GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
Minister of Finance
In 2021, the Dutch Tax Administration informed a data subject that they were unlawfully included in its database (the Fraud Signalling System, FSV). The use of the FSV did not comply with the GDPR; some data subjects’ data were unlawfully processed, too many employees had access to the data, and the data retention periods were too long. The data subject made an access request, and also requested their data to be rectified and erased under Articles 16 and 17 GDPR respectively. In 2022, the Minister of Finance (the controller) rejected the rectification and erasure request. The data subject brought a case to the District Court of Noord-Holland, who ordered the controller to comply with the data subject’s erasure request within one month of the ruling. The controller appealed the decision to the court, arguing that they did not have the obligation to erase the data under Article 17(3) GDPR. The court reversed the decision of the District Court, and stated that the controller had the right to dismiss the data subject’s rectification and erasure request. Article 16 GDPR is limited to incorrect or incomplete personal data, and the data subject did not specify in what way their data was incorrect or inaccurate. According to the court, the data subject wished to clear their name through the rectification request, which is not provided for under the GDPR. In terms of Article 17 GDPR, the court considered that processing the personal data was provisionally necessary in the public interest for the purpose of remedying the unlawful adverse effects of the FSV. Therefore, the decision to deny the data subject’s erasure request was proportionate despite the fact that said data was processed unlawfully. The court also considered the measures the controller had taken to limit the further processing of the data subject’s data.
the Mayor of Zwolle
A data subject requested access to personal data processed about him, contained in an advice report from t[https://www.riec.nl/site/binaries/site-content/collections/documents/2014/01/01/corporate-brochure-riec-liec-engels/Corporate+brochure+Engels.pdf he Regional Information and Expertise Center (RIEC)], related to his application for a liquor and hospitality license. The RIEC report was prepared as part of a Bibob investigation (a Dutch law for integrity assessments in public administration) into the legality of the business transfer and financial flows. The Mayor (the controller) rejected the request under Article 15(4) GDPR, Article 23(1)(i) GDPR, and Article 41 GDPR, claiming that restricting access was necessary and proportionate to protect the rights and freedoms of others, including the Mayor himself, and that the RIEC report fell under the confidentiality obligation in Article 28 of the [https://www.justis.nl/sites/default/files/2022-10/Factsheet%20The%20Dutch%20Bibob%20Act.pdf Bibob Act.] The data subject filed an objection to this refusal, which the Mayor declared unfounded and maintained the refusal. The data subject subsequently appealed the decision to the District Court Overijssel. The court dismissed the appeal, holding that the controller lawfully refused access to the personal data in the RIEC report. The court found that the report was part of a [https://www.justis.nl/sites/default/files/2022-10/Factsheet%20The%20Dutch%20Bibob%20Act.pdf Bibob] investigation and therefore subject to the confidentiality obligations under [https://www.justis.nl/sites/default/files/2022-10/Factsheet%20The%20Dutch%20Bibob%20Act.pdf Article 28 of the Bibob Act,] which preclude disclosure except in limited circumstances that did not apply here. Also, the court confirmed that restricting access was necessary and proportionate to protect the rights and freedoms of others, including the Mayor and the RIEC, as permitted under Article 15(4) GDPR, Article 23(1)(i) GDPR, a
Municipality of Zaandam
A data subject applied for an exemption from compulsory education for school years 2022-2023 and 2023-2024 for their son. On 24 July 2022 the data subject submitted a list containing the specific objections to each of the schools within a reasonable distance from their home, as required by the municipality. On 5 April 2024 the data subject filed an erasure request (Article 17 GDPR) to remove this list, as they believed this list to be unlawfully processed. On 12 June 2024 the municipality decided not to grant the request for removal. The municipality held that is obliged under national law to process a declaration of objections to potential schoolsCompulsory Education Act (Leerplichtwet) 1969, https://wetten.overheid.nl/BWBR0002628/2024-01-01 and archive this informationArchival Act (Archiefwet), https://wetten.overheid.nl/BWBR0007376/2024-06-19. The data subject objected to this decision and appealed to the appeals committee of the municipality. They argued that the declaration did not have to list separate objections to each of the schools. This argument was rejected, and the data subject appealed the decision to the court. The court held that the list of objections to schools was lawfully processed and the municipality did not have to grant the data subject's erasure request (Article 17 GDPR). Firstly, national lawArticle 6(1) of the Compulsory Education Act (Leerplichtwet 1969), https://wetten.overheid.nl/BWBR0002628/2024-01-01 requires parents to declare on which grounds they need an exemption from compulsory education. Specifically, parents must submit a "personal declaration", which must explain the objections to the educational values of all schools within a reasonable area from their home. The court held that the authoritiesCompulsory Education Officers (Dutch: leerplichtambtenaar) and courts have to be able to investigate the objections to the educational values of all schools in the area. The court held that this is only possible if there is a list
Court case 38 O 243/23
A telecommunications company is the controller. In 2023, the controller carried out a large scale direct marketing campaign directed at data subjects who were customers of other telecommunication providers. The letters included a “contract summary“, with a price offer and cancellation policy. The marketing was directed at data subjects personally, with the controller including their name, address, and landline number. The controller obtained this data from a mailing list vendor without the data subjects’ consent. In September 2023, a qualified entity issued a cease and desist notice to the controller, due to data protection, competition, and consumer law violations. The qualified entity also requested information from the controller regarding its data processing activities and sources of data. The qualified entity later brought an injunction claim against the controller. Regarding the GDPR violations, the qualified entity requested the court to order the controller to refrain from processing data subjects’ address and contact information through direct marketing campaigns without their consent, as well as order the controller to fulfill its information obligations in accordance with Articles 14(1) and 15 GDPR. Finally, the qualified entity requested the court to order the controller to them a total of €243.51. The controller requested the court to dismiss all claims. The controller argued that its data processing activities were lawful under legitimate interests (Article 6(1)(f) GDPR). In addition, direct marketing activities always constitute a legitimate interest under Recital 47 GDPR. The court found that the controller had violated national competition and consumer laws in the direct marketing campaign, as it considered it an unfair commercial practice. The court found a violation of Articles 5(1)(a) and 6(1) GDPR). According to the court, the controller processed data subjects’ address and contact information without a legal basis in writing and sending the promotional letters. The court stated that the controller could not rely on Article 6(1)(a) GDPR, as the data subject had not consented to the processing. In addition, the controller could not rely on legitimate interests under Article 6(1)(f) GDPR. The court first stated that Recital 47 GDPR simply indicated that direct marketing was a possible legitimate interest. Furthermore, the fact that direct marketing serves a legitimate interest purpose does not make the processing lawful. The court found that the processing did not meet the three cumulative conditions as established by the CJEU.see ECJ, Judgment of July 4, 2023 – C-252/21, Meta Platforms Inc. et al. v. Bundeskartellamt para. 106 This is because the controller failed to fulfill its other obligations under the GDPR. The court also emphasised that lawfulness of the direct marketing campaign cannot depend on the data subject’s lack of objection. The court found a violation of the controller’s information obligations. The court stated that the controller failed to provide the data subject with information related to the sources of its data, as well as the data subject’s right to object (Article 21 GDPR). Therefore, the controller violated Articles 14(1), (2)(a)-(c), (e) and (f) GDPR, as well as Articles 12(1) and (5) GDPR. In addition, the controller failed to provide information required by Articles 12(3) and 15 GDPR following the access request by the qualified entity. The court noted that the controller failed to provide the information, as well as an explanation on why the one month deadline was not complied with. The court ordered the controller to refrain from processing data subject’s data in the context of direct marketing campaigns without consent. In addition, the court ordered the controller to comply with its information obligations, and pay the qualified entity €243.51,
Court case 29 K 9469/23
The data subject was subject to a home visit by the public health authority following an external report raising concerns about her condition. After the visit, the authority created internal medical notes and administrative records documenting observations made by a physician, as well as information about the person who had reported the situation. The data subject subsequently requested access under Article 15 GDPR to all records held about her, including call logs, internal reports, medical notes, and any documents containing her name. The authority provided a GDPR response and later disclosed the entire file, but redacted personal data relating to authority staff and the reporting third party. The data subject brought an action seeking full, unredacted disclosure, arguing that the records did not accurately reflect what had occurred during the home visit and that she was entitled to receive the documents in their entirety under the GDPR. The court dismissed the claim, holding that the controller had fully complied with its obligations under Article 15 GDPR. It emphasised that the right of access and the right to obtain a copy under Article 15(3) GDPR concern only the data subject’s own personal data, not the documents or files as such in which those data appear. Relying expressly on the CJEU’s judgment in C-487/21 (CRIF), the court recalled that the concept of a “copy” under Article 15(3) GDPR refers to a faithful reproduction of the personal data undergoing processing, not necessarily to a copy of the entire document containing them. The decisive criterion is whether the information provided enables the data subject to obtain a complete and accurate understanding of the personal data processed about them and to effectively exercise their GDPR rights, such as rectification, erasure, or restriction of processing. The court further clarified, in line with the CJEU’s reasoning, that the controller is entitled to redact information in the same document that does not relate to the data subject, including personal data of third parties. Such redactions are lawful provided that they do not distort or render unintelligible the data subject’s own personal data or the context in which those data are processed. The court thus found that the redactions made by the authority were permissible and did not undermine the substance of the access right, as the disclosed records still allowed the data subject to understand the purpose, context, and use of her personal data. Finally, the court stressed that Article 15 GDPR does not provide a mechanism to contest the factual accuracy or substantive correctness of administrative or medical assessments. Disagreements about the content of reports must be pursued through other legal remedies and cannot be resolved through the GDPR right of access.
Court case 10 U 61/25 e
The data subject brought multiple claims against a credit information agency, arguing that its automated generation of various score values was unlawful under the GDPR. He sought declaratory relief, injunctive relief against exclusively automated scoring, disclosure of non-automated scores, damages, expanded access rights, and restrictions on the factors used in future scoring. The court of first instance dismissed the claims. The data subject appealed, relying in particular on Article 22 GDPR and arguing that negative scores could affect third-party decisions such as the conclusion of a rental agreement. The court has not yet published a final decision, but it has shared a notice of intention. The court intends to dismiss the appeal as unfounded. It agreed with the lower court that Article 22(1) GDPR was not applicable, because the automated generation of a score value, by itself, does not constitute a decision producing legal or similarly significant effects on the data subject. The court emphasised that Article 22 GDPR requires that the automated processing itself directly determines the outcome for the data subject, without independent decision-making by a third party. Where third parties, such as landlords or banks, merely take a score into account alongside other factors, the necessary causal link is missing. Referring to the CJEU’s judgment in C-634/21 (SCHUFA), the court stressed that Article 22 GDPR applies only where the automated result plays a decisive role in the final decision, which must be assessed on a case-by-case basis. Because the data subject failed to show that any automated score had directly caused a concrete adverse decision, all related claims, including injunctive relief, damages under Article 82 GDPR, and expanded access rights, were dismissed. It must be pointed out that this judgement is not binding yet.
Úrad na ochranu osobných údajov Slovenskej republiky (ÚOOÚ)
The DPA carried out an ex officio inspection of the Rajec’s City Council, the controller, concerning its processing of personal data through a CCTV system. On 27 August 2019, the DPA issued a first-instance decision imposing a €10,000 fine and corrective measures. Following an appeal by the controller, the DPA issued a second-instance decision on 29 November 2019. It partially amended the first-instance decision and reduced the fine to €9,000. The DPA found that the controller had violated the principle of transparency under Article 5(1)(a) GDPR by failing to specify the legal basis for CCTV processing in its records of processing activities and by failing to provide information to data subjects before they entered the monitored area. The DPA also found a violation of the storage limitation principle under Article 5(1)(e) GDPR. According to the DPA, the controller retained CCTV footage for longer than necessary. Although the controller had set a seven-day retention period, the inspection found one recording that had been retained for around 20 days. The controller challenged the DPA’s decision before the administrative court. It argued, among other things, that its records of processing activities referred to relevant national laws and that the GDPR did not require a precise citation of Article 6 GDPR in such records. It also argued that, at the time of the inspection, there were no binding rules on how CCTV information notices had to be provided, and that the single over-retained recording was a one-off human error without consequences for data subjects. During the court proceedings, the Administrative Court of Bratislava examined whether the operative part of the DPA’s decision met the requirements applicable to administrative penalties. The court focused on whether the alleged infringements were described with sufficient precision in terms of the act, time, place and manner of commission. The court annulled the DPA’s decision and remanded the case. The court held that, in administrative penalty proceedings, the operative part of a decision must clearly and precisely identify the conduct for which the sanction is imposed. This follows from the right of defence and the principles of criminal procedure that apply, by analogy, to administrative penalties. The court found that the DPA’s decision did not meet this standard. First, the operative part merely stated that the controller had failed to specify the legal basis for CCTV processing in its records of processing activities. However, the reasoning and administrative file showed that the controller had in fact mentioned certain legal bases, while the DPA considered them insufficient or incorrect. The court noted that this distinction was legally relevant, since an incorrect or missing entry in records of processing activities may amount to an Article 30 GDPR issue, whereas processing without a legal basis concerns the lawfulness of processing under Article 6 GDPR and may fall under a different sanctioning framework. Second, the court held that the DPA had not sufficiently specified the alleged failure to provide information to data subjects. The operative part did not identify which CCTV cameras, which monitored areas or which specific information notices were concerned. The fact that some of these details appeared in the reasoning, the inspection report or later submissions was not sufficient, since the operative part itself must contain the essential factual definition of the offence. Third, the court found that the alleged storage limitation infringement was also insufficiently specified. The operative part did not clearly state which personal data were retained for too long, whether the issue concerned CCTV footage or other data, whether it concerned one recording or several, or whether the DPA considered the controller’s seven-day retention period itself unlawful or only the single 20-day retention incident. Because of these deficiencies, the court considered the DPA’s decision incomprehensible and non-reviewable. It therefore could not assess the substantive GDPR issues or the proportionality of the fine. The DPA must issue a new decision, if it continues the proceedings, clearly defining the specific conduct, place, time and manner of the alleged infringements.
Data subject
The data subject filed an access request to the National Coordinator for Counterterrorism and Security (NCTV). The Ministry of Justice is the controller for the NCTV. The Ministry of Justice decided to grant access, but partly. What the data subject received, was an overview of their personal data, including the aim for which data was processed, the source and with whom it was shared. After their first appeal to the decision, the Ministry decided to grant more access and explained more context of the processed data. The data subject also received some copies of documents that were partly redacted. The data subject then appealed that decision to the court, because they believed more detail should be given about why their data were processed and shared with other parties. The data subject found the legal grounds mentioned in the overview to be too vague as they referred solely to the law, or the tasks of NCTV exercising its official authority. Furthermore, the data subject requested information, such as empolyee names, titles or departments of the organisations their data was shared with and why data was shared internationally. They also disputed the accuracy of the overview, because emails containing their personal information had a lot of redacted parts. This meant they were unable to review if their personal information was shared. The court rejected the appeal and found that the information received by the data subject was sufficient. The data subject's first complaint was that the information given to them was insufficient. The court held that Article 15 GDPR does not require the Ministry to provide more specific detail on why the data subject's data were processed. It is clear from case law that Article 15 GDPR does not require an organisation to provide full copies of all documents containing the data subject's data. It does require organisations to provide sufficient information to fulfil the goal of the right of access, i.e. to make it possible for the
Business owner (data subject)
On 20 November 2023, the data subject (a business owner) submitted an access request under Article 15(1) GDPR limited to the controller's legal department (a municipal authority), requesting a full written response and copies in accordance with Article 15(3) GDPR. On 12 December 2023, the controller asked the data subject to specify a reference date in order to process the request. On 18 December 2023, the data subject replied that no specific date was required and that the relevant date for the time limit to respond to such requests was the date of receipt. By letter dated 3 January 2024, the controller informed the data subject that the legal department did not store or process any personal data relating to them. Following that, the data subject alleged that the controller had not responded within the time limit set out in Article 12(3) GDPR. They argued that the one-month deadline expired on 22 December 2023 and that the request for a reference date did not suspend or extend the deadline. The controller argued that the request was excessive and made in bad faith. It submitted that the data subject had repeatedly exercised access rights between 2020 and 2024 in order to pursue unrelated damages claims. It also argued that the one-month period started only after the data subject responded to the request for a reference date. The court first held that a controller must provide information on measures taken under Articles 15 to 22 GDPR without undue delay and in any event within one month of receipt of the request. The period may only be extended by two further months where justified by the complexity or number of requests, and the controller must inform the data subject of the extension and the reasons within the initial one-month period. The court explained that the triggering event for the time limit was the receipt of the request on 22 November 2023, as the Article 12 GDPR and Article 15 GDPR did not require a data subject to specify a reference date for an acc
Court case W254 2313142-1
The data subject had initially requested that a electricity network operator (the controller) delete his email address from its systems. In March 2022, the controller confirmed that the deletion had been carried out. Nevertheless, in January 2024 the controller again contacted the data subject via the same email address to send a notification regarding a reading of the electricity meter. The data subject subsequently filed a complaint with the Austrian Data Protection Authority (DSB), arguing that the controller continued to process his personal data despite assuring him that it had been deleted. After the DSB failed to issue a decision within the six-month deadline, the data subject brought an inactivity complaint before the Federal Administrative Court on 23 February 2025, requesting that the court decide the case itself. During the proceedings, the controller initially argued that the email might have been collected again elsewhere due to human error. However, after a further internal review, the controller acknowledged that the email address had in fact not been deleted in 2022 as previously stated and had remained stored in its system until April 2024, when it was finally deleted. The court partially upheld the complaint. Because the controller retained the email address and used it to send a notification to the data subject, the court found that the processing lacked any valid legal basis under Article 6(1) GDPR. As a result, the court concluded that the processing was unlawful and therefore violated the principle of lawfulness under Article 5(1)(a) GDPR. The continued retention and use of the email address after a deletion request also contravened the principles of purpose limitation and data minimisation under Article 5(1)(b) and (c) GDPR, since the data were used again despite the data subject’s request that they no longer be stored. Furthermore, the controller breached the accountability principle under Article 5(2) GDPR by initially claiming that the da
Microsoft Ireland Operations Limited
An individual working as a judge (the data subject) sued Microsoft Ireland Operations Limited and its Romanian establishments (the controllers) and requested in court the removal or blocking from the search engine Bing (the search engine) of all links and URL addresses containing content relating to him from the web page www.luju.ro in accordance with Article 17 GDPR, Article 18 GDPR, Article 21 GDPR and Article 22 GDPR. The data subject alleged that the content was defamatory. Furthermore, the data subject requested an interdiction for the search engine to publish or transmit any content from the above-mentioned web page relating to the data subject and the awarding of RON 199,000 (approximately €39,000) in immaterial damages. In addition, the data subject asked for the logic behind the search engine algorithm to be communicated to him, specifically related to the content from the website luju.ro involving the data subject and how it is prioritised in the search results. Moreover, the data subject requested the communication of the records of processing activities in relation to him carried out by the controllers under Article 30 GDPR, along with the evaluation of the impact on his rights in accordance with Article 35 GDPR. Previously, the data subject obtained in court an order for the elimination and blocking from the search engine Google of all links leading to published articles on him on the website luju.ro. The removal of links from the search engine The court referred to a previous judgement which held that several articles published on the website luju.ro about the data subject have an impact on his honour and dignity. Subsequently, the court declared that the articles identified by the data subject in the present lawsuit have a defamatory character, affecting in particular his professional reputation as a judge. However, the court held that the reference to the data subject’s profession does not exclude a violation of his private life protected un
AB Storstockholms Lokaltrafik
AB Storstockholms Lokaltrafik (the controller), the operator of public transport in Stockholm, equipped its ticket inspectors with body-worn cameras that continuously recorded video and audio during inspections. The cameras had a short circular memory, automatically overwriting footage unless inspectors saved it when issuing fines or facing threats. The stated purposes of the cameras were to prevent and document violence against inspectors and to verify the identity of fined passengers. Following a supervisory investigation, the Swedish Data Protection Authority found that the controller had infringed several provisions of the GDPR, including the obligation to provide information to data subjects. The Authority imposed an administrative fine in total SEK 16,000,000 (€1,420,670) of which SEK 4,000,000 (€355,188) was for failure to provide information to the data subjects. The controller challenged the Swedish DPA’s decision before the Administrative court of first instance (Förvaltningsrätten i Stockholm), which upheld the fine. The controller then appealed to the Administrative Court of Appeal (Kammarrätten i Stockholm), which annulled the fine, holding that Article 13 GDPR was not applicable. The Swedish DPA subsequently appealed to the Supreme Administrative Court of Sweden (Högsta förvaltningsdomstolen). The referring court identified the key issue as whether Article 13 GDPR or Article 14 GDPR applies to personal data collected by body-worn cameras. Resolving this question was necessary to determine the content, timing, and possible exceptions of the information obligation and to assess whether the Authority was entitled to impose an administrative fine for non-compliance with Article 13 GDPR. The court also noted uncertainty regarding the legal weight of the [https://www.edpb.europa.eu/about-edpb/who-we-are/legacy-art-29-working-party_en Article 29 Working Party’s Guidelines] on transparency, which provide that Article 13 GDPR applies to video surveillance. In
Court case 25/04270
A professional notaries’ association (the controller) hired an accounting inspector (the data subject) in 2024. A year later, the controller dismissed the data subject for reasons related to his performance at work. Following his dismissal, the data subject requested the disclosure of his personal data including his work emails and other files. A month later, he filed an application with the Paris Labour Court seeking an order requiring the controller to provide him with the documents. The Paris Labour Court found that there were no grounds for the request. The data subject appealed the decision and argued in favour of obtaining access to his personal data in accordance with Article 15 GDPR. The data subject further claimed that the requested documents would enable him to respond to the decision of his dismissal. The Paris Court of Appeal held that the purpose of Article 15 GDPR is not to obtain copies of professional email correspondence of an employee in the course of his work, of which he is aware and which contains only his identity. Instead, the court noted that the purpose of the article is to enable the data subject to check that processing complies with the law, to check the accuracy of the data and, if needed, to ask for the rectification or erasure of the data. Furthermore, the Court noted that the controller sent the data subject a copy of his entire personnel file. Moreover, analysing the request from the perspective of Article 145 of the Code of Civil Procedure, it concluded that the requested documents would not serve the data subject in appealing his dismissal. Therefore, the Court rejected the data subject’s appeal.
Court case I ZR 115/25
The data subject had private health and long-term care insurance with the controller since 2010. Over the years, the controller adjusted the monthly insurance premiums several times, and informed the data subject of these adjustments through policy supplements and standardised explanatory letters, which the data subject no longer possessed. In March 2023, the data subject requested that the controller provide copies of the documents relating to past premium adjustments. After the controller refused, the data subject brought an action seeking access under Article 15(1) and (3) GDPR. Specifically, the data subject requested information concerning the contribution history of the insurance contract, including the dates and amounts of old and new premiums, tariff changes, and tariff terminations for several years. The court of first instance dismissed the claim. On appeal, the appellate court partially upheld the data subject’s request, holding that the requested information constituted personal data and therefore fell within the scope of Article 15 GDPR. The controller appealed to the Federal Court of Justice. The controller argued that the requested information did not constitute personal data because premium adjustments and tariff information were determined on an abstract, tariff-based basis and were not linked to the individual data subject. It further argued that the data subject’s request constituted an abuse of rights, as it was intended to prepare a repayment claim rather than to exercise data protection rights. The Court upheld the appeal, set aside the appellate judgment, and referred the case back for a new decision. The Court confirmed that Article 15 GDPR applies irrespective of the data subject’s motivation and that a request for access cannot be refused merely because it serves purposes unrelated to data protection. It also rejected the controller’s argument that the request constituted an abuse of rights under Article 12(5) GDPR. However, the Court hel
Court case C/02/438794 / HA RK 25-192 (E)
The data subject is a participant in a pension fund operated by the controller. He receives pension benefits and is concerned about the accuracy of his pension accrual, particularly in light of the upcoming transition to a new pension system. Because no rights can be derived from the Uniform Pension Overview (UPO), the data subject tried obtaining more certainty regarding the correctness of his pension. Relying on Article 15 GDPR, the data subject requested that the controller provide (i) a complete overview of the personal data on which his pension calculation was based, (ii) a clear explanation of how those data resulted in the pension amounts shown in the UPO, and (iii) a confirmation that the data used were correct. The requested information included, inter alia, pensionable salary, part-time percentages, years of service, and value transfers. The controller refused to provide the requested information. It argued that the GDPR did not provide a legal basis for the request, that the data subject had already retired before the GDPR became applicable, and that the requested information did not qualify as personal data. The controller further submitted that the GDPR was not intended to enable verification of pension calculations or pension administration and that the relevant data were already accessible through the UPO. The data subject brought proceedings before the Court, seeking an order to the controller to provide the requested information, a penalty payment, and an award of costs. The Court dismissed the request in its entirety. The Court held that the scope of the right of access under Article 15 GDPR is limited to personal data as defined in Article 4(1) GDPR. While that concept is broad and may include both objective and subjective information relating to an identifiable person, it does not extend to calculations themselves. The Court found that the data subject’s request was primarily aimed at obtaining the pension calculations themselves and a comprehensive explanation of how those calculations were made. Such calculations are not personal data, as they are not information that, by their content, purpose, or effect, relate to an identifiable natural person. Accordingly, they cannot be obtained by invoking the GDPR. To the extent that the request concerned underlying documents on which the calculations were based, the Court held that these could not be claimed under the GDPR either. In any event, the data subject already had access to the relevant data through the UPO. The Court further held that explanations of the data and confirmations of their correctness do not constitute personal data and thus fall outside the scope of Article 15 GDPR. The Court concluded that the data subject’s need for certainty regarding his pension, including in the context of the transition to the new pension system, could not be addressed through a GDPR access request. Consequently, the request was rejected.
Centre Hospitalier Eaubonne Montmorency
The data subject was hospitalised in the Eaubonne Montmorency Hospital Centre (the controller) in 2019. The first medical report created at the time of hospitalisation indicated a diagnosis of bipolar affective disorder, among others. The data subject showed that the controller issued a second medical report during the same hospital visit with a diagnosis of an adjustment disorder. Furthermore, she submitted medical reports from other hospitals ruling out the diagnosis of bipolar disorder. In 2020, the data subject made a request to the controller for the rectification of the initial medical diagnosis under Article 16 GDPR and Article 17 GDPR. The controller rejected her request and the data subject filed a petition before the Administrative Court of Cergy-Pontoise for an order to correct the medical records. The petition was rejected by the court. The data subject filed an appeal with the Administrative Court of Appeals of Versailles to overturn the judgment of the Administrative Court of Cergy-Pontoise. In the appeal, the data subject sought the same order for rectification. The court rejected the data subject’s appeal. The court noted that the initial diagnosis was the result of subjective medical assessments of the data subject’s state of health. Moreover, the court emphasised that a different subsequent diagnosis did not imply that the initial diagnosis was inaccurate. Therefore, the court found that the diagnosis cannot be subject to the right of rectification.
University of Cyprus
An assistant professor (the data subject) requested access to the content of evaluation reports by independent reviewers and letters of recommendation prepared during the academic promotion procedure from the University of Cyprus (the controller). The controller refused access during the ongoing promotion process, relying on their [https://www.ucy.ac.cy/legislation/wp-content/uploads/Rules_of_Evaluation_for_Professional_Advancement_Continuation_or_Termination_of_Employment_of_Academic_Staff_09.05.2023.pdf internal regulations] and long-standing academic practice requiring confidentiality and anonymity of external reviewers to protect objectivity and impartiality. They indicated, however, that access could be granted after completion of the procedure, with the reviewers’ identities redacted. The data subject filed a complaint with the Commissioner, the Cypriot DPA. The DPA held that the controller had violated the right of access to personal data under [https://www.afapdp.org/wp-content/uploads/2018/05/Chypre-Loi-n%C2%B0138I-sur-le-traitement-des-donnees-personnelles-2001.pdf Article 12 of Cypriot data protection law] and issued a formal decision ordering the controller to ensure access, suggesting anonymization of reviewers’ names. The controller then appealed that decision before the Administrative Court. The Administrative Court annulled the DPA’s decision. It held that the DPA had failed to properly balance the data subject’s right of access under Article 15 GDPR against the legitimate interests of the controller in preserving confidentiality and procedural integrity during an ongoing promotion process. The Court emphasized that the timing of the access request was crucial and that temporary restrictions could be justified where disclosure might affect the fairness and objectivity of a complex administrative procedure. The Court further found that the DPA had focused too narrowly on anonymization and had not adequately considered whether deferring access until the conclusion of the promotion process would constitute a proportionate limitation of the right of access. The controller’s position was not to deny access permanently, rather, it indicated that access could be provided after the final decision, with reviewers’ names redacted.
Court case 13R70/25x
A data subject brought proceedings against a controller after it refused to provide, free of charge, digital copies of invoices and transaction data following an access request. The data subject argued that Article 15(3) GDPR entitled them to receive a complete copy of the personal data processed by the controller, including the copies of invoices and transaction data. The controller argued that it had complied with both of the data subject's requests for information in a timely and complete manner. It argued that Article 15(3) GDPR entitled the data subject to a copy of their personal data, rather than to copies of documents as such. The controller alleged that it had disclosed the payment details provided by the data subject, thereby enabling them to clearly identify which bank account had been debited. The first-instance court dismissed the data subject’s action. It acknowledged that, according to the CJEU in judgement [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0487 C-487/21], copies of whole documents must be provided only where they are indispensable for the data subject to understand the processing of their personal data or to effectively exercise their GDPR rights. The court considered that the data subject had not proved such necessity. It noted that they had already received the relevant invoices during the contractual relationship following the respective billing periods and the information disclosed by the controller was sufficient to understand the processing at issue. The therefore found that the controller could make any re-sending of invoices conditional upon payment of a fee. The data subject appealed to the Higher Regional Court of Vienna (OLG WIEN) and argued that in accordance with the case law of the CJEU ([https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62022CJ0307 CJEU judgment C-307/22]) a data subject need not provide reasons for requesting a copy of their personal data from the controller, and that the right to obtain a copy of personal data applies even where the request serves purposes unrelated to GDPR. They further argued that the first-instance court had incorrectly imposed on them the burden of proving that the copies were necessary for the exercise of their GDPR rights. The court acknowledged that according to C-307/22, an access request does not need to be justified and is not manifestly unfounded or abusive merely because the data subject pursues objectives unrelated to data protection. It nevertheless stated that motives unrelated to data protection may become relevant when it comes to the scope of the right to access data. The court referred to C-487/21 and held that the right to a copy under Article 15(3) GDPR means that the data subject must be provided with a faithful and intelligible reproduction of the personal data where this is indispensable for understanding the processing at issue and enabling the data subject to effectively exercise their GDPR rights. The court considered that the data subject bears the burden of proving why copies of the requested documents are indispensable. It emphasized that a general assertion that the documents are needed to ensure the completeness of the response is insufficient. It further stated that this requirement also applies where the request pursues objectives unrelated to data protection. The court upheld the legal assessment of the first-instance court and dismissed the appeal.
Maximilian Schrems
The data subject, Max Schrems, was a user of a social networking platform operated by Meta (Facebook/Instagram). He filed twelve claims against Meta alleging violations of the GDPR, seeking clarification of data processing roles, assessment of the legality of certain processing activities, access to his personal data, and €500 in non-material damages. Since 2011, the data subject had attempted to obtain full access to his personal data, but Meta only provided partial access. The data subject argued that Meta unlawfully processed his personal and sensitive data, failed to provide full access to all personal data upon request, and collected personal data from users through social plugins, third-party apps, and websites using them for personalized advertising without consent. The proceedings were initiated in 2014 and extended over a period of approximately 11 years, involving several judicial bodies. The Regional Civil Court in Vienna initially declined jurisdiction on two occasions, taking the view that the data subject did not qualify as a consumer in relation to his private account. In later decisions, the court [https://noyb.eu/sites/default/files/2020-06/Urteil%20FB_geschw%C3%A4rzt.pdf cited] [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0446 uncertainty regarding jurisdiction under the GDPR]. During the course of the proceedings, the Austrian Supreme Court submitted [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0446 two questions to the European Court of Justice (CJEU).] In 2021, the Supreme Court issued a [https://noyb.eu/sites/default/files/2020-12/BVI-209_blackened_en.pdf partial judgment], awarding data subject €500 in damages, while leaving the remaining claims undecided until the ECJ rulings were available. The Austrian Supreme Court has now ruled on the remaining points of the appeal. The Austrian Supreme Court (OGH) ruled that Meta must provide data subject full access to all personal data processed about him. Th
Izi Asset Management
A data subject initiated proceedings in front of the Administrative Court of Sofia - City against Izi Asset Management (the controller) due to the refusal of the controller to provide them with a copy of a consumer credit agreement in accordance with Article 15 GDPR. The data subject’s representative, an attorney, contacted the controller via email to request the copies. The controller based its refusal on an alleged lack of explicit power of attorney on the part of the data subject’s representative. The court found that the controller’s refusal was unlawful. It noted that the request was valid under Article 15 GDPR, since the representative already indicated the power of attorney with an express right to file a complaint on the data subject’s behalf. The court noted that there were no grounds to require the submission of additional evidence by the representative of the data subject. Furthermore, it emphasised the obligations of the controller to provide information to the data subject under Article 12 GDPR. Therefore, the court revoked the controller’s decision to terminate the proceedings with the data subject regarding the provisions of the requested copies, and referred the case back to the controller for a decision on the merits of the request.