GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 21 October 2026 · Updated daily
Municipality of Utrechtse Heuvelrug
The claimant is a citizen who made an Article 17 GDPR request to the Municipal Executive of the municipality of Utrechtse Heuvelrug to delete his personal data processed on a forum used by different municipalities to cooperate and in emails to other administrative bodies. He also requested €3,000 in damages under Article 82 GDPR. The Executive rejected the request for deletion because the claimant's personal data had already been removed from the forum and because no personal data of his had been processed by e-mail. He also rejected the claim for damages on the grounds that the application was insufficiently substantiated. The claimant disagreed, arguing his data was still on a back-up of the forum. The defendant responded by stating the forum was responsible for data operations on the platform, and that the citizen should make his erasure request. First, the District Court of Midden-Nederland assessed whether the Municipal Executive should considered a controller in this case. It considered a previous case by the Administrative Jurisdiction Division of the Council of State (ECLI:NL:RVS:2019:181) and held that because municipal officials placed messages about the claimant containing his personal data on the forum, their actions must be attributed to the municipal executive for which they work and he must be regarded as a controller. However, it found he complied with his obligations after receiving the erasure request. Indeed, he contacted the forum which deleted the claimant's personal data from its platform. Second, it evaluated whether the claim for damages should be upheld. It started by citing a previous court decision which confirmed the mention of the claimant's name on the forum was lawful in accordance with Article 6(1)(e) GDPR. It found that such processing was necessary and proportionate to the invasion of the plaintiff's privacy to prevent fraudulent claims for penalty payments from different municipalities. Thus, the court rejected the claim for
Google LLC
Claimants 1 and 2 are entrepreneurs who are or have been active in the real estate market. They are married. Claimant 1 still operates at least one company that does development and sales of new buildings. Claimant 2 used to run a house rental agency, but not anymore. When the names of claimant 1 and claimant 2 are entered in Google search, the search results show links to sites and TV shows featuring both claimants and their way of running business in the negative light. In July 2019, during the preliminary relief proceedings the producer of one of the shows was ordered by the Court to add a rectification notice because some statements in the show did not have enough factual support. The Court, however, did not agree with the claimants that the removal of the show was justified. Similarly, the Netherlands Press Council also partially agreed with the claimants, finding that the reporting published on one of the sites did contain unsubstantiated accusations, hurtful language and insufficient consideration of the claimants’ side of the story. However, the Council found that careless journalistic conduct did not take place. Claimants submitted several “right to be forgotten” requests to Google to have specific links removed from the search results. Google rejected those requests. Claimants brought two cases before the Court. According to claimant 1, 18 URLs must be forgotten in case 19-64 and 24 URLs in case 20-22. Claimant 2 is asking to de-list 21 URLs in case 20-22. The Court considers both cases jointly. Claimants are of the opinion that a data subject in principle has a right to have his or her personal data deleted from search engine. It is then up to the search engine provider to prove that there are valid reasons for not deleting the information. According to the claimants, the balance of interests is in their favor in this case as the links they would like to have de-listed contain a lot of inaccuracies. Moreover, the information published on those pages is incomplete, irrelevant and excessive. Google’s position is that the requests for erasure submitted by the claimants do not satisfy the conditions in Article 17(1)(c) and Article 21(1) of the GDPR and Google’s internal policy. The information the claimants would like to de-list has an important warning function and is part of an important public debate, in which claimants are public figures. Making this information unavailable would have a disproportionate effect that is not unjustified. Also, the previous decisions of the Court and the Press Council were not about the content published via the contested URLs. And finally, Google argues that the decisions to reject the de-listing request were in line with the Costeja judgement. The Court considered the following: • neither the preliminary proceeding judge nor the Press Council agree with the claimants that the contested pieces of information are to be fully rectified and that the claimants are largely in the right; • the reports published on the contested sites have a warning function and are part of an important public debate; • the deletion requests have not been sufficiently substantiated by the claimants; • the contested URLs contain information about the professional activities of the claimants, meaning that their private lives are less affected; • the fact that complainant 2 is no longer active in the rental business is irrelevant since nothing prevents claimants 2 from re-entering this market again; • claimants 1 and 2 have been involved in previous Court proceedings where their actions as landlords were called into question. They or their legal entities have been ruled against several times. The Court ruled that under these circumstances, the public interest of becoming informed outweighs the claimants’ interest of having the URLs de-listed. The “right to be forgotten” requests are to be rejected.
President of the bar of Eastern Brabant
On 15 December 2017 appellant filed a disciplinary complaint against a lawyer who previously assisted him in a criminal case. In a letter from 17 September 2018, the president of the local bar shared his position statement on the complaint. On 6 May 2019 appellant submitted a request for rectification under Article 16 of GDPR, because, according to appellant, a specific sentence was missing in the statement. In the decision of 24 May 2019, the president of the bar of Eastern Brabant rejected the appellant’s request to rectification. The president of the bar of Eastern Brabant is of the opinion that his position statement does not constitute personal data of the appellant, which means the right to rectification is not applicable. Appellant believes that the right to rectification must be respected and that the president of the bar interprets the term “rectification” too narrowly, excluding the completion of incomplete data. The Council of State ruled that the rectification request to have the incomplete personal data completed cannot be extended to supplementing documents. The president of the bar was correct: Article 16 GDPR does not allow appellant to add a sentence in the president’s statement.
Court case 201905709/1/A3
In a domestic violence and child abuse case, the Minister for Legal Protection granted the father’s request to obtain a copy of the correspondence between the mother and the Council for the Protection of Childhood. Since there were several data subjects, the Minister asked the mother, in accordance with Article 4 GDPR, whether she objected to the inspection and surrender of the data and weighed up the interests involved. The mother objected, but the Minister for Legal Protection decided however that the father had the right to inspect or obtain a copy of the files, as the information contained in the files were already largely known to the father. The District Court of The Hague dismissed the mother’s appeal against that decision, considering that the father, having authority over the children, was entitled under Article 15(1) GDPR to inspect the files. In the opinion of the Court, it did not appear that the provision of the documents to the father would adversely affect the rights and freedoms of the mother. The mother’s appeal to the Council of State was declared well-founded. According to the Administrative Jurisdiction Division of the Council of State, • Article 15(1) GDPR only gives a data subject the right to obtain information about the personal data concerning him/her, and therefore does not provide a basis for providing personal data to third parties • Article 15(4) and recital 63 GDPR indicate that the right to obtain a copy must be without prejudice to the rights and freedoms of others. The files covered by the request include documents in which only personal data of the mother are included as well as documents containing both personal data of the mother and the father. As far as his own personal data are concerned, the father can be regarded as a data subject as referred to in Article 15(1) GDPR. But with regard to the mother’s personal data, the mother is the “data subject”. The personal data of the mother cannot therefore be provided to the fathe
Cooperative Rabobank U.A.
The District Court of Amsterdam rejected a request of removal of negative registrations in a credit information system pursuant to Article 17 GDPR, reasoning that the purpose of these registrations provided sufficient legitimate grounds to override personal interests. In 2003, the claimant (data subject) took out an investment mortgage at the cooperative bank Rabobank (the controller). From 2008 onwards, several payment arrears occurred and in 2016, the data subject stopped paying the monthly instalments. In 2020, the house in question was sold and the mortgage plus interest paid to the bank. The data subject also had a checking account with Rabobank. Here overdrafts occurred in 2008 (repaid in 2017) and in 2018 (repaid in 2021). As a consequence, Rabobank registered two code numbers (‘BKR registrations’) at the central credit information system. They regarded both the mortgage and the credit from the checking account, indicating the data subject’s history with payment arrears to potential creditors. In 2022, the data subject submitted a request for removal of the BKR registrations pursuant to Article 17 GDPR, which the bank rejected. He then sought a court order forcing the bank to remove the BKR registrations, basing his request on Article 21(1) GDPR and Article 6(1) GDPR. The data subject argued that he was now in a financially stable situation and that the registrations impacted him unjustifiably, as he could not obtain long-term financing at a market-based interest rate for the companies he is a shareholder of. The bank raised a defence. The court raised the question, whether there are grounds for the removal of the BKR codes. The court held that the registration codes’ aims, namely, to protect both the customer from excessive indebtedness and potential creditors from uncreditworthy borrowers, meet the requirement of compelling legitimate grounds and override the claimant’s interests in accordance with Article 21(1) GDPR, which allow the controller to further process the data even after the data subject has exercised their right to object. They were also found to be in line with the principle of proportionality, as lenders would have no other way of knowing of the data subject’s financial past. The court also argued that the data subject’s particular situation did not give rise to a compelling argument on erasing the registration codes, as both the arrears in connection to the mortgage and to the checking account were of a structural nature. Furthermore, the data subject was not able to prove his financial stability to the court. The court rejected the data subject’s request.
Datenschutzbehörde (Austrian Data Protection Authority)
In April 2019, the data subject sent an request for erasure of data on several payment defaults and some address data to the credit reference agency (CRA) CRIF GmbH because the debts had all been cleared. The CRA refused the erasure, stating that the data was still relevant for the purposes of assessing the data subject's creditworthiness. In June 2019, the data subject lodged a complaint with the Austrian DPA (Datenschutzbehörde - DSB), stating that all debts still stored in the CRA's data base have been cleared and that several debts only concerned insignificant amounts. The DSB rejected the complaint regarding the data on payment defaults but ordered the CRA to delete data on an old address of the data subject. The DSB held that the data on the payment defaults concern a total amount of more than EUR 3,000 and that none of the debts has been cleared more than 5 years ago. Under case law by the BVwG (see BVwG - W211 2225136-1), CRAs are allowed to store data on payment defaults or insolvencies for a five-year period after the clearance of the debt. The data subject filed an appeal against this decision by the DSB. In this appeal he/she also argued (for the first) time, that the CRA had also violated Article 14 GDPR because the data subject had never been informed about the processing of his/her data. Hence, the data must also be deleted under Article 17(1)(d) GDPR. Was the CRA allowed to still store data on payment defaults after the debts have been cleared? If so, for how long? Does the failure to inform the data subject under Article 14 GDPR result in the general unlawfulness of the processing and the obligation for the controller to delete the data under Article 17(1)(d) GDPR? The BVwG rejected the appeal and fully upheld the decision by the DSB. On the issue of storage duration of the data on payment defaults, the BVwG agreed with the DSB's reasoning and held that none of the data must be erased at the time of the decision. All the data stored could still
Municipality of Eindhoven
Appellant has been receiving welfare since 2011. In 2017, the municipality carried out an investigation triggered by an anonymous tip. As a result of this investigation the municipality concluded that the appellant had no right to receive the benefit and was supposed to pay it back. Appellant submitted a series of access and erasure requests to the municipality in 2018. Among other things, he wanted to have his bank details erased and he wanted to obtain access to the name of the reporter whose tip led to the investigation. The municipality refused to provide both and Court of First Instance upheld this part of the municipality's decision. Appellant is challenging the decision. The Council declared the appeal invalid. Appellant cannot access the name of the reporter because: a) the municipality says it doesn't have it and there is no reason to doubt that; b) even if they did have the name, appellant is not entitled to have access to it because it doesn't relate to him; c) the reporter is not the source of information, so Article 15(1)(g) does not apply. Appellant also cannot have his bank details removed because of the Archive act 1995 (Archiefwet 1995): the municipality is under the legal obligation to keep the information about social benefits for 10 years.
Court case Usž-670/21-2
The plaintiff points out that in this particular case about the controller's obligations regarding an Access Request, he proposed to submit a preliminary question to the Court of Justice of the European Union. He proposes that the High Administrative Court annul the first-instance judgment, uphold the plaintiff's claim and annul the defendant's decision. He seeks reimbursement of the costs of the appeal proceedings. The plaintiff filed an appeal against the judgment for substantial violation of the rules of court procedure, erroneously and incompletely established facts in the dispute and erroneous application of substantive law. In making such a claim, the first-instance court did not explain and specify on the basis of which it concludes that all credit documentation should be considered personal data, nor did it correlate with the notion of personal data from Art. (4)(1) GDPR on the protection of individuals with regard to the processing of personal data and on the free movement of such data. The erroneous and incompletely established factual situation was committed by the court failing to establish all the circumstances of the case, and in particular failing to establish precisely what is considered personal data and why it considers all credit documentation to be personal data. The court also erred in finding that providing the respondent with a copy of the requested documentation does not adversely affect the rights and freedoms of other individuals, emphasizing that other individuals do not mean the processing manager himself. The first-instance court only states this position in the reasoning of the judgment, without explaining on the basis of which it came to such a conclusion and from which it follows that such an interpretation of the said Article of the General Data Protection Regulation should be considered valid. It also maintains that the substantive law has been erroneously applied accordingly, for all the reasons stated during the administrative dispute. In response to the appeal, the respondent fully disputes the allegations as unfounded, for the reasons stated during the administrative dispute and finally proposes that the High Administrative Court dismiss the appeal in its entirety as unfounded and uphold the judgment rejecting the plaintiff's claim for annulment. It follows from the file that the first-instance court, in determining the factual situation in the dispute, in addition to the facts established by itself, took into account the facts established in the procedure of making the disputed decision. The inspection of the case file submitted to this Court with the appeal shows that the respondent's decision upheld the request of the interested person to establish a violation of the right to protection of personal data and found that disabling the exercise of access to personal data; the plaintiff violated Art. (15)(3) GDPR and ordered the plaintiff to allow the interested person to exercise the right of access to credit documents or personal data. In the opinion of this Court, the defendant's decision is based on law and this Court considers that the defendant's finding that by denying the exercise of the right of access to personal data, ie credit documentation of the interested person, violation of Art. (15)(3) of the General Regulation on Personal Data Protection. The person concerned requested that he be given access to his personal data by providing a copy of his personal data as provided for in Art. (15)(3) GDPR. This provision does not give the controller free choice when providing copies of the personal data being processed, but is a duty and obligation that the controller must provide. This provision stipulates that in any case the controller is obliged to provide a copy of personal data being processed, which in relation to this case means that the plaintiff (a bank - name not available at the moment) is obliged to provide a copy of documents containing personal data and thus provide access to personal data or credit documents which contains personal information. Other objections raised by the plaintiff in the appeal, this Court finds unfounded and without prejudice to the different resolution of the administrative matter in question, especially because these are objections raised by the plaintiff in the proceedings before the trial court, which the trial court manifested, and whose conclusions this Court fully agrees with.
Het college van burgemeester en wethouders van Den Haag
On 27 December 2018, the claimant requested access to his personal data held by the municipality of The Hague. He requested access to, among others, the information relating to an IP address, serial numbers and details of bicycles towed by the municipality and email communication with the employees of the municipality. The municipality provided claimant with some information but decided against disclosing all requested personal data. The claimant insists that the list of personal data provided by the municipality is incomplete. He argues that IP address, email communication and debit card payment information for the towed bicycle should be included. The Court ruled that, as follows from the case law of the Administrative Division of the Council of State, the person who claims that there should be more personal data, has to make it evident that this is indeed the case if they want to contest the administrative body’s investigation into the matter. The municipality has stated that IP addresses are not stored or linked to persons, it also doesn’t have the means to link IP addresses to a specific person (additional information from an ISP would be necessary here). Lastly, it would take an impossible amount to time and resources for the municipality to trace and identify all people who communicate IP addresses to the municipality. The Court ruled that when a processing requires an excessive effort, resulting in identification being practically impossible, an IP address cannot be considered personal data. Regarding the processing of the debit card payment data, the municipality indicated that that data is anonymized, which means it cannot be traced to the claimant. Regarding the claimant’s email communication with the municipality, the Court found that the claimant already has the emails he sent himself and the municipality’s response. Moreover, the Court ruled that Article 15 GDPR does not entitle the claimant to receive a copy of the physical or digital documents which contain his personal data because these documents do not constitute personal data. The claimant has the right to a complete overview, in an understandable form, of his personal data in order to be able to check the accuracy of these data and assess whether they are processed in accordance with the GDPR.
Het college van burgemeester en wethouders van Bladel
Appellant's personal data was shared in a document that was available to several Dutch animal protection authorities in the context of a nation-wide action day against rogue dog trafficking. The authorities of Bladel rejected her request for erasure. The Appellant went to court, arguing, among other, that the authorities had no legal basis for processing her data. The Court of First Instance of Eastern Brabant ruled that the local authority of Bladel was allowed to keep processing appellant's data under Article 17(3)(e) GDPR because of the ongoing legal proceedings. According to the Court, it was irrelevant whether it could be regarded that data was processed unlawfully. Apellant argues that her personal data is processed by the local authorities unlawfully. The authority of Bladel asserts that it had used the data for compatible purposes under Article 6(4) GDPR, which means the appellant's appeal must be rejected. The Council ruled that the Court of First Instance was entitled to assess whether the exception of Article 17(3)(e) GDPR took place without having to first assess the lawfulness of the processing. However, the Council noted that the authority of Bladen has changed their reason for rejected the appellant's request from Article 17(3)(e) to Article 6(4) GDPR without properly documenting or demonstrating how purpose compatibility criteria in GDPR are met. The nation-wide enforcement day for which the data had initially been collected, took place n 2016; the fact that appellant initiated legal proceedings against the municipality in connection with that event does not mean that the purposes of processing are compatible.
Minister for Agriculture, Nature and Food Quality
In 2013, as part of the integrated approach to rogue dog trafficking by the Police National Unit Animal Welfare Expertise Centre, a so-called pre-weighing document has been drawn up. This document contains data from dog handlers with sufficient indicators to justify further investigation. The dog handlers listed in the pre-road document are included in the general roadmap 'Canitas project' (hereafter: the roadmap) that has been drawn up for a national enforcement action day, and which in section 1.4 contains a diagram with data from dog handlers. The data of applicant and appellant are included in this diagram. The project involved cooperation with, among others, the National Animal Protection Inspectorate and the Dutch Food and Consumer Product Safety Authority. Within the framework of integral enforcement, the roadmap was shared with the administrative bodies affiliated to the Regional Information and Expertise Centre East Brabant. The applicant and the appellant have requested the deletion of their data from the pre-weighing document and the schedule according to the GDPR. The Minister takes the view that data in the roadmap will not be processed unlawfully. In addition, the right to be forgotten of Article 17 GDPR is not intended to correct or delete opinions with which the applicants disagree. Moreover, in connection with the processing of their data, the applicant and the appellant also brought civil proceedings for damages against the Minister. In that context, the data are necessary for the substantiation of a legal action, so that the exception in Article 17(3) GDPR applies, according to the Minister. The central question in the civil proceedings is whether the decision of the Minister not to delete the personal is well founded. The court noted that the last decision of the Minister is no longer based on Article 17(3) GDPR. Instead the decision is based on Article 6(4) GDPR. However the Minister did not explain well enough why the defence of legal clai
ING Bank N.V.
The appellant has a complicated credit history with the ING bank, which resulted in debts and outstanding payments. At some point her name was added to the Central Credit Information System of the Dutch Credit Registration Office. In 2017 the appellant paid all her debts, but the registration with the Credit Registration Office is to remain for the period of 5 years until 2022. In 2019 the appellant submitted the request for erasure which was rejected by ING. Subsequent Judgement of the Court of First Instance upheld this decision, which is now being contested by the appellant. The appellant requests the Court, among others, to order ING to remove the registration with the Credit Registration Office, limit its duration period or remove the registration temporarily until she gets another loan. The appellant claims that the necessity and proportionality balance assessment done by the Court of First Instance was wrong: for example, she can not get the mortgage she needs to improve her life. Her objection to processing follows from Article 21(1) GDPR. ING argues that Article 21(1) GDPR cannot be relied on in this case because it applies only to personal data processed under legitimate interest or public interest, but not under a legal obligation which is the case here. The Court agreed with the appellant: legal basis of the processing of her personal data by ING is legitimate interest and not the legal obligation under the Dutch Financial Supervision Act (Wet op het financieel toezicht). This means, that she has the right to object to her personal data processing based on Article 21(1). However, the Court rejects the appeal as such because the principles of necessity and proportionality are respected in this case. The appellant could not demonstrate that maintaining the registration would disproportionately affect her. The fact that she is financial reliable (even though challenged by ING) does not mean that she does not need protection from excessive loans. The m
Court case II Ips 23/2020
The plaintiff was a former Candidate for a position as a Judge at the European Court of Human Rights in 2014. During this process the defendant (a national media house) published articles on its website stating that the plaintiff had been sentenced to one year and six months imprisonment for domestic violence. The plaintiff (applicant) alleged a violation of the right to privacy for maintaining sensitive personal data on the defendant's website even after the call for judges of the European Court of Human Rights had been closed and the articles were no longer relevant. The Court of first Instance has balanced in it´s decision the collision of protected rights - the plaintiff´s personality rights and the right to privacy on the one side, and the defendant´s freedom of expression, on the other. The Court of Appeal (Višje sodišče v Mariboru) upheld the findings of the Court of First Instance. Therefore, the plaintiff filed a revision (partial renewal of a res judicata judgement) in the part of the decision of the court of appeals regarding the question if a person which was in the past a “relative public figure” loses its status as a “relative public figure” after certain time passes and there is no more interest of the public for that person. The Court held, that a former Candidate for the position of a Judge at the European Court of Human Rights (ECHR) is a “relative public person” or “relative public figure”. When someone becomes a “relative public person”, his field of expected privacy, becomes smaller - in inverse proportion, the more public the function, the more restrictive its privacy rights. The person will be forever in a way a person of public interest regarding the event which made the public interest about him increase. Another question is whether he is entitled to general anonymity and protection of personal data after the event. The answer to this question is not straightforward and depends on the circumstances of each case, in particular the importance of the event itself, the person's role in public life and his or her conduct and public appearance otherwise, the public's interest in accessing the information within a certain period of time after the event, the content and form of the publication. If an article is moved from the public accessible Homepage, to an Archive, which is accessible upon payable Subscription, such a movement actually makes the information publicly disappear. This has in relation to the general public, the same effect as an erasure (Article 17 GDPR). It would be excessive and contrary to the mission of the media to require them to check the relevance of their past publications on an ongoing, daily basis, but they are obliged to do so at the request of the persons entitled to do so, and to take appropriate action if necessary at that time.
KSV1870 Information GmbH (respondent in the initial procedure before the DSB)
In 2010, the data subject had been subject to insolvency proceedings. In 2012, he was ordered to repay 70% of his open debts and managed to fulfil this payment plan by mid-March 2018. The competent court consequently accepted his request to remove information on the insolvency from the public insolvency register ([https://edikte.justiz.gv.at/edikte/id/idedi8.nsf/suche!OpenForm&subf=e Insolvenzdatei]). This publicly available information of the data subject's insolvency had also been stored in the database of the credit reference agency KSV 1870 Information GmbH. The data subject is also the sole managing director of a limited company. The database entry on his insolvency has also been linked with the data stored on this company. The data subject requested the erasure of the data on his insolvency under Article 17 and 21 GDPR, stating that he has paid back his debts in line with the payment plan and that data on his insolvency are no longer published in the insolvency register. After KSV 1870 Information GmbH refused to delete the data, the data subject lodged a complaint with the Austrian DPA (Datenschutzbehörde - DSB). The DSB rejected the complaint and the data subject filed an appeal with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). Is a credit reference agency such as KSV 1870 Information GmbH allowed to store data on the insoleveny of an individual beyond the availability of that data in the official insolveny register? If so, for how long? The BVwG held, that KSV 1870 Information GmbH is allowed to store the data on the data subject's insolvency, even though that data is no longer available in the official insolvency register. Both the amount of a debt and the time that has passed since its incurrence and its payment are relevant to assess an indivuidual's creditworthiness. Neither EU law nor the national Austrian law contain provisions on the allowed storage period of creditworthiness data (such as information on insolvenc
STICHTING RECLASSERING NEDERLAND
The Parole Office processed personal data of the plaintiff while he was on probation between 2014 and 2020. On 13 august 2018 plaintiff submitted the right of access request to the Parole Office. On 9 November 2018 the Parole Office provided plaintiff with the overview of the documents, notes and emails that contain his personal data. The overview included the number, date, and a short explanation of each document. For example: “24. 1-12-2014 Email with client regarding the appointment”. The Parole Office excluded the following categories of documents from the overview and did not provide them to the plaintiff: 1) Internal notes and communication between the employees of the Parole Office about the rehabilitation process; 2) The correspondence and communication between the Parole Office and the Public Prosecutor’s Office about the rehabilitation process; 3) The correspondence and communication between the Parole Office and the Custodial Institutions Agency about the rehabilitation process. The plaintiff requests the Parole Office to provide him with a full overview of the documents containing his personal data, he also requests to be allowed to access to these documents, should he want to. The Parole Office explained to the plaintiff that the excluded documents fall under statutory exceptions for two reasons: a) this will help its employees and the employees of the concerned agencies to perform their tasks and freely exchange opinions, which is necessary for the execution of their duties; b) These documents cannot be shared with the plaintiff to protect privacy and personal data of the employees of the concerned agencies. The Parole Office also argued that its own internal reports are not personal data, but rather the impressions of the Parole Office employees. The Parole Office refers to a judgment of the Court of Justice of the European Union of June 17, 2014 (joined cases C-141/12 and C-372/12), in which it was ruled that a legal analysis based on personal d
Tax officer of the municipality of Bergen op Zoom
On 4 June 2020 the plaintiff lodged a complaint against the tax officer’s failure to decide on his objection to the result of the access request. Under the Dutch Administrative law, public authorities are obliged to issue decisions within specific timelines, otherwise they should pay a penalty. The Court found that the tax officer has indeed failed to decide on the plaintiff’s objection.The case is mostly based on the Dutch Administrative law. GDPR-wise, the Court considered that pursuant to Article 12(3) of the GDPR, data controller must provide data subject with the information on Article 15 to 22 requests without delay and in any case within one month of receipt. Article 34 of the GDPR Implementation Act states that a written decision on the request should be deemed as a decision within the meaning of the Dutch Administrative law.
Court case RN 9 K 19.1061
The applicant seeks an order that the City of P. refrain from video surveillance of the "P.er K.-garten" and from recording it. In a letter dated 23 November 2017, the Police Inspectorate P. provided the defendant with information on the "P.er K.-garten" as a basis for possible political initiatives for municipal video surveillance. In this letter it is stated that the K.-garten has been a police focus for years, especially during the warm months (April to October). On 14 May 2018, the defendant's city council decided to install video surveillance. Signs were missing at other entrances to the K.-garten and in some places they were installed in an area that was already covered by the cameras. Because of its open design, the K.-garten could be entered without being able to see the signs. A detailed note on the modalities of the video surveillance was only attached to the surveillance house. The operating hours of the video surveillance were between 6:00 and 1:00 am. The claimant argued that the installed video surveillance in a park is not necessary to prevent a.o. drug-related crimes. Moreover, the surveillance should not only be turned off entirely on market days, but also during other events which he would like to initiate. 1. Article 79 GDPR precludes further judicial remedies against controllers and processors, so that a general action for performance in the form of an action for an injunction pursuant to §§ 1004 (1) and 823 (2) of the German Civil Code is not permissible within the scope of the GDPR. 2. A distinction must be made between data processing that is (merely) contrary to the Regulation and a possible infringement of a person's rights with regard to the personal data relating exclusively to that person. 3. In the case of a mere unlawful data processing without any infringement of rights, the data subject has the right of appeal under Article 77(1) GDPR and subsequently the right of judicial remedy against the supervisory authority under Article 78(
ABN AMRO Bank N.V.
The appellant has a complicated financial history with several debts and a record of payment delays, including a mortgage at Achmea bank and a private loan from ABN AMRO bank. Because of these debts he was registered in the Central Credit Information System (CKI) of the Credit Registration Office (BKR). Over the years, the appellant has tried to improve his financial situation and succeeded in some areas. He wanted to take an additional loan to support his business, lease a working car and move to a bigger house. The CKI registration prevented all of this from happening, which led to a (rejected) right to erasure request and a lawsuit before the Court of First Instance of Zeeland-West-Brabant which he lost. The appeal is based on essentially two claims: 1) banks cannot use compliance with a legal obligation as a lawful basis for processing when it comes to credit register maintenance (a position seemingly shared by the Dutch DPA) and 2) in his particular case, such registration was disproportionate and thus was not compliant with the principles of necessity and proportionality. The banks are of the opinion that compliance with a legal obligation is the correct legal basis, that the appellant's financial situation is far from perfect and that the CKI record is therefore justified and necessary to protect the financial system and the appellant himself. The Court did not agree with a rather narrow interpretation of the scope of compliance with a legal obligation as a legal basis in this case. According to the Court, not every individual personal data processing operation requires specific legislation tailored to its purpose, a legislation can serve as a legal basis for several data processing operations. According the the Court, the appellant also failed to demonstrate exactly how the credit registration breached the principles of necessity and proportionality. Although his financial situation has seemingly improved, the Court ruled that the interests of ABN AMR
Court case W211 2221963-1
A natural person filed a complaint under the Data Protection Act (Datenschutzgesetz, DSG), in which it was summarised that the Company (appellant in this case - a real estate trustee and developer) had already sent letters to this natural person on several occasions, to his/her private address, in which the Company had expressed interest in acquiring the other party's property. Given the repeated sending of such letters, it had to be assumed that the Company had been processing the personal data of the involved party permanently for a long time. Therefore, on XXXX 2018, the natural person involved had asked the Company for information on the processing of personal data under Article 15 GDPR and, as it believed that any data processing that had been carried out was unlawful, he/she had requested that the data be deleted according to Article 17 GDPR. The complainant had not reacted to this request. The Company claimed in the proceedings initiated by the DPA that unfortunately, due to internal misconduct, the letter had remained unanswered. The opinion was accompanied by a letter from the Company addressed to the other party on the same day, in which the request for information under Article 15 GDPR was complied with and the other party was informed that its personal data had been deleted. It must be added that the complainant searched the land register for the property of the co-participating party and in this way obtained the contact details of the party. Subsequently, the complainant used the data obtained from the land register (extract from the land register) to contact the party three times by post with a view to a possible purchase of the said property. The contact details of the co-interested party were not used for any other purpose. However, the Company had not informed the party concerned about the personal data not collected directly from the party, under Article 14 of the GDPR. The data protection authority informally discontinued the proceedings regardi
Österreichische Post AG
In 2019, the data subject submitted an access request under Article 15 to the Austrian Post. The Austrian Post replied to the data subject stating that due to the high number of inquiries in connection of media coverage that they have, complainant within three months as opposed to one month. The data subject replied stating that their request was not complicated, and that they would like to have an answer within one month. No answer was provided to the data subject within the one-month time frame. The data subject then submitted a complaint to the Austrian Data Protection Authority (DSB), in which he stated that (1) he had not received an answer to his Article 15 request from the Post within a one-month, and (2) the information received from his Article 13 request was partially incorrect. The DSB replied stating that they could not yet ascertain whether a subjective right had been violated, given that the three-month period had not expired yet. The DSB told the complainant that they could informally withdraw the complaint within two weeks, or expect a rejection. The complainant replied to the DSB stating that their complaint should remain valid because the information provided by the Post had also been incorrect (Article 13 GDPR). However, the DSB rejected this reasoning, stating that the suggested infringement of Article 13 was to be treated separately in scope to the suggested infringement of Article 15, and that a new complaint should therefore be submitted. Moreover, the DSB stated that The data subject complained about the DSB’s legal assessment, stating that their legal assessment was incorrect and that they had violated essential procedural rules. The data subject claimed that the three-month deadline should only be used in exceptional cases, and that the DSB had erred in assessing that this instance was one such case. The data subject claimed that the DSB had infringed his rights by causing a delay in his ability to exercise his rights. The data protectio