GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
Court case C/13/770276 / HA ZA 25-1129
The controller is a national newspaper that published an article reporting on the criminal conviction of the data subject for the sexual exploitation of two underage girls. The article included information about the criminal proceedings and identified the data subject by name, while omitting his surname. The data subject initiated civil proceedings against the controller, arguing that the publication unlawfully interfered with his right to privacy and data protection, in particular under Article 10 GDPR. He claimed that the disclosure of his identity and professional background made him easily identifiable and caused disproportionate reputational harm. He further argued that the offence was relatively minor and did not justify such intrusive reporting. The controller argued that it had acted within its journalistic freedom and fulfilled its duty to inform the public about serious criminal offences. It maintained that sufficient care had been taken to limit identification by omitting the data subject’s surname and that the reporting was accurate, balanced, and in the public interest. The Court rejected the data subject’s claims and held that the publication was lawful. The Court carried out a balancing exercise between the data subject’s right to respect for private life under Article 8 ECHR and the controller’s freedom of expression under Article 10 ECHR, as required when applying Article 10 GDPR. It found that the balance weighed in favour of the controller. In particular, the Court held that the article was based on accurate and established facts, namely a criminal conviction. The disclosure contributed to a debate of general public interest, as sexual exploitation of minors, especially in the context of online platforms, raises serious societal concerns, regardless of the data subject’s characterisation of the offence as “light”. The Court further considered the data subject’s professional background and found that mentioning his profession was justified, as it had been relevant in the criminal sentencing and omitting it could have led to unwarranted suspicion of others in the same profession. The Court emphasised that the right to protection of reputation cannot be relied upon where reputational damage is a foreseeable consequence of one’s own criminal conduct. Finally, the Court found that the controller had acted proportionately, that sufficient steps had been taken to limit identification, and that the overall content, form, and consequences of the publication did not require rectification or compensation.
Court case W258 2271494-1
In late 2021, the data subject received a personalised COVID-19 vaccination reminder letter containing the data subject’s name, address and proposed vaccination appointments. This information was taken from the central vaccination register and patient index, and the letter displayed logos of several public bodies and social insurance entities. On 10 December 2021, the data subject filed a complaint with the DPA. They alleged that the municipal authority (assumed to be the controller) had unlawfully processed and disclosed sensitive health data by sending the vaccination reminder. Separately, the DPA opened an ex officio investigation into the vaccination reminder campaign. In that investigation, the DPA concluded that the municipal authority involved in the campaign acted as controller under Article 4(7) GDPR. The DPA later upheld the data subject’s complaint, as it held that the assumed controller had unlawfully accessed and processed data from the central vaccination register and patient index while having no sufficient legal basis. It rejected the data subject’s request to prohibit further processing and rejected the request for a fine. The municipal authority appealed before the court. It argued, among other things, that it was not the controller for the processing and that the processing had formed part of pandemic management measures. First, the court examined who acted as controller under Article 4(7) GDPR. The court found that the relevant political officeholder, acting within the framework of public health administration, had determined the purpose and essential means of the processing. The municipal authority involved in the campaign merely implemented their instructions. The court therefore held that it had not determined the purposes and means of the processing and was actually not the controller under Article 4(7) GDPR. Second, the court considered that the data subject could not reasonably identify the correct controller because the vaccination reminder letter referred to multiple entities' logos and did not clearly reveal who had decided on the processing operation. The court held that, in such circumstances, the DPA had the duty to determine the correct controller itself. However, the DPA had mistakenly conducted proceedings against an entity that was not the controller. The court further held that the incorrect identification of the controller could not be corrected during the judicial proceedings. Following the case law of the Austrian Supreme Administrative Court, the court annulled the DPA decision in its entirety without replacing it with a new decision. Finally, the court clarified that the annulment did not resolve the underlying data subject complaint on the merits. The data subject’s complaint therefore remained pending before the DPA.
CJEU case C-492/23 Russmedia
Russmedia Digital (Russmedia), a Romanian company, is the owner of the online marketplace www.publi24.ro on which ads for - inter alia - goods or services from Romania can be published, either free of charge or for a fee. An unidentified person published an ad on that online marketplace, the content of which was disparaging and offensive towards the data subject, stating that it offered sexual services (‘the ad’). That ad contained photographs originating from the data subject's social network account but used for the ad without the data subject's consent. The identity of the person posting that ad was not verified prior to publication. When contacted by the data subject, the controller removed the ad from its online marketplace less than an hour later. However, the same ad has been placed online, indicating the the original source as Russmedia, by other websites with advertising content, where it can still be accessed. = Arguing that the ad at issue infringed her rights, the data subject brought an action against Russmedia. The Court of First Instance upheld that action and ordered Russmedia, on the basis of Romanian law to pay the data subject non-material damage caused to her by the infringement of her right of personal portrayal and right to honour and reputation, the breach of her right to privacy, and the improper processing of her personal data. That court took the view that the ad at issue constituted a failure by Russmedia to meet the obligations imposed on it by the GDPR. However, a specialised court upheld Russmedia’s ensuing appeal, ruling that the action brought by the data subject was unfounded because Russmedia was not the author of the ad at issue. The court held that Russmedia was merely providing a service for storing ads, without being actively involved ‘in the content’ of those ads. That court therefore found that Russmedia was exempted from liability by Romanian law for the damage claimed. = The data subject brought an appeal against that d
Court case BA-1S/27/2022
On 23 October 2021, an individual submitted an access request to the Ministry of Justice of the Slovak Republic under the Slovak Freedom of Information Act (Act No. 211/2000 Coll.; “Freedom of Information Act”). The request concerned documents exchanged in proceedings before the European Court of Human Rights (ECtHR) in Shiksaitov v. Slovak Republic (applications nos. 56751/16 and 33762/17). The request covered all submissions made by the Slovak Republic to the ECtHR, all submissions made by the applicant in those proceedings, and all annexes attached to those documents. The Ministry partially granted the request. It disclosed certain government submissions but anonymised parts of the documents. It refused to disclose the applicant’s complaint in full, parts describing the facts of domestic criminal proceedings, file numbers of domestic cases, information relating to the applicant’s financial claims for just satisfaction, and all annexes attached to the government’s submissions. The Ministry relied mainly on Section 11(1)(d) of the Freedom of Information Act (information relating to court decision-making) and Section 9(1) and (2) of the same Act (protection of personality, privacy, and personal data). The requester appealed within the administrative procedure. He argued that the Ministry had misapplied the statutory exceptions, failed to consider partial disclosure, and did not properly explain which legal grounds applied to which parts of the withheld information. The Ministry dismissed the appeal and upheld its original decision. The requester then brought an action before the Administrative Court in Bratislava, seeking annulment of the Ministry’s decisions and a remittal for new proceedings. The Administrative Court in Bratislava annulled the Ministry’s decision and remitted the case for further proceedings. The court held that the Ministry had partly applied the Freedom of Information Act correctly but had committed a legal error in refusing access to the annexes. The court began by stressing that the right of access to information is a fundamental constitutional right. Public authorities must interpret exceptions narrowly and must always prefer disclosure over non-disclosure. A refusal is lawful only if it is based on law, pursues a legitimate aim, and is necessary and proportionate in a democratic society. The court first examined whether the requested information constituted personal data. Relying on the definition of personal data under Article 4(1) GDPR and Slovak data protection law, the court held that the applicant in the ECtHR proceedings was an identifiable natural person. The requested information therefore constituted personal data, including the applicant’s complaint, descriptions of domestic criminal proceedings, domestic case file numbers, and information about financial compensation claims. The court then balanced the right of access to information against the right to privacy and personal data protection. It found that the applicant in the ECtHR case was a private individual and not a public figure. The proceedings did not concern a matter of public interest. In these circumstances, the protection of personal data prevailed. The court therefore agreed that the Ministry lawfully refused access to the applicant’s complaint, domestic file numbers, factual descriptions of criminal proceedings, and information about financial claims. The court added that the Ministry should have explained this balancing exercise more clearly in its reasoning, but the outcome itself was lawful. However, the court reached a different conclusion regarding the annexes to the government’s submissions. The Ministry had refused to disclose them in full because it was not their originator, held only photocopies, and could not assess whether disclosure was lawful. The court held that this approach violated the Freedom of Information Act. The court explained that possession of copies meant that the information was available to the Ministry. Availability triggered a duty to assess disclosure. If the Ministry was not objectively able to assess whether legal grounds for restriction applied because it was not the originator of the documents, it had to forward the request, in whole or in part, to the competent authority that originated the documents, in accordance with Section 15(1) of the Freedom of Information Act. The Ministry could not lawfully refuse access solely because it lacked competence to evaluate the documents. The court also found that the Ministry failed to apply the principle of partial disclosure. It did not identify the annexes individually, did not examine whether only parts required protection, and did not explain why complete non-disclosure was necessary. This amounted to a blanket refusal, which the Freedom of Information Act does not permit. Because the refusal relating to the annexes was based on an incorrect legal assessment, the court annulled the Ministry’s decision and returned the case for new proceedings. The Ministry was bound by the court’s legal interpretation and had to reassess the request in line with the duty to maximise access to information.
Court case Us I-199/2025-9
On 28 January 2025, the Croatian Personal Data Protection Agency (AZOP) dismissed a complaint from a data subject who alleged that an education inspector had disclosed his personal data to the principal of a music school in Rijeka. The data subject claimed that the inspector copied him on an email to the principal without his consent, revealing his identity and breaching the GDPR and the Croatian implementing act. AZOP rejected the complaint, stating that there were no legal grounds to open a procedure, without assessing whether the data subject’s rights had been violated. They argued that the data subject’s allegations were about breaches of sectoral rules governing inspections, not about GDPR violations and consequently they lacked competence. The data subject challenged this decision before the Administrative Court in Rijeka. The Administrative Court in Rijeka annulled AZOP’s decision and sent the case back for reconsideration. The court held that AZOP could not rule on breaches of the Education Inspection Act or the inspector’s disciplinary responsibilities. However, as an independent supervisory authority under Article 51 GDPR, AZOP was competent and obliged to assess whether the data subject’s personal data had been unlawfully processed. The court found that AZOP should have examined the complaint on its merits rather than dismissing it on procedural grounds. The court required AZOP to establish the full facts, determine if unlawful processing occurred, and issue a substantive decision within 60 days. AZOP was ordered to reimburse the data subject €1,000 for legal costs while other cost claims were denied.
Court case 25/12378
The data subject filed a complaint with the Norwegian Data Protection Authority (Datatilsynet) about their employer. The DPA handled the complaint and chose to use corrective measures toward the employer. The data subject attempted to appeal this decision to the Privacy Appeals Board (PVN), but the PVN rejected the appeal because the data subject did not have the right to appeal under the national law. Later, The Civil Ombudsman stated that the data subject actually does have a right to appeal under Article 78(1) GDPR, which gives to the data subject the right to an effective judicial remedy against the DPA’s decisions. The Norwegian Civil Ombudsman argued that the CJEU rulings in SCHUFA and Land Hessen expand complainants’ right to bring legal action, suggesting they may challenge all aspects of complaint handling, including corrective measures. PVN was then instructed to reconsider its decision. Upon reconsideration, PVN concluded that the data subject still does not have the right to appeal DPA's decision. Under [https://lovdata.no/dokument/NLE/lov/1967-02-10 national law], the data subject is not considered a party to the case against the employer. A party is defined as a person “to whom a decision is addressed or who is directly affected by the case,” and PVN found it clear that the data subject did not meet this threshold. Moreover the PVN examined the possible application of Article 78 GDPR. According to Article 78 GDPR, every natural or legal person shall have the right to an effective judicial remedy against a legally binding decision concerning them taken by a supervisory authority. So, the question was whether the right to an effective judicial remedy under Article 78(1) GDPR can be invoked by a data subject who has lodged a complaint with a supervisory body but who are not themselves the addressees of the decision subsequently taken. According to Recital 143, any natural or legal person should have the right to an effective judicial remedy by the com
Court case Az. I ZB 36/25
A data subject filed a lawsuit against a psychiatrist who had prepared a psychological report in family proceedings on behalf of a district court. The data subject claimed that the psychiatrist had unlawfully processed their personal data and relied on Article 79 GDPR. The District Court dismissed the action. The data subject then filed an appeal before the Regional Court, represented not by a lawyer but by a non-profit association. The Regional Court rejected the appeal as inadmissible because, under [https://www.gesetze-im-internet.de/englisch_zpo/englisch_zpo.html § 78(1) of the German Code of Civil Procedure (Zivilprozessordnung – ZPO)], parties before Regional and Higher Regional Courts must be represented by a lawyer. The data subject sought legal aid (Prozesskostenhilfe) to challenge this decision before the Federal Court of Justice (Bundesgerichtshof – BGH). The BGH rejected the application for legal aid because the prosecution did not offer a sufficient prospect of success. The Court clarified that Article 80(1) GDPR did not change the national rule in § 78(1) ZPO, which requires representation by a lawyer before higher courts. Article 80(1) GDPR allows certain non-profit organisations to act on behalf of data subjects in exercising rights under Articles 77, 78 and 79 GDPR, but it does not give these organisations the right to represent parties in court proceedings where legal representation is mandatory. The Court explained that Article 80(1) GDPR regulates the right of a data subject to authorise an organisation to act on their behalf, but it does not confer postulatory capacity or modify procedural requirements under national law.
EDPS
In June 2017, the Single Resolution Board (SRB) adopted a resolution scheme in respect of Banco Popular Español SA. In order to determine whether the shareholders and creditors affected by the resolution action would have received better treatment if that bank had entered into normal insolvency proceedings, SRB asked Deloitte, an auditing and advisory company, to carry out the valuation. Once that valuation was drawn up, in August 2018, the SRB adopted a preliminary decision on whether compensation needed to be granted to the shareholders and creditors (participants), and launched a right to be heard process in order to allow it to adopt a final decision. The participants were invited to express their opinions using an online registration form which permitted SBR to verify their status as affected shareholders and creditors. In the context of that procedure, in June 2019, the SRB transferred some of those comments, in the form of pseudonymised data bearing an alphanumeric code, to Deloitte. Later in 2019, a number of affected participants submitted complaints to the European Data Protection Supervisor (EDPS). They alleged that the SRB had failed to inform them that the data collected through their responses on the forms would be transmitted to third parties, in breach of the terms of its privacy statement. In its decision in November 2020, the EDPS held that the pseudonymous data shared by the SRB constituted personal data because the SRB shared the alphanumeric code that allowed linking the replies to the participants. It found that Deloitte was a recipient of personal data and therefore SRB had infringed the obligation to provide information laid down in Regulation 2018/1725 by not including it in the privacy policy. The SRB brought an action for annulment of the EDPS’s decision before the General Court of the European Union, arguing that the information transmitted to Deloitte did not constitute personal data. The General Court of the European Union upheld the action in part and annulled the decision in question ([https://curia.europa.eu/juris/liste.jsf?language=en&td=ALL&num=T-557/20 T‑557/20]). The General Court pointed out that opinions and views constitute personal data only if they are linked to a particular person. It determined that since EDPS did not carry out such an examination, it could not conclude that the information transmitted to Deloitte constituted information ‘relating’ to a natural person within the meaning of Article 3(1) of Regulation 2018/1725. The EDPS appealed the judgment of the General Court before the Court of Justice of the European Union (CJEU), asking to be set aside, claiming that the General Court erred in law in its interpretation of Article 3(1) and (6) of Regulation 2018/1725. = == The AG opined that a (mere) presumption may apply when assessing if a comment ‘relates’ to its author, but that the comments even without such a presumption ‘relate’ to the data subjects by reason of their content, purpose and effect because they were liable to have an effect on the data subjects’ interests and rights regarding financial compensation. Additionally the AG held, that the aggregated content still reflects personal views, constituting a sum of opinions relating those who expressed them. Otherwise, the AG found, one could avoid the requirement of information ‘relating’ to a natural person by just aggregating them. Therefore the AG took the view that the GC’s assessment is erroneous as it considered that the EDPS had wrongfully found the comments at issue to be ‘related’ to natural persons, within the meaning of Article 3(1) EUDPR. == The AG states, that the question of identifiability illustrates the existence of two very different approaches to the scope of data protection rules, framing the question such: Should pseudonymised data be included within that scope automatically, irrespective of the accessibility of the additional identification data, or should the data following the pseudonymisation process be considered personal data only for those persons who can reasonably identify the data subjects? Firstly, the AG found, that the wording of Recital 16 EUDPR would be pointless if pseudonymisation would not leave open the possibility that the data subjects may not be identifiable. The AG draws a parallel to anonymisation: anonymised data is excluded from the scope of the EUDPR but pseudonymised data is only excluded in so far as the data subjects are not identifiable. Therefore the AG concludes, that pseudonymised data may fall outside the scope of the concept of ‘personal data’ but only where the risk of identification is non-existent or insignificant. The AG considers this to be a strict interpretation of the concept of personal data in line with the objective of ensuring a high level of protection of personal data. The AG states, that the fact that the EUDPR does not apply to data relating to non-identifiable persons does not preclude legal liability where appropriate. On the other hand, the AG found it disproportionate to impose on an entity obligations arising from the EUDPR, which cannot not reasonably identify the data subjects, as this would specifically require it to attempt to identify the data subjects. Therefore, the AG agrees with the GC that it was necessary to determine whether the pseudonymisation of the data at issue was sufficiently robust to conclude that the data subjects were not reasonably identifiable. == The AG opined, that the obligation to provide information of Article 15(1)(d) EUDPR, is - parallel to Breyer - part of the legal relationship between the data subjects, on the one hand, and the controller on the other, and not part of the relationship between the controller and the recipient, namely the processor. Therefore, the AG found, that the controller was obliged to provide information prior to the transfer of the data at issue and irrespective of whether or not they were personal data in the processor’s possession. Therefore, the issue of whether or not pseudonymisation is sufficiently robust and effective ultimately does not seem to the AG to be material regarding the controller’s obligation to provide information. Consequently, the AG is of the opinion, that the judgment under appeal must be set aside. = The AG stated, that if it was alternatively accepted that the recipient’s point of view was relevant in the present case, the AG agrees with the GC, that it was for the EDPS to demonstrate why the pseudonymisation was not sufficient. This is because, in the AG's opinion the controller is discharged of its burden of proof by pointing to the filtering, categorisation and aggregation of comments. The AG was therefore of the opinion that, the judgment under appeal should be upheld as regards this ground of appeal. = The AG concludes, that since the controller failed to fulfill its obligation to provide information under Article 15(1)(d) EUDPR, the EDPS' decision at issue should therefore be confirmed. First, the Court pointed out that the scope of the concept of personal data set out in Article 3(1) of Regulation 2018/1725 is essentially identical to that in Article 4(1) GDPR. Second, the CJEU held that personal opinions or views, as an expression of a person’s thinking, are necessarily closely linked to that person and constitute personal data. Third, the CJEU confirmed that the General Court was correct in so far as it held that the existence of additional information enabling the data subject to be identified does not, in itself mean that pseudonymised data must be regarded as constituting, in all cases and for every person, personal data for the purposes of the application of Regulation 2018/1725. The CJEU ruled that the identifiable nature of the data subject must be assessed at the time of collection of the data and from the point of view of the controller. In so far as pseudonymisation may, depending on the circumstances of the case, efficiently prevent third parties other than the controller from identifying the data subject, for the third parties pseudonymised data must not be considered personal data. Nevertheless, in so far as it cannot be ruled out that those third parties have means that reasonably allow them to attribute pseudonymised data to the data subject, the data subject must be regarded as identifiable. On the other hand, data which are in themselves impersonal for the controller may become ‘personal’ in nature where the controller puts them at the disposal of third parties who have means reasonably likely to enable the data subject to be identified. Those data are personal data both for the third parties and, indirectly, for the controller. Accordingly, the CJEU held that it was only the SRB who was able, via that code, to link the comments to the data, in particular to the identification data of the authors of the comments, received during the registration phase. Deloitte did not have access to the database of data collected during the registration phase. In the third place, the CJEU found that the General Court erred in law in holding that, in order to assess whether the SRB had complied with its obligation to provide information, the EDPS should have examined whether the comments transmitted to Deloitte constituted, from Deloitte’s point of view, personal data. The obligation to provide information laid down in Article 15(1)(d) of Regulation 2018/1725 is part of the legal relationship between the data subject and the controller and, therefore, it concerns the information in relation to that data subject as it was transmitted to that controller, thus before any potential transfer to a third party. The CJEU concluded that the identifiable nature of the data subject must be assessed at the time of the collection of the data and from the point of view of the controller.
CJEU case C‑414/24 Datenschutzbehörde (Articulation des recours)
In 2017 (before the GDPR entered into force), a data subject requested an online physician search platform (the controller) to erase their data. The controller refused, and the data subject brought a claim before a civil court. The data subject requested the controller to erase their data again after the GDPR had entered into force. This request was refused, and the data subject filed a complaint with the Austrian DPA. The DPA dismissed the complaint, on the grounds that they had previously brought the same matter before a court. According to the DPA, filing parallel or consecutive claims with a supervisory authority and a court was incompatible with the remedial mechanism under the GDPR. At the time, the civil court had not reached a final decision. The data subject appealed the decision to the Federal Administrative Court (Bundesverwaltungsgericht, or BVwG), who dismissed the appeal. The BVwG stated that the one-year limitation period under Austrian law had passed, and therefore, the data subject did not have the right to file a complaint with the DPA. The fact that the GDPR had entered into force did not interrupt the limitation period. Both the data subject and the DPA appealed the decision of the Court to the Supreme Administrative Court (Verwaltungsgerichtshof, or VwGH). The VwGH disagreed with the reasoning of the BVwG; the limitation period only started after the controller rejected the data subject’s second erasure request, after the GDPR had entered into force. The VwGH stayed proceedings and requested a preliminary ruling from the CJEU. The question was based on the Case C-132/21, in which the CJEU held that the right to lodge a complaint with a supervisory authority (Articles 77(1) and 78(1) GDPR) may be exercised independently from the right to a judicial remedy against a controller or processor (Article 79(1) GDPR). The VwGH requested the CJEU to clarify the relationship between the remedies, and specifically, whether a DPA can reject a complaint
Court case W252 2307842-1
A data subject filed twenty data-protection complaints between April 2021 and August 2024 against twelve different controllers, alleging violations of the GDPR rights to access, confidentiality, erasure, rectification, and restriction of processing. These complaints were submitted as free-form email attachments rather than using the authority’s structured form, and they consistently contained accusatory, hostile, and often insulting language toward the controllers and toward the Austrian Data Protection Authority (DSB). In many of the complaints, the data subject claimed that access requests had been ignored or incompletely answered, that deletion requests were not fulfilled, or that data had been unlawfully processed or disclosed. Also, the data subject frequently used derogatory expressions combined the GDPR allegations with extensive personal attacks, and repeatedly demanded “as high penalties as possible.” The DSB refused to process the complaints, arguing that the complaints were excessive, abusive, and not genuinely aimed at protecting GDPR rights. The data subject further appealed this refusal to the Federal Administrative Court (BVwG). The court dismissed the complaint and held that the DSB lawfully refused to process the twenty complaints under Article 57(4) GDPR on the ground that they constituted excessive and abusive requests. The Court emphasized that, under CJEU case law, supervisory authorities may refuse to act when complaints are objectively abusive, particularly when the data subject’s dominant intent is unrelated to GDPR-protected purposes. Although a mere quantity of complaints cannot be the sole basis for refusal, the data subject’s pattern, combined with clearly retaliatory and hostile motives, satisfied the requirement of proving misuse. The Court found that the data subject used GDPR procedures as a means of personal confrontation, not to vindicate data-protection rights, and thus his conduct fell squarely within “excessive” and “abusive”
Court case W137 2308681-1
The data subject filed a complaint on 07.05.2024 with the Austrian Data Protection Authority (DSB), alleging that an Estonian company located in Tallinn, Estonia, had failed to fully respond to a request for access under Article 15 GDPR. By 12.02.2025, more than six months later, the DSB had not issued a decision. As a result, the data subject filed an inactivity complaint with the DSB, arguing that it had failed to act within the legally required time. By letter dated 17.02.2025, the DSB informed the data subject that the complaint had been forwarded to the Estonian supervisory authority, which would assume responsibility as the lead supervisory authority. By letter from the DSB dated 20.02.2025, the inactivity complaint was transmitted to the Federal Administrative Court. It stated in particular that, due to cross-border processing, the Estonian supervisory authority is allegedly the responsible authority under the procedure referred to in Article 60 GDPR, and that the decision-making period is suspended for the duration of this procedure, in accordance with national procedural law. The Court dismissed the inactivity complaint as unfounded. Under Austrian procedural law, specifically [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20008255&FassungVom=2025-02-02&Artikel=&Paragraf=8&Anlage=&Uebergangsrecht= § 8(1) VwGVG] and [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A2P24/NOR40262693?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=dsg&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=24&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=12.09.2024&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=f3119544-88f3-40ff-a7b3-a77e97056d8d § 24 DSG,] an inactivity complaint may not be filed until the authority has failed to issue a decision on the matter within six months. However, when calculating this six-month period, any time during which cooperation procedures are carried out under Articles 56, 60, and 63 of the GDPR is excluded. According to Article 56(1) GDPR, when a complaint concerns cross-border processing of personal data, there is a division of responsibilities between a lead supervisory authority, usually the authority of the main or sole establishment of the controller under Article 60 GDPR, and the other supervisory authorities concerned. These authorities are required to cooperate according to the process set out in Article 60 GDPR. In this case, the DSB correctly recognized that the complaint involved cross-border processing, as defined under Article 4(23) GDPR. Therefore, the Austrian DPA qualifies as a concerned supervisory authority under Article 4(22)(c) GDPR. The responsibility for leading the case lies with the Estonian DPA, as the lead supervisory authority. As set out in Article 60(7) GDPR, decisions in such cases are adopted by the lead supervisory authority, even though they are based on cooperation and input from the other authorities involved. If a complaint is rejected, the formal rejection is issued by the supervisory authority where the complaint was originally lodged, in this case, the DSB. As confirmed by [https://gesetzefinden.at/judikatur/bvwg/bvwgt_20240911_w256_2290824_1_00 national case law,] the initiation of the cooperation procedure under Articles 56 and 60 GDPR is not at the discretion of the supervisory authority. It occurs automatically once a complaint involving cross-border processing is submitted. The national procedural deadline for the authority to make a decision was interrupted automatically at the moment the complaint was submitted. Therefore, the DSB is not inactive in the sense of national procedural law, as the conditions for asserting a failure to act have not been met.
Court case Az. VI ZR 426/24
The data subject is a member of the parliament for the party Die Linke. The controller is a state party described as "right-wing extremist small party". The data subject announced a demonstration against governmental actions at the town’s square and a few days later the controller published a post on Telegram and printed flyers announcing a demonstration at the same place and time and for the same cause as the other demonstration. In their announcement they called for a united demonstration and listed the data subject’s name amongst the names of far-right party leaders. The data subject filed a case before the Regional Court (District Court of Leipzig - LG Leipzig) arguing that his good reputation and credibility as politician had been significantly impaired by the fact that the announcement has wrongly given the impression that he was cooperating with a "right-wing party". He requested an injunctive relief and claimed immaterial damages for the violation of his personality rights and privacy rights, under Article 82 GDPR. The Regional Court awarded him €10,000 in immaterial damages and ordered the controller to delete the post. Following the controller’s appeal before the Court of Appeal (Higher Regional Court of Dresden - OLG Dresden), the court overturned the Regional Court's judgment and dismissed the action. It held that the violation of the right to personality did not reach the degree of relevance required for the granting of a monetary compensation and a claim from Article 82 GDPR was also out of the question because this article is not relevant in the area of political debate. The data subject appealed this judgement before the Federal Court of Justice (BGF) pursuing his claim for monetary compensation. The Federal Court of Justice held that the data subject was not entitled monetary compensation against the controller from any legal point of view. First, it held that the controller did not violate the data subject’s right to personality, under na
Irish Life Assurance
The data subject took out a life insurance policy with the controller, an insurance company. Between 2008 and 2020, a few letters containing the data subject’s personal and financial data were mistakenly sent to a third party. In June 2021, the data subject took proceedings to the court of first instance (Circuit Court) claiming that the controller acted negligently and in breach of duty, causing the data subject “distress, upset, anxiety, inconvenience, loss and damage”. The data subject sought a declaration that that the controller violated the GDPR, implemented by Data Protection Act 2018, and the Data Protection Acts of 1988 and 2003, and further sought damages for negligence and breach of duty. However, the court of first instance dismissed the case on the grounds that the data subject had not obtained authorisation from the Personal Injuries Assessment Board (PIAB), an independent body which was set up to make personal injuries claims faster and cheaper. (In most personal injury claims in Ireland, it is required to obtain an authorisation from the PIAB, before taking a claim to court.) The data subject appealed the decision before the court of appeal (High Court), limiting his claim to data breaches that allegedly occurred after the implementation of the GDPR in 2018. He also contended that his claim was not an action for personal injuries as that term is used in the [https://www.irishstatutebook.ie/eli/2003/act/46/section/12/enacted/en/html section 12 of the Personal Injury Assessment Board Act 2003] (the 2003 Act). Instead, it was a claim for non-material damages under the GDPR. The High Court upheld the Circuit court's decision that the PIAB authorisation should have been obtained first and ruled that the action should be dismissed. However, the data subject was granted leave to appeal to the Supreme Court regarding the question of whether a claim for damages for “distress, upset and anxiety” arising from an alleged data breach, falls within the statutory definition of “personal injury” in the 2003 Act and consequently requires a PIAB authorisation. The Supreme Court, after assessing the statutory and common law definitions of “personal injury”, found that the data subject’s claim was wrongly characterised as such. It held that only claims for damages characterised as medically recognised psychiatric injuries constitute personal injuries under the 2003 Act and have to go through the PIAB authorisation process. The Supreme Court held that claims based on mental distress, upset and anxiety should fall under [https://www.irishstatutebook.ie/eli/2018/act/7/section/117/enacted/en/html#:~:text=(1)%20Subject%20to%20subsection%20(,his%20or%20her%20personal%20data section 117 of the Data Protection Act 2018], allowing data subjects to take claims in tort when their GDPR rights have been breached. Nevertheless he noted that they are expected to be compensated very modestly. Therefore, as the classifications of the Circuit and High Court were wrong, the Justice allowed the appeal.
Lisa Ballmann
The ruling relates to the procedural aspects of a cross-border case involving Meta Platforms Ltd. The full summary for the case is available here. = In May 2018 a Facebook user (the complainant) lodged a complaint against Meta Platforms Ireland Ltd with the Austrian DPA. In her complaint, she claimed that the collection of personal data via Facebook violated several rules of the GDPR, including Articles 6 and 9. Short after the complaint was filed, the Austrian DPA held that the case was cross-border in nature and forwarded the complaint to the Irish DPA as the lead supervisory authority. In 2021 the Irish DPA submitted a draft decision to all EEA supervisory authorities. Some of them raised “reasoned and relevant objections” to the draft within the meaning of Article 4(24) GDPR. The DPC decided not to follow some of those objections and, therefore, referred the matter to the EDPB under the GDPR’s consistency mechanism. The EDPB decided the matter in December 2022 with its Binding Decision 3/2022. Following the Binding Decision, the Irish DPA decided the complaint and fined Meta €210,000,000 over the unlawful processing of personal data for targeted advertising on Facebook. = After the dispute resolution procedure of the EDPB the complainant requested access to the case file relating to her complaint. She invoked several provisions of EU primary and secondary law, including Article 41(2)(b) of the EU Charter of Fundamental Rights (“Right to good administration”). The EDPB replied with an email to the complainant (from now on: “the Contested Decision”), granting the complainant access to some of the documents relative to the procedure based on [https://eur-lex.europa.eu/eli/reg/2001/1049/oj EU Regulation 1049/2001]. However, the EDPB held that the complainant had no right of access under Article 41(2)(b) CFREU. As a result, the EDPB only granted the complainant access to parts of the file. The complainant considered that the EDPB violated her rights and filed an
A postal service
Austria’s main postal service is the controller for the case. In addition to providing postal services, the controller is also licensed as an “address publisher" and "direct marketing company”. The controller collected data about Austrian residents (the data subjects) without their consent. In particular, the controller used certain socio-demographic circumstances (e.g. age, place of residence, level of education) for profiling. The profiling consisted in an estimation of the likelihood that a data subject fell within certains categories (e.g. "do-it-yourselfer", "night owl", "person with affinity for investments"). One of the data subjects claimed that the controller processed his data unlawfully and sought immaterial damages for €7,000 under Article 82 GDPR. The courts of first and second instance both denied his claim. In particular, the Court of Appeal held that the data subject failed to prove the occurrence of immaterial damage. It is worth noting that the controller did not disclose the subject’s data. The controller also deleted the data at the request of the data subject, following a 2021 Supreme Court ruling between the same parties. The Court upheld the previous findings of the Court of Appeal and denied compensation. In the Court’s view, the data subject showed failed to prove that he suffered him anxiety or annoyance as a result of the processing of his data. On these grounds, the Court concluded that non-material damages were not proven and could not be compensated. The Court did not assess whether the subject's data were processed lawfully, as he would not have been able to claim damages either way.
Data Subject versus Platform A
The case originated before the Regional Court of Düsseldorf (LG Düsseldorf, 12 O 171/22), where the plaintiff sought non-material damages under Article 82 GDPR, access to information under Article 15 GDPR, and a cease-and-desist order. The dispute concerned Platform A., a social media provider that, by default, allowed profile lookups through mobile phone numbers without requiring explicit user consent. This design enabled a 2019 automated data scraping attack, during which attackers randomly generated mobile numbers and matched them with publicly available user data, such as names and profile identifiers. In 2021, the scraped dataset, including the plaintiff’s mobile number, was found on a publicly accessible online database. Platform A. acknowledged the breach publicly only in 2022. In reaction to the incident and to mitigate further exposure, the plaintiff changed her mobile number between 2021 and 2024, and has pursued claims for loss of control over her personal data and ongoing concerns about potential misuse. The Court held that the unauthorized scraping and disclosure of the plaintiff’s mobile phone number that was linked with publicly available profile data, constituted a loss of control over personal data, and therefore a compensable non-material damage under Article 82(1) GDPR. Under Article 82(1) GDPR, the court reiterated that “loss of control” alone constitutes non-material damage, without requiring proof of actual or tangible misuse. This position aligns with recent ECJ rulings (C‑590/22, C‑340/21) and national precedent from the German Federal Court of Justice (BGH VI ZR 10/24), which held that temporary or one-time loss of control may suffice for damages. In this case, however, the court only awarded €75 in damages, acknowledging that the scraped data was not highly sensitive. Further, the court rejected claims for declaratory relief regarding future harm, reasoning that no further material damage was likely due to the plaintiff’s change of phon
Datatilsynet (NO)
An employer (the controller) accessed the email address of an employee (the data subject) over suspicions of internal fraud. It was later discovered that the data subject committed no fraud. The data subject filed a complaint with the DPA. She claimed that her right to data protection was violated and request the DPA to impose a fine. The DPA held that the controller violated Articles 5, 6, 13 and 14 GDPR. On these grounds, the DPA issued a reprimand against the controller and an order to bring internal processes into compliance. The DPA did not impose a fine. The data subject filed an internal appeal before the Personvernnemnda (the Privacy Appeals Board of the DPA). In her appeal, she challenged the DPA’s decision not to fine the controller. The Board held that the data subject had no standing for appealing the decision and dismissed the appeal on procedural grounds. In this regard, The Board considered that the DPA’s decision put an end to the controller’s violation. On this basis, the Board held that the DPA’s decision not to inflict a fine, did not produce tangible and factual effects for the data subject. This, in turn, led to the conclusion that she was not a party to the decision and could not bring an appeal. The data subject further challenged the Board’s decision before the Sivilombudet (the Norwegian Parliamentary Ombud). She claimed that the Board was wrong in finding that she had no right to challenge the merits of the DPA’s decision. The Sivilombudet held that the data subject could challenge the DPA’s decision, and that she had the right to challenge both its procedure and its merits. In particular, she had the right to a review of the correctness and proportionality of the corrective measures inflicted by the DPA. On these grounds, the Sivilombudet ordered the Board to re-examine the data subject’s appeal, ensuring a full review of the DPA’s decision. = The Sivilombudet observed that the domestic rules on internal appeals against the DPA were not
Data Subject versus City of Osnabrück
The data subject operated a company that supplied explosives to German security authorities. The controller is a Municipality in Germany. The data subject and the controller were involved in a legal dispute before the Administrative court. In 2025, owing to the sensitive nature of his business, he requested the controller to refrain from transmitting his personal data in unencrypted form, and in 2016 the controller assured him that such transmissions would not take place. Nevertheless, between April 2019 and December 2020 the controller sent several unencrypted documents via fax containing data subject's data to the Administrative Court. The documents consisted of seven acknowledgments of receipt containing the data subject’s surname, case designations and file numbers, but no address, financial, or other sensitive business information. The data subject filed a case before the Regional Court (LG Osnabrück) claiming €17,500 in non-material damages under Article 82 GDPR. He argued that the controller was not allowed to send the faxes in an unencrypted form, but rather send the acknowledgements of receipt exclusively by post. He claimed that if intercepted, such data could potentially reveal his connection to explosives as well as his home address and thereby increase the risk of kidnapping, robbery, or extortion. The Regional Court found an infringement and awarded €7,000 in non material damages. The Higher Regional Court (OLG Oldenburg) upheld this award, reasoning that the controller violated Article 6(1)(f) GDPR, since the data subject's interests worthy of protection outweighed the controller's interest in transferring the acknowledgements of receipt unencrypted by electronic means. The court found that the data subject was exposed to increased abstract risk of criminal offenses against his person due to his professional activity, taking into account that no other person with the same surname lived in that area. It also found a violation of Article 18(1)(d) an
Court case VI ZR 67/23
The controller is the operator of a debt collection company that serves clients from the energy sector, among others. On 16 July 2019, the controller notified SCHUFA, a credit information agency, of a claim against the data subject by his electricity supplier that was enforced by an order issued by the local court on the same day. On 12 November 2019, SCHUFA deleted the negative entry made on the basis of a report. The data subject filed a case with the court of first instance (Regional Court Mainz-VG Mainz) claiming that the controller’s notification of the claim to SCHUFA was unlawful because the controller did not wait for the objection period of the enforcement order to expire before doing so. The negative score created by SCHUFA as a result of the controller’s notification led to massive economic consequences and disadvantages for him, including the termination of his credit cards by his bank and the threat of failure of real estate financing. At first instance, the data subject requested, among other things, that the controller be ordered to pay him damages at least €10,000. The court of first instance partially granted his application and ordered the controller to pay him €5,000. Both parties appealed before the court of appeal (Higher Regional Court Koblenz-OLG Koblenz). The court of appeal dismissed the action in full. It held that the data subject failed to demonstrate that compensable immaterial damage had occurred. A mere threat of material damage or the fear of material damage is not sufficient in itself if no further consequences result from this, which was not apparent in the present case and was not substantiated by the data subject. It is not apparent how the alleged termination of his credit cards by the bank actually impaired the data subject’s economic freedom of disposition or how other infringements had occurred his general lifestyle. Overall, he failed to demonstrate how the "damaging event" specifically affected him. The data subject appealed the decision of the court of appeal before the Federal Court of Justice. First, the Federal Court, referring to existing case law, held that non-material damage suffered by the data subject within the meaning of Article 82(1) GDPR is not dependent on a certain degree of seriousness.[https://curia.europa.eu/juris/liste.jsf?num=C-590/22 ECJ, judgments of June 20, 2024 - C-590/22, DB 2024, 1676 para. 26 - PS GbR]; [https://curia.europa.eu/juris/liste.jsf?num=C-741/21 of April 11, 2024 - C-741/21, NJW 2024, 1561 para. 36 - juris; of May 4, 2023 - C-300/21, VersR 2023, 920 para. 51 - Austrian Post] Nevertheless, the data subject has to demonstrate concrete negative effects.[https://curia.europa.eu/juris/liste.jsf?num=C-590/22 ECJ, judgments of 20 June 2024 - C- 590/22, DB 2024, 1676 para. 27 - PS GbR]; [https://curia.europa.eu/juris/liste.jsf?num=C-741/21 of 11 April 2024 - C-741/21, NJW 2024, 1561 para. 36 - juris]; see also [https://juris.bundesgerichtshof.de/cgi-bin/rechtsprechung/document.py?Gericht=bgh&Art=pm&Datum=2024&nr=139818&linked=urt&Blank=1&file=dokument.pdf Senate judgment of November 18, 2024 - VI ZR 10/24, BGHZ 242, 180 para. 29] It also pointed out that the mere loss of control over the data subject’s personal data is considered harm even if no misuse of the data in question has actually taken place to the detriment of data subjects.[https://curia.europa.eu/juris/liste.jsf?num=C-200/23 ECJ, judgment of October 4, 2024 - C-200/23, DB 2024, 2952 para. 145 mwN] Second, the court held that the data subject had sufficiently demonstrated the occurrence of immaterial damage within the meaning of Article 82(1) GDPR in the form of an impairment of his creditworthiness and thus his (economic) good reputation. The data subject's loss of reputation due to the impairment of his creditworthiness as a result of the SCHUFA report at issue had manifested itself in the termination of the credit card agreements and the threat of termination of the entire business relationship by the bank. This already demonstrated the occurrence of immaterial damage within the meaning of Article 82(1) GDPR. The court further determined that due to the negative SCHUFA entry, the data subject’s credit cards had been blocked and remained blocked despite the deletion of the negative entry. Plus, between the registration and the deletion of the entry, there was also a threat of failure of a real estate financing. Therefore, the data subject adequately proved that he suffered concrete negative effects which were attributable to the notification at issue. Third, due to the unlawful transmission of his data to SCUFA, the data subject also asserted immaterial damages against the controller in the form of loss of control over his data. Any involvement of the data subject in the creation of the negative score is irrelevant to the question of whether he suffered non-material damage. In this respect, the existence of non-material damage eligible for compensation under Article 82(1) GDPR cannot be denied on the grounds that the data subject only settled the claim enforceable by the enforcement order after it was issued. In conclusion, the Federal Court held that the reasoning of the court of appeal that the data subject had not sufficiently demonstrated the occurrence of non-material damage within the meaning of 82(1) GDPR was legally incorrect. The appeal judgment was therefore set aside and the case was referred back to the court of appeal for a new hearing and decision.
Court case 324 O 278/23
In 2022 the Berlin Administrative Court issued a ruling. The ruling included statements about the plaintiff (the data subject). In particular, the ruling stated that they were in arrears with the payment for their pension plan and that they received unemployment benefits for a while. Non-profit legal database OpenJur (the controller) provided a free digital legal database. In the context of this activity, the controller published the ruling of the Administrative Court in its database. The controller did not remove the data subject's name from the ruling before publishing. The data subject found the ruling on the database and requested the controller to remove it. The controller anonymized the ruling by removing the data subject's name but refused to remove the ruling. The data subject filed a lawsuit with the Regional Court of Hamburg. They claimed for damages and sought an injunction for the controller to remove the ruling from the database. First, the Court clarified that the controller's activities were journalistic in nature and, therefore, fell within the scope of Art. 85(2) GDPR (national exemptions for journalistic activities) and the relative German laws[1]. In this regard, the Court noted that the controller did not simply publish rulings. On the contrary, the controller carried out an editorial activity by choosing the decisions to publish, requesting unpublished decisions from courts, and providing summaries for the decisions. Then, the Court clarified that the controller's activities were lawful under national law. In particular, the Court noted that the Berlin Administrative Court was a "privileged source" of information. The Hamburg Court held that in relying on such a source, the defendant acted justifiably and was under no obligation to conduct subsequent research[2]. For these reasons, the Court dismissed both the damage claim and the request for injunctive relief.