GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Unión General de Trabajadores (UGT), a trade union, lodged a complaint with the DPA (AEPD) against Amazon Road Transport Spain, S.L., the controller. Applicants wishing to work within the Amazon Flex delivery programme were required to provide a certificate confirming that they had no criminal record. The certificates and other application documents were processed by external processors responsible for the preliminary screening of candidates. The controller considered this requirement necessary to protect its customers and ensure the security of the programme. Delivery drivers transported packages directly to private residences and had access to customers’ addresses, telephone numbers and information that could reveal aspects of their habits. They could also be entrusted with packages of significant value. On 10 February 2022, the DPA imposed a €2 million fine on the controller for an infringement of Article 6(1), in conjunction with Article 10 GDPR, as well as [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 Articles 10] and [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 71 LOPDGDD]. The DPA considered that a certificate showing the absence of criminal convictions still constituted personal data relating to criminal convictions and offences. Consequently, it held that candidates’ consent could not legitimise the processing without a specific authorisation under Union or national law. The controller appealed the decision before the Audiencia Nacional, the appeal court. It argued that a certificate confirming the absence of criminal records did not fall within Article 10 GDPR and referred to previous cases in which the DPA had accepted similar requirements for certain professional activities. The Court granted the appeal and annulled the DPA’s decision and the €2 million fine. First, the Court held that Article 10 GDPR must be interpreted strictly, particularly in administrative sanctioning proceedings, which are governed by the principle of minimum i
On 5 June 2025, an individual (the data subject) made an access request under Article 15 GDPR to the Romanian National Railways Company, Societatea Națională de Căi Ferate SA (the controller). The data subject requested CCTV footage from 30 May 2025 and information regarding the processing of his personal data following an alleged altercation between the data subject and police agents in front of a railway station. The controller refused to provide the data subject with the requested footage citing the protection of the rights and interests of other persons in the CCTV images. Subsequently, the data subject filed a complaint with the Romanian DPA (ANSPDCP). The DPA found violations of Article 12(6) GDPR, Article 15(3) GDPR and Article 83(5)(b) GDPR and issued the controller with a warning. Moreover, the DPA ordered the controller, among other things, to provide the requested footage, to the extent that it was still available, while following guidelines about sharing such images. In court, the data subject sued the controller for immaterial damages worth RON 3,500 (€665) claiming that its failure to provide the requested footage led to feelings of frustration, stress, injustice and helplessness by being forced to undertake additional steps to make use of his rights and by making it impossible to use the requested footage in other legal cases. The court held that the DPA’s decision attested the infringement of the data subject’s right to access by the controller, meeting the requirements of an illicit act under Article 1357 Romanian Civil Code. Moreover, the court accepted the data subject’s stress and suffering and the causal link between them and the controller’s access request refusal. Therefore, the court awarded RON 1,000 (€190) in immaterial damages to the data subject in accordance with Article 1381(1) Romanian Civil Code, Article 1381(2) Romanian Civil Code and Article 1385 Romanian Civil Code. At the same time, the court considered that the damage was no
An Austrian citizen residing in Vienna (the data subject) subscribed to the newsletter of a family-run optician company (the controller) mainly operating in the German states of North Rhine-Westphalia and Lower Saxony in March 2023. During the registration process, he provided his email address as well as his first and last name and consented to the processing of his personal data. He then made an access request under Article 15 GDPR by fax, using letterhead that included his full home address, email address, and fax number. The controller refused to provide the requested information in April 2023 as it considered the request to constitute abuse of rights. It cited newspaper reports indicating that the defendant had subscribed to numerous newsletters solely for the purpose of asserting claims for damages. The controller brought proceedings concerning the legality of its rejection of the access request. The data subject demanded access to the information required by in Article 15 GDPR and the payment of monetary compensation of €1,000 in a counter-lawsuit. The court referred the case to the CJEU for a preliminary ruling in July 2024. The CJEU rendered its judgment in the case C-526/24 Brillen Rottler on 19 March 2026. It held that even an initial access request could be rejected on the grounds of an abuse of rights. According to the CJEU, the assessment of abusive conduct is based on all circumstances of the individual case. Both objective circumstances and the subjective intent of the data subject need to be taken into account. An abusive intent always exists if the access request is made in order to artificially create a claim for damages. The court held that the lawsuit had originally been well-founded and ruled that the counterclaims were without merit. According to the court, the controller could reject the data subject’s access request as excessive under Article 12(5)(b) GDPR. The data subject also had no right to damages under Article 82 GDPR due to the abs
The data subject is in the military. The unit he is employed at (controller) and the data subject are involved in a multitude of legal disputes concerning his employment, disciplinary proceedings, data protection matters as well as procedures of criminal law. After the controller revealed information on one of the legal proceedings concerning a penalty he received in an official meeting to third persons, the data subject lodged a complaint with the DPA. In the course of the DPA investigation of the complaint, the controller revealed to the DPA a statement written by the data subject concerning his declining health status because of the multitude of proceedings between the two parties. The data subject considered the sharing of this document as a processing of health data, in violation of Article 9 GDPR. The proceeding before the DPA dealt with the question of whether the data subject’s complaint was excessive pursuant to Article 57(4) GDPR. The DPA held that the statement constituted health data pursuant to Article 4(15) GDPR. Since the processing of the statement happened in the context of the enforcement of legal claims, the DPA did not find a violation of Article 9 GDPR. The data subject appealed the DPA's decision. The Court upheld the DPA’S decision and decided that the controller could rely on the legal basis of Article 9(2)(f) GDPR. The Court held that the notion of “legal claims” pursuant to Article 9(2)(f) GDPR must be understood broadly as meaning any legal conflict. The notion of necessity in the context of Article 9(2)(f) GDPR is to be applied broadly as well because of the role the exemption plays for the enforcement of legal claims and because of Article 47 CFR, the right to an effective remedy and fair trial. “Necessary” must be understood as meaning that without the data in question, the enforcement of legal claims must be impossible or considerably more difficult. According to the Court, the requirement of necessity is not met where the process
The data subject had used a social media platform operated by the controller, an Irish company, since 2013. The controller provided “Business Tools” to third-party website operators and app providers. These tools enabled the controller to obtain data concerning how users interacted with third-party websites and apps, including information about page visits, purchases and advertisements clicked. In November 2023, the data subject requested that the controller recognize that the processing of his personal data was contrary to the parties’ contract, erase or anonymize the personal data, provide access to the personal data and pay compensation. The data subject subsequently brought an action before the Regional Court of Munich II, seeking a declaration that the parties’ user contract did not permit the processing, cessation of the processing of personal data collected through the Business Tools on third-party websites and apps, restriction of further processing, erasure or anonymization of previously collected data and at least €5,000 in non-material damages. The relevant data included direct and indirect identifiers, such as his name, contact details, IP address and internal identifiers, as well as website URLs, visit times, app names and information about his interactions with websites and apps. The Regional Court of Munich II dismissed the action, holding that the declaratory and erasure or anonymization claims were inadmissible, the cessation claims were legally unavailable and the damages claim had not been sufficiently substantiated. In relation to the damages claim, it found that the data subject had not identified specific third-party websites or apps through which his personal data had been processed. The data subject accordingly appealed to the Higher Regional Court of Munich. The Higher Regional Court of Munich partially upheld the appeal. First, the court held that the Controller processed the data subject’s personal data under Articles 4(1) and 4(2) GD
The data subject had applied for a secretary position in a human resources consulting company (the controller) in January 2025. He later filed a lawsuit claiming he had been discriminated against in the recruitment process on the basis of his gender and his disability. In October 2025, the data subject amended his lawsuit to include a claim for non-material damages of at least €1,000 under Article 82 GDPR. He claimed to have lost the control of his personal data as the controller had submitted a screenshot of the data subject’s Facebook profile to the court as an attachment to its answer to the lawsuit without first informing him of the collection and processing of his data in accordance with Article 14 GDPR. The court of first instance issued a default judgment where it dismissed the damages claim on 14 October 2025, as the data subject failed to appear before the court. This outcome was upheld in a final decision in January 2026: the court of first instance held that the data subject had voluntarily made the personal data at issue available for viewing by an unlimited number of people on his Facebook profile. Therefore, he had not suffered a significant loss of control over his personal data. The data subject appealed this decision to the Cologne Higher Labour Court in February 2026. The higher labour court dismissed the data subject’s claim for damages under Article 82 GDPR. First, the court held that the controller had not fully complied with its obligations under Article 14 GDPR – it had not provided the data subject the contact information of its data protection officer, specified the categories of personal data being processed, or explicitly identified the legitimate interests pursued. While the court found that there had been a violation of Article 14 GDPR, it also pointed out that a GDPR infringement alone could not give rise to a claim for damages. According to the court, the data subject had not suffered non-pecuniary damage in the present case. He
The controller was an address publisher and direct advertising company that operated a data application to provide advertisers with personal data for targeted marketing measures. In 2019, following media reports concerning the alleged sale of personal data, particularly information about natural persons’ political party affinity, the Austrian DPA (DSB) initiated an ex officio investigation against the controller. Based on its investigation, the DPA found that the controller had unlawfully processed political party affinity data and unlawfully further processed parcel-frequency data, and had infringed its obligations concerning the DPIA and record of processing activities. It consequently imposed a fine of €18,000,000. The controller appealed to the Federal Administrative Court (BVwG), arguing that the commission of an infringement by a legal person was not, in itself, sufficient for a fine to be imposed under the GDPR. It claimed that since a legal person could not act on its own, the culpable conduct of a natural person had to be identified and attributed to it. The controller argued that the DPA had failed to establish such attribution. The court agreed and, on 26 November 2020, annulled the fine. It found that the DPA had failed to establish that natural persons acting on behalf of the controller had engaged in culpable conduct. The DPA filed an extraordinary official appeal against this judgment with the Austrian Supreme Administrative Court (VwGH). The court stayed the proceedings pending the CJEU’s preliminary ruling in Case C-807/21 (Deutsche Wohnen SE), as the questions referred in that case were also relevant to the appeal proceedings. The CJEU published its judgement on this matter on 5 December 2023. The CJEU held that a fine under Article 83(4) GDPR, Article 83(5) GDPR and Article 83 (6) GDPR may be imposed on anyone who qualifies as a controller where it is established that the controller committed the relevant infringement intentionally or negligentl
ING Bank N.V. (the controller) is a bank. In 2022, several data subjects brought a complaint to the DPA regarding the controller’s contactless payments. The data subjects requested the controller to issue debit cards without a chip that would enable contactless payments. The controller stated that this was not possible, however, the contactless payment feature could be disabled on the data subjects’ cards. The data subjects later filed a complaint because the debit cards contained the chips even if the contactless feature was disabled. The DPA dismissed the complaint in 2024, on the grounds that further investigation would be needed to determine whether the controller violated the GDPR or not. The DPA stated that it had limited capacity and such an investigation would place a heavy burden on it. The data subjects appealed this decision to the court, who determined that the DPA had wrongfully failed to hear the data subjects during the objection phase. The DPA issued a new decision in 2025 and concluded that the controller had not violated the GDPR. The data subjects appealed this decision, arguing that the DPA had again not investigated the case sufficiently. In addition, the data subjects argued that the controller processed personal data through the debit card chip without a valid legal basis. This is because the chip allowed payments made with blocked or expired cards, meaning Article 6(1)(b) GDPR did not apply. The controller could also not rely on consent (Article 6(1)(a) GDPR) to process the data. The DPA argued that the GDPR does not require controllers to completely eliminate a risk. In addition, disabling contactless payments or blocking cards were related to the contract between the data subject and the controller; the DPA argued that this did not remove the basis to process personal data. The court found that the DPA investigated the complaint to an appropriate extent and was not required to conduct a further investigation. According to the court, the d
An employee of a private bank (the controller) erroneously sent a third party a message that was intended for a candidate in the controller’s staff selection process (the data subject) in October 2018. The message contained the data subject’s full name and information about their salary expectations. After the data subject was informed they were no longer considered for the position, they brought court proceedings requesting injunctive relief in order to prohibit the controller from processing the data subject’s personal data in connection with their job application. In addition, the data subject claimed non-material damages. The court of first instance granted the injunction and awarded the data subject € 1,000 in damages. The appellate court upheld the injunction but rejected the damages claim. The Federal Court of Justice (BGH) referred several questions to the CJEU regarding the interpretation of Article 82 GDPR. The CJEU rendered its judgment in the case C-655/23 Quirin Privatbank in September 2025. It held that Member States may provide for injunctive relief in national law in cases of unlawful processing. According to the CJEU, negative feelings caused by a loss of control over personal data can also constitute non-pecuniary damages. First, the Federal Court of Justice held that the data subject was entitled to non-material damages in accordance with Article 82 GDPR. The court confirmed the appellate court had correctly found that sending the message containing personal data to a third party had been unlawful due to the lack of a legal basis under Article 6(1) GDPR – the data subject had not consented to the processing. Furthermore, the controller had not argued that the processing would have been lawful under a different legal basis. The court also confirmed that the data subject had suffered non-material damage as a result of this GDPR violation. In the present case, the data subject’s concern that the recipient of the message might use the personal da
A district (the controller), acting as the lower water authority, initiated administrative proceedings after identifying unauthorised riverbank works and a private jetty on two riverside properties. One property belonged to a water utility company, while the other belonged to a municipality and was leased to the data subjects. During those proceedings, the controller shared the data subjects' personal data with various participants, including the owners of the affected properties, other public authorities and a lawyer who claimed to represent the data subjects. The data subjects lodged a complaint with the competent supervisory authority (LDI NRW), alleging that the controller had unlawfully processed and disclosed their personal data. They argued that their personal data had been shared with uninvolved third parties, that the controller had communicated with a lawyer whom they had not authorised, recorded a telephone conversation with an unknown person, and transmitted personal data by unencrypted email. The controller's data protection officer addressed each allegation and provided additional factual information concerning the disputed processing operations. The DPA initially informed the data subjects that no GDPR infringement was apparent, invited them to provide any additional factual information, and explained that it would obtain extracts from the controller's administrative file if there were concrete indications that it contained relevant facts not already available. The data subjects did not identify any additional facts and instead reiterated their legal position that the controller had breached its GDPR accountability obligations. The DPA rejected the complaint, concluding that no GDPR infringement could be established. The data subjects then brought an action before the Verwaltungsgericht Düsseldorf (Administrative Court Düsseldorf), seeking a fresh decision on their complaint on the basis that the DPA had failed to adequately investigate the complaint
The court found that the cookie banner allowed users to refuse cookies as easily as accepting them, dismissing the NGO's challenge.
Good Law Project Limited, a representative body, was mandated by 51 individuals to bring proceedings on their behalf under Article 80 UK GDPR. Reform UK Party Limited, the controller, is a registered political party and processed personal data in the context of its political activities. In the month before the UK general election of 4 July 2024, the representative body provided an online tool through which members of the public could send notices to major political parties. These notices included a request to stop processing personal data, an objection to processing under Articles 18 and 21 UK GDPR, a written notice under Schedule 1 DPA 2018 requiring the recipient not to process the sender’s personal data and a DSAR under Article 15 UK GDPR. More than 11,600 individuals used the tool. Of these, 1,746 individuals, including the data subjects represented in the claim, sent a notice to the controller between 5 June and 4 July 2024. The controller did not respond within one month. It neither provided a substantive response nor explained that it required additional time to respond. On 8 October 2024, the representative body sent a pre-action letter to the controller. Between 11 and 14 October 2024, the controller sent response emails stating that it had found no record of the recipients in its systems, except for the DSAR and cease-and-desist notice. The controller also stated that any election mailing may have been based on electoral roll data, which it claimed it was entitled to use and which was exempt from subject access. The representative body considered these responses insufficient. It wrote again to the controller on 24 October and 3 December 2024, but the controller did not reply. On 28 March 2025, the representative body issued a claim seeking compliance with the DSARs and compensation for non-material damage under Article 82 UK GDPR and Section 168 DPA 2018. The controller applied to strike out the claim or, alternatively, for summary judgement. The controlle
Good Law Project Limited, a representative body, was mandated by 51 individuals to bring proceedings on their behalf under Article 80 UK GDPR. Reform UK Party Limited, the controller, is a registered political party and processed personal data in the context of its political activities. In the month before the UK general election of 4 July 2024, the representative body provided an online tool through which members of the public could send notices to major political parties. These notices included a request to stop processing personal data, an objection to processing under Articles 18 and 21 UK GDPR, a written notice under Schedule 1 DPA 2018 requiring the recipient not to process the sender’s personal data and a DSAR under Article 15 UK GDPR. More than 11,600 individuals used the tool. Of these, 1,746 individuals, including the data subjects represented in the claim, sent a notice to the controller between 5 June and 4 July 2024. The controller did not respond within one month. It neither provided a substantive response nor explained that it required additional time to respond. On 8 October 2024, the representative body sent a pre-action letter to the controller. Between 11 and 14 October 2024, the controller sent response emails stating that it had found no record of the recipients in its systems, except for the DSAR and cease-and-desist notice. The controller also stated that any election mailing may have been based on electoral roll data, which it claimed it was entitled to use and which was exempt from subject access. The representative body considered these responses insufficient. It wrote again to the controller on 24 October and 3 December 2024, but the controller did not reply. On 28 March 2025, the representative body issued a claim seeking compliance with the DSARs and compensation for non-material damage under Article 82 UK GDPR and Section 168 DPA 2018. The controller applied to strike out the claim or, alternatively, for summary judgement. The controlle
A data subject was an employee of a heating and air conditioning business. The data subject ceased working at the company, however, was still able to access the company’s premises and computers through their managing director for several years. The company brought a case against the data subject, on the grounds that the data subject had sold equipment belonging to the company through eBay. The company sought damages based on this. The German Landesarbeitsgericht Niedersachsen (Higher Labour Court, Lower Saxony) stayed proceedings and requested a preliminary ruling from the CJEU. The data protection issue in this case is that the company became aware of the transactions by accessing the data subject’s private eBay account (how the company received the ID and password is disputed). According to the Court, the company collected and stored the data unlawfully. The Court also considered that it carried out data processing in assessing the evidence during the proceedings, and asked for clarification regarding national legislation for judicial data processing activities and their legal bases. The Court referred the following questions: # Do national provisions involving an independent judicial processing activity under public interest (Article 6(1)(e) GDPR) fulfil the certainty requirements under the EU Charter of Fundamental Rights and the GDPR if it interferes with the fundamental rights of a (third) party? # Data processing by a court: ## Can a court rely solely on Article 17(3)(e) GDPR to process personal data? ## If yes: ### Does this still apply if the initial data collection is unlawful? ### Does the principle of fairness (Article 5(1)(a) GDPR) restrict the applicability of Article 17(3)(e) GDPR? ### Must Article 17(3)(e) GDPR be interpreted as an exception to the prohibition of using unlawfully obtained data for judicial purposes? # Regardless of the questions above: ## Must the court carry out a comprehensive proportionality test in accordance with the princ
A Jehovah’s Witnesses congregation (the controller) sent another congregation an introductory letter containing the personal data of two members (the data subjects) who were changing congregations from the controller to the recipient. The data subjects did not receive a copy of this letter despite their request. They filed a complaint with the DPA in July 2023, stating that their right of access under the GDPR had been violated. The controller argued that providing access to the introductory letter would undermine confidentiality required by religious law. According to the controller, restricting the right of access was necessary to allow the elders of the congregations to fulfill their biblical mandate to care for the members as shepherds of God’s flock. The controller only provided the data subjects a short list of information about them contained in the letter. The DPA dismissed the complaint as unfounded in May 2024. It held that the restriction to the right of access was justified under Article 91(1) GDPR and the national Jehovah’s Witnesses Data Protection Act (DSGJZ), as providing access would jeopardise the religious community’s ability to fulfill its mission. The data subjects filed a lawsuit before the Administrative Court of Berlin in May 2024, claiming the right to obtain a copy of the introductory letter. The court ordered the controller to provide the data subjects access to their personal data undergoing processing by handing over a copy of the introductory letter addressed to the data subjects’ new congregation. First, the court referred to the principle of primacy of EU law and held that Article 91(1) GDPR gives precedence to the data protection rules of religious associations or communities only insofar as these rules comply with the GDPR. Second, the court concluded that the data subjects were entitled to receive the requested copy pursuant to Article 15(1) GDPR in conjunction with Article 15(3) GDPR. The court considered a merely abstract over
The plaintiffs challenged a decision approving the amendment plan concerning the southern runway and apron at Leipzig/Halle Airport. During the proceedings, they sought permission for their technical adviser, a permanent resident in the United States, to participate in the oral hearing by video and audio transmission. Among other issues, with the participation via video call, the discussion revolved around the transmission qualifying as a data transfer to United States. The transfer involved data of the plaintiffs, judges as well as spectators. The plaintiffs considered such lawful according to Article 49(1)(e) GDPR. The plaintiffs also submitted that personal attendance of the adviser would involve considerable time and expense and that avoiding a burdensome long-distance journey would support the quality of his participation. They further argued that remote participation would reduce the costs of the environmental proceedings and avoid air travel in furtherance of their noise and climate protection objectives. They suggested scheduling the adviser’s participation on a designated hearing day and at an appropriate time. The oral hearing had been scheduled over three days, with two substitute dates, in proceedings involving extensive subject matter and numerous participants. The court rejected the application. First, it exercised its discretion under § 102a VwGO and considered the case unsuitable for a video hearing because accommodating the six-hour time difference would impede the structured conduct of the complex, multi-day hearing. The adviser’s questioning from the United States would also constitute sovereign judicial activity extending into another state and therefore require US authorization through judicial assistance. Concerning data protection, the court held that Article 6(1)(e) GDPR read with § 102a VwGO did not by itself make the transfer lawful. On the contrary, the Court considered that consent should have been obtained under Article 49(1)(a) GD
The data subject, a doctor, sought an injunction against the Controller, the operator of an online review platform, requiring the removal of, and prohibiting the future publication of, a notice stating that between six and ten reviews concerning his medical practice had been removed during the previous year following complaints relating to defamation under German law. The Regional Court of Cologne dismissed the application, following which the data subject lodged an immediate appeal before the Higher Regional Court of Cologne. The data subject argued that the notice was inaccurate because the reviews had been challenged on the basis that no genuine patient relationship existed, rather than on the ground of defamation. He submitted that the notice therefore created the false impression that he had complained of defamatory reviews, rendering the processing of his personal data unlawful. The Controller argued that complaints alleging the absence of a genuine customer or patient relationship fell within its internal category of complaints concerning defamation under German law and that publishing the number of removed reviews promoted transparency regarding its review moderation process. The court held that where a data subject seeks not only the erasure of personal data but also an injunction preventing its future publication, Article 17(1) GDPR provides a basis for both forms of relief. It further held that the journalistic exemption under Article 85(2) GDPR did not apply because the Controller's review platform, including the automated notices relating to removed reviews, did not process data for journalistic purposes. The court also held that the displayed number of removed reviews constituted personal data within the meaning of Article 4(1) GDPR because it related to an identified natural person. By storing and disclosing that information, the Controller processed personal data within the meaning of Article 4(2) GDPR. In assessing the accuracy of the notice under
The data subject was a customer of a bank (controller). The data subject withdrew their consent to the processing of their e-mail address and phone number by the controller, and requested the deletion thereof. The data was not deleted. The controller tried to call the data subject in order to discuss the necessity of processing of their phone number, and send them an e-mail about the matter. The controller contacted the data subject again on the matters of possible usage of their bank account in violation of contract, and change of terms of service. Consequently, the data subject sought the termination of the contractual relationship with the controller. Because of unpaid bills, the contract could not be terminated. In order to discuss the matter, the controller tried to contact the data subject again. Eventually, the account of the data subject with the controller was closed. The data subject requested access to their data from the controller. The controller tried to call the data subject again on that matter. The data subject lodged a complaint with the DPA. The DPA held that the controller called the data subject in violation of the GDPR because the calls were not necessary for the performance of a contract between the parties pursuant to Article 6(1)(b) GDPR. Moreover, the DPA held that the controller could not rely on Article 6(1)(f) GDPR because the data subject must not reasonably expect to be called after requesting the deletion of their phone number. The controller appealed the decision by the DPA. The court overruled the decision of the DPA. The court distinguished between before and after termination of the contract. It held that before contract termination, the processing of the data subject’s e-mail address and phone number was necessary for the performance of the contract. In particular, contact details are necessary to be able to contact the data subject per phone call or e-mail about possible security threats concerning the data subject’s bank
The data subject (a child born in 2018), represented by her parents, was insured with the controller (a statutory health insurance provider) and participated in its digital bonus programme. The bonus programme was managed via an app. To handle the information technology operations of this programme, the controller hired the processor (an IT service provider), establishing a data processing agreement under Article 28 GDPR alongside specific information security guidelines. To provide these services, the processor utilised "MOVEit Transfer," a market-leading file transfer software developed by Progress Software Corp. On 31 May 2023, the software developer publicly announced a critical, previously unknown "zero-day" vulnerability in the software (later assigned CVE-2023-34362). At that exact moment, no security patch was available. On the very same day, 31 May 2023, the processor – alongside thousands of other companies worldwide – became the victim of a global cyberattack carried out by the hacker group "Clop." The hackers exploited this zero-day vulnerability to install a "web-shell" backdoor (typically named human2.aspx), bypassing authentication to exfiltrate database records. The compromised data included the data subject's first and last name, health insurance number, bonus points balance, and a bank account number (IBAN) belonging to her mother. No medical, health, or social security data was exfiltrated. On 1 June 2023, the developer released a security patch, which the processor installed immediately. On 2 June 2023, the German Federal Office for Information Security (BSI) issued a formal IT security warning (No. 2023-240133-1100, Version 1.1). The BSI classified the IT threat level as "3 / Orange" (business-critical), confirming active exploitation with data exfiltration. The BSI recommended immediately blocking all HTTP and HTTPS traffic to MOVEit environments, checking for specific Indicators of Compromise (IoCs) in the web server directories, and applying
The data subject lodged a complaint with the data protection authority of Saxony-Anhalt in August 2023, arguing that the procedure for selecting and electing the DPA violated the GDPR. The DPA found no GDPR infringement that could be pursued under Article 77 GDPR and rejected the complaint. The data subject appealed this DPA decision. He stated that the DPA had failed to properly examine the complaint on its merits and should therefore be required to reconsider it. The court of first instance dismissed the appeal as it considered the the DPA decision to be correct and could not find any GDPR infringement either. The data subject argued in his further appeal before the higher administrative court that Article 77 GDPR confers the data subject the right to a genuine substantive investigation of the complaint. He was of the opinion that the DPA had essentially refused to handle his complaint within the meaning of Article 78(2) GDPR and should be required to reconsider it. The court dismissed the appeal as unfounded. First, it pointed out that Article 57(1)(f) GDPR requires the DPA to investigate the subject matter of the complaint to the extent appropriate. The DPA therefore retains discretion concerning the scope of the investigation. In this case, the court found that the DPA had not simply ignored the complaint: it had conducted a legal assessment of the complaint and issued a reasoned decision. Second, the court held that the present case fell under Article 78(1) GDPR instead of Article 78(2) – the DPA had not failed to handle the complaint as it had issued a legally binding decision. Therefore, the court ultimately came to the conclusion that a DPA cannot be required to investigate the complaint again if the court reviewing the case can determine that no violation of the GDPR has occurred.