GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 21 October 2026 · Updated daily
Court case 4 U 324/21
The parties concluded a contract for the purchase of a laptop. Due to a hard disk defect, the claimant arranged for a repair with the defendant. Before returning the hard disk to the defendant, the defendant informed the claimant that they did not offer data backup- and data recovery services, that customers were "responsible for the security of their data" and that it could happen that "the hard disk may need to be deleted or replaced in the course of the repair". With this information, the claimant sent the hard disk to the defendant for repair. The hard disk contained the claimant’s personal data. Upon completion, the defendant returned a different hard disk to the claimant. This new hard disk did not contain the claimant's personal data. At trial, the claimant demanded compensation for unlawful processing of his personal data and information about its disclosure. He also claimed the surrender of the hard disk and applied for an injunction against the storage, disclosure or publication of the data on this hard drive. All claims were dismissed at trial. The appellate court had to decide whether, inter alia: # the implied consent to the deletion of the personal data is effective, # the claimant is entitled to further information under Article 15 GDPR even though the defendant had already communicated the non-existence of personal data, # the claimant has a valid claim for pecuniary damages under Article 1, in conjunction with Article 2(1) Grundgesetz or for non-pecuniary damages under Article 82 GDPR because of the loss of personal data. The appellate court dismissed all of the claimant's applications and upheld the decision of the trial court. The court held that personal data is processed when a hard disk containing personal data is physically destroyed under a contractual warranty. Regarding the effectiveness of consent to the deletion of personal data in the context of a repair, the court found that valid consent can be given through conduct implying intent. There was no need for express consent. According to Recital 32 GDPR, it suffices if the data subject takes an “affirmative act establishing a freely given, specific, informed and unambiguous (…) agreement to the processing of personal data (…) which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data.” The GDPR thus only requires voluntary and unambiguous action by the data subject that takes place before the processing of personal data begins and from which the consent can be clearly derived. In the present case, valid consent was given as the seller informed the customer in advance that replacement and deletion are an option and that the customer is solely responsible for backing up the data, before the hard disk is returned to the seller. By declaring that a controller is no longer in possession of a data carrier and has not processed the data on it, the controller has fulfilled the data subject's right of access under Article 15 GDPR. No further information is owed to the data subject. On the claims for compensation, the court held that claims for damages under Article 1, in conjunction with Article 2(1) Grundgesetz, require serious violations of the general right of personality. The seriousness depends on the significance of the violation, the motives of the defendant and the degree of culpability. In the present case, there was no serious violation, as the defendant had only acted within the warranties given and without intent to cause harm. The court also ruled out a claim under Article 82(1) GDPR. The court found no violation because the claimant had consented to the deletion of the data.
1) unknown data subject (complainant before the DSB)
A data subject requested erasure of a negative database entry from the database of an Austrian credit reference agency under Article 17 GDPR. The debt underlying the entry was EUR 38,83 and had been paid back in full only 17 days after a debt collection agency started to collect it from the data subject. Nevertheless, the credit reference agency refused to erase the data and the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde - DSB). The DSB upheld the data subject's complaint and ordered the credit reference agency to erase the data within two weeks. It held, that the data subject's interests outweigh those of the controller the in light of the insignificant amount of the debt and it's relatively quick payback. The credit reference agency filed an appeal against the DSB's decision with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG rejected the appeal and upheld the DSB's decision. In its reasoning it followed the DSB's assessment regarding legitimate interests. It further held, that the BVwG's case law on a five year storage period of payment experience data (in light of Regulation (EU) 575/2013) cannot be applied on the case at hand: these BVwG decisions dealt with data processing regarding significantly higher debt amounts and/or cases where there were multiple negative payment experience data in the credit reference agency's database.
Joint Tax office Lococensus Tricijn
In June 2019, the defendant, the Dutch Tax Office (Gemeenschappelijke belastingkantoor Lococensus-Tricijn', 'GBLT'), addressed a letter to the claimant. However, the destination of the letter was the claimant's old residential address. The claimant sent an email to the defendant, drawing attention to this error and emphasising that, as a result, his personal data had reached a third party. In its response, the defendant apologised, and proposed that the appropriate action would be to ask the third party to delete the relevant data and confirm this. The claimant indicated they were unable to respond to this proposal until certain ambiguities were resolved regarding the content of the leaked data. In August 2019, the claimant sent another email to the defendant, in which he asked a number of questions regarding the provision of his email address by the defendant to a company called 'KCM Survey BV', as well as other third parties for customer research purposes. Among other things, the complainant stated that he had not given his consent for this transfer, and asked what the legal basis was for sharing his data with third parties, and which third parties his data was shared with. The defendant responded stating that it considered processing for customer research purposes to be part of its statutory duties - more specifically, evaluating and ensuring the quality of the implementation of the Tax Act ('belastingwet') - and that therefore it does not consider it necessary to rely on the consent of data subjects. It did add, however, that it considered the claimant's communication as an objection to the processing of his email address for customer research purposes, and that it would no longer process the email for this purpose. Several months later, on 16 February 2020, the claimant asked for more information about the initial data breach involving the letter, as it was still not clear to him which documents were leaked. On 28 February 2020, by primary
CRIF
In 2018, the complainant requested access to their personal data from the CRIF (the ‘respondent’), a credit reference agency operating in Austria. After receiving the response of the agency, the complainant stated a violation of their right to access due to its insufficiency. According to the complainant, the agency failed to precisely name data sources, purposes and the storage period for the personal data. In this regard, the complainant has not been informed on new recipients of their personal data as well. Furthermore, the agency did not provide a full copy of the personal data processed on the complainant. Accordingly, it also breached the principles of data minimization and confidentiality, processing incorrect addresses and insufficiently encrypted data. The respondent indicated certain companies as their data sources and stated that the data is stored as long as there was an interest by the respondent. Moreover, the data made available by the agency presented all the data held on the complainant and a copy would not add any value. At the same time, providing more information would reveal business secrets which therefore cannot be made available. Consequently, there was no violation and therefore no right to appeal by the complainant. The Austrian DPA dismissed the complaint, arguing that the disclosure of data sources, recipients and as well as criteria for determining the storage period has fulfilled the access request of the complainant. The provided data was sufficient and a copy of the personal data does not include entire documents, exact copies or a facsimile of such, but it is in the choice of the controller on what and how exactly data is delivered. Moreover, Article 77 GDPR is standardized in administrative proceedings as part of the Austrian national law and therefore bound to its requirements. The Federal Administrative Court of Austria limited its judgement to the objections regarding the provision of information on the origin, storage period a
1. unknown (complainant before the Austrian Data Protection Autority)
A data subject (the complainant) sent an access request to an Austrian credit reference agency (the respondent), requesting (i.a.) a copy of their personal data undergoing processing pursuant to Article 15(3) in a commonly used electronic format. The respondent only provided a table that contained the personal data (name, date of birth, address data business functions of the data subject) in an aggregated form but refused to provide an actual copy of the data undergoing processing, such as database print-outs or email correspondence regarding the complainant. The respondent argued that Article 15(3) GDPR does not entitle a data subject to receive a copy of the data in the sense of a facsimile of the data. Furthermore, the disclosure of a copy would also violate the respondent's business secrets, since a copy of data from a relational database (such as the respondent's identity and creditworthiness database) would inevitably also reproduce the logical-mathematical links of the individual data records. The complainant argued that Article 15(3) GDPR entitles them to a copy of the data in the very form that these data are undergoing processing. A controller has no right to limit the right of access to a modified aggregation of the relevant data. The Austrian Data Protection authority (Datenschutzbehörde - DSB) followed the respondents argument and rejected the complainant's claim. It deemed the data and information provided by the respondent to be sufficient. The complainant consequently filed an appeal with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG stayed the procedure and requested the CJEU's preliminary ruling under Article 267 TFEU on the following questions: 1. Is the term "copy" in Article 15(3) GDPR to be interpreted as meaning a photocopy or facsimile or an electronic copy of (electronic) data, or does the term also cover a "transcript", un "double" ("duplicata") or a "transcript", as understood in German, French and English dictionaries? 2. Must the first sentence of Article 15(3) of the GDPR, according to which "the controller shall provide a copy of the personal data undergoing processing", be interpreted as implying a general legal right of a data subject to obtain a copy of - also - all documents relating to him or her or the provision of a copy of an extract from the database where the personal data are processed in such a database, or does this mean that the data subject has a legal right - only - to a faithful reproduction of the personal data to be provided with information pursuant to Article 15(1) of the GDPR? 3. In the event that the answer to question 2 is that the data subject only has a legal right to a faithful reproduction of the personal data to be provided pursuant to Article 15(1) GDPR: must Article 15(3) first sentence of the GDPR be interpreted as meaning that, due to the nature of the data processed (e.g. with regard to the diagnoses or examination results referred to in recital 63 or documents in connection with an examination within the meaning of the judgment of the CJEU of 20.12.2017, C-434/16) and the transparency requirement in Article 12(1) GDPR it may nevertheless be necessary in individual cases to also make text passages or entire documents available to the data subject? 4. Is the term "information" which, according to the third sentence of Article 15(3) GDPR, must be provided to the data subject "in a commonly used electronic form" where the data subject makes the request electronically "unless otherwise requested by the data subject" to be interpreted as meaning only the "personal data undergoing processing" referred to in the first sentence of Article 15(3) GDPR? a. If the answer to question 4 is in the negative: Is the term "information" which, according to the third sentence of Article 15(3) GDPR, must be provided to the data subject "in a commonly used electronic form" where the data subject makes the request electronically "unless otherwise requested by the data subject" to be interpreted as including, in addition, the information referred to in Article 15(1)(a) to (h) of the GDPR? b. If question 4.a. is also answered in the negative: Is the concept of "information" which, according to the third sentence of Article 15(3) GDPR, must be provided to the data subject "in a commonly used electronic form" where the request is made electronically, "unless otherwise requested by the data subject", to be interpreted as referring to the "personal data undergoing processing", the information referred to in Article 15(1)(a) to (h) GDPR and information going beyond these information, such as for example associated metadata?
College van burgemeester en wethouders van Leeuwarden
A data subject submitted an an access request to the Municipality of Leeuwaarden concerning information on the collection, processing, and storage of data by the chip card reader attached to the waste container at his home address. The request included the following words: "Yours faithfully but with kind regards,: [appellant name]: I AM Without Prejudice UCC 1-308 Beneficiary, Authorized Agent and Representative for the legal fiction [appellant name]" In response, the Municipality asked the data subject to submit his request online and signed with his DigiD within 14 days, or to identify himself at the town hall with a valid identification document. DigiD is an identity management platform used by government agencies in the Netherlands. The Municipality explained that the request concerns personal data, which must not be provided to the wrong person, and it is therefore important to properly establish the data subject's identity. Indeed, Recital 64 GDPR states that the controller should take all reasonable steps to verify the identity of a data subject requesting access. And, following Article 12(6) GDPR, if there is reason to doubt the identity, additional information may be requested that is necessary to confirm the identity of the data subject. When the data subject did not identify himself in the way it requested, the Municipality issued a decision stating it would not consider his request. The data subject lodged an objection to this decision, which the Municipality declared unfounded. On 2 October 2020, the District Court of Northern Netherlands dismissed an appeal by the data subject regarding the Municipality's decision to reject his request. The data subject ('appellant') then appealed to the Council of State. The appellant argued that the District Court erroneously ruled that the Municipality could reasonably doubt his identity and could therefore ask him to identify himself. In particular, this is because the Municipality had previ
Court case 6Nc19/21b
An Austrian based data subject intended to file a lawsuit under Article 79 GDPR due an (alleged) violation of Article 15(3) GDPR. The Austrian law contains no general provision determining which civil court in Austria would be competent to handle such lawsuit - § 29(2) of the Austrian Data Protection Act (Datenschutzgesetz - DSG) only establishes which court is locally competent to handle claims for damages following a violation of the GDPR (see Article 82 GDPR) or the DSG. Hence, the data subject filed a request under § 28 of the Austrian Judicial Jurisdiction Act (Jurisdiktionsnorm - JN) with the Austrian Supreme Court (OGH), asking the OGH to assign the case to the regional court of Feldkich (LG Feldkirch). § 28 JN allows for the OGH to assign a case to an Austrian civil court of its choice when it is unclear under the law, which court is locally competent to handle a case. The OGH rejected the data subject's request and held that § 29(2) DSG does not only apply to claims for damages but for any kind of civil claim under the GDPR or the DSG. In its reasoning the OGH referred to its decision 9Ob91/19d of 23.05.2019. The OGH held, that even if that decision (only) dealt with the question of subject matter competence of Austrian courts regarding claims under the GDPR, its findings can be applied on the question of local jurisdiction as well. Hence, the request under § 28 JN needed to be rejected, as the question of local competence can be answered by applying § 29(2) DSG per analogiam.
Claimant
Following alleged sexual abuse, the appellants requested the Dutch Inspectorate of Education ('the Inspectorate') to allow them to access documents and obtain a copy of all documentation concerning reports, announcements and/or questions made by, through or about the school community and submitted confidentially to inspectors or staff members. The request was made pre-GDPR, under the Dutch Personal Data Protection Act ('Wet bescherming persoonsgegevens'). More specifically, the appellants wished to obtain a copy of all documents known to the Inspectorate regarding the alleged sexual abuse. On 21 November 2016, this request was rejected by the Minister for Primary and Secondary Education and the Media ('the Minister'), since: # it was unclear to whose personal data the request was related; # the national law did not provide the right to obtain a copy but to access; and # the Dutch Education Supervision Act (Wet op het onderwijstoezicht') guarantees full confidentiality. By decision of 8 December 2017, the Minister provided a number of documents containing personal data of appellant A and his son in full and a number of documents in part. Insofar as more personal data of the appellants were held by the Inspectorate, the Minister refused access due to the above-mentioned confidentiality. By decision of 27 November 2018, the Minister dismissed the appellants' objection to the decision of 21 November 2016 as unfounded. The appellant filed an appeal with the Amsterdam District Court. On 29 August 2019, the Amsterdam District Court declared that the appeal lodged by the appellant was unfounded. With regard to the appellants' documents and other data, which are held by the Inspectorate and to which the above-mentioned confidentiality (Section 6(4) of the Education Supervision Act) applies, the District Court ruled that the Minister was entitled to refuse access to these documents, insofar as they are present and contain personal data of the appellants, on the grounds of
Court case 200.290.520_01
The data subject requested the District Court Limburg to order their former bank to hand them all documents that contain their personal data that have been processed. The District Court considered that the dispute mainly focuses on the personal data of the data subject that are or may have been included in the so-called EVA registration (a Dutch fraud prevention system) and in the report of the security affairs department of the bank. The bank stated that it had no longer had these documents, but offered to conduct internal investigation. The District Court gave the bank the opportunity to conduct this investigation and to hand over a report to the data subject which he had not yet received. The district court rejected the data subject's request because it considered that their former bank had fulfilled its obligation to provide information by handing over the report. Furthermore, the court concluded that the data subject no longer objected the bank's position that the internal security report is no longer available. The data subject only requested a copy of their personal data concerning the EVA registration, but the court ruled that the bank had sufficiently substantiated its claim that it no longer has this data. The data subject disagreed with the ruling of the District Court and filed a request with the Court of Appeal. The data subject claimed that the bank had conducted several investigations into them, at least in 2015 and 2018. The data subject also claimed that Article 15 GDPR gives them the right to access complete copies of the entire documentation in which their personal data are or may be contained, such as underlying documents and personal notes made by others. The bank also argued in appeal that they no longer have the data which the data subject is requesting, since the relation between the data subject and the bank ended in 2012 and all data is from the period 2009-2011. The retention period of 7 years has been exceeded already by several years.
The Board of the Eindhoven University of Technology
The dispute is between the data subject and the Board of the Eindhoven University of Technology (the controller). In December 2017, the data subject requested access to his personal data pursuant to Article 35 of the Personal Data Protection Act, the predecessor of the GDPR. The controller provided an overview of all personal data concerning the data subject that it had processed. According to the data subject, however, this overview was not complete. After objecting to the decision, the case ultimately ended up in Court. However, the case was suspended to provide the controller the opportunity to carry out a further search for the data subject’s personal data. On 7 January 2021, the controller submitted an additional list containing 101 emails. According to the data subject, however, this list was provided too late, and was not sorted in a way to provide a coherent overview. Moreover, the data subject claimed that a mere overview of the emails was not enough, since it was plausible that the content of these emails contained more personal data, especially considering that opinions regarding the data subject by the authors of these emails must also be regarded as personal data. In order to be able to exercise his other rights (such as rectification, erasure, or restriction of processing) he wanted copies of these emails. First, the Court considered the data subject's claim that the overview was too vague and provided too late. It stated that the formulation of the access request determines the scope of the search to be performed by the administrative body: if the request is (very) general (and not too specific), the administrative body can facilitate the request by searching for the most commonly used personal data (such as name and address details). Because the data subject formulated his request very generally and did not specify it during the objection procedure but waited until the procedure in Court, the Court concluded that the controller’s initial search for the data subject’s personal data was sufficient, and the additional list was not provided too late. Second, the Court considered that it did not follow from Article 15(3) GDPR that the data subject had a right of to access to a copy of the actual physical/digital documents in which his personal data were processed. An overview of the processed data sufficed, if this allowed the data subject to verify the accurateness and whether the processing had been compliant with the GDPR. Because the controller mainly processed name and address details of the data subject, the Court found that an overview of these personal data was enough to comply with Article 15 GDPR. In this regard, the Court noted that it did not follow from the provided overview that it was likely that the emails contained facts and opinions regarding the data subject. Hence, the Court concluded that the controller did not have to provide copies of the respective emails. Lastly, because the data subject waited until the procedure in Court to explain that he needed the copies to potentially exercise his other rights, the controller could not include this in his search and the general overview provided sufficed to comply with the access request.
Family service
On 27 January 2021 the Belgian DPA imposed an administrative fine of 50.000 EUR on plaintiff (a company that offers gift boxes to (expectant) mothers) for not complying with the core data protection principles of processing personal data in a fair, lawful and transaparent manner. The plaintiff appealed the decision and claimed that several procedural principles have been violated in the decision of the Belgian DPA. Both parties referred to former decisions of the litigation chamber or the Court of Appeal to support their positions. However, according to the Court of Appeal, unlike the Anglo-saxon system, the Belgian legal system does not assign any binding precedent value to decisions. The most important aspects are shortly described hereafter: * Violation of rights of defence Although the litigation chamber admits that the file was not fully complete when the case was initiated, the Court stated that plaintiff did not report during the proceedings that documents were still missing afterwards, and therefore that plaintiff did not sufficiently demonstrate that its rights on this point were violated. * Violation of duty to state reasons (facts/violations) Plaintiff argues that the Belgian DPA can only base its decision on reasons whose factual existence has been duly proven. The court reminds the parties that it is not up to the court to re-examine the facts and substitute its views to the ones of the Belgian DPA. It can only verify whether the facts on which the decision is based are accurate. * Violation of duty to state reasons (legal basis) Plaintiff complained about the content and motivation of the contested decision with regard to 'consent' or 'legitmate interest' as a legal basis, but the court clearly states that the plaintiff could not sufficiently demonstrate that the consent met all the requirements (free, specific, unambiguous, informed). The Court also points to the absence of a 'balancing test' in which plaintiff had objectively considered beforeha
Schufa Holding AG
The controller is the Schufa Holding AG, a German credit rating agency. The data subject went into private insolvency after a failed business start-up. The insolvency proceedings were concluded and he was discharged from residual debt. This was published - as provided for under national law - on the online insolvency notice portal (www.insolvenzbekanntmachungen.de). § 3(1) of the German Insolvency Notification Regulation (InsoBekV) provides that such publications must be deleted no later than six months after the discontinuation of the insolvency proceedings has become unappealable. The respective entry on the data subject was deleted during this period. The controller included the information on the discharge of residual debt in its database at the time of its publication on www.insolvenzbekanntmachungen.de. However, it continued to store the information in its database after it was deleted from the aforementioned register and processed it for credit assessment purposes. The controller is a member of an association of German credit agencies. This association has given itself rules of conduct according to which the information about the discharge of residual debt is to be deleted after 3 years. The data subject received (after deletion on www.insolvenzbekanntmachungen.de) a rejection for a flat enquiry because of his bad credit rating. An action by the data subject for deletion of the entry on residual debt discharge was dismissed at first instance. The data subject appealed against this decision to the Schleswig-Holstein Higher Regional Court (OLG Schleswig-Holstein). The court ruled that the data subject was entitled to erasure under Article 17(1)(d) GDPR, as the data processing was not lawful. In any case, the requirements of Article 6 GDPR were no longer met 6 months after the discharge of residual debt had become unappealable. = The court first states that the processing cannot be based on Article 6(1)(e) GDPR. For this to be the case, the processing must be
Court case 2020/AR/1111
The complainant, an executive at an unnamed large company, had requested the removal of 12 URLs. As Google had refused to remove several of the concerned links, the complainant referred the case to the Belgian DPA. Building on the principles developed by the CJEU in the Google Spain and Google/CNIL cases, the Belgian DPA decided that Google Belgium is an establishment of Google LLC , triggering the applicability of the GDPR under article 3.1. Moreover, the DPA referred to a latter sent on 23 June 2020 by Google LLC to the Irish DPC stating it would no longer object to local (non-lead) supervisory authorities exercising local data protection jurisdiction when it comes to the scope of Google LLC's responsibilities. As a result, despite the designation of the Irish DPC as lead supervisory authority, the Belgian DPA considered it had jurisdiction because the case did not relate to Google Ireland Ltd's processing activities, but to Google LLC. Therefore, the one-stop-shop procedure did not apply. On these grounds, the Belgian DPA: * ordered Google Belgium to de-reference the concerned search results; * imposed an administrative fines of EUR600,000, based on Alphabet's (Google's mother company) annual turnover in the three previous years; and * ordered Google to clarify the ambiguity concerning the roles of the different entities involved, and in particular to clearly and precisely clarify which entity is the data controller for Belgium and for which processing activity. Google Belgium appealed the decisions before the Court of appeal on the grounds that - the order was addressed to Google Belgium which is not the controller in this case * the APD did not sufficiently motivate how it could be established that Google Belgium was linked to the activities of Google LCC as the controller; * Article 58 GDPR does not provide the possibility to impose a corrective measure on another entity than the controller (ie Google LLC); * the APD published the decision without removin
Court case W274 2237071-1
After multiple years as a member of a union the data subject decided to quit and sent the union a letter requesting termination of the membership and the deletion of personal data. Among other information the letter contained the membership number and the handwritten signature of the data subject. The union immediately terminated the membership of the data subject. In terms of the erasure request, however, the union asked for a copy of the ID of the data subject in order to progress with the deletion. Although the name and membership number were known to the union, it could not verify that also the signature on the letter was from the data subject. The union argued that although the data subject stated to be known to the union due to their long membership, the size of the union with over 1.2 million members and different administrative responsibilities did not constitute a personal relationship with the data subject. Moreover, the consequences of the data deletion would be severe compared to a resignation given that the data was necessary for a later re-entry in the union to continue the data subject’s membership. Therefore, and in accordance with Article 12(6) GDPR additional measures of identification were required. The data subject refused to provide a copy of the ID seeing a contradiction in providing even more data to achieve its deletion. The data subject argued that sending a copy of the ID does not mean any higher degree of reliability or proof of identity since it could be stolen, forged or used by another person. According to the GDPR additional information may only be requested if there are reasonable doubts about the identity of the natural person which does not allow for routine identity checks in all data subjects' rights. The BVwG ruled that the union unjustifiably requested proof of identity of the data subject and had not dealt with the latter's request for deletion. In this regard, it followed a previous position of the Austrian DPA according to
Minister of Finance
The claimant's request for access to his personal data was rejected by the Minister of Finance (the defendant), and the claimant appealed this decision. The Minister of Finance considered the request to be too general, comparing it to a 'fishing expedition.' It argued that where a controller processes a large amount of data about a data subject (such as in this case), the data subject must specify to which information or which processing activity the request relates. The defendant draws on case law, as well as Recital 63 GDPR, which at sentence seven states: "Where the controller processes a large quantity of information concerning a data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates." With regard to the statutory tasks of the tax authorities, the defendant argued that the claimant can largely view and change his personal data himself by logging in to 'my tax authority' or 'my benefits' (web portals). The claimant argues that the defendant is wrong to ask him to specify his request, because this would make it impossible for him to verify what personal data is being processed. According to the claimant, there is a possibility that personal data may be processed incorrectly, incompletely and/or unlawfully without the ability to verify and rectify. The Court declared the claimant's appeal well-founded, and annulled the Minister of Finance's decision. It held that, in general, a controller may request clarification from a data subject on an access request if it processes a large amount of data. However, this does not mean that a controller can in all cases demand clarification before performing a search. In the opinion of the Court, even where a controller processes a large amount of data, it is reasonable to expect the data controller to perform a search for the "most common" personal data in the case of a generally formulated request (e.g., on the basis of a name, address, or social security number), in the "most common" data files and/or computer systems or applications. During the hearing, the defendant had argued that to search the many systems in which the Minister of Finance processes personal data, employees must log-in separately and that only a limited number of employees are authorized for some systems, such as the Fraud Signaling Facility (FSV) system. In this regard, the Court found that the defendant had insufficiently substantiated that it would not be possible to perform a search for the most common personal data in a number of the larger applications or systems. The fact that an employee must log in per system or application, or that not every tax employee has access to a system or an application, does not justify the conclusion that this requires a disproportionate effort from the Minister of Finance, without further substantiation. Accordingly, the contested decision lacks a proper statement of reasons. The Court ordered the defendant to reach a new decision in line with its ruling. The defendant therefore now either has to: further substantiate that a search for the most common personal data is not possible; or, will have to perform a search and respond to the data subject's access request accordingly. The Court denied the claimant's request to impose a penalty on the defendant, because there is no reason to assume that the defendant will not comply with the decision.
Court case VI ZR 576/19
The controller is a life insurance company with which the data subject is insured. Even before the introduction of the GDPR, the data subject asserted a claim for information pursuant to § 34 of the old version of the German Data Protection Act (BDSG). The controller provided some information. However, the data subject was of the opinion that the information provided was incomplete. The claim subsequently asserted in court was dismissed at first instance. In the second instance, the data subject based his request for information on Article 15 GDPR, which has since entered into force. The data subject requested information on all personal data actually held by the defendant, which were subsequently specified in more detail. The court of second instance rejected the right to information, arguing that the claim had already been fully satisfied. The data subject had not specifically shown that the information already provided by the controller was incomplete and what further information he was demanding. Furthermore, the requested items were not subject to the right of access. The data subject appealed this decision to the Federal Court of Justice (Bundesgerichtshof - BGH). The appeal against the denied right of access was successful. The data subject was entitled to information to the extent claimed. The claim was not fulfilled by the controller and insofar still existed to the extent asserted. The BGH refrained from a preliminary ruling since the interpretation of the law is clearly defined by the CJEU ("acte clair"). = The court first explains under which conditions a right of access is fulfilled. This is the case if, according to the controller's declared intention, the information constitutes the information owed in its entirety. If the information is provided in this form, any inaccuracy in its content does not prevent performance. The suspicion that the information provided was incomplete or incorrect could not justify a claim to information to a greater exte
Transporting Company
The controller, a transporting company located in Germany, employed the data subject for the delivery and assembly of goods. The company filed criminal charges against the employee for aggravated fraud based on falsely overcharged travel expenses and terminated the employment contract. In order to prove their innocence, the employee requested information pursuant to Article 15 GDPR from the controller, arguing that the information was required for a proper defence within the criminal proceding. The company did not name any interest in secrecy or conflicting interests worthy of protection but refused to provide the information requested. It claimed that the access to confidential data prior to the conclusion of the criminal proceeding resulted in an abuse of rights. In a first instance, the Labour Court of Wiesbaden decided that the defendant was entitled to receive the information requested because the controller did not provide evidence its overriding confidentiality interests. The data subject filed an appeal. The Regional Labour Court of Hesse held that the company's confidentiality interests did not override those of the defendant in effective legal protection recognized by the GDPR. Although the purpose of the right to access is to enable the control of lawfulness of the processing of personal data, the pursuit of further purposes and different motives, such as the exercise of defence rights in a criminal proceeding, does not justify a refusal. At the same time, the data subject is not required to limit his request for information. The individual pieces of information listed in the application correspond to the standardized requirements of Article 15(1) GDPR and represent the right to information embodied therein. In conclusion, the court upheld the previous court's decision as the company failed to sufficiently substantiate their concerns.
A parish of the Roman Catholic Church
A parish of the Roman Catholic Church was processing the application of an individual on the right of erasure. The individual requested their personal data to be erased from the Baptismal Register, because they were no longer a member of the church. In their opinion, the collected data were no longer necessary in relation to the purposes for which they were collected. They did not give consent for their baptism or processing of his personal data. The individual also claimed that personal data entered in the register revealed religious beliefs and interfered with their religious freedom. The data collected in the register were: first and last name of individual, date of birth, date of baptism, names of parents and godparents and place of residence. The parish claimed that the legal basis for the processing of data in the register is mainly the Protection of Documents and Archives and Archival Institutions Act, which classifies the registry as archival material of outstanding national importance, therefore it is not allowed to delete any of the data contained. The parish has also made an additional entry in the register stating that the person is no longer a member of the church. The Slovenian DPA assessed if the processing is necessary for archiving purposes in the public interest in accordance with Article 89(1) GDPR and if the erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing (Article 17(3)(d) GDPR). The SA emphasised, that the aforementioned act itself stipulates that church documentary material has the characteristics of archival material. It is also subject to the principles of permanence and integrity and it provides measures which can be considered as appropriate safeguards according to 89(1) GDPR. The DPA decided that the Baptismal Register is an archive document according to the national act and that the individual cannot claim the right of erasure when the processing is needed for archiving
The municipal executive of Almelo municipality
The District Court of Overijssel ordered the Dutch municipality of Amelo to erase a 'youth assistance' file. This is the second instance in a short period of time that a lower court has ruled that the Dutch Youth Act does not authorize municipalities to keep files that are no longer needed. The court awarded the child and his mother €125 each in damages.
Court case 2021/AR/205
After a contractual relationship with the music company who owned the Facebook fanpage of the musician (including their full name), the latter wanted to get back control of this page. The DPA issued an order to transfer the page (APD/GBA - 14/2020) on the basis of data portability, but this order was annulled by the Court of Appeal. The litigation chamber of the DPA then issued a second decision (APD/GBA - 02/2021) which imposed a fine of €10,000 on the music company for not transferring the fanpage of the musician to them, after they had exercised their right to data portability and right to object. The DPA imposed this second decision based on the lack of consent from the artist to use its name and the termination of the management agreement. The defendant has now appealed this decision. According to the defendant, the DPA was incorrect to find that the lawfulness of the processing of the complainant's personal data under Article 6(1)(b) stopped on 3 November 2019, when the management agreement between the artist and the defendant was terminated. The defendant argues that the termination of the management agreement has no effects on its rights to manage the Facebook page. Its right to maintain the Facebook page was not based on the management agreement. Instead, the intellectual property rights to the musical works of the artist are relevant. As the exclusive licensee of certain musical works of the artist, the defendant is entitled to use the name and image of the performing artist of these musical works for the purpose of marketing and commercialisation of the music. These rights derive from various agreements between the company and claimant (not including the management agreement) which also involve a third party music producer. The Court of Appeal annulled the DPA's decision. It held that, despite the termination of the management agreement, the music company still had a legitimate interest to manage the fanpage. This is because, according to an artist