GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 21 October 2026 · Updated daily
Court case BGH VI ZR 405/18
The plaintiff was the managing director of a regional association of a charitable organisation. In 2011, this regional association had a financial deficit of almost one million euros. At the time, both of these events were reported in the regional daily press, mentioning the plaintiff's full name. The plaintiff now requests the defendant, as the person responsible for the internet search engine "Google", to refrain from including these press articles in a search for his name in the results list. The Regional Court dismissed the action. The plaintiff's appeal was unsuccessful. The question was whether Google has to delist press articles of the plaintiff according to Article 17 GDPR. The court hold that the basic rights of the plaintiff does not outweigh the interests of the search engine and the interest of its users, the public and the press organs for the linked newspaper articles, also taking into account the time that has passed by, this is why he cannot base his claim on Art. 17 GDPR.
Court case BGH VI ZR 476/18
The applicant was an authorised officer of one of those companies. In 2015, several articles appeared on the website of a US-American company, whose objective, according to its own statements, is "to make a lasting contribution to fraud prevention in the economy and society through active education and transparency", by critically examining these companies. One of these articles was illustrated with photos of the plaintiffs. The business model of the website's operator was in turn critically reported, among other things with the accusation that she was trying to blackmail companies by first publishing negative reports and then offering to delete the reports or prevent negative reporting for a so-called protection fee. Google was asked to delete the thumbnails. The German Federal Court of Justice (Bundesgerichtshof - BGH) stayed proceedings and referred two questions to the Court of Justice of the European Union for a preliminary ruling: - Is it compatible with the rights of the data subject in Article 7,8 CFR to weigh up the possibility to file an interim injunction as legal protection and receive a preliminary clarification on the right to get delisted as a decisive factor in the decision on conflicting rights and interests arising from Article 17(3)(a) GDPR? - Can the BGH oblige the defendant to pay the costs if third parties placed photos which are shown as a thumbnail in the search engine of the defendant, even if the third party's website is linked but not specifically named when the thumbnail is displayed by the search engine and the resulting context is not displayed by the internet search service?
Court case 1 K 473/19.MZ
The claimant brought action against the termination of an investigation by the regional DPA (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz – LFDI). He had made requests under Art 15 GDPR to a number of regional public authorities - several courts, attorney general’s offices, a ministry and a parliamentary body – but didn’t see his rights under GDPR met, except in one case. In particular, he didn’t feel informed about which information could be deleted. The claimant referred to a lack of consistency between the regional authorities in the application of Article 15 and a generally too narrow interpretation compared to its application on the national level. The DPA terminated the investigation with reference to a lack of provision of information by the claimant. Was the termination of the investigation by the regional DPA lawful and, in this context, did the regional public authorities respond adequately to the requests under Article 15 GDPR? The court denies admissibility of the claim and dismisses it. It was not possible to investigate the claims and hence confirm the necessary possible infringement of claimants’ rights since he did not provide sufficient information. Subsequently, the court explains that, had the claim been admissible, it could not have been successful. It confirms that the regional DPA met its obligation to request missing information from the claimant and that the claimant had not responded to this. In particular, the court explains, - although no legal expertise or analysis could be expected from him - had the claimant failed to specify which acts or omissions he felt were in breach of which right granted to him under GDPR, in particular Article 15. Not even if or why he was expecting the respective authorities to hold personal data on him, which of his requests had been responded to or not, and why those replies received were in his opinion not satisfactory. This lack of information also inhibited con
Stichting Philadelphia Zorg
By separate decisions dated 15 October 2018, the Amsterdam Legal Aid Board rejected appellant's requests for additional legal support. Appellant requested a copy of his and his stepdaughter’s personal data under Article 15(3) of the GDPR from Zilveren Kruis, Stichting Philadelphia Zorg, Stichting Cordaan and another party. On 30 August 2018 and 28 September 2018, appellant submitted six applications for additional legal assistance in proceedings against these parties under Article 35 of the GDPR Implementation act, on the grounds that, in his opinion, insufficient personal data had been provided. The Amsterdam Court of First Instance rejected the appellant's complaint on the ground that this problem did not need a lawyer. Appellant disputes this decision in the Council of State. According to the appellant, he only received an overview of the personal data in response to his data subject request, although he needed more information for a successful damage compensation procedure. He also argues that the GDPR case law demonstrates that this is a complex legal area. Appellant also pointed out that his data subject requests were, in essence, rejected, and his opponents hired large law firms to handle the case, which makes it emotionally distressing for him and his stepdaughter. Finally, he also has a pending appeal against the FOI request to Philadelphia before the Council of State. All of this proves, in the appellant's view, that the case is legally and factually complex. Appellant also questioned the fairness of the policy of the Amsterdam Legal Aid Board and claimed the violation of the right to effective remedy and fair trial. The Council rejected the appeal based on the following: * The policy of the Legal Aid Board does not in general provide for legal support for data subject requests under Article 35 of the GDPR Implementation action, but exception can be made where cases are considered complex enough. * The arguments paid down by the appellant did not prove the legal and factual complexity of the case. The claim that his DSARs were rejected were not supported by any details or documents. * The Board was entitled to expect the appellant to explain in his own words why he expected more data in response to his data subject access request. * The fact that there are several ongoing proceedings, including the FOI request appeal, does not in itself prove the complexity of the proceedings for which appellants' requests were submitted. * Nor does the fact that conducting the proceeding is emotionally burdensome for the appellant.
Court case 14 U 150/23
The controller operates a social network in Europe. The data subject has had a private account on this network since 2008. In September 2022 an unknown third party distributed child pornography - violating the controller's terms and conditions - using the data subject's account without authorisation. On 11 September 2022 the data subject's account was temporarily deactivated. The controller had not previously heard the data subject and initially did not give a reason for blocking . Due to the deactivation, the data subject was unable to use the network's functions. The data subject contacted the controller on 28 September 2022 and requested - inter alia - to restore the user account and remove the deletion and blocking notes from the data subject's user data record. On 1 October 2022, the account was reactivated. The blocking of the account and the deletion of the posts created by third parties are still recorded in the controller's data set. = The data subject claimed in the first instance that the deactivation of her account was unlawful but the regional court mostly rejected the action and the data subject appealed this decision requesting - inter alia - that # It is determined that the deactivation of the data subject's profile was in breach of contract. # The controller is ordered to correct the data subject's data stored by it so that all deletion and blocking notes are deleted from the user data record # The controller is ordered to refrain from blocking the data subject because of the publication of contributions or from deactivating her account for this reason without informing her in advance of the intended blocking/account deactivation and granting the opportunity to respond with a subsequent new decision. Alternatively, in the event that the court considers the above application to be too far-reaching: The controller is ordered to refrain from blocking the data subject on www.xxx.com without informing her in advance of the intended blocking/account dea
ING Bank N.V.
A special code (“A”) registration was made at the Central Credit Information System (CKI) on 21 March 2018 in connection with the balance deficit on an ING payment account of the complainant that took place in 2016. On 19 November 2018 code A was changed to code H, which remains visible for the period of five years from that date. The Court considered four complaints behind the appeal. Complaint 4 is challenging the proportionality of the registration in the Central Credit Information System (CKI), claiming that it should be deleted because it disproportionately affects his business. For example, the complaint was denied a business loan necessary to continue his business operations. The Court must assess necessity and proportionality of the processing the complainant has objected to and decide whether the interests, rights and freedoms of the complainant prevailed in this case. The Court considered that ING’s interest in this processing was to prevent a debt problem and to inform lender about possible risks. ING was able to show evidence that the complainant’s financial situation was not stable. The Court has agreed with the complainant that the code registration at the CKI may indeed constitute an obstacle to receiving credit. However, it has also considered that it was not possible to ascertain from the letters of loan refusal that this registration was among of the reasons of the credit denial. Complainant’s financial situation may as well have been considered insufficient by the potential lender. In the view of the above, the Court ruled that there are compelling legitimate interests in maintaining the registration; the processing was necessary and proportionate.
Executive board of the municipality of Haarlem
Complainant has submitted a data subject access request to the executive board of the municipality of Haarlem on 24th of July 2019. On 26th of October 2019 complainant lodged an appeal in connection with a failure to take action on his request. On 20th of December 2019 the municipality made a decision on the request. On 7th of February 2020 the District Court of the Northern Netherlands declared the appeal well founded and ordered the municipality to pay a penalty of EUR 1 442 to the complainant and cover the court fee of EUR 174. The municipality has opposed to this judgement. The Court must decide whether the appeal of the complainant can be considered well-founded without a reasonable doubt. The municipality is of the opinion that the judgement of the 7th of February 2020 did not take into account the argument that the claimant was abusing his rights in order to get paid for the delayed decision on the right of access. Complainant completely ignored requests to provide additional information necessary to action the access request, such as a request for a copy of an ID. Furthermore, the complainant's letter sent to the municipality on 24th of August 2019 cannot be viewed as a penalty payment notice under Article 6:2 of the Dutch Administrative Law Act because the content of that letter doesn't make it clear what request it refers to, the municipality is not requested to make a decision within a certain period of time and the letter does not clearly state that a penalty payment will be required in the absence of such decision. The claimant is of the opinion that there was no abuse of rights; the letter constitutes a valid penalty payment notice of because the municipality hasn't disputed its validity in the previous proceedings and because penalty payment notices were allowed to be submitted in free form. The Court established that the parties were not disputing the fact that the decision on the complainant's access request under GDPR should have been take
Court case AWB- 20_7155 VV
The data subject went through a debt assistance process at young age, due to medical costs and costs of her studies. However, she did her utmost to get rid of her debts. Now she has a stable job and would like to purchase a house. The registration in the credit registry was decisive in the refusal to grant a mortgage and the documents do show that in any event Rabobank and ING do not grant a mortgage if there is such a registration. The applicant cannot obtain a mortgage with the current registration, or it is very difficult and on much less favourable conditions. Does an entry in a credit registry that precludes somebody from obtaining a credit has to be deleted if the interests of the data subject outweigh the responsible granting of mortgages. The applicant cannot obtain a mortgage with the current registration, or it is very difficult and on much less favourable conditions. The applicant therefore has a substantial interest in deleting this registration in light of the actual reason for the debt assistance programme and her development.
VQ
VQ submitted a petition to the Petitions Committee of the Parliament of Land Hessen, in Germany. After that, he made an access request, pursuant to Article 15 GDPR. In particular, he asked to have access personal data concerning him, recorded by that Committee when dealing with his petition. However, the President of the Parliament of Land Hessen rejected the request, arguing that the GDPR was not applicable as the petition procedure constituted a function of the parliament, activity that would fall outside of its scope. Dissatisfied, VQ brought an action before the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden, Germany) challenging this decision. While considering that German law did not grant the right to access in this context, the Court was uncertain whether: a) the Committee could be categorised as a ‘public authority’, within the meaning of Article 4(7) GDPR; and b) it could be considered as the ‘controller’ of VQ’s personal data. Besides that, that Court was also uncertain whether it itself could be considered as a ‘court or tribunal’, within the meaning of Article 267 TFEU, read together with the second paragraph of Article 47 of the Charter. In those circumstances, it decided to stay the proceedings and to refer the following questions to the CJEU for a preliminary ruling: (1) Is Article 15 GDPR applicable to the committee of a parliament of a Federated State of a Member State that is responsible for dealing with the petitions of citizens and is that committee to be regarded as a public authority within the meaning of Article 4(7) GDPR? (2) Is the referring court an independent and impartial court or tribunal within the meaning of Article 267 TFEU read in conjunction with the second paragraph of Article 47 of the Charter? The CJEU considered that, by its second question, the Verwaltungsgericht Wiesbaden asked for a clarification on the admissibility of its request for a preliminary ruling, given that being a ‘court or tribunal
The controller is Google and the data subject is a plastic surgeon. One of data subject's patients filed a complaint against data subject in 2014 for a lack of aftercare after an operation. This led, ultimately, to a procedure before the Central Disciplinary Tribunal for Health Care, of which the result was that data subject was conditionally suspended for a period of four months, with a probationary period of two years. Now, when googling the data subject's name, links to certain websites (www.zwartelijstartsen.nl and www.drimble.nl) appeared between the search results. These links referred to articles that mentioned the data subject's name, their BIG number (unique identifier for health care personnel), their speciality, and the ruling of the Disciplinary Tribunal which led to the data subject's suspension. In 2017, the data subject requested Google to remove the links. Google rejected this request and stated that the URLs in the search results were justified by the essential interest of the general public to have access to them. The data subject then brought the issue to Court, [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBAMS:2018:8606&showbutton=true&keyword=C%2f13%2f636885%2fHA+RK+17-301 and the Court of First Instance upheld their claim.] Google then filed for appeal. The Court of Appeal conducted a balancing test pursuant to Article 21 GDPR, and found that Google's interests and that of third parties, outweighed the data subject's interest. Hence, the right to freedom of information of Google and third parties outweighed the right to privacy and protection of personal data of the respondent. In this regard, the Court considered that established case law (GC and others, and CJEU Costeja), in which it is stated that, in principle, the public's right to freedom of information must give way to the right to privacy and protection of personal data. However, according to the Court, in this case there were special circumstances, because of whi
Court case AWB - 19_1554
An applicant asked to erase all data on him to the municipality. After having investigated, it appeared that a conversation between two municipal agents could reveal the identity of the applicant. The applicant considered the processing was illegal and therefore claimed for damages to the city. Are the data where the name of the data subject still personal data ? is the processing in line with the GDPR ? The Court decided that the discussion made it possible to identity the applicant and therefore the GDPR was applicable. However, the processing was compliant with the GDPR since the aim was to prevent abuse of the law by applicants, which is the legitimate interest of the municipalities. No damages were granted.
Court case AWB- 20_5255
The plaintiff asked the minister of justice to access personal data on his detention. The minister did not answered within the deadline. The court instructs the Minister, within four weeks of the date of dispatch of the decision, to take a decision of the complainant and order the payment of € 100 for each day without taking such a decision. The court also decides on a penalty of 1442 euros for failure to decide on the objection in good time.
Court case N° 430810
CNIL issued a fine of € 50 million against Google in CNIL - SAN-2019-001 after two complaints filed by noyb and La Quadrature du Net on the basis of lack of transparency of the privacy policy and the lack of valid legal basis to process the data. Google appealed the decision of the CNIL on several grounds, including the lack of competence of the CNIL since Google would have its main establishment in Ireland. The Conseil d'Etat confirmed the decision of the CNIL in all points and considered that the CNIL was competent to deal with the case since Google did not have a main establishment in the EU at the time of the decision of the CNIL. The Conseil d'Etat also confirmed that Google's privacy policy was not sufficiently transparent since the information was disseminated throughout several documents and was not easily accessible. The Conseil d'Etat also confirmed that the consent obtained by Google was not valid since it was not sufficiently informed and specific (the users had to accept all processing operations without the possibility to refuse specific processing operations in the first layer of information). Finally, the Conseil d'Etat confirmed that the fine was not disproportionate considering inter alia the seriousness of the violation, the financial capacity of Google, the impact of people and the duration of the violation.
Court case AWB - 19 _ 1687
The plaintiff complained about factual inaccuracies in reports on his medical situation and possibilities for performing work in the context of granting a work benefit. He requested rectification of data in these reports. The defendant claimed it corrected the inaccuracies by issuing a new report but the plaintiff found this not sufficient since the inaccuracies remain in the initial reports and alleged violation of his right to rectification. The Court had to assess the way in which the rectification should be carried out by the defendant considering also its technical capacity. The District Court invoked Article 24 and Recital 78 GDPR and concluded that data controllers must take appropriate technical and organisational measures that are necessary to ensure that the requirements of GDPR are met. It found that an additional report cannot be considered sufficient to fulfill the right to rectification. The controller must use its best efforts to ensure that policies and systems are in line with the GDPR including transparent and clearly recognisable rectification of inaccuracies other than merely adding a document in a medical file. The Court ordered the controller to investigate the possibilities of complying with the right to rectification within six weeks and notify the Court if it will make use of this opportunity within two weeks.
unknown data subject
On 19.02.2019, the data subject sent an access request under Article 15 GDPR to a controller (an Austrian municipality). The request was signed using an electronic signature. The controller did not consider the electronic signature a sufficient form of identification and required the data subject to produce an ID card under Article 12(6) GDPR. As the data subject did not do so, the controller refused to handle the access request under Article 11(2) GDPR. The data subject filed a complaint with the DSB, which shared the data subject's view and held that the electronic signature was a sufficient form of identification for an access request. The controller filed an complaint with the BVwG against the decision of the DSB. Is an electronic signature under § 4(1) SVG and Article 3(10) eIDAS Regulation sufficient to identify a data subject regarding an access request? The BVwG upheld the decision of the DSB. It ruled that the controller had never stated the reasons for its doubts concerning the identity of the data subject. The full name, address and e-mail address of the data subject were known to the controller and also used in the correspondence with the data subject. In addition, the data subject had put a qualified electronic signature on its access request. Hence, it was unclear, why the controller should have any doubts on the data subjects identity. Moreover, the BVwG shared the view of the data subject and the DSB that an electronic signature under § 4(1) SVG and Article 3(10) eIDAS Regulation a sufficient form of identification. The provision of an ID card is not the only mean of verifying a data subject's identity. Lastly, the BVWG held that § 24 Abs. 5 DSG which would bar the DSB (and BVwG/VwGH) from ordering a public entity to comply with the data subject's requests does not apply due to the primacy of application of Article 58(2)(c) GDPR. Consequently, the BVwG ordered the controller to comply with the data subject's request under Article 15 GDPR.
COÖPERATIVE RABOBANK U.A.
Rabobank granted the plaintiffs two mortgage loans. There were arrears about which Rabobank sent letters to the plaintiffs. In these letters, Rabobank stated that if a backlog of three months or more were to arise, this would be reported to the Credit Registration Office (BKR). The plaintiffs failed to pay the arrears. They tried to refinance the house through an intermediate but this was not possible due to the BKR registration. They asked the removal of this registration claiming that Rabobank did it wrongly. Rabobank informed them that the request was rejected. The plaintiffs claimed that on the basis of a balancing of interests, the registration should be deleted because the purpose of the registration no longer outweighs the interests of the plaintiffs upon its removal. They also claimed urgent interest in the removal. The Court found that the GDPR applies to the request for removal. The request shall be based on Article 21 in conjunction with Article 79 of the GDPR and Article 35(2) of the GDPR Implementation Act. If this request is rejected, a petition must be submitted to the court according to the mentioned Article 35(2). The Court also found that there was no urgent interest for the removal. The Court put forward a balancing test as required by Articles 21(1) and 6(1)(e) GDPR and Recital 69 GDPR. It found that the BKR registration was made correctly and the balancing of interest was at the disadvantage of the plaintiffs.
Municipality of Helmond
On 5 October 2018 the executive board refused to erase personal data of the claimant processed by the municipality of Helmond and refused to compensate damages to the claimant. On 8 March 2020 the board declared the claimant’s objection unfounded. The claimant has launched an appeal against this decision. The Court had to decide whether the board’s rejection of 8 March 2020 was in line with the administrative law and rule on the GDPR-based right of erasure and right to compensation requests. The Court found that the request to erase personal data of the claimant was invalid because this processing had been carried out in line with Article 6(1)(e) of the GDPR and couldn’t have been done in a less intrusive way. Therefore, the processing was not unlawful. So, on this point, the Court has upheld the previous decision of the board. The Court rejected the claim for compensation because his personal data was processed in accordance with the GDPR and local administrative law.
ABN AMRO Bank NV
In order to obtain a loan, the data subject provided false document to the bank. Once the bank realized the fraud, it cancelled the contract and inserted the data subject's details into two registries (the Incident Register and the External Change Register) meant to protect and preserve the integrity of the financial system, for a maximum duration of 8 years. Before the Court of First Instance, the data subject asked the deletion of her personal data from the registries or alternatively to limit the duration of the registrations to one year, or a period to be determined by the Court. The Court of First Instance rejected the requests and the data subject challenged the decision before the Arnhem-Leeuwarden Court of Appeal. Under Article 21(1) GDPR, the Court balanced the interests at stake between the bank and the data subject. The data subject argued that her interests should prevail because as an accountant in the financial sector, this information would damage her reputation and work life. In addition, the registrations would make it impossible for her to obtain another mortgage and buy a new house. The Court of Appeal rejected these arguments. The incident was serious, especially for an accountant. This therefore justified the adverse consequences that the data subject may experience in her work. Furthermore, she had not proved the necessity of a new house, since she had been living in a (different) home that she owned. The interests and circumstances alleged by the data subject were therefore insufficient for the Court to reform the first decision. In view of the above, the interest of the bank in maintaining the registrations outweighs the interests of the data subject. As per the alternative request, the Court of Appeal did not consider the 8-years limit to be disproportionate due to the seriousness of the incident. The alternative request is therefore also rejected and the first decision entirely upheld.
Judicial Examination Office of the State North-Rhine Westphalia
The plaintiff's request for free delivery of the copy of the examination papers was rejected by the defendant based on the argumentation that the GDPR would not apply since the personal data contained in the examination papers were neither fully nor partially processed automatically, nor did they constitute data which are or are to be stored in a file system. Whether copies of exams fall under the scope of the GDPR with the consequence that respective individuals can make use of their rights under the GDPR. The court decided that the carrying out of professional examinations to acquire the basic qualification to practise a profession in one EU Member State, which entitles him/her to practise his/her profession, and the resulting processing of personal data, are likely to constitute an activity falling within the scope of Union law solely because of their abstract relevance to fundamental freedoms and the internal market. Therefore, pursuant to Section 5 (8) sentence 1 of the Data Protection Act of North Rhine-Westphalia (DSG NRW) in conjunction with Art. 15 (3) and Art. 12 (5) sentence 1 of the General Data Protection Regulation, an examinee is entitled to a free copy of the supervisory work he/she has done in connection with the Second State Examination in Law in North Rhine-Westphalia, together with the examiner's report, on paper or in a standard electronic format.
Stichting Jeugdbescherming regio Amstedam
A minor has been placed under supervision of the Amsterdam Centre for Youth and Family (Stichting Jeugdbescherming regio Amsterdam; the defendant). The mother (plaintiff) requests a copy of the complete file from the defendant containing her personal data. The defendant provides the requested data, but removes some phrases and didn’t provide internal notes. Are internal notes and correspondence containing personal data subject to article 15 GDPR? The court ruled that the plaintiff did not provide enough indications to contradict the statement of the defendant that the removed phrases did not contain personal data. The request to provide the removed phrases is denied. The court rules that the internal notes and correspondence must be qualified as personal thoughts from employees which are only intended for internal consultation and deliberation and therefore can’t be qualified as personal data in the sense of the GDPR. Besides, the purpose of the request is not consistent with the purpose of Article 15 GDPR. The request was made in relation to a family dispute, while the purpose of Article 15 GDPR is to enable data subjects to verify whether their personal data is correct and to verify whether their personal data is processed lawfully. The request is denied.