GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
The controller is a credit rating agency maintaining a database with 68,000,000 Germany-related datasets. The contractual partners of the controller transmit data from their customers to the controller. The controller stores the data it receives from its partners. In turn it calculates and provides its partners with information on which the statistical risk of payment default. The data subject is a craftsman and requested the erasure of an entry on his creditworthiness stored by the controller regarding a debt between €300 and €400 for which payment had been in default for months. The controller rejected the request. Consequently, the data subject filed a lawsuit requesting erasure of the entry based on Article 17 GDPR with the Regional Court of Augsburg (Landesgericht Augsburg - LG Augsburg). The court found the claim to be unfounded as the controller was justified in processing the data under Article 6(1)(f) GDPR. The data subject appealed this decision and brought forward that the controller should have notified the data subject of the data processing through push-notifications. In the Appeals process the Higher Regional Court Munich (Oberlandesgericht München - OLG München) fully upheld the decision of the first instance. It maintained that the interest of the controller for storing the data is not overridden by legitimate interests of the data subject. Even though the debt was eventually settled the information stored by the controller remained suitable for assessing the credit score. The court also agreed with the first instance that even the payment history on small amounts (in the case at hand an amount below €400,00) is appropriate for future risk assessments. Regarding the fact, that the data subject had eventually paid the claim the court agreed with the first instance that even a late payment is relevant for risk predications. The court held that while the controller is obliged to inform the data subject in accordance with Article 13 and 14 GDPR, t
The controller is a telecommunications company. In 2018, the data subject and the controller entered into a phone contract. The form for the contract included a paragraph which stated that the data subject consents to data exchange between Vodafone and Schufa and other credit rating agencies according to the respective terms and conditions. He also signed these terms and conditions including the controller's data protection information. The data subject claimed that he had not read this information sheet. However, he argued that without signing these documents he was not able to conclude the contract. Subsequently, the controller transferred data about the conclusion of the telecommunications contract to Schufa. In a [https://www.schufa.de/newsroom/schufa/daten-loeschung-telekommunikationskonten/ press release made public on 19 October 2023], Schufa informed the public that it was going to delete information transferred by telecommunication companies by the 20 October 2023. Schufa noted that the Conference of the German Data Protection Agencies (Datenschutzkonferenz der Länder) [https://www.datenschutzkonferenz-online.de/media/dskb/20210929_top_07_beschluss_positivdaten.pdf was of the opinion] that transferal and processing of personal data stemming from the field of telecommunication required a consent of the data subject. The data subject then requested access to their personal data from Schufa and was granted access. With his lawsuit, the data subject claimed, inter alia, €4,000 in non-material damages. The court dismissed the data subject’s action. It held that there was no GDPR infringement and also the claim fell under the statute of limitations. By signing the contract form the data subject had validly consented to the processing of personal data. The fact that it was not possible to form the contract without consenting was not relevant for the court. The statute of limitations applied because the data subject was informed about the transfer of data to Schu
The data subject is a user of Facebook (the controller). In April 2021, data of approx. 533 million Facebook users were made public on the internet. An unknown third party had used the possibility of finding user accounts through the users’ phone numbers for scraping Facebook by trying out randomly generated phone numbers. Through this method, they were able to obtain user profiles with matching phone numbers. The data subject in this case was also among the people affected by this scraping incident; his user ID, first and last name, workplace, and gender were included in the data set and were therefore linked to his phone number. Notably, while the data subject had set his phone number to be visible only to himself, he had left the searchability setting at the default "Everyone," allowing others to find his profile via his phone number. The data subject claimed that the controller did not take appropriate measures to avoid the exploitation of the contact tool that allowed users to be found through their phone numbers. He sued the controller for damages and sought a declaratory judgment to acknowledge his future right to compensation. This declaratory judgment concerning damages is standard in German law due to statutory limitations that would otherwise prevent a person from bringing claims after a period of three years (such as for long-term consequences of a car accident). After the data subject was granted €250 in non-material damages by the Regional Court of Bonn (Landgericht Bonn – LG Bonn), the controller appealed to the Higher Regional Court of Cologne (Oberlandesgericht Köln – OLG Köln), which then overrode LG Bonn’s decision and fully dismissed the action. The data subject, in return, appealed the case to the German Federal Court of Justice (Bundesgerichtshof – BGH). In its first decision under the [https://www.gesetze-im-internet.de/zpo/__552b.html new leading decision procedure], the Federal Court of Justice (Bundesgerichtshof, BGH) partially overruled
The controller operates the social network Facebook. The data subject is a Facebook user. On the 16 September 2021, the data subject re-posted another user’s post on the alleged ineffectiveness and dangers of Covid-19 vaccinations, claiming the “studies published by the CDC, the British government and Oxford University have shown that Covid-19 vaccines are ineffective”. On the same day, the controller removed this post and informed the data subject about this deletion who then appealed the decision without giving further reasons. The controller, however, did not change its decision. The controller’s terms and conditions stipulated that all violations against the community standards expire after one year. With his lawsuit, the data subject demanded, inter alia, * the rectification of his data saved with the controller insofar as all deletion and blocking entries from the controller’s system should be deleted and the counter that counts them should be reset; * decide, by way of a declaratory judgement, that the controller was not allowed to remove the post and confer on the data subject any kind of blocking; * the unblocking of said Facebook post; * €50 in damages. The Regional Court (Landgericht Frankfurt – LG Frankfurt) dismissed the lawsuit completely. The data subject then appealed the decision to the Higher Regional Court Frankfurt (Oberlandesgericht Frankfurt – OLG Frankfurt). The OLG Frankfurt held that the controller had to delete all deletion and blocking entries older than 1 January 2021 and the entry referring to the 16 September 2021 and to reduce the respective counter accordingly. Furthermore, the OLG partially granted the data subject pre-court lawyer costs; the rest of the appeal was dismissed. = The legal basis for the deletion claim follows from Article 17(1)(a) GDPR. The controller was not able to demonstrate the necessity of the further processing of these data since the violations expired after one year according to the terms and conditions of
The data subject’s personal data was processed by the Tax Administration because it suspected him of not fulfilling his tax obligations. This suspicion was raised after the Fiscal Information and Investigation Service (FIOD) had carried out a criminal investigation into the data subject’s tax advisor. During the investigation, the FIOD drew on the assistance of three employees of the Tax Administration and data on the customer's of the tax advisor under investigation, including the personal data of the data subject, were analysed during the proceedings. The data subject requested the erasure of their data under Article 17 GDPR but the request was rejected by the controller, the Minister of Finance. In the Netherlands, the Tax Administration forms part of the Ministry of Finance. The data subject argued that the Tax Administration is processing his personal data for a purpose other than the purpose for which the FIOD initially collected the data. The data subject appealed the Minister's decision to the District Court of Central Netherlands (Rb. Midden-Nederlands) which held that the controller had complied with both the requirements of the GDPR as well as the Law Enforcement Directive. The data subject appealed this decision to the Administrative Jurisdiction Division of the Council of State (Afdeling Bestuursrechtspraak van de Raad van State – ABRvS). The court determined that since the data had been collected for the purpose of the detection of criminal offences, it had to consider whether the disclosure of data by the FIOD to the Tax Administration was permissible. It stated that under [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32016L0680 Article 9 of the Law Enforcement Directive], further processing of personal data is permissible if authorised by EU law. The court held that the further processing of data fell under the remit of the GDPR as the Tax Administration fulfills a task which is in the public interest. The court reiterated the Distri
Data Controller (B) had entered into contract with defendant company to ensure back-up of personal data in case of physical or technical incidents, and to establish regular testing, assessment and evaluation of the efficiency of the technical and organisational measures. Witness 2 explains, and this is uncontested, that the Data Controller was subject to a ransomware attack on 12ᵗʰ August 2020. The Data Controller’s systems were locked and they were unable to restore using back-ups. t is found in the terms of service that the defendant has assumed obligations to ensure access and availability of processed data for the Data Controller. Witness 1 has explained that they, as Executive Officer in the Data Controlling company, were unaware that they ought be in possession of an access key to the back-up. The witness for Data Controller explains that the defendant company had not established a procedure for testing, assessment and evaluation of the feasibility of using the back-up to restore access to the processed data. Irrespective of * it according to the Witness 1’s statement is found apparent, that the customer themselves create the access-key upon installation * the customer in this process is informed that they themselves are responsible for storing the access-key; which the defendant company is not in possession of * it being stated in the terms of service appendix that the customer them selves are responsible for setting up the system and software and access-key used, and it is apparent that there can be no other outcome The defendant did not take steps to ensure that the Data Controller was in possession of the access key and thus had the ability to restore access and availability of the personal data in the back-up. The defendant is found guilty of being negligent in their obligations stated in the Article 32(1) & Article 83(2), (4)(a), (9). The sanction is set as a monetary penalty of €5 ,360 (DKK 40,000). In setting the sanction the court has takien into
In 2016, the data subject had been investigated and convicted due to tax evasion by a German Regional Court. The data subject alleged that the investigative file concerning him had been leaked to third parties including a journalist who used the contents of the file for their reporting. First, the data subject lodged a complaint with the DPA of the federal state of North Rhine-Westphalia (Landesbauftragte für Datenschutz und Informationsfreiheit des Landes Nordrhein-Westfalen – LDI NRW) in 2017 which was rejected on the ground that the the disclosure of court files forms part of the administration of justice and that the DPA lacks competence on this matter. In response to this, the data subject brought a case against the DPA to the Administrative Court Düsseldorf (Verwaltungsgericht Düsseldorf – VG Düsseldorf) in 2019. The claim was rejected as the complained of breach and the following proceedings had been concluded prior to the entry into force of the GDPR in 2018 (see 29 K 7031/19). However, the DPA treated the case taken by the data subject in 2019 as a complaint and began investigating the alleged data breach. The DPA requested information on the potential data breach from the Regional Court as well as all involved public prosecution offices. It did not request information from the tax investigation department as it considered this entity not to fall within its competence. On the 1 June 2022, the DPA issued a decision stating that it had found no violation of the data subject's rights. On the 4 July 2022, the data subject brought a case to the Administrative Court Düsseldorf (VG Düsseldorf) contesting the decision of the DPA dated 1 June 2022. The data subject alleged that the DPA did not diligently investigate the circumstances which in his eyes proves an active failure to act within its margin of discretion. He detailed that a violation should not be left unpunished just because it cannot be concretely identified. In addition, the data subject claimed t
The data subject lives in the Netherlands and was a victim of the so-called "benefit scandal". The latter involved the usage of a discriminatory algorithm by the Dutch Tax Administration in order to detect frauds by families claiming childcare benefits (see AP (The Netherlands) - 25.11.2021). Since she wanted to know what personal data of her the Tax Administration (Belastingdienst, the controller) was processing, she filed an access request with the Tax Administration. More specifically, she requested the respective minister to access and list her personal data contained in the Fraud Alert Facility (Fraude Signalering Voorziening - FSV), a system used to detect possible frauds in an automatic way. The controller rejected the access request. It argued that the processing at hand fell within the scope of Article 23 GDPR. More specifically, the controller referred to [https://wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=41&z=2021-07-01&g=2021-07-01 Article 41(1)(i) of the Dutch GDPR Implementation Act] (Uitvoeringswet Algemene verordening gegevensbescherming - UAVG), stating that the controller can limit data subjects' rights (in this case, the right of access) in view of the protection of the rights and freedoms of others. The controller took the position that it could not comment further on this, as this would prejudice the purpose of the restriction. The controller, therefore, did not specify how the balancing of interests entailed on the basis of [https://wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=41&z=2021-07-01&g=2021-07-01 Article 41(2)(h) UAVG] was carried out. On these grounds, the data subject appealed the controller's decision before the District Court of Rotterdam (Rechtbank Rotterdam - Rb. Rotterdam). The court ruled that the controller did not give sufficient reasons for reject the data subject's access request. The court referred to the [https://zoek.officielebekendmakingen.nl/kst-34851-3.html Explanatory Memorandum of
On the 16 December 2019, the data subject filed a complaint against the controller, a credit rating agency with the Austrian DPA (Datenschutzbehoerde – DSB). The data subject alleged that the controller stored data regarding a previous insolvency for an excessive period of time after the termination of the insolvency or restructuring proceedings. Making available data on the insolvency led to the data subject suffering damages as bank loans were made unavailable to him. In the particular circumstances of the data subject, the insolvency was caused due to guaranty commitments rather than his own actions. Any debt and guaranties were settled through the restructuring proceedings and all outstanding payments were made within a month. The controller had violated the data subject’s right to privacy under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597 Article 1(1) of the Austrian Data Protection Act] (Datenschutzgesetz - DSG) as none of the requirements of Article 6(1)(f) GDPR were met for the publication of credit-limiting information. The data subject later added that his right to rectification under Article 16 GDPR, his right to erasure under Article 17 GDPR and his right to restriction under Article 18 GDPR had been violated. He further added that he is exercising his right to object under Article 21 GDPR due to violations of Article 6(1)(e) & (f) GDPR. The data subject detailed that the credit rating agency stored and made available "negative entries" for seven years after the insolvency procedure had been wrapped up. The DSB rejected the complaint on 16 August 2021 stating that the consideration of non-payments in the near past is necessary in order to disseminate a complete profile of credit worthiness. The erasure from the insolvency register does not mean that this data must automatically be removed by credit rating agencies. The data subject appealed the decision to the Federal Administrative Court of Austria
The controller is a credit rating agency. Its contractual partners provide it with information relevant to the database from their business relationships with their customers. The controller stores this information as entries in its database in order to be able to provide its contractual partners with information. The data subject had previously initiated court procedures against the controller about the legality of the so-called score value, which the controller determines on the basis of the data available to it and which is intended to assess the creditworthiness of the person concerned. With regard to this procedure, the controller imposed a so-called score block until its conclusion, with the consequence that no more credit score values are transmitted in the event of a corresponding query by the controller's contractual partners. This can lead to difficulties for the data subject, e.g. for entering into new contracts. The data subject challenged the block imposed by the controller on the data subject of the database for the provision of information on contractual partners with the application to lift the so-called "score block" and to refrain from a future block until the decision in the main action. The Court of first instance dismissed the application for a preliminary injunction. The data subject's appealed this, seeking the court, to order the controller to immediately to lift the block imposed on the applicant of the database for the provision of information on contractual partners, the so-called "score block". The court stated, the data subject is only entitled to the rights of data subjects under Chapter III of the GDPR. The court found, that the data subject seeks the (re)commencement of the processing of personal data by the controller in the form of scoring and the transmission of the scoring value to third parties which is not listed in Chapter III. Thus, the court found, that the GDPR did not provide a legal basis for it's claim. The cour
The controller, a telecommunication company, informed its customers (data subjects) through various privacy notices that so called “positive data” could be transferred to the credit ranking agency SCHUFA and CRIF. SCHUFA and CRIF process the data received from the controller and also use it for the purpose of profiling (scoring) in order to provide their contractual partners with information, among other things, for assessing the creditworthiness of natural persons ("credit scoring"). Independently of credit scoring, SCHUFA supports its contractual partners by creating profiles to identify conspicuous facts. For postpaid mobile phone contracts, the controller transmitted “positive data” from data subjects to SCHUFA until October 2023 and continues to transmit it to CRIF. This includes at least the master data required for identity verification (e.g. name) as well information on whether a contractual relationship was established with the consumer and if an existing contractual relationship with the consumer has been terminated. The plaintiff, a consumer association, alleged that the controller lacked a legal basis for transmitting "positive data" to credit scoring agencies and therefore violating Article 6 GDPR. Additionally the consumer association held that the controller privacy notices constituted unfair terms and conditions subject to special consumer protection and competition regulation. It demanded a cease-and-desist declaration along with reimbursement of associated costs. The controller claimed a legitimate interest according to Article 6(1)(f) GDPR in mitigating payment defaults and preventing fraud. The Regional Court Munich (Landgericht München – LG München) dismissed the action in the first instance. It stated the following reasons: # The claim related to "positive data" was inadmissible due to the lack of specificity, as the term is undefined by local law and unclear in its application. # The contested data protection notices were not general terms a
On 24 January 2022, the Ministry for Foreign Affairs, the controller, notified the Data Protection Ombudsman of a data breach as per Article 33 GDPR. This data breach concerned spy malware, which has been installed on Finnish diplomats´ phones and allowed the exploitation of information stored on the phones. Four months later, the Data Protection Ombudsman decided that the controller did not comply with the notification limit, i.e. 72 hours as per Article 33(1) GDPR and did not provide for a reasoned explanation for such delay. Moreover, the controller did not comply with Article 34 GDPR due to the improper notification to data subjects (only oral and during a press release). The controller appealed the Data Protection Ombudsman decision. The Administrative Court held that the personal data breach in this case was posing a high threat to the rights and freedoms of individuals, within the meaning of Article 34(1) GDPR. While the controller did notify via press release the data subjects of the breach, the Court found that the controller did not notify the parties of the infringement without undue delay. Two main reasons were brought forward: the gravity and seriousness of impact on data subjects, and the fact that Finland did not provide any national law limiting the scope of application of Article 33 and 34 GDPR due to national security guarantees. The controller appealed the decisions of the Administrative Court to the Supreme Administrative Court. In its decision, the Supreme Administrative Court elaborated on three main points: 1. The GDPR is not applicable for foreign and security policy matters. In this regard, the Court decided that, even if the GDPR expressly states that the processing of personal data relating to national security and the common Union foreign and security policy is excluded from the GDPR, in [https://www.finlex.fi/en/laki/kaannokset/2018/en20181050.pdf Article 2(1) of the Finnish Data Protection Act], the scope of the GDPR has been nat
The data subject has used an account in a social network operated by the controller. Upon registration, the data subject voluntarily entered his mobile phone number. As a default setting, a user profile could be found through the search function by entering the user's phone number, even if the number was not made visible for the person searching for the number. Furthermore, the social network included a contact import function that allowed users to import contacts from their smartphone and thus find other users among his phone contacts. To avoid being searchable for other users through one’s phone number, the user had to open and change the settings of the social network. The described functions made it possible to search for automatically generated phone numbers on the platform. If a generated number matched a user’s profile, the profile was shown. Thus, the scrapers knew that the number was really existing and in use and could link this number to the other data the data subject made public on the platform. Starting from January 2018, unknown persons obtained large amounts of account data and matching phone numbers, including the account data of the data subject. In 2021, these data could be found on the internet. The controller confirmed to the data subject in September 2021 that according to their information personal data of the data subject (the user ID, first and last name, and gender) were scraped from the platform. With his lawsuit, the data subject claimed, inter alia, non-material damages from the controller. The court held that, in the case at hand, despite an infringement of the GDPR there was no damage. The possibility of scraping user data from the platform amounted to processing of personal data under Article 4(2) GDPR. The court held, that the availability of the phone numbers for scraping does not fall under Article 6(1)(b) GDPR since this data processing is not strictly necessary for the performance of the contract between the parties. The data p
The data subject made 9 access requests to the controller, two of the requests were not answered. On 8 April 2024, the data subject initiated legal proceedings against the controller before the district court. They argued that the controller violated Article 15(1)(c) GDPR because the controller did not give a full list of recipients of their personal data. The data subjects also wants access to who they share and will share personal data with in the future, especially recipients in third countries and international organisations. Second, the data subject argued that the controller must, under Article 15(1)(g) GDPR, reveal the source of the data. The data subject also claims the controller violated Article 12(1) until 12(4) GDPR. The controller argued that they have no obligation to share the identity of third parties because this is confidential business information. Therefore, the controller feels that they can partially restrict the data subject’s right of access based on Article 23 GDPR and Article 41(1)(e) of the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming – UAVG) The controller reacted to the second point and claims that all personal data is taken from one public source (de Kamer van Koophandel). First, the court assessed if the controller could rely on Article 41(1)(e) UAVG and Article 23 GDPR to deny an access request. The court did not find that a list of clients could damage the controller’s financial interests based on Article 41(1)(e) UAVG. The court found that the controller did not demonstrate why their customer base is a business secret. The controller did not explain how the size of the customer base and the identity of the third parties requested by the data subject negatively influenced its financial interests. Overall, the protection of business secrets is not a fundamental right and the rights of the data subject have priority over the rights of the controller. Furthermore, the controller does not
The data subject used the social network operated by the controller. Until 07 November 2023 it’s service was free of cost. After that, the controller explicitly demanded a consent for personalised advertisement in order to continue the social network for free. The data subject consented and did not opt for the payment model that would have allowed using the platform without consenting to the advertisement (“pay or okay”). For the time before his consent, the data subject claimed €1,500 in non-material damages alleging that, without consent, the processing of his personal data for advertisement purposes had been illegal. He alternatively based his claim on what the court refers to as a reversed licence analogy: Before consenting to personalised advertisement, the data subject had used the social network for 66 months. Referring to the post 2023 payment model’s monthly cost of €20, the data subject claimed 66 * €20 = €1,320 in unjust enrichment. The court held that the claim based on two different legal bases was too vague and therefore inadmissible under [https://www.gesetze-im-internet.de/zpo/__253.html § 253(2)(2) German Civil Process Order] (Zivilprozessordnung – ZPO). This is due to the fact that if the court decides by, e.g., granting the claim on the basis of unjust enrichment, there would be no decision on the non-material damages. Therefore, the controller couldn’t determine if the data subject would sue again. This happens, when one claim is based on two matters of dispute rather than two legal bases for the same claim. The court held that non-material damages and unjust enrichment claims were two matters in dispute since the claimed damage is non-material while the claimed unjust enrichment is about a material amount of money that allegedly is still within the assets of the controller. Both are two different things: A damage of the data subject does not necessarily correspond with a material enrichment of the controller and, vice versa, an unjust enrichme
The controller was a political party, the data subjects were recipients of two campaign emails. On 22 November 2021, a staff member of the controller sent two emails with attached “open letters” as part of a political campaign, using an open distribution list in the “To” field instead of using blind copy (BCC). Each email exposed around 400 email addresses, including at least 100 personalised addresses showing first and last names. The controller had collected the email addresses from publicly accessible sources and relied on legitimate interest under Article 6(1)(f) GDPR for the processing, instead of asking for consent. On 4 December 2021, the controller notified the DPA of the personal data breach. On 22 April 2022, in separate supervisory proceedings, the DPA found that the controller had unlawfully disclosed political opinions through the open distribution list. Subsequently, it initiated administrative fine proceedings. On 14 December 2023, the DPA imposed a fine of €50,700 under Article 83(5)(a) GDPR for infringements of Article 5(1)(a) and (c) GDPR and Article 9(1) GDPR. The controller appealed to the court. It argued that the email addresses did not reveal political opinions, that [https://www.jusline.at/gesetz/dsg/paragraf/artikel2zu30 § 30 DSG] required attribution to a natural person in a leadership position, and that the fine was disproportionate. The court partly upheld the appeal and amended part of the decision. First, the court held that the combination of the personalised email addresses and the political content attributed a political opinion to at least part of the recipients. By making the distribution list visible to all recipients, the controller disclosed special categories of personal data within the meaning of Article 9(1) GDPR and no exception under Article 9(2) GDPR applied. Legitimate interests under Article 6(1)(f) GDPR can not justify the processing of special categories of data. Second, the court confirmed a violation of Article 5
A former employee of a health care institution filed a complaint with the Polish DPA (UODO). The employee (a data subject) claimed the health care institution (a controller) unlawfully processed their data stored on their business computer hard drive. For the data subject, there was no legal basis to process their data after the employment relationship ceased. Consequently, the data subject asked for deletion of their data. The DPA ordered deletion of personal data by the controller. According to the DPA, the controller didn’t have legitimate interest under Article 6(1)(f) GDPR to process the data. Although the controller argued the data were necessary for defence of legal claims, the claims were of hypothetical nature. Thus, the controller processed the data in advance. The controller brought an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The appeal was dismissed. The court found no evidence that processing of the data at stake was necessary for the purpose of controller’s legitimate interest. The court emphasised that purely theoretical, future claims cannot justify data processing once the employment relation came to an end under conciliatory agreement (mutual consent of the parties . Hence, the DPA’s decision was upheld. The controller lodged a cassation appeal before the Supreme Administrative Court (Naczelny Sąd Administracyjny – NSA). The Supreme Administrative Court upheld the cassation appeal. The court of first instance failed to hear the case properly. The appeal was not thoroughly assessed and not all the controller’s statements against the DPA decisions were answered. In particular, the court of first instance didn’t identify the category of data processed by the controller, nor the data stored on the hard drive. It remained unknown whether the hard drive contained also data of other individuals. Moreover, the court of first instance didn’t explain in detail why the controller was not
The data subject had a heating supply contract with a private energy company, the controller. On 17 October 2019, the controller installed a smart heat meter in the data subject’s apartment. The device recorded various consumption and technical data, including energy usage, flow rates, and temperatures. It also stored historical operational data for error detection. The controller read the meter once per year on-site. Although the device technically supported remote reading via a radio module, the controller did not use this function. On 21 September 2020, the data subject filed a complaint with the DPA, arguing that the device unlawfully processed personal data and that the controller required a specific legal basis as a public authority. The DPA rejected the complaint on 11 October 2021. The data subject appealed to the court. First, the court held that the controller was not a public authority. It acted as a private company under a contractual relationship and had no statutory powers to exercise authority. Therefore, Article 6(1)(f) GDPR could apply. Second, the court held that the processing of consumption data (such as energy use, flow, and temperatures) complied with Article 6(1)(c) GDPR. National law required the collection and storage of such data for billing, energy efficiency, and system operation. This law satisfied the requirements of Article 6(3) GDPR by defining the purpose, scope, and retention periods. Third, the court held that the processing of additional technical and historical data (such as error logs and operational records) complied with Article 6(1)(f) GDPR. The controller had a legitimate interest in ensuring the proper functioning and maintenance of the device. The processing was necessary for detecting faults and maintaining system reliability. Finally, the court found that the data subject’s interests did not override the controller’s interests. Access to detailed historical data required specialised tools, and the data was only used i
A court rendered a judgment in a case referring to a data subject. An individual, being a member of data subject’s family, published the judgement via their Facebook account and by placing its copy behind their car’s pane. The judgment was published in that way for 11 days. The data subject filed a complaint with the Polish DPA (UODO). The DPA dismissed the complaint as it considered that the personal data were published under Article 2(2)(c) GDPR, i.e. for purely personal activity. Additionally, the individual and the data subject were related. Thus, according to the DPA, the processing at stake fell outside GDPR’s scope of application. The data subject brought an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The court repealed the DPA’s decision. By referring to case C-101/01 and C-212/13, the court emphasised the exemption of purely private activity didn’t cover the processing which led to disclosing the data to unlimited number of people. Because the individual shared the data via Facebook, making it available to unlimited number of its users, Article 2(2)(c) GDPR didn’t apply. The DPA lodged a cassation appeal before the Supreme Administrative Court (Naczelny Sąd Administracyjny – NSA). The Supreme Administrative Court dismissed the cassation appeal. The court explained that the notion of purely personal activity was inherently limited. In particular, when the personal data were made accessible to an unrestricted number of people, for instance, social media users, it excluded the application of Article 2(2)(c) GDPR. The court based it reasoning on Recital 18 GDPR, case C-212/13 and WP29 [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2009/wp163_en.pdf Opinion 5/2009]. In the case at stake, the individual published the judgement referring to the data subject via Facebook. The post shared in such a way that every Facebook user could has accessed it. Hence, the indiv
The controller is a telecommunications company. The data subject and the controller entered into a mobile phone contract. During the conclusion of the contract the controller provided the data subject with an information sheet that included information about the transfer of personal data to the Schufa, a credit rating agency. Subsequently, the controller transferred the name, the date of birth, the address, and information about the conclusion of the contract to Schufa. Following his request, Schufa informed the data subject about the data forwarded by the controller. In a [https://www.schufa.de/newsroom/schufa/daten-loeschung-telekommunikationskonten/ press release made public on 19 October 2023], Schufa informed the public that it was going to delete information transferred by telecommunication companies by the 20 October 2023. Schufa noted that the Conference of the German Data Protection Agencies (Datenschutzkonferenz der Länder) was of the [https://www.datenschutzkonferenz-online.de/media/dskb/20210929_top_07_beschluss_positivdaten.pdf opinion] that the transfer and processing of so called positive data (i.e. data without connection to a payment default or another violation of the contract by the data subject) required the consent of the data subject. Data concerning the conclusion of a contract would constitute such positive data. With his lawsuit, the data subject claimed, inter alia, €4,000 in non-material damages. The court recognised the controller’s interest in lowering its financial risk. If the controller enters into a contract in which it periodically charges the client for its services without a pre-paid system, there is a certain risk of the client not paying for services made in advance. This risk increases when the client is handed a mobile phone at the beginning of the long term contract. Therefore, a risk of being defrauded exists for the controller. The court further recognises the possible advantage of a standardised notification about the co