controller appealed the decision to the Supreme Administrative Court. The controller argued that including information on the elections on the outside of the envelope does not violate the GDPR, as religious communities have a strong freedom of religious communication. In addition, the controller argued that it implemented appropriate safeguards in processing the data subject’s data. On the other hand, the data subject argued that the controller did not comply with the requirements of data minimisation (Article 5(1)(c) GDPR) when processing data under Article 9(2) GDPR. The data subject argued that the controller could have delivered the information without including information about the controller. The court first clarified that personal data that indirectly reveals sensitive information relating to a data subject may fall under the scope of Article 9(1) GDPR, in accordance with CJEU case law.See C-184/20, Vyriausioji Tarnybinės jaikos Commissioner, margins 125 and 127 to 128 of the judgment, and Case C-21/23, Lindenapotheke, margins 81 to 82 This is also the case for information relating to the data subject to a certain probability but not an absolute certainty.See Case C-21/23, Lindenapotheke, margin 90 Applied to this case, the court noted that the information on church membership indirectly revealed by the outside of the envelope cannot itself be considered as specific evidence of a data subject’s religious beliefs. However, it may allow persons to draw inferences regarding a data subject’s religious beliefs. Therefore, the information on the envelope regarding the data subject’s membership of the church fell under the scope of Article 9(1) GDPR. The court then stated that the purpose of Article 9(1) GDPR is to ensure a better protection of special categories of personal data, as its processing may constitute a particularly serious interference with data subjects rights. When assessing processing of this data, it is also important to consider how seriously it can interfere with data subjects’ rights. The court made a distinction between the data in the outside of the envelope (that is not in itself a specific indication of a data subject’s beliefs) with views or behaviours that directly express religious beliefs; the court considered that the processing in this case did not constitute a serious interference with a data subject’s rights in comparison to data under Article 9(1) GDPR typically does. While Article 9(1) GDPR prohibits the processing of sensitive personal data, Article 9(2)(d) GDPR may be a valid legal basis when carried out in connection to legitimate activities of a religious community, and this data is not disclosed outside of the community without the data subject’s consent. In this case, the purpose of sending the letters was to inform data subjects of the elections. The court considered that this information was provided only to members of the church. Furthermore, the risk of third parties accessing it was low, especially considering the duty of confidentiality of the postal service. The fact that persons in the data subject’s household could access the envelope was not sufficient grounds to conclude that the information outside of the envelope should have been delivered inside the envelope, as the lower court had concluded. Therefore, the court considered that the controller had not violated the GDPR, as it processed the data with a valid legal basis and with appropriate safeguards. The court overturned the decision of the lower court and upheld the decision of the DPA.
MP (Data subject)
In December 2023, callers to a service telephone number operated by a public broadcaster (the controller) heard an automated message stating that calls were recorded and could also be broadcast. Several times during December 2023, the data subject called the service number. The controller recorded the call. On 12 December 2023 and again on 18 December 2023, the data subject complained to the DPA that the controller recorded calls without obtaining consent. The controller argued that the recordings formed part of its statutory quality-assurance obligations. It relied on national legislation requiring it to maintain a quality-assurance system and submitted that the recordings supported that objective. During the proceedings, it also stated that it would adapt its system so that future callers could prevent or interrupt recordings. The DPA upheld the complaint and found that the recording violated the data subject's right to confidentiality. The controller appealed to the Federal Administrative Court. First, the court held that the recording constituted processing of personal data and that the broadcaster acted as controller under Article 4(7) GDPR. Second, the court rejected the broadcaster's reliance on Article 6(1)(c) GDPR. Although national law required the broadcaster to operate a quality-assurance system, the court found that those provisions did not impose a sufficiently specific legal obligation to record callers. Recording service-line calls was not necessary to fulfil the statutory quality-assurance requirements, which could be achieved through other measures such as representative audience surveys, studies and audience consultations. Third, the court rejected using Article 6(1)(e) GDPR as a basis. While the broadcaster's quality-assurance activities served a task in the public interest, recording callers was not necessary for carrying out that task because less intrusive alternatives were available. Fourth, the court rejected Article 6(1)(f) GDPR. The court accepted that the broadcaster had a legitimate interest in maintaining and improving the quality of its public-service activities. However, it found that recording callers was not necessary for achieving that objective. Referring to the principle of data minimisation in Article 5(1)(c) GDPR, the court held that the same purpose could be achieved through less intrusive methods. Finally, the court rejected Article 6(1)(a) GDPR. The court noted that consent requires an active indication of agreement and that the controller must be able to demonstrate it under Article 7(1) GDPR. The fact that the data subject called the service number again after hearing the recording notice did not constitute valid consent. The broadcaster failed to prove that the data subject had actively agreed to the recording. The court therefore upheld the DPA's decision and held that the recording lacked a valid legal basis under Article 6 GDPR.
Court case 42 K 51.25
The property management company of a high-rise building (the controller) had a video surveillance system installed at the entrances of the building in 2021. The installation was approved by the homeowners' association. The footage was stored for 72 hours, and there was no live monitoring. Signs indicating video surveillance were posted at both entrances. The owner of an apartment in the building (a data subject) filed a complaint with the DPA in July 2023. The controller argued that the surveillance was intended to prevent and detect unauthorised access to the building and criminal offences. It also stated that there had been repeated incidents of vandalism and property damage prior to the installation of the cameras. The DPA issued it's final notice in April 2025 and held that no violation of the GDPR could be established. It considered the video surveillance necessary to protect the legitimate interests of data subjects - namely, the protection of property against damage and vandalism. The data subject appealed the DPA decision in April 2025. He argued that there was no particular threat that would justify the installation of a video surveillance system. According to the data subject, an on-site investigation carried out by the Berlin police supported this view. The court dismissed the data subject's appeal. It held that the DPA had fulfilled its obligation under Article 57(1)(f) GDPR and investigated the complaint to an appropriate extent. In addition, the court held that the video surveillance was lawful under Article 6(1)(f) GDPR. The court came to the conclusion that the controller's aim to protect property against vandalism and prevent criminal offenses constituted a legitimate interest within the meaning of Article 6(1)(f) GDPR. It referred to previous jurisprudence and pointed out that video surveillance could be only be justified for such purposes if there is a threat that goes beyond the general risks of daily life. This requirement was fulfilled in the present case, as there had been incidents of vandalism, property damage, and threats. Furthermore, the court held that there were no alternative security measures available that would interfere less with the rights of data subjects and be equally suitable for achieving the purposes of the video surveillance. According to the court, hiring a security service to permanently monitor the entrances to the building would not constitute a milder measure from a data minimisation perspective, since the security guards would have to verify the access authorisations of everyone entering the building and ask them why they wish to enter. Finally, the court argued that the legitimate interests of the property management company ultimately outweighed the interests and fundamental rights and freedoms of the data subjects. The court considered the impact on the individuals being filmed to be minimal: the video surveillance was limited to the entrance areas, the data subjects had been informed of the surveillance and the footage was deleted after 72 hours.
Harri Värs
The data subject asked the county court (Harju County Court) to disclose several documents held by the court. The request covered three different categories of information. First, the data subject wanted to inspect and copy the file of a closed criminal case. Second, requested the applications submitted by third parties who had asked to access another criminal case file. Third, requested the employment contract and job description of the court’s press officer. He also asked whether the press officer had received any disciplinary sanctions. The court answered only part of the request. It stated that no disciplinary sanctions had been imposed on the press officer. However, it refused the remaining parts. It considered that the request required legal assessment and could therefore be treated as a request for clarification rather than as an access-to-information request. It also argued that the criminal case file and the third-party access applications contained personal data and restricted information. The employment contract was also refused on the basis that it contained information subject to access restrictions. The complainant challenged the refusal before the administrative court, which dismissed the complaint and upheld the county court refusal. He then appealed to the second instance court (Tallinn Circuit Court), which also dismissed the appeal. The data subject later appealed to the Supreme Court, which had to decide whether county court had correctly handled the request as a public information request and how access to court-held documents should be reconciled with the protection of personal data. The case raised issues under Article 6 GDPR, since disclosure of personal data by a public authority requires a legal basis; Article 9 GDPR, since archived criminal case files may contain special categories of personal data; and Article 86 GDPR, since the dispute concerned public access to official documents held by a public authority. The Supreme Court partially upheld the appeal. It first held that the complainant’s submission had to be treated as a public information request. The fact that the court had to review documents, assess access restrictions, anonymise information or redact personal data did not change the nature of the request. In other words, an authority cannot avoid the stricter access-to-information framework merely because the request requires a legal and factual assessment. On the archived criminal case file, the court accepted the refusal. It found that such files contain extensive personal data, including data about defendants, victims, witnesses and other persons mentioned in the proceedings. Some of that information may also fall under Article 9 GDPR. The complainant relied on a general interest in checking whether the criminal proceedings had been fair, but the court considered that this was not strong enough to justify access to the whole file. Since any disclosure would require a valid legal basis under Article 6 GDPR and, where sensitive data was involved, an Article 9 GDPR condition, the court held that the rights and interests of the persons mentioned in the file prevailed. However, the court reached a different conclusion for the third-party access requests and the press officer’s employment contract. These documents could not be refused automatically just because they contained personal data. Under Article 86 GDPR, public access to official documents and data protection rights must be reconciled, not treated as mutually exclusive. The authority therefore had to examine the actual documents and assess whether disclosure was possible in part, for example by removing names, contact details or other personal data. The Supreme Court ordered county court to reconsider these parts of the request, while leaving the refusal of access to the archived criminal case file in place.
Swedish Tax Authority
In 2025, the Luxembourgish Tax Authority (the controller) requested a Luxembourgish company to provide it with tax related information from several Swedish data subjects, following a request for assistance from the Swedish Tax Authority. The controller requested information related to one specific data subject, but also requested a complete list of data subjects who held a specific type of loan with the company (including Swedish residents). The purpose was to verify data subjects’ tax situation. The company filed a case with the Administrative Court in September 2025, seeking to appeal the request. The court dismissed this decision, and the company provided the controller with the information. The company anonymised the data that was not related to the specific data subject and Swedish residents in order to comply with data minimisation requirements under the GDPR (Article 5(1)(c) GDPR). The controller requested the complete information, and fined the company €79,000 for refusing to provide it. The company filed a claim with the Administrative Court, who dismissed it and upheld the fine. The decision was then appealed by the company to the court, seeking to overturn the fine. The company argued that it had complied with the controller’s request while complying with the GDPR, and that information of data subjects that were not tax residents in Sweden would likely not be relevant for the controller. The controller argued that the request was justified under national law. The court dismissed the company’s appeal regarding data minimisation, but partly upheld the appeal regarding the fine. The court considered that the company did not comply with the controller’s decision, as it did not provide a complete list of data subjects holding a specific loan type with the company. The court dismissed the company’s data minimisation argument; according to the court, the company did not substantiate its argument as it did not refer to specific articles of the GDPR. Finally, the court considered that the full information was relevant for the Swedish tax authority, and therefore, the request for information was not disproportionate in light of the principle of data minimisation. However, the court reduced the fine to €12.500.
Father (data subject)
The father (the data subject) and the mother (controller) shared a minor child. On 18 May 2024, the data subject brought the child to the retail branch where the controller worked and left the child there. A video surveillance system by the branch recorded the handover. The controller obtained access to the footage and on 1 July 2024, she submitted it to the family court to raise concerns about the child's welfare. During the proceedings, a court-appointed expert assessed the incident and concluded that the father's conduct did not amount to a child welfare risk. On 12 July 2024, the data subject filed a complaint with the DPA. He argued that the use of the retail camera footage for private purposes breached the purpose limitation principle and lacked a legal basis. He also claimed that the retail branch had inadequate security measures because the mother had been able to access the footage. The DPA rejected the complaint. It found that the retail branch was not the controller for the video surveillance processing and that the mother's processing was lawful under Article 6(1)(f) GDPR. The father appealed to the court. First, the court held that the complaint against the retail branch failed because the branch was not the controller for the CCTV system, as another company within the corporate group had decided the purposes and means of the surveillance. Second, the court held that the mother was also a controller for the separate processing, purposes, and for submitting it to the family court. Third, the court assessed the lawfulness of the mother's processing under Article 6(1)(f) GDPR. The court found that the mother had a legitimate interest in asserting her rights in the child contact proceedings and in addressing a potentially problematic handover situation. The court also considered the child's interest in avoiding harmful or conflict-laden handovers to be a relevant third-party legitimate interest. It noted that behaviour and interactions during child handovers are difficult to prove and that a video recording could provide more objective evidence than the parents' conflicting accounts. Finally, the court balanced the competing interests. It acknowledged that the data subject could not reasonably expect the mother to access and use footage from her employer's CCTV system. However, the footage was recorded in a publicly accessible shop, so the child's interests outweighed the data subject's interest in confidentiality. Consequently, the court held that the processing was lawful under Article 6(1)(f) GDPR and dismissed the appeal.
Court case Az. 1 WRB 1.25
A disciplinary superior ordered a soldier (the data subject) to provide proof of her COVID-19 vaccination by presenting her vaccination certificate to the disciplinary superior in March 2023. She refused and lodged a complaint against the order in May 2023. The complaint was rejected in a decision in June 2023. The data subject appealed this decision. A military court rejected the data subject’s appeal and held that the order to provide proof of coronavirus vaccination was lawful and binding. The data subject appealed the case further to the Federal Administrative Court and contested the lawfulness of the order. The Federal Administrative Court held that there was no legal basis for the order to present the vaccination certificate in national law. In addition, the order was unlawful under the GDPR. The court considered the inspection of a vaccination certificate and its evaluation for the decision on a vaccination order to be processing of personal data. According to the court, a vaccination certificate contains information on the vaccination status of an individual and other health data that can only be processed if one of the narrowly defined exceptions in Article 9(2) GDPR is applicable. The court pointed out that German national law allows the personnel of the the medical service of the German Armed Forces to process health data of soldiers for the purposes of preventive medicine within the meaning of Article 9(2)(h) GDPR. However, the disciplinary superior was not part of the medical service and therefore not authorised to process health data. The exceptions in Articles 9(2)(b), (g) and (i) were not applicable to the present case either as the necessity requirement was not fulfilled. The court held that the data subject’s vaccination status could have been verified in a procedure less intrusive to the rights and freedoms of the data subject.
Secretaría General de Instituciones Penitenciarias
Secretaría General de Instituciones Penitenciarias (the controller) is an organ under the Spanish Ministry of Inner Affairs. The controller is responsible for coordinating and monitoring penitentiary institutions in Spain. In 2019, an employee of a penitentiary center (the data subject) brought a complaint to the DPA. The data subject provided a medical note to justify three days of sick leave, however the controller also demanded them to provide the diagnosis or medical treatment in order to justify the sick leave. The controller later reduced the data subject’s pay in relation to the three days for refusing to provide this information, as it considered that the sick leave was not justified. In 2021, the DPA issued a reprimand for the controller, stating that it had violated the principle of data minimisation (Article 5(1)(c) GDPR). The DPA noted that the controller did not have a legal basis to demand this information under Articles 6(1) and 9 GDPR.See decision number PS/00088/2020, https://www.aepd.es/documento/ps-00088-2020.pdf The DPA also dismissed the internal appeal filed by the controller, on the grounds that it had not provided any new facts or legal arguments.See appeal number RR/00103/2021 (same decision number), https://www.aepd.es/documento/reposicion-ps-00088-2020.pdf The controller appealed the DPA’s decision to the High Court in 2021. According to the controller, the data subject did not inform anyone before taking the sick leave, and did not respond to calls attempting to contact them. The controller argued that demanding additional documentation was justified under suspicions of false illness, as unplanned absences from employees can pose a security risk in the context of managing penitentiary centres. The court stated that the controller did not process personal data, because it had simply requested it from the data subject and not collected it. Therefore, the court upheld the appeal and overturned the decision of the DPA. The DPA appealed the decision to the Supreme Court in 2025. The DPA requested the court to overturn the decision of the lower court, and establish in case law that the definition of “processing” under the GDPR is broad and includes situations in which a party requests data in accordance with CJEU case law.See cases C-175/20 Valsts ieņēmumu dienests (Processing of personal data for tax purposes), link to GDPRhub summary, [https://infocuria.curia.europa.eu/tabs/affair?lang=en&sort=AFF_NUM-DESC&searchTerm=%22C-175%2F20%22&publishedId=C-175%2F20 link to Curia]. C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer, link to GDPRhub summary, [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CA0034 link to judgment]. C-659/22 Ministerstvo zdravotnictví (COVID19 mobile application), link to GDPRhub summary, [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CA0659 link to judgment]. C-548/21 Bezirkshauptmannschaft Landeck (Attempt to access personal data stored on a mobile telephone), [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CA0548 link to judgment]. The court first clarified that the controller did process personal data, because the definition of processing under Article 4 GDPR is broad. This means that the controller processed personal data when requesting data from the data subject, even if the controller does not receive it. According to the court, the lower court took a literal interpretation of Article 4 GDPR, and concluded that processing of personal data begins when it is collected. The court argued that this literal interpretation does not align with the intention of the legislator or with CJEU case law.See C-175/20, margins 34, 35, 37 and C-659/22, margins 27, 28, 32 Furthermore, the court argued that it is only possible to ensure an effective protection of the fundamental right to privacy and data protection (both under the [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 8 CFREU] and [https://www.boe.es/buscar/act.php?id=BOE-A-1978-31229 Article 18 of the Spanish Constitution]) if a controller has the obligation to to comply with the GDPR at the moment of requesting data from a data subject. This includes assessing whether the personal data requested are limited to what is necessary for the purpose(s) for which they are collected. The court then stated that the controller must ensure compliance with the principles under the GDPR (Article 5 GDPR) when requesting the data, including the principle of data minimisation. The court noted that national lawLaw 41/2002, of November 14, 2002, basic law regulating patient autonomy and rights and obligations regarding clinical information and documentation (Ley 41/2002, de 14 de noviembre, básica reguladora de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica), https://www.boe.es/buscar/act.php?id=BOE-A-2002-22188 establishes additional protections related to obtaining clinical information and documentation. The court stated that preventing fraud and employee absenteeism are legitimate aims. However, the controller had enough information to achieve these aims with the medical note from the data subject. For short term sick leave, the court considered it unnecessary for the controller to request additional information, especially information that has additional protections under national law. Therefore, the controller processed this data without a legal basis (Article 6(1) GDPR) and in violation of the principle of data minimisation (Article 5(1)(c) GDPR). The court overturned the decision of the lower court, and upheld the decision of the DPA.
Court case W298 2323263-1/11E
The controller was an Austrian advertising company. The data subjects were persons whose conversation was recorded during a meeting with a representative of the controller. On 24 April 2024, a representative of the controller visited the office during business hours to offer advertising services. According to the findings of the court, when scheduling and conducting the meeting, the representative gave the impression that he was acting in connection with the municipality and that the purpose of the meeting was to update data. During the meeting, the representative made an audio recording. The recording captured the conversation with the data subjects and also included information such as an email address, names, social media account names, information about education, and conversations involving other persons nearby. The meeting took place without physical separation from the rest of the office. The representative presented contractual documents during the meeting and one of the data subjects signed the documents. These documents contained a clause stating that, for quality improvement purposes, the client consented to the recording of all conversations and to the taking of photographs when placing an order. The data subjects were informed about the recording clause only during the meeting. They stated that they had not been aware at the beginning that the ongoing conversation was being recorded. The data subjects filed a complaint with the Austrian DPA. The DPA first found that the controller had violated their right to confidentiality by recording the conversation without prior consent, nor overriding legitimate interest. The DPA then opened administrative criminal proceedings and imposed a fine of €6,300, plus procedural costs of €630. The controller appealed. It argued that the processing hadn’t begun when its representative entered the office, but only when the audio file was saved, that one of the data subjects had consented by signing the documents, that no personal data was processed because the voices in the recording couldn’t be linked to identifiable persons and that it had an overriding legitimate interest in the recording. The court relied on the testimony of the data subjects. It found credible their statement that they had not noticed any recording device at the beginning of the meeting and that, had they known about the recording, they would not have held the meeting during office hours or without separating it from other office activities. The court also accepted that one of the data subjects was unaware that the ongoing conversation was being recorded. The court held that the audio recording involved personal data. It reasoned that the persons recorded could be identified because the controller could link the audio file to the date of the meeting, the location, the participants, the practice name and the services discussed. The recording therefore constituted processing of personal data. The court rejected the controller’s argument that the processing only began after the meeting because the data was stored only then. It noted that the controller’s representative had admitted that the recording had started before the conversation started and that more than five minutes had passed before any reference was made to the privacy policy. The court stated that the controller couldn’t rely on consent under Article 6(1)(a) GDPR and Article 7 GDPR. The data subjects were not properly informed about the recording before it began. The reference to the recording clause in the contractual documents was made only during the conversation, after the recording had already started. The court also considered that the strict requirements for voluntary consent were not met, especially because the alleged consent was linked to contractual documents. Moreover, the court held that the controller could not rely on legitimate interests under Article 6(1)(f) GDPR. The controller referred to quality improvement and the possible defence of legal claims. The court pointed out that the purpose of improving quality or supplementing transcripts was excessive and it wasn’t foreseeable that such legal claims would arise. Also, the controller didn’t show that recording the conversation was necessary for those purposes or that less intrusive means wouldn’t have been sufficient. The court also noted that secret audio recordings are generally unlawful and permissible only in exceptional circumstances, which weren’t present in this case. Τhe court additionally found that the controller hadn’t complied with its information obligations under Article 13 GDPR. The required information had to be provided at the time of data collection. Providing information only after a recorded conversation had already begun couldn’t retroactively cure the failure to inform the data subjects in time. The court also upheld the assessment of fault. It considered that the controller, through its representative, recorded the conversation without a legal basis and without providing prior information. The court accepted the DPA’s view that the conduct was intentional or at least negligent. Regarding the fine, the court held that the €6,300 fine was effective, proportionate and dissuasive. The court also ordered the controller to pay €1,260 for the appeal proceedings. The court dismissed the appeal and upheld the DPA’s decision.
Court case 3-24-2146/23
A member of the Estonian Parliament (Riigikogu), the controller, published on his Facebook account a recording of a telephone conversation with an official of the Ministry of Social Affairs, the data subject. The recording disclosed personal data relating to the data subject, including special category data concerning the data subject’s health. The data subject lodged a complaint with the Estonian DPA (AKI), requesting that publication of the video recording be discontinued and that the recording be deleted. The DPA initiated supervisory proceedings and ordered the controller to cease disclosing the data subject’s personal data by removing the video from his Facebook account. The DPA subsequently closed the supervisory proceedings, issuing the controller with a reprimand and a notice terminating the proceedings. The controller then brought an action before the Tallinn Administrative court (Tallinna Halduskohus), seeking annulment of the DPA’s reprimand and notice terminating the proceedings, as well as a declaration that the DPA’s handling of the matter had been unlawful arguing that the conversation was an official exchange, that there was heightened public interest and that publication was part of his parliamentary mandate and covered by Article 6(1)(e) GDPR. The Administrative court dismissed the action. The controller subsequently appealed the Administrative court’s judgment before the Tallinn Circuit Court (Tallinna Ringkonnakohus), seeking annulment of the DPA’s decision and reconsideration of the matter. The court found that the publication of the phone recording on Facebook constituted processing of personal data under Articles 4(1) and (2) of the GDPR. The data subject was identifiable from the recording, including through their voice and the context of the call. The court also fund that the statement “I feel unwell” constituted health data, as it provided information about the person’s health status at a specific moment. The court rejected the argument that the processing fell outside EU law or within the EU common foreign and security policy exception under Article 2(2) GDPR. A parliamentarian’s Facebook publication of a call with a ministry official could not be characterised as an activity outside the GDPR merely because the underlying topic concerned international or EU policy. The court further held that there was no consent under Article 6(1)(a) GDPR, as the data subject had expressly objected to publication of the recording. Also, under Article 6(3) GDPR, processing based on a public-interest task or official authority must be grounded in EU or Member State law. The court found no Estonian or EU provision allowing a parliamentarian to publish an official’s personal data on a personal Facebook account. The right to request information from public authorities did not automatically include the right to disclose the personal data contained in that information. The court also held that parliamentary immunity of the controller did not prevent DPA supervision. Immunity does not give members of parliament broader rights to infringe the rights of others, and the DPA’s order did not prevent the controller from carrying out parliamentary duties. He remained free to communicate the substance of the issue without disclosing the data subject’s personal data. The court also found that Article 2(2)(a) GDPR does not apply in the case since this Article cannot be automatically applied to a specific activity merely because it involves the activities of the state or a public authority itself.
EasyJet Airlines Spain
EasyJet Airlines Spain (the controller) is an airline company. In 2024, Unión Sindical Obrera-Sector de Transporte Aéreo (USO-STA, a trade union in the aviation sector) brought a case against the controller to the High Court. The controller published a seniority list on its intranet, as an obligation from its collective bargaining agreement with SITCPLA (Sindicato Independiente de Tripulantes de Cabina de Pasajeros, also a trade union). This list was made for the purpose of regulating access and organising promotions and changes of contract. The controller pseudonymised the identities of the data subjects, replacing their names with a number. The USO-STA requested the court to order the controller to publish the full names of the data subjects, as it considered that the controller did not fully comply with the collective bargaining agreement. According to USO-STA, this obligation complied with the GDPR, because the controller processed data under the legal basis of legal obligation (Article 6(1)(c) GDPR). The High Court dismissed the case on procedural grounds. According to the court, there was no current and real litigious interest, as the controller fulfilled its obligation in relation to the collective bargaining agreement. The court considered the manner in which the controller did this (pseudonymising the data) irrelevant. The trade union appealed the case to the court. The controller argued that it complied with the collective bargaining agreement, and that it pseudonymised the data to comply with the principle of data minimisation (Article 5(1)(c) GDPR) and CJEU case lawSee case C-65/2023 (MK v K GmbH), https://infocuria.curia.europa.eu/tabs/jurisprudence?lang=en&sort=DOC_DATE-DESC&searchTerm=%22c-65%2F23%22&publishedId=c-65%2F23. In addition, the controller argued that the pseudonymised data allowed data subjects to see their relative position within the company. The court first clarified that the case was admissible, as there was a potential conflict between the collective agreement and national law. The court then considered whether the pseudonymised data fell under the scope of personal data. The court referred to CJEU case lawSee case C-413/23 (European Data Protection Supervisor v Single Resolution Board), margin 72 onwards, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62023CJ0413 and case C-479/22 (OC v European Commission), margin 52-64, https://infocuria.curia.europa.eu/tabs/affair?lang=en&sort=AFF_NUM-DESC&searchTerm=%22c-479%2F22%22&publishedId=c-479%2F22, and stated that if a person is not able to directly or indirectly identify a data subject following pseodonymisation, this pseudonymised data ceases to be personal data for that data subject. The court concluded that personal data has a dynamic and not absolute definition, taking into consideration whether a party has reasonable means to identify a data subject, In principle, therefore, the pseudnymised data would not be considered personal data and fall outside of the scope of the GDPR if the identity of a data subject cannot be linked to the pseudonymised number. The court also noted that, in principle, the controller lawfully pseudonymised the data (as opposed to publishing the full names of data subjects). The court assessed whether the collective bargaining agreement’s obligation to publish the seniority list complied with the GDPR. The court first noted that the controller did not process sensitive personal data (Article 9 GDPR), unless it publishes information related to sensitive data (such as leaves of absence). This was a case by case analysis that fell outside the scope of this case. In terms of lawfulness, the court stated that applicable legal basis was legal obligation (Article 6(1)(c) GDPR), and that the controller could not use the GDPR as a justification to not comply with its collective bargaining agreement. In addition, Article 88 GDPR allows collective bargaining agreements to include provisions on data processing (as an opening clause). Nonetheless, despite the margin of appreciation given to Member States, the collective bargaining agreement must comply with the rest of the provisions of the GDPR. The court considered that employees had the right (under their collective bargaining agreement) to know the job positions and names of other employees. This data, according to the court, is purely work related and has a minor impact on the data subjects. Therefore, including the data subjects’ full names was proportionate and did not violate the principle of data minimisation under the GDPR. The court overturned the decision by the previous court, and stated that the data subjects had the right to have the seniority list include data subjects’ full name, provided that the access to this data is limited.
Court case 6 C 7.24
An insured person (the data subject) lodged a complaint with a DPA in March 2019 against a mutual health insurance association (the controller) that offered screening and preventive programs for i.e. diabetes, asthma and back problems. The data subject stated the controller had violated Articles 5(1)(a), 6(1) and 9(1) GDPR by analysing invoices containing health data of its insured persons for reimbursement in connection with offering individualised preventive programs without first obtaining consent. The DPA issued the controller a reprimand in February 2022 and ordered it to only carry out such processing operations based on consent. The administrative court revoked the DPA decision in March 2023 in response to the appeal brought against it. The higher administrative court dismissed the DPA’s subsequent appeal in June 2024. It considered the challenged DPA decision to be materially unlawful: the court held that the processing was necessary for the purposes of preventive medicine and thus fell under the exception to the prohibition of the processing of sensitive categories of personal data in Article 9(2)(h) GDPR. The DPA appealed the court’s decision to the German Federal Administrative Court. The dispute before it concerned whether the processing operations carried out by the controller were covered by exception in Article 9(2)(h) GDPR and whether there was a legal basis for the processing operations under Article 6(1)(f) GDPR. The German Federal Administrative Court held that the exception in Article 9(2)(h) GDPR was applicable to the processing operations in connection with the screening and preventive programs offered by the controller. The court amended the judgments of the lower courts and dismissed the controller’s claims. The DPA’s appeal was justified. First, the court found that Article 9(2)(h) GDPR was applicable to the present case despite the fact that the controller did not directly provide the health-related services itself, but only arranged them. According to the court, a systematic reading of Article 9(2)(h) supports the view that the concept of preventive healthcare covers the entirety of measures aimed at preventing illness as far as possible, not only the narrow area of a doctor-patient relationship. The necessity criterion was also satisfied: the controller’s interest in the processing was not limited to self-serving economic interests, as improved healthcare will regularly also reduce the financial burden on a large number of insured persons. Furthermore, the processing was carried out on the basis of Member State law in accordance with Article 9(2)(h). Second, the court held that there was no legal basis for the processing of personal data under Article 6(1) GDPR and amended the appealed judgment in this regard. In the present case, Article 6(1)(f) was the only possible legal basis as no consent of the data subject had been obtained. However, the controller had not informed the data subject of its legitimate interests as required by Article 13(1)(d) GDPR. In addition, the court ruled that the balancing test under Article 6(1)(f) GDPR could only lead to the conclusion that the interests of the data subject outweigh the legitimate interests of the controller. This was supported by the higher level of protection of sensitive health data, the wide range of data processing by the controller, and the fact that the health care programs offered by the controller were not a part of the core area of medical care.
Court case 202203874/1/A3
After moving to a new building in 2018, Stichting Focus Filmtheater, the controller, abolished cash payments and allowed customers to pay only by debit card, credit card, or online. The data subject objected to this policy, arguing that forcing card payments unnecessarily involves the processing of personal data and infringes his right to privacy. He therefore filed a complaint with the DPA. The DPA rejected the complaint following investigation, concluding that no likely violation of the GDPR occurred. It considered that card payments were used to ensure employee safety and to enable the performance of the contract with customers. The court of first instance upheld this view. The data subject then appealed to the Council of State, arguing that the DPA had failed to properly assess whether the processing was necessary and justified, and that less intrusive alternatives, such as allowing cash payments, were available. The court held that the DPA’s decision was insufficiently reasoned and therefore unlawful. The court clarified that compliance with the GDPR generally implies compliance with Articles 7 and 8 of the EU Charter and Article 8 ECHR, so no separate human-rights analysis was required. While the court accepted that “(social) safety” can in principle constitute a legitimate and well-defined purpose for processing personal data under Article 6(1)(b) GDPR, it emphasised that such a purpose must be substantiated in the specific circumstances of the case. In this instance, the data subject had credibly argued that staff safety was not actually at risk, and the DPA had failed to demonstrate that abolishing cash payments materially improved employee safety. The mere fact that cash can be stolen was not sufficient to establish a concrete and justified purpose. Because the existence of a legitimate purpose had not been adequately established, the DPA could not properly assess whether the processing was necessary for the performance of the contract or whether it was