GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
The data subject signed a contract with the controller for telecommunications services. On 26 June 2023, the data subject received information about a data transmission. The data subject objected to the disclosure by the controller of his personal data included in a contract to a legal entity other than the parties to the contract. The controller registered contract data to a legal entity other than the parties to the contract, supporting a joint fraud control system for the credit industry. The controller shared the personal data (name, address, date of birth, dates of the start and end of a telecommunications contract, contract number and reporting feature) without explicit consent of the data subject. The data subject initiated legal proceedings and was seeking damages, in the form of non-material compensation, for a data transmission without consent. The Regional Court Memmingen dismissed the case on the grounds that the data subject had failed to prove the existence of any present or future damage that was reasonably likely to occur. The prevention of fraud may constitute a legitimate interest of the controller within the meaning of Article 6(1)(f) GDPR.
The data subject and the controller both worked as nurses at the same hospital, on different wards. Over ten years before the events in question, the data subject had been hospitalised as a patient on the ward where the controller worked as a nurse. The controller's daughter, a school classmate of the data subject at the time, had visited her in hospital and the data subject's hospitalisation had briefly been discussed once in a social-skills class at school, without any diagnosis being disclosed. The data subject only told her closest friends about the hospitalisation itself. The data subject was later employed as a nurse at the same hospital, on a different ward, from October to April of a subsequent year. She and the controller belonged to a shared WhatsApp group used by both wards. Around Christmas, the controller's daughter recognised the data subject from her WhatsApp profile picture and reminded the controller that the data subject had once been her patient, the controller herself had not previously made this connection. The data subject resigned from her position, with her last working day followed by sick leave through the end of her notice period. On her first day back from holiday, the controller, deputy head of her ward, discussed recent events with the ward manager, including the data subject's resignation. In the course of this conversation, the controller mentioned that her daughter had gone to school with the data subject and asked the ward manager whether she had known that the data subject had been hospitalised on the relevant ward over ten years earlier. That same day, the ward manager told the data subject that staff at the hospital were aware of her earlier hospitalisation, intending to prepare her for the possibility that colleagues might raise it. The data subject later learned, from the site manager, that it was the controller who had disclosed this information to the ward manager. The data subject alleged that this disclosure led to her bein
The data subject took part in a three day seminar organised by the controller in January 2020. The controller sent the data subject a document listing the participants of the seminar, noting who wanted to arrive a day earlier and indicating the room categories booked and whether breakfast had been booked. On 22 January 2020, the data subject requested access under Article 15 GDPR, including information about the controller’s authorisation to store data, the time, recipient and purpose of the forwarding of data and the purposes for processing. On 15 February 2020, the data subject lodged a complaint with the Bavarian DPA (“Bayerischen Landesamtes für Datenschutzaufsicht”) for the misuse of personal data of participants in a seminar by sending out the participants list and failure to provide information about the use of the data subject’s personal data. The data subject explained that in addition to the names, the list of seminar participants sent by the controller also showed the room category booked, from which conclusions could be drawn about the financial situation of the participants. On 6 March 2020, the DPA requested the controller to provide the data subject with the information under Article 15 GDPR. On 12 March 2020, the controller replied, stating that they deleted the data subject’s personal data and only saved the email address, which was needed for the seminar and would be deleted afterwards. The controller further stated that sending out the list of participants to the data subject was an oversight and would not happen again. On 24 March 2020, the DPA sent the data subject a final notification that they requested the controller again to provide information. No other supervisory measures under Article 58(2) GDPR were needed according to the DPA and the case was considered closed. The DPA informed the data subject it was welcome to contact the DPA again if it did not receive the information from the controller within four weeks, which the data subject d
The data subject visited several popular websites and refused all cookies. However, tracking cookies were still placed on the data subject’s device. The controllers are Linkedin Ireland, Linkedin Netherlands, Microsoft Corporation (US), Microsoft Ireland Operations, Microsoft (NL) and Xandr (US). LinkedIn offers an advertising service and allows for companies to place tracking cookies on the browsers of a user after they view or click their ads. Microsoft has an advertising service that sells ad space on various websites. The service also allows advertisers to show their ads on the ad space of 'third-party' website operators and can place tracking cookies on the devices of website visitors. Xandr is an online platform that buys and sells digital ads. To use the services of Xandr, website users need to install a Java-script that places tracking cookies on the devices of website visitors. All of them are part of the Microsoft Group. The data subject hired a third party specialist to make an independent analysis of the controllers’ collection of personal data via the placed cookies. The analysis confirmed that out of the 30 websites the data subject visited, 27 websites placed and/or read cookies without the data subject’s consent. 24 websites did this even after explicit refusal to consent. Thus, the controllers were collecting personal data of the data subject’s browsing habits without their consent. The data subject filed an urgency procedure (“kort geding”) at the Amsterdam District Court (“Rechtbank Amsterdam”), asking the court to forbid the controllers to place tracking cookies without the data subject’s consent. Jurisdiction of the court [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Brussels I bis Regulation] regulates which courts of the EU Member States have jurisdiction in cases with links to more than one Member State in the EU. [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 7(2) Brussels I bi
A data subject working in the property investment sector hired gardening company Alisdair Cameron Limited (ACL) to carry out landscaping and gardening services on one of its properties. A contractual dispute arose between the data subject and the owner, which resulting in several disagreements over the phone. During some of these conversations, the data subject made threats of violence towards the owner and his family. At the suggestion of a family member, the owner recorded some of their calls. The data subject was not aware that the calls were being recorded. The owner of the company shared the recordings of the phone calls with several employees, family members and friends. He stated that he did so to inform others about the threats out of concern for his and his family’s safety. Several of them in turn shared the recordings with others, resulting in a total of 15 people having access. The owner of ACL explicitly requested each person who he knew to have received the recording to not forward the recording and to delete it. However, the recordings somehow ended up in the hands of some of the data subject’s competitors in the property investment industry (without the owner of the gardening company’s knowledge). Upon learning of this, the data subject made access requests to the gardening company, the owner and various of the gardening company’s employees. The owner argued that he was not a controller and thus was not required to respond to the access request. The gardening company did respond to the request, but it refused to provide the identities of individual recipients and only disclosed the categories of recipients. The data subject made a claim under the [https://www.legislation.gov.uk/eur/2016/679/contents UK GDPR] and [https://www.legislation.gov.uk/ukpga/2018/12/schedule/2 Data Protection Act 2018 (DPA 2018)] for an order that ACL and the owner comply with the access requests. The case raised four key questions before the King's Bench Division of the High
The controller was responsible for a multi-partner customer loyalty programme. Customers of participating retail shops could register as members, collect points based on their purchases and subsequently redeem them to receive various "exclusive" benefits and discounts. For participation in the programme, the controller collected personal data from the customers. Only the data of customers who gave consent during the registration process were processed to create profiles of the members about their purchasing behaviour for the purpose of personalised advertising. This was not mandatory for the conclusion of the contract. Consent was obtained by signing up via a physical brochure at the partner shops or on the website. The physical brochure obtained consent through a signature field at the end of the registration form, slightly separated from the text “declaration of consent”. To the left of this, at the same height, was the mandatory field "Date" required for registration. The field for the signature was not marked with a "*" meaning "mandatory field". The website obtained consent under the heading "Enjoy your own personal benefits" with a tick box yes and no to the processing of data to benefit from exclusive benefits and promotions. After the Supreme Administrative Court (“Verwaltungsgerichtshof – VwGH”) annulled part of the DPA’s decision against the controller, the DPA started anew the respective part of the procedure against the controller. In that decision, the DPA held that the way the controller obtained consent on its website and on their physical registration brochure did not meet the requirements under Article 5(1)(a) GDPR in conjunction with Article 7(2) GDPR. As a result of the lack of consent, the controller could not base its processing of personal data on consent under Article 6(1)(a). Thus, DPA held that the controller also violated Article 6(1) GDPR in conjunction with Article 5(1)(a) GDPR. The DPA fined the controller €2 million under Article 83(
The data subjects are tenants in a house which an estate agent (data processor) was commissioned to sell by the owners (controllers). On 11 August 2022, pictures of the interior were taken by the data processor's employees at an appointment with the data subjects while present, inviting the employees in. These pictures were published under a sales advertisement on a real estate website and included in a printed exposé that was handed out to prospective buyers during viewing appointments. Following the publication, the data subjects were approached by persons about the pictures of their living quarters, causing them to feel exposed and observed. On 12 January 2023, the controllers were requested by the data subjects to provide information about the storage of the pictures and to submit proof of a declaration of consent to the taking of the pictures by the data subjects. The same was requested of the data processor on 13 February 2023. The data processor was also requested to pay pre-trial legal fees of €659,74 by 24 February 2023. On 03 March 2023, the processor rejected the data subjects' claims, citing the immediate deletion of the pictures that had taken place since finding out the data subjects felt uncomfortable by them. The data subjects alleged that the processor took the pictures in question without their consent. The publication and resulting "unmasking" caused the subjects non-material damages that cannot be compensated by simply deleting the pictures. Therefore, they claim the processor is obligated to provide information and pay appropriate compensation for pain and suffering. They requested that the data processor be ordered to provide information about the pictures taken as well as whether and to what extent digital and/or analog copies of pictures on which the data subjects can be recognized in the property were made and where these are stored, that the processor be forced to provide verifiable evidence of this. They also requested a copy of persona
A claimant requested the District Court of Kymeenlaakso (Kymenlaakson käräjäoikeus) to provide all case lists and public decision summaries that are not published on the court's website. The claimant intended to use this information to create content for his website. He also stated that he studies court decisions for academic purposes, specifically to assess whether the decisions are consistent and the reasoning behind them is understandable. The District Court declined the request to provide the information. According to the Law on litigation in public courts ([https://www.finlex.fi/fi/laki/ajantasa/2007/20070370?__cf_chl_tk=BkGgxvbQAG3BnbpWiuKtw2bDwQUvFLqD.DATyw87Tj0-1724049343-0.0.1.1-5566 Oikeudenkäynnin julkisuuslaki]), everyone has the right to access public court documents. The court is responsible for publishing case lists prior to hearings, and if a case is declared classified, the court is required to produce a public summary of the case. The Act on the Publicity of the Activities of Public Authorities ([https://www.finlex.fi/fi/laki/ajantasa/1999/19990621 Julkisuuslaki]) in § 1 explicitly states that documents produced by authorities are public unless specific laws make them confidential. § 16 of the Act on the Publicity of the Activities of Public Authorities limits the disclosure of personal information, even when the document itself is not classified. The recipient must have the right to process such personal data. According to Article 85 GDPR, member states must balance freedom of speech and freedom of information with protection of personal data in their national legislation. Finland's Act on the Publicity of the Activities of Public Authorities allows journalists to access personal information for journalistic purposes. The requested documents contain personal information, such as the names of defendants. According to the District Court’s reasoning, publishing on a private website does not qualify as journalistic activity that would justify t
[https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000046221284?init=true&page=1&query=bio%C3%A9thique&searchField=ALL&tab_selection=all The Bioethics Law] (la loi sur la bioéthique) amended the [https://www.legifrance.gouv.fr/codes/texte_lc/LEGITEXT000006072665/ Public Health Code] (Code de la santé publique) to grant individuals who were conceived with the assistance of third party donors the right to access the identity and some non-identifying data of the donor. This amendment also required donors to expressly consent to the communication of their identity and data to the Commission for the Access of Persons born from Medical Assistance to Procreation (CAPADD). Donation was not permitted without this consent. The data included age, general condition, physical characteristics, family and personal situation, country of birth and motivation for the donation. The transitional provisions of the amendment made it possible to obtain the consent of the donor who made their donation before the amendment was enacted. The applicants decided to challenge the legality of the amendment before the Supreme Administrative Court of France. The applicants put forward several arguments to cancel the amendment to the Public Health Code, inter alia alleged infringement of principal of legal certainty or conformity of the amendment with French constitution. One of the arguments referred to a violation of Article 21(1) GDPR and Article 6(1)(e) GDPR. The applicants claimed that the former donors, namely donors who were not under the consent requirement of the new law, could not exercise their right in relation to the authority – CAPADD. The CAPADD was entitled to processes the contact data of former donors, transferred from the organisation or establishment where they made their donation. A person conceived by medical assistance may request to access the data of a particular former donor. Then, the CAPADD would contact this former donor to obtain their consent for disclosure of the data
The applicant is the data subject who files his income tax in Ireland. The controller is the Irish tax authority, the Revenue Commissioner. The data subject sought to challenge the controller’s refusal to erase data related to his 2007 tax return after they invoked the right to erasure under Article 17 GDPR. The data subject had previously reached a settlement with the tax authority in 2016 regarding tax assessments. In 2021, he requested the erasure of his 2007 tax data, which the controller refused, citing legal obligations under the Taxes Acts, which are also recognized in Article 17(3)(b) GDPR. The controller stated that the data subject could approach the Data Protection Commission if he was not in agreement with the decision of the controller. Instead of approaching the Data Protection Commission, the data subject applied for judicial review of controller’s decision before the High Court. In this case before the High Court, the data subject filed an application to have the proceedings heard in camera or anonymized. The data subject argued that if the proceedings were not anonymized or held in camera, it would render his substantive relief pointless, as the very information he sought to protect would become public through the court process. Further, he argued that public proceedings could create an impression that he was a non-compliant taxpayer, potentially causing irreparable damage to his reputation. The High Court rejected the data subject’s application for in camera proceedings or anonymization. The court found that the constitutional principle of administering justice in public outweighed the data subject’s privacy concerns. It determined that the data subject’s case did not meet the exceptional circumstances required to justify a departure from public proceedings, as outlined in previous case law. In this case, the High Court noted, the data subject had already brought an application for judicial review in his name without seeking to anonymise that a
The controller, an employer, suspected that an employee had committed embezzlement and carried out an inspection of the employee’s mailbox. After discovering e-mail exchanges between the employee and another employee (the data subject), the controller also suspected that the data subject contributed to a possible embezzlement and accessed their mailbox as well. Access to the data subject’s mailbox was carried out by the controller with the assistance of a third party and a data processor. The inspection of the e-mails showed the data subject had breached their duty of loyalty in their employment by sharing insider information and other confidential information. The data subject was then dismissed. On 12 July 2020, the data subject lodged a complaint at the Norwegian DPA (“Datatilsynet”). The data subject argued that the controller had no legal basis for conducting an inspection and disclosing their personal data. The DPA found that the controller failed to comply with the accountability principle under Article 5(2) GDPR as the controller did not submit documentation of the legal basis for conducting the inspection of the data subject’s mailbox. The DPA held that the controller had a legitimate interest to inspect the data subject’s mailbox under Article 6(1) GDPR and Section 2 of the Norwegian E-mail Regulations (“[https://lovdata.no/dokument/LTI/forskrift/2018-07-02-1108 e-postforskriften]”). Under the E-mail Regulations, an employer has the right to access an employee’s mailbox in the event of "reasonable suspicion that the employee's use of a mailbox or other electronic equipment results in a serious breach of the obligations arising from the employment relationship or may provide grounds for termination or dismissal". However, the DPA found that the controller did not process the data subject’s personal data with sufficient transparency under Article 5(1)(a) GDPR and Article 14 GDPR, as the data subject was not informed about the processing. The DPA stated that
Between May 2018 and April 2019, several customers of a bank (‘controller’) asked it to provide them with a copy of documents containing their personal data, including loan contracts they had concluded, repayment plans, documents relating to changes in interest rates and account statements. Some of these requests were explicitly motivated by the data subjects’ desire to bring a claim or legal action against the controller. The controller refused to give access to these documents. The data subjects lodged complaints with the Croatian DPA claiming that this rejection constituted a violation of Article 15(3) GDPR. As the controller did not comply with the injunctions issued by the DPA in 26 specific cases, the DPA ordered it to pay a HRK 1,100,000 (€146,667) fine. The controller considered that Article 15(3) GDPR confers only a right to a copy of the personal data being processed, to the exclusion of the documents containing them. Therefore, the controller brought an action before the Administrative Court of Zagreb against the administrative fine imposed by the DPA. The Administrative Court decided to stay the proceedings and referred the following questions to the CJEU: 1) Does Article 15(3) GDPR oblige the controller to provide the data subject with a copy of the document containing their personal data? 2) May the controller reject an access request made as a means of obtaining documentation to assist the data subject with bringing legal proceedings against the controller? On the first question First, the CJEU indicated that by its wording, Article 15(3) GDPR confers on the data subject the right to obtain an accurate reproduction of personal data concerning them, understood in a broad sense, which are subject of a processing carried out by the controller (§25 of the Order). Second, the CJEU noted that the term ‘copy’ does not refer to a document as such, but to the personal data it contains, which must be complete. The copy must therefore contain all the pe
The data subject's partner was observed by a professional detective (the controller), because the partner's employer doubted the partner's medical condition as they were on sick leave. The data subject was listed as "target person 2" in the controller's observation report and was therefore also photographed 4 times (sometimes alone) by the controller on their private property. The photos and reports were send to their partner's lawyer and to the labour court without the data subject's consent. Therefore, the data subject lodged a complaint against a professional detective (the controller) with the Austrian DPA ("Datenschutzbehörde - DSB"). The controller argued they had to observe the data subject in addition to the data subject's partner to fulfill the assignment. The controller did accidentally referred to the data subject as the "target person" instead of a "witness". The controller however stated that no sensitive data was collected about the data subject and that the photographs were not intended to be used as evidence. The data subject responded to this claim, arguing that the photographs were unnecessary, as a basic report would have sufficed for such investigative purposes. The data subject emphasised that the photos were taken on the weekend on private property without their permission. The controller further argued that the data subject's full name was obtained from a land registry search, and that the photographs were of poor quality, and therefore the data subject was not clearly identifiable. Moreover, the controller argued that such photographs do not constitute sensitive data, emphasising that the data subject also had some photos on social media. The data subject responded to these claims, stating that the photographs were not blurry and that they had never been and would never be called be as a witness in their partner’s proceedings. Moreover, the fact that the data subject had photos on social media did not allow the controller to take pictures
The controller is a credit rating agency, which provides information on the creditworthiness of individuals to its partners. This is done by calculating a credit score reflecting the probability of the person fulfilling credit-relevant contracts, based on collected information and past experience of the data subject. The data subject argued that the credit score calculated by the controller would have negative effects on them make the conclusion of contracts difficult for them. The data subject further argued that the credit scoring by the controller was in violation of Article 22(1) GDPR. The data subject therefore claimed injunctive relief at the Regional Court Traunstein (“Landsgericht Traunstein”). The data subject also claimed non-material damages of at least € 5,000 from the controller due to unlawful and discriminatory processing of their personal data when calculating the credit score. This included using their address, age and gender for calculating the credit score by the controller. Furthermore, the data subject argued that their right of access under Article 15(1)(h) GDPR was not fulfilled. The data subject requested the court to order the controller to provide information on the specific manner the credit score was calculated, including the calculation method used, the personal characteristics of the data subject used for the calculation, the various risk classes and how they are categorized, the weighting of categories of criteria and of individual criteria in relation to each other that most strongly influence the final credit score and more. The controller argued that besides providing the credit score to its partners, it also provides the information on which the score calculation is based. The data subject was able to conclude various credit-relevant contracts in the recent past even after the controller provided credit scores to the potential contractual partners of the data subject. The controller argued that the data subject’s claims were gen
The data subjects, joint operators of a hotel and restaurant business, ran their establishment through a family business. The controller operates an online travel platform accessible in Austria, on which registered users can post reviews and experience reports about listed establishments, in addition to general information. The data subjects' business was listed on the platform without their consent and was reviewed by users a few times per month, in comments that identified the data subjects by name, including both positive and negative reviews. On 27 June 2019, the data subjects requested that the controller erase all their personal data from the platform. The controller did not comply. On 28 August 2019, the data subjects lodged a complaint with the Austrian DPA, alleging unlawful processing and a violation of their right to erasure under Article 17(1)(d) GDPR. The DPA rejected the complaint on 18 September 2020, relying on Article 6(1)(f) GDPR (legitimate interests) as the legal basis for the processing. The data subjects appealed to the Federal Administrative Court (BVwG), which held an oral hearing and dismissed the appeal on 13 May 2022. The BVwG found that the platform's processing served a legitimate interest in freedom of expression and information that the reviews concerned the data subjects' social andprofessional sphere rather than their private sphere, that it was reasonable to expect the data subjects to monitor the platform for unjustified criticism and that the controller had taken adequate measures against abusive reviews. The BVwG declared an appeal on points of law (Revision) admissible, citing the absence of Supreme Administrative Court case-law on the principles governing the balancing of interests for review platforms under Article 6(1)(f) GDPR. The data subjects appealed to the Supreme Administrative Court. The court dismissed the appeal as unfounded, addressing each contested element of the three-part test under Article 6(1)(f) GDPR (legit
The data subject had a contract with a bank (the controller) from 1986 to 2000. Another bank informed the data subject that the controller had a claim against the data subject based on a Schufa (credit ranking agency) entry. Because of this, the data subject could not get a loan. Subsequently, the data subject requested access from the controller about the type and the scope of the personal data stored about the data subject. The controller objected to this request, stating that the request was too extensive and provided information to the extent that it considered was lawful. The data subject argued that this information was incomplete and asked again for access. The controller refused to provide further information. The data subject then filed a lawsuit at the District Court of Seligenstadt (Amtsgericht Seligenstadt - AG Seligenstadt) against the incomplete answer to the access request and claimed non-material damages. The District Court then ordered the controller to provide access under Article 15(1)(a) - (h) GDPR, and additionally the means of data processing, the media on which the data was stored, the frequency of deletion of the data subject's personal data, each location where the data was stored, whether a cloud was used for storage, which data was deleted in the last twelve months, the technical and organisational measures for processing and profiling of the data subject's personal data, how security was ensured, which data threats occurred, and the name of the data protection officer (DPO). However, the District Court did reject the compensation for non-material damages. The data subject appealed the decision at the Regional Court of Darmstadt (Landgericht Darmstadt - LG Darmstadt) and requested the Regional Court to order the controller to provide complete information under Article 15 GDPR, and reformulated its request to include all notes and assessments on the data subject, the algorithms used by the controller to evaluate the data, all processors
The Luxembourg DPA ("Commission Nationale pour la Protection des Données - CNPD") launched an investigation on a group of companies with a subsidiary based in Luxembourg (the controller). The group of companies had appointed a single DPO (the group's DPO) under Article 37(2) GDPR to handle all data protection matters and had appointed a lawyer as the local contact point in Luxembourg to assist the group's DPO. Article 37(2) GDPR allows for the possibility to appoint one DPO for a group of undertakings. The controller had also established a GDPR Board, a committee dedicated to data protection in Luxembourg. The DPO however was not a member of the GDPR Board and was only informed of the subjects discussed there through the minutes of the GDPR Board and through the questions raised by the local contact point during these meetings. The group's DPO did not seat in Luxembourg and was involved mostly indirectly, through the local contact point, in data protection-related matters of the Luxembourg entity. During the course of the investigation, the controller did appoint its own DPO, that started on 1 October 2020. The DPA found that even if the Group's DPO was participating in numerous meetings at a group level and regularly organised meetings with its local points of contact, this was not sufficient to demonstrate the direct, formal and permanent involvement of the DPO in Luxembourg. Therefore, the DPA found that the controller did not sufficiently involve the DPO with data protection matters violating Article 38(1) GDPR and Article 39 GDPR. It further found that the controller did not provided its DPO with the necessary resources and power, violating Article 38(2) GDPR. Thus, the DPA fined the controller €18,000. The controller appealed this decision at the Administrative Court of the Grand Duchy of Luxembourg ("Tribunal administratif du Grand-Duché de Luxembourg - TADM"), seeking annulment of the decision. The controller argued that the DPA used their power excessively
The case concerns a data subject who filed a complaint with the DPA alleging a violation of the GDPR by the controller (a hospital) according to [https://narodne-novine.nn.hr/clanci/sluzbeni/2018_05_42_805.html Article 34 of the Act on the Implementation of the GDPR (Zakon o provedbi Opće uredbe o zaštiti podataka - ZPOUZP)]. The data subject claimed the controller failed to provide access to her medical documentation and failed to inform her of its loss. The controller attributed the loss to irreversible server changes during a system overhaul in 2018/2019. The data subject filed the complaint with the DPA in November 2023, which included details of the alleged personal data breach and supporting evidence. The DPA initiated an investigation requesting an explanation from the controller, including why the data subject was not informed about the data loss as required under Article 34 GDPR. Despite the DPA's actions, including supervisory activities at the hospital, the DPA did not resolve the case within the 60-day deadline prescribed under [https://narodne-novine.nn.hr/clanci/sluzbeni/2009_04_47_1065.html Article 101(2) General Administrative Procedure Act (Zakon o općem upravnom postupku - ZUP)]. The delay was attributed to a high volume of cases and limited resources. The data subject then initiated an administrative inactivity complaint, and the Administrative Court in Rijeka ruled in her favor. The court ordered the DPA to issue a decision on the case within 60 days under [https://narodne-novine.nn.hr/clanci/sluzbeni/2010_02_20_483.html Article 58(3) Act on Adminstrative Disputes (Zakon o upravnim sporovima - ZUS)] and awarded the plaintiff €2,500 for the costs of the legal proceedings under [https://narodne-novine.nn.hr/clanci/sluzbeni/2010_02_20_483.html Article 79(4) ZUS].
The data subject was in a dispute with a health insurance company (the controller) about premium adjustment issues in their insurance plan, and associated missed explanation obligations. The data subject repeatedly used their right to access information via Article 15 GDPR to obtain data about the contribution history of the insurance contract. The data subject's original access request sought extensive documentation (all correspondence and attachments). The controller refused such frequent and extensive requests, citing Article 12(5) GDPR, which allows a controller to refuse or charge a reasonable fee for excessive or repetitive requests. The court confirmed that only the personal data of the data subject falls within the scope of Article 15 GDPR. The mere fact that some documents like formal letters or appended documents in insurance correspondence exist does not mean the entire document collection is personal data if only parts of them relate to the data subject. The court explicitly stated that an access request may be repeated and the existence of prior disclosures does not extinguish the right to access further relevant personal data, so a controller cannot claim that a prior fulfillment of a request automatically precludes subsequent valid requests under Article 15 GDPR. The court further held that the broad set of documents originally requested by the data subject was too general and did not meet this requirement. Only specific documents about the data subject’s insurance relationship were treated as identifiable personal information. The court granted the data subject a more narrowly tailored access right to certain personal data, which requires the controller to provide a copy of specific personal information about the data subject’s contract for the years 2017 to 2019, including the dates and amounts of old and new insurance contributions, the dates of insurance plan changes and the dates when the insurance plans were terminated.
In order to protect works covered by copyright against their communication on the Internet without the authorization of the holder of the rights, France adopted Decree n. 2010-236, which introduced in particular, [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000020740267/2009-11-01/ Article L. 331-21 in the French Intellectual Property Code] (‘CPI’). This Article establishes that the High Authority for the dissemination of works and the protection of rights on the Internet (‘Hadopi’) may request the identity, postal address, email address and telephone number of a person who made protected works available to download on the Internet, from internet service providers. The purpose of this access is to enable Hadopi to initiate a procedure against the identified person, combining educational and punitive measures. In particular, the sending of a first and second recommendation and then a letter notifying them that that activity is liable to constitute gross negligence. The matter may be referred to the public prosecution service in the most serious cases. Four associations, including La Quadrature du Net, sought the annulment of this Decree, claiming that [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000020740267/2009-11-01/ Article L. 331-21 CPI] was contrary to EU law, in particular [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058-20091219 Article 15 ePrivacy Directive] and [https://fra.europa.eu/sq/eu-charter/article/7-respect-private-and-family-life Articles 7], [https://fra.europa.eu/en/eu-charter/article/8-protection-personal-data 8] and [https://fra.europa.eu/en/eu-charter/article/11-freedom-expression-and-information 11] of the Charter. Regarding the alleged infringement of EU law, La Quadrature du Net submitted that this Article permits access to any connection data in a disproportionate manner for non-serious copyright offences committed on the Internet, without any prior review by a judge or an authority. In par