GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 21 October 2026 · Updated daily
Court case III OSK 4558/21
The controller is a foundation that makes personal data obtained via the National Court Register available on its website for the purpose of supporting the development of democracy by strengthening the citizens' rights of access to public information and re-use of public sector information. The data subject is an individual whose personal data had been processed by the foundation. This personal data included their name, surname, date of birth, gender, PESEL registration number, information on functions the data subject had in several (private) entities, and information on the value of their shares in such entities. The controller provided a free and a paid version of its website. The free version displayed only personal data that were linked to current ongoing activity of the data subject in several entities, and the shares they held in those entities. The paid version displayed also past activities of the data subject. In this case, the data subject's personal data was only accessible via the paid version of the website. The data subject submitted an erasure request pursuant to Article 17(1)(d) GDPR but the foundation rejected this request. The data subject then filed a complaint with the Polish DPA (UODO). The DPA rejected this complaint since it found that the controller had a legitimate interest to process the personal data under Article 6(1)(f) GDPR, and the data subject's interests or fundamental rights and freedoms did not override the controller's interest. The data subject did not accept this outcome and brought the action before court claiming inter alia that the controller had no legal basis to process the data. Hence, they did not object to the processing pursuant to Article 21 GDPR, but purely questioned its lawfulness. After the Court dismissed the appeal, the data subject brought the action before the Supreme Administrative Court. The Supreme Administrative Court dismissed the appeal, since it held that the processing was lawful. Consequently, th
Swedish Authority for Privacy Protection (IMY)
In March 2020, the Swedish DPA Integritetsskyddsmyndigheten (IMY) fined Google €7,200,000 (SEK 75 million) for violating Article 17 GDPR (the right to erasure). In particular, the IMY considered that Google had violated the right to erasure in connection with two complaints from data subjects (Complaint No. 2 and Complaint No. 8 in the supervisory case), as well as because of its general practice of regularly informing webmasters when search results are being removed. Google appealed that decision before the Stockholm Administrative Court (FiS). In December 2020, the FiS upheld that Google had breached the right to erasure with respect to Complaint No. 2, but found no such breach with respect to Complaint No. 8. In both cases, however, the FiS concluded that Google had acted contrary to data protection law because of its practice of notifying webmasters of deleted search results. The FiS further justified a reduction of the overall fine calculated by IMY for the breaches that were upheld. Google further appealed the FiS decision before the Court of Appeal in Gothenburg. In the context of these appeal proceedings, IMY argued that Google had breached the right to erasure with respect to both Complaint No. 2 and Complaint No. 8, and had also acted contrary to data protection law because of its practice of notifying webmasters of removed search results. IMY wanted the overall fine to be set at €6,300,000 (SEK 66 million). In particular, the proposed fine of €6,300,000 included: * a fine of €96,639 (SEK 1 million) for not respecting the right to erasure with respect to Complaint No. 2; * a fine of €1,448,547 (SEK 15 million) for not respecting the right to erasure with respect to Complaint No. 8; and * a fine of € 4,800,000 (SEK 50 million) for the practice of regularly informing webmasters of deleted search results. = The Gothenburg Court of Appeals partly reversed the findings of the the FiS and found that Google had complied with Article 17 GDPR on the right to erasure with respect to both Complaint No. 2 and Complaint No. 8. In particular: With respect to Complaint No. 2, the Gothenburg Court of Appeals found that the data subject had first only provided the main web address (URL) of the discussion thread where his/her name was mentioned, but had failed to provide the specific URLs where his/her name was mentioned each time. The Gothenburg Court of Appeal noted in this respect that Google's instructions on erasure requests clearly require the data subject to provide each and every URL that is part of the erasure request, as even small changes to the URL can lead to a different website. The Gothenburg Court of Appeal further noted that Google has set up a help page explaining the importance of providing each URLs in details. Finally, the Court of Appeals noted that, once the data subject had completed his/her erasure request by providing the specific URLs where his/her name was mentioned, Google had proceeded to the erasure of these pages without undue delay. Based on these considerations, the Court of Appeals concluded that Google had complied with Article 17 GDPR. With respect to Complaint No. 8, the Court of Appeals agreed with FiS that Google had complied with Article 17 GDPR by removing the concerned search result three days before IMY had ordered Google to do so. Hence, the Court of Appeals concluded that Google had deleted the requested search results without undue delay, in accordance with Article 17 GDPR. = The Gothenburg Court of Appeal upheld the FiS decision that Google's practice to regularly inform webmasters of the removal of search results was contrary to Article 5(1)(a) GDPR (principle of lawfulness), Article 5(1)(b) GDPR (principle of purpose limitation) and Article 6 GDPR (absence of valid legal basis for the processing). The Gothenburg Court of Appeals found in this respect that Google had systematically ignored the [https://ec.europa.eu/newsroom/article29/redirection/document/64437 Article 29 Working Party's Opinion on the right to erasure] over an extended period of time. Although the Opinion is not strictly binding, the Gothenburg Court of Appeal pointed out that the Article 29 Working Party's mandate is to ensure that the European Union's data protection rules are applied consistently in all Member States, and that controllers should thus consider such opinions and guidelines. In conclusion, the Gothenburg Court of Appeal found that Google's practice to inform webmaster of deleted search results was contrary to the GDPR, and upheld the fine of €4,800,000 million (SEK 50 million) imposed on Google by FiS.
Court case 4 U 484/20
A Facebook user, the data subject, posted content that violated Facebook´s policy about mobbing and bullying. As a result, the post was erased and the user was set into a "Readonly"-Mode which banned him from actively using his Facebook profile. Information about the ban became part of the dataset about the data subject. In previous proceedings at the Regional Court of Ellwagen, the legal dispute between the parties were the questions concerning the context in which the content was posted, whether the policy was valid, whether the ban constituted a violation of the freedom of expression, and whether the consequence of the "Readonly" mode was permissible. The Regional Court of Ellwangen dismissed the case. In its decision, the Regional Court of Ellwagen held that the policy was valid and that the data subject violated Facebook's policy with his bullying and harassment. The information about the erasure and "Readonly" mode of the data subject is being processed by the data controller. Since the data subject was appealing the decision of the first court on the false use of law and on the grounds that there was no violation of the Facebook's policy, the data subject argued that the controller is obliged to correct the stored dataset on the data subject and erase the information of the violation of the policy pursuant to Article 16 GDPR. In its decision, the court held that Facebook's policy was binding and that the content posted by the data subject violated the policy. The data controller had the right to erase the data subject's content and to ban the data subject from actively using its services. Therefore, the personal data that was processed was correct and no right for rectification of the data pursuant to Article 16 GDPR could be exercised.
Defam
Controller is Defam, a credit provider. Data subject took out a credit of €10,000 for their friend, because the friend wanted to open a liquor store and did not have enough money. Data subject had to start paying off the loan from February 2014 onwards, but they did not pay the installments. After multiple payment arrears and broken payment arrangements, in December 2015, controller terminated the agreement, claimed the credit early, and registered the debt in the credit registration database (CKI) with the code “A2” (relating to data subject’s creditworthiness). After multiple payment arrangements, the debt was finally payed off on 30 January 2019. The registration of the codes relating to data subject’s creditworthiness will be deleted in January 2024. On 22 June 2020, Coderingsvrij B.V., on behalf of the data subject, objected to the registration in the CKI and requested removal, pursuant to Article 21 GDPR and Article 17 GDPR. Data subject claimed that he is now financially stable, and want to move out of the house of the parents of their partner, which is hard because of the registration of the “A2” code in the CKI. Controller refused to do so on 8 July 2020. After data subject requested again on 15 February 2021 to have the registration removed based because data subject’s interests overrode those of the controller, controller refused again on 25 February 2021. Then, the data subject brought the case before Court. First, the Court considered the admissibility of data subject’s appeal. The controller argued that the appeal was inadmissible because data subject did not appeal to their rejection on 8 July 2020, within 6 weeks, pursuant to Article 35 of the General Data Protection Implementing Act (UAVG). Moreover, the controller claimed that the request of 15 February 2021 was a repeated request, based on the same grounds, and could not be considered a new request. The Court rejected the argument because controller dealt with the request of 15 February 2021 in
Court case 200.254.914
On 22 May 2018, complainant, who is a writer, requested Google via a to remove ten search-results that appeared when someone would type in complainant's name via Google Search. The search-results refer to webpages that display a conflict between complainant and a literary critic, since the latter accused complainant of plagiarism and (the accompanying) unjustified use of academic titles. After Google rejected the request, complainant asked the District Court Midden-Nederland to order google to remove the references to the ten internet addresses on pain of a penalty payment. This Court decided that complainant insufficiently refuted Google's argument that the contested search results are correct, relevant and not excessive, and also because it has not been established that the processing takes longer than necessary. The Court furthermore ruled that the interest of Google and of internet users who may want to gain access to the search results prevails over the interest of complainant. Complainant appealed against this judgement. Before the Court decided on the legitimacy of the deletion request, it assessed whether the applicable legislative instrument is the GDPR, or the (Dutch) Personal Data Protection Act (Wbp). It asserted that the legal proceedings started on 25 May 2018, and Article 48(10) of the General Data Protection Implementing Act (UAVG) states that the Wbp continuous to apply to proceedings that were pending before 25 May 2018 (the date the GDPR entered into force). However, it concluded that the GDPR is the applicable legislative instrument in this case, since the request concerns a request for removal, in respect of which it must be assessed ex nunc whether the processing is (currently) in accordance with the applicable rules. Then, the Court stated that the request for deletion must be regarded as an appeal to Article 21(1) GDPR, and the Court must therefore conduct the balancing test. In this regard, it acknowledged that complainant had an inte
Court case 15 K 118/20
The data subject requested information on all data processed by the tax office, invoking Article 15 GDPR, in particular a complete colour copy of the tax files including all side files and the internal comments on all data processed by the tax office. The data subject accused the tax office of file manipulation as well as "recording false data". The tax office provided the data subject with copies of all current tax assessments, a printout of the tax collection account, as well as a basic data overview and an overview of the electronic record. It refused to provide further information. At the hearing, the tax office submitted extensive further printouts from its databases, but still refused to provide information on any assessment-related data, tax audits and risk management system data and, in particular, a copy of the tax files. The court had to decide whether tax offices are obliged to grant full access to tax files under Article 15(1) GDPR. The Tax Court of Munich (Finanzgericht München - FG München) held that by handing over the additional copies of its databases at the court hearing, the tax office fulfilled its duty under Article 15(1) GDPR. The data subject was not entitled to further disclosure. On the applicability of the GDPR: The court determined that the GDPR and the data protection provisions of the German General Tax Code (AO) are applicable to the processing of personal data by tax offices. By referring to its previous decision (FG München 15 K 81/20) the court confirmed that the area of direct taxation is not excluded from the scope of the GDPR under Article 2(2)(a) GDPR. Furthermore, the court extensively discussed the material scope of application according to Article 2(1) GDPR. At first, it referred to the decisions of the CJEU in C-434/16 and C-141/12+C-372/12 to establish that only legal evaluations do not constitute personal data but all other content referring to the fiscal situation of the data subjects does. This includes all assessm
Tax Authority
The controller is a tax authority. In October 2020, the data subject requested to be provided with copies of files containing his personal data pursuant to Article 15(3) GDPR. The controller refused, arguing that the right to access of Article 15 GDPR does not entail all internal processes of the controller or the right to have all exchanged correspondence, which is already known to the data subject, printed out and sent again. The Finance Court Berlin-Brandenburg (Finanzgericht Berlin-Brandenburg - FG Berlin-Brandenburg) fully rejected the data subject's claim. The court began with clarifying that - contrary to the controller's position - the GDPR is applicable to the administration of direct taxes in the area of tax administration. Furthermore, all information contained in a tax file is generally personal data. Then, the court held that the data subject rights enshrined in Article 15(3) GDPR do not entitle the data subject to be provided with copies of personal data in the form of (electronic) duplicates of entire files by the controller. According to the court, Article 15(3) GDPR only contains a right to the catalogue information pursuant to Article 15(1)(a)-(h) GDPR. The FG Berlin-Brandenburg based that decision on a narrow interpretation of the provision, arguing that Article 15(1) and 15(3) GDPR do not contain two independent rights but rather a single right. First, the court argued that it was sufficient for the data subject to receive a complete overview of the data reproduced in the draft document - i.e. including personal data contained in the legal analysis - in an intelligible form instead of a copy of the document or the original file containing that data. This had been decided by the [https://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=8085503 CJEU] in the context of the previous Data Protection Directive and had to be applied for the purpose of the interpretation of
Court case ECLI:DE:LAGNI:2021:1022.16SA761.20.00
The defendant is an auto-mobile manufacturer, the claimant was employed by the defendant and responsible for the development of diesel engines. After anomalies in connection with the diesel engines became known, the defendant began to start internal enquiries to investigate the diesel gate. In the course of the investigations, the defendant repeatedly asked the claimant to give consent for the transfer of personal data, private correspondence and personnel files to investigative authorities in the USA. However, the claimant only partially consented to the transfers. In this context, the claimant made an initial data subject access request to the defendant in 2016 for information about the data to be transferred to the USA and the results of the investigations. Ultimately, the claimant was given a warning in connection with the investigations and the defendant terminated the employment relationship. At the termination hearing, the claimant made a further data subject access request against the defendant in August/September 2018. The defendant responded to this second request and sent copies of 938 documents which originated from the claimant's account and business equipment. The documents provided were partially anonymised and redacted. In December 2018, the claimant then requested the defendant to provide more information. At trial, the claimant claimed damages from the defendant under Article 82 GDPR for unlawful processing of the claimant's personal data. The claimant claimed that the processing was unlawful due to a lack of transparency, the unlawful transfer of personal data to US authorities and the improper handling of the data subject access request. According to the claimant, the defendant had not provided all relevant personal data when answering the data subject access request. The data submitted was unusable, as some of it had been redacted on 96% of its pages or consisted only of publicly accessible documents such as press releases. The information had been misrepresented in an abbreviated form. The defendant instead justified the redactions and omissions with overriding legitimate interests in confidentiality. At first instance, the claimant demanded that the defendant be ordered to compensate the claimant for all material and non-material damages already incurred and to be incurred in the future, resulting from the illegal handling of the claimant's personal data that was the subject of the dispute. This relates in particular to the incorrectly answered data subject access request under Article 15 GDPR. The claim was dismissed at trial for lack of certainty. The appellate court had to decide, inter alia, whether the claim for compensation for material and non-material damage was sufficiently certain and admissible. The appellate court ruled that the claimant's appeal is sufficiently certain insofar as it specifically referred to the incorrectly answered data subject access request. The claimant's claim is admissible in connection to the payment of material or non-material damages for the incorrectly answered data subject access request of August 2018. The defendant was ordered to pay the claimant non-material damages in the amount of €1,250. However, a violation of data subject rights that occurred prior to the introduction of the GDPR does not continue to have an effect into the future. Such violations are therefore not to be assessed on the basis of the GDPR and cannot lead to compensation as defined in Article 82 GDPR. The claimant is therefore only entitled to compensation for non-material damage in relation to violations that occurred after the entry into force of the GDPR. The appellate court further held, that the duty to provide information under Article 15(1) GDPR is subject to a broad interpretation of personal data and includes all information relating to an identified or identifiable natural person. Only with such a broad understanding of personal data is it possible for data subjects to assess the lawfulness of the processing of their personal data. With regard to the present case, the defendant failed to sufficiently establish that they were entitled to withhold the redacted information on the basis of overriding legitimate interests in confidentiality. Thus, the defendant answered the data subject access request of August 2018 incompletely. The appellate court was of the opinion that a claim for compensation for non-material damage under Article 82 GDPR does not have to be materially relevant to be admissible. In the present case, the appellate court established causation of non-material damage: As the defendant did not sufficiently fulfil their obligations to provide information in response to the claimant's data subject access request, the claimant did not obtain timely, sufficient knowledge about the processing of personal data. In conclusion, the claimant suffered loss of control and was denied the possibility of reviewing the lawfulness of the processing of personal data. The appellate court also held that the claimant's further claims for damages due to the defendant's alleged violation of their data protection obligations was inadmissible. The claimant was unable to demonstrate to which particular conduct and which alleged breach of duty his claim should refer. The plaintiff should have named the alleged breaches of duty in the particulars of claim or should have listed the defendant's actions to which the claim refers.
Court case 10 Sa 443/21
The data subject worked as a cook for over 20 years for the controller. In 2019, the data subject requested detailed information in accordance with Article 15 GDPR after he had received a warning from the controller and was transferred. The request concerned these two processes. The controller did not comply with the request. The defendant claimed before the Labour Court of Berlin that, since he had remained in the dark about essential factors of the data processing, he was entitled to damages pursuant to Article 82 GDPR. He argued that a claim for damages in the amount of €250 per month per infringement was appropriate because the infringement had lasted for more than 16 months. As a result of the months-long delay in providing information, he had been prevented from assessing whether and how the defendant had been processing his personal data. The Labour Court of Berlin dismissed the action insofar as it was relevant to the appeal. It held that it was unclear what the exact aim of the data subject's access request had been. With his appeal, the data subject pursued a claim of damages in the amount of at least €8,000 by the controller. The Regional Labour Court of Berlin-Brandenburg partly upheld the claim. It granted the data subject damages in the amount of €2,000. It held that information was not given correctly as requested and that the controller should have regarded Article 15 GDPR in full. Contrary to the first instance court's opinion, the data subject had sufficiently specified his access request. The controller had neither indicated whether and, if so, to which persons or bodies it had disclosed or would disclose the transfer process, nor when or according to which criteria the data would be deleted. Nor did the controller indicate the existence of the data subject's rights pursuant to Articles 12 et seqq. GDPR. The court concluded that it was indeed so obvious that this information was missing that the controller could have ascertained what the data subject was asking it to do by simply looking at the text of Article 15(1) GDPR. The court further agreed with the data subject that he had suffered damages. It held that a non-material claim for damages exists irrespective of whether a materiality threshold has been reached in the case of violations of the provisions of the GDPR. Since the controller had not sufficiently fulfilled its obligation to provide information in terms of content, the data subject had not obtained sufficient knowledge about the processing of his personal data. In this respect, a loss of control had occurred and the possibility of reviewing the lawfulness of the processing of his personal data had been made impossible or difficult for him. The court found damages in the amount of €1,000 per incompletely answered request for information. It emphasised that the enforcement of the GDPR also relied on a deterrent effect of claims for damages. Therefore, the awarded damages should encourage the controller to comply with the relevant requirements.
Court case 2 O 448/20
The controller is a health insurance company. The data subject entered into a contract for private healthcare insurance with the controller. During the term of the contract, the controller repeatedly increased the premiums and informed the data subject accordingly. The data subject initially paid the increased premiums without reservation, but subsequently suspected unlawful premium adjustments. To obtain a refund of premiums, the data subject used a request for information in connection with a staged action pursuant to section 254 ZPO, and requested the controller to submit the supplements to the insurance policy, justifications for the adjustments, as well as further information sheets. The controller, however, claimed that the requested documents were no longer available and refused to send them. Moreover, they also stated that the request for information was inadmissible, as the information requested by the data subject did not serve to quantify the claim. The data subject then brought the action before court. The Court had to decide, inter alia, whether the data subject's request, if interpreted as a an access request under Article 15 GDPR, was admissible from a data protection perspective. The Court held that the access request was vexatious and declared the action partially inadmissible and unfounded. The claim was dismissed. According to the Court, the data subject's request was unfounded under both civil law and data protection law. The Court held that the request for information could not be regarded as an access request under Article 15(1) GDPR. According to Recital 63 GDPR, the right of access under Article 15 GDPR serves data subjects to be informed about the processing of their personal data and to verify the lawfulness of the processing. By making such requests, data subjects should be empowered to assess the scope and content of the data processed in order to be able to assert further rights under the GDPR. In the present case, the data subject
Aegon and unknown
The claimant requested the defendant to remove certain special codes, that link to their creditworthiness, from the Central Credit Information System (CKI) of the Bureau for Credit Registration. The registration of these special codes had resulted from the claimant's inability to repay their mortgage debt to the defendant. The registration was dated September 2018 and remained in effect for a period of five years. Hence, the claimant would not be removed from the BKI until September 2023. Since the registration had the effect of preventing the claimant from taking out a new loan, the claimant requested the defendant to remove their personal data from the CKI. However, the claimant made some procedural mistakes. They first requested their personal data to be removed on 22 August 2019. The defendant rejected to this request on 10 September 2019. Afterwards, the claimant lodged an appeal to this decision, but erroneously brought the defendant's sister company to Court. The claimant submitted their second request for deletion, which was identical to the first one, on 28 April 2020. After the defendant rejected the request again, the claimant submitted appeal to the decision. However, this time, they brought the right party to Court. In the first instance, the claimant demanded the removal of the registration accompanied by a daily penalty payment. The Court ordered the defendant to remove the registration on 1 January 2023 instead of September 2023. However the demanded penalty payment was rejected. The applicant did not agree with the ruling and brought the case for appeal. The claimant put forward three grounds of appeal against the contested decision. First of all, the claimant points to the wrongful absence of relevant facts. Secondly, the claimant argued that the Court should have first assessed whether the registration was still necessary before weighing up the interests. Finally, the claimant challenges the Court's finding that the registration should not be removed until 1 January 2023. The defendant, in turn, put forward four grounds for appeal. Firstly, it also concerns the establishment of facts and, secondly, the admissibility of the application. Thirdly, the defendant complains that the Court wrongly gave weight to the time lapse factor in the weighing of interests. Finally, the defendant argues that there is no ground for removal on 1 January 2023. The Court of Appeal of The Hague tested two elements in its judgment, namely the admissibility of the application and whether the request for removal of the registration should be granted. With regard to the admissibility of the claimant's application of 28 April 2020, the Court of Appeal considered Article 35(2) of the Implementing Act of the GDPR (UAVG), which follows from the right to object, Article 21 GDPR. Article 35(2) UAVG stipulates that the appeal must be submitted to Court within six weeks after receipt of the response from the data controller. Defendant claimed that claimant exceeded the (initial) deadline. First, they claimed that claimant did not submit any new facts and circumstances in his request of 28 April 2020. Second, they stated that claimant could circumvent Article 35(2) UAVG at any moment by submitting a new deletion request. The Court, however, considered that the appeal was admissible. First, they considered that it was clear that claimant made a procedural mistake by addressing the first application to the wrong party, and that the new request dated 28 April 2020 is motivated by the wish to rectify this mistake by still obtaining judicial review. Hence, the Court noted that a reasonable interpretation of Article 35(2) UAVG implies that claimant could still appeal to the rejection of 26 May 2020. Furthermore, respondent, in its response of 26 May 2020 to the second deletion request of 28 April 2020, assessed the content of the request again, and did not emphasis that it would no longer consider the request since this request was identical to the first one. Therefore, the Court concluded that claimant's right to object pursuant to Article 21 GDPR, weighs more than defendant's interest in legal certainty that after six weeks it no longer had to expect that it would be involved in legal proceedings. Regarding the deletion request, the Court examined Article 6(1)(f), Article 17, and Article 21 GDPR. The second sentence of Article 21(1) stipulates that the controller (the defendant) shall no longer personal data unless it has compelling legitimate grounds for the processing which override the interests or the fundamental rights and freedoms of the data subject. Hence, the Court assessed whether the infringement of the data subject's interests is not disproportionate in relation to the purpose that is served by the processing (proportionality test) and whether that purpose cannot reasonably be achieved in a different manner that is less detrimental to the data subject (subsidiarity test). Pursuant to Article 4:32 of the Financial Supervision Act, credit providers are obliged to participate in a credit registration system. The purpose of credit registration is to promote socially responsible financial services, as (also) follows from the General Regulations of the CKI (CKI-regulations). On the one hand, it is in the interest of consumers to protect them excessive lending and other financial problems (i.e., problematic debt situations). On the other hand, it is in the interest of credit providers to limit financial risks when granting credit and to prevent, and combat abuse and fraud. The credit registration system serves these interests, for example by informing credit providers about relevant details that have occurred in the (recent) past. To this end a credit provider is obliged (pursuant to the CKI-regulations) to register certain payment arrears and other irregularities in the CKI. Hence, in principle, such a special codes (that link to bad creditworthiness) remain in place for up to five years after the arrears have been repaid or the credit agreement has been terminated. The Court acknowledged defendant's arguments that stated that claimant was late with payments for a long period, defendant was left with a large residual debt which it had to write of to a large extend, and claimant had not done everything in his power to pay his debts. Considering the fact that claimant also had other debts (that were largely written off), the Court considered that this indicated a risk of excessive lending. This legitimated the importance of registration in the CKI, so that other lenders can assess their credit risks. The claimant was not able to sufficiently demonstrate that its interests outweighed above-mentioned interest. Hence, the Court concluded that the defendant's interest in maintaining the registration outweighed the claimant's interest in having his personal data removed. The request for removal was therefore dismissed.
Court case 5 O 457/20
The controller is a credit reference agency. The data subject is a private person over whose assets, insolvency proceedings were opened. In the course of the insolvency proceedings the data subject was granted a discharge of residual debt, which the controller added to the data subject’s credit report as a negative entry. The data subject unsuccessfully requested the controller to remove the entry and the subsequent applications for an injunction were rejected for lack of merit at trial. The data subject argued that the negative entry was to his detriment as it restricted his ability to participate in economic life. In particular, he could not obtain overdrafts, finance property or car, or place internet orders on account. He argued that the processing of the data on the discharge of residual debt by the controller was unlawful. The data subject requested, inter alia, to order the controller to remove the entry. The controller instead justified the processing with the necessity to provide its contract partners with facts to assess the data subject's creditworthiness. Deleting the entry would deceive potential lenders and possibly induce them to grant a loan without having sufficient information on the data subject's actual creditworthiness. The court had to decide whether the data subject was entitled to have the negative entry deleted and whether the data subject was entitled to injunctive relief against the controller’s data processing in connection with the discharge of residual debt. The appellate court dismissed the claim. It held that the requirements for a claim for erasure pursuant to Article 17(1) GDPR were not met, and the processing is lawful pursuant to Article 6(1)(f) GDPR. Pursuant to Article 17(1), data subjects have the right to demand from the controller that their personal data be deleted without undue delay, provided that one of the grounds specified in the provision, applies. This is in particular the case if there are no overriding legitimate grounds for the processing, the purpose of processing no longer exists or the processing of personal data was unlawful. The court pointed out that, according to the [https://research.wolterskluwer-online.de/document/77de5b4c-8fd7-4e9a-97f6-329f1b45e41f German Federal Court of Justice], a legitimate interest exists if credit lenders transfer the management of their interests to credit reference agencies for reasons of security and rationalisation. Criteria for the risk-free approval of credit applications also include information on insolvency proceedings and their outcomes. Thus, the notification of the granting of a residual debt discharge is in the interest of the controller. Granting a residual debt discharge does not aim at enabling debtors to participate in economic life as if insolvency proceedings had not existed at all. The data subject cannot demand to be put on an equal footing with a person who was never affected by insolvency. Such interests are not protected and therefore cannot outweigh the interest of future business partners in checking the creditworthiness of their debtors. In conclusion, the data subject had no overriding legitimate interest in the removal of the entry. The processing of the residual debt discharge entry by the controller is lawful. Thus, a claim for deletion under Article 17(1)(d) GDPR has no merits. Moreover, the Court held that the negative entry is stored by the controller in order to provide its contract partners with information about it. This purpose persists and could not be pursued without the entry. A claim for deletion pursuant to Article 17(1)(a) GDPR has no merits either. Lastly, a claim for deletion also does not follow from Article 17(1)(c) GDPR. The data subject has neither objected nor is the data subject's particular personal situation apparent.
Court case 3 U 2906/20
In accordance with Article 15(3) GDPR the claimant, as the data subject, demanded in a pre-action measure that the defendants provide them with copies of all of the claimant’s personal data held by the defendants. In particular, the claimant requested copies of telephone notes, memos, protocols, e-mails, letters and underwriting documents for capital investments. The defendants subsequently provided information on the claimant’s personal data in accordance with Article 15(1) GDPR. However, they did not provide the claimant with copies of the documents. The refusal to provide the copies was based on the defendants' argument that Article 15(3) GDPR only governs the method in which information is provided, but does not confer an entitlement on the data subject to be provided with copies. In the subsequent trial, the claimant widened their claim and demanded that the defendants be ordered to provide them with copies of all personal data, including the requested notes, memos and documents. At trial, the court found that the data in question was in fact personal data and ordered the defendants to provide the claimant with copies of all her personal data. The defendants appealed to the OLG Munich to revoke the decision of the trial court. The OLG Munich had to decide on the question if a claim under Article 15 GDPR entitles the data subject to be provided with copies of their personal data and whether Article 15(3) GDPR contains an independent entitlement to have a copy of the personal data handed over to the data subject. The appellate court dismissed the defendants' application and upheld the trial court's decision to order the defendants to provide the claimant with copies of all her personal data. The Court found that an individual who is entitled to information under Article 15(1) GDPR is also, independently, entitled to receive copies pursuant to Article 15(3) GDPR. Both paragraphs concern the same subject matter – personal data – but are different entitlements with different legal effects. Moreover, the structure of the Regulation suggests that Article 15(3) GDPR is a separate claim. With this paragraph, the Regulation does not just further specify the right to information according to Article 15(1) GDPR, but instead introduces an independent provision. The wording of Article 15(3) creates an obligation on the controller to provide the data subject with copies of the personal data. Regarding this obligation, the Court further specified that “the subject matter is not merely an abstract enumeration of the existing information”. Rather, the data subject is entitled to be provided with the information in the form in which it is available to the controller. Regarding the personal nature of the copies, the court confirmed that according to Article 4(1) GDPR and the ECJ’s case law, the definition of personal data must be constructed broadly and potentially includes all types of information, both of objective and subjective nature, in the form of opinions or assessments, provided that the information relates to the data subject. In the present case, the claimant’s letters and e-mails to the defendants must in principle be regarded as personal data within the meaning of Article 4(1) GDPR. Telephone notes, memos and protocols which record what the claimant said to the defendants on the phone or in personal conversations must also be classified as personal data.
Court case 3 S 50/21
Controller is a private landlord, the data subject is their tenant. During an eviction dispute, the data subject filed an access request pursuant to Article 15 GDPR. The controller, however, rejected to comply with the request because it did not store any personal data as a private landlord. Hence, in their opinion, the GDPR did not apply. The data subject was of the opinion that the controller did process data, since their mobile phone number was used for the purpose of communication. Moreover, the controller commissioned an external company to prepare the utility bill. [https://www.lareda.hessenrecht.hessen.de/bshe/document/LARE210000903 The District Court of Wiesbaden acknowledged the data subject’s claim]. It held that the data subject’s personal data was clearly processed, and that none of the exceptions of Article 2(2) GDPR applied. Hence, it concluded the landlord violated Article 15 GDPR. The landlord filed appeal against this decision. The Regional Court of Wiesbaden rejected the appeal. It stated that the controller does process personal data. It noted that the personal data from the rental agreement is processed further by the external company in preparation for the utility bill. According to the Court, at that moment, "computer-aided processing takes place", which results in the company being a processor in accordance with Article 4(8) GDPR and Article 28 GDPR. Moreover, the Court notes that the controller processed data subject's personal data because they communicated via WhatsApp. Lastly, the Court stated that it is obvious that there is no abuse of the right to access, since the data subject's access request, and decided that the controller had to comply with the access request pursuant to Article 15 GDPR.
Private Individual
Controller (company B) is a company that collects debts. The data subject had a contractual relationship with a bank (company A), since they had a credit card account at this bank. The data subject experienced payment difficulties in 2017, which resulted in debt. Ultimately, this led company A to commission company B with the collection of the accumulated debt. Although it remained disputed between the parties whether the data subject and company B concluded a payment arrangement to pay off the debt, the data subject then paid instalment fees to company B to resolve the whole debt. However, company B still registered a claim for €1,546 with SCHUFA Holding AG. This is a credit reference agency that registers debt so that other companies can assess a customer's creditworthiness. The data subject then brought the action before the Regional Court of Lüneburg (Case number 3 O 143/20), in which the data subject and company A concluded a settlement, in which company A promised to have the registered claim of €1,546 removed from the database of SCHUFA Holding AG, pursuant to Article 17(1)(a) GDPR. Company B then contacted the SCHUFA Holding AG to have the claim removed, but the latter did not fulfil the request for deletion. On 10 February 2021, the data subject filed a complaint with the Hessian DPA. The DPA, however, rejected the complaint because it did not see a violation of the GDPR. Consequently, it held that there was no possibility of obliging SCHUFA Holding AG to delete the entry. It was assumed that an agreement on payment in instalments had not been concluded, even if the data subject had behaved in this way. The data subject appealed against this decision before the Administrative Court of Wiesbaden. The Administrative Court of Wiesbaden upheld the appeal. First, the Court considered that the Hessian DPA is the competent supervisory authority pursuant to Article 64(1)(a) GDPR, and that the Court is competent to hear the disputes pursuant to Section 20(1) a
Austrian Data Protection Authority (Datenschutzbehörde - DSB)
A credit reference agency had processed payment experience data on a total of over EUR 1,300 on a data subject. Some of the debts underlying these data had already been repaid, some were still unpaid. In autumn 2019, the data subject requested erasure of all payment experience data under Article 17 GDPR. The credit reference agency refused, arguing a legitimate interest under Article 6(1)(f) GDPR. After the erasure request, the credit reference agency obtained further data on additional debts that the data subjects had failed to pay. The data subject filed a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB), arguing that the payment experience entries were old and therefore not suitable for assessing their creditworthiness. The data subject further claimed that the data were inaccurate. The DSB partially upheld the complaint and ordered the credit reference agency to erase the four oldest payment experience entries from their database. These entries concerned debts over EUR 66 (fully repaid in December 2014), EUR 60 (never repaid but collection ceased in August 2015), EUR 177 (fully repaid in October 2015) and EUR 84 (never repaid but collection ceased in December 2015). The credit reference filed an appeal against this decision with the federal administrative court (Bundesverwaltungsgericht - BVwG) The BVwG partially upheld the decision. It held that the credit reference agency must indeed erase the database entry on the EUR 60 debt (never repaid but collection ceased in August 2015) but may continue to process the remaining entries. It referred to existing BVwG case law, according to which the [https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:32013R0575 CRR Regulation] (which obliges banks to assess creditworthiness based on information that reaches at least back five years in the past) can be used as a tool of interpretation to assess the legitimate storage period for payment experience data. The BVwG held that this five
Plaintiff
The plaintiff requested the defendant, the Board of Directors of the Uitvoeringsinstituut werknemersverzekeringen (UWV, Employee Insurance Agency), to provide access to phone notes and the deletion of these notes. The plaintiff was granted access to the phone notes pursuant Article 15 of the GDPR, but the defendant did not delete them. The defendant argued that the GDPR and the Archive Act must be seen in relation to each other. The phone notes were part of the file that was kept by the defendant in order to carry out their official authority (Article 6(1)(e) GDPR) and had to be saved for the required retention periods according to the Archive Act, which is an exemption from the Article 17 GDPR right to erasure. The plaintiff argued that the processing of the phone notes was not necessary, but the court agreed with the position of the defendant: because the plaintiff made an application for unemployment benefits, initial processing of the phone notes was lawful. Pursuant to Article 30 of the Wet structuur uitvoeringsorganisatie werk en inkomen (Work and Income Implementation organisation Structure Act) the defendant had a duty in the public interest and could therefore base the processing of personal data on Article 6(1)(e) GDPR. The court held that pursuant to Article 17(3) GDPR there is no obligation for a government body to erase personal data if it is subject to a statutory processing obligation. The court also held that there was no obligation to delete plaintiff's personal data from the phone notes pursuant to Article 5(1)(e) GDPR, because Article 3 of the Archives Act precludes the later modification of archival documents.
Court case L 3 R 7/21
The data subject did an apprenticeship from 1978 to 1983. The pension notice mentioned her apprenticeship with 31 months. This was the period which the defendant acknowleged as being eligible for the data subject's pension. The data subject did not contest this notion of the defendant. However, with her claim before the Social Court of Hamburg (Sozialgericht Hamburg - SG Hamburg) she requested clarification that her apprenticeship did not only take 31 months but 5 years. She was afraid of drawbacks on account of an official document mentioning only 31 months. The Social Court of Hamburg denied her request. The Regional Social Court (Landessozialgericht Hamburg - LSG Hamburg) upheld the decision of the Social Court on the basis of the Social Court's reasoning. In its not published decision, the Social Court of Hamburg referrered to the beginning of the second sentence of Article 16 GDPR which states that the pruposes of the processing have to be taken into account. As a consequence, it reasoned that the concept of completeness in Article 16 GDPR is to be understood relatively and not absolutely. Personal data is therefore only incomplete in the sense of Article 16 GDPR if it is so incomplete that the purpose of the processing can no longer be achieved. Insofar as the data satisfies the (possibly very specific) purpose determined by the controller, the data subject cannot demand the inclusion of additional data which, from his point of view, is supposedly useful in the respective context but is not necessary to achieve the purpose. The purpose of listing the periods in the contested notice of the defendant was to justify the amount of the pension granted. This was already apparent from the fact that the insurance history was preceded by the explanatory statement that the list contained data that is relevant for determining the amount of pension. The insurance history did not serve the purpose of presenting a complete curriculum vitae of the plaintiff.
1) unknown data subject (complainant in the procedure before the DSB)
The data subject filed a complaint with the Austrian Data Protection Authority (DSB) against the controller, requesting to be provided with recipients to whom the personal data had been shared under Article 15(1)(c) GDPR, rather than mere categories of recipients. The controller refused, arguing that a controller has a right to choose whether to provide a data subject with information on actual data recipients or rather just categories thereof. Further, the controller argued that the disclosure of actual data recipients would reveal its trade secrets. The DSB upheld the data subject's complaint and ordered the controller to provide the data subject with information on the actual data recipients. The controller filed an appeal against that decision with the Austrian Federal Administrative Court (BVwG), repeating its arguments brought forward before the DSB. The BVwG did not (yet) take a decision on the merit of the case but stalled the procedure because the Austrian Supreme Court (OGH) had already filed a request for preliminary ruling on the question the interpretation of Article 15(1)(c) GDPR in February 2021. Once the CJEU has passed its judgment on the matter, the BVwG will reopen the case.
Court case 23 O 10931/20
The controller operates a social network and an online platform. The data subject created a customer account there using his law firm e-mail address. In July 2020, the data subject demanded damages from the controller because of an alleged data protection incident from January 2019 on the website to his e-mail address. The controller replied, telling the data subject that it did not own the website. Therefore, it informed the data subject how and via which URL he could view and download a complete copy of the data stored about him within his user account. The data subject claimed that the URL links sent by the controller were useless because they showed “page not found” when called. The data subject sought damages for an alleged data breach. He claimed that the defendant did not answer his request for information. The data subject had initially claimed that his data was stolen from his account as part of a hack in February 2019. In 2021, the data subject submitted that a data protection incident regarding his e-mail address was no longer at stake, but rather his account on the platform. He alleged that he lost control of his data as a result of the breach of his right to information and the data leak made possible by system errors. According to him, this amounted to an immaterial damage to be valued at least € 4,500 due to the seriousness of the data protection violation. Before the court, the data subject requested to order the controller to pay him € 6,650 plus interest. The controller submitted that it fulfilled its information obligations under the GDPR. It argued that its information system was customary in the market. Furthermore, the data subject no longer responded to the notification of the links. In addition, the controller denied a data protection incident concerning the plaintiff's e-mail address. The Regional Court of Munich rejected the data subject's claim. It held that the mere allegation that damage has occurred due to the loss of control over data is not sufficient to establish non-material damages. First, the court established that the controller had sufficiently provided access pursuant to Article 15 GDPR by sending the URL links. In the court proceedings, it could not be confirmed that the page could not be accessed. The court confirmed that the electronic provision of personal data on the account is explicitly allowed by the GDPR as Recital 63 GDPR states that, where possible, the controller should be able to provide remote access to a secure system that would allow data subjects direct access to their personal data. Second, the court held that the data subject had not sufficiently shown to have suffered any measurable and compensable damage. It did not follow the data subject's submission that, since his e-mail address had been stolen, the thieves would thus have had access to all contacts stored under this email, in particular client contacts, which could have been sold on the Darknet in addition to his own e-mail address. While it did acknowledge that the data subject may have been affected by a large-scale hack of which the controller had not informed him, the data subject had not submitted sufficient proof of that claim. The court clarified that non-material damages can be compensated pursuant to Article 82 GDPR. However, the data subject had not submitted that, for example confidential client data was accessed. Furthermore, the data subject's e-mail address was not secret and could easily be accessed by third parties. The data subject had limited his argument to the damage consisted in the loss of control over his data which was not sufficient to establish a measurable non-material damages.