GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
A data subject applied for a renewal of a Small Public Service Vehicle (SPSV) license to drive taxis. The application included a new question inquiring about his immigration status. The data subject stated that he was a legal immigrant. The Superintendent verified whether the data subject had a criminal record from the local Garda station and requested immigration status information from the Minister for Justice. The Minister for Justice sent the Superintendent documents pertaining to the data subject, including a refusal to renew the data subject’s residence card because the Minister considered the data subject’s marriage contract to be one of convenience for the purpose of obtaining an immigration permission. The Minister for Justice had thus revoked the data subject’s permission to reside in Ireland. Based on this data indicating ‘fraudulent’ conduct, the Superintendent denied the data subject’s application to renew his SPSV license. It cited [https://www.irishstatutebook.ie/eli/2013/act/37/enacted/en/html section 10(1) of the Taxi Regulation Act 2013], “[t]he licensing authority shall not grant a license . . .unless it is satisfied that he or she is a suitable person to hold a license.” The data subject appealed the controller’s decision to the District Court on 11 January 2023. The data subject claimed that the Superintendent infringed his data protection and EU Charter rights in obtaining the immigration data, and requested an order directing the Superintendent to renew the license. The Superintendent argued that it was merely carrying out its function under the Taxi Regulation Act 2023 in assessing whether the applicant for a taxi license is a “suitable person.” It cited three provisions as a legal basis in its request to the Minister for Justice: * [https://www.irishstatutebook.ie/eli/2003/act/26/enacted/en/html Sections 8(1) and (2) of the Immigration Act 2003:] “. . .whenever so requested, an information holder shall give to another information holder s
The data subject was an employee at a company. Him and the employer (controller) had a difficult relationship, after the latter had unsuccessfully tried to let him go for not adequately fulfilling his duties. Then he decided to relocate him in another region, despite the data subject's opposition. On 4 February 22, the data subject submitted a medical certificate for incapacity to work for the period between 4 February and 4 March 2022, due to an injury suffered outside of working hours on that day. The controller suspected a feigned illness and engaged a detective agency to monitor the employee during that period. The investigators observed him in public areas and near his home, recording his physical activities such as shopping, carrying heavy objects, and working on his terrace. When the data subject became aware of it, he filed a case before the court of first instance (Regional Labor Court of Düsseldorf - AG Düsseldorf) seeking compensation for immaterial damages at least €25,000, under Article 82(1) GDPR, for the unlawful processing of his personal data and especially health data. The Labour Court dismissed the claim, holding that the controller had legitimate interest in the surveillance and it was necessary for the exercise of his rights under Article 9(2)(b) GDPR in conjunction with § 26(3) of the German Federal Data Protection Act (BDSG). On the data subject's appeal, the court (Higher Labour Court of Düsseldorf -LAG) overturned the ruling and ordered the controller to pay compensation in the amount of €1,500. Both parties appealed to the Federal Labour Court (BAG). The data subject sought a higher sum while the employer sought dismissal of all damages. The Federal Labour Court dismissed both appeals, upholding the award of €1,500 in damages under Article 82(1) GDPR. First, it found that observing and documenting the data subject’s physical condition, such as his gait and mobility, constituted processing of health data under Article 9(1) GDPR. Se
A data subject brought two cases before the Administrative Court of Cergy-Pontoise (Tribunal administratif de Cergy-Pontoise) – the controller. The data concerning these case were processed in an automated data processing system called “[https://www.legifrance.gouv.fr/loda/id/LEGITEXT000006071341/2023-12-14 Sagace]”. After both cases had been decided, the data subject requested the access to their personal data connected to those cases. The data were processed in “Sagace”. The controller rejected data subject’s request, which caused the data subject to lodge a complaint with the French DPA (CNIL). The DPA stated the access request fell within the scope of the judicial capacity of courts and as such was excluded from jurisdiction of the DPA. The data subject appealed against the CNIL's decision to the Supreme Administrative Court (Conseil d’Etat). The court rejected the appeal. The access request at hand touched upon the exercise of judicial capacity by courts. This was because the “Sagace” system, which processed the data subject’s data, was designed to allow parties of administrative court proceedings manage pending cases. Also, according to the body of evidence, the access requests were directly linked to the proceedings initiated by the data subject – they wanted to verify whether the court took into account two pleadings delivered within proceedings. Hence, under Article 55(3) GDPR the DPA had no competence to decide cases referring to court’s exercise of judicial capacity. Within French legal system, Article 45 of [https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000049563368 Law of 21 May 2024 on the security and regulation of the digital space] (Loi n° 2024-449 du 21 mai 2024 visant à sécuriser et à réguler l'espace numérique conferred the court (Conseil d’Etat) with the authority to control data processing activities by administrative courts while exercise judicial capacity.
Due to a bankruptcy the data subject was represented by a bankruptcy trustee. The bankruptcy was lifted on 7 July 2022, ending the trustee’s authorization to represent the data subject. However, on 19 July 2022, an employee of a Dutch bank, ABN AMRO Bank (the controller), shared the data subject’s personal data with the former bankruptcy trustee of the data subject on the phone. The data subject lodged a complaint with the Dutch DPA (“Autoriteit Persoonsgegevens) for an unreported data breach by the controller (i.e. sharing his personal data with his former bankruptcy trustee). The controller admitted to the DPA that the bankruptcy trustee of the data subject should only have been informed that they were no longer appointed due to the discharge from bankruptcy of the data subject, and that therefore information of the data subject would not be shared anymore with them. The DPA interpreted the data subject's complaint as not directly referring to the data breach, but to the unlawful processing of sensitive personal data. To determine whether unlawful processing took place, further investigation would have been required. However, in this case, the DPA refrained from conducting further investigation. The DPA explained why it was not investigating the data subject’s complaint, referring to the [https://www.autoriteitpersoonsgegevens.nl/een-tip-of-klacht-indienen-bij-de-ap/behandeling-van-klachten-door-de-ap criteria on their website]. On their website the DPA states that to be efficient and effective, they have to make choices and therefore use the following criteria to determine whether the complaint qualifies for further investigation: the complaint is about a violation that is still ongoing, has a broader societal interest, there are no other proceedings pending, the complaint is specifically about a GDPR issue, and the subject of the complaint has not previously been investigated by the DPA. Taking into account the data subject's complaint, the DPA held that the a
On 1 October 2020, a journalist uploaded a video to the Youtube platform (controller). The data subject complained about statements made about him and the company he was part of. The journalist did not reply to any emails about the uploaded video. On 13 November 2020, the data subject complained to the controller about the video. In response on the same day, the controller asked the data subject for providing the specific statements in corresponding time. On 7 May 2021, the data subject's lawyer requested the deletion of the video from the Youtube (controllers platform). The controller asked the data subject to provide proof of identity and information about the statements that violated personal rights. The data subject sent a power of attorney. The controller explained that more information was needed about the image, name, or other personal data. The data subject's lawyer wrote to the controller on 8 November 2021. The controller then blocked the video for the local state domain and informed the data subject by email on 16 November 2021. The controller has not provided any further steps. The data subject initiated legal proceeding, which resulted in the controller being ordered to refrain from making the contribution to the video posted by the journalist. The controller had not fulfilled its obligation to request appropriate information from the author of the video. The controller appeals against aforementioned judgement. The Higher Regional Court Nuremberg amended the judgement of the Regional Court of Nuremberg-Fürth of 14 November 2023, case no. 11 O 7452/21. The action is dismissed. The link between the data subject and the company was found to be weak, as the data subject was not in a representative position. The Higher Regional Court Nuremberg concluded that the video presented opinions rather than established facts about the data subjects professional capacity and operations in the company.
In 2022, the data subject (represented by their parents) filed an access request with the DPA. They aimed at accessing some documents concerning an investigation conducted by the DPA on a controller. According to a statement of the DPA, the data subject was not a party in this procedure. After receiving an answer only partially disclosing the file of this investigation, the data subject filed a complaint with the DPA (which, in this case, acts both as the supervisory authority and the controller), arguing that no complete copy of the documents of the file had been made available. The DPA rejected this complaint, pointing out that, on the one hand, it had disclosed the information provided for by Article 15(1) and (2) GDPR. On the other hand, the data subject does not have a right to inspect the entire file since they are not a party of this investigation proceeding. In a separate and previous legal proceeding before the BVwG, the data subject appealed this complaint. In this case, the BVwG did not upheld the complaint. It ruled that the DPA lawfully only partially disclosed the documents contained in the file and that the disclosed parts easily allow the data subject to get the information stated in Article 15(1) and (2) GDPR. As for Article 15(3) GDPR, the DPA suspended the proceedings, due to the fact that there was a preliminary ruling proceeding before the CJEU under number C-487/21. After the CJEU issued its judgement in case C-487/21, Österreichische Datenschutzbehörde and CRIF, the DPA rejected the data subject’s complaint. It argued that, in light of this judgement, Article 15(3) GDPR does not enshrine an independent right, but merely represents a modality of the provision of information. Therefore, the data subject appealed the DPA’s decision before the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). First, the court noted that in case C-487/21, Österreichische Datenschutzbehörde and CRIF, the CJEU had ruled that Article 15(3) GDPR must b
The data subject entered into a telecommunications contract with the controller who then informed a credit rating agency about the establishment of the contract and disclosed personal data in connection with the contract. The data subject claimed that he never consented to the transmission of the data. He elaborated that the controller acted unlawfully as the transmission of the data was not necessary for the performance of the contract nor justified through legitimate interest under Article 6(1)(f) GDPR. In addition, the data subject claimed appropriate damages as he believed that the transmission of data negatively affected his credit score which caused him persistent existential worries. The controller argued that the transmission of data is necessary for fraud prevention, prevention of overindebtedness and for the precise prognosis of risk of default. Further, it stated that the transmission in question was indicated to the data subject when entering into the contract and rejected the argument that the data transmitted affected the credit score of the data subject. Before the claim was filed by the data subject, the credit rating agency had already deleted the data indicating whether a telecommunications contract had been entered into. The regional court of Passau (Landesgericht Passau – LG Passau) held that the data transmission was permissible under Article 6(1)(f) GDPR as it was necessary for the legitimate interests of the controller and third parties. The transmission of data was held to be necessary for fraud prevention as it allows for more precise prognosis on overindebtedness and risk of default. Moreover, due to the narrow scope of the transmitted data the court found that the fundamental rights or freedoms of the data subject did not outweigh the controller’s interests. The court further rejected the data subject’s claim to damages under Article 82(1) GDPR. It found the argument that precisely this transmission of data negatively affected the d
The data subject and the controller entered into a telecommunications contract beginning on the 24.08.2020. Subsequently, the data subject was notified that his personal data was shared with [https://www.schufa.de/ SCHUFA Holding AG], a credit rating agency. On the 25.08.2020, the controller notified SCHUFA of the conclusion of the contract and transferred various information regarding the contractual relationship with the data subject. In August 2023, SCHUFA provided the data subject with a copy of his recorded personal data which included the information on the telecommunications contract. In September 2023, the data subject contacted the controller claiming immaterial damages under Article 82(1) GDPR. In October 2023, SCHUFA announced that they would begin to delete personal data connected with telecommunications contracts. Also in October 2023, the data subject filed a lawsuit regarding the claimed immaterial damages and argued that he suffered from the transmission of data from the controller to SCHUFA. He claimed that the transmission was unlawful and could not be justified on a legal basis as per Article 6(1)(a), (b) and (f) GDPR. He elaborated that upon reception of the information by SCHUFA he felt loss of control and great worry regarding his creditworthiness. He further claimed entitlement to injunctive relief under Article 6(1) and Article 17 GDPR. The controller claimed that there had been no violation of the GDPR as the transmission of data protects consumers from overindebtedness, enables more precise prognosis of risk of default and ensures the functionality of credit rating agencies which are essential for economic trade. The controller argued that the data subject had suffered no damage and that his reactions were engineered and far-fetched. It based this argument on the fact that each citizen usually has several telecommunications contracts so the disclosure of this information in no way sets him apart from others. Therefore, the transfer of
An individual (the controller) installed a video surveillance system (CCTV) on their premises. The CCTV filmed a forest path, which run alongside their premises. The CCTV was active upon detection of movement and stored the recording on a SD card. The path was on the property of the controller but members of a partnership had the right to use the path for forestry and hunting purposes. In principle, other strangers were not allowed to use the path. As the controller explained, the members of the partnership decided, in majority but without the controller’s agreement, to use the path for hunting purposes. The route was necessary for the hunters to access the hunting area, located on the premises of a third party (a member of the partnership). According to the controller, the CCTV was installed as a protection and to gather evidence that unauthorised people used the path. Two of the members of the partnership lodged a complaint with the Austrian DPA (DSB), claiming the controller violated their right to privacy. The DPA found the controller filmed the area to collect evidence of the path’s misuse. However, the permanent surveillance of the path to make several potential complaints was not permissible. Nevertheless, the DPA noted that the controller removed the CCTV, so there was no mandate for further actions of the DPA. The controller initiated the appeal proceedings before The Federal Administrative Court (Bundesverwaltungsgericht) against the DPA’s decision. The court upheld the appeal, overturned the DPA’s decision and rejected the complaints by the data subjects. The court examined the legitimate interest pursued by the controller. All criteria of the legitimate interest stemming from the CJEU case law was fulfilled. The controller had a legitimate interest to monitor access to the path and bring cases against people misusing it. The court found no alternative, less privacy intrusive way to supervise the path. Moreover, the legitimate interest of the con
Before the COVID-19 pandemic: The State and others were already aware that the IT systems of the GGD were outdated and would not be suitable for handling a large epidemic or pandemic. Nevertheless, no adequate measures were taken to improve the systems. March 2020: The GGD systems, HPZone, and later CoronIT, are used to combat the COVID-19 pandemic. April 2020: The European Data Protection Board (EDPB) emphasizes the importance of data protection in combating the coronavirus. January 22, 2021: GGD GHOR Nederland reports a data breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP). This is referred to in the media as the "corona data leak." January 28, 2021: GGD GHOR publishes a page with "Frequently Asked Questions and Answers about Data Theft" on their website. At this time, there is still much uncertainty about the extent of the data leak. February 2021: Following media reports about the theft and trade of personal data from GGD systems, the AP announces that it will intensify its supervision of the GGD. KPMG advises GGD GHOR to stop using HPZone as soon as possible due to inadequate data protection. The AP investigates the security of websites linked to DigiD, including www.coronatest.nl. April 2021 to January 2022: The AP investigates whether GGD GHOR and two local GGDs have taken appropriate technical and organizational measures to protect personal data in the context of testing, vaccinating, and contact tracing. The AP acknowledges that the GGDs faced a huge challenge due to the pandemic, but emphasizes that good data security is essential, especially given the large amount of sensitive data the GGD processes. The AP shares its findings with GGD GHOR and gives them until March 1, 2022, to implement improvements. November 25, 2021: Stichting ICAM is founded with the aim of taking action against (threatened) privacy violations of citizens, including claiming compensation after data breaches. April 25, 2022: GGD GHOR sends letters to 1,2
The data subject lodged a complaint against the controller, the Region Uppsala, at the Swedish DPA (“IMY”) for recording telephone conversations without a legal basis for the processing. The DPA sent an information letter to the controller, informing them of the complaint, the applicable law and closed the case without taking any further action. The DPA held that the purpose of the letter was to give the controller the opportunity to review its processing and to correct any shortcomings themselves. The DPA therefore did not see any grounds to investigate the complaint further. The data subject appealed this decision at the Administrative Court of Stockholm (“Förvaltningsrätten I Stockholm”), arguing that the DPA has the obligation to take effective measures to limit violations. As the letter stated that the DPA did not intend to take further action, there was no incentive for the controller to remedy its violations. Therefore, the data subject argued that the DPA failed to investigate the matter with due diligence, even though it was clear from the complaint that the controller did not have a legal basis for its processing. The data subject further argued that information letters are not a corrective measure under Article 58 GDPR and can therefore not constitute as an effective measure. The data subject argued that this was also not in line with the [https://www.edpb.europa.eu/our-work-tools/our-documents/internal-documents/internal-edpb-document-022021-sas-duties-relation_en EDPB internal document on Supervisory Authorities’ duties in relation to alleged GDPR infringements]. The IMY held that the appeal should be rejected as the measure was sufficient. The IMY held that if the letter did not result in the controller correcting any shortcomings, the data subject was free to submit a new complaint at a later stage. The court assessed whether IMY had grounds for not investigating the data subject’s complaint further, beyond sending an information letter to the cont
The case is part of a broader dispute between a company and some of its employees. During a meeting between the managers of the company and the employees, one of the employees (the controller) recorded the ongoing conversation, without the managers being aware of this. Some years later, another employee used this recording during a labour trial as evidence. Therefore, the managers (the data subjects in this case) filed a complaint with the Italian DPA (Garante per la protezione dei dati personali). The DPA rejected this complaint, arguing that the processing at hand had the only purpose of proving the employee's statements during the trial. The data subjects appealed the DPA's decision before the Court of Venice (Tribunale di Venezia). Contrary to the DPA, the court upheld the data subjects' claims, ruling that the processing was unlawful and fining the controller €5,000. The court gave the following reasons: # when the recording was made, there was no defence needs but only some "organisational problems" in the company; # the trial in which the recording was used took place years later; # the household exemption provided for by Article 2(2)(c) GDPR does not apply. The controller appealed this decision before the Italian Supreme Court (Corte di cassazione). First, the court pointed out that the recording occurred in 2016, i.e. a time when the GDPR was not yet in force. The court recalled that A[https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196!vig=2016-11-14~art24 rticle 24(f) of the then-applicable Italian Data Protection Code] stated that the data subject's consent was not needed when the processing was necessary "to assert or defend a legal claim, provided that the data are processed exclusively for such purposes and for no longer than is necessary for the pursuit of those purposes". On this point, the court noted that, according to national case law, this rule applies not only during the trial on itself, but also regarding
A data subject was under guardianship, duly appointed under German law ([https://www.gesetze-im-internet.de/bgb/ Article 1896 and 1897 BGB]). The guardian was a lawyer acting in a professional manner and belonging to the personal circle of the data subject. They, performed their duties for a certain time and was later replaced by another person. The data subject referred to the Local Court of Hannover (Amtsgericht Hannover – AG Hannover) for legal aid to access the data collected by the guardian when performing their duties. The AG Hannover rejected the application of the data subject. According to the court, since the guardian performed their duties in context of their professional activity it was not a data controller within the meaning of Article 4(7) GDPR. Hence, they were not obliged to respond to access request under Article 15 GDPR. Also, the court emphasised that the guardian was a legal representative of data subject under German law. That meant the guardian could process the personal data on behalf of data subject. The data subject appealed against the decision of the AG Hannover to the Regional Court of Hannover (Landgericht Hannover - LG Hannover). The appeal raised the court’s doubts whether a professional guardian was covered by the definition of controller in Article 4(7) GDPR. Also, the court deliberated about the problem of the guardian being a part of the data subject’s personal circle. As a result, LG Hannover decided to refer the following preliminary questions to the CJEU: # Is a legally appointed guardian who performs that activity in a professional capacity a controller within the meaning of Article 4(7) GDPR? # Is he or she required to provide information in accordance with Article 15 GDPR?’ The CJEU answered both question positively. The CJEU found the guardian as such to be a controller within the meaning of Article 4(7) GDPR. Firstly, the CJEU excluded the application of Article 2(2)(c) GDPR to guardian’s activity, namely the exception
Meta Platforms Ireland Ltd (the controller) is the provider of the social network Facebook in the EU. Facebook contains a section called “App Centre”, that allows users to access free games provided by third parties. While accessing these games, it is indicated that some personal data is collected by the third party providing the game. The user was also informed that, by using the applications concerned, they accepted the general conditions of those applications and their data protection policy. The Federal Union of Consumer Organisations and Associations (Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband eV), a German consumer association, brought an action before the Regional Court of Berlin (Landesgericht Berlin – LG Berlin), claiming that the controller failed to comply with the legal requirements to obtain valid consent from the user under the GDPR. The action was brought independently of a specific infringement of a data subject’s GDPR rights and without a mandate from a specific data subject. The Federal Union based its standing on national law allowing a consumer protection organization to bring proceedings on the basis of the infringement of the prohibition of unfair commercial practices (or a breach of a consumer protection law or the prohibition of the use of invalid general terms and conditions). In this case, the Federal Union deemed that the controller had breached the above cited law by having violated data protection law. The LG Berlin upheld the action; the controller appealed this decision before the Higher Regional Court of Berlin (Kammergericht Berlin – KG Berlin). This appeal was dismissed and the controller further appealed the judgement of KG Berlin before the Federal Court of Justice (Bundesgerichtshof – BGH). The BGH had doubts as to the admissibility of the action brought by the Federal Union. Therefore, it referred a question to the CJEU for a preliminary ruling on the interpretation of Ar
The data subject is an employee of the controller, the budgetary institution Klaipėda City Social Support Centre (Klaipėdos miesto socialinės paramos centras). On 2 April 2021, the controller’s Ethics Committee received a report stating that the data subject allegedly had behaved in an unethical way in the workplace environment. These conducts consisted in writing disrespectful statements about her colleagues and managers in a closed Facebook group and, more generally, having a rude attitude while working. On 6 August 2021, the data subject filed a complaint with the DPA. She argued that the investigation of the Ethics Committee infringed data protection law, as it processed her personal data without a legal basis under Article 6(1) GDPR. The data subject complained that the Committee unlawfully obtained her correspondence in the closed Facebook group. The DPA upheld the complaint. It found that the controller could not base its processing on legitimate interest under Article 6(1)(f) GDPR and that, however, it had not applied the balancing test of interests and did not assess whether the legitimate interests of the controller override the rights and freedoms of the data subject. Moreover, the DPA noted that the controller can be considered equivalent a public authority acting in the performance of their task. Therefore, according to Article 6(1) GDPR, Article 6(1)(f) GDPR cannot apply. The decision was appealed before the Vilnius Regional Administrative Court (Vilniaus apygardos administracinis teismas). On 27 February 2023, the controller’s appeal was dismissed. The court held that the act of receiving and analysing the data subject’s posts constitutes processing of personal data under Article 4(2) GDPR. Moreover, it pointed out that the processing of personal data is lawful only if it relies on one of the legal basis contained in Article 6(1) GDPR. As for Article 6(1)(f) GDPR, the court found that the controller had not proven that its alleged interest of ensuring
The data subject is a user of a social network platform, which also provides a messaging service. This platform is managed by a company with its headquarter in the USA. The data subject initiated a lawsuit before the Regional Court of Traunstein (Landesgericht Traunstein – LG Traunstein). Firstly, she argued that the controller is constantly monitoring her private messages and that the privacy policy is not transparent and is too complex. Secondly, she argued that, through cookies, the controller is collecting data relating to activities that happen outside the social network without her consent. Thirdly, she claimed that the controller forwarded all her personal data from and in connection with her account to the USA. She argued that this transfer is unlawful since the USA did not guarantee a level of protection equivalent to the GDPR. Therefore, the data subject asked the court to order the controller to pay non-material damages. As for the first argument, the controller pointed out that it conducts scans on the private messages only when to detect child sexual abuse material (CSAM) in compliance with the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32002L0058 ePrivacy Directive 2002/58/EC] (see [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32021R1232 Article 3 Regulation (EU) 2021/1232]). Moreover, the controller argued that it is respecting its transparency obligations and that the transfer of data to the US is legal since there is an adequacy decision and, before that, there were SCCs. First of all, the court ruled that the data subject has not demonstrated that the controller is systematically and automatically monitors the content exchanged via the messenger service. In every case, it found that the controller has proven that it carries out only permissible CSAM scanning. According to the court, this processing is covered by the legal basis provided for by Article 6(1)(f) GDPR. Secondly, it held that, due to the extensive dat
The data subject was a department head at the Department of Education (the controller). On 20 January 2022, the data subject sent an access request under Article 15 GDPR to the controller regarding his stored personal data. On 25 May 2022, the data subject sent another request. At the same time, two proceedings were pending before the Labour and Social Court (“Arbeits- und Sozialgericht”) between the data subject and the controller. On 30 June 2022 and 17 August 2023, the controller responded to the request and provided the data subject with information. This included a total of 187 documents relating to the data subject and his personal file. However, the controller refused to provide information to certain emails and statements, claiming it relied on overriding confidentiality interests, which would outweigh the data subject’s interest in receiving this information. As there were labour and social court proceedings pending, these emails and statements were part of these proceedings. Providing this information would therefore mean a deterioration of the controller’s litigation position. On 27 September 2022, the data subject lodged a complaint at the Austrian DPA (“Datenschutzbehörde - DSB”) against the controller for violating their right of access under Article 15 GDPR. According to the data subject, the controller provided the data subject with incomplete information. The data subject argued that he was still missing the following documents: the extensive volume of written complaints against the data subject at the controller’s personnel department, the written requests for dismissal from the data subject’s function as appointed department head, statements on the data subject to the controller and other relevant files. The DPA rejected the complaint, because there were no indications that the information provided by the controller was incomplete. The DPA also held that the controller was cooperative throughout the proceedings and had been able to demonstrate in
Several applicants, including the The Human Rights League (la Ligue des droits de l'Homme) and the National Council of Bar Associations filed requests to The Supreme Administrative Court of France to annul the [https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000047416587 Decree of 6 April 2023]. The applicants brought forward a number of charges against the Decree, including unclear purpose of the Decree, its interference with the principle of data minimisation, right to information, right to object and the security of data. The Decree authorised the implementation of automated processing of personal data relating to the care of minors returning from areas of operation of terrorist groups. The processing covered the data of French minors, minors presumed to be French minors, as well as foreign minors present in French territory, who lived in or transited through the Iraqi-Syrian zone or any other area in which terrorist groups operate. The data included the data identifying minors, their current situation (family, judicial, administrative, medical and educational) and identification data of persons exercising the parental authority. The court rejected all requests. At the beginning the court ruled out the allegation of incompetence of the regulatory power by referring to the legal basis of the Decree ([https://www.conseil-constitutionnel.fr/le-bloc-de-constitutionnalite/texte-integral-de-la-constitution-du-4-octobre-1958-en-vigueur Article 34 of French Constitution]). Then, it explained why data-principles charges against the Decree were unfounded. First, regarding the purpose of the Decree, the court emphasised it was precisely indicated in Article 1 of Decree. The idea that stood behind the Decree was to better help minors coming from the areas exposed to terrorist groups operations. The processing of the data aimed at providing the minors with appropriate care and prevent them from getting involved in criminal activities as well as spreading radicalism. Hence,
In August 2022, the claimant (the data subject) was on sick leave from their work. On 29 August 2022, the plaintiff was helping their mother-in-law trim a tree at her residential place. The claimant noticed a vehicle across the street with one of its occupants filming them with a phone. The plaintiff approached the vehicle and recognized the individuals, identifying them as senior managers from their company. The claimant subsequently expressed frustration, contending that they were being filmed without their consent and outside the work environment. The following day, the claimant was summoned to a meeting in which they were suspended with pay pending an investigation. During the meeting, the plaintiff asked about the recording, and was told not to focus on the video evidence, because there were credible witnesses to the incident in question. No such investigation took place. On 06 September 2022, the claimant attended a disciplinary hearing. On 12 September 2022, they were informed of their immediate termination, which was upheld after an appeal. It was claimed that the (unlawful) recording was not relied upon during these proceedings. The data subject complained, among others, that the defendant(s) wrongfully used, disclosed or processed its confidential information without consent or lawful purpose, thereby violating provisions of the GDPR and the Data Protection Act 2018. The data subject’s claim seeks damages, including non-material damages for the related stress, financial detriment, and reputational damages, inter alia. The plaintiff also issued motions to direct the defendant to comply with their request for access to, and copy of, the recording. In response thereto, an affidavit was issued confirming that one of the senior managers neither possessed the recording nor transferred it to anyone. The Circuit Civil Court held that the defendants and its agents breached the data subject’s personal data rights, because there was a sufficient causal link be
The data subject is a user of the platform X (formerly known as Twitter) of which the controller is Twitter International Company ULC. On 11 October 2023, the controller temporarily restricted ("shadowbanned") the account of the data subject, for posting a message that included the word “child pornography”. The message read: “The chats of hundreds of millions of people will soon be scanned to detect a relatively small number of criminals, no matter how bad. Strong criticism of European plans against child pornography: 'Not proportionate'” [link to a newspaper article].The controller automatically detected the post as potentially violating their policy. The shadowban meant that the data subject's account and posted messages temporarily did not appear in searches or on the timeline of other users. The controller did not notify the data subject of the shadowban. The data subject only found out through other users that told him they could not find his account. Subsequently, the data subject did an access request on 13 October 2023, to, amongst other things, understand what the shadowban entailed and why this happened. On 16 October 2023, the controller lifted the restriction after an additional review. This was also not communicated to the data subject. On 14 November 2023, the controller responded to the access request, and referred to various sections of their privacy policy in response to the data subject's questions. On 17 November 2023, the data subject initiated proceedings by application (“verzoekschriftprocedure”) at the District Court of Amsterdam (“Rechtbank Amsterdam”). The data subject requested the court to order the controller to respond to his access request under Article 15 GDPR, and his request for information on automated decision-making under Article 22 GDPR. The data subject also requested the court to impose a penalty of € 4.000 on the controller for every day it did not comply. The controller argued that they complied with the data subject’s