GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
Meta
Meta's Business Tools tracked user behavior on third-party sites without valid consent, constituting unlawful processing of personal data.
Court case BA-5S/30/2020
The DPA conducted an investigation on a controller’s premises and issued a fine of €10,000 and an order to take corrective measures. The controller contested the decision and the DPA lowered the fine to €9,000 and amended some of the factual findings. In its second decision, the DPA held that the controller violated the principle of transparency in Article 5(1)(a) GDPR by failing to inform data subjects about the existence of video surveillance at the point of entry in the monitored area and by failing to specify in the record of processing activities the legal basis for such personal data processing. The controller argued that the record of processing activities contained the legal basis for the processing of personal data (a national law provision), and claimed that the requirement to include a mention of Article 6 GDPR was overly formalist. Moreover, the controller argued that the pictograms placed at the entrance to the monitored area along with a notice of information on its website were meant to inform data subjects of the video surveillance carried out there. The DPA also found a violation of the principle of data minimisation in Article 5(1)(e) GDPR due to the longer than necessary data retention times. The controller claimed that the retention period was generally 7 days and only one recording was kept for longer due to an error. Finally, the DPA held that there was no violation in relation to the processing of employee data of the principle of legality in Article 5(1)(a) GDPR with reference to accountability in Article 5(2) GDPR, since the controller submitted at the time of the inspection a proportionality test in regard to the processing of employees’ personal data. The DPA ordered the controller to take measures to inform data subjects about the processing of their personal data in accordance with Article 13 GDPR. The controller contested the second DPA decision in court. The court annulled the DPA’s second decision and remanded the case to t
Court case Pn-877/2023-29
A data subject filed a lawsuit against Propuls d.o.o., the controller and publisher of the news portal direktno.hr, claiming that two articles published on 11 January 2023 and 31 January 2023 disclosed her personal data without her consent: The first article reported on payments related to the football club Dinamo Zagreb and included the data subject’s full name, bank account number, and payment amounts. The second article referred to the first article via a hyperlink but did not mention the data subject directly. The data subject argued that the disclosure violated her right to privacy and the protection of personal and family life under Croatian law and the GDPR. She claimed non-material damage and sought compensation as well as publication of the court decision in the controller's news portal. The controller admitted publishing the articles but argued that the information was accurate and that publishing the data served the public interest. The controller also stated that it had issued a correction upon the data subject request and argued that journalistic activity may be exempt from certain obligations under GDPR and it's exempt from liability if the facts concerned are true according to the Croatian Media Law. The evidence included the published articles, the correction request, witness testimony from journalists and the data subject, and financial records. The court held that the controller violated the data subject’s right to privacy and the protection of personal and family life. It reasoned that publishing her full name, bank account number, and payment amounts was disproportionate because the details were not necessary to inform the public about the football club payments. Following the ECHR jurisprudence, the court applied a proportionality test, balancing the controller’s freedom of expression against data subject's privacy rights under the Croatian Constitution and civil law. The court emphasised that the data subject was not a public figure, had not voluntarily exposed her private life to the media, and did not participate in public debate in a way that could justify disclosing her sensitive data. The court also addressed the controller’s argument regarding journalistic freedom. It recognised that journalists may publish personal data when there is an overriding public interest, such as exposing wrongdoing or contributing to an important debate. However, in this case, the disclosure of the data subject’s bank account and payment amounts was unnecessary for the story’s public interest. The court noted that general information about club payments could have been reported without identifying her. Regarding the harm suffered, the court found that the data subject experienced non-material damage, including emotional stress and intrusion into her private and family life. It awarded €3,000 in damages with statutory interest, while rejecting the additional claim of €3,636.14 as excessive. The court also denied the data subject’s request to publish the decision, explaining that publishing it could further disclose her personal data and undermine her privacy rights.
Court case 327 O 38/25
A court began investigating an airline company (the controller) for their potential consumer, competition and data protection violations following a dispute between two companies. The controller implemented a pre-selected consent box on their website when searching for flights. While the box was initially not pre-ticked, the website automatically ticked the box if a data subject did not do so. This meant that data subjects automatically consented to the website’s terms of use by clicking the “search” button. Furthermore, the controller required data subjects to create an account when booking flights, and filled out some of the information automatically when creating an account. This was also the case if a data subject wished to only look at flights without booking. The opposing company argued that data subjects were not allowed to give meaningful consent, as the option cannot be de-selected. In addition, the controller processed data subjects’ data without a legal basis by requiring them to create an account and by automatically filling in information. The data subject argued that the controller processed data beyond what is necessary for a flight booking or search, in violation of the principle of data minimisation (Article 5(1)(c) GDPR). The controller also violated Article 7(4) GDPR by making the provision of its services conditional to the data subject’s consent. The controller argued that data subjects could easily access the website’s terms and conditions, and that the automatic ticking of the box did not force data subjects to consent. Furthermore, the controller processed only the necessary data when creating data subjects’ accounts. The court found that the controller violated the GDPR and consumer laws through its pre-ticked boxes. The court highlighted that the website misled data subjects into thinking they have a choice, when in reality the website ticked the box automatically. The court dismissed the controller’s argument that the message next to the box sufficiently informed data subjects. However, the court found the processing of data when creating an account permissible, as it considered it necessary for the performance of the flight services. According to the court, the controller only needed data subjects’ email address to create an account, and any other data had to be voluntarily provided by the data subject. Therefore, the court considered this compliant with Articles 5 and 6 GDPR. In addition, the opposing company had not provided enough evidence of the risk of the controller using the booking data for direct marketing purposes. The court prohibited the controller from obtaining consent from data subjects through pre-ticked boxes.
Court case 391/2024
The controller is an insurance company offering voluntary personal insurance. In the context of processing insurance applications, the controller requested and processed health data obtained from healthcare providers in order to assess insurability and determine potential liability. The Data Protection Ombudsman investigated the controller’s practices and concluded that the processing of health data at the application stage violated Article 9 GDPR. According to the Ombudsman, the national exception under Section 6(1)(1) of the Finnish Data Protection Act, which allows insurance companies to process health data, could only apply once an insurance contract had been concluded. On that basis, the Ombudsman ordered the controller to bring its processing into compliance with Article 9 GDPR. The Helsinki Administrative Court upheld the Ombudsman’s decision, finding that the concept of “insured person” under national law did not extend to insurance applicants prior to the conclusion of a contract. The controller appealed to the Supreme Administrative Court. The court overturned the decisions of both the Administrative Court and the Data Protection Ombudsman. The Court held that the concept of “insured person” in Section 6(1)(1) of the Finnish Data Protection Act must be interpreted to include the person who is the object of voluntary personal insurance, irrespective of whether the insurance contract has already been concluded or is still being applied for. This interpretation was supported by the structure and purpose of national insurance law, which requires the assessment of risk and liability already at the application stage. The Court found that processing health data during the insurance application phase is an inherent and necessary part of insurance activity and falls within the national exception permitted under Article 9(2)(g) GDPR. Interpreting the exception more narrowly would exclude a core element of insurance practice without support in the legislative history. Accordingly, the Court concluded that the controller’s processing of health data was not unlawful under Article 9 GDPR, annulled the supervisory authority’s order, and lifted the obligation to modify the processing practices.
Amazon France Logistique
In 2023 the French DPA (CNIL) found that, among other things, Amazon France Logistique (the controller) processed three indicators related to the work performance of their employees without a legal basis. The DPA took this finding into consideration when deciding on the fine issued to the controller, i.e. €32 million. The controller contested the decision. The Supreme Administrative Court found that the three indicators (i.e. the stow machine gun indicator, the idle time indicator, and the latency time indicator) were processed lawfully under Article 6(1)(f) GDPR (i.e. legitimate interest). The Court noted that the purpose of the indicators was the management of stock and order (stock machine gun indicator) and to flag interruptions in activity that cannot be detected by the other indicators used in order to identify their causes (idle time indicator and latency time indicator). The Court also noted that the right to private life of the employees was not excessively infringed upon by the processing of these indicators. In contrast, the Court maintained the DPA’s decision regarding the controller's violation of Article 5 GDPR, specifically the principle of data minimisation and accountability, by collecting a disproportionate amount of data and storing them for 31 days without showing the need for such processing. Therefore, the Court found that the controller processed the indicators based on a legitimate interest under Article 6(1)(f) GDPR and reduced the initial fine from €32 million to €15 million.
IMY
= AB Storstockholms Lokaltrafik (the controller) is the public transport authority for the Stockholm area and operates public transport services. The controller equipped its ticket inspectors with body cameras. The cameras are used to prevent and document threats and violence against inspectors and to verify the identity of passengers who do not have a ticket and need to pay a fine. The cameras had a “circular memory” and automatically erased footage after a certain amount of time; however, ticket inspectors could press a button to preserve the footage. The DPA investigated the controller’s use of body cameras. In 2021 it concluded that the controller operated the cameras in violation of Article 6(1)(f), 5(1)(a)(c), and 13 the GDPR. In particular, the DPA held that the controller violated Article 13 GDPR by failing to inform the passengers (the data subjects) that they were being recorded. On these grounds the DPA issued a fine for a total SEK 16,000,000 (€1,422,000). Out of the total, SEK 4,000,000 (€ 355,500) related specifically to the violation of Article 13. The controller challenged the decision with the Administrative Court of Stockholm. The Court dismissed the action in so far as it concerned the breach of Article 13. The controller further challenged the decision with the Administrative Court of Appeal of Stockholm. Contrary to the DPA and the first instance court, the Court of Appeal held that in the case at hand, Article 14 applied instead of Article 13. On this basis, the Court annulled the DPA’s fine with regards to the SEK 4,000,000 that related to the violation of Article 13. The DPA challenged the Court of Appeal’s decision before the Supreme Administrative Court and claimed that Article 13 GDPR was the applicable provision and the correct ground for fining the controller. The Supreme Administrative Court then referred case to the CJEU for a preliminary ruling. = The Supreme Administrative Court referred the following question to the CJEU: “which of Articles 13 and 14 of the GDPR applies where personal data are obtained by a body camera?”. The controller and the DPA put forward different interpretations: * Under the DPA’s interpretation, Article 14 applies whenever the data subject is not the source of the data, regardless of its involvement in the collection of the data. This interpretation was in line with EDPB guidance and the case laws of DPAs; * Under the controller’s interpretation, Article 14 applies when the data subject does not actively take part in the collection of their data through a deliberate action (for instance, by filling out a form). Articles 13 and 14 both regulate the controller’s duty to provide information about the processing of personal data but differ in several ways, including the applicable exemptions and the time at which the information must be provided. In the case at hand, the difference mattered because the controller argued for the exemption found under Article 14(5)(b): “paragraphs 1 to 4 shall not apply where and insofar as (…) the provision of such information proves impossible or would involve a disproportionate effort”. On 1 August 2025 the AG delivered its Opinion on the case. Based on CJEU case law, the AG clarified that Articles 13 and 14 are mutually exclusive and that the scope of Article 14 is defined negatively by reference to Article 13 of the GDPR. In other words, Article 14 covers any processing of personal data that is not covered by Article 13. The AG held that Article 13 applies whenever the data subject is the source of the data (“collected from the data subject”), regardless of the data subject’s involvement in the collection of the data. In other words, for Article 13 to apply, “there should be no intermediary between the data subject and the controller"Margin 30.. It follows that Article 14 applies whenever the data are collected from a source other than the data subject. In this regard, the AG also pointed to the wording of Article 14(2)(f) GDPR and Recital 62 GDPR, as both support this interpretation. Finally, the AG clarified that the view that Article 13 applies to data collection by means of a body camera, is in line with the general principle of transparency. Unlike Article 14, Article 13 requires the controller to provide information immediately. This allows data subjects to adapt their behavior or even to refrain from entering the area under surveillance. For these reasons, the AG held that the case at hand fell under Article 13 GDPR. TBD
SCHUFA
The controller, SCHUFA Holding AG, operates a credit information agency that collects and stores information on payment defaults reported by its contractual partners for the purpose of assessing consumers’ creditworthiness. The data subject had three undisputed payment defaults recorded by SCHUFA. Each claim had been fully settled between December 2020 and December 2022. Despite settlement, SCHUFA continued to store the corresponding entries and made them available to its clients for credit assessments. Over the course of the proceedings, SCHUFA progressively deleted the entries, relying in part on codes of conduct under Article 40 GDPR approved by the Hessian DPA, which provide for deletion after three years, or after 18 months under specific conditions. The data subject sought deletion of the entries, compensation for non-material damage under Article 82 GDPR, and reimbursement of pre-trial legal costs. After the deletion claims were declared settled, the Cologne Higher Regional Court awarded the data subject €500 in non-material damages, holding that continued storage after settlement was unlawful. The court reasoned that, following the CJEU’s judgment in SCHUFA Holding (C-26/22 and C-64/22), private credit agencies could not store data longer than comparable entries in the public debtor register, which must be deleted immediately upon proof of full satisfaction of the claim. SCHUFA appealed the decision to the Federal Court of Justice. The Federal Court of Justice upheld the appeal. The Court confirmed that credit information agencies pursue legitimate interests within the meaning of Article 6(1)(f) GDPR, both in their own economic interest and in the interest of their customers, such as lenders seeking reliable creditworthiness assessments. It emphasised that credit reporting serves recognised economic and consumer-protection functions and may, in principle, justify the processing of data on payment defaults. However, the Court held that the Court of Appeal was wrong in assuming that the lawfulness of storage must always be assessed by aligning storage periods with those applicable to the public debtor register. The immediate deletion rule in § 882e(3) No. 1 ZPO reflects a specific legislative assessment for the debtor register, which cannot be automatically transferred to credit information agencies. Unlike the debtor register, credit agencies rely on data reported by private creditors, store more differentiated information, and serve broader purposes than enforcement alone. The Court distinguished the case from the CJEU’s SCHUFA Holding judgement on residual debt discharge, noting that that case concerned parallel storage of data originating from a public register, whereas the present case involved data obtained independently from contractual partners. As a result, the CJEU’s reasoning on avoiding circumvention of public-register deletion periods did not apply directly. Furthermore, the Court held that approved codes of conduct under Article 40 GDPR, such as the German credit agencies’ rules on review and storage periods, may be used as a benchmark when balancing interests under Article 6(1)(f) GDPR. Such codes can contribute to legal certainty in mass data processing, provided that they lead to an appropriate balance of interests and that the specific circumstances of the individual case are duly taken into account. Because the Court of Appeal had not properly examined whether continued storage was necessary and proportionate in light of these principles, nor conducted a sufficiently individualised balancing of interests, the finding of unlawfulness under Article 6(1)(f) GDPR could not stand. Consequently, the basis for awarding damages under Article 82 GDPR was not established. The case was therefore remitted for an appropriate assessment of the lawfulness of the data processing and, if appropriate, the existence and extent of non-material damage.
ANSPDCP
The Romanian DPA issued a fine to a company (the controller) in April 2025 for the unlawful processing of its employees’ personal data via surveillance cameras in one of its storage facilities in violation of Article 5(1)(a) and (b) GDPR, Article 5(2) GDPR, Article 6(1) GDPR, and Article 5 Law no. 190/2018 (Legea nr. 190/2018). The controller appealed the DPA’s decision in court arguing, among other things, that the DPA failed to indicate the specific violation committed and the specific time and date. The controller asked the court to annul the DPA’s decision. The court found that the DPA failed to provide a concrete description of the violations committed by the controller. The court noted that the DPA’s decision only provided a generic mention that the personal data processing activities carried out by the controller were in breach of Article 5(1)(a) and (b) GDPR, Article 5(2) GDPR and Article 6(1) GDPR along with Article 5 Law nr. 190/2018. Furthermore, the court found that the DPA’s decision failed to identify and mention the exact date and context of the alleged unlawful processing activities. Instead, the decision only specified that the processing began in 2017. Therefore, the court upheld the controller’s appeal against the DPA’s decision and annulled said decision.
Meta Platforms Ireland Limited
Meta Platforms Ireland Ltd (the controller) is a company that operates the social media platform Facebook. An umbrella consumer organisation brought a complaint regarding Facebook’s “Find Friends” feature. This feature allows registered data subjects to upload third persons’ contact information, as well as pictures, nicknames, relationship status or professional details. This also applies to third persons who are not Facebook users. At the time, the controller stored all this data, including log data related to calls and text messages (metadata). Data subjects who uploaded this data were able to delete it from their account at any moment. According to the controller’s privacy policy, the aim of this processing was to help connect people or generate friend suggestions for data subjects. The controller retained data of non-registered data subjects in the event that they created an account in the future. The consumer organisation brought a case against the controller in June 2018, demanding that the court issue a cease-and-desist subject to a penalty. According to the organisation, the “Friends Finder” feature violated Article 6(1)(a) GDPR, 25(2) GDPR and 5(1)(c) GDPR, because the controller processed data subjects’ data without consent. The organisation also argued that the controller created comprehensive user profiles for personalised advertising purposes without a legal basis, in violation of Article 6(1) GDPR. In addition, the controller lacked explicit consent to process sensitive personal data that users entered in their accounts, in violation of Article 9(2)(a) GDPR. Finally, the organisation argued that the controller did not meet its information obligations by providing legal bases without linking them to specific data processing activities and purposes. This was a violation of Article 13(2)(f) GDPR. The controller argued that the organisation did not have standing, and contested the competence of the court. The controller also argued that its processing ac
Meta
Meta, the controller, is the developer of the instruments “Meta Business Tools”, which are integrated by many third-party websites and apps. Their aim is to monitor and enhance the effectiveness of advertisement. The processes transferring data from the third-party websites to Meta take place regardless of whether the user has activated Meta apps at that moment, and regardless of whether the user has given consent. The data subject’s personal data were being processed according to the procedures described above, despite having objected to the processing of such personal data on his Instagram profile's settings. The data subject thus filed a complaint with the court, asking for an order for the controller to stop processing his data and to delete or anonymise all personal data currently stored, and to be awarded immaterial damages. The controller claims that the data processing carried out with the use of Meta Business tools is “inherent in the contemporary use of the internet”, and that it has no way of making sure that third-party companies have obtained consent from users. The court awarded immaterial damages for €5,000, holding that fear of misuse of one's personal data can amount to immaterial damage. Firstly, it declared the requests to order the controller to cease processing and to delete his personal data inadmissible. The requests were not sufficiently specific, as they did not refer to specific data points. Further on, the court rejected the controllers arguments, affirming that: “Ultimately, the objections raised are not legal arguments, but purely political ones based on the erroneous assumption that the defendant has a quasi-natural right to the undisturbed use of the "business tools" it has designed. Legally, the opposite is true: if the defendant brings applications onto the market with which it cannot ensure legally compliant operation for all users, then it will have to refrain from using these "tools" if the parties concerned take legal a
Court case VDS00089378
A trade union requested that an employer provide a detailed list of the 200 highest gross salaries paid in April 2024, broken down by salary components, including organisational unit, service, department, and job code. The request was made in the context of a collective labour dispute and was justified by the trade union on the basis of a collective agreement and its role in protecting workers’ interests. The employer refused to disclose the requested data. The court of first instance rejected the trade union’s request, finding that the disclosure of such personal data lacked a sufficient legal basis, and ordered the trade union to reimburse the employer’s procedural costs. The trade union appealed, arguing that public-sector salaries are public under national law, which obliges employers to provide trade unions with data necessary for the performance of trade union activities. The court dismissed the appeal and upheld the judgment of the court of first instance. First, the court held that the collective agreement relied upon by the trade union does not constitute a law and therefore cannot serve as a legal basis for the disclosure of personal data, as required by Article 6(2) of the Personal Data Protection Act (ZVOP-2), implementing Article 6 and 9 GDPR. Although public-sector salaries are public under national law, the court clarified that this does not entitle a trade union to obtain individual salary data within a collective labour dispute. Access to such information must be sought before the competent authority, and not before a labour court. The court additionally found that the national legislation invoked is not sufficiently specific, on its own, to justify the disclosure of detailed personal salary data. In line with the principle of data minimisation under Article 5(1)(c) GDPR, the trade union would have had to demonstrate concretely why the requested data were necessary for specific trade union activities, which it failed to do. General claims about mo
paydirekt GmbH
The data subject purchased eye drops, skin care products, and other similar products from on online pharmacy website, as well as items from an online sex shop website. The data subject used the online payment service provided by Paydirekt GmbH (the controller) when making the online purchases. The controller stored data regarding the items purchased, along with the amount of money spent and the date of the purchases. The data subject, represented by noyb, filed a complained with the Hesse DPA (HBDI) in which she argued that the controller violated Article 5(1) GDPR and Article 9(1) GDPR by processing health-related data and data relating to her sexual life (both sensitive data) without a legal basis - specifically by storing the information on the individual items purchased, and Article 25(1) GDPR by processing data that were not needed for the provision of the payment services (data minimisation). The DPA partially rejected the complaint, finding that the controller can process information on the items purchased by a customer from an online pharmacy and an online sex shop based on its legitimate interest to minimise mid-transaction payment cancellations and for fraud prevention purposes. Furthermore, the DPA held that the specific information on purchased items is not sensitive data. In August 2022, the data subject appealed against the DPA's decision in court, requesting that the decision be revoked and that the DPA prohibit the controller from processing the purchased items when making a purchase. Following the CJEU judgement in C-21/23 EuGH the DPA changed their position on the classification of these data to be partially sensitive data. However, the DPA did not provide a detailed explanation as to the consequences of this change of position. In 2025, the controller entered liquidation proceedings and ceased operations. The Court noted that the controller ceased operations, entered liquidation and claimed to have deleted the data subject’s data. Therefor
Court case K-648/2025-2
The defendant, an insurance agent at Croatia Osiguranje d.d., had his access to company business applications revoked during his employment termination notice period in September 2021. Despite this restriction and without authorization from his employer or clients, he used the login credentials of another employee to repeatedly access internal sales applications. He then sent 41 emails containing 848 documents that included the insurance policies and personal data (names, addresses, personal identification numbers, birth dates, and phone numbers) of at least 334 clients. He first sent the data to his official work email and then forwarded it to his private email. The prosecution alleged that this conduct violated the GDPR, the Croatian GDPR Implementation Act, and internal company access rules and this this constituted unauthorized use of personal data and unauthorized access to computer systems under Croatian criminal law. The court held that the defendant committed a criminal offense against privacy. Because the defendant intentionally accessed and used personal data without permission and without a valid legal basis under Article 6(1) GDPR, the court held that he committed the criminal offense of violation of privacy under Article 146(1) of the Croatian Criminal Code. The court sentenced HIM to a prison term of three months. Additionally, the court found that the defendant knowingly accessed the employer’s computer systems without authorisation. The court held that this conduct constituted a criminal offense against computer systems, programs, and data under Article 266(1) of the Croatian Criminal Code because it involved intentional interference with computer systems which the defendant had no lawful access. For this the court sentenced the defendant to a prison term of four months. The court combined the sentences into a single six-month prison term. It then imposed a suspended sentence, so the prison term would not be executed if the defendant did not commit another crime within a one-year probation period. The court explained that it could revoke the suspended sentence if the defendant committed another offense that resulted in imprisonment. The court also ordered him to pay €30 in procedural costs. It held that this sanction was sufficient to prevent future violations and to fulfill the aims of punishment under Croatian law.
Imagens Médicas Integradas SA
Imagens Médicas Integradas S.A., several companies in the SIBS group and Synlabhealth II S.A. (the controllers) are a number of companies in the medical field. Between 2021 and 2022, the national competition authority conducted several investigations under the authorisation of the Public Prosecutor’s Office. The information seized included employees’ emails and internal documents. The controllers objected to the competition authority seizing employees’ emails, and filed an appeal with the Tribunal da Concorrência, Regulação e Supervisão (Competition, Regulation and Supervision Court, Portugal). According to the controllers, the seizures were illegal, as they infringed their right to secrecy of correspondence. The competition court decided to stay proceedings and refer questions to the CJEU concerning the lawfulness of the seizure of emails of employees during investigations carried out by the competition authority. The competition court referred the following questions: # Do the business records at issue in this case, which are transmitted by email, constitute “correspondence” for the purposes of [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 CFR]? # Does [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 CFR] preclude business records arising from email communications between managers and employees of undertakings from being seized in the course of an investigation into agreements and practices prohibited under [https://eur-lex.europa.eu/eli/treaty/tfeu_2012/oj/eng Article 101 TFEU] (ex Article 81 [EC]) [or, in Case C 260/23, [https://eur-lex.europa.eu/eli/treaty/tfeu_2012/oj/eng Article 102 TFEU] (ex article 82 [EC])]? # Does [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 CFR] preclude such business records from being seized on the prior authorisation of a judicial authority, in this case the Public Prosecutor’s Office, which is responsible for representing the State, defending the interests determined by law, bringing criminal prosecutions on the basis of the principle of legality and defending democratic legality in accordance with the Constitution, and which operates independently of the other central, regional and local authorities?’ In his initial opinion, the AG stated that [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 of the EU Charter of Fundamental Rights (CFR)] must be interpreted as not precluding national law from allowing the national competition authority to seize (among other information) employees’ emails related to the investigation without prior judicial authorisation. However, there must be a strict legal framework for the authority’s powers, with adequate and effective safeguards against abuse and arbitrariness. The Court requested the AG to issue a supplementary opinion following the judgement in [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0548 Landeck (C-548/21)], in which the CJEU assessed the Law Enforcement Directive in relation with [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Articles 7], [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng 8] and [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng 52(1) CFR]. The AG was asked to provide his opinion on how [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 8 CFR] applies, in particular when the records and emails contain personal data. The AG first noted that [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 8 CFR] is closely related to [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 CFR], and the two rights may be difficult to distinguish clearly. The AG also noted that the seizure of emails by a national competition authority limits the right to data protection under [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 8 CFR] if said emails contain personal data under Article 4(1) GDPR. [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 8 CFR], however, is not absolute, and may be limited in accordance with [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 52(1) CFR]. For example, the national competition authority may process personal data in the emails under Article 6(1)(e) GDPR in conjunction with Article 6(3) GDPR; since the seizure was permitted under national law, the AG concluded that the processing meets the first requirement of [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 52(1) CFR] (provided by law). The AG then noted that the competition authority did not collect an unlimited amount of data during its investigations, meaning the essence of [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 8 CFR] was not affected. According to the AG, the seizure of emails was the least restrictive way of pursuing the objective of identifying anticompetitive practices. This case is different to that of Landeck, as it did not involve full access to individuals' mobile phone data. In principle, the emails exchanged between employees is of business nature, and therefore the processing is proportionate. Finally, the AG stated that the national competition authority did not need prior judicial authorisation to seize the emails under Article 8 CFR, as he stated in his opinion regarding [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 CFR]. The AG reached a similar conclusion to his first opinion; [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 8 CFR] must be interpreted as not precluding national law from allowing the national competition authority to seize (among other information) employees’ emails related to the investigation without prior judicial authorisation. However, there must be a strict legal framework for the authority’s powers, with adequate and effective safeguards against abuse and arbitrariness. Regarding the first question, the CJEU held that [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 CFR] must be interpreted as meaning that the concept of “communications” includes business-related emails exchanged between employees and managers through an enterprise’s email system. The professional nature of an email, its content, whether it has been read or deleted, or an internal prohibition on personal use do not remove it from the protection afforded by [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 7 CFR]. Personal data contained in or generated by such communications is also protected under Article 8 CFR. Regarding the second and third questions, the CJEU examined them together and reformulated them as asking whether [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Articles 7] and [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng 8 CFR] preclude the seizure, without prior judicial authorisation, of employees’ and managers’ emails during an inspection carried out at an enterprise’s business premises by a national competition authority investigating potential infringements of [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Articles 101] or [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng 102 TFEU]. The CJEU found that searching and seizing such emails constitutes an interference with the rights to privacy and data protection. Under [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 52(1) CFR], such interference is permissible only where it is provided for by law, respects the essence of those rights, pursues an objective of general interest recognised by the EU and complies with the principle of proportionality. The CJEU considered that detecting infringements of EU competition law and preserving undistorted competition in the internal market constitute objectives of general interest. It also found that access to professional emails may be necessary because such communications are a primary source of evidence of anticompetitive conduct and no equally effective, less intrusive alternative may be available. However, the national legal framework must contain clear and precise rules limiting the scope of the inspection and the subsequent processing of the data. In particular, searches must be based on a duly reasoned inspection decision and reasonable grounds for suspecting an infringement. The information collected must be relevant to the predefined subject matter of the investigation, may not be used for unrelated purposes and must be processed in accordance with the GDPR, including the applicable rules on storage and transfers. The absence of prior authorisation by a judge does not, in itself, render the seizure unlawful when the inspection takes place at business or commercial premises. Nevertheless, national law and practice must provide adequate and sufficient safeguards against abuse and arbitrariness. These safeguards must include effective ex post judicial review of both the legality and necessity of the inspection and the manner in which it was conducted, together with an appropriate remedy and the possibility of assessing the admissibility of the evidence obtained. In the present case, the prior authorisation granted by the independent Portuguese Public Prosecutor’s Office could contribute to the strict framework governing the scope, duration and appropriateness of the measures, but could not replace the requirement for effective ex post judicial review. The CJEU therefore held that [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Articles 7] and [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng 8 CFR] do not preclude the seizure, without prior authorisation by a judge, of professional emails during an inspection at an enterprise’s business premises, provided that the authority’s powers are governed by a strict legal framework and accompanied by adequate and sufficient safeguards against abuse and arbitrariness, including effective ex post judicial review. The CJEU clarified, however, that a different standard applies where the authority seeks access to phones, computers or other electronic devices belonging personally to employees or managers. Since such devices may contain private communications, location data, browsing histories, photographs or special categories of personal data under [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Article 9 GDPR], access may constitute a serious interference with [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng Articles 7] and [https://eur-lex.europa.eu/eli/treaty/char_2012/oj/eng 8 CFR]. In such circumstances, access must be subject to prior review by a court or an independent administrative body capable of balancing the needs of the investigation against the affected individuals’ fundamental rights.
Grindr
Grindr is a location-based dating app aimed at gay and bisexual men, transgender people and queer people. In 2020, the Norwegian Consumer Council filed a complaint against Grindr with the Norwegian Data Protection Authority. The reason for this was that Grindr disclosed personal data to several third parties for marketing purposes. The Norwegian Data Protection Authority concluded that Grindr disclosed personal data about its users to third parties for behavioural marketing without valid consent, and that the information about the use of the Grindr app constituted information about the users' sexual orientation or sexual relationships. In December 2021, the Data Protection Authority imposed a fine of NOK 65 million (€5 million). Grindr appealed the decision, and in 2022 the case was referred to the Privacy Appeals Board for review. In September 2023, the Board upheld the Data Protection Authority's conclusions and the decision to impose a fine. Grindr appealed against the Privacy Appeals Board’s decision, and in 2024, the Oslo District Court upheld the administrative fine. The Oslo District Court ruled that the consents were not valid and that Grindr transferred sensitive personal data to advertising partners. Grindr appealed the judgment from Oslo District Court to Borgarting Court of Appeal on 12 August 2025. The Court of Appeal dismissed Grindr’s appeal and upheld the Data Protection Authority’s decision and fine. It held that the information Grindr disclosed to its advertising partners, including users’ App IDs, constituted special categories of personal data under Article 9(1) GDPR, as this data indirectly revealed users’ sexual orientation and sexual relationships. Referring to CJEU case law, the court found that information which can indirectly reveal such sensitive details falls within the scope of Article 9(1) GDPR. Grindr’s argument that the data did not “reveal” sexuality and that its purpose was purely commercial was rejected because the app’s design, marketing, and predominant use by LGBTQ+ individuals made it clear that merely being identified as a Grindr user strongly indicated a non-heterosexual orientation. Also, the court held that Grindr’s consent mechanism did not meet the GDPR’s requirements that consent be freely given, specific, and informed under Articles 4(11) and 4(7) GDPR , interpreted in light of Recitals 42 and 43 and the CJEU case law. Consent was not voluntary because users could not access the app without agreeing to data sharing, which was not necessary for the providing of the services, and the paid versions did not remedy this since personal data were shared before payment was possible. The option to change device settings to limit behavioral advertising also did not constitute valid consent, as the GDPR requires an active and unambiguous act, not inaction or reliance on default settings. Moreover, Grindr’s privacy policy was unclear and misleading, failing to explain in plain terms which data were shared, with whom, and for what purpose. Consequently, the court found that Grindr’s users had not provided valid consent, and the company therefore lacked a lawful basis under Article 6(1)(a) and Article 9(2) GDPR for sharing personal data with advertisers. The fine of NOK 65 million (€5 million) was confirmed as valid and proportionate. The court found no reason to reduce the fine, rejecting Grindr’s argument that it was excessive or inconsistent with other EU cases.
Court case VI ZR 431/24
A consumer protection organisation filed a case against a mobile phone service provider in Germany. The organisation challenged the provider’s practice of transferring “positive data” about customers to the credit agency SCHUFA. Positive data is information about the existence and proper fulfillment of a postpaid mobile contract. The controller stated that this transfer served the purpose of fraud prevention and credit risk management. The organisation claimed that the transfer violated the GDPR, as it was carried out without the data subject’s consent. It also argued that the provider’s data protection notice was an invalid section of the controller's general terms and conditions under German civil law. The lower courts dismissed the claims. The organisation appealed to the Federal Court of Justice (Bundesgerichtshof - BGH). The BGH dismissed the appeal and confirmed that the transmission of positive data to SCHUFA was lawful under Article 6(1)(f) GDPR. The court held that the controller had a legitimate interest in preventing fraud and assessing credit risk when concluding postpaid mobile phone contracts, particularly those involving the provision of smartphones. It found that consumers could reasonably expect such data transfers in this context. The court explained that the transfer of positive data was minimal and proportional because the information shared was limited and did not reveal private preferences or behaviour. The BGH rejected the organisation’s argument that the transfer aimed to identify “contract hoppers" (people who frequently change contracts to get bonuses), as there was no factual evidence to support this claim. It also held that the proceedings did not need to be suspended pending other cases, as the relevant legal issues had already been clarified by the CJEU in its previous case law (Mousse v CNIL C-394/23; Schufa C‑26/22 and C‑64/22). Regarding the data protection notice, the BGH found that it was not part of the contractual terms but mer
Court case LVwG-352-2/2025-R12
A journalist requested information from the Vorarlberg State Government (the controller) under the Vorarlberg Freedom of Information Act regarding the locations of election posters and digital election advertising displays used by political parties for the next state election. Under Article 1c(2) of the Vorarlberg Political Party Promotion Act (PFG), political parties were legally required to notify the state government of the locations used for election posters or digital election advertising displays. The journalist stated that the purpose of the information request was to compare the poster locations reported by political parties with a photographic documentation of actual poster locations prepared by several editors of their media outlet. The controller refused this request on data protection grounds. It argued that the map showing election poster locations and the addresses in their descriptions involved special categories of personal data under Article 9 GDPR, as these data could reveal the political opinions of the property owners associated with the respective addresses. The controller also stated that no exemption under Article 9(2) GDPR applied in this case. Additionally, the controller stated that disclosure was not permissible due to the absence of a legal basis. The controller argued that the interest in confidentiality of special categories of personal data prevailed, especially since there was no necessity for the requested information to exercise freedom of expression in accordance with Article 10 of the European Convention on Human Rights (ECHR). The journalist appealed the decision to the Provincial Administrative Court (LVwG) of Vorarlberg. They argued that the intention behind their information request was to determine the geographical focus of the election campaign by assessing the poster locations and had no intention of using the requested data to attribute political views to individuals or entities. The journalist contended that it was in the public interest to know which party aimed to target voters more intensively at specific locations and that the controller failed to reconcile the data protection aspects with the right of freedom of expression and information. They argued that the location of an election poster or a digital election advertising display alone is not enough to infer a close political affiliation of the property owner with a political party. The journalist also claimed that the decision had not examined whether partial information not relating to natural persons, such as poster locations on public roads or other public transportation areas, could have been disclosed. The court accepted that the journalist acted as a “public watchdog” and sought the information for journalistic purposes. Regarding the locations of election posters submitted by political parties, the court held that, where the locations concerned property owners who were natural persons, the information allowed inferences about their political opinions. It reasoned that it would generally be contrary to common experience for a property owner to permit a poster for a party with which they did not have at least some positive political affinity. It determined that the data could be classified as information about political opinions if the data allowed someone to draw such conclusions, even if only as a presumption. It therefore stated that the processing of location data from political parties’ election posters constituted processing of special categories of personal data under Article 9(1) GDPR. The court also noted it was not decisive for this that the journalist’s stated intention was not to attribute political opinions to individuals or entities. Furthermore, the court examined whether any exceptions under Article 9(2) GDPR could apply in this case. It considered the exception for data manifestly made public by the data subject pursuant to Article 9(2)(e) GDPR and the exception for substantial public interest pursuant to Article 9(2)(g) GDPR. The court rejected the application of Article 9(2)(e) GDPR. It held that the mere fact that election posters were visible in public did not mean that the property owners themselves had manifestly made public information allowing an inference, even a presumed one, about their political opinions. Moreover, it determined that there was no legal basis that would allow the disclosure of the locations of election posters. The court held that the PFG did not permit disclosure beyond the designated public bodies and that the Vorarlberg Freedom of Information Act lacked the necessary specificity to provide a legal basis under Article 9(2)(g) GDPR. Accordingly, the court concluded that neither of the exceptions applied. In addition, the court determined that the public interest in disclosing the specific poster locations did not outweigh the affected individuals’ right to data protection. It noted that the journalist's interest in knowing where political parties intended to target voters more intensely was not considered an overriding public interest and did not significantly improve democratic oversight or political transparency. The court further addressed the possibility of partial disclosure in relation to locations not associated with natural persons. It found that the State Government did not have ready and available information identifying which of the approximately 2,700 addresses were linked to natural persons and which to legal persons. The court noted that the State Government was not required to carry out further inquiries in order to provide a partial response. It concluded that therefore a response limited to addresses attributable to legal persons was not possible. The court further stated that such a limited disclosure would not have satisfied the journalist’s asserted interest.
Court case Ra 2023/04/0117
A data subject received a COVID-19 vaccination information letter sent by the social insurance institution together with the Ministry of Social Affairs, Health, Care and Consumer Protection. Believing that his vaccination status and contact data must have been unlawfully accessed or shared, he filed a complaint with the Austrian Data Protection Authority (DSB), alleging a violation of his right to confidentiality under [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=1&Paragraf=1&Anlage=&Uebergangsrecht= § 1 DSG] and unlawful processing under Articles 5, 6, and 9 GDPR. He further argued that the controller had failed to comply with the information obligations under Article 14 GDPR, had not concluded a joint-controller agreement with the Ministry, and had not carried out a data protection impact assessment. The DSB dismissed the complaint and the data subject appealed to the Federal Administrative Court, and when that court dismissed his appeal and refused to allow an ordinary revision, he filed an extraordinary appeal with the Supreme Administrative Court. The Supreme Administrative Court examined the data subject’s extraordinary appeal and determined that it raised no legal question of fundamental importance. It agreed with the lower court and the DSB that the social insurance institution, classified as a public law institution, was entitled, under [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10008147&FassungVom=2021-08-31&Artikel=&Paragraf=750&Anlage=&Uebergangsrecht= national law], to process the data subject’s data from the central vaccination register on the basis of explicit statutory authorizations, which required the identification of unvaccinated insured persons and the sending of official information regarding health risks and available free vaccines. Moreover, because this legal basis met the requirements of Articles 6 and 9 GDPR, no violation of the data subject’s righ
Court case I C 321/24
A data subject was covered by mandatory social insurance in Poland and stayed at a rehabilitation center in 2022. She shortened her stay after the death of her mother and informed the Social Insurance Institution (the controller) to avoid charges for the unused period. On 26 July 2022, a Social Insurance Institution employee accidentally sent an Excel file containing the data subbject’s personal data from their work email to their private email account. The data included her name, ID number, the name of the rehabilitation center, the duration of stay, and the reason for shortening the stay. The file was not encrypted, but the employee deleted it from the private email on the same day. The Social Insurance Institution informed the data subject about the incident, apologised, and explained the potential risks. The data subject feared that her data could be misused for financial or other purposes and took preventive steps such as blocking her bank account and requesting a new identity document. On 16 November 2023, the data subject filed a lawsuit seeking PLN 4,000 (€870) in compensation for non-material harm caused by the breach under Article 82 GDPR and the Polish Civil Code. She claimed that Social Insurance Institution violated her privacy by unlawfully processing her personal data. The Regional Court in Warsaw (Sąd Okręgowy w Warszawie) dismissed the claim in full on 7 October 2025. The court recognised that sending the Excel file breached Article 5 GDPR because the data were not securely transmitted. However, the court explained that a GDPR breach alone does not create a right to compensation. To obtain redress under Article 82 GDPR, the data subject must show that she suffered actual harm and that the harm was caused by the controller’s actions. The court found that the data subject did not prove that any third party accessed her personal data. Her fear of misuse, although genuine, was not reasonable given the circumstances: the file went only to the empl