GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
In 2022, Norwegian, Slovenian, Greek, French, Spanish and Czech consumer protection organisation, on behalf of data subjects, lodged complaints with DPAs relating to the account creation process with Google. These complaints were then forwarded to the Irish DPA between September 2022 and March 2023 as the lead supervisory authority due to location of the controller and in accordance with the one stop shop mechanism. The complaints alleged dark patterns were used by Google in its account creation process. On 23 October 2023, the DPC decided to commence an inquiry and issued a notice of commencement. On 30 November 2023, Google objected to the commencement of the inquiry stating that the necessary information had not been provided to the DPC and to Google itself. Google posited that neither the account identifier information of each of the data subjects nor copies of the mandates of the consumer protection organisation representing the data subjects under Article 80(1) GDPR were presented to it. Google therefore questioned the DPC's jurisdiction over the matter. On 18 January 2024, Google initiated judicial review proceedings at the Irish High Court claiming that the DPC lacked jurisdiction over the inquiry as it was not in receipt of the above information. The Irish High Court sought to determine the admissibility of the complaints and did not analyse the content of the complaints. The DPC submitted to the High Court, that it has very wide discretionary powers as to when it can launch an inquiry and that no specific preconditions must be met. In response to Google’s argument that the DPC did not have the account IDs nor the mandates of the consumer protection authorities, the DPC purported that the EU law principle of mutual trust and the duty of sincere cooperation applied. As the lead supervisory authority, the DPC had to assume that the concerned supervisory authorities had forwarded the claim on the basis that the complaints were well constituted. In fact, the
A school (the controller) installed a fingerprint scanner by the entrance to the canteen. By scanning students’ fingerprints the device verified whether a meal was paid. The processing was based on their parents’ consent. The Polish DPA (UODO) initiated ex officio proceedings against the controller. During the proceedings, the controller explained they didn’t possess the students’ fingerprint samples. Such a sample was stored only within the fingerprint scanner. When a student ceased to eat in the canteen, their fingerprint stored in the fingerprint scanner was immediately deleted. After investigation, the DPA found violations of Article 5(1)(c) GDPR and Article 9(1) GDPR. The controller processed the biometric data under Article 4(14) GDPR. Nevertheless, the processing of biometric data was not based on a valid consent under Article 9(2)(a) GDPR. The students not using the fingerprint scanner were treated differently, i.e., they had to verify their identity by telling their name and contract number while entering the canteen. For this reason, the DPA claimed the consent was not freely given. Moreover, the DPA stated that processing of the biometric data violated data minimisation principle, as the controller was able to use less privacy intrusive means. Hence, the controller was fined PLN 20,000. Additionally, the DPA ordered deletion of the students’ fingerprints data and a ban on its further processing. The controller lodged an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The controller argued they didn’t process biometric data. Furthermore, the controller disagreed with the DPA that the parents’ consent was an inappropriate legal basis for the processing at stake. The court upheld the appeal. For the court the interpretation of the data minimisation principle, relied upon by the DPA, was too strict. The controller proved the relation between the fingerprints processing and its purpose. Furthermore, th
The Dutch police deployed Mobile Camera Cars (MCAs) in Rotterdam during the COVID-19 pandemic to enforce public health measures, such as social distancing and ban on gatherings. The MCAs captured 360-degree video footage of public spaces, including streets, parks, and residential areas, where individuals (including children) were identifiable. The footage was transmitted to a central monitoring room and could be forwarded to other police units. The police failed to conduct a Data Protection Impact Assessment (DPIA) before deploying the MCAs, despite the high-risk nature of the data processing. A DPIA was only conducted after the processing had already begun. The Dutch DPA imposed a fine of €50,000 on the police for violating Article 4c(1) of the Dutch Police Data Act, which requires a DPIA for high-risk processing activities. The police then apealled the decision. The District Court of The Hague ruled that the police violated Article 4c(1) of the Dutch Police Data Act by failing to conduct a DPIA before processing personal data. However, the court found that the violation was limited to one day (May 20, 2020), as the DPIA was completed before further processing occurred. The court also considered the exceptional circumstances of the COVID-19 pandemic and reduced the fine from €50,000 to €30,000, deeming the original fine disproportionate given the limited duration of the violation and the low likelihood of recurrence. The use of the MCAs has been discontinued. The Court found that an image of a person captured by a camera falls under the concept of personal data, as the person concerned can be identified through it. The fact that the people were not actually identified by the police does not alter this. The personal data were collected and forwarded to the control room in the performance of police duties, so that this constitutes processing of police data. The film images are stored chronologically and therefore have a structure in time. It is not necessary tha
The data subject underwent a rehabilitation stay in a therapy centre approved by the controller, a social insurance provider. On 27 June 2022, a district court requested the controller to disclose the location of the data subject’s rehabilitation stay in the context of enforcement proceedings. The controller provided the name and address of the therapy centre. The data subject later argued that this information revealed sensitive health data and that the disclosure was unlawful. He also claimed that the controller failed to properly assess the legality of the court’s request and should have refused or sought clarification. On 10 January 2023, the data subject filed a complaint with the DPA, alleging a violation of his right to confidentiality and unlawful processing of health data. The DPA rejected the complaint. The data subject appealed to the court, maintaining that the disclosure lacked a legal basis and exceeded what was necessary. First, the court classified the information about the rehabilitation location as health data within the meaning of Article 9 GDPR, as it allowed inferences about the data subject’s medical condition. Second, the court held that the disclosure was lawful under Article 6(1)(c) GDPR and Article 6(1)(e) GDPR because the controller acted under a legal obligation and in the exercise of a task in the public interest. The relevant legal basis derived from national provisions requiring social insurance bodies to provide information to courts. Third, the court found that Article 9(2)(g) GDPR applied, as the processing was necessary for reasons of substantial public interest based on national law. Fourth, the court emphasised that the controller complied with the principle of data minimisation under Article 5(1)(c) GDPR, as it disclosed only the specific information requested by the court and nothing beyond that. Fifth, the court rejected the argument that the controller had to assess the legality of the court order in detail. It held that th
The data subject underwent a rehabilitation stay in a therapy centre approved by the controller, a social insurance provider. On 27 June 2022, a district court requested the controller to disclose the location of the data subject’s rehabilitation stay in the context of enforcement proceedings. The controller provided the name and address of the therapy centre. The data subject later argued that this information revealed sensitive health data and that the disclosure was unlawful. He also claimed that the controller failed to properly assess the legality of the court’s request and should have refused or sought clarification. On 10 January 2023, the data subject filed a complaint with the DPA, alleging a violation of his right to confidentiality and unlawful processing of health data. The DPA rejected the complaint. The data subject appealed to the court, maintaining that the disclosure lacked a legal basis and exceeded what was necessary. First, the court classified the information about the rehabilitation location as health data within the meaning of Article 9 GDPR, as it allowed inferences about the data subject’s medical condition. Second, the court held that the disclosure was lawful under Article 6(1)(c) GDPR and Article 6(1)(e) GDPR because the controller acted under a legal obligation and in the exercise of a task in the public interest. The relevant legal basis derived from national provisions requiring social insurance bodies to provide information to courts. Third, the court found that Article 9(2)(g) GDPR applied, as the processing was necessary for reasons of substantial public interest based on national law. Fourth, the court emphasised that the controller complied with the principle of data minimisation under Article 5(1)(c) GDPR, as it disclosed only the specific information requested by the court and nothing beyond that. Fifth, the court rejected the argument that the controller had to assess the legality of the court order in detail. It held that th
On 27 June 2022, the District Court issued a request to the controller — a statutory social insurance carrier — asking for the name and address of the therapy facility where the data subject was undergoing rehabilitation. The request was part of ongoing enforcement proceedings against the data subject. The controller received this request on 11 July 2022. Relying on its statutory duty to provide administrative assistance under Section 360(1) ASVG, in conjunction with Section 129 B-KUVG and Section 89h GOG, the controller disclosed the name and address of the rehabilitation center. The duration of the data subject’s stay had already been communicated to the court separately. On 30 August 2022, the controller informed the data subject in writing about the data disclosure and explained the legal basis for this action. The controller argued that the request did not appear to exceed the court’s lawful authority and that only minimal and necessary data had been shared. Moreover, the controller maintained that if the information disclosed qualified as special category data under Article 9(1) GDPR, the disclosure was nonetheless lawful pursuant to Article 9(2)(f) GDPR, which permits processing necessary for the establishment, exercise, or defense of legal claims or judicial activities. On 10 January 2023, the data subject filed a complaint with DPA under Article 77 GDPR and Section 24 DSG. The data subject alleged a violation of the right to confidentiality under Section 1 DSG and Article 9 GDPR, asserting that the controller had unlawfully transferred sensitive health-related data to the court without a proper legal basis or consent. The data subject emphasized that the location of the rehabilitation facility could allow for inferences about health status, and that the controller failed to clarify exactly what data had been transferred despite multiple requests for access. At the request of the DPA, the controller submitted a response on 17 February 2023, reaffirming that
The controller is a tennis federation. Members of an affiliated tennis association, they automatically become a member of the tennis federation. In 2018, the controller supplied two of its sponsors (a Sporting equipment retailer and a online betting company) with the personal data of its members in exchange for money. The sponsors used the personal data for marketing purposes. After complaints were lodged by members of the controller with the Dutch DPA (Autoriteit Persoonsgegevens), itheld that the controller had violated Articles 6(1)(a) and (f) GDPR in combination with Article 5(1)(a) GDPR, as it had disclosed personal data without the consent of the data subjects or any other valid legal basis. The DPA purported that only an interest in law, with a legal basis can prove a legitimate interest under the GDPR and fined the controller €525,000. The controller brought an action against the DPA’s decision before the District Court of Amsterdam (Rechtbank Amsterdam - Rb. Amsterdam) and argued that the disclosure of the personal data of its members was justified due to a legitimate interest as per Article 6(1)(f) GDPR. The legitimate interest is comprised of creating a close connection with the data subjects and being able to offer them discounts and offers from sponsors enabling them to play tennis at a more affordable price. In general, the controller argued that any interest, as long as it is not unlawful, can constitute a legitimate interest. On the 22 September 2022, the District Court requested a preliminary ruling by the CJEU since it had doubts as to the interpretation of legitimate interests under Article 6(1)(f) GDPR and so posed the following three questions to the CJEU: 1. How should the District Court interpret legitimate interests under Article 6(1)(f) GDPR? 2. Is it to be interpreted as encompassing only interests founded in law? 3. Can any interest classify as a legitimate interest as long as it is not unlawful? More specifically: can a purely commer
The reference originates from a civil dispute between two competing pharmacists (the controller and DR) brought before a German regional court (Landgericht Dessau-Roßlau – LG Dessau-Roßlau). The controller sold non-prescription but pharmacy-only medicine through Amazon requiring customers to enter their name, delivery address and the information necessary for the individualization of the medicines. On the basis of the German legislation on unfair commercial practices, DR sought an injunction prohibiting the controller from selling pharmacy-only but non-prescription medication through Amazon unless customers could express their consent to the data processing in advance. DR alleged that the sale through Amazon was unlawful under the GDPR as it did not ask for the prior consent of the customer’s as required under Article 9(2) GDPR for the processing of sensitive data. The Regional Court and the Higher Regional Court (Oberlandesgericht Naumburg – OLG Naumburg) held that the marketing of pharmacy-only medication is contrary to paragraph 3 of a national law on unfair competition ([https://www.gesetze-im-internet.de/uwg_2004/__3.html §3 Gesetz gegen den unlauteren Wettbewerb (UWG)]). Also, without explicit consent from the customers, the processing is prohibited under the GDPR since it entails the processing of special categories of personal data. The controller then appealed the case to the Federal Court of Justice (Bundesgerichtshof - BGH) which referred to the CJEU the following preliminary questions: 1) Does the GDPR preclude national provisions which grant competitors the power to take action against the infringer for infringements of the GDPR by way of an action before the civil courts under the prohibition of unfair commercial practices? 2) Are the data of an online pharmacist’s customers in connection with online-orders for pharmacy-only (but not prescription-only) medicines health data within the meaning of Article 9(1) GDPR? 1. First question (Chapter VII
The data subject is a shareholder of a company in Bulgaria. On 14 January 2021, the company’s constitutive instrument was sent to the Registration Agency (Agentsia po vpisvaniyata), the Bulgarian authority managing the commercial register (the controller in the case at hand). This instrument, which includes the surname, first name, identification number, identity card number, date and place of issue of that card, as well as the data subject’s address and signature, was made available to the public by the Agency as submitted. On 8 July 2021, the data subject requested the controller to erase the personal data relating to her contained in that constitutive instrument. In order to comply with this request, on 26 January 2022 the controller requested the data subject to provide a copy of the instrument in which the personal data of the company members, other than the personal data required by law, were redacted. On 31 January 2022, the data subject brought an action before the Administrative Court of Dobrich (Administrativen sad Dobrich) seeking annulment of the controller’s decision and an order that the controller compensate her for the alleged non-material damage. On 5 May 2022, this court annulled the decision and ordered the controller to pay compensation to data subject in the amount of BGN 500 (approximately €255). The court ruled that, first, the damage consisted in psychological and emotional suffering, i.e. fear of possible abuse, as well as the sense of powerlessness and disappointment that her personal data could not be protected. Second, the damage stemmed also from the controller’s decision, which had led to an infringement of the right to erasure and the unlawful processing of her data contained in the constitutive instrument. The controller appealed this judgement in front of the Supreme Administrative Court (Varhoven administrativen sad), which stayed the proceedings and referred the following questions to the CJEU: # if [https://eur-lex.europa.eu/leg
The Consumer Rights Protection Centre ([https://www.ptac.gov.lv/en/about-us Patērētāju tiesību aizsardzības centrs] - PTAC) used distributed a video featuring a character imitating a well known journalist (the data subject). The campaign's aim was to make the consumers aware of risks associated with buying pre-owned cars. The PTAC didn’t obtain the data subject’s consent who opposed the making and distribution of that video. The data subject demanded PTAC to stop distributing the video and claimed compensation for the damage to his reputation. After PTAC rejected the data subjects request, the data subject initiated proceedings before District Administrative Court (Administratīvā rajona tiesa). The data subject claimed for compensation of non-material damage by an apology and payment of €2,000. The District Administrative Court found PTAC conduct was unlawful and ordered PTAC to pay €100 in compensation for non-material damage and to make a public apology. The Regional Administrative Court (Administratīvā apgabaltiesa), which heard an appeal, confirmed the finding that PTAC processed the data unlawfully, as there was no valid legal basis under Article 6 GDPR. As a result, PTAC was ordered to cease the processing. Moreover, the court also ordered the apology, under Article 14 of [https://likumi.lv/ta/id/110746-valsts-parvaldes-iestazu-nodarito-zaudejumu-atlidzinasanas-likums Law on compensation for damage caused by public authorities] (Valsts pārvaldes iestāžu nodarīto zaudējumu atlīdzināšanas likums), to be published on websites where the video was available. Nevertheless, the court dismissed the financial compensation for non-material damage. According to the court, the video was prepared to perform task in the public interest and the infringement itself was not of serious nature. Additionally, the court pointed out that the complicated nature of legal framework caused PTAC to misinterpret the applicable law. The data subject lodged an appeal before the Supreme
In 2018, Meta Platforms Ireland (“controller”) presented new Facebook terms of service to its users in the European Union, with a view of obtaining their consent. The data subject, a Facebook user, accepted the new terms of service presented by the controller. The data subject received advertisement for a female politician on the basis of the analysis that he was similar to other “customers” who “liked” her. He also regularly received advertising aimed at homosexuals and invitations to corresponding events. The data subject had publically referred to his homosexuality, but had never mentioned his sexual orientation on Facebook, nor published any sensitive data. He hadn’t authorised the controller to use the fields in his profile relating to his relationship status, employer, job title or education for the purposes of targeted advertising either. Those advertisements and invitations were not based directly on his sexual orientation or his “friends” on Facebook, but on an analysis of their particular interests. The data subject claimed that the controller recorded all data relating to him, including those obtained through third parties or plug-ins, and stored them for an indefinite period. Subsequently, during a panel discussion, the data subject referred to his sexual orientation during a speech aimed at criticizing the allegedly unlawful processing by the controller of data relating to his sexual orientation. The data subject therefore brought an action before the Landesgericht für Zivilsachen Wien (Regional Court for Civil Matters, Vienna, Austria) seeking enforcement, a declaration and an injunction concerning the allegedly unlawful processing of his personal data. His action was dismissed at first instance on 30 June 2020 and, on appeal, by the Oberlandesgericht Wien (Higher Regional Court, Vienna, Austria) on 7 December 2020. The data subject therefore lodged an appeal with the Oberster Gerichtshof (Supreme Court). The latter referred a total of four questio
A data subject initiated civil proceedings against its employer (the controller). The data subject alleged wage and trade union discrimination. In first instance, the court examining the case ordered the controller to provide the data subject with employment data regarding nine designated employees, including pay slips of the last 3 years. The controller lodged an appeal against the order with the [https://www.cours-appel.justice.fr/caen Caen Court of Appeal] (Cour d'appel de Caen), which confirmed the decision of first instance. It considered that the production of payslips was not only necessary but also the only means available to the data subject to prove the alleged discrimination. The controller then appealed the case before the Supreme Court (Cour de cassation). The Supreme Court first recognised that the right to prove a discrimination can justify the production of documents containing (third party) personal data. Weighing this right to evidence against the right to data protection, the Supreme Court stated that the production of documents containing personal data must be indispensable to the exercise of the right to evidence and proportionate to the aim pursued. Applying the principle of data minimisation, the Supreme Court held that a Court ordering the production of such evidence must, where appropriate of its own motion, limit the production of documents to what is strictly necessary to prove discrimination. By requiring the controller to produce payslips, without limiting the data to be produced to what would be strictly necessary to the proof of discrimination, the Caen Court of Appeal therefore violated the principle of minimisation. The Court therefore overturned the decision of the Caen Court of Appeal and sent the case to [https://www.cours-appel.justice.fr/rouen the Rouen Court of Appeal] (Cour d'appel de Rouen).
A data subject underwent psychiatrist examination within a court proceeding. The court assigned that task to Netherlands Institute for Forensic Psychiatry and Psychology (Nederlands Instituut voor Forensische Psychiatrie en Psychologie). During the examination, the Institute created the final report and additional documents, including the feedback report, which was not shared with the court. The feedback report contained, inter alia, the notes and comments of doctors performing patient's examination. The data subject filed an access request in reference to the feedback report with the Minister of Legal Protection. The Minister excluded the application of the GDPR and didn’t disclosed the data. The appeal proceedings, initiated by the data subject resulted in the dismissal of the Minister’s decision. The District Court of First Instance of Gelderland (Rechtbank Gelderland) examining the appeal found the GDPR applied to the case. However, the access request didn’t cover the personal data within the meaning of the GDPR. The data subject lodged an appeal with the Dutch Council of State (Raad van State; the Supreme Administrative Court). The court rejected the appeal. The court explained that under Article 2(2)(d) GDPR the GDPR doesn’t apply to processing of personal data within criminal proceedings. The feedback report was drafted as a part of criminal proceedings against the data subject. The purpose of the feedback report was to monitor the quality of the final report, disclosed to the court. For the court, the feedback report served then as the prosecution the criminal proceedings. Consequently, the GDPR, including Article 15, didn’t apply to the data subject’s request and the Minister was entitled to reject that request.
On 22 November 2019, a data subject entered into a mobile phone contract with the controller (a telecommunications company). The telecommunications company transmitted to 2 credit information agencies so called 'positive data' about the data subject, in particular information about the commissioning and execution of the contract which included data required to identify the respective person. The data subject received a leaflet regarding the transmission of data to S with a reference to a right of objection. On 19 October 2023, one of the credit information agencies published a press release stating that it would delete customer account information relating to the constoller. This decision was due to following the assessment of the Data Protection Conference of the German States (DSK) and the body of the independent German federal and state data protection supervisory authorities that the transmission and processing of data from the telecommunications sector by credit information agencies for credit scoring cannot be based on a "legitimate interest" according to Article 6(1)(a) of the GDPR and consent is required. The data subject filed a case before the court of first instance (Regional Court of Itzehoe- LG Itzehoe) requesting that the controller is ordered to compensate them for immaterial damages for the data protection breach, cease and desist transmitting their personal data to the credit information agencies and compensate them for all future damages that the plaintiff has suffered and/or will suffer as a result of the unauthorized transmission. They claim that they did not consent to having their personal data shared with the credit information agencies and that the transmission is unlawful and violated Article 6(1) and Article 5(1)(a) GDPR. They alleged it caused non-material damage in the form of loss of control over their data deriving from the transmission, impact on economic decisions and financial freedom, and suffering fear of data loss and sleep dis
The data subject filed a complaint on the 25 March 2021 against the controller, her former partner’s lawyer, with the Austrian DPA (DSB). The data subject alleged that the controller had violated her right to privacy under [https://www.jusline.at/gesetz/dsg/paragraf/artikel1zu1 paragraph 1(1) of the Austrian Data Protection Act (Datenschutzgesetz – DSG]). Since 2020, the controller and the data subject’s lawyer have been engaged in settling the divorce proceedings. The data subject’s former partner demonstrated detailed knowledge of the data subject’s extramarital affair which made her conclude that he may still have access to the video surveillance cameras in her home. The data subject’s lawyer therefore requested the controller to submit the recorded video material through a data carrier. The controller responded to this request by sending an unsecured zip file in an email containing 41 files showing the data subject engaging in explicit actions. In her complaint, the data subject argued primarily that she did not expect the transmission of such explicit content and therefore had not consented to this processing of her data. Further, she argued that the unsecured transmission of the data via email as well as the disclosure of the material to employees of the controller was unnecessary. She further argued that the transmission of the highly sensitive data should have been carried out in person, directly by her ex-partner. The DSB held that the controller processed the data to give effect to a legitimate interest under Article 6(1)(f) GDPR and that under Article 32 GDPR a data subject is not entitled to select which security measures are implemented for the processing. The data subject appealed the decision to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The court recalled, that the data subject had alleged only a breach of [https://www.jusline.at/gesetz/dsg/paragraf/artikel1zu1 paragraph 1(1) of the Austrian Data Protection Act (§1(1)
The controller is a telecommunications company. The data subject and the controller entered into a mobile phone contract. During the conclusion of the contract the controller provided the data subject with an information sheet that included information about the transfer of personal data to the Schufa, a credit rating agency. Following the closure of the contract, the controller transmitted personal data of the data subject to Schufa, such as the fact that a contract was formed, name, date of birth, address, date of the contract closure, and the contract identifier. The data subject had not explicitly consented to this transfer. [https://www.schufa.de/newsroom/schufa/daten-loeschung-telekommunikationskonten/ In a press release made public on 19 October 2023], Schufa informed the public that it was going to delete information transferred by telecommunication companies by the 20 October 2023. Schufa noted that the Conference of the German Data Protection Agencies (Datenschutzkonferenz der Länder) was of the [https://www.datenschutzkonferenz-online.de/media/dskb/20210929_top_07_beschluss_positivdaten.pdf opinion] that the transfer and processing of so called positive data (i.e. data without connection to a payment default or another violation of the contract by the data subject) required the consent of the data subject. Data concerning the conclusion of a contract would constitute such positive data. With his lawsuit, the data subject claimed, inter alia, non-material damages and a declaratory judgement that all future damages arising from the alleged GDPR infringement have to be borne by the controller. This declaratory judgement concerning damages is a standard in German law due to statutory limitation that would otherwise prevent the person claiming damages from bringing any claims after a period of three years (such as for long-term consequences of a car accident). The court held that the action for a declaratory judgement was inadmissible. The data subject faile
A data subject filed a complaint with the Polish DPA (UODO) in September claiming that an insurance company (the controller) unlawfully processed and transferred their personal data to [https://www.ufg.pl/infoportal/faces/pages_home-page?_afrLoop=11910042574273553&_afrWindowMode=0&_adf.ctrl-state=nawhddp69_4 the Insurance Guarantee Fund] (Ubezpieczeniowy Fundusz Gwarancyjny). Under the Polish law, the Insurance Guarantee Fund held register of insured entities. The DPA asked the controller and the Insurance Guarantee Fund to make statements regarding the complaint. In December, the data subject filed a statement, lamenting the DPA's alleged inactivity and prolongation of the proceedings. Also, the data subject asked for the copies of all documents sent to the DPA by the controller and the Insurance Guarantee Fund. The DPA refused to provide the data subject with such copies and continued to process the case. The data subject filed a complaint with the Voievodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie), claiming proceedings were prolonged by the DPA's inactivity. In the meantime, the DPA issued a decision. The court upheld the complaint against the DPA inactivity. According to the court, the DPA proceeded the case with protraction. There was no extenuating circumstances explaining the fact that the DPA examined the case for four months. Thus, the DPA violated Article 35 of [https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU19600300168/U/D19600168Lj.pdf administrative procedure code] (kodeks postępowania administracyjnego) according to which in principle, DPA's should render their decision in one month. The DPA lodged the cassation appeal with the Supreme Administrative Court (Naczelny Sąd Administracyjny). The DPA stood on a position that it was Article 78(2) GDPR that determined the terms to examine the case. The court upheld the DPA's appeal. Article 78(2) GDPR was applicable to the case at hand. The three months term
A data subject contacted the Norwegian DPA (Datatilsynet) asking for investigation against the Child Welfare Service in relation to its GDPR compliance. The request covered processing activities relating to data subject’s children. In response, the DPA explained that the [https://www.statsforvalteren.no/ State Administration] (Statsforvalteren) was competent to hear complaints, in particular, regarding data processing of municipality bodies. Thus, the DPA closed the case. Few months later, the data subject filed a complaint with the DPA in relation to data processing performed by the Police. Allegedly, the police breached the duty of confidentiality, disclosing a criminal report case to the Child Welfare Service. Additionally, the data subject asked the DPA to audit the municipality's data processing. The DPA informed the data subject that it is not competent to examine the processing activity's of the police. Also, again the DPA found no reasons to conduct further investigation against the Child Welfare Service, nor to audit the municipality. Hence, the DPA close the case. The data subject lodged an appeal with the Privacy Appeals Board (Personvernnemnda). The Privacy Appeals Board dismissed the appeal. According to the Privacy Appeals Board, the DPA closed the case since there was no complaint within the meaning of Article 77(1) GDPR in conjunction with Article 57 GDPR. The Privacy Appeals Board found that the mere suspicion of unlawful data processing, not yet linked to specific processing activities, did not oblige the DPA to initiate investigation. In the case at hand, the data subject asked the DPA to verify whether the Child Welfare Service violated GDPR in one of the mentioned cases. Nevertheless, the data subject’s claims were vague and general, expressing the data subject dissatisfaction with the Child Welfare Service conduct. Consequently, for the Privacy Appeals Board the data subject's request didn't constitute a complaint under Article 77(1) GDP
A data subject requested access to her data processed by the board within the [https://www.npe.no/no/ Norwegian System of Patient Injury Compensation] (Norsk pasienterstatning), a controller. The data subject was a party to proceedings before the controller and her request covered the documents of the case, including the logs data. The data subject stood on the position that the controller’s employees didn’t check the documents in depth, while examining her case. For this reason, the data subject wanted to verify who and when accessed her documents. The controller partially answered the access request. The data subject didn’t receive the information she asked for, in particular whether printouts of the documents were done, or the documents were sent by e-mail or copied and stored elsewhere. The data subject complained with the Norwegian DPA (Datatilsynet) and notified the Ministry of Public health. The data subject claimed that the controller violated Article 32 GDPR, because they didn’t secure the data properly as there was no logs control in place. Moreover, lack of access to log data deprived the data subject from scrutinising the controller’s conduct with their case. Additionally, the data subject filed an access request with the [https://www.helseklage.no National Appeals Body for the Health Service] (Nasjonalt klageorgan for helsetjenesten), which was the body competent to deal with appeals and/or complaints against the controller's decisions. The appeal body answered the request and provided the data subject with the dates and purposes of access to the data subject’s documents. Nevertheless, in reference to the Ministry of Public health letter, the appeal body didn’t disclosed the identity of employees who accessed the documents. The DPA issued a decision, stating that access request was answered. Moreover, alleged violation of Article 32 GDPR were not found. Thus, the DPA closed the case. The data subject lodged an appeal with the Privacy Appeals Boa
A journalist submitted a query on the outcome of an interrogation of two police officers to the state police department. The state police department responded that due to paragraph [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?ResultFunctionToken=5fed9deb-b9d5-47fc-901c-04b45e84e503&Position=1&SkipToDocumentPage=True&Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=05.11.2024&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=Datenschutzgesetz 1(1) of the Austrian National Data Protection Act] (Datenschutzgesetz – DSG) the provision of information was not possible. In its reasoning the state police department highlighted that the police officers in question were identifiable through publicly available video footage. It further stated that the journalist did not show an outweighing interest which would warrant the provision of information. The journalist responded to the state police department explaining that he is not interested in personal data on the police officers but merely requests to know the outcome of the interrogation which he was informed about. He further submitted that he does not intend to publish the provided information. The state police department explained that providing the information would enable drawing conclusions on whether the officers were subject to disciplinary measures which in turn affects their standing as employees and therefore their concerns their right to privacy. The journalist filed a complaint on the 6 October 2021 alleging that the state police department had not objectively balanced the interests of the police officers with the journalists request for information. The complaint was forwarded t