GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
The case involved a failure to respond to a data erasure request, unrelated to cookies or consent mechanisms.
Swedish DPA fined Medhelp (Controller) a total of € 1,200,000 (SEK 12 million) for several breaches of GDPR. The Controller was contracted to answer and give medical advice on the medical advice phone line '1177' by three Swedish regions. The DPA found that the Controller breached GDPR on the following points: a) Medhelp was fined for unlawfully disclosing personal data to MediCall, a Thai company, and for allowing MediCall to process personal data, violating Article_5_GDPR#1a, Article_6_GDPR, and Article_9_GDPR#1. b) Medhelp, for an unknown period, exposed personal data in from of audio files containing recorded phone calls to 1177 on the internet without protection against unauthorized disclosure and unauthorized access, breaching Article_5_GDPR#1f and Article_32_GDPR#1 . c) Medhelp, other than an automated message stating that the calls were being recorded for patient safety and quality purposes, did not properly inform callers about how their personal data would be processed in connection with the collection of personal data during phone calls to 1177, in violation of Article_5_GDPR#1a and Article_13_GDPR. Medhelp appealed the DPA's decision to the Administrative Court in Stockholm, which overturned point (a) of the decision and remanded the issue to IMY for further processing, amended the decision for points (b) to (d) to reduce the sanction fee to 8,800,000 SEK, and dismissed the appeal in other respects. The Administrative Court annulled point (a) of IMY's decision, because both MediCall and Medhelp were deemed healthcare providers with responsibility for the personal data under Swedish laws, and MediCall's personnel were also subject to confidentiality obligations specified in [https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/patientsakerhetslag-2010659_sfs-2010-659/#K6 Chapter 6 of Patient Safety Act.] That court ruled that Medhelp was legally permitted to disclose personal data to MediCall for processing in relation
The controller (employer) and the data subject (employee) disagreed about the immaterial damages according to Article 82(1) GDPR. The data subject first demanded the removal of two written warnings (one for a data protection violation) from their personnel file on 12 July 2022 which they had received on 29 June 2022. On 13 July 2022, the data subject also sent the controller a request pursuant to Article 15 GDPR and demanded a copy of their personal data. The controller complied on 30 August 2022 and informed the data subject of the data that is processed, but did not include copies of documents. On 02 February 2023, the data subject filed a lawsuit to demand that the controller hands over a copy of the data and €3,000 in compensation (Article 82(1) GDPR) due to a belated and incomplete provision by the controller. The subject alleged that they suffered immaterial damages due to the loss of control over their data. On 01 June 2023, the parties reached a partial settlement before the Labour Court Mainz. The controller agreed to remove both written warnings from the personnel file of the data subject, supply copies of the processed data in the future, and let the data subject access the file after 31 August 2023, while the subject in turn agreed to be more careful in the future about who is included in the mailing list as to not cause another data protection violation. The Labour Court sentenced the controller to pay €1,000 (as opposed to the initially suggested €3,000) to the data subject. The controller appealed this decision and argued that not every violation against the GDPR could constitute immaterial damages and that the other party needed to prove the damages. In case of the data subject, it alleged it needed to be proven how the loss of control caused damages, and that the data was not lost, but lawfully processed. The data subject responded by requesting a dismissal of the appeal and to be paid another €2,000 by the controller for the failure to timely a
On 20 October 2020, the data subject requested information regarding his personal data stored by the controller and requested copies of all records containing this data. In a letter from 18 November 2020, the controller provided the data subject with general information regarding the personal data stored in their IT systems, the categories of this data, and the recipients of this data to whom the controller had disclosed it. Moreover, the controller stated that although the data subject is not entitled to receive copies of all documents in which his personal data is mentioned, copies will be made available to the data subject if he specifies his request for information and describes which documents or processing activities he was concerned with. In a letter from 4 December 2020, the data subject argued that the information provided was late and incomplete as it only listed in a specific way his so-called 'master data' (Stammdaten'), whereas the data subject asserted a right to receive copies of all documents held by the controller in which his personal data was listed. He additionally requested from the controller to erase all of his personal data and in the case of no erasure, the data subject objected to further processing of his personal data. In a letter from 28 December 2020, the controller informed the data subject that it could not erase his personal data and rejected the data subject's objection to further processing. The controller reiterated that further copies will only be made available if the data subject specifies his request. On 15 March 2021, the data subject filed a lawsuit against the controller at the Administrate Court of Berlin (Verwaltungsgericht Berlin, VG Berlin). The controller complied with the request for erasure after the filing of the lawsuit and therefore the parties agreed that this part of the lawsuit was settled. However, the data subject still requested the controller to provide him with all information on his personal data and to
The data subject has private health and long-term care insurance with the controller. The controller increased the contributions in 2018 and 2020. The data subject considers the premium increases to be unlawful. Consequently, in civil court, the data subject requested information on the basis of Article 15(1) GDPR from the controller about premium increases starting from 2016, including justifications for the premium adjustment and supplements to the insurance policy. The Landsgericht Verden (Regional Court of Verden) upheld the action. The controller appealed the decision to the Oberlandesgerichts Celle (Higher Regional Court of Celle). However, the Court of Appeal held that the data subject is entitled to the asserted right to information under Article 15(1) GDPR. It found that letters from the controller to the data subject, even standard letters sent to a large number of recipients with the same content, are subject to the right to information as they contain information about the data subject. The controller appealed to the German Federal Court of Justice (Bundesgerichtshof – BGH). The Federal Court of Justice held that the access request by the data subject cannot be affirmed based on the reasoning of the Court of Appeal. Article 15 GDPR and the GDPR as such are applicable, even if the processing occurred before the GDPR came into force in 2018. This is because the request was submitted after 2018. The CJEU previously ruled that “it is applicable to a request for access to the information referred to in that provision where the processing operations which that request concerns were carried out before the date on which that regulation became applicable, but the request was submitted after that date.” (see [https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:62021CJ0579 CJEU Case C-579/21], para 36). However, Article 15 GDPR cannot be used in the case at issue, because of the following reasons: Firstly, in light of the broad scope of personal data und
NAV, the Norwegian Labour and Welfare Administration, is a government agency that collaborates with local municipalities to provide a unified access to public labor and welfare services. Its primary functions include promoting employment and ensuring financial and social security. NAV administers a significant portion of the state budget and is one of the country's largest employers with about 22,000 employees. Nearly all citizens of Norway are in contact with NAV at some point of their life. NAV, in a letter to the data subject, admitted that it had unlawfully read his case files, equaling a violation of confidentiality. This formed the basis of the original complaint (Article 77 GDPR), which was declined by the DPA on the following basis: The Norwegian DPA Datatilsynet argued it is not the competent authority to assess the legality of isolated access to individual case files, and the potential violation of NAV employees' obligation to confidentiality. PVN related this appeal to a larger DPA investigation in September 2023 of NAV's insufficient logging, access and log controls. (Datatilsynet (Norway) - 23/00708). On 6 February 2024, PVN unanimously decided to uphold the DPA's decision not to further investigate this case. PVN underscored that this case does not concern the lawfulness of processing under Article 6 GDPR or the processing of special categories of personal data under Article 9 GDPR. Rather, the crux is whether one of the controller's employees had a valid reason to access a particular case file. PVN further argues that isolated incidences of "unnecessary" access to case files do not necessarily amount to a violation of Articles 24 and 25 GDPR, thereby not resulting in any corrective measures under Article 58(2) GDPR.
The data subject lodged a complaint with the Croatian DPA (“AZOP”) after their yard was filmed by a controller. The AZOP considered that this processing operation had no valid legal basis. On 3 October 2018, it ordered the deletion of every recording of the yard or public road and prohibited the controller from recording the yard in question. The decision indicated that “No appeal is allowed against this decision”. In accordance with Article 133(2) of the Croatian Act on General Administrative Procedure, the decision became enforceable by delivery of the decision to the party. The controller did not act on the decision. The data subjects thus submitted a request to the AZOP to adopt an enforcement decision. Meanwhile, the controller initiated an administrative dispute against the initial decision taken by the AZOP. The AZOP responded to the data subjects that the conditions for execution of the decision were not met because that decision faced an ongoing procedure before an Administrative Court. Following the conclusion of the administrative dispute, the data subjects asked the AZOP to adopt a decision on the enforcement of the decision. The AZOP did not take any action. The data subjects submitted a complaint with the Administrative Court of Zaghreb against the AZOP. The AZOP stated that it did not take any action because the controller indicated that the recordings were deleted and the data subjects did not prove the contrary. It made two arguments pursuant to the [https://narodne-novine.nn.hr/clanci/sluzbeni/2009_04_47_1065.html Croatian Act on General Administrative Procedure]. First, it noted that Article [https://narodne-novine.nn.hr/clanci/sluzbeni/2009_04_47_1065.html 139(1) of this Act] establishes an obligation to issue a decision when the executed party does not act according the enforcement decision. Second, the AZOP argued that the decision cannot be enforced because the statute of limitations period granting 5 years to bring an enforcement action un
On 29 November 2023, the Spanish trade union CCOO initiated legal action against the controller concerning a collective labor dispute. In response to the pandemic, some employees of the controller transitioned to telecommuting arrangements. The controller proposed a telecommuting agreement, which the Workers' Legal Representation did not accept, ending the negotiation process without consensus. The controller then entered into individual agreements with the employees regulating, among other topics, the use of personal devices of employees for 2-factor authentication purposes (2FA). The Worker’s Legal Representation brought proceedings before the court seeking annulment, among others, of the clause that mandated the employees to provide their cell phone numbers for receiving SMS messages and/or accessing applications to confirm identity during established working hours. The controller justified this requirement based on cybersecurity reasons and their legitimate interest in ensuring information and system security. The court held that the clause was void since, according to [https://www.boe.es/diario_boe/txt.php?id=BOE-A-2023-13741 Article 19.7 of the Collective Bargaining Agreement of State Scope for the Contact Center Sector], companies shall provide tools, applications, or devices especially in the event where a 2FA system is necessary. The controller should furnish the requisite tools and means, rather than relying on workers' personal devices. In exceptional cases and exclusively for this purpose, if the employee refuses the tool provided by the company, they may consent to use devices or tools of their own.
On May 2021, Dansk Retursystem sent to the data subject an advertising letter advertising products from X. Lebensversicherung AG. As a result, the data subject demanded information from the controller and the deletion of his data. The controller replied that it had received the data from the company AD from Switzerland and processed it on behalf of X. Lebensversicherung AG for marketing purposes on the basis of Article 6(1)(f) GDPR, without transmitting the data to the data subject himself. The data subject claimed for non-material damages pursuant to Article 82 GDPR in the amount of EUR 3,000.00, as well as pre-trial legal costs, for violation of Article 6(1)(f) GDPR, affirming that he did not consent to such processing of his personal data and there was no customer relationship with the defendant or its business partners. The Court dismissed the claim, recognizing that advertising can be a legitimate interest within the controller's business. Also, the data subject's interests do not outweigh the interests of the controller. In addition, they highlighted that having a customer relationship before the direct advertising it is not a requirement. Unsatisfied, the data subject appealed, requesting a compensation for his non-material damage in the amount of €3,000.00 and the reimbursement of the appeal in the amount of €603.93. The Court decided to uphold the judgment of the Stuttgart Regional Court, dismissing the data subject's appeal. They concluded that the advertising mail sent by Dansk Retursystem was lawful under Article 6(1)(f) GDPR and there was no need for an existing customer relationship for direct advertising to be considered a legitimate interest. Also, they highlighted that the data subject's claim for damages under Article 82 GDPR was unfounded, since he failed to demonstrate that he suffered any actual harm or distress beyond mere displeasure from receiving the advertisement. The Court reaffirmed that the use of personal data for direct advertising
On 6 September 2017 the municipality of Enschede decided to start 24/7 WiFi tracking in the centre of the city. Its purpose was to measure the effectiveness of municipal investments, in view of the responsible use of public funds. The contract to execute this task was given to City Traffic B.V., now Bureau RMC. Bureau RMC then contracted an unnamed party to do the installation and maintenance of the sensors and to collect and validate the data gathered by the sensors. Information collected included hashed MAC-addresses, date and timestamp of exposure, signal strength and sensor ID. It was stored for a period between 6 and 7 months. Starting from 1 January 2019 the hashed MAC-addresses were also truncated. On 30 April 2020 the municipality gave an assignment to Bureau RMC to switch the tracking sensors off. The Dutch DPA concluded that the chosen anonymization method of truncating a small part of the hashed MAC address does not sufficiently exclude the risks of singling out, linking or deducing person’s identity based on a pseudonymous identifier + timestamp + location information (available via the sensor ID). Accofrding to the Dutch DPA employees of the controller could identify people in three ways: (a) When someone walks past sensor, their MAC address is registered and an employee in the vicinity of the sensor could see who is walking by and link the MAC address to the person walking by on that moment. (b) the moment that a device enters the range of the sensor and the moment when device leaves the range of the sensor were stored. If someone enters for a longer time but does not exit within range sensor, and employee could find out who is in the range of the sensor in the corresponding time-span and connect the MAC address to that person. (c) An employee could determine a movement pattern based on the readings of multiple sensors, and use this information to link the MAC address to a specific person. Because of these reasons the Dutch DPA held that the data pro
On 15 February 2020, a data subject lodged a complaint with the French DPA (“CNIL”) regarding the refusal by the Diocesan association of Angers to grant his request for access to personal data concerning him contained in the baptism register of Angers’ diocese and to exercise his right to erasure and to object the processing of his personal data. After noting that the access request had been granted by the controller, the CNIL considered that (i) the data subject could not rely on any of the grounds for deletion mentioned in Article 17(1) GDPR and (ii) the insertion in the margin of the register of a statement indicating that the data subject did not recognize the value of his baptism could be regarded as satisfying the exercise of his right to object under Article 21(1) GDPR. Therefore, in a letter dated 2 December 2021, the CNIL informed the data subject of their decision to close the complaint. The data subject appealed this decision asking the French Supreme Administrative court (“Conseil d’Etat”) to annul it. Firstly, regarding the lawfulness of the processing in itself, data revealing a person’s religious beliefs is, by virtue of Article 9 GDPR, sensitive data whose processing is, in principle, prohibited. By way of exception, the processing of such data is authorised, in particular under Article 9(2)(d) if it is carried out, in the context of their legitimate activities and subject to appropriate safeguards, by an association pursuing a religious aim, provided that the processing relates to members, former members or persons having regular contact with it. The Conseil d’Etat noted that the baptism registers kept by the Catholic Church are intended to keep a record of every event. This personal data was only accessible to the persons concerned and the registers were kept in a closed place before being deposited in the diocese’s historical archives for a period of 120 years. The Conseil d’Etat therefore considered that the mention of personal data in the ba
On 16 September 2021, the Italian DPA issued a €200,000 fine against the controller, a university. While Covid-19 restrictions were in place, it used a proctoring software to ensure students were not cheating during the examination. Among other matters, the DPA found that the controller was processing biometric data without a legal basis. The controller challenged the DPA decision before the Court of Milan. On 20 October 2022, this Court partially upheld the controller’s appeal and overturned the DPA decision. It ruled that the data that was processed did not fall into the definition of biometric data as per Article 4(14) GDPR. On 12 January 2023, the DPA appealed the decision of the Court of Milan before the Supreme Court, which upheld the appeal and overturned the judgement. Firstly, the court analysed whether the data processed fell into the definition of biometric data in accordance with Article 4(14) GDPR. The court reminded that, according to this definition, personal data is biometric data when (1) it results from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person and (2) this processing allows or confirms the unique identification of that natural person. Secondly, the Supreme Court disagreed with the judgement of the Court of Milan: according to the former, this processing was actually involving biometric data. It observed that the software was not only filming students while they were taking the exam, but also analysing the recording. More specifically, it was detecting “unusual behaviours” and collecting these “anomalous elements” into a video. This video was then sent to the professor, who could then decide if a further investigation was necessary. The court pointed out that, among other functions, this processing allowed to uniquely identify the person, as during all the recording time the software constantly checks if the person behind the camera is actually the student who is su
In 2010, debt settlement proceedings were issued against the data subject. The data subject settled the payments of their debts in March 2018. After settling the debts, the civil court ordered to make the personal data of the data subject unavailable to the public in the public insolvency register. The controller, a credit ranking agency, continued to process and store personal data of the data subject that related to his debt settlement procedure that the controller obtained from the public insolvency register. The purpose of the procesing was to assess the creditworthiness of the data subject and his company. The data subject was the company's sole shareholder. The data subject requested the erasure of his personal data on 4 May 2018, after fulfilling his debt payment plan. The controller did not reply. On 24 October 2018, the data subject lodged a complaint at the Austrian DPA against the controller for the infringement of the right to erasure under Article 17 GDPR. The controller informed the DPA by letter the same day that it would not comply with this request. The DPA dismissed the data protection complaint. The decision does not give detail on why the complaint was dismissed. The data subject appealed this decision at the Federal Administrative Court (Bundesverwaltungsgericht, BVwG). The court dismissed the appeal. The court found that the controller’s processing the personal data in question was necessary, as the purpose of the processing was for making a forecast about the future payment behaviour of the data subject. The court found that the interests of the controller and its third parties outweighed the interests of the data subject The court concluded that the processing of data on historical insolvencies and payment defaults of the data subject was necessary and lawful and that the objections raised by the data subject could not justify his request for erasure. The data subject appealed to the decision before the Austrian Supreme Administrative Co
Following an investigation, an entry was made into the police records about a data subject. The data subject was convicted and given a one year suspended sentence. After serving the sentence the data subject was legally rehabilitated according to national law. Due to this, the data subject requested the erasure of the entry concerning him in the police records. The police (the controller) refused on the grounds that legal rehabilitation is not one of the grounds for erasure in the police records under national law. The administrative court of Sofia in Bulgaria upheld the police's decision. Therefore, the data subject brought an appeal before the Supreme Administrative Court, Bulgaria. The data subject argued that Article 5,13 and 14 LED (the roughly equivalent GDPR articles would be Article 5(1)(e), 13 and 15 GDPR) do not permit the police to indefinitely process his data. This is de facto the data subject's current case, as without a ground for removal, they will never be able to obtain erasure from the police register. The Supreme Administrative Court, Bulgaria referred the following question to the CJEU: 1) Does Article 5 and 13(2)(b) and 13(3) LED allow national law which leads to a virtually unrestricted right for authorities to process personal data and does this allow for the elimination of the data subject's right to restricted processing or erasure? The CJEU held that the LED precluded national legislation and does not allow the police to process the data indiscriminately until the data subject's death. First, the CJEU broadened the question that was being referred to it by reformulating it (as is allowed under C-742/19 Ministrtsvo za obramo). It included into the scope of the question special categories of data, as the national legislation on storage also includes biometric and genetic data. It also broadened the relevant LED Articles in question to include 4(1)(c) and (e), 10, 16(2) and (3). The question was therefore, whether these articles preclude
A data subject lodged a complaint to the French DPA (“CNIL”) regarding workplace video surveillance on the controller’s premises. The CNIL led an investigation on 21 June 2022. During said investigation, the person in charge of the premises did not object to the investigation, however the manager then instructed the person in charge of the premises not to sign the inspection report, and did not respond to phone calls and messages sent to him by the agents of the CNIL. The controller did not reply to requests for information and documents, nor to reminders sent by the DPA. On 2 December 2022, the CNIL sent a report proposing to impose an administrative fine and an injunction to provide the information requested, to which no response was received. In a letter dated 22 December 2022, the controller’s lawyer submitted observations and communicated only part of the information and documents requested. The CNIL imposed a €10,000 fine on 8 February 2023 for not cooperating with the DPA. The CNIL also asked that the controller provide the documents requested and provide detailed answers to the questions asked, subject to a penalty of €50 per day of delay at the end of the period of one month following the notification of this decision. The controller asked the French Supreme Administrative Court (“Conseil d’Etat”) to annul this decision. Firstly, pursuant to Article 58(1)(a) GDPR, a supervisory authority may order the controller to provide it with any information and personal data it requires to do its duties. Furthermore, Article 31 GDPR states that the controller must cooperate with the supervisory authority. The Conseil d’Etat considered that the controller did not provide the CNIL with the documents and information requested on the video surveillance systems installed on its business premises, thereby depriving the CNIL of the means necessary to verify the controller’s compliance with the GDPR. Secondly, the Conseil d’Etat also considered that the documents the cont
The Association of Accidental Americans (“Association”) sought the annulment of the decision of 23 May 2022 by which the French DPA (“CNIL”) ordered the closure of its complaint seeking the suspension of automatic transfers of tax data operated between France and the United States pursuant to the international agreement concluded on 14 November 2013 (“FATCA Agreement”). The Association appealed the decision in front of the French Supreme Administrative Court (“Conseil d’Etat”). Firstly, Article 5 GDPR states that processing must respect data minimization and storage limitation. The Association had considered that by analyzing the US Treasury and statements by the US tax authority, the transfer of personal data to the US authorities under the FACTA Agreement did not meet the data minimization requirement since (i) little or no use would be made of this data by these authorities due to the lack of resources available and (ii) there would be a lack of reciprocity between the American and European authorities as regards to the transmission of this data. The Conseil d’Etat considered that since it was not disputed that the processing at issue served a legitimate purpose of improving compliance with tax obligations and provides for procedures for selecting, collecting and processing data that was appropriate and proportionate to that purpose, the circumstances alleged could not lead to this processing as being regarded as failing to comply with the data minimization requirement. Furthermore, the Conseil d’Etat noted that the mere fact that the 'FATCA' agreement does not contain any stipulations on the length of time for which transferred data may be retained did not in itself, in view of the safeguards provided by US law, and in particular the Privacy Act of 1974, imply a failure to comply with Article 5(1)(e) GDPR. Secondly, the Association had held that although the Conseil d’Etat had ruled that the FATCA Agreement did not infringe Article 46 GDPR in previous decisi
The data subject (the claimant) bought a household appliance. To buy it he entered into a payment contract with Saturn Media Market (the controller). This contract contained the claimant's personal data (first and last name, address, place of residence, employer, income and bank details) and was printed and signed by both the controller and claimant. The claimant took the appliance and contract to the check-out desk at the Saturn Media Market. A third party slipped past the claimant in the line and was able to collect both the appliance and the contract. An employee at Saturn Media Market realised the mistake and was able to reclaim the appliance and contract within half an hour. There was no evidence that the third party misused the personal data of the claimant. The controller offered to compensate the complainant for the mistake by sending the appliance free of charge to his house. The claimant refused and requested damages under Article 82(1) GDPR. The claimant brought an action before the Amtsgericht Hagen (Hagen District Court, Germany) wanting compensation for the non-material damage he claimed to have suffered as a result of the error made by Saturn's employees and the risks resulting from the loss of control over his personal data. The Hagen District Court referred seven questions to the CJEU: # Is Article 82 GDPR valid given that the Article itself appears to to lack precision as to its legal effects in the event of compensation for non-material damage. As no automatic legal effects are specified, is the compensation rule is valid in respect of non-material damage? # Does the complainant need to prove, in addition to the unathorised disclosure to a third party, the existence of a damage? # Does the mere fact that printed documents containing personal data that have been transmitted without authorisation to a third party due to an error committed by employees of the controller, establish a breach of the GDPR? # Does unintenional disclosure (via a breach
The data subject was a registered user of Twitter, operated by the parent company of the controller. The data subject posted on multiple occasions content that the controller removed on the same days. On 13 February 2022, the controller deactivated the data subject's account and notified them. The data subject sought legal redress, and the LG Köln ordered the controller to fully restore the profile, provide information on whether the deactivation had been undertaken by a third-party company, and cover the data subject's legal costs. The court rejected the data subject's additional requests for data correction, prevention of further account blocking, and damages of €1,500. The data subject appealed, seeking these rejected requests. The controller, however, withdrew its appeal. The Higher Regional Court of Cologne dismissed the data subject's appeal. First, the court held that the data subject's request to delete all deletion and blocking notes from their user data record did not establish a valid deletion claim under Article 17 GDPR#1 as the upcoming legal processes made the data necessary for the defence of legal claims Article 17 GDPR#3e. The court found that the controller's documentation of violations against its terms did not entitle the data subject to a correction claim under Article 16 GDPR. The statements on the deletion counter were not factual inaccuracies but legal assessments. Thus, the claim for correction rights according to Article 16 GDPR did not apply. Third, the court examined the request to prevent future account blocks without prior notification and found it excessively broad. Certain scenarios, such as blocking for unlawful content, permitted the controller's immediate action under legal compliance obligations. Therefore, this claim was unreasonable. astly, the court dismissed the request for damages, as the appeal did not present a clear basis for differentiating claimed material and immaterial damages (€1,500 total), which contravened proce
The controller was an Austrian social security body and the data subjects were three employees. On 30 July 2020, the controller’s administrative board had a a non-public meeting and created a transcript of that meeting that only 26 people had access to. On 15 August 2020, a website published an article containing verbatim statements from named participants in the confidential transcribed meeting. On 16 October 2020, the controller started an internal investigation into the handling of meeting records and data security. In February 2021, it carried out a search of the email server logfiles of all employees for communications sent to a specific recipient domain. The search covered 6,000 employees’ mail server logfiles and produced a list containing sender and recipient email addresses, delivery status, subject line, size, and date and time of sending, but the controller did not review email content. The controller involved the works council chair of the head office, but it did not involve the local works councils representing the three data subjects, despite the controller’s internal works agreement requiring the local works council to be involved. The data subjects complained to the DPA on 15 February 2022. They argued that the controller had unlawfully searched employees’ email data without a valid legal basis and not with the correct procedure. The DPA upheld the complaint. The controller appealed to the Federal Administrative Court. First, the court held that the searched logfiles contained personal data within the meaning of Article 4(1) GDPR. The sender and recipient email addresses identified employees because they contained their first and last names, so searching those logfiles therefore amounted to processing under Article 4(2) GDPR. Second, the court rejected the DPA’s view that the controller needed a specific statutory basis because it was a public body. The court held that, in its relationship with employees, the controller acted under private law rat
The data subject is managing director of CEE Projekte Verwaltung GmbH, has been listed in the commercial register with their date of birth and residence since September 2012. In 2022, the data subject requested the deletion of their date of birth and residence from the commercial register, citing safety concerns due to their professional involvement with explosives, which could make them a target for kidnapping or robbery. The request was denied by the local court. Subsequently, the data subject appealed this decision, additionally requesting that the transmission of their personal data from the commercial register to third parties only occur after a balancing of interests. The appeal was rejected by the OLG Celle. The data subject then filed a legal complaint with the German Federal Court of Justice, which also upheld the previous decisions, insisting on the necessity of these data being included in the commercial register. The German Federal Court of Justice upheld all lower court's decision, determining that the controller had no right to the deletion of their date of birth and residence from the commercial register under Article 17(1) GDPR. The court ruled that the inclusion of this information is crucial for fulfilling a legal obligation of the register court under both union and national law. First, the court concluded that the data processing was mandated by law, rendering Article 17(3)(b) GDPR applicable, which permits data processing necessary for compliance with a legal obligation. Second, the court found that the data subject's objections under Article 21(1) GDPR were invalid when the data processing is based on Article 6(1)(c) GDPR, necessitated by a legal duty imposed on the controller. Lastly, the court noted that no restriction on processing could be requested under Article 18(1)(d) GDPR, as the data processing was lawful and essential for the register's public function. Hence, the Federal Court of Justice ruled that the residence and the date of