GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 21 October 2026 · Updated daily
Data Protection Authority - DSB (appellant and applicant)
The Public Employment Service (AMS) is a service provider under public law with its own legal personality. It is responsible for implementing the labour market policy of the federal government. In order to support workers in their (re-)integration into the labour market, it offers various services which are implemented by its counsellors. In the course of a counselling interview, counsellors have to discuss the client's wishes/expectations, their previous life history and the reasons for their unemployment. The jobseeker's chances on the labour market should also be addressed and discussed. In order to support counsellors in assessing the labour market opportunities of jobseekers, the AMS has developed a concept for calculating the labour market opportunities of jobseekers (AMAS) In concrete terms, AMS uses an algorithm to automatically calculate the probability of currently registered customers being employed for a certain number of days within a certain period in the future. For this purpose, a so called IC is calculated from the following data: age group, gender, group of States, education, health impairment, caring duties, professional group, pre-career regional labour market performance, duration of the business case at the AMS Based on the calculated IC, a classification is made into the following groups: Service clients with high labour market opportunities, care clients with low labour market opportunities, counselling clients with medium labour market opportunities. In order to ensure that the counsellors do not adopt AMAS unquestioningly, the AMS has issued guidelines and corresponding instructions as well as conducted training courses. The Data Protection Authority (DSB) initiated an ex officio investigation into the matter and concluded that the AMS was prohibited from processing data with the help of the AMAS with effect from 1 January 2021, unless there is a suitable legal basis for the data processing. This decision was then repealed by the Federal A
The municipal executive of Leiden
The appellant is a civil servant at the municipality of Leiden. He does not want the municipality to share his personal data with third parties because he fears he would lose control over his data. The municipality of Leiden outsources its HR administration to Service71; Service71 uses YouForce as the HRM tool which is offered by RAET B.V. On 15 January 2018 the municipality denied appellant’s request to delete his performance reports and assessments from YouForce. Appellant has also objected to the processing of his data by the company Mindtree in India. In the appealed decision the Court of First Instance of the Hague considered that the municipality had compelling and legitimate grounds for the data processing, which override the interests of the appellant. The Court found no evidence that the appellant’s personal data was processed in India by the employees of Mindtree. The appellant argues that: 1. The Court failed to recognize that his request should also be considered as an access request because it was not possible for him to make sure that the data processing in question was lawful. 2. The municipality has no legal basis for sharing his data with Service71 and RAET B.V. and that the data processing itself is excessive. 3. Personal data of employees, including the appellant, can be accessed by the company Mindtree in India. On the first point, the Council ruled that the appellant had already had direct access to his data via the YouForce personnel file, which means his request should not have been considered as access request. On the second point, the Council established that the appellant did not object to the performance reports and assessments as such. He also did not object to having these reports digitalized, provided that the storage would take place on the premises of the municipality, for example on the computer of his supervisor. However, appellant did not want the reports to be stored by third parties, such as Servicepunt71 and RAET B.V. It
HOIST FINANCE AB
Complainant’s debt at the predecessor of Hoist Finance was claimed by Hoist on 5 July 2006 because payment arrears. On 8 May 2006 a record of the payment irregularities was made in the Stichting Bureau Kredietregistratie (BKR register): code “A” was added to complainant’s name. On 28 June 2006 an additional code 2 was added to the registration, which mark the existence of a claimed debt. After the decision of the District Court of Groningen, the complainant agreed on a payment arrangement to pay the debt. On 1 June 2017 a code 3 was added to the complainant’s BKR registration to signify the payment agreement. The entire debt was paid on 27 June 2017. On 17 July 2020 Hoist Finance notified the complainant that it would have the 3-code removed from his BKR registration in response to the complainant’s request. On 10 September 2020 another BKR registration deletion request was submitted, but Hoist Finance rejected it on 21 September 2020. Complainant claims that codes “A” and “2” must be removed from his registration because he is disproportionately affected by it. He is in the process of buying a house and he cannot get his mortgage approved. Complainant also points out that he hasn’t had any debts for 3 years. Hoist Finance disagrees: the complainant did not submit his objection to the rejection to Court within the legal term of 6 weeks (under Article 35(2) UAVG), which makes his request inadmissible. Heist Finance also argues that the complainant does not have an urgent interest, his A2 registration should remain for the term of 5 years and that the deletion request is not sufficiently substantiated. In particular, the reason for maintaining the registration is that the complainant has had financial problems for a long time, which means that lenders still require protection in this case. The Court considered that there is doubt about whether Hoist Finance as a participant in the credit registration system makes credit registrations under Article 6(1)(c) or Article 6(1)(f) of the GDPR. If is also unclear whether the right to objection applies to BKR registrations and how Article 35(2) of the GDPR Implementation Act should be applied. The Court has mentioned three recent judgements. Because of this uncertainty the Court is referring the following questions for the Supreme Court: 1. Should the processing of concrete personal data by a credit institution, by means of an individual registration in the system of the BKR, be assessed against the provisions of Article 6(1)(c) of the GDPR, or Article 6(1)(f) of the GDPR, or both provisions? 2. Does the answer to question 1 mean that a. the person whose personal data have been recorded is not entitled to invoke the right to erasure referred to in Article 17 of the GDPR? b. the person is not entitled to a right of objection as referred to in Article 21 of the GDPR? 3. If the answer to question 2.b. means that no right of objection as referred to in Article 21 of the GDPR exists in the case of a BKR registration, does that mean that Article 35 of the GDPR Implementation Act plays no role in the legal proceedings to delete that registration?
Court case II SA/Wa 607/20
Individuals have complained to the Polish supervisory authority about the processing of their personal data by their bank without a legal basis and for marketing purposes. The applicants were customers of the bank and held personal and savings accounts with it. After some time, the customers requested the bank in writing to stop sending advertising material and bank statements to their address and withdrew their consent to the processing of their personal data by the bank, which withdrawal of consent included the quote: "the use, processing and archiving of all our personal data by the Bank". The bank informed the applicants that it would not comply with the request due to the impossibility of confirming the identity of the applicants, and also indicated the possibility of submitting the request in person at any bank office or by sending a request to that effect via the bank's helpline or Internet channel. The applicants have refused to use the communication channels indicated to them by the bank and have renewed their statement withdrawing their consent to the processing of their personal data by the bank. The bank eventually closed the customers' bank accounts and at the end sent them a monthly bank statement and later a combined bank statement, which contained information about the bank's subscription to a new structured deposit. By letter from November 2018 the bank stated that it currently processes the applicants' data in terms of first names, surnames, type of identity document, identity document number, expiry date of identity document, country of issue of identity document, PESEL identification number, date of birth, place of birth, country of birth, residence status, nationality, parents' first names, marital status, mother's maiden name, gender, residential address, correspondence address, mobile phone number, home phone number, form of employment and preferred language of contact, data on the bank's products held, CIF number (identification number assigned to the bank's customers), on the basis of Article 6(1)(f) GDPR, i.e. in the legitimate interest pursued by the bank, for the purpose of establishing, investigating or defending against possible claims by applicants. The DPA pointed out that, as of the date of closure of the clients' bank accounts, the bank should cease processing their personal data in connection with the contracts between it and the applicants, i.e. on the basis of Article 6(1)(b) GDPR. However, pursuant to Article 17(3)(e) GDPR, the right to request from the controller the immediate erasure of personal data concerning the data subject, pursuant to which the controller is obliged to erase personal data without undue delay, does not apply to the extent that the processing is necessary for the establishment, assertion or defence of claims. In the opinion of the DPA, the evidence gathered in the present proceedings has not demonstrated that the applicants have made any claim against the bank that would justify the bank's right to retain and process their personal data for evidential purposes in connection with the applicants' pursuit of this claim. The DPA issued a decision ordering the bank to delete the applicants' personal data and issued a warning to the bank for violating Articles 6(1), 12(2) and (3), and 21(3) GDPR. The administrative court dismissed the bank's appeal against the supervisory authority's decision. It indicated that it did not appear from the evidence gathered in the course of the proceedings that the applicants had made any claim against the bank which would entitle the bank to retain and process their personal data for evidential purposes in connection with their pursuit of that claim. The court emphasised that the premise of Article 6(1)(f) GDPR relates to an already existing situation where the purpose deriving from the legitimate interests pursued by the controller is the need to prove, or the need to assert or defend against, an existing claim, not to a situation where the data are processed in order to safeguard against a possible claim. Therefore, it is not permissible to process personal data as if "in advance" with the assumption that they may possibly be useful in the future and with reference to the provisions concerning the limitation of civil law claims.
Court case UTR 20/268
This matter concerns a claimant’s access request which was only partially addressed. The data subject objected to the controller’s decision and argued that his request should have included information linked to his name, his alias, and internal correspondence between the defendant and its organisational unit (TOELT) relating to the processing of his asylum application. On the one side, the complainant relied on Article 12 GDPR and Article 15(1) GDPR, and referred to a judgment of [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:GHDHA:2019:2398 the Court of Appeal in The Hague] and the Nowak judgment by the CJEU in support of his interpretation of the notion of personal data. The controller, on the other side, maintained that the definition of personal data does not include internal correspondence nor the claimant’s alias. The court turned to the definition contained in Article 4 GDPR to determine whether an alias forms part of one’s personal data and declared the controller’s understanding as incorrect. The court held that “[t]his alias was used by the claimant... and can therefore be directly linked to the claimant himself.” Hence, the scope of personal data includes someone's alias. In its assessment of whether this was also the case for internal correspondence between the controller and TOELT, the court distinguished the present matter from the case law referred to by the complainant. It further noted that a CJEU judgment relied on by the controller predates the GDPR but maintains its relevance to the interpretation of the right of access and rectification. The court considered the CJEU’s reasoning, that if the applicant’s right of access were to be extended to the legal analysis of the residence permit process, it would no longer serve the purpose of the GDPR and would ensure the applicant access to administrative documents, which the GDPR does not provide for. Thus, the internal correspondence between the controller and TOELT was excluded fr
Ministère de l'Intérieur
The applicant claimed to have personal data stored on the French National Schengen Information System (“N-SIS II database”). Under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1862 Regulation (EU) 2018/1862], the Schengen Information System is composed of, on one hand, a central system (“C-SIS”), and, on the other hand, national systems (“N-SIS”) that communicate with the central system. The system as a whole allows Member States to share alerts on persons, which include personal data, for several purposes in relation with police and judicial cooperation. The applicant exercised his rights of access and erasure against the Ministry of the Interior (“Ministère de l’intérieur”), without success. She then petitioned the French DPA (“CNIL”), with the same outcome. In this context, she seeks the annulment of the Ministry’s decision before the French Administrative Supreme Court (“Conseil d’Etat”). As it appeared during the proceedings, her demand was processed in accordance with the procedure applicable to personal data processed for national security purposes. The applicant demands that the Court reviews the lawfulness of this procedure and the decision of the Ministry. Is French procedural law applicable to the exercise of the right of access and the right to erasure of personal data processed for national safety purposes compliant with Article 15 and 23 GDPR? The Court found that the applicant’s petition had been lawfully processed and must be rejected. According to [https://www.legifrance.gouv.fr/codes/section_lc/LEGITEXT000006070933/LEGISCTA000006136462/#LEGISCTA000006136462 Article L773-1 to 773-8 of the Administrative Justice Code] (“Code de la Justice administrative”), a specific panel of judges reviews the application. The defendant has limited access to the file. If the alleged data do not exist or are lawfully processed, the application is rejected without further indication. However, if the processing is found unlawful, the applicant is informed of this outcome, and the decision specifies the reason. The Court mentions the legal reasons laid down by Article L773-8 of the Administrative justice Code: personal data are incorrect, incomplete, ambiguous or out of date or their collection, processing, transmission or storage are prohibited. The Court finds this process compliant with Article 15 GDPR, on the right of access, and Article 23 GDPR on restrictions to the rights of data subject by legislative measures. Subsequently, it finds that the Ministry of Interior has acted pursuant to this procedure and thus lawfully. Regarding the rights exercised by the data subject, the Court rejects the application on the basis of its own review of the file.
Court case 6Ob138/20t
The claimant was hospitalised in a hospital for which the defendant was responsible. After being discharged from hospital, the claimant asked the hospital to send his entire medical history to his email address free of charge, citing the GDPR. The hospital responded that the transfer of the medical history was subject to the payment of a fee. The claimant did not pay the fee and the defendant did not provide the claimant with the medical history until the conclusion of the oral proceedings at first instance. The complainant sued the hospital operator for €7,000. The court of first instance upheld the claim, holding that the GDPR regulations overrode national law on the provision of medical records. The claimant was entitled to a free initial copy of the medical history under Article 15(3) GDPR in conjunction with Article 12(3) GDPR. The Court of Appeal amended the judgment to dismiss the claim. It valued the subject matter of the decision at €5,000, but no more than €30,000, and allowed the ordinary appeal because there was no supreme court case law on a patient's right to receive a free initial copy of his medical history under the Data Protection Act. The plaintiff has appealed. Is the right to receive a first copy of medical history free of charge limited by national legislation in a way that is permissible under Article 23 GDPR, or must the principle of chargeability remain inapplicable as a national law contrary to Article 23 GDPR? The Supreme Court repealed the judgments of the lower courts and referred the case back to the court of first instance for re-examination and determination.
Municipal Executive of Zundert
The requester has submitted an access request to the Municipal Executive of Zundert. He wanted to know if the Municipal Executive was processing his data by posting messages on the Forum of the Association of Municipalities of the Netherlands (VNG) and have the content of those messages. The Municipal Executive has rejected this request because, among other reasons, the requester’s signature didn’t match the signature on the FOI request submitted by the person with the same name living at the same address as the requester. The Municipal Executive invited the requester to visit the town hall. Instead, the requester sent a letter with an explanation of why the signatures were not matching together with the copies of an ID card and a bank card. The Municipality did not accept the letter and refused to proceed with the access request. The requester sent a written objection and included a copy of his passport. The Municipal Executive rejected the objection on the basis that the requester was misusing his rights. The requester took the Municipal Executive to court which agreed with the requester and ruled that a copy of passport was enough to establish the identity of the requester. The Municipality Executive is appealing this decision. 1. Can the requester’s access requested be rejected on the basis that the requester is abusing the law? 2. Under these circumstances, is a copy of passport enough to establish the identity of the requester? On the first question, the Council has no reason to rule that the requester is misusing his right of access. Finding out what information was posted on the VNG forum is in line with the purpose of the Personal Data Protection Act and, subsequently, the GDPR. Request for compensation in case his data is processed unlawfully is also in line with the GDPR. The facts that this may be the reason for the access request and that requests like this were submitted to other municipalities, do not mean that the purpose of the request is not in line with the purposes of the GDPR. The Council ruled that the mismatch in signatures does give the Municipal Executive a valid reason to doubt the identity of the requester. Since the requester refused to visit town hall and did not submit any other documents, like a certified copy of passport, the Municipal Executive could reasonably take the view that it did not have enough information to work on the request. Therefore, it could declare the requester’s objection unfounded. The Court was wrong to rule otherwise.
Council of Mayor and Aldermen of Uithoorn
The Council of Mayor and Aldermen of Uithoorn (which exercises the executive power of the municipal government) rejected the request of appellant to erase his personal data. He attached a certified copy of his passport to this request, but it was deemed insufficient to establish the applicant's identity properly and irrefutably. The Council of Mayor and Aldermen of Uithoorn requested the appellant to visit the town hall in person. Subsequently, the appellant requested that a DigiD link be e-mailed to enable him to identify himself, but such identification via DigiD was not yet possible at the municipality. By decision of 10 February 2020, the District Court of Amsterdam dismissed the appellant’s appeal against that decision as unfounded. The Court ruled that the Council of Mayor and Aldermen of Uithoorn could reasonably request the appellant to come and identify himself personally at the town hall, in order to prevent fraud. Such requirement was not deemed disproportionate, considering the irreversibility of the erasure of data and the importance of proper identification in this respect. The appellant lodged an appeal against this decision. Does the presentation of a copy of a passport provide sufficient information to verify the data subject's identity? Recital 64 of the GDPR states that the data controller should take all reasonable steps to verify the identity of a data subject requesting access. If there is reason to doubt the identity, additional information may be requested, as follows from Article 12(6) of the GDPR. In this case, the Council of State as of the opinion that there were other possibilities for establishing identity, which raised a lower threshold. The presentation of a copy of a passport, for example, is in principle considered a reasonable measure to verify identity. The fact that it is possible to falsify the copy of a passport and that it is impossible to check whether the document that has been scanned is authentic, as argued by the Council, does not make this any different. The Council itself indicated that it did not suspect that the copy had been falsified or that there might be another person behind the request. Therefore there was no reason to ask for additional information or to impose additional requirements.
Minister of Agriculture, Nature and Food quality
Plaintiff regularly represents others in Open Government Act (Wet openbaarheid van bestuur) procedures against the Dutch Food and Consumer Product Safety Authority (hereafter: NVWA). Plaintiff requested access to the personal data processed by the NVWA with regards to these procedures, basing their claim on article 15(1) GDPR. The NVWA partially granted the request and gave plaintiff an overview of the data processed by them with regards to the aforementioned procedures and who has access to this information. Plaintiff objected to the primary decision because - among other things - the overview was incomplete. Defendant ruled that the objection justified, revoked the primary decision gave a more complete overview. Plaintiff appealed to the decision, and argues that an overview of the processed personal data is not enough. They argue that they need a copy of the specific documents in which their personal data is processed to assess the accuracy of the data in context of these documents. The court held that to comply with an article 15(1) GDPR request, it is sufficient to provide an overview of what data is processed and in which documents, if the data in question is mostly name, address and contact information. A copy of the documents itself does not need to be provided.
doctor
The complainant lodged a complaint pursuant to Article 77 of the GDPR on the grounds of infringement of the right to erasure of data pursuant to Article 17 of the GDPR and the right to object to data processing pursuant to Article 21 of the GDPR against one of Austria's leading doctor search platforms. This platform is intended to enable patients and doctors to find each other. For this purpose, it listed doctors on its website - including the complainant- with their title, name, address, speciality, telephone number and surgery hours. Directly below the presentation of this data, the platform allows anonymous third parties to rate the respective doctors according to a school grading system in various categories as well as to write a "field report" in free text. In order to be able to submit such an evaluation, it was necessary to register on the website with a freely selected user name and to provide an e-mail address and date of birth. The entry of further data was not required. The complainant claimed that the allegations in some evaluations were untrue and likely to damage his reputation and standing. The Data Protection Authority rejected the complaint on the grounds of inadmissibility. In its opinion, the recourse to the data protection authority was inadmissible because an ordinary court was already dealing with the same matter. Does the online platform violate the rights of the data subject under the GDPR? In addition, is there an obligation for the platform to delete all data which use does not comply with the provisions of the GDPR, in particular the complainant's entire doctor profile including all evaluations, and is the platform obliged to refrain from any further processing of the data? In its decision, the Administrative Court agrees with the reasoning of the Supreme Court, according to which the parallelism of legal protection options is permissible under the GDPR, which is directly applicable in Austria, and the circumstance of parallel recour
ING Bank N.V.
The data subject had a bank account at a Dutch bank, ING Bank N.V. (the controller). The account had a credit limit of €250. The data subject used internet banking to check their account and make transactions. The data subject also downloaded the controller’s mobile app. The website and the mobile app of the controller have an electronic message box that the controller uses to communicate with account holders. The controller sent multiple messages to the electronic message box of the data subject stating that the account exceeded the €250 credit limit. The controller also stated that if the balance is not replenished to a positive amount within the given deadline, the controller was obligated to report the outstanding amount to the Central Credit Registration Office (“Bureau Krediet Registratie – BKR”) in their Central Credit Information System (“Centraal Krediet Informatiesysteem – CKI”) under Article 13 of the Dutch General Regulations CKI (“Algemeen Reglement CKI – AR”). Two months later, on 10 January 2019, the controller reported the outstanding payment to the BKR. The data subject's BKR statement showed a so-called 2-code in the CKI. This special code entailed that the controller demanded payment of balance. On 18 February 2019, the data subject settled the credit limit. The data subject initiated proceedings by application at the District Court Midden-Nederland (“Rechtbank Midden-Nederland”). The data subject requested the court to rule that the controller did not notify the data subject about the the registration at the BKR, as stipulated in the GDPR. He was therefore unable to prevent the registration of his balance deficit in the CKI. The data subject argued it had never seen the messages in the electronic message box as he had not logged in for a while, and he also did not receive push notifications on the app that there were new messages. The data subject argued that the controller should have notified him by different means. The data subject there
SAMEN VEILIG MIDDEN-NEDERLAND
In December 2016 the director of the school of the complainant's son filed a report with the child protective service. In December 2017 the report was investigated and closed after the consultation with the parents of the minor. In March 2020 the complainant filed a request with Samen Veilig, asking to provide her with copies of all complete log overviews, including all names of persons who have had access to the file of her son. Samen Veilig responded that it would provide the job titles of the employees, but not their names. Must Samen Veilig provide the names of the employees who have had access to the file of the complainant's son? The Court ruled that Samen Veilig did not strike the right balance in their assessment of interests. Samen Veilig has a valid interest of restricting access to the employee information to protect their privacy, when it's necessary for the exercise of their tasks or to investigate or end a (suspected) child abuse. However, these exceptions apply only in individual cases. In this specific case, it has not been asserted that there is any reason to believe that the complainant might misuse the information that will be provided to her. The mere mentioning of job title does not suffice and limits the complainant in the possibility to check whether the access to the file was lawful. Samen Veilig must provide complainant with the requested log files, including names of employees and access time stamps.
Google LLC
The applicant asked Google to remove search results for his name, under the "right to be forgotten". Google decided not to take action on certain URLs. Two months later, the applicant submitted a new (repeated) request, which was rejected by Google for the same reasons. The applicant then lodged a complaint in front of the Dutch civil courts. In Netherlands, the instigation of legal proceedings against a data controller on the basis of the GDPR has been further regulated by the "GDPR Implementation Act". According to Article 35(2) of this local law, data subjects who wish to challenge a data controller' decision on a request made on the basis of Articles 15 to 22 of the GDPR, shall lodge their petition in front of the civil courts within six weeks of receipt of the decision. According to the Dutch case law, exceeding this six-week period leads, in principle, to inadmissibility. Consequently, Google was of the opinion that the applicant's petition was inadmissible as it was submitted later than six weeks after Google's first reply, and therefore not within the period prescribed by Article 35(2) of the GDPR Implementation Act. On the contrary, the applicant was of the opinion that his second (repeated) request started a new time-limit. According to the applicant, neither the GDPR nor its Implementation Act limits the number of applications which may be submitted. In that regard, the applicant refers to the text of Article 21(1) of the GDPR, which states that requets for removal can be made "at any time". Should the applicant's complaint be declared inadmissible for not respecting the time limits as set out to in Article 12(5) of the GDPR and Article 35(2) of the Dutch GDPR Implementation Act? According to the court, the exercise of the rights granted to the data subjects by the GDPR is not unlimited. In order to protect the legitimate interests of the data controller (not to have to decide continuously on repeated requests and be subjected to lengthy litigation, but to know, within a workable period, whether its decision can still be submitted to the courts or not), there are limits to the frequency with which data subjects can make use of their rights. Article 12(5) of the GDPR provides in this respect that a controller may refuse to comply with a data subject request where that request is manifestly unfounded or excessive, in particular because of its repetitive nature. However, Article 12(5) of the GDPR does not contain a clear answer as to when a request may be dismissed as repetitive, nor whether, as in the present case, this can be done after only one repeated request within two months of receiving the negative answer. In addition, it is not clear to the court how Article 12(5) relates to the right to object deriving from Article 21(1), which the data subjects can exercise "at any time", neither how the submission of a repeated request relates to the situation where the national law sets a period of six weeks for lodging an appeal and where such period has expired. The domestic court therefore proposes to ask the following questions to the European Court of Justice: 1) Do the words "at any time" in Article 21(1) of the GDPR mean that data subjects, following receipt of a negative decision in response to a request for removal, are entitled to submit a repeated request (when there is not any change in the facts or circumstances relating to the data subject's situation)? 2) If yes, is the data controller nevertheless allowed, under Article 12(5)(b) of the GDPR, to refuse to comply with the request because of its repetitive nature? 3) Is it relevant how much time elapsed between receipt of the controller's decision rejecting the previous request and the submission of the new (repeated) request by the data subjects? If so, how much time must have elapsed as a minimum before the data subject can submit a new (repeated) request? 4) Does it make any difference if the national law lays down a time-limit within which the data subjects must lodge their appeal against a (negative) decision of a controller, and that time limit has expired at the time when the repeated request is lodged? Is it possible, immediately after the expiry of the time-limit, to submit a new identical request to which the controller would have to reply as to the substance and against which - according to the letter of Article 35(2) - an appeal could (still) be lodged? 5) Does it make any difference if, when the original (rejected) request was made, the data subject was assisted by a professional legal adviser, such as a lawyer?
Austrian Postal Service (Plaintiff)
= The Austrian Postal Service (Österreichische Post AG) had been selling data on natural person's party "affinity for a political party" to their customers. In light of broad media coverage on this topic the Austrian Data Protection Authority (Datenschutzbehörde - DSB) started an ex-officio investigation against the Austrian Postal Service. The DSB investigated i.a the records of processing activities and the data protection impact assessment of the Austrian Postal Service. Further, it investigated records that must be maintained under § 151 Trade Regulations Act (Gewerbeordnung 1994 - GewO). = With its decision dated 22.01.2019, the DSB #held that the Austrian Postal Service had processed personal data on the "affinity for a political party" without a legal basis, as these data qualify as special categories of personal data under Article 9(1) GDPR. Their processing would require the data subjects' explicit consent under Article 9(2)(a) GDPR and § 151(4) GewO, #ordered the Austrian Postal Service to stop the processing of these data effective immediately and to erase such data within a period of two weeks (unless a derogation under Article 17(3) GDPR was applicable), #held that the Austrian Postal Service had failed to carry out a data protection impact assessment prior to 25.05.2018, #held that this data protection impact assessment was incorrect because it did not take into account that data on the "affinity for a political party" qualify as special categories of personal data, #held that the records of processing activities maintained by the Austrian Postal Service was incorrect, because it did not take into account that data on the"affinity for a political party" qualify as special categories of personal data #ordered the Austrian Postal Service to carry out a new, correct data protection impact assessment regarding the processing on data on the "affinity for a political party". = On 11.03.2019 the Austrian Postal Service filed an appeal against the DSB's d
Anonymous Mother
In September 2020, a mother requested copies of the youth files of three of her children from a private foundation that provides assistance under the Dutch Youth Act (Jeuwgdwet). About six weeks later, in October, she sent the foundation a letter stating that it had failed to respond to her request within the statutory time limit and demanding financial compensation. In early November 2020, the mother filed an administrative appeal regarding the foundation's failure to respond to her request. In the request, she referred to the Dutch General Administrative Law Act (Algemene wet bestuursrecht, AwB), the European Convention on Human Rights (ECHR), the Dutch Youth Act (Juegdwet), the GDPR and the former Dutch Data Protection Act (Wbp), which was in force before the GDPR. The court first considered the provisions on which the claim was based. The court found that the application was an access request based on Article 15 GDPR in conjunction with [https://wetten.overheid.nl/BWBR0034925/2020-07-01/#Hoofdstuk7_Paragraaf7.3_Artikel7.3.10 7.3.10 of the Youth Act]. Secondly, the court considered whether it had jurisdiction to determine the matter. The court looked at the provisions of the General Administrative Law Act (AwB). [https://wetten.overheid.nl/jci1.3:c:BWBR0005537&hoofdstuk=1&titeldeel=1.1&artikel=1:3&z=2021-07-10&g=2021-07-10 Article 1:3(1) of the AwB] defines what an administrative decision is under Dutch administrative law: a written decision on an administrative body acting on the basis of a public law. Furthermore, [https://wetten.overheid.nl/jci1.3:c:BWBR0005537&hoofdstuk=6&afdeling=6.1&artikel=6:2&z=2021-07-10&g=2021-07-10 Article 6:2(b) of the AwB] stipulates that if an administrative body fails to respond to an individual's request in a timely manner, the request is deemed to be rejected so that the applicant can file an administrative appeal. The court noted that [https://wetten.overheid.nl/jci1.3:c:BWBR0034925&hoofdstuk=7¶graaf=7.3&artikel=7.3.17&z=2020-07-01&g=2020-07-01 Article 7.3.17 of the Youth Act] was amended on January 1, 2015. This provision clarifies that private youth assistance providers are no longer considered administrative bodies. The court also referred to the already settled case law which also establishes the same thing. The court therefore found that it did not have jurisdiction to decide the case. This was because the mother had brought an administrative claim against a non-administrative body. The court could not see that the alleged violations of the ECHR would lead to a different conclusion. Finally, the court informed the mother that she could instead file her complaint as a civil dispute.
Court case 16 W 37/20
The complainant was a doctor listed on the defendant's evaluation website. In February 2020, the defendant informed the claimant that he had discovered that positive assessments, so-called false assessments, had been published on his profile and asked him to clarify this situation. The sanction for the lack of explanation was supposed to be information for users of the portal in the form of a warning on the doctor's profile that reviews had been purchased. In the correspondence exchanged, the doctor denied that there were false assessments on his profile, but the defendant found it not sufficient. The defendant then posted a warning notice on the applicant's profile. The plaintiff sought a temporary injunction to prohibit the marking of his profile with a warning sign and the display of the text of the warning. The Regional Court dismissed the application. The applicant challenged that decision and filed an immediate appelation. The Regional Court did not remedy the complaint and referred the matter to the Higher Regional Court for a decision. Does the public interest invoked by the defendant in connection with the publication of the warning outweigh the interests of the applicant? Has the defendant infringed the provisions of the GermanCivil Code in conjunction with the Article 6(1)(f) GDPR, and could not invoke the press exception for the publication of the warning? The Higher Regional Court declared the appeal to be unsuccessful. It held that the plaintiff has no right against the defendant to stop the labelling of his profile with a warning sign and the display of the warning sign.
Insurance company
This decision is an appeal of decision 24/2020, where a customer (the data subject) of an insureance company (the controller) claimed that its health data was used for a purpose to which he did not explicitly agree by the controller. The DPA upheld the complaint and stated that there was a lack of transparancy in the controller's privacy policy as it did not demontrate any legitimate interest. Therefore the controller violated Article 5(1)(a) and (2), Article 6(1), Article 12(1), Article 13(1)(b) and (c) GDPR. The DPA imposed a fine of €50.000. The controller appealed the decision of the DPA at the Court of Appeal of Brussels and raised the following pleas: # The decision was void because of a lack of reasoning regarding the legal basis for #* the processing of personal data with regard to the purposes set out in Article 4.3 of its Privacy Statement, and #* the transfers to third parties set out in Article 6 of its Privacy Statement. # It should have been able to rely on its legitimate interests for the processing of personal data for certain purposes and for transfers to third parties. # When it could not rely on its legitimate interests, it should have been able to rely on legal grounds other than the consent. # The decision violates its freedom of enterprise. # The fine was disproportionate. In response the DPA requested the Court to declare the appeal unfounded, as: # the contested decision was properly reasoned in law and in fact. It was based the information available, in view of the active duty of responsibility of the controller. The balancing of interests provided by te controller did not change this. (regarding the controllers's 1st to 4th plea) # the decision did not unlawfully restrict the controller's ability to stop the violations found. The fact that the GBA, based on the information at its disposal, presumed that it was possible to use consent as a legal basis does not affect the lawfulness of the decision. (regarding the controller's 2th and 3th p
Ministry of Education, Culture and Science
The appellant, in connection with a dispute with her son's former school, has requested the Dutch Minister of Education, Culture and Science to inspect her and her son's file. The Minister has partially granted the request for access, but wrongly did not grant access to the personal policy views of civil servants. Following a decision of the Council of State, the Minister amended its order and granted the appellant access to more documents, including to the personal policy views of civil servants, subject to the removal of the personal data of third parties. The appellant appealed, arguing that the Minister has not provided all the documents covered by her request and has therefore failed to comply adequately with the Council of State’s first ruling. Also, according to the appellant, the Minister has glossed over more than just personal data in the documents submitted. Has the Minister provided all personal data covered by the access request of the data subject? The appeal is unfounded. The Council of State ruled that the appellant did not make it plausible that the Minister did not provide all the documents covered by her request. Also, in view of Article 15(1) of the GDPR, the appellant has no right to personal data of third parties. This includes information by which a third party can be directly or indirectly identified. The Minister has therefore rightly omitted/deleted the litigated passages.
An online newspaper article from 2012 mentioned the complainant's resignation as the head of an educational institution. The article states that the complainant resigned after three months, after the employees sent a letter to the board demanding the resignation of the manager. According to the article, the employees felt that the data subject did not have the right background for the position. The then chairman of the board and acting director confirms in the article that they received such a letter, but does not comment on its content or the relationship in general. It appears from the article that the online newspaper has tried to contact A several times, but that they have not succeeded in getting a comment from her. When the educational institution went bankrupt in the spring of 2014, a different party bought the bankruptcy estate and continued the operation of the educational institution in a new company. In 2017, the data subject asked Google to delete the search term for her name which led to the newspaper article in question. One year later, Google informed the complainant that it refuses to delete the search result. Despite appeals from the complainant, Google continued to refuse moving forward with the erasure request. The complainant also contacted the editor of the online newspaper online newspaper and the media company Amedia, which owns the newspaper, and requested that the article be deleted. The editor rejected the delete request, referring to the fact that the newspaper does not in principle delete articles from its website. Amedia stated that they do not interfere with the newspaper's editorial content. Consequently. the data subject complained to the Datatilsynet and requested assistance in having the search result deleted by searching for her name in Google. The DPA made a balance of interests between the consideration of freedom of information and the public's interest in having access to the search match by name search and the complainant's r