GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 21 October 2026 · Updated daily
532 results · Showing 521–532
GGD Flevoland
The claimant’s son applied for social support at home. Following the application, the City Public Health Department investigated and addressed a recommendation on whether the social support should be granted to the City Council. The City Council decided to not grant the social support. Then, the claimant requested a copy of the files processed during the application process, including the son's personal data related to his medical files. The City Council refused to grant the access. Who is the relevant controller? The Court first considered that all public entities involved in the application process and not only the City Council were joint controllers. Thus, the access request regarding the personal data could have been sent to the City Public Health Department as well. Then, the Court considered that the access to the personal data should have been granted by the City Council under the data protection law. However, the City Council already destroyed the personal data after it refused to grant the social support. Therefore, the Court considered that the refusal was legitimate.
Court case 34 O 13123/19
An individual participated in the MasterCard's loyalty programme “Priceless Specials". The individual objected to MasterCard's processing of personal data and asked it to refrain from processing without adequate precautions against data misuse. Further, the complainant learned that the other participants’ sensitive personal data was publicly accessible online. Following the mentioned request, MasterCard informed the data subject that an incidence led to unauthorised online publication of the personal data of some of its customers. The representative of the data subject filed an injunction asking MasterCard to cease the processing and acknowledge its responsibilities regarding the lack of security. MasterCard did not respond. Thus, the complainant’s representative filed a motion before the Regional Court of Munich. The applicant based theirs claims principally on the GDPR and the German Civil Code (BGB). The Court emphasised the need to implement adequate and appropriate safety measures, but it rejected the application for injunction as unfounded. It found that the request was not sufficiently precise, since it didn't clearly ask what measures the defendant should take. Also, the Court pointed out that the applicant has the possibility to object to the processing of his personal data and to terminate the contract with the data controller. The Court stated that such an injunction would have been well founded only if the change of an existing condition to the processing could thwart or substantially complicate the realisation of a right of the plaintiff. In such context, it stressed that the right to stop unlawful processing of data is not enshrined as such in the German data protection act and that the mere processing of data contrary to the act does not constitute a violation of the law. Finally, it confirmed the data controller’s arguments that to cease the processing will not stop the risk of the personal data incident repetition and stated that measure
NDR
The complainant sought injunctive relief against a search engine operator because the search engine’s list of results for searches of her name contained a link to the transcript of a TV broadcast that was uploaded to an online archive in 2010. In the document the complainant is identified by name and accused of unfair treatment of an employee. The Celle Higher Regional Court rejected her claim and then she referred to the Federal Constitutional Court. The Court decided for the first time that where EU fundamental rights take precedence over German fundamental rights, the Court itself can directly review, on the basis of EU fundamental rights, the application of EU law by German authorities. What is decisive here is that under current EU law there would otherwise be a gap in protection regarding the application of EU fundamental rights by the ordinary courts. The fundamental rights of both the Basic Law and the Charter are not limited to protecting citizens vis-à-vis the state, but also afford protection in disputes under private law. The conflicting fundamental rights must be balanced on an equal basis.https://www.bundesverfassungsgericht.de/SharedDocs/Pressemitteilungen/EN/2019/bvg19-084.html According to the Court, the balancing exercise here must take into account the fundamental right to private and family life as well as the fundamental right to the protection of personal data on the one hand and the freedom to conduct a business on the other hand. The fundamental rights of third parties directly affected must also be considered, including the freedom of expression of the broadcasting corporation and the internet users’ interest in receiving information. The search engine operator’s economic interests as such are in principle not sufficiently weighty to justify a limitation of the affected person’s right to protection. It is not for the individual to determine unilaterally what information may be disseminated about them in the course of public communication processes. Consideration must be given to the easy access to and the continuing availability of the information online and to the time passed between the original publication and its listing in search results. The Court noted that clear distinction between online information falling within the social and the private sphere is not more really possible anymore, so the complainant should expect negative effects of information regarding her professional conduct also on the private life.https://www.bundesverfassungsgericht.de/SharedDocs/Pressemitteilungen/EN/2019/bvg19-084.html
ING Bank N.V.
The complainant asked his bank (ING Bank N.V.) to remove his data from the BKR registration (office for credit) under Article 21 GDPR. The bank did not answer to the request. The data subject brought a complaint before the Court of First Instance. The Court of First Instance found the complaint inadmissible and the complainant appealed the decision. The Amsterdam Court of Appeal considered that a request under Article 21 GDPR can be made at any time and several times. It also found that a provisional measure can be granted under Article 21 GDPR if an urgent action is needed. However, in the present case, the Court stated that the applicant did not prove the urgent interest for the interim measures. Thus, the measures could not be granted and the dedicated claim was rejected as inadmissible. The Court found that the applicant should have submitted a new request under Article 21 GDPR.
The Federal Public Service (FPS) Health, Food Chain Safety and Environment
The appealed decision concerns a healthcare professional (data subject) whose appointment as a deputy member of PGC Limburg (Provinciale Geneeskundige Commissie van Limburg) was withdrawn by a decision correcting his previous appointment. The data subject submitted an access request at the FPS Public Health (controller) to figure out why his appointment was withdrawn. With no response from the FPS Public Health, he filed a first complaint with the Belgian DPA. In October 2018, the DPA ordered the FPS Public Health to respond to the data subject's request, but the FPS did not comply. The data subject then filed a second complaint in 2019. The DPA found that the FPS had not established internal procedures in compliance with the GDPR's standards. In doing so, the FPS Public Health also failed to comply with the principle of accountability (Article 5(2) GDPR). The DPA noted that the FPS acknowledged these facts and stated that there were problems with its internal procedures. The DPA decided to reprimand the FPS for its violations. Additionally, the DPA held that the FPS must implement internal procedures in line with the GPDR. In the appeal procedure, the FPS argues that: 1. the complaint has become devoid of all purpose 2. the DPA interprets the right to access to broad, violating Article 15 GDPR; 3. there was no violation of Article 12(3) and 12(4) GDPR, as it has a procedure in place to handle these requests; and 4. the DPA exceeded the limits of its competence, as the decision was based on violations that were not stated by the data subject. The Court of Appeal of Brussels held that, while the purpose of the complaint deviates from that of the appealed decision, the DPA can, on its own initiative, investigate the controller after a complaint. The Court found no trace of the FPS's alleged statement that it commited any kind of error in the record of the proceedings. However this was indicated by the DPA and, moreover, used to substantiate its decision. The Co
Court case 4 K 252/19.GI
The plaintiff was designated as insolvency administrator for the B. GmbH (a limited liability company), that was not able to communicate its financial records after the opening of the insolvency procedure. Needing those records for the procedure, the plaintiff requested that the tax office of Gießen provide him with the documents. He based his demand, amongst other grounds, on §80 of the Hessian data protection law (freedom of information) and the the right of access (Article 15 GDPR) of the debtor on its behalf. This was possible as the applicable German law expands the right to access to legal entities in this specific case. The tax office refused, arguing that the plaintiff could not be considered as the data subject concerned but only as a “third party” as defined in Article 4(10) GDPR. Can an insolvency administrator exercise the right to access on behalf of a company? The Administrative Court of Gießen ruled in favor of the tax office. The Court started by demonstrating that the debtor, a corporation, had indeed a right of access under Article 15 GDPR in all taxation matters despite not being a natural person, in accordance with §2a(5) of the Abgabenordnung (national tax law). The Court then agreed with the tax office that the plaintiff is a “third party” and pointed out that the right of access is a highly personal right which could neither be alienated nor transferred, not even in the event of the opening of an insolvency procedure. Thus, the insolvency administrator had no rightful claim against the tax office for the release of financial records of the debtor.
Achmea
The applicant requested the Court to remove his credit registration from two bank databases, Achmea and ABN AMRO, because these registrations prevented him from obtaining loans and leases. The claimant based his application on Article 8 of the ECHR and Article 7 of the Charter. In their defence, the banks argued that the processing of the personal data was not based on the data subject’s consent under Article 6(1)(a) GDPR but on compliance with legal obligations under Article 6(1)(c) GDPR and that the data subject did not have the right to object to the processing. The Court had to balance the different interests at stake to assess whether the banks' refusal to erase the personal data was legitimate. First of all, the Court described that the objective of credit registration was to protect consumers against excessive lending and to protect providers of credit against borrowers who have not proven their ability to repay the loans. Then, the Court found that the credit registration system necessarily involves the processing of personal data, protected by Article 16(2) TFEU. It found that personal data can be collected only for specific purposes listed exhaustively under Article 6(1) GDPR. In addition, the Court stressed the difference between the right to object to processing on the one hand, which applies where the processing is based on Article 6(1)(e) GDPR or Article 6(1)(f) GDPR, and the right to erasure on the other hand, which applies even if the processing is based on Article 6(1)(c) GDPR. The Court confirmed that in this case the processing was based on Article 6(1)(c) GDPR and that the claimant could ask for the erasure of his personal data. However, the controllers could still refuse the erasure on the basis of compelling legitimate grounds which would outweigh the interests, rights and freedoms of the data subject. It found that only the “negative” credit registrations prevented the Claimant from obtaining loans and leases but that they were necessar
Court case 2019/AR/1006
Client Y of Bank X requested the bank on the basis of Article 16 GDPR to write their name with the appropriate diacritics. The Bank argued that this was not possible with their current computer systems and could thus not fulfil the request. In response, the client lodged a complaint with the Belgian DPA. The Litigation chamber (Geschillenkamer) of the DPA ruled on the 15th of May 2019 that the argument of the Bank concerning the technical impossibility was not sufficient. The Litigation chamber ruled that the Bank should comply with the request of Client Y. The Bank decided to appeal the decision, because - inter alia - it was already working on upgrading their computer systems and the problem should be fixed within several months. In the appeal procedure, the Bank argues that there is no obligation to use correct diacritics in capital letters, and that this is not "personal data". The DPA disagrees and argues that Article 16 GDPR unreservedly grants the right to the data subject to request the rectification of incorrect personal data without delay. Correct spelling of one's name is personal data in accordance with Article 4(1) GDPR, according to the DPA. The Court of Appeal of Brussels held that, in accordance with Article 16 GDPR, the data subject has the right for their name to be correctly spelled when processed by the computer systems of the Bank. To claim in 2019 that adapting a computer system to correctly handle diacritics would cost several months of work and/or constitute additional costs for the Bank, does not allow the Bank to disregard the rights of the data subject. A correctly functioning banking institution may be expected to have computing systems that meet current standards, including the right to correct spelling of people's names.
Google LCC
In 2015, the CNIL informed Google that it must remove links from all versions of its search engine throughout the world when implementing an erasure request from a data subject. Google declined to comply, limiting its de-referencing of links obtained via its search engines with domain extensions inside the EU only (e.g. google.de or google.fr), as well as using geo-blocking techniques, which prohibits links from appearing in searches performed in France regardless of the version used. As a consequence, the CNIL imposed a fine of 100.000 EUR on Google due to non-compliance with the data protection legislation. Google filed a request with the Conseil d'État to have the fine annulled. The Conseil d'État subsequently submitted concerns to the Court of Justice, citing "many severe challenges" surrounding the interpretation of the directive. 'Single act of processing': The search engine in this case must be regarded as carrying out a single act of personal data processing, because of the existence of gateways between its various national versions. Following this reasoning the act of processing is carried out within the framework of an establishment of Google in a Union Member State (France in this case). Territorial scope: The fact that the search engine is operated by a company situated in a 'third state' cannot lead to an exemption of the processing of personal data for the purpose of the operation of that search engine (in connection with the advertising and commercial activities) of an establishment of the controller on the territory of a Member State from the obligations and safeguards of Directive 95/46 and Regulation 2016/679 (GDPR). The Court explained that the Directive and GDPR do not indicate that EU legislature has chosen to establish a scope which would go beyond the territory of the Member States and thus ruled that search engine operators are not required under EU law to remove links on all the versions of its search engine. Ruling: It follows that where
Netherlands Bar Association
The Dutch Bar Association published the plaintiff’s name on the online list of suspended and removed lawyers, after a disciplinary measure of unconditional suspension had been imposed on him. The plaintiff asked Google to remove the list from the search results relating to his name. Google refused and indicated the website operator as the competent entity for this removal. The Association, which was the website operator, rejected his request. The Court recalled Article 34 of the Dutch Data Protection Act (Wet bescherming persoonsgegevens - Wbp) which foresees that a written decision on a request submitted under Articles 15 to 22 GDPR shall be regarded as falling within the time limits referred to in Article 12(3) GDPR and, in so far as it has been taken by an administrative body, such as the Bar Association, this decision shall be deemed as a decision within the meaning of the General Administrative Law Act. Therefore, the Association rightly refused to grant the request for erasure under Article 17 GDPR. Moreover, the Court found that the plaintiff did not justify his reliance on Article 18 GDPR. As for Article 21 GDPR, the Court ruled that the public interest in the publication of the list outweighs the plausible interest of the plaintiff to apply for a job unencumbered. Therefore, the Court dismissed the appeal as unfounded.
CNIL
Four applicants wanted to exercise their right to de-referencing concerning various links to third-party websites which contained sensitive data pertaining to them. As the requests were rejected by Google, the applicants brought complaints before the Commission Nationale de l’Informatique et des Libertés (CNIL), the French data protection authority. the CNIL refused, however, to serve formal notice on Google to carry out the de-referencing requested. Thereupon, the applicants turned to the Council of State (Counsel d’État), which ordered a stay of the proceedings and referred to the Court four questions relating to the applicability of the prohibition of the processing of sensitive data in the context of search engines and to the de-referencing of such data. The Court recalled that an activity of a search engine, which consists in finding information published or placed on the internet by third parties, indexing it automatically, storing it temporarily and making it available to internet users according to a particular order of preference, must be classified as "processing of personal data" and that the operator of the search engine therefore needs to be considered a 'controller' within the means of article 4(7) GDPR. In its preliminary ruling the court judged that: * Information relating to legal proceedings brought against an individual and information relating to an ensuing conviction are data relating to ‘offences’ and ‘criminal convictions’ within the meaning of Article 8(5) of Directive 95/46 (and Article 10 GDPR); * The operator of a search engine is in principle required to accede to requests for de-referencing links to web pages containing sensitive personal data, unless an exemption is applicable; * A search engine operator does not need to automatically delete links to specific sites following an erasure request made by the data subject. Instead, in order to determine whether to remove links to pages that contain sensitive personal data, the search eng
Court case Sa 11/18
The plaintiff was employed by an international group as head of the “Legal Mergers & Acquisitions”. A longstanding labour dispute began between the plaintiff and his employer. As a result, the plaintiff was assigned to various positions having a lower hierarchy and lower wage level. During the conflict, the plaintiff received several warnings from its employer for improperly fulfilling his work and was finally dismissed. In the context of this dispute, the plaintiff requested access to personal data under Article 15 GDPR. The right to access relates, among other things, to any correspondence about the plaintiff in parallel with the personnel file, and the inclusion of the plaintiff in internal 'negative lists'. This is of importance because a Business Practices Office (BPO) proceeding against the plaintiff was initiated in 2014 - it equals a whistle blower system. In an email from the head of HR to the plaintiff on March 8, 2017, the plaintiff was informed that a compliance check was planned for all (job) appointments in the legal area, which would also check whether a BPO Proceedings result in a violation of the rules. However, the first instance rejected the right of the plaintiff to claim information about the personal performance and the behavioural data processed by the employer, which was not stored in the personnel file. The employer refused to communicate this information because of third-parties interests, namely business secrets. The Land court confirmed that Article 15 GDPR also exists in an employment law relationship, and a Member State is authorized to issue specific national regulations on employee data within certain limits. According to the GDPR, personal data is all information that relates to an identified or identifiable natural person ('data subject'), and, in an employment relationship, the employer inevitably processes personal data of its employees. It has been judged that the plaintiff is entitled to information about personal perform