GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 21 October 2026 · Updated daily
Ηet college van burgemeester en wethouders van de gemeente Utrecht
Different local authorities were exchanging per email the contact details of an applicant asking to access document under the freedom of information act. This processing of personal data was done in order to prevent abuse of the system of access to documents. The plaintiffs asked for damages for violation of the GDPR after he objected to the use of his/her data in this context. The Court had to decide whether the processing was compliant with the GDPR: proportionate, compliant with the data minimization principle, and had a valid ground. The Court held that the processing of personal data in this context was appropriate, proportionate and compliant with the GDPR since there was no other less intrusive way for the local authorities to prevent abuse of the freedom of information act.
Court case c/13/673085 / HA ZA 19-340
The applicant requested to delete a previous court decision from the website "rechtspraak.nl" according to Article 17 (1) GDPR, because the applicant claims that he/she could be identified by it and therefore creates a reason to deport him/her. The issue in this case is whether the State is obliged to remove, in whole or in part, the judment of 28 June 2019 of the District Court of The Hague, published in accordance with the anonymisation guidelines, from www.rechtspraak.nl. The court hold that to the extent that the applicant is reasonably identifiable person the applicant cannot obtain the deletion of the data referred to in Article 17 GDPR, because Article 17 (3) (b) GDPR precludes this. By publishing the decision, the District Court of The Hague fulfils its constitutional obligation that judicial decisions must be taken publicly (Article 6 (1) ECHR, Article 14(1) International Covenant on Civil and Political Rights, Article 21 Dutch Basic Law and Article 5(1) of the Law on the Organisation of the Judiciary). Consequently, the applicant does not have the right to incorrect information under Article 17(1) GDPR.
The Board of the Legal Aid Council
In October 2017, a citizen, the Applicant, submitted applications for a legal aid aimed at lodging an appeal against a municipality. To support its application, the Applicant submitted additional judgements which include personal data about him. One of the document was the first instance judgement. In May 2018, the Applicant asked to the Board of the Legal Aid Council, the Defendant, the deletion of the judgements attached to the applications. The Defendant claimed that they needed those judgments to assess whether they could grant the legal aid. They claimed that the processing was necessary for the performance of a task carried out in the public interest. They argued that the applicant should submit judgements linked to the proceeding concerned by the legal aid application, to have a satisfactory understanding of facts. The Applicant claimed that the judgements have been attached to the application for attachment without his consent and there were unlawfully processed. He also claimed that information about the mental health status was included in those judgements and that it was not necessary for the Defendant to store them for ten years. Τhe Court had to assess whether the legal aid council was required to delete the information about the mental health status of the plaintiff according to Article 17(1)(d) GDPR. The Court recalled that deletion request under Article 17(1)(d) must be granted if the personal data have been unlawfully processed. In the present situation, the Court issued that the personal data were processed for the performance of a task carrier out in the public interest, under Article 6(1)(e) GDPR. It stressed out that Article 6(1)(e), read in conjunction with 6(3), in the lights of Recital 41, the basis for the processing does not necessarily have to be laid down in a legislative act, but it must be” clear and precise and its application should be foreseeable to persons subject to it”. In this regard, the Court hold that the application for
Court case 1 S 397/19
The plaintiff was born in the Republic of Turkey. His birth was first recorded in the civil status register in the district of Kayseri as 01.01.1956 and later corrected to 01.01.1958 (following a ruling of the District Court Sarız in 1971). When moving to Germany in 1971, the plaintiff stated 01.01.1958 as his date of birth. This date was entererd into defendant's register of residents. In 2015, after the discovery of new documents by the plaintiff the District Court of Kayseri ruled that the plaintiff's date of birth in the civil status register in the district of Kayseri would be corrected to 01.01.1953. The plaintiff also received a new Turkish passport showing that date. Subsequently, the plaintiff requested the defendant to change his date of birth to 01.01.1953, which was rejected due to lack of certainty on the plaintiff's actual date of birth. After the plaintiff's objections to this rejection were dismissed by the Karlsruhe Regional Council, the plaintiff filed a complaint with the Administrative Court of Karlsruhe, which ordered the defendant to correct the plaintiff's date of birth recorded in the register of residents from 01.01.1958 to 01.01.1953. The defendant appealed againts that decision. Two disputes werde adressed from a data protection perspective: 1) What is the legal basis for a request for rectification of an entry in the register of residents if the request has been submitted before the GDPR entered into force but has not yet been decided on as valid or legally binding? 2) What are the consequences if the plaintiff requests the rectification of an entry in the register of residents and it is not possible to clarify when the plaintiff was actually born ("non liquet")? Does this entitle the plaintiff to (i) restriction of processing pursuant to or analogous to Article 18 (1)(a) GDPR, (ii) the entry of the date of birth claimed by the plaintiff or (iii) the replacement of his year of birth by the sequence of numbers "0000"? The Court held
Court case 9 Ca 6557/18
The parties argue about data protection information and information, the issuing of copies and compensation. # on the conditions and fulfilment of the right to information under Article 15 (1), (2) of the DS-GVO in the employment relationship # the right to be granted a data copy under Art. 15 (3) DS-GVO can be objected to on the basis of the principle of good faith that the effort and expense of the person responsible is grossly disproportionate to the claimant's interest in performance. # the conditions and assessment of a claim for compensation for non-material damage under Art. 82(1) DS-GVO, here in the case of a breach of the right to information under Art. 15(1) DS-GVO # Order the defendant to provide the applicant with information on the following questions: :# the purposes for which the personal data of the plaintiff have been processed since 07.06.2018 and :# the categories of personal data processed # order the defendant to pay the applicant EUR 5 000 plus interest at 5 percentage points above the base rate since 9 October 2019 # for the rest, the action is dismissed. # the plaintiff is ordered to pay the costs of the lawsuit. # the amount in dispute in the decision: € 152,982.81 # the appeal is allowed for both parties.
Court case 3L 1028.19
The plaintiff visited a school in Berlin where a record with notes from teachers about his behavior was created. The school record contains his insulting statements to classmates and teachers and notes because of disrupted teaching. The student changes the school recently. Were the requirements of Article 17 GDPR fulfilled and would the defendant require to delete the school record? Article 17 (1) (a) GDPR grants a right to delete personal data, if the purpose for which the personal data was collected no longer exists and further storage is no longer necessary. The court did not see such a loss of purpose in this case. The VG held the applicable school regulation against the student and his parents. It stipulates that a change of school does not justify a loss of purpose. According to the school regulation the processing of personal data relating to pupils and legal guardians is necessary for the school to perform its tasks. This applies in particular to students' breaches of duty in order to be able to take the appropriate pedagogical measures and compare them with their effects in the past. The concerned school record shall be kept during the mandatory school period according to the school regulation. Since the student is still obliged to go to school, it can be assumed that the documents collected will continue to serve their purpose. Furthermore, the applicants have not made it credible that the personal data within the meaning of Article 17 (1) (d) GDPR were processed illegally.
The Netherlands
The digital tool called System Risk Indication (SyRI) is used by central and local Dutch authorities to prevent and combat fraud in the areas of tax and social security. It carries out different processing operations on personal data. SyRI gathers large-scale data and generates risk notification about people likely to commit fraud, which is called “risk report”. These risk reports have significant consequences on citizens' life; they indicate s that a specific person is worthy of investigation related to fraud. A number of civil society organisations and citizens sued the State claiming that SyRI violates fundamental rights. The Sate argued that SyRI provides sufficient guarantees for protecting the human right to privacy. The litigation raised numerous issues related to International and European Law, mainly the violation of Article 8(2) ECHR which allows interferences with the exercise of the right to respect for private and family life by a public authority under three conditions: it must be provided by law, be necessary in a democratic society and pursue interests such as the prevention of disorder or the economic well-being of the country. Nevertheless, this summary will focus on the protection of personal data and the interplay between the new technologies and the ECHR. The Court had to pronounce itself on whether the processing of personal data by the digital tool SyRI falls within the scope of Article 8(2) ECHR. It assessed whether SyRI was prescribed by law and under which conditions to know if it was necessary for the pursue of the prevention of fraud within a democratic society. Thus, it addressed importantly the interplay between Article 8 ECHR and EU law, including the Charter and the GDPR for the purpose of the assessment of the interference in private life under the ECHR. Focusing on data protection, the Court focused on the processing operations in the context of the deployment of the SyRI and the technical safeguards contained in the tool. It referred to several further processing operations, namely: the mutual exchange of personal data by administrative bodies, the provision of personal data to the Minister, the profiling, the provision of personal data to the Minister, the making of risk notifications and/or the inclusion of (information about) notifications in the Register of Notifications. Mainly, It had to assess whether Article 8 of the Charter; Articles 5, 6, 22 and 35 GDPR have been violated. The Court decided to assess the compliance with Article 8 ECHR in the lights of the Charter and the EU law data protection principles. Indeed, the Court recalled that the ECHR provides for a minimum protection of the fundamental right to privacy. It pointed out that the content and scope of EU fundamental rights in the Charter and the ECHR are alike insofar they are corresponding to each other’s. It also reminded, that the Charter provides for a least the same minimum level of protection and that rights guaranteed by the ECHR are part of the general principles of EU law under Article 6(3) TEU. Finally, as the Court considered that the Charter and the GDPR go beyond the ECHR in some respect, the ECHR have to be interpreted in the lights of the general principles of the Charter and the GDPR. Regarding the concrete assessment of the interference in the lights of the EU data protection principles, the Court considered that the risk model, the indicators and the data that are actually processed are neither public nor known to those involved and it has a significant effect on the private life of the person to whom the report relates. More precisely, with regard to the condition of “provided by law”, the Court acknowledged the SyRI legislation. Nevertheless, it left open the question on whether the legislation is sufficiently accessible and foreseeable to constitute an adequate legal basis and, thus, to justify the restriction of the right to privacy. Concerning the condition of “necessary in a democratic society”, the Court assessed the risk model and the processing operations on personal data and concluded that the SyRI legislation does not take sufficiently into account the purpose of limitation principle (Article 5(1)(b) GDPR) and data minimization (Article 5(1)(c) GDPR). For example, the Court noticed that the data protection impact assessment had been carried out prior the entry in force of the GDPR and could not meet the requirements under the national data protection act and Article 35 GDPR.
Court case 12 K 213/19
The plaintiffs claimed the right to inspect files in accordance with Article 15 (1) GDPR. They argued that the scope of application of the GDPR is not excluded according to Article 2 (2) because the GDPR should be applicable to all types of tax in favor of those affected. The Court had to assess whether the GDPR is applicable to a access request concerning personal data processed by the tax authority. According to Article 2 (2)(a) GDPR the regulation does not apply to the processing of personal data as part of an activity that does not fall within the scope of Union law. Therefore, the court ruled that the provisions of the GDPR in the area of tax law are only applicable to harmonized taxes, such as VAT, but not in the area of income taxation of natural persons. In this respect, there is no corresponding harmonization in the area of the European Union. The court explained further that the national legislature has not extended the material scope of application of the standard of Article 2 GDPR to the area of non-harmonized taxes. Accordingly, the Court denied the requested access according to Article 15 GDPR.
The chief of police
The claimant was previously involved in several proceedings regarding the police's treatment towards herself and the disclosure of her personal data to the public. To know more about the processing of her personal data by the Chief of Police, she submitted a subject access request. The Chief of Police provided her with a summary of the personal data processed with the information requested with undue delay, in June 2017. Thus, the Chief of Police set a penalty payment. Following the first answer, the Chief of Police completed with another decision in October 2017 which has been challenged by the applicant before the Court Rb. Zeeland-West-Brabant (Netherlands). The Court Rb. Zeeland-West-Brabant annulled the decision of October 2017 as it found it incomplete. However, based on the new Chief of Police supplementing decision submitted in January 2018 during the proceedings, it also ruled that the data controller does not have to take any other decision regarding the subject access request. Indeed, the lower court considered that the supplementing decision, so-called the "new overview" decision provided enough information and was, thus, complete. The claimant's appeal the Court Rb. Zeeland-West-Brabant's judgement before the Dutch State Council (Raad Van Staten). The applicant claimed mainly that the new overview decision has not been provided in comprehensible form. Especially, she argued that the information related to the purpose(s) of the processing, the recipients or categories of recipients and the origin were not stated clearly. Also, she argued that the new overview decision was still incomplete, as some of the personal data were missing. The Raad Van Staten had to decide on whether the information provided in the proceeding were sufficient enough to comply with Article 15 GDPR and the National data protection law. The Raad Van Staten considered that the data controller had to search another time and find all the personal data about the data subject to answer with accurate and clear information.
De Vereniging Zorgaanbieders voor Zorgcommunicatie (VZVZ)
In the letter dated 27 July 2017, the plaintiff requested the defendant to take enforcement action against VZVZ - the administrator of a network to which certain categories of healthcare providers can connect and consult medical data about their patients in each other's systems (LSP). The claims made were as follows: a. The Personal Data Authority (defendant) must take action against VZVZ for the lack of explicit consent collected by people registered in the LSP; b. the defendant must review the view of its legal predecessor, the Dutch Data Protection Authority (Cbp), from 2014, that VZVZ has put in place sufficient technical and organisational safeguards to ensure that only personal data of patients who have given their consent for this purpose are processed; c. the defendant must confirm that VZVZ may not ask for a national identification number (BSN) in combination with a copy of a valid identity document in response to written requests to the effect that someone has been registered with the LSP. The plaintiff submitted four cases of patients who had been registered with the LSP without their permission. According to the plaintiff, she has thus demonstrated that patients are registered with the LSP without their explicit consent and that the system as such is therefore flawed. According to the plaintiff, the defendant must take enforcement action against VZVZ in order to rectify this. In addition to this enforcement request, the plaintiff also submitted an enforcement request to the defendant aimed at addressing pharmacists about the unlawful registration of patients with the LSP. The plaintiff lodged an appeal against the decision of 24 December 2018 (the contested decision), by which the defendant dismissed the claimant's complaint. The appeal is unfounded. The District Court dismissed the plaintiff's argument that the LSP as a system is unlawful. There is no reason to follow plaintiff in her view that healthcare providers are reporting patients in
SPEC ENTERTAINMENT B.V.
The plaintiff was victim of a robbery in her flower shop. Afterwards, she cooperated with a TV program to talk about the robbery. The reconstruction of the scene was shot with the plaintiff’s fragment of voice. The TV program had been included at a later stage in a theatre show which was aimed to be broadcasted on TV. The plaintiff filled a complaint against the company using her voice in the theatre show. The plaintiff argued inter alia that her voice had been processed without any legal basis, and that the controller violated Article 6 GDPR. The Court had to assess whether a person’s fragment of voice constitutes personal data or anonymous data, whether the processing was lawful and whether the fragment of voice could be deleted. The Court found that anonymous data is data that cannot be traced back to an identified or identifiable person. In the present case, the fragment of voice could lead to the plaintiff’s identification without disproportionate efforts. The Court considered that the information gathered here was so unique that it could only relate to one person. It further found that voice data constitutes biometric data within the meaning of Article 4(14) GDPR. Regarding the lawfulness of the processing, the Court considered that the use of the voice in the context of an artistic form of expression falls within the scope of Article 6(1)(f) GDPR. Also, it stressed that the processing of the personal data for an artistic form of expression does not allow the exercise of the right of erasure under Article 17 GDPR pursuant to Article 85 GDPR and a specific provision in Article 43(2) of the Dutch Data Protection Act that makes Article 17 GDPR inapplicable in cases of artistic expression. Thus, the Court found that the processing of the personal data was lawful and rejected the complaint.
Google LLC
The plaintiff is a dentist in Germany but he used to practice in the Netherlands, where he was registered with the [https://www.bigregister.nl/ BIG-register] for healthcare professionals. Τhe Regional Health Care Disciplinary Boards in Amsterdam and Zwolle imposed disciplinary measures on him after complaints about his treatments. The plaintiff asked Google to remove all search results which linked to his name when searching for his name or the combination of his name and the search term "disciplinary law". Google removed some of them but refused to remove the rest claiming its legitimate interest under Article 6(1)(f) GDPR, the freedom of expression and the interest of the public in finding information online. The plaintiff on the other hand argued that he exercised his right to be forgotten on the basis of Article 17(1)(a) GDPR and Article 17(1)(c) GDPR and that the balancing test of the conflicting rights and interests should favor his rights and interests. He claimed that Google violated Article 12 GDPR by refusing to remove the links at stake without explaining the reasons why it did so in a transparent, concise and comprehensible form; these links reveal data relating to criminal convictions or otherwise sensitive data and require stricter protection under Article 9 GDPR and Article 10 GDPR, which Google violated. The Court had to assess whether Google had to remove all the links on the grounds of Article 17(1)(a) GDPR and Article 17(1)(c) GDPR or whether the exception of Article 17(3)(a) GDPR about the freedom of expression and information shall be applicable. The Court had to go through this balancing exercise. The Court noted that, although it follows from the case law that the right to privacy and the right to the protection of personal data take precedence over the right to freedom of information when balancing interests, in this case the interference with the the plaintiff's right to privacy was justified by the overriding public interest in acces
GOOGLE LLC
On 1 December 2006 plaintiff was arrested and charged of murdering an 8-year old boy. The first conviction was on 6 September 2007 and after multiple appeals on 22 may 2012 the final verdict was 11 years and 7 month prison followed by an involuntary commitment. The European Court of Human Rights rejected the application he made there. During the whole time, there was a lot of media coverage about this case and all proceedings. On 24 May 2015 the involuntary commitment started, and it has been extended with two years twice on 2 June 2017 and 29 May 2019. There was also media coverage about these extensions. When searching using Google search for the name of plaintiff, a lot of search results are found with publications about the crime he committed and the legal proceedings afterwards. After a request, Google removed 100 search results, but denied to remove 82 other results. It explained that with: "It is Google's understanding that the information about your client on these URL's - with regard to all the circumstances of the case we are aware of - is still relevant in relation to the purposes of data processing, and therefore the reference to this document in our search results is justified by the public interest." = The search results include information about criminal convictions and background of the crime. Based on Article 10 GDPR data processing about criminal convictions is only allowed under the control of an official authority. Data processing would also be allowed if processing is authorised by Union or Member State law, but this does not apply. Based on this, Google may not process this data. Article 32 GDPR and Article 33 GDPR also cannot justify the processing. Based on [https://curia.europa.eu/juris/document/document_print.jsf?doclang=EN&text=&pageIndex=0&docid=152065&cid=244711 CJEU - C-131/12 Google Spain], [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:HR:2017:316 Hoge Raad - 15/03380] and Article 17 GDPR a weighing of the interests should take place as defined in the Costeja ruling. Applicant's right to privacy shall normally outweigh Google's economical interests. In this case applicant's right to privacy shall prevail because information about a crime committed 12 years ago is not relevant any more. Every month, there are just 110 searches made about this case. Applicant is released from prison, and want to start a new life. This becomes impossible because of these search results. Applicant is not a public figure, but even if he is, the public does not need this particular information any more. There is no longer a discussion about the conviction of applicant. The search results make it difficult for applicant to find a job. Employers use Google to find information about applicants. This causes him to limit the jobs he can find. The only relevant information could be the extension of the involuntary commitment, but the public discussion about problems related to involuntary commitment should not hurt him. Not only the current list of URL's should be considered, but Google must also be forced to remove all future search results. = Based on Article 17 GDPR and Article 21 GDPR it is only possible to request to delete specific search results, because a weighing of the interests must be made for every search result. The right to be forgotten can only be based on Article 17 GDPR and/or Article 21 GDPR. In this case this does not apply. Applicant bases his request on Article 10 GDPR. The goal of article 10 was never forbid search engines to process any special categories of personal data. Based on [https://curia.europa.eu/juris/document/document.jsf?text=&docid=218106&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=6850841 CJEU - C-136/17 - GC et al v. CNIL], a weighing of the interests must also be made for special categories of personal data. Article 17(3)(a) GDPR contains an exception to protect the freedom of expression and information which also applies to personal data relating to criminal convictions and offences. The balancing of interests is to his disadvantage. Applicant does not point to any wrong information found on the pages linked to in the search results. So the data processing by Google is correct. Because of the seriousness of the crime for which he was convicted, the extent to which that crime shocked society, the fact that his criminal trial has been subject of public debate in several instances and the fact that the criminal case has been reported by many media, it is logical and balanced that a large proportion of the search results relate to the crime committed. There is a public interest in finding information about the crime committed by the applicant. The seriousness and severity of the crime committed by the applicant, as well as the subsequent investigations, indictments and convictions have resulted in almost all Dutch media and also some foreign media reporting about him. The murder of the victim has become an act of history. As opposed to "right to be forgotten" there is also a "right to remember". Applicant is a public figure. His fame is a direct and inevitable consequence of his own actions. Applicant wrongly claims that the public no longer has an interest in the contested information because there is no longer a public debate about his conviction and because the crime took place 12 years ago. However, the public has an interest in information about current and recent criminal cases, but also in information about known criminal cases that lie further in the past. Moreover, in 2017 and 2019, many more news items were published about the extension of the term of applicant's involuntary commitment. Applicant is still in a forensic position. In 2021, a new assessment will be made as to whether the term of applicant's involuntary commitment will be extended once again or whether applicant will be released. The developments in the criminal case of applicant are therefore still relevant and topical at this time. At the present state of affairs, it is difficult to see that applicant should be indemnified against any association on the internet with the criminal offence he has committed in the event of an unaccompanied leave of absence or an attempt to apply for a job. Against this background, the request by applicant to have the search results in his name removed is premature. The data processing of Google is based on Article 6(1)(f). The content of the page linked to also has to be taken in account. Article 10 GDPR states that processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out in principle only under the control of official authority. When a trade-off has to be made, based on Article 17 and 21, plaintiff's right to privacy shall normally outweigh Google's economical interests. In this case, it is relevant what the CJEU has determined in [https://curia.europa.eu/juris/document/document.jsf?text=&docid=218106&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=6850841 CJEU - C-136/17 - GC et al v. CNIL] paragraphs 46, 47, 66, 67, 68, 76, 77, 78 and 79. Plaintiff has been convicted for murderer committed in 2006. While the jail time has ended, the involuntary commitment had not been ended yet. Publicity which involved naming the full name of plaintiff are caused by his own actions. Plaintiff did not explain why the search results cause harm at this moment, considering the involuntary commitment is not finished yet. The search results do not point to wrong information in any way. The information, even from 2006 is still relevant. The request will be rejected, because the conditions from Article 17(1) GDPR are not met. Listing of the search results shown after searching for the name of the plaintiff are required to protect the freedom of expression and information as defined in Article 11 Charter of Fundamental Rights of the European Union. This means the situation as described in Article 17(3)(a) GDPR applies.
Court case N° 391000N° 393769 N° 395335 N° 397755 N° 399999 N° 401258 N° 403868 N° 405464 N° 405910 N° 407776 N° 409212 N° 423326 N° 429154
13 individuals requested the de-referencing of links leading to webpages which contained their personal data from Google LLC. Following Google’s refusal, the individuals filed complaints with the CNIL to request the de-referencing of the links at stake. The CNIL rejected all of the complaints. Thus, each of the complainants challenged the CNIL’s decision before the French Council of State (Conseil d’Etat). From these 13 appeals 18 different legal issues arose. In several instances the Court found that Google complied with the de-referencing requests prior to the appeals. Nevertheless, the Court clarified the framework in which a search engine must respect the right to be forgotten. It recalled that the right to be forgotten is not absolute and it always has to be balanced against the right of freedom of information. When implementing this balancing test the sensitivity of personal data should be taken into consideration. Insofar it does not concern sensitive personal data, the de-referencing must take place whenever the information provided with the link does not outweigh the right to information of the public. The Conseil d’ Etat set guidelines by stating that the balancing assessment should focus on three main elements: * The nature of the personal data, * the social importance of the data subject and * whether the information provided with the link is easily accessible. Insofar it regards sensitive personal data, the de-referencing must occur whenever the information provided with the link is not strictly necessary for the information of the public. In the latter case a stricter assessment has to be conducted, but it still has to follow the same three main elements.
ING Bank N.V.
The Durch Stichting Bureau Kredietregistratie (BKR), a private entity founded by banks, runs a Central Credit Information System (CKI). Dutch law requires banks to be connected to the CKI. The claimant wanted certain data to be delete. It brought a legal action based on Article 17 GDPR and Article 21 GDPR, read in conjunction with the Dutch Data Protection Act (Wet bescherming persoonsgegevens - Wbp). The Court of First Instance rejected the claims and dismissed the requests. Thus, the plaintiff appealed the decision before the Court of Appeal. The Arnhem-Leeuwarden Court of Appeal found that the registration of personal data in the CKI of the BKR does constitute processing of personal data under Article 6(1)(c) GDPR. In this instance, this means that the processing at stake is necessary for the compliance with a legal financial obligation and leads to several consequences. First, whenever the legal basis of the processing is necessary for compliance with a legal obligation each Member State may introduce more specific provisions according to Article 6(2) GDPR. In the present case, the processing is carried out under a national legal obligation and for the performance of a task carried out in the public interest since this system is the only credit registration system in the Netherlands. In addition, insofar the compliance with a legal obligation constitutes the primary the legal basis under Article 6(1)(c) GDPR, the Court found that the data subject cannot exercise his right to object pursuant to Article 21(1) GDPR. Secondly, the right to erasure does not apply to the extent that the processing is necessary for the compliance with a legal obligation carried out in the public interest, by virtue of Article 17(3)(b) GDPR. Indeed, it further is justified that the task carried out in the public interest under Article 6(1)(e) GDPR does not constitute an appropriate and adequate legal basis for all the personal data processed. Lastly, the Court recalled that other GDPR principles apply as well. As a consequence, the data controller has to process the personal data to the extent this is necessary for and proportionate to the purpose of the compliance. In this case, the Court found that the processing was lawful.
Court case W211 2210458-1/10
A kebab shop installed three cameras, two inside one outside. The outside camera has also captured a public street and a gas station on the other side. Instead of 72h under Austrian law, it kept data for 14-16 days. No warning signs were installed. The system was installed and accessed by the husband of the owner of the kebab place. A police officer reported the case, which was ultimately handled by the DPA. The DPA a violation of (I.) Articles 5(1)(a) and (c) as well as Article 6(1) GDPR and (II.) §§ 12, 50a and 50d of the Austrian Data Protection Act (DSG). The violations of the GDPR was taxed with EUR 1,200, the violation of the DSG with two times EUR 300. The controller disputed the legal and factual findings. He claimed that he has e.g. installed warning signs and changed the scope of the cameras and the deletion period. He further argued that he was not the controller, because his wife was the owner of the kebap place. The court saw no mistake in any factual findings. Later changes are irrelevant to find a violation of the GDPR. As the husband has actually bought and installed the camera, as well as reviewed the footage, he had factual control and is the controller under Article 4(7) GDPR. The court considered §§ 12 and 13 Austrian Data Protection Act (Datenschutzgesetz - DSG) inapplicable in lack of an opening clause specifically for the processing of pictures and videos under the GDPR. Hence the lawfulness of processing was assessed under Article 5 and 6 GDPR only. Given the financial situation of the controller, the penalty was reduced from EUR 1,800 to EUR 1,500.
Court case 11 K 4526/16
The plaintiff had applied for a position at the Administrative Court. His application was rejected based on an assessment which included notes of the President of the Court. The plaintiff requested access to his personal file including that assessment, as provided for in Article 15(1) GDPR, which was kept by the Higher Administrative Court. The Court denied the request. Does Article 15 GDPR apply to hand written paper notes? In the judgement, as for the part that is relevant here, the Berlin-Brandenburg Administrative Court ruled that the GDPR does not apply to the notes of the President of the Administrative Court. According to Article 2(1) GDPR, it applies to data processing which is carried out wholly or partly by automated means. This term is not defined under Article 4 GDPR. According to Article 3(2) of the German Federal Data Protection Act (BSDG), the term automated data collection means the collection, processing or use of personal data using data processing equipment. In this case the President’s notes contain personal data of the plaintiff but they are handwritten and not collected or processed using data processing equipment.
Municipal Executive of the Municipality of Almere
The plaintiff had requested erasure of his personal data according to Article 17 GDPR claiming that the forwarding of data via e-mail to other municipalities and the publication on the VNG forum of his personal data constituted unlawful processing. He also claimed compensation for damages occurred from the unlawful processing on the basis of Article 82 GDPR. The defendant had rejected the request because the processing at stake was lawful and thus the requirement of Article 17(1)(d) GDPR was not fulfilled. According to the defendant, the lawfulness should be assessed on the basis of the Dutch Data Protection Act and not of the GDPR as the processing at stake took place before the GDPR came into force. Does the GDPR apply to events that happened before 25. 5. 2018? The Court found that the GDPR also applies to legal consequences of events which occurred before it came into force. The Dutch transitional law lists cases where the Act would still apply after the enforcement of the GDPR, but the present case is not among them. However, the lawfulness of the processing is based on a factual assessment and the facts took place before the GDPR. Hence, the facts should be examined in on the basis of the Act, while the legal consequences, such as the right to erasure and the right to compensation, on the basis of the GDPR. The Court ruled that the processing at stake was compliant with the Act and thus lawful. Consequently, the defendant rightly rejected the request to erasure based on Article 17(1)(d) GDPR. Finally, for the factual assessment of the right to compensation the plaintiff should apply before the civil and not the administrative courts according to the Dutch Data Protection Act (Wet bescherming persoonsgegevens - Wbp).
Court case 15 U 126/19
The plaintiff is a dental specialist and demanded that the defendant, which operates a rating portal for doctors with more than six million users per month, delete his data published on this portal without his consent. The Court of First Instance found that the plaintiff could request the deletion of his personal data pursuant to Article 17(1)(d) GDPR since the data was unlawfully processed. The defendant claimed that its activities fall under exception in (Article 85 GDPR) read in conjunction with Recital 153 and the right to freedom of expression and information as it carries out processing activities for journalistic purposes. Is a platform that grants certain benefits to "premium" listings a journalistic platform? The Higher Regional Court focused in particular on whether the evaluation site was a “neutral information broker” by granting customers “hidden advantages” - terms developed through the case law of the Federal Supreme Court to assess whether the exception in Article 17(3) GDPR applies. The court examined the various functions of the site on a case by case basis and found that the site left the role as a “neutral information broker” through four of the contested functions. The controller can therefore not be seen as a journalistic platform. The doctors were therefore given the right to erasure under Article 17 GDPR. The Court admitted the appeal (“Revision”) to the Federal Supreme Court. → See the parallel case OLG Cologne - 15 U 89/19.
Court case 15 U 89/19
Two doctors sued a platform for deletion of their basic profile set up on the platform without their consent under Article 17 GDPR. They argued that due to the functions of the site, non-paying doctors (basic customers) were used on the site as an advertising platform for paying doctors (premium customers) in an inadmissible manner, partly due to functions hidden from regular users. Is a platform that grants certain benefits to "premium" listings a journalistic platform? The Higher Regional Court focused in particular on whether the evaluation site was a “neutral information broker” by granting customers “hidden advantages” - terms developed through the case law of the Federal Supreme Court to assess whether the exception in Article 17(3) GDPR applies. The court examined the various functions of the site on a case by case basis and found that the site left the role as a “neutral information broker” through four of the contested functions. The controller can therefore not be seen as a journalistic platform. The doctors were therefore given the right to erasure under Article 17 GDPR. The Court admitted the appeal (“Revision”) to the Federal Supreme Court. → See the parallel case OLG Cologne - 15 U 126/19.