GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
A journalist (‘data subject’) demanded an apology in relation to himself and to the citizens of the Czech Republic (‘CZ’) from the Ministry of Industry and Trade of the CZ (‘controller’) as a compensation for the non-material damages suffered as a result of the incorrect transposition of Directive 2002/58 of the European Parliament and of the Council /EC of 12 July 2002 on the processing of personal data and the protection of privacy in the electronic communications sector (‘e-Privacy Directive’ or ‘Directive’). According to the Czech law transposing the Directive, operators of electronic communications and public networks must store a variety of user communication information for six months, primarily to aid in the investigation of criminal and misdemeanor activates. The incorrect transposition of the Directive allegedly led to the widespread collection and processing of operation and location data of users' the electronic communications. In this case, the data subject saw an interference with his rights to privacy and informational self-determination. Before filing the lawsuit, the data subject tried unsuccessfully to obtain the erasure of data stored on him through a mobile operator and later through the Czech DPA. The DPA stated that, in their opinion, it is indisputable that the national legislation issue (§ 97 paragraph 3 of Act No. 127/2005 Coll.) is not in accordance with Article 15 ePrivacy Directive. According to the Directive, Member States may enact laws to limit certain rights outlined in the Directive, including data retention, if it is necessary for national security, defense, public safety, or crime prevention, in line with EU principles. However, the complaint was rejected by the DPA. Nevertheless, the data subject brought the DPA's opinion to the controller's attention who rejected it claiming that this transposition of the Directive cannot be considered as 'improper official procedure' according to Act No. 82/1998 Coll., on liability for da
On 2 May 2023, a person identifying themself under the name of the data subject lodged a complaint with the DPA against a controller, a court. This complaint alleged that the controller had not provided information as required by Article 13 and Article 14 GDPR. On 24 January 2024, the data subject filed an inactivity suit against the DPA on the same matter, requesting access to the administrative file. In a procedural order on 25 January 2024, the court requested the alleged data subject to provide proof of their identity within two weeks as there were doubts about whether the person acting in the case was in fact the data subject. On 6 February 2024, a submission arrived under the data subject’s name with a declaration of personal and economic circumstances and other documents, noting the data subject was unable to attend due to illness. A follow-up order on 9 February 2024 reminded the data subject of the identity requirement and sought justification for why access to the file should be transmitted in print or electronic form. No further response was received and no evidence of identity was provided. First, the court found that the person acting as the data subject had not demonstrated that they were the person affected by the underlying complaint procedure towards the supervisory authority. The court noted numerous indicators suggesting that the person acting in the procedure might not be the data subject, including failure to respond to repeated requests to prove identity, absence from the hearing, failure to provide requested medical evidence and personal/economic declarations. The court also referenced similar earlier cases by the same person (like 29 K 8881/22) where identity doubts had arisen. Because the person continued to press cases without establishing identity, the court stated it would in future simply file such claims rather than decide them. As a result, the objective and subjective elements of a legal interest in pursuing the alleged claim coul
In 2023, two applicants challenged decisions under Ireland's safe third country return system. Applicant A argued that the Minister improperly relied on the UK adequacy decisions, which exclude immigration-related data transfers, to justify the return order. Applicant B claimed the system lacked adequate data protection equivalent to the Dublin III Regulation. Both cases centered on the transfer of personal data to the UK during the immigration process, alleging GDPR violations. However, neither applicant pursued data protection remedies with the Irish Data Protection Commissioner. The State defended the data transfers, citing public interest grounds under Article 49(1)(d) GDPR and emphasizing the necessity of data exchange for the functioning of the Common Travel Area (CTA), a long-standing arrangement enabling free movement between Ireland and the UK. The court concluded that alleged GDPR breaches did not invalidate the safe third country return system. It found that existing remedies under the Data Protection Act 2018, such as complaints to the Data Protection Commissioner, were sufficient to address potential violations. Furthermore, the court upheld the legality of data transfers under Article 49(1)(d) GDPR, citing public interest in maintaining fair and effective immigration control and the CTA’s operation. The judgment emphasized that broader questions of GDPR compliance in the immigration context require fuller evidence and more focused proceedings.
Under [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000043894115 Article L. 1461-1 of the French Public Health Code], the public interest group “Plateforme des données de santé” (‘controller’) is responsible for collecting, organising and making data from the national health data system available as well as promoting the use of data in the health sector. The controller wished to implement an automated processing of personal data for the purpose of creating a health data warehouse called EMC2. However, the processing did not comply on certain points with the [https://www.cnil.fr/fr/la-cnil-adopte-un-referentiel-sur-les-entrepots-de-donnees-de-sante guidelines for the processing of personal data for the creation of data warehouses in the healthcare sector] adopted by the French DPA (‘CNIL’). According to [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000038888793 Article 66 of the French Data Protection Act], if processing operations relating to the guarantee of high standards and safety of healthcare do not comply with guidelines adopted by the CNIL, the processing may only be implemented after the CNIL authorises it. Therefore, the controller applied to the CNIL for an authorisation. On 21 December 2023, the CNIL authorised this processing and admitted the legality of hosting health data by a processor, Microsoft Ireland. Therefore, in March 2024, several companies and associations lodged an appeal with the French High Supreme Administrative Court (‘Conseil d’Etat’) asking the suspension of the [https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000049057224 CNIL deliberation]. In French law, [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000006449326 Article L. 521-1 of the French Code of Administrative Justice] establishes that urgency justifies the suspension of an administrative act when its execution is sufficiently serious and immediate to affect a public interest, the applicant’s situation or the interests they intend to defend. Th
The Data Subject submitted a complaint to the ICO which was investigated by the Commissioner. The Commissioner communicated with the data controller a number of times and the outcome was communicated to the Applicant on 3 May 2023. The Data Subject was dissatisfied with the Commissioners response and made an application to the tribunal under Section 166 of the Data Protection Act 1998 (DPA) seeking to challenge the Commissioners outcome citing procedural failings and investigatory failings by the Commissioner. The Tribunal dismissed the Data Subject's appeal, finding it had no power to reassess the ICO's decision. The Tribunal's role under Section 166 of the Data Protection Act is limited to ensuring the ICO's complaint handling process was procedurally correct. As the ICO had already responded and concluded the case, the Tribunal had no authority to challenge the outcome or provide a remedy. The Tribunal explained that it cannot: - Alter the ICO's decision - Oversee the ICO's functions or internal processes - Challenge the ICO's exercise of its powers The Tribunal can only order the ICO to take appropriate steps to respond to a complaint or inform the complainant of progress or outcome. In this case, the ICO had already taken appropriate steps and reached a final decision. The Data Protection Act does not provide a right to appeal this decision to the Tribunal.
Pursuant to Article 17(1) GDPR, the data subject had requested Google LLC (the controller) to remove several search result links from Google Search that led to articles published by various news media in 2010, the subject of which was an arrest warrant against the data subject. After the controller refused to remove the links, the Finnish DPA had ordered the controller to comply with the data subject's request. The Administrative Court of Helsinki had overturned the DPA's decision following an appeal by the controller. The DPA then appealed the Administrative Court's decision to the Supreme Administrative Court of Finland (the Court) requesting that the Administrative Court's decision be overturned and that the DPA's original decision be enforced. The DPA stated that the search result links concerned news articles about an arrest warrant, the social significance of which was mainly fleeting compared to crime news. Accordingly, the DPA considered that the links concerned outdated information that had since lost its relevance. The DPA also emphasised that the vast majority of the news articles also contained a photograph of the data subject and that the date indicated in the articles did not guarantee that the reader understood the information as describing past events. The Court found that the news articles to which the search result links led were still available on the news websites that had published them. Consequently, the removal of such links could have a relatively limited impact on the public's access to information. The Court noted that the information on the arrest warrant, which was almost ten years old and no longer valid, had expired. Therefore, the information no longer had much social relevance, even though it was indirectly related to the punishment and the crime of which the data subject had been convicted. The Court stated that the information contained in the news articles about the nature of the offence and the length of the sentence could not b
The controller runs a web portal that connects operators of holiday homes to potential guests by allowing the operators to place ads on the portal. To acquire new operators to present their holiday homes the controller advertises their service via phone. They were using the services of a call centre in Kosovo for this purpose. Call centre staff members would search for phone numbers of landlords and operators of hotels and holiday homes and called them. They presented the portal to them and tried to close a contract about a cost free test entry or a “premium entry” on the portal. During the call, the call centre staff asked for data related to the customer and their accommodation. Subsequently, the controller provided the new client with information and a confirmation via e-mail. Persons who said they did not want to be contacted anymore were blacklisted. Following 20 data protection complaints, the Saxony-Anhalt DPA (Landesbeauftragter für den Datenschutz Sachsen-Anhalt) got to know about the business practices of the controller and, in particular, that a client will receive more calls after opting for the cost-free test ad on the portal. The DPA then conducted an official hearing of the controller. After the hearing, the Saxony-Anhalt DPA ordered the controller under Article 58(2)(f) GDPR to refrain from the processing of phone numbers and other personal data for the purpose of advertisement if these phone numbers are related to an identifiable natural person. This order included an exception for cases in which the person had either consented to the processing of their data or concrete facts indicate that the person had a factual interest in an advertisement entry on the controller’s page and is awaiting the call or at least would react positively to the call. Furthermore, it ordered the controller under Article 58(2)(g) GDPR to delete all personal data that could not be processed anymore under the aforementioned order. In addition, the DPA ordered the controll
In February 2020, the Újpest administration (the controller) obtained personal data about Hungarian residents from the Hungarian Treasury and Budapest district office. The intent was to determine eligibility for a program seeking to provide financial supports to residents made vulnerable by the COVID-19 pandemic. The Hungarian DPA initiated an investigation after a report alerted it of the processing. The DPA determined that the controller failed to timely inform data subjects of the categories of personal data processed, the purposes of processing, or how they could exercise their rights in relation to the processing. On 22 April 2021, it found that the controller violated Articles 5, 14, and 12(1) GDPR. Pursuant to Article 58(2)(d), the DPA ordered the controller to erase the personal data of data subjects who were entitled to the right to erasure but had not requested it. The controller challenged the DPA’s order before the Fővárosi Törvényszék (Budapest High Court), arguing that Article 58(2)(d) GDPR does not empower the DPA to order the erasure of personal data in the absence of an Article 17 GDPR request from the data subject. Seeking clarification on the interpretations of Article 17 and 58(2)(d) GDPR, the Budapest High Court referred two questions to the CJEU: # Can a DPA order a controller or processor to erase unlawfully processed personal data despite the absence of a request from the data subject? # If the DPA can exercise such corrective power, is that so whether or not the personal data were obtained from the data subject? In deciding the first question, the Court held that some corrective powers under Article 58(2) GDPR, namely 58(2)(d) and (g) GDPR, may be exercised by the DPA on its own motion. Article 58(2)(c) GDPR, on the other hand, does require a prior data subject request. The Court noted that the plain language of Article 58(2)(d) and (g) GDPR does not require a data subject request to authorize the DPA’s corrective power. Article 58 GDPR
A company Prolegia Research AB has request to take part in records in a criminal case by the constitutional right to access public records in sweden. The company is sericeprovider in are like background checks and consultancy in recruitment. The company has during the process to get access applied for a voluntary certificate of publication that give the entity the same constituinal cover as pappers and TV by the constutition. The company has calmes that the by the voluntary certificate of publication is useing the data in the records for prupes of journalism and by that not is obligated to enforce the GDPR. The question in the case are if the EU-law by GDPR are to be enforced before the swedish constition and if the the company are processing with the records are for journalism purpes or more for a bussiness purpes. The DPA has in a memorandum, IMYRS 2022:2 sayed following as a summery. According to Article 85 of the Data Protection Regulation, Member States are obliged to national legislation the right to protection of personal integrity and the right to freedom of expression and information. In Sweden, this has taken place through the regulation in ch. 1. Section 7 of the law (2018:218) with provisions adapting to the EU's data protection regulation (data protection act). The first paragraph of the section states that personal data processing that is covered by the constitutional protection in the Freedom of the Press Ordinance (TF) and the freedom of expression fundamental law (YGL) are exempted from the requirements and the data protection regulation if the application of the regulation would come into conflict with the constitutions. In c h. 1 Section 7, second paragraph, exceptions are made with regard to opinion and freedom of information. The exception covers treatments that take place for journalistic purposes purposes or for academic, artistic or literary creation. If the exception is applicable, most provisions of the data protection regulation do no
The data subject had a dispute with the German tax authority (Finanzamt), which was resolved by a previous judgement. After that, on 14 October 2020, the data subject filed an access request with this authority, which is the controller in the present case. On 21 October 2020, the controller rejected the request, arguing that they did not have a right to access under Article 15 GDPR as the legal proceeding with the FA was already terminated. Moreover, the controller argued that the request was excessive under Article 12(5) GDPR. The data subject started a lawsuit against the controller before the Berlin-Brandenburg Fiscal Court (Finanzgericht Berlin-Brandenburg – FG Berlin-Brandenburg). The data subject claimed they had not only the right to obtain a copy of their personal data, but also to have a copy of the documents or an extract of the database where their personal data was contained. The court did not uphold the data subject’s requests. The court argued that Article 15(3) GDPR must be interpreted restrictively and, therefore, the data subject did not have the right they claimed. Moreover, the court held that, even if the data subject had such a right, their request would have been excessive as per Article 12(5) GDPR. Therefore, the data subject lodged an appeal against the decision with the Federal Fiscal Court (Bundesfinanzhof – BFH). First of all, the BFH noted that the right to access under Article 15 GDPR is conferred to data subjects independently from any other legal proceeding. It stated that the purpose of this article is to ensure that the data subject is aware of the processing of their personal data and can verify the lawfulness of the processing. Secondly, the BFH dismissed the data subject’s argument and found that the data subject has no general right to obtain a copy of extracts from documents where personal data is contained. According to the court, the data subject can normally verify the accuracy of the personal data and the lawfulness of i
On 02.06.2020, the complaining journalist requested information from the controller on the names and sums of all companies that received financial aid in the form of tax deferrals, grants or loan guarantees during the COVID-19 pandemic under [https://www.ris.bka.gv.at/eli/bgbl/1987/287/P2/NOR12016843?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=Auskunftspflichtgesetz&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=2&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=11.03.2024&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=78db5b41-eb7d-4cf5-9e8a-c364906c4b57 § 2 Auskunftspflichtgesetz] and [https://www.ris.bka.gv.at/eli/bgbl/1987/287/P3/NOR12013339?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=Auskunftspflichtgesetz&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=3&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=11.03.2024&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=46bee1dc-e46a-4257-9b32-8fb1d1bf1651 § 3 Auskunftspflichtgesetz]. On 26.08.2020, the controller rejected the journalist's request, arguing that it cannot provide the requested information due to a statutory duty of confidentiality coming from data protection ([https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=11.03.2024&VonInkrafttret
On 28 March 2022, the Swedish DPA ("IMY") fined Klarna AB ("the controller") €730,000 (SEK 7,300,000) for not providing data subjects with adequate information related to their processing activities. The DPA found that the controller violated the GDPR in several respects. The controller appealed the DPA's decision to a court of first instance, the Administrative Court of Stockholm ("FiS"). The Administrative Court upheld the controller's appeal in part and lowered the administrative fine to €600,000 (SEK 6,000,000) because the violations did not cause considerable harm and were not intentional and the controller had improved its information. The DPA appealed this decision to a court of appeal, the Administrative Court of Appeal of Stockholm ("KamR Stockholm"), requesting the fine to be raised back to €730,000 (SEK 7,300,000). The court of appeal, reviewed the entire appealed decision to decide whether the controller should be fined on the grounds put forward by the DPA. The Court therefore reviewed whether the controller provided complete or sufficient information on different aspects in their privacy policy and if they fulfilled the requirements on how it should be provided under Article 12 GDPR, Article 13 GDPR and Article 14 GDPR. The court of appeal disagreed with the court of first instance on whether the controller infringed Article 13(1)(f) GDPR by not indicating the specific countries to which personal data is transferred. The court of appeal found that the GDPR does not require that the specific third countries must be named. Therefore, the Court held that the controller did not violate Article 13(1)(f) GDPR by not specifying the third countries in their privacy policy. Moreover, the court of appeal disagreed with the court of first instance on whether the information provided by the controller on the rights of data subjects fulfilled the requirements of Article 13(2)(b) GDPR. This Article requires the controller to inform the data subject of the existen
This is an appeal of the earlier case [https://gdprhub.eu/index.php?title=CJEU_-_T%E2%80%91384/20_-_OC_v_European_Commission T‑384/20 - OC v European Commission.] The claimant (OC) appealed the general court’s decision on three grounds. That the General Court had legally misinterpreted the definition of personal data and had failed to observe proper administrative procedures when making its judgement (right to a presumption of innocence and the right to good administration under the Charter of Fundamental Rights). On the concept of personal data, the claimant argued that the general court had legally misinterpreted the concept of an ‘identifiable natural person’. They used two points to make this argument: 1) Identifiability is not tied to whether an “average reader” can identify you. The case law states that identifiability depends on whether an individual holds ‘additional factors...necessary for identification... [these factors] can be available to a person other than the controller’ (see C-582/14 at para 39 and 41). The General Court’s use of an average reader does not analyse the factors that the specific reader in the case holds. Thus, contrary to the case law, it does not test whether a person has the additional factors needed for identification. The General Court’s novel use of this test was therefore erroneous. 2) The General Court had erred in arguing that the ‘means reasonably likely’ to be used to identify a data subject (recital 26 GDPR and recital 16 EUDPR) was limited. Rather, the court should have looked at the costs and time required for the identification of the claimant to determine whether the claimant could be identified using ‘reasonable means’. This would be in line with what recital 25 GDPR actually states. The Court held that the General Court had made several errors of law and that the first ground of appeal must be upheld. First, the Court noted that the EUDPR (Regulation 2018/1725) - the piece of legislation applicable at the ca
The case involves the Transparency & Consent Framework for online advertising, focusing on personal data processing compliance with GDPR, not specific cookie violations.
A data subject participated in a competition organized by Endemol Shine Finland. The latter made an oral request to the Etelä-Savon käräjäoikeus (District Court, South Savo, Finland) for information on possible ongoing or completed criminal proceedings concerning the data subject, for the purpose of clarifying their criminal record. The district court refused the request. Following this, Endemol Shine Finland brought an appeal against the judgement before the Itä-Suomen hovioikeus (Court of Appeal, Eastern Finland, Finland). The latter stayed the proceedings and referred three questions to the CJEU: # Does an oral transfer of personal data constitute processing of personal data within the meaning of Article 2(1) and 4(2) GDPR # Can public access to official documents allow information on criminal convictions or offences to be obtained from a court’s register without restriction when the request is made orally? # Is it relevant whether the person requesting the information is a company or a private individual? On the first question: Article 4(2) GDPR defines “processing” as: any operation or set of operations which is performed on the personal data or on sets of personal data, whether or not by automated means. The Court determined that the use of “any operation” in this definition is intended to give the concept of “processing” a broad scope, which is corroborated by the non-exhaustive nature, expressed by the phrase “such as”. The Court added that Article 4(2) GDPR does not lay down any condition as to the form of processing meaning that the concept of processing covers the oral disclosure of personal data. The question still arose as to whether the oral disclosure of personal data falls within the material scope of the GDPR. Article 2(1) GDPR provides that the GDPR applies to the processing wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part
The data subject, a job seeker with over ten years of experience in debt and accounts management, applied twice for a position at a housing company (the controller) on 3 August 2022 and 3 December 2022. The controller did not respond to either application. On 18 May 2023, the data subject requested access to his personal data under Article 15 GDPR. After receiving no response, he sent reminders on 3 June 2023 and 18 June 2023, with deadlines of 17 June 2023 and 28 June 2023. The controller still did not respond. The data subject then filed a lawsuit at the Labour Court Düsseldorf ("Arbeitsgericht Düsseldorf - AG Düsseldorf") seeking a copy of his data, information on all the recipients to whom his personal data was disclosed to, and €5,000 in non-material damages. The first instance court ruled partially in favour of the data subject, granting the access request but denying the claim for non-material damages. The court held that a violation of Article 15(1) GDPR always means a loss of control and cannot be considered as the damage itself. Therefore, the court found that the data subject did not demonstrate any non-material damage entitling him to compensation. The data subject then appealed this decision at the Regional Labour Court Düsseldorf ("Landesarbeitsgericht Düsseldorf - LAG Düsseldorf"), adjusting his claim to €2,500 in non-material damages. First, the court held that the controller violated Article 15 GDPR in conjunction with Article 12(3) GDPR by not providing information on the data subject's personal data, its processing purposes, and the recipients of the personal data to the data subject after repeated requests. Second, the court determined whether the violation under Article 15 GDPR gave rise to a claim for compensation for material and non-material damage under Article 82(1) GDPR. The court held that Article 82(1) GDPR should not be interpreted too narrow. The court took into account that some case law take the view that violations under Artic
A data subject, an entrepreneur, requested access to their personal data at a credit ranking agency (“controller”). The controller provided certain information, including that a specifically named company had carried out a query regarding the identity and creditworthiness of the data subject. The data subject lodged a complaint with the Austrian DPA (“Datenschutzbehörde”) against the controller for violating their right of access under Article 15 GDPR and for violating the principles of data minimisation (Article 5(1)(c) GDPR), confidentiality (Article 5(1)(f) GDPR) and the controller’s information obligation under Article 14 GDPR regarding the transfer of the data subject’s data to a third party. The data subject argued that the information that the controller provided was inadequate as it did not provide the origin of the data, storage period, processing purposes and a copy was missing. The DPA dismissed the complaint, stating that the controller provided sufficient information. The DPA held that the controller fulfilled the information obligations as the information was publicly accessible on a website. The data subject appealed this decision to the Federal Administrative Court (“Bundesverwaltungsgericht”). The Federal Administrative Court partially upheld the complaint against the controller, stating that the controller violated the data subject’s right of access by providing insufficient information on the storage period within the meaning of Article 15(1)(d) GDPR. At the same time, the court dismissed the data subject’s arguments concerning the information on the origin of the data and the processing purposes. Concerning transparency obligations, the court further held that the controller did not fulfil its duty to provide information on the recipients of data and thereby violated Article 14(1)(e) GDPR. Finally, the court rejected the complaint on the alleged violations of data minimisation and right to confidentiality. Both the DPA and the controller appe
Following the murder of a Slovak journalist and his fiancée, Mr Ján Kuciak and Ms Martina Kušnírová, in Slovakia on 21 February 2018, the Slovak authorities (Národná kriminálna agentúra (National Crime Agency, Slovakia; ‘NAKA’)) conducted an extensive investigation. At the request of those authorities, the European Union Agency for Law Enforcement Cooperation (‘Europol’) extracted the data stored on two mobile telephones allegedly belonging to Mr Marian Kočner, the data subject, who was prosecuted as an accomplice to that murder for having ordered the killings, following the investigation. Europol sent its scientific reports to those authorities and delivered to them a hard disk containing the encrypted data it had extracted. In one of its reports, Europol stated that Mr Kočner had been detained on suspicion of a financial offence since 2018 and that his name was, inter alia, directly linked to the ‘so-called mafia lists’ and the ‘Panama Papers’. In May 2019, the Slovak press and international network of investigative journalists published a large amount of information relating to Mr Kočner from his mobile telephones, including transcripts of intimate communications exchanged between him and his girlfriend. The conversation was carried by means of encrypted messaging service. For the reasons stated above, Mr Kočner sent a complaint to Europol seeking compensation in the amount of €100,000 as a reparation for the non-material damage on the bases of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0794 Article 50(1) Regulation 2016/794]. The sought compensation consisted of €50,000 for the unlawful disclosure of data subject's intimate conversation with his girlfriend and €50,000 for the inclusion of his name on the 'mafia list'. Europol and Slovak Republic contended that the arguments are unfounded as, firstly, Regulation 2016/794 (setting up the rules for the Europol) does not provide for such joint liability of Europol and the Member State.
The data subject was an employee of the controller, a financial advisory firm. On 11 April 2019, the data subject requested copies of all personal data the controller held about them under Article 15(3) GDPR, covering the years from 1 January 1997 to 31 March 2018. The controller provided a standard disclosure of stored information but did not supply actual copies of documents. The data subject then sued for damages and specifically sought court orders requiring the controller to hand over copies of all personal data, including telephone notes, file memos, minutes of conversations, emails, letters, and subscription documents related to investments. The case progressed through the regional court and higher regional court, which differed on the scope of what must be provided. Both controller and data subject appealed previous decisions. First, the court clarified that the right under Article 15(3) GDPR to receive a “copy” of personal data does not automatically extend to entire documents simply because they contain personal data. It held that documents the data subject themself authored (such as emails and letters to the controller) are in their entirety personal data and must be supplied as copies because the personal data is inherent in the document. Documents or parts of documents created by the controller (such as telephone notes, file memos, minutes, letters from the controller, or investment subscription forms) are not wholly personal data of the data subject as they may contain mixed information. Second, it clarified that the controller must provide only those portions that constitute the data subject’s personal data and need not turn over entire documents if parts are unrelated to the personal data. Finally, the court therefore limited the data subject’s entitlement to copies of their own emails and letters held by the controller and dismissed requests for broader document disclosure.
The data subject applied for a job position at the controller. As his application was rejected, the data subject wanted to know the reasons for the rejection and requested from the controller a copy of his personal data under Article 15 GDPR. However, the controller only provided a printout of the stored data to the data subject. Subsequently, the data subject filed a complaint against the controller before the labour court in Düsseldorf ("Arbeitsgericht Düsseldorf"), seeking all information about recipients of his personal data, reasons for rejection of his job application, and a copy of all of his personal data. The data subject also requested €6,000 for non-material damages under Article 82 GDPR. During the course of the proceedings, the first three claims were settled as the controller provided the requested information in the written statement. The monetary compensation was reduced to €2,000. The data subject still claimed non-material damages because the controller failed to provide access under Article 15 GDPR without undue delay and in any event within one month, which resulted in a loss of control over his data. The data subject was also massively annoyed that the controller did not properly fulfil his right to access. The court dismissed the data subject's claim for monetary compensation under Article 82(1) GDPR as he was unable to demonstrate either non-material damage or the causal nexus between the violation of the GDPR and the damage. The court took into account the CJEU judgements in case C-667/21 - Krankenversicherung Nordrhein and C-687/21 - Saturn Electroand held that Article 82(1) GDPR is not about punitive damages for a violation of the GDPR. It merely fulfils a compensatory function as a genuine claim for damages. Therefore, a claim for damages would require a violation of the law as well as damage caused as a result of the violation of the law. Thus, there must also have been negative consequences for the person to claim damages. The court