GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
The political party's website used Google reCaptcha and Google Fonts without consent, and continued data transfers after cookies were rejected.
The data subject filed a complaint with the Austrian DPA (DSB) on the 5 January 2021 against her ex-partner (the controller). In her complaint, she detailed that her former partner had recorded their fights in order to use these recordings in divorce proceedings. The DSB rejected the data subject’s claim as it found that the DSB was not authorized to make a decision in this case due to the principle of proportionality (“Übermaßverbot”) as it found that making a decision in this case would excessively infringe on the concerned parties rights. The data subject appealed the decision of the DSB to the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG assessed whether the controller violated the data subject’s right to privacy through making recordings to be used as evidence in divorce proceedings. In assessing whether the so called household exception in Article 2(2)(c) GDPR prevents the application of the GDPR in this case, the BVwG referred to C-25/17, in which the CJEU showed that only exclusively personal or familial actions are precluded by this provision. The court held that the disapplication of the GDPR through the household exemption is to be interpreted in a restrictive way and that the controller did not intend to use the recordings for merely personal purposes. Therefore the court held that the GDPR applied to the processing and also rejected the DSB’s claim of the limitation due to the principle of proportionality. The court accepted that the recordings intended to be used in divorce proceedings can be legitimized under Article 6(1)(f) GDPR. It highlighted that as per C-26/22 and C-64/22, it must be assessed whether the legitimate interest cannot be achieved through less invasive means. The court held that the recording was indeed necessary for the interest pursued by the controller. However, the court stated that the interest of the data subject not to be recorded in her own home, outweighed the interest of the controller to
In the main proceedings, the applicants are investment companies which hold shares indirectly through a trust company in investment funds. The applicants request the defendants, which are trust companies, to disclose the names and addresses of all their partners with indirect shareholdings in the investment funds concerned. The defendants object to such a disclosure, arguing that there are clauses prohibiting disclosure of those data to other shareholders. Moreover, they think that the only reason for which the applicants want to access this data is because they want to promote their own investment products. This matter was brought before the Local Court of Munich (Amtsgericht München – AG München). According to this Court, the case law of the Federal Court of Justice (Bundesgerichtshof – BGH) and of the Higher Regional Court of Munich (Oberlandesgericht München – OLG München) obliges the defendants to share the data, except from the case when there is an abuse of rights. However, the AG München is uncertain as to the compatibility of this case law with the GDPR and, therefore, stayed the proceedings and referred the matter to the CJEU for a preliminary ruling. In short, the Court asked the CJEU if Article 6(1)(b) and 6(1)(f) GDPR must be interpreted in the sense that a processing of personal data, consisting in disclosing the identity of all the partners with indirect shareholdings in a fund irrespective of the size of their shareholding in the capital of those funds, for the purpose of contacting them and negotiating the purchase of their shares or to coordinate with them, can be either * regarded as necessary for the performance of a contract to which the data subjects are parties, or * for the purposes of legitimate interests pursued by the controller or by a third party. First, since the referring court made a reference to an obligation stemming from national case law, the CJEU considered necessary to reformulate the questions referred as extending to the in
The data subject is a journalist, who in 2011 started receiving backlash for publishing her research on generic drugs. Many websites posted abusive, defamatory and derogatory comments about her being transexual. Google associated her name with the derogatory and defamatory comments about her and, as a result, upon googling her name, those terms came up as an auto suggestion/auto completion in the search tool. In 2012, the data subject filed a case before the court of first instance (Athens Court of First Instance) against the U.S. based Google LLC and the Greek subsidiary, Google Greece, (controllers) requesting that the said auto suggestions/auto completions and links to the said pages would be deleted since they constituted a violation of her personality and damaged her honour and reputation. The court issued interim measures and then a decision ordering the controllers to cease and desist from associating in any way her name with these words and prevent any future posting of similar content in the search results. The court found that the controllers violated her personality rights under Greek law (Civil code, Articles 57-59) and awarded her €30,000 in non material damages. Nevertheless, the auto suggestions/auto completions regarding her name and the links were not deleted and the data subject contacted Google LLC and Google Greece multiple times in an attempt to resolve this. On their behalf, the controllers instructed her to file a request on their platform and point out the certain URLs for deletion. Both parties appealed before the court of appeal (Athens Court of Appeal). The controllers claimed that the court of first instance erred in the application of the law, arguing that they were not liable for the content of the third-party posts on the Internet appearing in the search engine and that they may remove specific URLs only if they are notified (with a specific reference) by the data subject. The data subject claimed a higher compensation. The court
The controller was president of a large association of air sports clubs ("the association") and the data subject was an employee of this association. On 11 May 2023, the data subject wrote an email to 24 people, including the controller, in which the data subject addressed, among other things, his health situation and its cause. In her capacity as president, the controller sent a circular to all (almost 10,000) members of the association on 11 June 2023 stating that the data subject - despite being on sick leave since November 2022 - had made unfounded allegations against (among others) the controller. On the 6 June 2023, the controller terminated the employment relationship with the data subject. However, subsequently the controller was voted out of her position as president of the association. The data subject then continued to work for the association as it retracted the termination of employment. The data subject was affected in his daily life at the airport (the location of the association's air sports activities) by the controller's circular. In particular, when the data subject met new people from the numerous airports and clubs affiliated with the association, he was confronted with the controller's circular. The data subject demanded at least €17,000 in non-material damages from the controller for degrading him by publishing sensitive data, namely his illness and its duration. Furthermore, the data subject argued, that the controller gave the impression that the data subject was damaging the association by falsely "calling in sick". The court held, that the data subject is entitled to €10,000 compensation from the controller in accordance with Article 82(1) GDPR. The court found that the controller had violated the lawfulness principle in article 5(1) GDPR and that they had processed special categories under article 9(1) GDPR unlawfully. The court further elaborated that the controller had processed data without consent from the data subject and tha
The data subject has multiple bank accounts with the controller, a bank. On 13 November 2023, the controller asked the data subject to provide documents concerning their source of income. Since the data subject did not reply to this request, the controller closed their bank account. On 29 November 2023, the data subject filed an access request to the controller according to Article 15 GDPR. On 2 January 2024, the controller replied to the data subject, sending several data processed by it. However, the data subject considered it implausible that the controller does not process any data about the blocking of the account and that the logic behind the decision-making cannot be explained. Therefore, the data subject informed the controller about this and requested the latter not to delete their data pursuant to Article 18(1) GDPR since they intended to file a lawsuit. On 5 February 2024, the data subject initiated legal proceeding against the controller before the District Court of The Hague (Rechtbank Den Haag – Rb. Den Haag). More specifically, the data subject aimed at acquiring more information about the decision-making process about the blocking of their bank account and if this decision had been taken through automated means. The controller argued that it had already sufficiently acted on the access request and pointed out that there was no automated decision-making (ADM). Indeed, the controller explained that, even though an alert about a suspicious transaction is triggered automatically, then human intervention is required to decide whether to take further action. Furthermore, it noted that in the case at hand [https://wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=41&z=2021-07-01&g=2021-07-01 Article 41(1)(d) of the Dutch GDPR Implementation Act] (Uitvoeringswet Algemene verordening gegevensbescherming – UAVG) applies, since the purpose of this processing is preventing criminal offences pursuant to the [https://wetten.overheid.nl/jci1.3:c:BWBR0024
The data subject had a mobile contract with the controller, a telecommunications company, starting 17 April 2019. The contract included privacy notices stating that personal data, including contract initiation, execution, and completion (“positive data”), could be sent to a credit scoring agency for credit scoring, under Article 6(1)(b) and (f) GDPR. The data subject did not provide explicit consent. On 18 April 2019, the controller transmitted positive data to the credit scoring agency. On 12 October 2023, the data subject received a credit report confirming this transmission. The report showed a high credit score and contained no negative entries. The data subject claimed this transmission caused immaterial harm, including loss of control over personal data, stress, and fear of economic disadvantage. They requested compensation of €5,000, a permanent injunction against future positive data transmission without consent. The controller argued that the transmission served legitimate interests, namely fraud prevention and accurate risk assessment, and that the data had been deleted by the credit scoring agency between October and November 2023. First, the court confirmed that fraud prevention constituted a legitimate interest under Article 6(1)(f) GDPR. Alternative measures, such as staff training, only offering pre-paid contracts, or sectoral data pools, were insufficient. Second, the court carried out a proportionality assessment. The data subject’s interest in data protection and economic security did not outweigh the controller’s interest. The positive data were accurate, non-sensitive, and had been disclosed transparently in contract documents. The data subject’s score was high, and the data had been deleted already, eliminating the risk of further adverse effects. Third, the court decided the data subject did not demonstrate immaterial damage under Article 82(1) GDPR. The claimed loss of control, stress, and anxiety over future transactions were hypothetical
The Maltesian controller operates an online gambling platform. The data subject is a former customer of the controller. By way of an action by stages (Stufenklage), the data subject sued the controller first to provide him with the information under Article 15 GDPR and, on the second stage, to pay an amount that is to be determined after obtaining the claimed information from the controller. He requested the information under Article 15 GDPR to be sent as an Excel file. During the relevant timespan, the controller operated its platform under a Maltesian gambling licence, but did not have a licence in the German State (Land) of Baden-Württemberg. The data subject claims that he was not aware of this legal situation and therefore wants the money back that he paid to the controller. The court held that payment data as well as data concerning the data subject’s usage of the platform were personal data as they were clearly linked to the data subject. Otherwise, the court concluded, the controller, who deems its offering legal, wouldn’t have been able to provide its service to the data subject. Therefore, the data subject was identifiable under Article 4(1) GDPR. Under Article 15(3) GDPR, the information has to be provided in a commonly used electronic form, if the data subject makes his request by electronic means. Neither Article 15 nor Article 12 GDPR specify any certain format; but one can derive from the said norms that the data subject had a right to choose between electronic, written or other form of information. Where the legal literature concludes that data copies only have to be provided in the format they are already in without any editing, the court disagrees with this position. The court rather points to the obligation of providing the information in an electronic form under Article 15(3)(3) GDPR that includes an obligation to convert data to a commonly used electronic format. Even though there is no explicit statement in the GDPR about who can choose the c
The data subject is a former member of Jehovah's Witnesses (the controller). She left the organisation in 2020. The data that the controller has collected during the time of her membership was retained by the controller after her exit. The data subject decided to lodge a complaint against the controller claiming that, # the processing does not have a lawful basis under the GDPR and, # the controller did not allow for her exercise of right to be forgotten under Article 17 GDPR as they did not erase her data from their data base and did not return physical documents containing her personal data. The complaint was rejected by the DPA. The case was later lodged with the Administrative Court and was decided in favour of the controller. The data subject lodged an appeal with the Supreme Administrative Court. The Polish Supreme Administrative court did not revisit all the facts of the case, but only specific errors raised by the data subject. The cassation appeal was rejected in its entirety due to the fact, that, 1) the data subject did not specify which specific subsection of Article 9 GDPR is supposed to be violated and therefore is the legal basis of the appeal and, 2) the factual nature of the appeal was incorrect, as the data subject claimed Article 9 GDPR cannot be fulfilled, as she never consented for processing. The Supreme Administrative Court has expressed or affirmed the following: # Processing of historical data of a former member of a religious organisation may be lawful under Article 6(1)(f) GDPR and does not have to be based on consent Article 6(1)(a) GDPR. # As the data is sensitive within the meaning of Article 9 GDPR, such processing of historical data of a former member will be lawful under Article 9(2)(d) GDPR (the internal processing by certain organisations), subject to appropriate technical safeguards. # Data regarding former members which relate to ongoing court proceedings should be processed on the basis of Article 9(2)(f) GDPR (exercise or
On 25 November 2019, the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde – DSB) against the controller, the Austrian unemployment office (“Arbeitsmarktservice Österreich”). The data subject received unemployment payments through the controller which is a body that helps people find employment. The controller had retained data on the data subject’s transactions relating to their unemployment between 1992 and 1994. Between 1992 and 1994, the data subject had received unemployment payments and emergency aid payments. When on the 16 November 2019 the data subject again wanted to apply for unemployment payments, his account included pre-saved information on him. It included the data subject’s address and family status as well as information on transactions between 1992 and 1994. The DSB rejected the complaint on 3 February 2021, as it considered the processing of the data to be necessary for the execution of the controller’s current obligations. The data subject appealed this decision to the Federal Administrative Court (Bundesverwaltungsgericht BVwG) which accepted that the processing was unlawful but rejected the claim in relation to the right to erasure. The BVwG reasoned that an Austrian law governing the actions of the controller ([https://www.jusline.at/gesetz/amsg/paragraf/25 §25 Abs. 9 Arbeitsmarktservicegesetz – AMSG]) set out a clear limit of seven years for the retention of this kind of data (as defined in paragraph 25(1) AMSG). When the data is needed after the seven year period, the data could be requested from social insurance agencies. Therefore, the BVwG concluded that the processing had been in violation of Article 5(1)(e) GDPR since 2018. In relation to the erasure of the data, the BVwG held that the data from 1992-1994 is needed for the current unemployment payments therefore it rejected the argument that the data subject's right to erasure had been violated under Article 17 GDPR. Both the data subject and the controller ap
The applicant, A (the controller) raised a complaint for annulment of a decision issued by AZOP (the DPA). With that decision, the DPA held that the controller failed to display the video surveillance notice when posting the notice on video surveillance against Article 27 ZPOUZP. Also, it was established that the controller failed to display all relevant information and by doing so, violated Article 27(2) ZPOUZP. Also, in accordance with Article 51(1) ZPOUZP he was obliged to pay an administrative fine of €3,500. The controller argued the penalty was disproportionate, citing mitigating factors such as prior compliance, lack of harm to individuals, and immediate corrective actions. He also claimed the DPA failed to properly assess circumstances and should have issued a warning or lesser penalty instead. The court stated that under Article 51 ZPOUZP, an administrative fine of up to HRK 50,000 (€6,600) is mandatory for failing to properly mark premises as required by Article 27 ZPOUZP. Therefore, there was no legal basis for issuing only a warning or ordering the elimination of the irregularities. The court noted that the DPA has the legal authority to impose administrative fines as appropriate measures for each violation of rights. It further stated that the controller's challenge to the adequacy and choice of the fine was unnecessary and unauthorized. Furthermore, the controller argued that he had never received complaints regarding video surveillance or data processing, but the court deemed this irrelevant to his obligation to comply with legal provisions. While he emphasized his cooperation during supervision and claimed mitigating circumstances, the court found these efforts insufficient to impact the case. The controller ultimately acknowledged his failure but argued that any fine should be minimal. The court concluded that the DPA acted impartially and lawfully, basing its decision on relevant facts and evidence. The Court held that the controller's complaint
The data subject underwent medical treatment in a hospital managed by the controller following an work related injury. The controller issued a report that was used by the data subject to apply for workers’ compensation. This application was rejected by the competent authority. After that, the data subject filed a rectification and deletion request to the controller, asking the latter to modify the medical report. The controller rejected this request. On 8 December 2023, the DPA closed the case without deciding whether the controller had violated the GDPR and without considering any corrective measures. The DPA pointed out that it does not have medical or healthcare expertise and, therefore, concluded that it was not appropriate to consider the complaint pursuant to Article 57(1)(f) GDPR. Moreover, the DPA pointed out that, according to national law (see holding below) and as already stated by the Data Protection Board, the DPA does not have the power to carry out a real review of what information is correct or relevant to include in a patient record. On 27 December 2023, the data subject complained about this decision. The DPA considered the complaint and upheld its decision not to conduct further investigations. Therefore, on 2 April 2024, the case was submitted to the Data Protection Board (Personvernnemnda). The data subject believed that the DPA has not considered her case and that the DPA has a duty to check that GDPR is complied with. On the handling of the complaint by the DPA First, the Board held that the DPA has closed the case without making a decision and without considering the data subject's complaint. Pursuant to Article 57(1)(f) GDPR, the DPA shall investigate a complaint lodged by a data subject and investigate, to the extent appropriate, the subject matter of the complaint, as well as inform the complainant of the course and outcome of the investigation within a reasonable time. According to the Board, this provision does not allow for a disc
The Church of Norway had access to birth certificates of children. Some data subjects discovered that they or their children were listed as member of the Church of Norway. Although the state church system was abolished, and there was no legal basis for access to confidential information from the National Population Register, the data were processed by the Church of Norway. The data subjects lodged a complaint with the Norwegian DPA (Datatilsynet). In parallel, a Norwegian NGO, the Norwegian Humanist Association (Human-Etisk Forbund) filed similar complaints on behalf of five of its members. The DPA reprimanded the Church of Norway for a violation of Article 6(1) GDPR, Article 14(1)(d) GDPR, Article 14(2)(f) GDPR in conjunction with Article 12(1) GDPR. The DPA found the Church of Norway accessed and processed birth certificates for members' children from the National Population Register without a legal basis. Additionally, the Church of Norway didn’t provide its members with easy accessible information about the processing taking place. The data subject, including the ones represented by the Norwegian Humanist Association, appealed against the DPA decision with the Data Protection Board (Personvernnemnda). The data subjects stood on a position that the reprimand issued against the Church or Norway was inadequate and more severe correction measures needed to be applied by the DPA. The Data Protection Board dismissed the appeal. The aim of the appeal was to contest the measures applied by the DPA in reaction to the GDPR violation. However, the Board found no need to reconsider the appropriateness of the measure imposed by the DPA. The Privacy Appeals Board emphasised that the DPA’s choice of reaction towards a violation of the GDPR was not supposed to be influenced by data subject’s expectation of “revenge”. Hence, the data subject had no interest in the outcome of the case after the DPA's correction measure brought the processing into compliance with the GDPR.
The claimant is the father of a child treated at Antonius Hospital (controller). During the treatment a social worker was involved with the child and the parents who performed social work for his family. In 2015, upon his request, the father received a copy of his child's medical record from the controller but claimed that several details were missing, including details about the social worker. In May 2022, the father exercised his right to access, pursuant to Article 15 GDPR, requesting information from the controller about the social worker, log data on his child's file and involved healthcare providers registration data. The controller provided limited data, arguing further records didn’t exist or weren’t covered by the request. The father filed a case before the Court of first instance which rejected the father's request. Before the Court of Appeal, the father explained that he had requested several times to obtain access to all personal data regarding himself and his child but the controller has not provided any data outside his child's medical record and that the controller has misunderstood his request. The controller claimed that they did not need to provide an overview of the complete log data, because the father is not entitled to this data under Article 15 GDPR, because it does not concern personal data of him or his child. The court of Appeal decided to overturn the decision of the Court of first instance and grant part of the fathers requests. First, the Court of Appeal held that the controller must provide the father with a copy of the personal data it processes about himself and his child in connection with the treatment that still has in his possession, pursuant to Article 15(1) and Article 15(3) GDPR, noting that the controller interpreted the father's access request too narrowly. As far as possible, the controller must choose to provide the personal data in a way that does not infringe the rights or freedoms of its employees and of the mothe
The data subject is a client of the controller that operates two social media platforms which allow users to create their own profile and share it with friends. The controller earns money through personalised ads which are tailored to the user’s behaviour. Upon registration, the user provides the controller with their full name, their date of birth and gender. Additionally, the user is asked to enter their phone number and e-mail address. On the registration page, the new user is informed that by clicking the “Register now” button they consent to the controller’s terms and conditions and they can learn about the collection, sharing, and processing of personal data in the data guidelines of the controller. In these guidelines and in the social media portal’s help section users are being informed that the controller offers the users a personalised experience and state-of-the-art technology to ensure secure and functional operation for everyone. Additionally, the terms and conditions include detailed information about the processing of personal data and why they are necessary for personalising the contents shown to the user. The data subject accepted these terms and conditions that were subsequently changed during the time they used the platform. At first, the controller based its processing on Article 6(1)(b) GDPR. Since 5 April 2023, the controller informed the users the processing was done under Article 6(1)(f) GDPR and offered a possibility to object to the processing. Starting from 3 November 2023, the controller then introduced a consent model. It gave the data subject one of the three following options: either consent to the processing of their personal data for advertising, subscribe to the ad-free version, or leave the platform by deleting the account after possibly obtaining a copy of their data. On 8 November 2023, the data subject consented to the processing of their data for advertising purposes. The data subject filed a lawsuit with the Regional Court As
The data subject is the owner of an apartment. The controller managed the building where the data subject's apartment was located. The building heating was provided by a company (K-Company). Additionally, each apartment had an individual contract with another provider (I-Company). Also, the controller concluded an agreement with I-Company according to which I-Company prepared the consumption invoices, using for that purpose data provided by the controller. The building's apartments were equipped with meters capable to send consumption data regarding water (cold and hot) & heating to I-Company. The apartments’ owners received the individual statements of water (cold and hot) & heating. Remote meter (radio-based) monitored the consumption. The data subject's meter was not calibrated since 2018 and the data subject refused I-Company access to the apartment. Consequently, the data subject received consumption statement based on extrapolated values. The data subject requested, under Article 16 GDPR, the controller to rectify their data regarding the extrapolated consumption. The controller claimed that they didn’t prepare the consumption invoices and that the data could not be rectified by them. In response, the data subject lodged a complaint with the Austrian DPA (DSB). The DPA examined the case and found the controller didn’t transmit incorrect data used for billing the data subject. Moreover, it was the I-Company who prepared the individual invoices. Hence, the controller was unable to rectify the data. Additionally, for the DPA the controller was not a controller under Article 4(7) GDPR, as they didn’t determine the means and purposes of data processing. The data subject initiated the appeal proceedings before the Federal Administrative Court (Bundesverwaltungsgericht). The court dismissed the appeal. The court found that the Controller was a data controller for the processing at hand. It was apparent that the controller determined the means and purposes of
The parties involved are in dispute about the fact that the German tax office requires a copy of the rental agreements from the landlady (taxpayer) as part of an income tax return. The landlady is the data controller, the tenants are the data subjects and the tax office would be the recipient of the data. In the income tax returns for 2018 and 2019, the controller submitted her statements of the total rental income, depreciation, administrative and maintenance expenses for the respective property for its income from letting and leasing various properties. The tax office requested a copy of the rental agreements, service charge settlements and on claimed maintenance expenses from the controller. The controller submitted the gross and net rental income with the names of the tenants blacked out as well as the operating costs for the various apartments and documents on the maintenance expenses, but not the requested copies of the rental agreements and maintenance expenses. The data controller argued that the disclosure of the requested documents was not possible without the consent of the data subjects. Furthermore the tax office was not entitled to request the documents, as the rental agreements were not required to check the actual income. The tax office responded with a request for the rental agreements in question, referring to the duty of cooperation of the controller under the German Fiscal Code (Abgabenordnung - AO). The documents are necessary for the verification of the income data submitted by the controller. The tax office rejected an objection on its decision by the controller as unfounded and repeated the obligation to cooperate according to AO. The duty to cooperate includes in particular the complete and truthful disclosure of the facts relevant to taxation and the provision of evidence. The tax office may, at its own discretion, determine which evidence it deems necessary within the meaning of the relevant section of the AO. The tax office requires the
The Chief of a County (Starosta Powiatowy, the controller) sent a letter addressed to an individual who co-owns land with the county. The letter referred to the fee for perpetual usufruct of the land (użytkowanie wieczyste; i.e. a temporary lease of state's land by a natural or legal person, up to 99 years, in exchange for an annual fee). However, the letter was delivered to another individual (the data subject) residing at the address used by the Chief of County. The data subject lodged a complaint with the Polish DPA (UODO). The individual argued the land’s co-owner did not reside in the address. The controller explained they used the land’s co-owner's registered address and the data subject's statement was not suffice to invalidate it. The DPA dismissed the case, emphasising the controller didn’t violated the GDPR by sending the correspondence on the registered address of the land’s co-owner. Additionally, the individual’s right to data protection was not violated, as the authority didn’t process their data, but data of the land’s co-owner. The individual appealed against the DPA’s decision. The Voivodeship Administrative Court in Warsaw (Wojewódzki Sąd Administracyjny w Warszawie) upheld the DPA’s decision. Consequently, the individual brought the case before the Supreme Administrative Court (Naczelny Sąd Administracyjny). The Supreme Administrative Court dismissed the appeal. The court found no evidence of the controller’s misconduct. Also, the court confirmed the data subject was not affected. The authority acquired the address from the official register. The mere fact that the same address was shared by the data subject and the land’s co-owner didn’t amount to the GDPR violation. The court underlined that, in the case at hand, it was the land’s co-owner data processed, not the data subject's.
The website's cookie banner initially lacked a reject button on the first layer, used pre-ticked boxes, and did not allow easy withdrawal of consent, violating GDPR requirements.
The data subject visited a website, for which the controller was responsible. Upon accessing the website, the data subject was presented with a 'Consent Management Platform (CMP or cookie banner)' that, according to the data subject, violated Article 6 GDPR. The data subject filed a complaint to the Austrian DPA (DSB) on 10 August 2021. The data subject was represented by noyb. During the proceedings before the DPA: * the controller claimed to have reworked the design of the CMP and to have deleted the contested personal data of the data subject; * the data subject replied to this statement claiming that even though the violations identified in the complaint had been remedied by the new design of the CMP, certain cookies were then classified as 'strictly necessary' (within the meaning of Article 5 (3) ePrivacy Directive) and thus set as 'always active'; * in response, the controller claimed not to have processed any personal data without the data subjects consent. In addition, the controller explained that the note 'always active' for certain cookies was incorrect and had only not been removed by the time of the data subject's statement for technical reasons; * the data subject explained that the cookies had still been incorrectly classified and various non-required cookies were set without interaction with the banner. The controller claimed they had revised the cookie settings and the banner again and the contested cookies that were not deemed strictly necessary were not being set anymore if consent was not given; * the data subject stated their data was indeed processed without their consent upon visiting the website and that the processor had not explained in sufficient detail to what extent certain cookies were considered strictly necessary. The DPA dismissed the complaint. However, it also officially instructed the processor in point 3) of their decision to adapt the website and the banner in such a way to be compliant with Article 4(11) GDPR and Article 4(7