GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 21 October 2026 · Updated daily
Complainant
The complainant objected that when he searched for his name, search results concerning him were listed on Google. The search result linked to a news/consumer report where the complainant was interviewed in his role for a company he represented. The complainant filed a complaint with Datatilsynet, which rejected his complaint based on an assessment of the balancing of interests in Google's favour. The complainant then appealed the complaint to PVN. The PVN issued a split decision, where the majority agreed with Datatilsynet that the search result should not be delisted. In particular the following elements in the decision were emphasised: * None of the personal data concerned information covered by Article 9 or 10 GDPR. * The data subject was interviewed as part of his role in the business, and not as a private individual. * It had only been two years since the interview, and the data subject had the same role in the same company. * The interview gave a correct impression at the time it was published (though the company later won in court concerning the same case). Personvernnemda did not give the data subject's subjective feelings connected to the search result a decisive influence in the outcome.
Court case 1 A 1343/19 SN
The plaintiff planned the construction of a nursing home. For this purpose, he commissioned an expert office to prepare an expert opinion on the structural and functional condition of the neighbouring building with regard to existing damage. This building is owned by the data subject. The data subject requested the plaintiff to provide a copy of the expert report that did not contain the name but the address of the data subject. The plaintiff refused to do so. The data subject then requested the assistance of the competent DPA. The DPA decided that the plaintiff was obliged to provide a copy of the expert report under Article 15(3) GDPR. The present lawsuit is directed against this decision. The court ruled that the data subject had a claim against the plaintiff under Article 15(3) GDPR. = The Administrative Court of Schwerin (VG Schwerin) first finds that the expert opinion is personal data under Article 4(1) GDPR. For this purpose, it distinguishes between factual data and personal data. With reference to ECJ case law, the court explains that the delimitation is to be based on a context-related approach. Accordingly, the personal reference could result from an element of content, purpose or result, a combination of those elements or the realisation of all elements. The content element is realized when direct or indirect information about a person is given. Indirect reference to a person is assumed if statements are made about relationships, such as a statement about the value of a property. The purpose element is given if the information makes it possible to assess, treat or influence a person. This is particularly assumed when various pieces of information are linked, for example, to recognise patterns and to create corresponding analyses based on which the interaction with a person is taking place. The result element is realised if is the possibility that the information can affect the rights and interests of a specific person, for example in the case of info
State Secretary of Justice and Security
On 9 July 2019, the data subject made a request to the Ministry of Justice and Security (the controller) to access his personal data pursuant to Article 15 GDPR. The controller decided to reject this request on 15 October 2019. During the hearing on 26 November 2019, the controller deemed the data subject's request to be formulated too generally. In response to this, the data subject specified it by requesting access to the personal data processed during the exchange of documents by the Dutch Immigration and Naturalization Service with the civil registry of the municipality and the Court of Appeal of Arnhem-Leeuwarden. The data subject specifically wanted to know which personal data had been processed in connection with the procedure before the Court of Appeal concerning an alleged sham paternity recognition of his daughter, and by which departments these data had been processed. In the contested decision from 19 December 2019, the controller considered the data subject’s objection to the decision as unfounded since his request did not concern personal data that had been processed by the Repatriation and Departure Service. Moreover, the data subject had initially failed to respond sufficiently to the request of the controller to provide additional information regarding his request to access. Consequently, there is no right to penalty payment due to the failing of a timely decision as the controller had the right to reject the data subject's application as unfounded. The data subject appealed this decision. First, the data subject was interested in the detailed documents and appendices in which his personal data had been processed. In the District Court’s opinion, the data subject had no right to this under Article 15 GDPR. This Article does not provide the right to physical or digital copies in which the personal data has been processed. This is further specified in Article 15(3) GDPR as it states that the data subject has the right to a copy of the personal da
Unknown applicant
Whenever a consumer in the Netherlands obtains credit, the debt must be registered in a central register of the foundation Bureau Krediet Registratie (BKR). The case at hand involved a person with whom the bank, Rabobank, had made a special agreement. He was to pay part of a loan and was forgiven the repayment of a remaining part of the loan. After he had paid the amount agreed with the bank, Rabobank nevertheless reported him to the BKR register with a special code. This prevented him from taking out new loans, even though he was in a good financial situation. For this reason, he took the matter to court. The claimant had two mortgages on two homes with his ex-partner. Following the couple's divorce, they were forced to sell both houses. After the houses had been sold in 2015 and 2016, a residual debt of €119,979 remained. The partners were jointly responsible for the full repayment of the debt. Almost immediately after the sale of the first home, the applicant voluntarily started repaying the remaining debt at the rate of €500 per month. In November 2015, the applicant's 7 monthly repayments totalled €3500. In February 2017, Rabobank sent a letter to the applicant. The bank had calculated that the applicant could repay €1486 per month, but that this would not enable him to repay the entire debt within 5 years. The bank offered him alternative payment models; if he accepted the special arrangement, he would not have to repay the entire remaining debt. The applicant and the bank agreed that the applicant would pay €1388.89 per month for 36 months (€50,000 in total) and that the bank would pay €62,015.83. It was also agreed that the €3500 that the applicant had already paid would be deducted from the amount that the applicant owed. The applicant fully complied with the payment plan and repaid the debt between September 2017 and May 2020. On 29 May 2020, Rabobank registered the applicant in the BKR's Central Credit Information System with a special code of 3. This c
The Executive of the Municipality of Etten-Leur ('het college van burgemeester en wethouders van de gemeente Etten-Leur')
On the 17th July 2019, the claimant submitted a request to the defendant, the Board of the Municipality of Etten-Leur ('the Board'), demanding: * the erasure of his personal data, pursuant to Article 17 GDPR, which the Board had published on the Association of Dutch Municipalities ('VNG') forum - an online forum accessible to employees at other municipalities in the Netherlands. The claimant had learned that his personal data was published on the VNG forum via an access request submitted to the the Board. * damages on account of the fact that the Board had published his personal data on the forum, in accordance with Article 82 GDPR. The claimant considered €2,500 an appropriate amount. According to the claimant, the publication of his personal data on the VNG violated the principle of proportionality. Further, the claimant argued that the Board should not have shared his personal data in this way without his permission, and that it had no legal basis for such processing under Article 6 GDPR. The Board rejected the claimant's request for erasure. In particular, it argued that the claimant's request for erasure was fundamentally unfounded, as the publication of personal data on the VNG forum was not unlawful. It was therefore not obliged to erase the personal data in line with Article 17(d), nor was it obliged to provide the claimant damages. The claimant contested this decision. The Court declared the claimant's request for erasure unfounded, and rejected the request for damages. In particular, it referred to a [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RVS:2020:898 decision by the Administrative Law Division of the Council of State ('AbRS') of 1 April 2020]. This decision highlighted that a municipal Board can be requested to disclose private information about an administrative matter falling under the Dutch Government Information (Public Access) Act ('Wob'), since the implementation of the Wob is a public law task of a municipal Board, and
Court case W214 2228164-1
Insolvency proceedings were pending against the data subject due to claims in the amount of approximately €500,000. The proceedings were suspended in July 2016 because a reorganisation plan was filed in bankruptcy. The data subject paid the payment plan in August 2016. The controller is a credit scoring agency with a trade license according to § 152 of the Austrian Trade Regulation Act (GewO). It used the aforementioned financial data in its file on the basis of which his creditworthiness was assessed. The controller rejected the data subject’s request to delete the financial data. Subsequently, the data subject filed a complaint before the Austrian DPA (DSB). The DSB decided that the right to be forgotten was not infringed and rejected the complaint. The data subject has filed an administrative appeal against this decision. The Austrian Federal Administrative Court (BVwG) ruled that the data subject was not entitled to deletion. Such a right did not arise from Article 17(1)(a), (c) or (d) GDPR. In particular, this was justified by the fact that the processing operations at issue were in compliance with the principles of Article 5 GDPR and that they could be based on the legal basis of Article 6(1)(f) GDPR. = The BVwG ruled that the principle of process limitation was respected. The assessment of creditworthiness by credit agencies is a defined and clear purpose recognised by the legal system. This can be derived from § 152 GewO. The data were also accurate and complete because the controller noted in its database that the reorganization plan filed in bankruptcy was handled immediately by the complainant. They were also fundamentally necessary and suitable in order to be able to make a prognosis about the future payment behaviour of the data subject. The court focused on the issues “storage limitation” and “data minimization” and decided that those principles were followed as well. It ruled that data on financial defaults can be processed for up to 5
Municipal executives of Roerdalen, Valkenburg aan de Geul, Vaals and Brunssum
The claimant submitted data subject access requests to the municipal executives of Roerdalen, Valkenburg aan de Geul, Vaals and Brunssum in 2020. The municipal executives responded within one month asking the claimant to identify himself and informing him that his requests cannot be processed until this is done. The claimant sent requests to expedite the decision on his requests taking the view that decisions on his requests were not taken in a timely manner. In their responses, the municipalities have referred to their earlier letters and asked the claimant once again to identify himself. The claimant filed appeals regarding the failure to make timely decisions on his GDPR access request. Has the claimant abused his rights? Should his requests be rejected by the municipalities? The Court considered that the claimant had not used his access request to exercise his rights in line with the GDPR, but rather to initiate proceedings against the municipalities in question and collect penalty payments for the delayed decisions. The claimant failed to mention the GDPR in his access request, which had caused ambiguity and delay. Furthermore, he did not identify himself and failed to respond to the several identification requests sent by the municipalities, although he was aware that this would prevent the municipalities from deciding on his request. When sending his notices of expiration, the claimant was aware that his request could not have been decided upon. Moreover, these notices were worded in such a way that they could have and have indeed caused further confusion. The claimant showed bad faith and has therefore abused his power. The appeals for the failure to make a timely decision are declared inadmissible on account of abuse of rights.
Court case W214 2216836-1
The controller is a credit scoring agency with a trade license according to § 152 of the Austrian Trade Regulation Act (GewO). It used, inter alia, two receivables against the data subject and various former addresses (8 moves in 11 years) in its file on the basis of which his creditworthiness was assessed. The receivables amounted to mid-double-digit amounts. They arose between 2016 and 2017. The data subject was in a so-called continued qualified default of payment with regard to both receivables. This means that there was a delay in payment, the first two reminders by the creditor and also a third reminder by a collection agency had been unsuccessful. In 2018, the data subject paid the receivables. The controller then entered a "positively settled" note for each of the receivables in its data system. The controller rejected the data subject’s request to delete the two receivables as well as all his former addresses. Subsequently, the data subject filed a complaint before the Austrian DPA (DSB). The DSB decided that the right to be forgotten was infringed since the controller did not follow the request. The controller has filed an administrative appeal against this decision. The Austrian Federal Administrative Court (BVwG) ruled that the data subject was not entitled to deletion. Such a right does not arise from Article 17(1)(a), (c) or (d) GDPR. In particular, this was justified by the fact that the processing operations at issue were in compliance with the principles of Article 5 GDPR and that they could be based on the legal basis of Article 6(1)(f) GDPR. = == The BVwG ruled that the principle of process limitation was respected. The assessment of creditworthiness by credit agencies is a defined and clear purpose recognised by the legal system. This can be derived from § 152 GewO. The data were also accurate and complete because the controller entered a “positively settled” remark after the two claims have been paid. They were also fundamentally necessary
NWO-I (Netherlands Foundation of Scientific Research Institutes)
NWO-I (Netherlands Foundation of Scientific Research Institutes) rejected the applicant’s subject access request. More specifically, the applicant wanted to see what personal data was sent to his former employer by email and examine the related documents. NWO-I is of the opinion that the access request is formulated too broadly and must be rejected. Moreover, NMO-I claims that it has checked its personnel files and that these do not contain any personal data of the applicant. The initial request of the applicant was indeed very broadly formulated. However, the applicant has subsequently explained that he was looking for specific emails between NWO-I and his former employer. Moreover, the applicant was able to demonstrate an email chain where he was mentioned. The Court noted that the right of access does not extend to (parts of) internal notes that contain the personal thoughts of employees of the data controller and that are exclusively intended for internal consideration. However, this exception does not apply in this case because the personal data were shared with third parties outside of NMO-I. NMO-I must provide the applicant with the complete overview of all personal data it processed via emails with third parties concerning the applicant and his former employer. NMO-I must also provide copies of underlying documents, but it can edit out the names of the senders and recipients.
Court case II SA/Wa 1899/20
The data subject filed a complaint with the supervisory authority about the unlawful processing of her personal data, in particular her image, by a sole proprietor (the controller). The complainant stated that she had been invited by the controller to take part in a music video which he was to produce. The complainant gave her written consent to the free processing of her personal data, including the use of her image by the controller. The unpaid consent to data processing in question covered the use of the complainant's personal data, i.e. her image, in connection with the production of a music video by the band [...], made for the song "[...]", which was subsequently published on the [...] portal. The complainant emphasised that she did not enter into a contract with the Controller covering her participation in the clip, nor did she receive any remuneration for appearing in the clip or for the use of her image. The complainant explained that, after her performance, she received the sum of PLN 150 as reimbursement of costs associated with the preparation for the music video and travel to the shooting set. This amount was also compensation for the time spent by the complainant on, among other things, studying the script of the music video. The Controller published the abovementioned music video on his recording studio's profile on the website [...], also making available there the complainant's personal data in the form of her first and last name. The Controller also published on the [...] and Instagram portals a photographic material with the image of the complainant, making available there also her personal data in the form of her first and last name, as well as another film material using the image of the complainant ([...]). The photographic material using the image of the applicant and her name and surname data was also made available by the applicant to other commercial portals. In January 2019 the complainant withdrew her consent to the processing of her pe
Minister van Buitenlandse Zaken, Directie Juridische Zaken
On 28 March 2019, the complainant submitted a DSAR to the Directorate of Legal Affairs of the Ministry of Foreign Affairs (The Directorate). The complainant has previously received an email from the Repatriation and Departure Service (DT&V), containing data about the claimant. According the DT&V, that data originated from the Directorate. On 29 April 2019, the Directorate rejected the complainant’s request of access to his personal data. On 17 September 2019, complainant’s objection to this decision was rejected as unfounded. The complainant appeals against this decision. The Directorate claims that the complainant’s DSAR cannot be granted because the Ministry is not controller of the affected personal data: the identity investigation in question was ordered by the Repatriation and Departure Service (DT&V). In addition, after rejecting the complainant’s objection, the Directorate claimed that the complainant was abusing his rights. The Directorate pointed out that complainant has submitted access requests to both DT&V and the Directorate, and that he wanted to use this data in other process, so access to personal data was not the end goal of the request. The Court considered that it was not obvious that the complainant’s wish to access his data was contrary to the purpose of the GDPR. The fact that these data could be used in another procedure also did not not lead the Court to believe that there was an abuse of rights. The Court also pointed to the case law, from which it follows that the access request where another procedure is concerned only constitutes an abuse of rights in special circumstances. For example, if rights or powers have been used so manifestly without reasonable purpose or for a purpose other than that for which they were granted. The Court saw no reason to rule that there had been an abuse of rights by the complainant. When deciding whether the Directorate was a controller or a processor, the Court considered the following. The Directorate failed to provide the documents (required following Article 28(3) GDPR) to demonstrate that the purposes and means of processing were determined by the DT&V and that the Directorate had no factual influence over the key elements of the personal data processing. Considering that the term “controller” must be interpreted broadly, the Court ruled that the Directorate was wrong in assuming that it was a data processor. The Court declared the appeal against the Directorate’s decision well founded.
De Staatssecretaris van Justitie en Veiligheid, Dienst Terugkeer en Vertrek
The plaintiff requested access to his personal data processed by The Repatriation and Departure Service (Dienst Terugkeer & Vertrek) on the basis Article 12 GDPR and 15 GDPR. The State Secretary of Justice, on behalf of The Repatriation and Departure Service, provided the plaintiff with an overview. The plaintiff argues not all available, underlying information was provided. He argues that the State Secretary is in therefore in breach of the GDPR. The State Secretary claims he is not in possession of the underlying information the plaintiff is refering to. Should information about people other than the data subject be included in an access request based on Article 15 GDPR? Does Article 15 GDPR require that (copies of) the original documents are provided? The District Court Rotterdam holds that the right of access is limited to personal data concerning the data subject. Furthermore, an overview of the requested data suffices. The original documents (or a copy) don't have to be provided.
Court case 1 A 1254/20 SN
The plaintiff and the participant in this case had previously been involved in another proceeding in which the applicant challenged a building permit issued to the participant. In this case the participant's representative introduced documents into the proceedings - a notarial contract with City A, to which the applicant, among others, was a party. Immediately following the conclusion of the above case, the complainant requested information from the participant on what personal data he was processing about the applicant. He set a deadline within which he expected a reply (less than one month). He did not receive an answer within the specified time limit and therefore asked the defendant (the supervisory authority) to intervene. The authority indicated that it could only take action one month after the request was made to the participant. The authority asked to be informed if the request was not complied with within one month. The applicant received the information about processing his data by the participant two weeks late. The complainant turned to the supervisory authority again, claiming that the information was incomplete. By letter of 6 January 2020, the participant's representative informed that full information had been provided to the plaintiff. Besides, only the participant's representative had access to the documents containing applicant's personal data. It had not been revealed to the participant. In June 2020, the DPA informed the claimant of its final decision. In the DPA's view, there was no infringement and therefore no further action was needed. The supervisory authority stated that the notarial contracts, to which the plaintiff was a party, had not been available to the participant at any time. They had been made available by the city of A-City exclusively to the law firm of the participant's legal representative. The plaintiff claimed that the above mentioned contracts were made available to the participant's legal representative by A-City viola
Ola Netherlands BV
The case was brought by 'private hire drivers' in the United Kingdom. They use the services of Ola through the Ola Driver App. The passengers they transport use the Ola Cabs App. The applicants are affiliated with the App Drivers & Couriers Union (ADCU). In the application, they requested to be allowed to inspect the following in a commonly used electronic form: all personal data relating to them that Ola processes, including the personal data as mentioned in the privacy statement and the accompanying documentation, the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations and the retention period for these data, the existence of automated decision making, including those referred to in Article 22, paragraph 1 and 4 GDPR provided for profiling, and at least in those cases, useful information on the underlying logic, as well as the importance of and the anticipated effects of such processing, in the event of a transfer to a third country or an international organization, the appropriate safeguards in accordance with Article 46 GDPR that Ola has in place regarding this transfer. Additionally, the applicants requested Ola to provide personal data in a structured, commonly used and machine-readable form, namely as a CSV file, or by means of an Application Programming Interface ( API), in such a way that this data can be directly transmitted to another controller. The requests were based on Article 15 paragraph 1 GDPR 1. According to the applicants, Ola did not provide full access to their personal data in response to their access requests. The privacy statement and accompanying documents show that Ola processes a large number of categories of personal data, but the applicants have not obtained access to many of these categories. Furthermore, the datasets received by them consist o
Uber
The challenge was brought by four Uber drivers, each of whom had received a separate message from Uber stating that their Uber Driver account had been deactivated because Uber had determined that they had violated the applicable contractual terms and conditions of Uber by being guilty of fraud. According to the applicants, Uber's decision was taken completely automatically without meaningful human intervention. The decision led to the immediate termination of the agreement between Uber and the applicants and to loss of income. Additionally, according to the applicants Uber violated the principle of transparency by not informing them about the underlying logic, the importance and the expected consequences of the processing for them, not informing them of the type of fraud they are accused of and by not informing them that their accounts would be blocked in the event of fraud. In addition, Uber failed to explain the grounds for the decision in intelligible words. Uber argued that it did not deactivate the accounts of the drivers solely on the basis of automated decision-making. The controller demonstrated that the decision to deactivate the account of one of the applicants was a result of an investigation which included actions taken by an Uber employee such as carrying out a personal conversation with the driver about consequences of the fraud, followed by a written confirmation. According to Uber, after a fraud signal the driver's access to the Driver app is automatically temporarily blocked until the driver has contacted an Uber employee. Access to the Driver app is reactivated as soon as the driver has made contact. Does automated termination of contract by Uber fulfil scope of automated decision making under Artcle 22 GDPR? Did Uber violate the transparency principle by failing to inform the applicants about the consequences of the procedure? The Court found that Uber's contract termination procedure does not constitute automated decision making under Articl
UBER B.V.
The 10 plaintiffs are or were engaged to drive with the app of the defendant, Uber, in the United Kingdom. The plaintiffs are part of the App for Drivers and Couriers Union (ADCU) which protects their interests as private drivers and couriers in the UK. ADCU is itself a member of International Alliance of App Transport Workers (IAATW). ADCU and IAATW want to create a database of the personal information of drivers at Uber. The plaintiffs have made requests by email or via the Uber Driver App to access the data processed by Uber concerning them. Uber provided digital files in response to these requests. The plaintiffs asked the court to review the digital files provided and to order Uber to provide explanation on a series of questions relating to the files given. The plaintiffs claimed that the files given were not complete as the data given did not contain the full information that they were entitled to. The plaintiffs also claimed that the decision was automated within the scope of Article 22 and therefore Article 15(1)(h) applies. They also claimed to have a right to data portability under Article 20(1) GDPR and that information should be provided in a structured, commonly used and machine-readable format. They claim that Uber only provided a small part of the data in the required format. The plaintiffs asked the court to order Uber to: I. a) provide, within one month of notification and in a standard electronic form, access to: (i) personal data which Uber processes, such as the "Driver’s Profile" including the records of Uber employees, "Tags", and "Report", (ii) the purposes for processing, the categories of personal data, recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations and the storage period (iii) in the event of transfer to a third country or to an international organisation; the appropriate safeguards applied by Uber pursuant to art
The municipality of Venlo
Controller is the municipality of Venlo. Data subject worked for the municipality as administrative assistant until March 2017, on a temporary basis via an employment agency. During this period, the data subject made several reports of suspected wrongdoing, one of which was investigated externally by Ernst and Young, on request of the municipality executive. The data subject was reprimanded two times in 2016, for certain remarks they had made. As of 1 April 2017, the hiring of data subject was prematurely terminated. On 10 July 2018, data subject made two requests. One access request pursuant to Article 15 GDPR, and one for the disclosure of documents under the Government Information (Public Access) Act (hereafter: Wob-request). On 3 September 2018, the data subject filed another access request. In the Wob-request, the data subject asked to provide him with copies of, or to allow him to inspect, documents that directly or indirectly refer to reports he made of suspected wrongdoing, to the whistleblower process that followed two of these reports, to the two warnings he received and to the termination of his contract of employment as of 1 April 2017. In both access requests, data subject asked to provide him with copies of all documents containing personal data relating to him, or to provide him with an overview listing all documents containing his personal data and to allow him to inspect these documents. By decision of 9 October 2018, controller dismissed both access requests, but granted the Wob-request. After data subject objected to the rejection, and this objection was dismissed, the data subject brought the action before court. In their judgment of 13 February 2020, the District Court considered that an access request pursuant to Article 15 GDPR does not provide a claim to a copy of the document in which personal data are contained, insofar as the purpose of this right can be fully satisfied in another way. Moreover, it held that this provision does not give the data subject the right to receive a copy of the documents which contain his personal data, or the right to inspect these documents. The data subject appealed to this judgement. The Council of State considered that Article 15(3) GDPR is not intended to ensure access to administrative documents. It stated that this this interpretation follows the CJEU’s logic as expressed in paragraph 46 of their [https://curia.europa.eu/juris/document/document.jsf?text=&docid=155114&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=715318 judgment of the of 17 July 2014, Y.S.] The Council stated that “although this judgment deals with the right of access in Article 12 of the Privacy Directive (95/46/EC), which has been replaced by the GDPR, the purpose of the Privacy Directive corresponds to the purpose of the GDPR, namely to ensure the protection of the applicant's right to privacy with respect to the processing of data relating to him”. The Council therefore concluded that “the obligation to provide a 'copy of the personal data' pursuant to Article 15(3) GDPR does therefore not mean that an administrative body is obliged to provide a copy of the documents in which those personal data are contained”, although it may decide to do so.
Uber B.V.
Five Uber drivers from the United Kingdom, and one from the Netherlands, argued that they had been wrongfully accused of fraudulent activity and consequently dismissed by Uber by solely algorithmic means in the sense of Article 22 GDPR. The Uber drivers were represented by the App Drivers & Couriers Union ('ADCU') and Workers Info Exchange ('WIE'). The Court issued a default judgment as Uber was not present at the hearing. It: * considered Uber's decisions regarding the finding of fraudulent activity, the violation of its terms and conditions, and the employees' consequent dismissal, unlawful; * ordered Uber to reinstate the drivers' accounts within one week of the service of the judgment; * ordered Uber to pay the drivers a penalty of €5,000 for each day or part thereof that it does not comply with the main order, up to a maximum of €50,000; * ordered Uber to pay each driver damages, totalling €100,474.
unknown (claimant)
The controller (defendant) is the biggest logistics and postal service provider in Austria. Its main business activities include the transport of letters, advertising mail, print media, and parcels. Furthermore, the defendant also conducts business as an address publisher under § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) and sells personal data for third-party marketing purposes. On 14.01.2019 the data subject (claimant) sent an access request under Article 15 GDPR to the controller on which the controller replied to on 14.02.2019. Besides data such as name and phone number the controller stated to process certain "marketing classifications" under § 151(6) GewO. These "marketing classifications" are calculated based on a a variety of socio-demographic circumstances (e.g. age, place of residence, level of education) and express a statistic probability of the data subject belonging to a certain demographic group (e.g. "do-it-yourselfer", "night owl", "person with affinity for investments"). The data subject was not content with the controller's reply and filed a lawsuit for the provision of access under Article 15 and erasure under Article 17 GDPR in connection with Article 21 GDPR. Furthermore, the data subject requested a declaratory judgment that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject. The first instance court (Regional Court Wels - LG Wels) rejected the lawsuit, holding that the controller had already fulfilled the data subject's requests. Following an appeal by the data subject, the second instance court (Higher Regional Court Linz - OLG Linz) partially overturned this decision and held that the data subject had indeed a legal interest in the claimed declaratory judgment. Consequently, it held that the controller is under the legal obligation to provide access to the data su
Court case II SA/Wa 2378/20
The President of the Office for Personal Data Protection, after conducting administrative proceedings on the processing of personal data by ClickQuickNow, issued a decision finding that the entity had violated the principle of lawfulness, fairness and transparency of personal data processing. In addition, he found that the company violated Article 7 (3) GDPR, Article 12 (2) GDPR, Article 17 (1)(b)GDPR and Article 24 (1) GDPR, by failing to implement appropriate technical and organisational measures to enable the data subject to easily and effectively withdraw consent to the processing of his personal data and to exercise his right to request the immediate erasure of his personal data (right to be forgotten). In addition, the supervisory authority found that the company processed without legal basis the data of persons who are not its customers, from whom it received requests to cease processing personal data. A fine of €47,000 was imposed on the company. The company appealed against this decision to the Provincial Administrative Court. The court dismissed the complaint and held that the controller is obliged to provide the data subject with the possibility to withdraw consent as easily as to give consent. While the controller may provide for an easier way to withdraw consent than to give consent, it may not limit this right by adopting solutions that would make it more difficult to provide a statement of withdrawal of consent than to provide a statement of consent. Asking the data subject about the reasons for withdrawing consent has no legal basis and is a deliberate action aimed at obstructing or even preventing the exercise of data subjects' rights. Such action constitutes at the same time an infringement of the principle of lawfulness, transparency and fairness of data processing. In the Court's view, the procedure applied by the company in the process of revoking consent to the processing of personal data previously obtained by the company does not meet the criteria of a simple and quick revocation of consent and constitutes a violation of the provisions of the GDPR. The court found that the company was not only failing to facilitate, but was actually making it more difficult for data subjects to exercise their right to erasure of personal data.