GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
Ida-Tallinna Keskhaigla
On 13 February 2023, the DPA imposed a fine of € 200,000 EUR to Ida Tallina Central Hospital (‘controller’) for the unlawful disclosure of health data within the meaning of Article 9(1) GDPR. A member of the management board threw them into an open bin outside of the hospital and open to public access. With this conduct, the controller violated the requirements of Article 32(1)(b) GDPR to ensure the confidentiality of the services processing personal data. Pursuant to Article 62 PDPA, the controller committed a misdemeanour. The decision of the DPA was appealed by the controller. On 31 August 2023, the Harju County Court (‘first instance court’) annulled the decision of the DPA and ruled that the controller could not be punished for committing a misdemeanour because of the principle of derivative liability applied. According to this principle: 1) a legal person, such as a hospital, can only be liable for an offence if the conduct of its body, member, manager, or competent representative met all the elements of a tort or delict, and 2) if the act was committed in the interests of the legal person. In this case, the violation was attributed to a member of the management board, but the misconduct did not meet all the legal elements of the offense to be done in the interest of the hospital. Since this was not the case, the hospital could not be held liable for the alleged infringement. On 21 December 2023, an appeal against the decision of the first instance court was filed by an out of court proceeding by the data subject which sought the annulment of the above decision. The controller argued in the appeal proceeding that the misdemeanour proceedings should be terminated as the offence is time-barred according to 29(1)(5) Code of Misdemeanour Procedure (‘VTMS’). The Supreme Court clarified that in Estonia, due to the unique structure of their legal system, fines for GDPR violations are imposed through misdemeanour procedures by a supervisory authority. The sam
A. T.
The case concerns a data subject who filed a complaint with the DPA alleging a violation of the GDPR by the controller (a hospital) according to [https://narodne-novine.nn.hr/clanci/sluzbeni/2018_05_42_805.html Article 34 of the Act on the Implementation of the GDPR (Zakon o provedbi Opće uredbe o zaštiti podataka - ZPOUZP)]. The data subject claimed the controller failed to provide access to her medical documentation and failed to inform her of its loss. The controller attributed the loss to irreversible server changes during a system overhaul in 2018/2019. The data subject filed the complaint with the DPA in November 2023, which included details of the alleged personal data breach and supporting evidence. The DPA initiated an investigation requesting an explanation from the controller, including why the data subject was not informed about the data loss as required under Article 34 GDPR. Despite the DPA's actions, including supervisory activities at the hospital, the DPA did not resolve the case within the 60-day deadline prescribed under [https://narodne-novine.nn.hr/clanci/sluzbeni/2009_04_47_1065.html Article 101(2) General Administrative Procedure Act (Zakon o općem upravnom postupku - ZUP)]. The delay was attributed to a high volume of cases and limited resources. The data subject then initiated an administrative inactivity complaint, and the Administrative Court in Rijeka ruled in her favor. The court ordered the DPA to issue a decision on the case within 60 days under [https://narodne-novine.nn.hr/clanci/sluzbeni/2010_02_20_483.html Article 58(3) Act on Adminstrative Disputes (Zakon o upravnim sporovima - ZUS)] and awarded the plaintiff €2,500 for the costs of the legal proceedings under [https://narodne-novine.nn.hr/clanci/sluzbeni/2010_02_20_483.html Article 79(4) ZUS].
Municipality of Beaucaire
The French DPA (CNIL) issued a decision against the municipality for multiple violations of the GDPR stemming from a video surveillance system and automatic license plate reading devices. According to the CNIL, the municipality was not a competent authority entitled under the [https://www.legifrance.gouv.fr/codes/texte_lc/LEGITEXT000025503132/ Internal Security Code] (Code de la sécurité intérieure) to implement automated reading devices for the registration plates of vehicles. Additionally, the collection of registration plate data for the sole purpose of responding to the requests of law enforcement officials, exercising their judicial police duties would not correspond to one of the purposes listed in article L. 251-2 of Internal Security Code. Also, the municipality was obliged to perform the DPIA, because 73 cameras covered the areas accessible to the public, inter alia areas close to major routes of passage and several public services and infrastructure. Hence, data processing at hand posed a high risk to rights and freedoms of natural persons and the duty to perform DPIA under Article 35 GDPR was due. The CNIL also found the municipality violated Article 32 GDPR for several reasons, including network infrastructure issues, usage of a server operating systems with no update-support for nearly 10 years and no maintained service by the developer, and for insufficient practices regarding the security of passwords used for applications within the community. The municipality filed an appeal to overrule the decision. The French Supreme Administrative Court (Conseil d'Etat) rejected the appeal. First, the court emphasised that the municipality implemented the devices in question for the sole purpose of responding to the requests of the security forces, i.e., making the data available to the security forces for the exercise of their judicial police duties. However, such a purpose was not provided for in article L. 251-2 of the Internal Security Code, making the ac
Medhelp Sjukvårdsrådgivning AB
Swedish DPA fined Medhelp (Controller) a total of € 1,200,000 (SEK 12 million) for several breaches of GDPR. The Controller was contracted to answer and give medical advice on the medical advice phone line '1177' by three Swedish regions. The DPA found that the Controller breached GDPR on the following points: a) Medhelp was fined for unlawfully disclosing personal data to MediCall, a Thai company, and for allowing MediCall to process personal data, violating Article_5_GDPR#1a, Article_6_GDPR, and Article_9_GDPR#1. b) Medhelp, for an unknown period, exposed personal data in from of audio files containing recorded phone calls to 1177 on the internet without protection against unauthorized disclosure and unauthorized access, breaching Article_5_GDPR#1f and Article_32_GDPR#1 . c) Medhelp, other than an automated message stating that the calls were being recorded for patient safety and quality purposes, did not properly inform callers about how their personal data would be processed in connection with the collection of personal data during phone calls to 1177, in violation of Article_5_GDPR#1a and Article_13_GDPR. Medhelp appealed the DPA's decision to the Administrative Court in Stockholm, which overturned point (a) of the decision and remanded the issue to IMY for further processing, amended the decision for points (b) to (d) to reduce the sanction fee to 8,800,000 SEK, and dismissed the appeal in other respects. The Administrative Court annulled point (a) of IMY's decision, because both MediCall and Medhelp were deemed healthcare providers with responsibility for the personal data under Swedish laws, and MediCall's personnel were also subject to confidentiality obligations specified in [https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/patientsakerhetslag-2010659_sfs-2010-659/#K6 Chapter 6 of Patient Safety Act.] That court ruled that Medhelp was legally permitted to disclose personal data to MediCall for processing in relation
BL
The data subject (the claimant) bought a household appliance. To buy it he entered into a payment contract with Saturn Media Market (the controller). This contract contained the claimant's personal data (first and last name, address, place of residence, employer, income and bank details) and was printed and signed by both the controller and claimant. The claimant took the appliance and contract to the check-out desk at the Saturn Media Market. A third party slipped past the claimant in the line and was able to collect both the appliance and the contract. An employee at Saturn Media Market realised the mistake and was able to reclaim the appliance and contract within half an hour. There was no evidence that the third party misused the personal data of the claimant. The controller offered to compensate the complainant for the mistake by sending the appliance free of charge to his house. The claimant refused and requested damages under Article 82(1) GDPR. The claimant brought an action before the Amtsgericht Hagen (Hagen District Court, Germany) wanting compensation for the non-material damage he claimed to have suffered as a result of the error made by Saturn's employees and the risks resulting from the loss of control over his personal data. The Hagen District Court referred seven questions to the CJEU: # Is Article 82 GDPR valid given that the Article itself appears to to lack precision as to its legal effects in the event of compensation for non-material damage. As no automatic legal effects are specified, is the compensation rule is valid in respect of non-material damage? # Does the complainant need to prove, in addition to the unathorised disclosure to a third party, the existence of a damage? # Does the mere fact that printed documents containing personal data that have been transmitted without authorisation to a third party due to an error committed by employees of the controller, establish a breach of the GDPR? # Does unintenional disclosure (via a breach
ZQ
The Medical Service of Health Insurance (the controller) is Germany's public health insurance medical review service. It provides expert reports when people say they are unable to work, as well as for its own staff. Before becoming unable to work, the data subject worked for the controller. The insurance company that was paying their benefits requested an expert opinion from the controller. The controller obtained health information from the data subject's doctor in the form of a medical report, which was then distributed to the data subject's coworkers. The data subject believed that their medical data had been unlawfully processed and sought €20,000 in damages from the controller, who rejected the claims. According to the data subject, the evaluation should have been performed by another organisation in order to prevent coworkers from accessing their medical data. Furthermore, they considered the security procedures around their medical report's archiving to be inadequate. After being rejected at first and second (Landesarbeitsgericht Düsseldorf) instance, the the data subject appealed to the Federal Labour Court, who referred the case to the CJEU with the following questions: On the topic of health data 1) Does Article 9(2)(h) GDPR prohibit a medical service of a health insurance fund from processing its employee’s health data when it is a prerequisite for the assessment of that employee’s working capacity? 2) If the Court answers Question 1 in the negative (with the consequence that an exception to the prohibition on the processing of data concerning health laid down in Article 9(1) GDPR is possible under Article 9(2)(h) GDPR) in a case such as the present one, are there further data protection requirements, beyond the conditions set out in Article 9(3) GDPR, that must be complied with, and, if so, which ones? 3) If the Court answers Question 1 in the negative, does the permissibility or lawfulness of the processing of data concerning health depend on the fulf
CJEU case C‑340/21 Natsionalna agentsia za prihodite
With its first question, the referring court asked whether the fact that a GDPR violation effectively occurred automatically entails that the controller did not comply with its obligations to implement appropriate measures under Articles 24 and 32 GDPR. According to the Advocate General, appropriate measures shall be in line with the state of the art. However, this cannot guarantee that in exceptional situations they will always be effective. In addition, Article 32(1) GDPR specifically mentions that the controller may take into account the “cost of implementations” that a certain security measure entails. With its second question, the Supreme Administrative Court tried to ascertain what kind of test should a judicial authority perform when assessing the suitability of the measures adopted by the controller. The Advocate General stressed that judicial scrutiny cannot be limited to the existence of measures in place. The third question concerned how to allocate the burden of proof concerning the suitability of the security measures. In the Advocate General’s Opinion, it is the controller who has to bear such a burden. The data subject, in the context of an action pursuant to Article 82 GDPR, shall prove a GDPR infringement, the existence of a damage and a causal link between the former elements. However, a burden of proof on the data subject concerning the suitability of the measures would make the fulfillment of the action almost impossible in practice. With the fourth question, the referring court asked whether the fact that the data breach occurred because of third parties’ actions entails that the controller was no longer liable under Article 82(3) GDPR. The Advocate General categorically excluded this interpretation, highlighting that a controller ceases to be liable only when it shows the lack of fault on his side. The fifth question concerned the notion of non-material damage. In particular, the court wondered whether the data subject’s concern that their data
Sanoma Media Finland Oy
The data subject had asked the Administrative Court of Hämeenlinna (the Court) to overturn [https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_9970/163/2019 the Finnish DPA's decision], according to which the media outlets owned by Sanoma Media Finland Oy (the controller) were not obliged to erase personal tax information because it was processed for journalistic purposes. The data subject filed the appeal claiming that the controller had processed their personal data unlawfully, and claimed that, unlike individual news that utilises public tax information, the tax information portals published by the controller do not contribute to the emergence of an important social debate. The data subject considered that the tax information portals contained information covered by the protection of people's privacy, which enabled the precise identification of individuals, and which had caused harm to the data subject and their family. The data subject also stated that if the Court considered that the tax information had been processed solely for journalistic purposes, the processing of personal data in the tax information portals had in any case violated Article 5(1)(a) GDPR and Article 32 GDPR, because the large-scale and permanent publication of personal data of a large number of people did not meet the requirements set for the security of processing. The controller emphasised that the tax information portals enable public debate on socially significant topics related to taxation, such as income disparity. The publication of tax information promotes opportunities to make observations related to society, especially when the information is available to everyone free of charge. The DPA pointed out that the question is not whether tax information can be published, but whether [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L5P27 Section 27(1) of the Finnish Data Protection Act] applies, according to which certain provisions of the GDPR do not apply to the processing of personal data solely for journalistic purposes. The Court noted that the purpose of publishing tax information could reasonably be considered to be disclosure of information to the public. In the tax information portals published by the controller, public tax information concerning the data subject has been processed solely for journalistic purposes in accordance with [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L5P27 Section 27(1) of the Finnish Data Protection Act]. In this respect, the Court considered that information published on the tax information portals consisted of accurate public tax information and did not reveal sensitive details of the data subject's private life. Therefore, the exemptions provided for in [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L5P27 Section 27(1) of the Finnish Data Protection Act] could be deemed necessary to reconcile the right to the protection of personal data with the freedom of expression and information in accordance with Article 85(2) GDPR. The Court held that the provisions on the security of processing in Article 32 GDPR are not intended to limit the publication of information resulting from the purpose of the processing of personal data, and they may not be interpreted together with Article 5(1)(a) GDPR as restrictions on such processing. In light of this, the Court agreed with the DPA that the controller had not violated the GDPR or the Finnish Data Protection Act.
Court case W108 2263948-1/4E
A data subject installed at the front door of his house a camera provided by a telecommunications service provider, the controller. After noticing that he no longer received e-mail notifications from the front door camera he contacted the controller and received different and contradictory information about the causes of system's malfunctioning in different occasions. On this basis, he suspected that his personal data had been leaked due to a ransomware attack and again contacted the controller about this. The data subject later found out that his account had been automatically blocked and the controller replied that this occurred because the account had been improperly used. The data subject was thus certain that he had been subject to a personal data breach, which the controller should have informed him about under Article 12 GDPR in a transparent manner. As a consequence, he believed that this violated his rights under several GDPR provisions, including Article 22 GDPR and filed a complaint with the Austrian DPA (DSB). However, due to a delay in the procedure, the data subject filed an appeal before the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG) as he claimed that the DSB failed to take a decision within the prescribed time limit. On the basis of the submissions of the parties, the BVwG first of all ascertained that there had been no unauthorised access to the data subject's data and that the controller had credibly demonstrated that there had been no hacker attack, hence there had been no violation of Article 12 GDPR, Article 5 GDPR and Article 34 GDPR. The BVwG instead determined that the blocking of the complainant's email account was set by an algorithm due to unusually high activity as an anti-spam measure. Effectively, the controller had submitted that it noticed a high number of e-mails were being sent from the data subject's account within a short period of time, and suspected a misuse of his account. As regards the s
The parties were in dispute over claims for damages, injunctive relief and information in relation to the use of the social media platform Facebook operated by Facebook (now: Meta) and a data scraping incident. The data subject is a Facebook user. Facebook operates a social media platform and is the data controller. Among other features, Facebook provides its users with the ability to import contacts from their address book, called the Contact Import Tool. The purpose of the tool is to allow users to import contacts and thus find friends on Facebook's social media platform. The Contact Import Tool has been abused by unauthorised third parties to harvest contact information from Facebook users. By enumerating batches of possible phone numbers, it was possible to manipulate the tool to return personal information about Facebook users. The data queries were automated. This made it possible to extract large amounts of data from Facebook's user database. Unauthorised third parties were able to match the phone numbers on Facebook with certain publicly available data to further identify specific individuals. At an unknown time, presumably between January 2018 and September 2019, third parties read personal data (specifically name, gender and user ID) from Facebook's database and were able to associate specific phone numbers with each record. At the beginning of April 2021, the data sets obtained in this way were made available for download on the Internet in a well-known "hacker forum", including the data set of the data subject. The data subject is of the opinion that he is entitled to non-material under Article 82(1) GDPR, because Facebook made the plaintiff's personal data available to unauthorised third parties. In particular, Facebook did not adequately protect personal data from web-scraping attacks, for example by using "security captchas" to make it more difficult for software to make automated queries. The data subject further argued that Facebook failed to co
Court case 19 O 147/22
The data subject was a computer scientist and Facebook user. While using Facebook's social media services, the data subject provided several mandatory personal data, including their first name, last name and sex.. These data points, including the system generated "Facebook ID", were publicly visible by default on the user profile. In addition the data subject added his mobile phone number. The mobile phone number was also visible by default but the user could change the visibility in the settings. The data subject limited the visibility to the "target group search“ setting, but left the searchability option for his mobile phone number visible. In 2021, unknown “third parties” published data, that has been scraped from the website in 2019. The data subject lamented that since then he received anonymous calls and spam emails. This entailed negative psychological consequences for him. Thus, the data subject asked for €500 in non-material damages under Article 82 GDPR. The controller replied that data scraping - which is not hacking - does not entail a violation of the GDPR by the controller, as no mandatory security measures where circumvented and the plaintiff made an informed decision to voluntarily share their phone number on the site. The court rejected the request for damages under Article 82 GDPR. The court held that there was no breach of duty by the controller that could trigger damages. The publication of the mobile phone number wasn‘t mandatory and the data subject had the (unused) option to hide the phone number on their profile. The court was of the opinion, that the controller did not breach its duty to adequately protect the personal data of users in accordance with Article 32 GDPR. The controller was not obliged to take protective measures to prevent the collection of already publicly accessible information. The controller also did not violate the principle of "privacy by default" enshrined in Articles 24 and 25(2) GDPR. It was undisputed that only th
Østre Toten municipality
This case is an appeal of a decision in which the DPA fined a municipality (the controller) about €352,555 (NOK 4,000,000) for violating Article 5(1)(f) GDPR, Article 24 GDPR and Article 32 GDPR after a serious ransomware attack led to highly sensitive personal data being irreparably lost and sold on the dark web. The controller disagreed with the DPA on the part of the decision pertaining to the fine and asked them to reconsider their position. After the DPA had reviewed the case again, they found no grounds to change their decision and so, as per Norwegian procedures, referred the case to the Privacy Appeals Board. In their comments to the Privacy Appeals Board, the controller argued that the grounds for an administrative fine were non-existent. They also held that they had implemented sufficient technical and organisational measures available to them as per their internal resources and in line with Article 24 GDPR and Article 32 GDPR. The Privacy Appeals Board reviewed the case, both parties' arguments, grounds for imposing an administrative fine as per the GDPR, as well as the objective and subjective grounds for assessing if personal data breaches took place. After assessing the controller's personal data practices, the Privacy Appeals Board held that they agreed with the DPA in that the various deficiencies represented fundamental shortcomings in the controller's information security, resulting in violations of Article 24 GDPR and Article 32 GDPR. When assessing the subjective grounds, however, the Privacy Appeals Board noted that the DPA had taken an incorrect legal standpoint and interpreted the legality inaccurately. They disagreed with the DPA's interpretation that the Chief Municipal Executive was objectively responsible for the personal data breaches, regardless of him acting negligent. In the Privacy Appeals Board's view, the insufficient IT security must be sees against a lack of focus over time, long before the Chief Municipal Executive was employed
Stichting Bravis Ziekenhuis (hospital)
The data subject went through a turbulent divorce with her ex-partner. Afterwards, her ex wrote a book about it. Some parts of the book contained information on the data subject’s medical status. Coincidentally, the publisher of the book used to worked at the hospital (the controller) where the data subject was a patient. On top of that, the publisher was the ex’s new partner. After the book was published, the data subject requested the controller for access to the logging data of her patient record. The logging data revealed that her ex’s new partner frequently accessed her patient file for four years. The data subject therefore filed a complaint with the controller, to which the controller replied in a letter. The controller stated that the ex's new partner's employment had been terminated. However it could not establish that she was the reason that the data subject's medical information was published in the book. The data subject was not satisfied with the content of the response and took the case to court. The data subject claimed that the controller was liable for the (non-material) damages that she suffered because (1) the controller took insufficient measures to protect her medical data and (2) insufficiently investigated the data breach. In addition, the data subject argued that the controller was liable for damages caused by its employee (the ex’s new partner/publisher) who accessed her medical records and subsequently published those in the book. The Court held that the controller's monitoring policy did not meet the necessary standard, as it was non-existent. As a result, logging by employees with unrestricted access (like the present case) was not monitored at all and only two patient files were randomly checked every month. The Court found that this fell short, given the amount of personal data processed by the controller. It therefore held that the controller violated Article 32 GDPR, as no appropriate measures were taken to protect the data subject's medical data. The Court held that the controller sufficiently investigated the breach, however it noted that it could have been handled better (for example by personally contacting the data subject). The Court noted that to allow the claim for non-material damages, the data subject's honour or reputation must have been harmed, or she had to have suffered in some other way pursuant to article 6:106(b) BW. The Court stated that it could not establish whether her honour or reputation were harmed. Hence, it investigated whether she suffered 'in some other way'. The Court assessed whether the nature and gravity of the violation would imply such obvious adverse consequences for the data subject, that notable harm to her could be assumed. The Court considered that the data subject’s fundamental right to privacy and data protection were violated. Moreover, special categories of personal data (medical data) were involved. The Court stated that the data was frequently accessed, over a long period of time, and inadequately protected. The medical information was then shared with third parties and published in a book. The Court therefore held that it was obvious that the data subject suffered adverse consequences from the violation (e.g. anxiety). In addition, the Court noted that the concept of 'damages' must be interpreted broadly pursuant to Recital 146. Furthermore, the importance of control over personal data and enforcement of the violated rule follows from the GDPR. The Court therefore held that a regulation-compliant interpretation of article 6:106(1) BW (also) implied that data subject was entitled to fair compensation for her non-material damages. Therefore, the Court ordered the controller to pay the data subject €2,000 in immaterial damages.
Court case 15 Verg 8/22
The respondents issued a Europe-wide invitation to tender for the procurement of a digital discharge management software. One of the exclusion criteria ("A-Criteria") was the software-related compliance with a GDPR draft contract. Additionally, the fact that the data is exclusively processed in an EEA data centre where no subcontractors / group companies are located in third countries, was designed as an evaluation criteria ("B-Criteria"). Both the applicant and the interested third party submitted a bid. The respondents awarded the contract to the third party. The applicant complained that the interested third party should have been excluded from the tender evaluation because, among other things, their bid violated the mandatory legal requirements of the GDPR by processing personal data on servers to which third countries had access. They used A. S.à.r.l. as a subcontractor. The agreement between the third party and A. S.à.r.l. in implementation Article 28 GDPR allowed A. S.à.r.l. to disclose personal data processed on behalf of the customer without or contrary to the customer's instructions and to transfer such data to a third country if this were necessary to comply with laws or binding orders issued by a state authority. Moreover, a supplementary addendum to the agreement stated that A. S.à.r.l. would challenge any unreasonable request by a governmental body. This would already show that A. S.à.r.l. assumed that it would be subject to a request for surrender by the US authorities. The respondent and the interested third party argued to the contrary that the bid did not constitute an infringement against the GDPR since a theoretical possibility of access by the third country did not constitute a transfer of personal data. Moreover, the defendant used standard contractual clauses and implemented the supplementary provisions required by the ECJ under the Schrems II case law through further agreements with A. S.à.r.l.. The procurement chamber agreed with the applic
Court case C/16/526196/ HA RK / 21-01
The applicant’s marriage to Ms D was converted into a registered partnership, after which the applicant and Ms D entered into a covenant for the termination of the registered partnership and a partial dissolution of the matrimonial community of property. The community of property was successfully dissolved in 2004. In the abovementioned covenant, the applicant and Ms D had agreed to continue their joined ownership of the life insurance policy. In particular, there was first an obligation to share the value with each other upon payment and second Ms D had the obligation to reimburse the applicant annually for the subscription of the insurance. A dispute arose in relation to ASR’s compliance with the GDPR obligations. Hence, the applicant will be referred to as the data subject and ASR will be referred to as data controller. In particular, the data controller informed the data subject of the personal data kept on him by the data controller. However, the data subject believed that this information was inaccurate and incomplete. Therefore, the data subject initiated several procedures against the data controller. The first four requests concern the right to inspection. Precisely, a request for full access of the data subject’s data kept by the data controller, based on article 15 GDPR. Moreover, a request for an overview of the contacts the data controller had with third parties, as well as a list of documents added to the data subject’s file on request of third parties. Finally, the data subject requested a copy of the complete file of his documents from either 2004 or 2016 onwards. With his final three requests, the data subject asked the court to order the data controller to handle the agreement with the data subject in accordance with the GDPR, to delete all personal data of the data subject after proper termination of the agreement and to order a payment of the material and immaterial damages suffered by the improper implementation of the GDPR. First, the Cour
Court case 5 L1281/22.F
The data subject distributed weapons of war and security products to the German authorities. Due to their "physical and chemical properties," the data subject's products were particularly suitable for illegal activities, and he feared becoming a target of kidnapping or robbery to obtain those products if his personal data were exposed. The German Federal Office for Economic Affairs and Export Control (hereinafter “Office”) was the supervisory authority of the controller within the meaning of the German War Weapons Control Act and the corresponding regulation on the implementation of this act. The Office maintained the electronic war weapons register and had switched to electronic legal transactions via its own communication platform. Emails sent out by this communication platform were sent with transport encryption, not end-to-end encryption. The data subject and the controller disagreed about the obligation to use end-to-end encryption in these electronic legal transactions. The data subject argued that the electronic legal transactions need to be safeguarded by end-to-end encryption. The controller and the Office argued that a transport encryption was sufficient and does not see the necessity to implement additional end-to-end encryption. The data subject requested a temporary injunction on the transmission of his personal data without end-to-end encryption by the controller pending a decision on the issue by the Administrative Court of Frankfurt. The Court held that transport encryption was sufficient for sending email via the controller's communication platform. According to Article 5(1)(f) GDPR, personal data must be processed according to the principles of integrity and confidentiality. The Court acknowledged that these principles are general and need to be specified, but it insisted that they impose concrete obligations, not merely goals for which to strive. The measures that must be taken are those that ensure a level of protection appropriate to the r
Speedy AD
A data subject filed a complaint with the Bulgarian DPA because a courier, Speedy AD (the controller) had delivered a parcel addressed to them to another person, which was located at the address and is not the addressee. On 04.09.2021, for the data subject was prepared and sent a parcel, which parcel contained a form letter with personal data- two names, an address and a telephone number in connection with an organised service action for the car of the data subject. On the same date, the data subject has informed the controller, that did not reside at the address indicated for delivery and die not indicate a new address for redirection of the shipment. The parcel was delivered by a courier of Speedy AD on 5.09.2019, despite a timely phone call from the addressee on 4.09.2019 that they not live at the address. It was delivered to an unknown person who signed instead of the data subject.The employee of the controller did not perform identity verification and did not reflect this properly in the system of the controller. The Bulgarian Supreme Administrative Court (ВАС) finds that the data on the bill of lading and in the shipment - two names, mobile phone number, address of previous residence, the capacity of the data subject as the owner of a specific and individualized vehicle, constitute personal data. The acts of receiving, storing and transmitting personal data in the context of the delivery of a shipment constitute processing of personal data. The statutory requirement that postal items be provided to recipients in person constitutes a measure to protect the personal data subject in order to verify the identity of the recipient and to ensure the lawfulness of the processing of personal data as a response to the obligations of the controller to put in place appropriate technical and organisational measures within the meaning of Articles 24 and 25 GDPR. The Bulgarian Data Protection Authority (CPDP) found a breach of Article 5(1)(a) GDPR and Article 5(1)(f) GDP
Scalable Capital
The controller is Scalable Capital, an online stockbroker. The data subject is a customer of the controller. The controller informed the data subject about a data breach which had occurred on 19 October 2020. A third party had accessed parts of the data subject's personal information, potentially including personal, tax and contact data and their IBAN. The breach was conducted by using the credentials of CodeShip Inc., a "Software as a Service" company which the controller had contracted in the past. The contract was terminated in 2015. After the termination, the controller did not delete or change the credentials of CodeShip Inc. The third party obtained the credentials by means of a cyber attack against CodeShip Inc. The third party used CodeShip’s – still valid – credentials three times between April and October 2020 to gain access to the controller's database. Some of the data obtained was supposedly used for identity theft or for other fraudulent behaviour. After the breach, the controller paid the data subject a one-year subscription to the identity protection service “meine SCHUFA Plus”. The court ordered the controller to pay €1200 as non-material damages to the data subject. The court found that the controller violated Article 32(1) and Article 5(1)(f) GDPR because it had not implemented technical and organisational measures to ensure an appropriate level of security, especially in regards to “integrity and confidentiality”. The controller contributed to the data breach and potential identity theft by not deactivating or changing CodeShip’s credentials for several years. Although it could not be verified by the court that the data subject’s identity was fraudulently used by a third person, the court found that the risk alone establishes an immaterial damage pursuant to Article 82(1) GDPR. When assessing the amount of damages pursuant to Article 82(2) GDPR, the court considered as mitigating factors that the data was not used for any fraudulent behaviou
Court case 4 CS 21.2254
The controller is a municipal water provider. Its data subjects are private persons living on a property that has two residential units. This includes a water meter that records the consumption of both residential units. A letter from the controller of February 2021 contained the note that with the next change of the electronic water meter it was planned to install a water meter that is remotely readable and runs with a wireless function. The controller set the data subjects a deadline of two weeks to make an objection if they did not want the water meter to be remotely readable. The controller made clear that in that case, the supply of several residential units by the water meter would not be given. The data subjects made an objection and did not allow the employee of the controller access the water meter. On 20 April 2021, the data subjects also objected according to Art. 21(1) GDPR. On 12 May 2021, the controller obliged the data subjects by a notice, among other things, to let the employees of the controller access the water meter. On 9 June 2021, the data subjects again did not grant access to the employee of the controller. On 11 June 2021, they filed an appeal against the notice from 12 May 2021 with the Administrative Court Bayreuth VG Bayreuth. The data subjects also requested the VG Bayreuth to grant a preliminary injunction. According to the data subjects, the collection of the data would not be necessary for running the water supply. They argued that the data processed was personal data as it was possible to know who for example is not at home with additional knowledge and other data. The controller on the other hand argued that there was no possibility to assign the consumption of water to individual persons. Therefore, the controller was of the opinion that it was not a matter of personal data. Hence, there was also no possibility to make an objection regarding the installation of a water meter that is remotely readable. On 15 July 2021, the contro
Court case 10 As 190/2020 - 39
In 2018, the Czech DPA held that the controller, a hospital, had violated the duty to implement sufficient security safeguards under § 13 of the Czech Law on Data Protection 2000 (implementing the Data Protection Directive). The DPA issued a fine of 1,634 EUR to the controller. The controller requested a judicial review of the DPA's decision. In 2020, the City Court of Prague (MSPH) confirmed the DPA's decision. The controller subsequently requested a judicial review at the Supreme Administrative Court (NSS). The appeal's main line of argument was that under Article 40(6) of the Czech Charter of Fundamental Rights and Freedoms, the court must apply a legal act enacted after the relevant events had taken place, provided that it is more favourable to the offender. In the specific case, the controller claimed that the MSPH should have applied the new law, namely the GDPR and its implementing act - the Czech Law on Data Processing 2019 - instead of the old Law on Data Protection 2000. The controller considered the former to be more favourable in two respects. First, the controller considered that it would not have been found in violation of the duty to implement sufficient security standards under Article 32 GDPR in the same way as it was found to be under § 13 of the Law on Data Protection 2000. This is because the controller's duty to "keep electronic records" under § 13(4)(c) of the Law on Data Protection 2000§ 13(4)(c) stipulates that the controller must "keep electronic records that make it possible to identify and verify when, by whom and for what reason personal data were recorded or otherwise processed". is nowhere to be found in Article 32 GDPR which does not explicitly refer to such a specific obligation and is therefore more favourable. Second, the controller argued that even if it had been a violation of Article 32 GDPR, the DPA or the court could not have issued a fine against it. Indeed, under § 62(5) of the GDPR implementing act - the Law on Data Processing 2019 - an administrative fine shall not be issued against controllers or processors referred to in Article 83(7) GDPR which, in turn, refers to "public authorities and bodies". The controller considered itself to be a public authority or body (a hospital) and hence exempt from any administrative fine under the new law. Hence, the NSS had to consider if the newly introduced provisions were more favourable to the controller or not. Consequently, the NSS had to consider two questions. First, whether Article 32 GDPR was more favourable to the controller than § 13 of the Law on Data Protection 2000. Second, the NSS had to decide whether the controller could have benefitted from § 62(5) of the Law on Data Processing 2019 which states that the DPA shall not issue an administrative fine to public authorities and bodies as defined in Article 83(7) GDPR. First, the NSS held that the duty to implement sufficient security standards under the GDPR was not more favourable to the controller than the old law. Although § 13(4)(c) of the Law on Data Protection 2000 does not have an explicit corresponding counterpart in the GDPR, the controller also violated the more general § 13(1) which obliges the controller to "take such measures to prevent unauthorised or accidental access to, alteration, destruction or loss of personal data, unauthorised transfers, other unauthorised processing or other misuse of personal data." The NSS did not consider this duty to be less favourable to the controller than the corresponding duty under Article 32 GDPR. Second, the NSS held that the controller could not have benefitted from the exemption for public authorities and bodies from administrative fines under § 62(5) of the Law on Data Processing 2019. This was because the controller (a hospital) was not a public authority or body within the meaning of Article 83(7) GDPR. In interpreting what amounts to a public authority or body under Article 83(7) GDPR, the NSS held that such entity will normally be established by law and designed to perform tasks in the public interest. It will not have its own property and will be financed from public budgets. It is irrelevant whether it is a public institution within the meaning of Freedom of Information Act or the Public Procurement Act, or whether it keeps medical documentation. The NSS concluded that the controller is hence not such a public authority or body as it is a joint-stock company with its own assets and budget. Although it is predominantly financed by public health insurance, such funding is not public funding because the complainant receives it in return for specific services and patients not unlike private providers. Thus, although the complainant provides healthcare that is certainly in the public interest, it does not amount to a public authority or body within the meaning of Article 83(7) GDPR. Hence, the NSS held that the GDPR as implemented by the Law on Data Processing 2019 was not more favourable to the controller than the Data Protection Directive as implemented by the Law on Data Protection 2000. Consequently, the NSS held that the MSPH was correct in applying the latter and confirmed its decision.