GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
The data subject filed a lawsuit with the first instance court, the Regional Court of Cologne (“Landgerichts Köln”) seeking injunctive relief. The data subject further requested the court to order Google Ireland Limited (the controller) to erase search results that linked to an article which contained false information about the data subject and included a photograph of the data subject that infringed the data subject’s copyright. The article used the photograph to make allegations of the data subject. The photograph was taken by the data subject’s wife, who did not give the website the right to use the photograph for the mentioned article. The first instance court agreed with Google Ireland's view that they are not the controller, but the US based Google Limited Liability Company (LLC), because they make the decisions about how to respond to a search query and how the relevant search results are displayed. Google LLC was also named as the controller in the privacy policy. Although Google Ireland Limited operates the Google search engine in Germany and other European countries, it had no influence on how the search results were generated. The court therefore dismissed the action for injunctive relief and request for erasure. The data subject appealed the decision of the first instance court for failing to recognise that Google Ireland Limited is a controller under Article 4(7) GDPR. It further requested the court to erase the search results related to the article with inaccurate information of the data subject. On whether Google Ireland Limited is a controller The court disagreed with the first instance court and held that Google Ireland Limited is the controller. The court held that it is irrelevant whether the controller only offers access to the search engine and took into account the CJEU judgement in C-131/12 - Google Spain and C-231/22 - Belgian State and held that the mere display of information containing personal data constitutes the processing of such d
The Data Subject made request to have access and obtain his personal data to the University of Edinburgh. However, he was dissatisfied with the University's response and on 31 March 2023, he lodged a complaint with the ICO regarding the handling of his data subject access request. After the Commissioner's investigation, which found that there was a delay, but eventually all entitled data was disclosed, the Data Subject was still not satisfied with the result, claiming that not all his data was provided by the controller. The Tribunal decided to strike out a Data Subject's appeal. The decision was based on the Tribunal’s interpretation that its role under Section 166 of the Data Protection Act (DPA) is not to reassess the substantive outcome of the Commissioner's decisions, but solely to ensure that the complaint handling process was procedurally correct. Since the Commissioner had already responded and concluded the case with the outcome communicated to the Data Subject, the Tribunal ruled that it had no authority to challenge this outcome or provide a substantive remedy. Therefore, the application was struck out, with the Tribunal stating that there was no reasonable prospect of success for the appeal, as it did not present issues within the Tribunal’s purview to correct, only addressing procedural elements which were already satisfied. The Tribunal does not have the power to alter the conclusion reached by the Commissioner on a complaint. Neither does the Tribunal have an oversight role over the Commissioner’s exercise of his functions or internal processes. The Tribunal can only make an order to determine the appropriate steps to respond to the complaint have been made and/or to inform the complainant of progress on the complaint, or of the outcome of the complaint. According to the Tribunal, it was clear that the ICO has taken appropriate steps to respond to the Data Subject and has reached to a final decision and communicated the outcome. Also, it was highlig
Grindr (the controller) is a location-based social networking app marketed towards the LGBTQ community. The app has an ad-based free version, but users can upgrade to paid subscription versions which include more features and are without ads. In January 2020, the Norwegian Consumer Council together with noyb lodged a complaint with the Norwegian DPA (“Datatilsynet”) against the controller for unlawful sharing of personal data with third parties for marketing purposes. This included GPS location, IP address, Advertising ID, age, gender and the fact that the user in question was on the controller's app. Users could be identified through the data shared, and the recipients could potentially further share the data. On 13 December 2021, the DPA fined the controller €6,4 million (NOK 65 million) for disclosing personal data to advertising partners without a valid legal basis, violating Article 6(1) GDPR. Furthermore, the controller violated Article 9(1) GDPR for disclosing special categories of personal data to advertising partners. On 14 February 2022, the controller appealed this decision at the Privacy Appeals Board (“Personvernnemnda”). The Privacy Appeals Board upheld the DPA’s decision. On 27 October 2023, the controller filed a lawsuit against the Privacy Appeals Board at the Oslo District Court (“Oslo tingrett”). The controller argued that the Appeals Board’s decision should be declared invalid or alternatively that the fine should be reduced. Disclosure of special categories of personal data The court held that by providing the App ID, the controller shared information with their advertising partners that a specific user is a user of their app. The court held that by just being a user of the controller’s app, one can draw the conclusion that the user is not heterosexual and thus is covered by sexual relationships and orientation under Article 9(1) GDPR. Thus, the court concluded that the controller disclosed personal data of special categories of personal da
Two data subjects wanted to register as street sex workers in the prostitution zone of the municipality Nijmegen. This registration is mandatory for offering sexual services as the General Municipal Ordinance Nijmegen (“Algemene Plaatselijke Verordening Nijmegen - APV”) prohibits street prostitution in the municipality, except in designated areas. On 22 March 2022, the municipal executive (“het college”) designated a section of a street as an area where street prostitution was permitted, provided certain conditions are met. This was the designation decree (”aanwijzingsbesluit"). The conditions included mandatory registration with the mayor for street sex workers, who had to be at least 18 years old, and could either demonstrate that they were working as street sex workers in the city since 2020, or that they utilised healthcare services for street sex workers in the city since that date. On 27 and 28 April 2022, the data subjects submitted their application for registration in the new designated area to the mayor of the municipality (the controller). On 4 July 2022, the controller told the data subjects it would reject their application, to which the data subjects submitted a statement with their views to the controller. On 1 August 2022, the controller still rejected both applications, because the data subjects failed to adhere to the conditions for the registration. On 9 September 2022, the data subjects objected to the rejections together with Bureau Clara Wichmann (“Stichting Bureau Clara Wichmann – BCW”), a legal entity advocating for women's rights and combating gender discrimination. On 10 July 2023, the controller dismissed the objection. Following this, the data subjects together with BCW filed an appeal against the controller's decision at the District Court of First Instance of Gelderland ("Rechtbank Gelderland"). The data subjects argued that the registration requirement, along with the conditions attached to it, was in conflict with the GDPR and [htt
On 12 June 2023, the Swedish DPA (“IMY”) imposed a fine of €5,167,615 (SEK 58 million) on Spotify AB (the controller) for violating the GDPR. The DPA held that the controller did not provide sufficiently clear information in the access request and violated Article 12(1), 15(1)(a) to (d), (1)(g) and (2) GDPR. The controller appealed the DPA’s decision at the Administrative Court of Stockholm (“Förvaltningsrätten I Stockholm”) and requested to annul the DPA’s decision, to impose a reprimand instead of a fine or otherwise reduce the imposed fine. The controller did not agree that with the DPA’s reliance on the guidelines of the EDPB and the Article 29 Working Party for their decision, as these were not legally binding. The controller argued that there was no requirement of how the information on categories of personal data should be presented under Article 15(1)(b) GDPR and thus it complied with the provision regardless of the generalised information. Also, the controller argued that there was a link to the privacy policy that had a more detailed description of the different categories. The controller further argued there was no obligation to provide information on the storage periods in relation to each category of personal data under Article 15(1)(d) GDPR, to provide precise information on the criteria for determining the storage periods and to provide information on which third countries the personal data was transferred to under Article 15(2) GDPR. Moreover, the controller argued that there was also no obligation to provide an explanation to the codes and numbers relating to personal data contained in the technical log files. There was also no obligation to provide this explanation in a specific language other than English. EDPB’s Guidelines The court agreed with the controller that the EDPB and Article 29 Working Party Guidelines are not legally binding. However, the court held that they can be used to support the interpretation of the GDPR. The court further
The controller, Microsoft Corporation, provides the service “Microsoft advertising” which enables website operations to place adverts in the search results of the "Microsoft Search Network". It can also collect information about the visitors to a website and to place targeted adverts for these visitors via cookies. The data subject visited third-party websites. She claims that the controller’s cookies were placed on her device without her consent. A forensic analysis of the recorded network traffic revealed that cookies from the controller had been placed on the data subject’s device without their consent. The data subjected sought injunctive relief at the Regional Court of Frankfurt am Main (“Landgericht Frankfurt am Main”) and requested the court to order the controller to refrain from using cookies on her end devices without her consent. The court refused to issue an interim injunction and dismissed the case. The court stated that grounds for an injunction were lacking and that the data subject did not demonstrate that they would otherwise suffer considerable disadvantages and that they cannot reasonably be expected to wait for the main proceedings. The court held that the data subject had the option to block the storage or reading of cookies via the internet browser settings, while the controller would have to change its complete processing, costing enormous effort in terms of time and money. Thus, the balance of interests is therefore in favour of the controller. The data subject appealed this decision at the higher regional court of Frankfurt (“Oberlandesgericht Frankfurt am Main”), arguing that the balance of interests is in their favour as there can be no right to exercise an unlawful business model. Moreover, the data subject had to live with the uncertainty of the whereabouts of its data, the associated loss of control and the fear of disclosure to unauthorised third parties. The data subject requested the court to amend the first judgement, to grant the i
Clearview AI Inc. (the controller or Clearview) is a company established in the United States. The controller scrapes the internet for photos of faces. Users of its services can upload a photo of the face of a person and obtain other photos of the same person, based on facial recognition technology. They also obtain the URLs where those photos were found. These searches may identify a data subject’s social media accounts or other webpages that disclose further personal data about them. The controller claimed to have the biggest known database of facial images with more than 10 billion images. In February 2020, September 2020 and January 2021, the data subject submitted access requests as well as objections to processing to the controller via the email address privacy@clearview.ai. The controller did not respond until 29 January 2021, when it instructed the data subject to exercise its rights using a web form. The data subject submitted the form but did not receive a response. In March 2021 the data subject sent another email to the controller attempting to exercise their rights. The controller again responded by instructing them to fill out the web form. On 10 March 2021 the data subject filed a complaint with the Spanish DPA (AEPD) alleging numerous infringements of the GDPR. The AEPD archived the complaint in September 2021 on the basis that it lacked competence because the controller did not fall within the scope of Article 3(2) GDPR. This provision applies the GDPR to controllers established outside of the EU – in this case, the US – when they offer goods or services to data subjects in the Union of if they monitor their behaviour. The AEPD considered that the provision was not applicable in this case. The data subject initiated proceedings before the Administrative Chamber of Spain’s Audiencia Nacional (the Court) to challenge the AEPD’s decision. It argued that the AEPD is competent to handle the complaint because Clearview processed EU data subjects’ data
The controller is a Dutch radio and television broadcaster. On its website it offers a forum called “Radar”, where people who had signed up can post articles and reply to other people’s posts. The users must comply with some conditions of use, called “Huisregels” (House rules). Compliance with those rules is monitored by the moderators of the forum. The data subject has been participating in the forum since 2006. After being banned for the violation of the house rules, the data subject filed an access request. The controller did not act on this request. Therefore, the data subject sued the controller before the District Court Midden-Nederland (Rechtbank Midden-Nederland), asking the court to order the controller to comply with the access request and provide him a copy of his information relating to the violation of the house rules. The controller argued it was not obliged to act on the access request since the so called “journalistic exception” applied: Article 85 GDPR provides that Member States shall reconcile by law the right to protection of personal data with the right to freedom of expression and information, including the processing for journalistic purposes. To this purpose, [https://wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=43&z=2018-05-25&g=2018-05-25 Article 43 of the GDPR Implementation Act] (Uitvoeringswet Algemene verordening gegevensbescherming – UAVG) foresees that Article 15 GDPR shall not apply to the processing of personal data exclusively for journalistic purposes. On 4 January 2023, the court stated that the controller could not rely on the so called “journalistic exception”. Moreover, it ruled that the controller had already sufficiently given the data subject access to his personal data, but ordered it to provide him with the information as described in Article 15(1)(a) to 15(1)(h) GDPR. Both the data subject and the controller appealed the decision before the Court of Appeal of Arnhem-Leeuwarden (Gerechtshof Arnhem-Leeuward
On 12 September 2018, a data subject submitted a petition to the DPC concerning Google Ireland Ltd’s (the controller) data processing for targeted advertising through its real time bidding (RTB) online advertising system. A petition is an informal request which does not give a petitioner party rights in a GDPR procedure. Thus, in 2019, the data subject followed up his petition with a complaint alleging violations of Articles 5(1)(a), (c) and (f) GDPR. In particular, the complaint emphasised the lack of adequate safeguards to ensure the integrity of personal data. The complaint claimed that the controller’s use of the RTB system on millions of websites and broadcasting of personal and sometimes sensitive data to other tracking companies with no controls constituted the biggest data breach ever seen. In January 2020, the DPC informed the data subject that it had initiated an ex officio inquiry into substantially the same issues as the complaint. While the DPC confirmed that the data subject’s case was being treated as a complaint, the DPC also said that it was examining matters in the context of an inquiry that could substantially overlap with and influence the outcome of the complaint. Thus, it stated that it would handle the complaint in line with and based upon the progress of the inquiry. As the inquiry unfolded, it became clear that the data subject and DPC disagreed about how confidentiality and security concerns were implicated. The scope of the DPC's inquiry focused on legal basis and transparency issues rather than the Article 5(1)(f) GDPR claims. In several communications, the DPC stressed that it would “continue[] to have an open mind in relation to the central matters” of the inquiry and that when it resumed its examination of the Complaint, it would again consider whether issues relating to data security should be the subject of scrutiny. It also noted that the result of its investigation may end up being functionally the same, with the effect that the
A French company, Veesion created a software for CCTV cameras aimed at detecting suspicious behaviour (gestures) of people. It was based on an algorithmic processing of the images collected by the cameras. The software was popular amongst shops, using it to monitor their commercial premises. The French DPA (CNIL) found the software violated the GDPR, especially the right to object under Article 21 GDPR, and informed the company of the result of the investigation. Also, the DPA mentioned the company clients had to be informed about the outcome of the investigation. In response, the company claimed the DPA's legal reasoning was wrong, mostly because the right to object didn’t apply to the processing of data within the system, pursuant to Article R. 253-6 of the Code of Internal Security ([https://www.legifrance.gouv.fr/codes/texte_lc/LEGITEXT000025503132/ Code de la sécurité intérieure]). Consequently, the company requested the French Supreme Administrative Court (Conseil d’Etat) to suspend the execution of the letter. The court rejected the request as unfounded. The Veesion software was not covered by Article R. 253-6 of the Code of Internal Security, as it was applicable only to certain category of the CCTV, namely the CCTV related to the national security, protection against threats to public security or their prevention. Hence, it didn't cover an algorithmic processing of the images collected by the cameras, which was the functionality of the software. The court didn’t come across with any other reasons to suspend the execution of the letter or making the software compliant with the provisions of law.
On 01 September 1999, the data subject started working for the controller, a medical service responsible for providing health assessments for health insurers. Starting on 22 November 2017, the data subject became unable to work due to illness. Their health insurer ordered an assessment of the data subject's disability on 06 June 2018 due to doubts about their inability to work. This assessment was to be done by the controller, who also happened to be the employer of the data subject. The controller had specific rules in form of a "special case" unit of 36 people in place for this occurrence to prevent preferential treatment or discrimination for its employees. A developed role concept within this unit ensured that the relevant expert assessments were not processed by employees who worked with the person concerned in a department, which was also technically secured with separate storing of key and file. Merging was only possible using a key stored in an encryption library. An employee the data subject was familiar with produced the required assessment report for the controller and the health insurer in cooperation with the data subject's doctor via a phone call. On 01 August 2018, the data subject requested a coworker to check whether an assessment report about them was available in the database and to send a picture of it. The coworker complied. On 15 August 2018, the data subject requested compensation of €20,000 from the controller outside of court, but they denied the claim. The data subject also sought material damages in the second instance by way of a payment and declaratory action, each based on Article 82(1) of the GDPR and § 823(1) of the German Civil Code (BGB) in conjunction with Article 2(1) and Article 1(1) of the Constitutional Law (GG). The controller then expressed an immediate termination on 05 December 2019 and 12 December 2019 respectively. The data subject alleged the controller violated their right to privacy based on Article 82(1) GDPR, saying
Scalable capital (‘controller’) managed a trading application in which the data subject opened accounts and entered personal data to do so. In 2020, their personal data were seized by third parties whose identity remains unknown. According to the controller, those data had not been used fraudulently. The data subjects brought an action before the Amtsgericht München (Local Court, Munich, Germany) seeking compensation for the non-material damage which they claimed to have suffered as a result of the theft of their personal data. The court stayed the proceedings and decided to refer the following questions to the CJEU: # Does the right to compensation under Article 82(1) GDPR, including the determination of the amount of the compensation, have a purely compensatory function, and in some cases a satisfactory function? # Does the right to compensation also have an individual satisfaction function – understood as the private interest of the injured party in seeing the behaviour that caused the damage penalised? When determining the compensation, is additional weight attributed to only deliberate or grossly negligent data protection infringements? # Is the compensation for non-material damages to be determined on the basis of a structural order of precedence which attributes less weight to the detrimental effects of a data infringement than to the detrimental and painful effects associated with a physical injury? # Can a national court only award minimal compensation in the light of the non-serious nature of the damage? # Does identity theft under recital 75 GDPR require the offender to have actually assumed the identity of the data subject, meaning to have somehow impersonated that person, or does the mere possession of such data constitute identity theft? On the first and second questions First, the CJEU pointed out that it has already held that Article 82 GDPR fulfills a function that is compensatory and not punitive (§22 of the Judgement, and See [https://gdprhub
A consultancy firm (‘controller’) was informed by its clients (‘data subjects’) that their postal address have changed. In July 2020, the data subjects asked the controller to draw up their tax return from the previous year. Having received no reply, they contacted the controller who informed them that the tax return had been sent to them by post in September 2020. The new occupants of the former address of the data subjects informed them that they received an envelope with the names of the data subjects and that they had opened it by mistake. When they realized that these documents were not addressed to them, they placed the documents back in the envelope and handed it to close relatives of the data subjects so that they could collect it. When the data subjects collected the envelope, they found that it contained only a copy of the tax return and a cover letter. They assumed that the envelope also contained the original version of that tax return which included personal data including their names, dates of birth of the data subjects' and their children, tax identification numbers, bank details, information relating to their membership of a religious community, disabled status of a member of their family, professions and workplaces. The data subjects brought an action before Amtsgericht Wesel (Local Court, Wesel, Germany) seeking for compensation for the non-material damage under Article 82(1) GDPR, which they believe they have suffered as a result of the disclosure of their personal data to third parties. They assessed the damages at €15,000. The local court stayed the proceedings and referred the following questions to the CJEU: # To claim compensation under Article 82(1) GDPR, is it necessary to establish that a further adverse effect on the data subject has occurred, beyond the infringement of the GDPR as such? # Does the claim for compensation for non-material damages under Article 82(1) GDPR require the damage to reach a certain magnitude? # Is it sufficien
The data subject was employed by the controller and requested access to information under Article 15(1) GDPR regarding a transfer decision and a disciplinary warning. The controller responded within the deadline, providing documents and partially redacted records. The data subject claimed the information was incomplete and asserted that years of delayed access left them unable to assess how the personal data was processed. They sought immaterial damages under Article 82(1) GDPR, arguing a loss of control and uncertainty, alternatively relying on national liability doctrines. In the original decision, the labor court dismissed the claim. After a revision, the higher court awarded €2,000 in damages. Both parties appealed to the Federal Labor Court. First, the court opined that mere infringement of the right of access, and the abstract “loss of control” inherent in any such infringement, does not constitute compensable damage, as Article 82 GDPR requires a distinct, concrete harm causally linked to the violation. It considered that negative feelings or fears may qualify as immaterial damage only if objectively justified; a purely hypothetical risk of data misuse is insufficient. Unlike a data breach, delayed or incomplete access does not itself increase misuse risk. As no concrete harm was substantiated, neither GDPR-based nor alternative national-law damage claims succeeded. Hence, the court denied any compensation under Article 82(1) GDPR, as the data subject failed to demonstrate an immaterial damage had occurred.
The data subject is a civil servant that works at a municipality (the controller). In 2017, the data subject had a stroke that led to a longer sick leave of the data subject. Following a medical examination by the public medical officer, the controller decided to attempt to transfer the data subject to early retirement in September 2018. This attempt ultimately failed, as the data subject successfully challenged the early retirement before the Administrative Court Stuttgart (Verwaltungsgericht Stuttgart – VG Stuttgart) in November 2021 therefore remaining a civil servant. However, on 5 July 2018 the controller had already sent out a job offer to about 80 staff members. It included the information that the previous staff member (the data subject) was about to be transferred to early retirement due to his incapacity to work. On 16 February 2022, the data subject sued the controller for €20,000 in damages before the VG Stuttgart due to the disclosure of his health information and claiming that the transfer of the his file to the municipality’s lawyer was also illegal. The court found that the lawsuit was admissible and belonged before the administrative court, even though [https://www.gesetze-im-internet.de/gg/art_34.html Article 34 Basic Law (Grundgesetz – GG)] assigns all claims of official liability to the civil courts. The VG Stuttgart argued that Article 82 GDPR was not an official liability claim. The court awarded the data subject €2,500 in non-material damages. The court held that there was a violation of Article 9(1) GDPR due to the disclosure of the alleged disability for service in the job offer the controller had sent out. This was health data under Article 4(15) GDPR, because the inability to work was due to the health status. The wording “previous office-bearer” made the data subject identifiable. The disclosure was neither necessary under Article 9(2)(b) nor (f) GDPR. The court also found that the data subject had suffered a non-material damage. The da
On 13 February 2023, the DPA imposed a fine of € 200,000 EUR to Ida Tallina Central Hospital (‘controller’) for the unlawful disclosure of health data within the meaning of Article 9(1) GDPR. A member of the management board threw them into an open bin outside of the hospital and open to public access. With this conduct, the controller violated the requirements of Article 32(1)(b) GDPR to ensure the confidentiality of the services processing personal data. Pursuant to Article 62 PDPA, the controller committed a misdemeanour. The decision of the DPA was appealed by the controller. On 31 August 2023, the Harju County Court (‘first instance court’) annulled the decision of the DPA and ruled that the controller could not be punished for committing a misdemeanour because of the principle of derivative liability applied. According to this principle: 1) a legal person, such as a hospital, can only be liable for an offence if the conduct of its body, member, manager, or competent representative met all the elements of a tort or delict, and 2) if the act was committed in the interests of the legal person. In this case, the violation was attributed to a member of the management board, but the misconduct did not meet all the legal elements of the offense to be done in the interest of the hospital. Since this was not the case, the hospital could not be held liable for the alleged infringement. On 21 December 2023, an appeal against the decision of the first instance court was filed by an out of court proceeding by the data subject which sought the annulment of the above decision. The controller argued in the appeal proceeding that the misdemeanour proceedings should be terminated as the offence is time-barred according to 29(1)(5) Code of Misdemeanour Procedure (‘VTMS’). The Supreme Court clarified that in Estonia, due to the unique structure of their legal system, fines for GDPR violations are imposed through misdemeanour procedures by a supervisory authority. The sam
The controller, Verifiera AB, operates a database that includes court decisions pertaining to involuntary psychiatric care and care of persons with substance abuse. The controller's business operations falls within the scope of the Swedish constitutional law on Freedom of Expression (Yttrandefrihetsgrundlag - YGL) due to their publishing license ("utgivningsbevis"). The Swedish DPA (Integritetsskyddsmyndigheten - IMY) issued a reprimand and an injunction against the controller. The DPA found that the publication of health-related court decisions by the controller violated Article 9(1) GDPR, which prohibits the processing of personal data related to health. It ordered the controller to take certain measures to comply with Article 9(1) GDPR. Although [https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2018218-med-kompletterande-bestammelser_sfs-2018-218/ Chapter 1, §7 of the Swedish Data Protection Act], states that the GDPR and the implementing national law shall not apply to the extent that this would conflict, among others, with the constitutional law on Freedom of Expression, the GDPR is still applicable when sensitive data is published under [https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/yttrandefrihetsgrundlag-19911469_sfs-1991-1469/#K1 Chapter 1, §20 YGL]. [https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/yttrandefrihetsgrundlag-19911469_sfs-1991-1469/#K1 Chapter 1, §20 YGL] states: “The provisions of this Constitution shall not preclude the enactment of legislation prohibiting the disclosure of personal data # revealing ethnic origin, skin colour or other similar characteristics, political opinions, religious or philosophical beliefs or trade union membership # concerning health, sex life or sexual orientation, or # which consists of genetic data or biometric data to uniquely identify a natural person.” Thus, the DPA held that Article 9(1) GDPR is ap
The data subject has an Iranian nationality and applied for asylum in the Netherlands in 2016. After two applications and two appeals, the State Secretary for Justice and Security (the controller) granted the data subject asylum on 25 August 2021 and provided the data subject with a temporary asylum residence permit. On 22 September 2021, the data subjected requested access under Article 15 GDPR to their personal data that the controller processed and stored. On 22 October 2021, the controller replied to the access request and, amongst other things, provided the data subject with an overview of the disclosures of the data subject’s personal data. This showed that the controller transmitted the data subject’s personal data to, among others, the Central Agency for the Reception of Asylum Seekers (“Centraal Orgaan opvang asielzoekers - COA”) and the Repatriation and Departure Service (“Dienst Terugkeer & Vertrek - DT&V”). The data subject then objected to the processing of their personal data (specifically personal data belonging to special categories under Article 9 GDPR), namely the sharing of those data with the COA and DT&V. The controller rejected the objection of the processing on 7 December 2021. The data subject appealed this decision at the District Court of Northern Holland (“Rechtbank Noord-Holland”), and also sought damages under Article 82 GDPR for the unlawful processing of their (special categories of) personal data. The controller argued that there was no unlawful processing of (special categories of) personal data of the data subject and that the sharing of the personal data with the COA and DT&V was necessary under Article 6(1)(e) GDPR for the performance of a task carried out in the public interest or in the exercise of official authority of these agencies. The COA's tasks include providing guidance and accommodation to asylum seekers. The controller argued that this task also requires the processing of special categories of personal data under Arti
On 31 December 2022, the Irish DPA (“DPC”) prohibited Meta Ireland from using a contract under Article 6(1)(b) GDPR as a legal basis for behavioural advertising in connection with the Facebook and Instagram services. Meta Ireland was required to bring its processing activities related to behavioural advertising into compliance with Article 6(1) GDPR within three months. Meta Ireland responded by changing its processing basis to legitimate interest under Article 6(1)(f) GDPR. On 5 May 2023, the Norwegian DPA (“Datatilsynet”) requested under Article 61(1) GDPR the DPC to introduce a temporary ban on Meta Ireland’s processing of personal data for purposes related to behavioural advertising. The Datatilsynet held that legitimate interest was not a proper legal basis, either. The DPC did not comply with the request. On 14 July 2023, the Norwegian DPA issued a temporary ban themselves against the controllers Meta Ireland and Facebook Norway under Article 66(1) GDPR in combination with Article 58(2)(f) GDPR (see summary of the DPA's decision here). This only concerned processing activities in Norway. The DPA also stated its intention to request an urgent binding decision from the EDPB under Article 66(2) GDPR. On 3 and 4 August 2023, Meta Ireland and Facebook Norway applied for a temporary injunction against the DPA's decision, demanding that the DPA would be prohibited from implementing the decision. The Oslo District Court issued a ruling on 6 September 2023 and concluded that there was no probable cause for temporary injunction and dismissed the cases. The court also found that the conditions had been met under Article 66(1) GDPR for making an urgent binding decision. The deadline for compliance with the ban was 4 August 2023, however, Meta Ireland and Facebook Norway did not comply. Therefore, on 7 August 2023, the DPA issued a penalty of €86,992.56 (NOK one million) per day for failure to comply with the decision of 14 July 2023 based on §29 of the Norwegian Person
The data subject applied for legal aid for court proceedings. The application for legal aid and the data subject’s objection as well as the decision of the district court to grant legal aid were submitted to the lawyer of the other party in the proceedings, who forwarded these documents, including the declaration of assets, to their client. Subsequently, these documents were forwarded by the other party in the proceedings to a third party. On 6 April 2023, the data subject lodged a complaint with the Austrian DPA (“Datenschutzbehörde – DSB”) against the other party for forwarding the documents to a third party. The DPA held that the forwarding of the application for legal aid, including the declaration of assets, violated the principle of data minimisation pursuant to Article 5(1)(c) GDPR. The other party appealed this decision at the Federal Administrative Court (“Bundesverwaltungsgericht - BVwG”). The court upheld the appeal and annulled the DPA’s decision. The court held that the DPA failed to question the third party, to whom the application for legal aid including the declaration of assets had been forwarded to, whether they had already been aware of the transmitted data beforehand. As the DPA had not made any findings on this question, the court could also not establish facts necessary for a decision on this matter. Therefore, the case should be referred back to the DPA to complete the facts of the case quickly and in a cost-saving manner. The DPA appealed this decision at the Supreme Administrative Court (“Verwaltungsgerichtshof - VwGH”) and argued that it cannot be inferred from the wording of Article 57(1)(f) GDPR that the DPA is obliged to investigate beyond "to the extent appropriate". In the present case, it could not be said that the "appropriate extent" of the investigation was not reached. Moreover, there was also a lack of case law from the Administrative Court on Article 57(1)(f) GDPR. The annulment of the DPA’s decision by the Federal Administr