GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
The data subject is a customer of a telecommunications service provider (the controller). The data protection information on the telecommunications contract does state that the controller reports the conclusion of the contract to a credit rating agency. In October 2023, the data subject received a letter of information from the credit rating agency, about the personal data stored, including - among other things - the fact of the conclusion of a telecommunications contract with the controller in January 2021, the account number and the statement, that this information will be stored as long as the business relationship exists. The data subject claims the transmission of data caused distress and existential concern, particularly regarding potential impacts on creditworthiness. The data subject asserts that the transfer of data was unlawful because it did not fulfill the conditions of legitimate interest under Article 6(1)(f) GDPR. The data subject contends that the controller could have used other available systems for fraud prevention and that the data transfer was unnecessary for maintaining credit system functionality or calculating default risks. The data subject claimed - inter alia - non-material damages of at least €5,000. The controller asserts that the transmission of positive data was lawful under the GDPR, justified by the need to prevent fraud and to protect consumers from excessive indebtedness. The controller disputes that any damage occurred, claiming the data subject’s fears were unfounded and that there was no deterioration in the data subject’s credit score due to the data transfer. The court held, that though the notification of the credit rating agency about the conclusion of the contract constitutes processing (of so called 'postive data') within the meaning of Article 6 GDPR the data subject is not entitled to non-material damages under Article 82(1) GDPR or any other basis against the controller. The court denied Article 6(1)(a) GDPR as a
The data subject, a holder of an insurance policy of an insurance company (the controller), sued after the controller adjusted the premium amounts of their policy. The data subject claimed the adjustments were not fully communicated in accordance with the German Insurance Contract Act ([https://www.gesetze-im-internet.de/vvg_2008/ Versicherungsvertragsgesetz] - VVG), which mandates that reasons for premium changes be disclosed, including whether they are temporary or permanent. The contract between the data subject and the controller had been in place for several years, with premium adjustments occurring over time. The data subject argued that the controller did not provide adequate information about these adjustments. They also sought access to personal data related to their insurance policy under Article 15 GDPR, including details of premium adjustments, tariff changes, and policy terminations. The controller denied the request, asserting that the necessary information had already been provided. The court held that the data subject's claim for information under Article 15(1) GDPR was justified. The personal data in question, relating to the data subject’s insurance relationship, were considered personal data as per Article 4(1) GDPR. The controller was required to provide information on the processing of these personal data, which included the time and amount of premium adjustments, tariff changes, and tariff terminations. The court rejected the controller’s argument that the data subject's request was abusive according to Article 12(5)(b) GDPR. It emphasized that the GDPR grants a very strong right to information, aimed at ensuring transparency and data sovereignty. The data subject’s request was not deemed excessive, as it sought data related to his own contractual relationship and indicated that he no longer had access to the information. The court affirmed that the controller could not deny the request based on the data subject's potential economic intere
The data subject is employed by the controller, a company governed by German law. In 2017, the group of companies to which the controller belongs introduced a cloud-based new software as a personnel information management system. In that context, the controller transferred personal data of its employees from the to-be-replaced software to a server of the group’s parent company in the USA. The controller and its works council had concluded an agreement confirming acquiescence to the introduction of the new software, which limited the transfer of data to certain categories. In that context, the data subject brought applications before the Labour Court (Arbeitsgericht Ulm - AG Ulm) and then before the Higher Labour Court (Landesarbeitsgericht - LAG Baden-Württemberg) for access to certain information, erasure of data concerning him, and compensation. Not fully satisfied in the course of these procedure, the data subject brought an appeal before the Federal Labour Court (Bundesarbeitsgericht - BAG), claiming that the transfer of his personal data to the parent company’s server was neither necessary for the purposes of the employment relationship (as the controller still used the to-be-replaced software) nor for the purpose of testing the new software, since the use of dummy data would have been sufficient. Additionally, the data subject claimed that, even if the works agreement confirming acquiescence could constitute a valid basis for that processing, the authorisation contained therein was exceeded, since the controller transmitted data other than those provided for. The Federal Labour Court stayed the proceedings and referred the following questions to the CJEU: # Is a national legal provision that has been adopted pursuant to Article 88(1) GDPR – such as [https://www.gesetze-im-internet.de/bdsg_2018/__26.html Paragraph 26(4) of the German Federal Data Protection Act] (Bundesdatenschutzgesetz - BDSG) – and which provides that the processing of personal data, includin
The data subject filed a complaint against a gym operator with the Austrian DPA (Datenschutzbehörde – DSB) alleging that the gym operator had unlawfully disclosed her personal data. When the data subject signed-up to the gym membership, she had ticked a box which meant that she did not consent to the further processing of her data. Civil dispute The data subject had brought a civil claim against the gym operator as it alleged that the controller had increased the membership fees without the members agreement. In the course of the court proceedings email communication between the data subject and the gym operator were used as evidence. Through providing the email communication as evidence, the data subject alleged that the gym operator had unlawfully disclosed the name, e-mail address and the fact that the data subject had a gym membership. The gym operator argued that they had merely provided the data subject’s lawyer with the email correspondence as it was relevant to the civil claim. The e-mail communications had been sent by the gym operator's lawyer to the data subject's lawyer. Later, the gym operator added that the data subject’s details were necessary for the contractual relationship and further that the use of this data fell under the gym operator’s legitimate interest. DSB decision The DSB held that gym operator had violated that data subject’s right to privacy by disclosing data beyond what was necessary. It found that the data subject had rejected the transfer of her personal data when signing up with the gym. The DSB determined that Article 6(1)(b) GDPR did not apply to the processing and therefore analysed the gym operator’s legitimate interest and found that the evidence would have been equally powerful if the data subject’s details had been redacted. Appeal The gym operator appealed this decision to the Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG) stating that the change in purpose for the processing was legitim
On 19 May 2020, a Luxembourg bank informed the complainant that, by 30 June 2020, they would transmit the complainant's bank account information to the Luxembourg fiscal authorities. Afterwards, by latest the 30th September 2020, the Luxembourg fiscal authorities will share this information with the US fiscal authorities. The complainant, a French and American citizen connected to the association for the protection of civil rights ASBL, turned to the Luxembourg direct Tax Office (hereinafter: ACD), explaining that the data to be transferred on the basis of the FATCA concern identification, financial and economic data, i.e. personal data as defined in the GDPR. Thus, the complainant requested the ACD to erase the personal data and immediately discontinue the exchange of information between the ACD and the American fiscal authorities. The director of the ACD rejected this request, stating that the ASBL is not a data subject and the processing of the personal data of the complainant was necessary to respect the Luxembourg FATCA Agreement law to which the ACD is subject, Thus, in their view the request to restrict processing is not justified. The complainant turned to the Luxembourg Administrative Tribunal, which rejected the injunctive request to suspend the information sharing with the US fiscal authorities. The Tribunal also declared itself entitled neither to decide on the decision of the ACD, nor to invalidate it. As to the merit, the Tribunal found the request for invalidation unfounded, rejecting the request for a reimbursement and ordering the complainant to pay the costs. The ACD challenged the receivability of appeal. In relation to the GDPR-related questions, the court held the following. * Whether the GDPR was applicable to the data transfer With regards to the applicability of the GDPR and the law of the 1st August 2018 about the organisation of the Commission Nationale pour la Protection des Données (CNPD, the Luxembourg data protection supervisory aut
A data subject brought a lawsuit against a social media platform alleging infringements in connection with a scraping incident. In particular, the data subject sought: * Non-material damages of at least €1,000 under Article 82 GDPR. * Injunctive relief, claiming that the platform failed to employ appropriate technical and organisational measures to prevent further unlawful disclosures, and that it relied on invalid or insufficient consent regarding the processing of the data subject’s telephone number. * Information about the personal data processed by the platform (likely under Article 15 GDPR). Both the lower court and the appellate court dismissed the claims relevant for the appeal. While the data subject withdrew their appeal on the merits, their legal representative lodged a separate counter-presentation (Gegenvorstellung) challenging only the litigation value set by the court. The legal representative argued that the litigation value should be raised from €3,000 to €6,500, in order to increase recoverable fees. The Federal Court of Justice dismissed the legal representative’s counter-presentation and confirmed the total litigation value at €3,000, broken down as follows: * €1,000 for the non-material damages claim, * €1,500 for both injunctive relief requests combined, and * €500 for the claim seeking information. The Court explained that, although the claims concerned alleged violations, the scope and importance of the injunctive relief did not justify the requested increase to €5,000. The original scraping incident had occurred five years earlier without further substantial harm, and the platform had already disabled the disputed feature. Consequently, the Federal Court of Justice found €3,000 to be an appropriate valuation in light of the circumstances and dismissed the lawyer’s petition for a higher amount.
The data subject is a user of Facebook (the controller) and was a affected by a scraping incident. An unknown third party had used the possibility of finding user accounts through the users’ phone numbers for scraping Facebook by randomly generating phone numbers and searching for users. Through this method, the data subject's ID, first and last name, and gender were included in the data set and were linked to his phone number. Notably, while the data subject had set his phone number to be visible only to himself, he had left the searchability setting at the default "Everyone," allowing others to find his profile via his phone number. Following a scraping incident the data subject received spam calls and SMS messages. The data subject claimed in a written statement that he had fallen into a state of great discomfort and concern about possible abuse. However, the spam calls and SMS messages received under the disputed cell phone number were filtered out from the outset. The data subject claimed that the controller did not take appropriate measures to avoid the exploitation of the contact tool that allowed users to be found through their phone numbers. He sued the controller for damages of €3,000 and sought a declaratory judgement to acknowledge his future right to compensation. This declaratory judgement concerning damages is standard in German law due to statutory limitations that would otherwise prevent a person from bringing claims after a period of three years (such as for long-term consequences of a car accident). Additionally the data subjects applied for injunctions requesting that the controller refrains from processing his telephone number in any way that goes beyond the processing necessary for two-factor authentication and that the court orders the data subject to enhance its security measures. Following the lead decision of the German Federal Court of Justice (Bundesgerichtshof - BGH) - VI ZR 10/24 from 18 November 2024 the court held, that the mere
The data controller is an online casino-game provider. The data subject set up an account, deposited money and lost it on the website. On 23rd May 2024, the data subject submitted (through his representative) an access request with the controller requesting access to their personal data, and specifically, all deposits and withdrawals and the stakes, wins and losses made on his account. The access request was made through the data subject’s representative, and included an electronically signed power of attorney and a copy of the data subject’s ID. On 26th May 2024, the controller refused the applicant’s request, asking for a handwritten power of attorney signed by the plaintiff in ink. The data subject did not respond to the controller’s response and filed the present action on 5th July 2024 with the Regional Court of Klagenfurt. The data subject sought that the controller be compelled to provide a digital copy of the data requested. On August 1st 2024, the controller sent further communication to the data subject’s representative and, in light of having received notice of the claim filed, deemed there to be a legally valid power of attorney within the meaning of Section 8 RAO and provided the information requested by the data subject on 23rd May. On 9th October, the data subject, having received the requested information, limited the scope of their filing to request only reimbursement of the costs incurred in the court proceeding. The trial court ruled that the controller could not rely on § 45 ZPO, an Austrian Civil Procedure provision which requires plaintiffs in a proceeding to bear the costs of such proceeding where the cause of action is not attributable to the action of the defendant and the defendant immediately acknowledges the claim in action. The controller had argued that this provision should apply as the power of attorney received in May 2024 was invalid. The trial judge ordered the controller to reimburse the data subject for their legal costs, to the
The parties were involved in a legal dispute regarding a data breach resulting from a scraping incident on the controller’s social network. The data subject, a user of the controller’s social network, claimed that their personal data was unlawfully accessed through the controller's contact importer tool. The alleged data scraping incident occurred in 2019, but the exact timeline was disputed between the parties. The controller initially disputed the details of the data breach, stating that no concrete evidence could be provided to confirm the timing of the breach. The data subject claimed that the breach occurred after the entry into force of the GDPR on 25 May 2018, and sought compensation for damages resulting from the unauthorized access to their data. The Regional Court (Landgericht Heilbronn - LG Heilbronn) initially ruled in favor of the data subject, awarding €500 in damages and recognizing the controller’s obligation to compensate for future damages. However, the controller appealed the decision, arguing that the breach could have occurred before the GDPR’s enforcement date. The court held that the controller’s appeal was successful. It found that the data subject failed to provide sufficient evidence to prove that the data access occurred after 25 May 2018, the date when the GDPR came into effect. The court emphasized that it was the data subject’s responsibility to prove that the breach occurred within the applicable time-frame for the GDPR and that it did not provide adequate evidence to support this claim. The court also noted that while the controller had more knowledge of the data breach, they had satisfied their secondary burden of presenting details of the event, including references to the press release, which indicated the data scraping occurred "before September 2019." The court clarified that this formulation remained uncertain as to whether the breach occurred before or after the GDPR's entry into force. Given the lack of evidence from the dat
On the 20 April 2024, the Austrian DPA (Datenschutzbehörde – DSB) received a complaint filed against the operator of a tobacco shop (the controller). The controller had installed CCTV cameras in front of their shop but did not put up an appropriate notice. Additionally, the controller had screenshotted a woman who hadn’t cleaned up after her dog, printed out the screenshot and stuck it to the window next to the entrance of his tobacco shop. The DSB found that the cameras did not just monitor the entrance to the tobacco shop but also the entrance to an apartment building, the footpath the leading up to it and partly the nearby tram stop. The controller argued that tobacco shops are subject to higher risk of danger. Further, the CCTVs use had already been justified through enabling a vandal to be identified. The monitored public area had been kept to a minimum and the recordings were only stored for a maximum of 24 hours. In response to the printed out picture of the woman, the controller stated that he had put a sticker over her face and that the woman herself had most likely removed the sticker. The controller also brought forward that based on training given by the Office of Criminal Investigation of Lower Austria (Landeskriminalamt Niederösterreich - LKA), he genuinely believed that the pictograms sufficed as an information notice. The DSB held that the controller had violated Article 5(1) (a)(b)&(c) GDPR, Article 6(1)(f) GDPR and Article 13 GDPR and issued a €1,500 fine. The controller appealed the decision to the Federal Administrative Court of Austria (Bundesverwaltungsgericht – BVwG). He stated that thieves and criminals constantly threatened his shop and that he had to fear for his life. He disclosed that roughly a month before the appeal a bomb attack on his shop had been carried out, causing five-digit damage. The DSB requested the controller’s claim to be rejected. The BVwG held that the controller did have a legitimate interest in installing the C
The data subject is a user of Facebook (the controller). In April 2021, data of approximately 533 million Facebook users were made public on the internet. An unknown third party had used the possibility of finding user accounts through the users’ phone numbers for scraping Facebook by trying out randomly generated phone numbers. Through this method, they were able to obtain user profiles with matching phone numbers. The data subject in this case was also among the people affected by this scraping incident; his user ID, first and last name, and gender were included in the data set and were therefore linked to his phone number. Notably, while the data subject had set his phone number to be visible only to himself, he had left the searchability setting at the default "Everyone," allowing others to find his profile via his phone number. The data subject claimed that the controller did not take appropriate measures to avoid the exploitation of the contact tool that allowed users to be found through their phone numbers. He sued the controller for damages and sought a declaratory judgment to acknowledge his future right to compensation. This declaratory judgment concerning damages is standard in German law due to statutory limitations that would otherwise prevent a person from bringing claims after a period of three years (such as for long-term consequences of a car accident). The data subject argued that he had suffered a loss of control over his personal data, resulting in a feeling of unease and worrying about potential abuse of his data. This also resulted in a heightened distrust of emails and calls from unknown senders or numbers. After the controller rejected the data subject’s claims, the data subject initiated legal proceedings, claiming that the controller had violated the GDPR in several respects and had not adequately protected his data. The Regional Court Münster (Landgericht Münster - LG Münster) dismissed the action on 6 June 2024 because the data subject h
The data subject had obtained an immunity certificate confirming the vaccination against COVID-19, issued by the respective authority (the controller). This certificate included data that was generated by the controller itself, especially an ID number and a QR code. In April 2021, the data subject filed a complaint with the Hungarian DPA alleging that the controller had not published any data protection statement concerning the issuing of vaccination certificates. During the subsequent procedure the controller declared that Article 6(1)(e) GDPR and Article 9(2)(i) GDPR were the respective legal bases for the processing. Furthermore, they stated that they obtained the personal data that it processed from another body, in accordance with the provisions of Decree No 60/2021. On that basis, it asserted that, pursuant to Article 14(5)(c) of the GDPR, it was not required to provide information on the processing of those data. It nonetheless drew up the requested statement concerning the protection of personal data and published it on its website. The Hungarian DPA dismissed the complaint and found that the processing fell under Article 14(5)(c) GDPR and the domestic law included appropriate safeguards for the legitimate interests of the data subject. The data subject challenged the decision in court. The first instance court considered that the exception laid down in Article 14(5)(c) GDPR was not applicable because certain personal data produced in relation to the immunity certificates were not collected from another body by the controller, but were generated by that controller itself in the performance of its tasks. In that court’s view, only personal data obtained from another body could be covered by the exception laid down in Article 14(5)(c) GDPR. This decision was appealed by the DPA. The court of appeals then stayed the proceedings and forwarded three questions to the CJEU for a preliminary ruling: # Does the exception laid down in Article 14(5)(c) also apply to da
The data subject, a Flemish-speaking Belgian citizen, advanced a complaint, in Flemish, with the Belgian DPA against the controller. The complaint was declared admissible by the DPA and, on 8 December 2022, the parties were informed of the advancement of proceedings, mentioning, in Flemish, the possibility of changing the language of proceedings. Thus, the data subject asked, in Flemish, to change the language of procedure to French, as her lawyer, substituting her previous Flemish-speaking lawyer, was Francophone. The Investigation Chamber of the DPA accepted this request. The controller appealed against this decision of the Investigation Chamber which, in turn, retreated the decision on the merits, but upheld the change of language from Flemish to French. The controller introduced an appeal against this last decision before the Market Court (a bilingual section of the court of appeal) in Brussels, who, in turn, referred two questions for review to the Constitutional Court: 1. Is [https://etaamb.openjustice.be/fr/loi-du-03-decembre-2017_n2017031916.html Article 57 of the law of 3 December 2017] (on the establishment of the DPA), compatible with [http://www.parliament.am/library/parlamentarizm2019/belgia.pdf Article 30 of the Constitution], in that it leaves the DPA itself responsible for determining the use of languages in the procedures carried out before it? 2. Is [https://etaamb.openjustice.be/fr/loi-du-03-decembre-2017_n2017031916.html Article 57 of the law of 3 December 2017], compatible with [http://www.parliament.am/library/parlamentarizm2019/belgia.pdf Articles 10, 11 and 30 of the Constitution], in that it does give rise to a difference in treatment between the people concerned by an administrative procedure before the DPA and the persons concerned by an administrative procedure before the Competition Authority? With Article 30 of the Constitution stating that “the use of languages spoken in Belgium is optional; only the law can rule on this matter, and o
A public-law body (the data controller) sent a letter to an individual (the data subject) inviting them to receive a Covid-19 vaccination. On 14 December 2021, the data subject submitted a complaint with the Datenschutzbehörde (hereinafter DSB/data protection authority), alleging that the controller had violated their right to confidentiality of personal data under §1(2) DSG since they could not establish how the controller obtained information about their vaccination. Following a series of proceedings conducted against the wrong responsible party, the data subject identified the correct controller through a letter dated 01 August 2024. In particular, the data subject requested: (i) a finding of a violation of their fundamental rights; (ii) a prohibition of further data processing under §22(4) DSG; and (iii) the imposition of a fine. Decision of the Data Protection Authority (DSB) By means of a decision rendered on 03 September 2024, the DSB upheld the complaint in part. Firstly, it held that the controller had unlawfully accessed and processed the data subject’s records from the central vaccination register and central patient index. In the absence of a legal basis in accordance with §1 para. 2 DSG, the DSB maintained that the data subject’s right to confidentiality was infringed upon. Secondly, the DSB dismissed the request for prohibition of processing given that the processing had already been completed and therefore fell short of the standard stipulated under §22 para 4 DSG. Thirdly, it rejected the request for a fine for two-fold reasons: the data subject held no subject right to demand one, and fines cannot be imposed on bodies of public law under §30(5) DSG. The data subject subsequently appealed the decision to the Federal Administrative Court on grounds that they found it “outrageous” that their vaccination data had been shared. Despite a court order issued on 02 October 2024 to clarify their grounds of appeal, the data subject did not submit further st
The data subject advanced an appeal to a DPA decision concerning an alleged violation of her fundamental right to privacy, as laid out in [https://www.jusline.at/gesetz/dsg/paragraf/artikel1zu1 Article 1(1) of the Austrian Data Protection Act (Datenschutzgesetz – DSG)]. The initial complaint advanced by the data subject related to the sharing of the data subject´s MRI scans without the data subject´s consent, in the context of a treatment procedure at a rehabilitation centre following a hip operation. At the time of the follow-up treatment, the appellant was seventy-seven years old and suffered from dementia and significant cognitive impairment due to two brain operations in 2018. Therefore, the data subject was unable to provide any information about her medication and previous findings and thus had an authorized representative. A few days after the data subject´s admission to the hospital, the data subject´s authorized representative, a doctor, submitted a bundle of radiological images. One of the MRI scan's radiological images was missing so the medical team of the rehabilitation centre asked the data subject´s authorized representative to send a duplicate. The requested MRI was faxed to the rehabilitation centre by the data subject´s authorized representative on the same day without the consent of the data subject, who only learned of this disclosure verbally from doctors at the rehabilitation center. The data subject advanced a complaint, claiming that, in the case at hand, [https://www.jusline.at/gesetz/dsg/paragraf/artikel1zu1 Article 1(1) of the Austrian Data Protection Act (Datenschutzgesetz – DSG)] was violated. The Administrative Court Holding The Administrative Court dismissed the complaint as unfounded due to the following reasons. First, the Administrative Court found that the data subject´s authorized representative was the controller under Article 4(7) GDPR. Then, it proceeded by considering that, while [https://www.jusline.at/gesetz/dsg/paragra
On the 09 August 2022, a data subject, represented by noyb, filed a complaint with the Austrian DPA (Datenschutzbehörde – DSB) alleging that the controller unlawfully processed their personal data without the data subject's valid consent. The data subject alleged that, due to the use of dark patterns by the controller, the principle of transparency was violated and that the withdrawal of consent was not as easy as its issuance. Therefore, the data subject requested the erasure of their personal data. The option to reject cookies was a link, which was only identifiable as a link when hovering over it with the mouse. The accept button on the other hand was strongly highlighted by being placed in the middle of the banner and in a colour with strong contrast to the background. On the 22 September 2023, the DSB issued a decision on the following three points: Point 1: The data subject’s right to erasure had been violated under Article 17 GDPR. Point 2: The data subject’s right to privacy had not been violated under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&FassungVom=04-11-2022 §1(1) of the Austrian Data Protection Act] (Datenschutzgesetz - DSG). Point 3.a: The DSB ordered the controller to alter its cookie banner to make the “reject all cookies” appear in equal format to the “accept all cookies” option. Point 3.b: The controller must implement a function, which makes the revocation of consent just as simple as its declaration. The controller appealed points 1, 3a and 3b of the decision to the Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The controller posited that the GDPR does not require the “accept” and “reject” buttons to be displayed in an equal format. Further, it added that the revocation of consent was available through a footer link on the website which lead to the cookie settings. The court rejected the controller’s appeal. Point 1: The data of the data subject, at the
Toplofikacia Sofia EAD, the controller, is a Bulgarian company that provides heating services to its customers, both individuals and companies, in the Sofia metropolitan area. The controller submitted a request to the Ministry of Regional Development for access to several registers of personal data of the Bulgarian population. The reasoning for the request was that the access will facilitate the execution of the contracts between the controller and its customers. The Ministry of Regional Development refused to provide access to the registers that keep significant amount of personal data, including inheritance information, and advised the controller for the optional procedure under Article 125(3) of local Energy Act to seek permission from the Bulgarian Data Protection Authority. In May 2022 the controller submitted a request to the DPA asking for revocation of the Ministry's decision. In its request the company referred to the legal bases of (i) the performance of contract (Articles 6(1)(b) GDPR), (ii) the compliance with a legal obligation (Article 6(1)(c) GDPR), and (iii) a task carried out in the public interest (Article 6(1)(e) GDPR) for the requested access to the registers. The DPA carried out a corresponding analysis for each of these legal bases and decided that none of them is applicable for the controller. The DPA refused to grant permanent access to the registers and instructed the company to provide a solid justification for any future request to the Ministry. In July 2022, the controller appealed the decision of the DPA before the Administrative Court of Sofia. The Administrative Court of Sofia upheld the decision confirming the analysis of the DPA and on top of it pointing out that the registers provide information for the entire population of Bulgaria, while the company operates only in the Sofia region. Subsequently, the controller appealed the decision to the Supreme Administrative Court. The Supreme Administrative Court of Bulgaria upheld th
The data subject had an electricity contract with an electricity provider. The electricity provider’s terms and conditions included the following paragraph: “For the purpose of credit checks, the energy supplier may obtain information from credit agencies and pass on personal customer data relating to the energy supply contract to them under the conditions of § 28a BDSG.” The contract started in April 2014 and was cancelled by A due to outstanding bills in September 2014. In October 2014, the electricity provider sent an invoice to the data subject which listed a due amount of €529.16. According to the invoice, this amount included, inter alia, electricity costs, reminder charges, damages caused by delay, and a bank transfer fee. In November 2014, the debt collecting agency (the controller) reminded the data subject of the payment and added a fee for their services. In 2019, the electricity company conveyed the claim to the controller. In 2020, the controller warned the data subject about a possible transfer of their payment data to a credit rating agency. In 2021 and 2022, the controller informed the credit rating agency Schufa about the fact that the data subject had not paid. The data subject refused to pay and invoked the statute of limitations. The controller accepted this and Schufa noted it as well. Following this, the data subject was refused several contracts by different companies such as a mobile phone contract, a credit, and an insurance. The controller refused to remove the information from Schufa. Following a lawsuit filed at the Regional Court of Kiel (Landgericht Kiel – LG Kiel) the LG Kiel decided that the controller had to withdraw their information from Schufa because there was no legal basis for the processing of personal data. Furthermore, the LG Kiel held that the data subject was entitled to €500 in non-material damages under Article 82(1) GDPR. Both the controller and the data subject appealed the decision to the Higher Regional Court Schlesw
The plaintiff sued a private health insurance company (the controller) by way of an action by stages (Stufenklage) according to [https://www.gesetze-im-internet.de/englisch_zpo/englisch_zpo.html#p0945 § 254 German Civil Process Order (Zivilprozessordnung – ZPO)]. 57 clients of the controller had assigned claims to a third party (the plaintiff). The health insurance company had raised their insurance premiums. On the first stage, the claimant sued for information under Article 15 GDPR to be able to determine the premiums paid by the clients that had assigned their claims. On the second stage, the claimant sought a declaratory judgement that the raises of the insurance premiums by the controller were unlawful and were suing for an amount yet to be determined after having obtained the information from the first stage. The court of first instance, the Regional Court Wuppertal (Landgericht Wuppertal – LG Wuppertal) dismissed the lawsuit. = The court held that an action by stages was inadmissible because the claimant did not want to determine the exact amount of their claims but rather, if they had any claims at all. This made the claims brought forth on the second stage inadmissible because they were not specified enough under [https://www.gesetze-im-internet.de/englisch_zpo/englisch_zpo.html#p0934 § 253(2)(2) ZPO]. The claims for information on the first stage were however admissible. The admissible claims for information were, however, unfounded. This was due to the fact that the criteria of neither Article 15 GDPR nor other, national legal bases for the claims were matched. = The court held that Article 15 GDPR did not give right to information for two reasons: first, the right under Article 15 GDPR to obtain access to personal data is strictly personal and does not follow the assigned claim (as an exception to [https://www.gesetze-im-internet.de/bgb/__401.html § 401 German Civil Code (Bürgerliches Gesetzbuch – BGB)]). The court held that the right under Article 1
The data subject maintained an "on/off relationship" with a subordinate. After disputes arose, this subordinate sent excerpts of the WhatsApp-Chat traffic with the data subject to the works council chairman of the company they worked for. The chairman than forwarded this chat history containing highly intimate data to the human resources department (HR) which ultimately led to the termination of the data subject's employment. The data subject argued, among other things, that there was no legal basis under Article 6 GDPR for this disclosure and that the forwarding was both a violation of data protection law and of his general personal rights therefore entitling him to €5,000 plus interest in non-material damages from the works council's chairman pursuant to Article 82(1) GDPR. # The labor court dismissed the data subject's claim, holding that the data transfer was lawful under Article 6(1)(b) and (f) GDPR and [https://www.gesetze-im-internet.de/bdsg_2018/__26.html § 26(1) BDSG] (Federal Data Protection Act) in order to provide the employer with the most meaningful basis for examining the complaint of the data subject's subordinate. The court argued, that the scope of Article 6(b) GDPR also includes the transfer of data for the execution and termination of the employment contract of the data subject and his subordinate for the examination of possible measures by the employer. The data subject had not provided evidence the transferred personal data was irrelevant for the examination of the subordinate's complaint. # Furthermore the court argued, that the data subject has not provided evidence that the works council chairman did not act in his capacity as a works council member when forwarding the data to the human resources department, meaning that he would not have been personally liable to the plaintiff for compliance with data protection law in any case. According to [https://www.gesetze-im-internet.de/betrvg/__79.html § 79a BetrVG] (Works Constitution Act), the