GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
Inspektorat kam Visshia sadeben savet
Following the expiration of the prescribed time limit for submission of annual declarations of assets of judges, public prosecutors and investigating magistrates and their families, the Inspectorate at the Bulgarian Supreme Judicial Council requested the Sofia District Court to lift the banking secrecy of several judges and public prosecutors, as well as their families. The Inspectorate is comprised of an Inspector General and a panel of ten Inspectors. At the time, the terms of office of the Inspectorate members had been expired for two years and there was no provision in national law limiting the permissible extent of the extention of their duties . The referring Court was unsure as to whether the continuation of the performance of their duties by the Inspectorate past the expiry of their term undermines the independence of the Office under EU law and unsure as to the interplay between the provisions in the Bulgarian Constitution and the GDPR, and referred the following questions: (1) Must the second subparagraph of Article 19(1) TEU, read in conjunction with the second paragraph of Article 47 of [the Charter], be interpreted as meaning that it is per se or under certain conditions an infringement of the obligation incumbent on Member States to provide effective remedies sufficient to ensure independent judicial review for the functions of an authority which can impose disciplinary penalties on judges and has powers to collect data relating to their assets and liabilities to be indefinitely extended after the constitutionally stipulated term of office of that body comes to an end? If such an extension is permissible, under what conditions is that the case? (2) Must Article 2(2)(a) of [the GDPR] be interpreted as meaning that the disclosure of data covered by banking secrecy for the purposes of verifying assets and liabilities of judges and public prosecutors which are subsequently made public constitutes an activity which falls outside the scope of [EU]
Meta Platforms Ireland Ltd.
Meta Platforms Ireland Ltd. brought an action before the General Court seeking an annulment of [https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion_202408_consentorpay_en.pdf Opinion 8/2024 of the EDPB of 17 April 2024 on valid consent in the context of “consent or pay” models implemented by large online platforms]. They also sought compensation for the damages suffered as a result of the opinion under [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12012E/TXT:en:PDF Article 268 TFEU]. The EDPB argued that the Court should dismiss both the action for annulment and compensation as inadmissible and order Meta to pay costs. The EDPB claimed that the contested opinion is not a challengeable act that it was not of direct or individual concern for Meta. The EDPB further argued that the opinions adopted under Article 64 GDPR differ from the binding decisions under Article 65(1) as they do not, on their own, create legal effects. Meta argued that if such opinions were inadmissible, the autonomy of EU law would be undermined. Meta highlighted that data subjects may bring legal proceedings on the basis of such opinions before courts in the EEA, but not the EU, and that those courts cannot refer questions to the Court of Justice under [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12012E/TXT:en:PDF Article 267 TFEU]. This creates, Meta argued, a risk of conflict in the interpretation and application of EU law. Meta also argued that if their action for annulment was declared inadmissible, this would lead to a breach of its right to effective judicial protection as enshrined in Article 47 of the Charter. Finally, Meta submitted that the opinion produces binding legal effects. In support of this, Meta highlighted the limited discretion afforded to supervisory authorities under the opinion and claimed that it demonstrated the EDPB’s desire to force its views upon the Data Protection Commission (DPC), Meta’s lead supervisory authority. The C
Court case I C 1061/19
A data subject filed a lawsuit against a hotel and service company (the controller), seeking PLN 50,000 (€11,500) in compensation for the alleged unlawful use of her image and an injunction prohibiting its use on an outdoor billboard. The data subject had been employed by the controller from 1 April 2017 to 30 September 2017. She claimed that in 2019 her image appeared on the billboard for approximately three months without her consent. She sent three letters requesting the removal of the image and compensation. While the controller removed the image, it refused to pay compensation. The data subject relied on Article 82 GDPR, Articles 23 and 24 of the Civil Code (Kodeks cywilny) and Article 81 of the Act of 4 February 1994 on Copyright and Related Rights (Ustawa o prawie autorskim i prawach pokrewnych), arguing that her personal rights were infringed and that her former employment did not constitute consent. She also stated that the image appeared on the defendant’s Facebook profile from 29 September 2017 to 23 November 2020 without her consent. The controller argued that it was not liable because it had commissioned an external company to produce the advertisement. It claimed that the data subjects had given verbal consent to participate in a professional photo, and that her image appeared only as a minor background detail, which did not require consent under Article 81(2)(2) of the Act on Copyright and Related Rights. The controller also stated that the data subject could not be identified from the billboard and that any liability for infringement rested with the advertising company. The court held that the data subject did not consent to the use of her image for advertising purposes. It established that she participated in the photoshoot under instructions from her supervisor, believing only her hands would appear, and that no consent was given for the publication of her face. The court argued that the controller made the decision to publish the image and is
Data Protection Commission
The data subject was a fire prevention officer working for the Irish Health Service Executive (HSE) and was provided with a work phone to be used for work purposes. In May 2021, the HSE suffered a significant data breach and ransomware attack which compromised a large number of HSE computers and devices, including the data subject’s work phone. In June 2021, the data subject noticed that his personal email account and personal cryptocurrency account, both of which he had accessed on his work phone, had been compromised. Cryptocurrency to the value of €1,400 had been stolen. After being left unsatisfied with the HSE’s response to a complaint he had filed in relation to the incident, the data subject complained to the DPC on 15 December 2021. In an email to the data subject about the issues he raised, the DPC noted that the HSE was not the data controller in respect of the data subject’s non-work-related personal data which was on the work phone as the device was only supposed to be used for work purposes. It was found that there was “no basis” upon which the HSE could be considered the data controller when the personal data (personal email and cryptocurrency account) was stored on the device without the HSE’s knowledge or agreement. On 15 August 2022, the data subject sought a judicial review before the High Court of the DPC’s decision. The data subject claimed that the work-related data comprised “personal data” under Article 4(1) GDPR, that the HSE was the data controller in respect of it in accordance with Article 4(7) GDPR, and that the DPC had erred in their findings in respect of their decision. This, according to the data subject, rendered their decision “unreasonable” in accordance with the test laid out in Meadows v Minister for Justice, Equality and Law Reform [2010] 2 I.R. 70. This decision established some criteria for which an administrative decision can be judicially reviewed in Ireland. The data subject also claimed that the DPC had failed in their obligation to investigate the breach of the GDPR which he complained about. The applicant thus sought an order annulling the DPC’s decision. The DPC opposed the application for judicial review, submitting that the breach considered in the data subject’s complaint to the DPC related solely to the non-work-related personal data present on the device for which the DPC found that the HSE was not the data controller. The decision did not, according to the DPC, consider the work-related personal data on the device. The DPC also noted that the rejection of the complaint amounted to a legally binding decision in accordance with s. 150(12) of the Data Protection Act 2018, and as such, the data subject should have sought a statutory appeal in lieu of a judicial review. In respect of the question as to whether the data subject should have pursued a statutory appeal in lieu of judicial review, the Court held that in this instance, this failure would not preclude his application for judicial review. The Court referenced the language adopted by the DPC in their communication to the data subject, noting that they used the term “concerns” rather than a complaint and that it was not expressly stated that they were “dismissing” or “rejecting” the matter. The Court found that in their email, the DPC should have used the language in the legislation and informed the data subject that he had a right of appeal. In the present circumstances, it would be unfair to deny the data subject judicial review on this ground. In assessing the reasonableness of the DPC’s conduct and their obligation to investigate the alleged infringement, the Court referenced the data subject’s initial complaint. The Court noted that the data subject made their complaint entirely about the alleged breach of his non-work-related personal data on the work device. This, it was held, was addressed by the DPC in their response to him. The Court found that DPC’s decision did not err sufficiently so as to warrant the Court's intervention, and that there were no grounds for finding that the test set out in Meadows was satisfied. Accordingly, the Court refused the data subject’s application for judicial review.
Court case 5 U 129/24
The data subject was a user of a platform provided by the controller. An unknown third-party used the possibility of finding user accounts through the users’ phone numbers for scraping the platform by randomly generating phone numbers and searching for users, on the basis of a default setting set by the controller. The data subject was affected by this data "scraping incident", that resulted in loss of control of their data. The data subject filed a lawsuit with the first instance court. At first instance, the court ordered the controller to pay the data subject €500 for non-material damages and granted the requests for declaratory and injunctive relief. Both parties appealed the decision of the court of first instance before the Higher Regional Court of Celle (Oberlandesgericht Celle – OLG Celle). The court amended the decision of the court of first instance. It ordered the controller to pay the data subject the amount of €100 pursuant to Article 82(1) GDPR and established that the controller is obliged to compensate the data subject for all material future damages. However, it confirmed the court of first instance's order to cease and desist from any further infringements of this provision under penalty of a fine, to refrain from disclosing personal data of the data subject’s side to third parties, in particular the telephone number or other non-public data points, on the basis of a default setting set by the controller and to refrain from processing the data subject's telephone number on the basis of consent, which was obtained due to the confusing and incomplete information provided by the controller. First, the court held that the controller violated the principle of data minimisation pursuant to Article 5(1)(b), Article 5(1)(c) and Article 25(2)(b) GDPR. Following the lead decision of the German Federal Court of Justice (Bundesgerichtshof - BGH) - VI ZR 10/24 from 18 November 2024, the court held that the mere loss of control over one's personal data as a
Court case 16 U 184/23
The data subject is pursuing claims against the controller inter alia for damages, information and injunctive relief based on alleged data protection violations by the controller in connection with so-called data scraping on the social network. operated by the controller. The platform provided the technical possibility of using a variety of digit sequences similar to common phone number formats to search for matching users on the social network. If a generated number matched a user's stored mobile phone number, their public user information was assigned to the entered number and retrieved. Starting in January 2018, unknown persons exploited this opportunity to massively steal data from user accounts, which also affected the data subject. In 2021, stolen data appeared on the internet. The controller confirmed to the data subject that, according to its information, the "user ID," first and last name, and gender had been extracted from the data subject's individual data through scraping. For a more detailed summary of the facts and the leading decision in these scraping cases see BGH - VI ZR 10/24. = The court found that although the controller violated the GDPR, the data subject did not suffer any compensable non-material damage as a result. The court held, that contrary to the controller's view, the searchability of the data subject's user profile using his mobile phone number was not necessary within the meaning of Article 6(1)(f) GDPR or Article 6(1)(b) GDPR as it was not essential to fulfilling the main purpose of the user agreement cited by the controller – mutual findability for networking purposes. Additionally, the court found that the linking of the privacy settings in the terms of use as well as the privacy tools and help area pages of the platform did not provide any transparent information about the searchability using the mobile phone number. The court held, that the data subject did not have to concern himself with these information options, but w
Amt der Tiroler Landesregierung
During the COVID-19 pandemic, the Office (Amt der Tiroler Landesregierung), an auxiliary administrative entity in the service of the Governor and the Provincial Government of Tyrol, sent a ‘vaccination reminder letter’ to all adults residing in the Province of Tyrol who had not yet been vaccinated against that virus. For the purpose of identifying the addressees of those letters, the Office appointed two private companies, which conducted a cross-check of data in the central vaccination register and the patient index, which referred to their residential address. One of those addressees of the vaccination reminder letter (the data subject), filed a complaint with the DPA against the Office alleging unlawful processing of his personal data. Before that authority, the Office stated that it had the status of ‘controller’ and that it was responsible for the letter sent to data subject. The DPA found that the Office had violated the GDPR when it had consulted the data of the data subject in the vaccination register to send the ‘vaccination reminder’ even though it did not have a right to access that register or the patient index. The Office appealed that decision before the Federal Administrative Court (Bundesverwaltungsgericht - BVwG) which held that the Office had the status of controller on the basis of national law but did not have a right to consult the vaccination register for the purposes of sending a reminder letter. Consequently the Office brought an appeal before the Supreme Administrative Court (Verwaltungsgerichtshof -VwGH). That court found that, to enable it to rule in the case before it, it must be determined whether the Office, in the context of that case, has the status of ‘controller’, within the meaning of Article 4(7) GDPR and decided to stay the proceedings and to request a preliminary ruling asking in essence: * whether Article 4(7) GDPR must be interpreted as meaning that it precludes national legislation which designates, as controller, an auxiliar
Data Subject versus Bavarian public broadcasting authority
The data subject owed broadcasting fees to the Bavarian public broadcasting authority for services since 2013. In 2021, the public broadcasting authority engaged P. GmbH, a debt-collection agency, to recover outstanding payments. In response to an information request by the data subject under § 11(8) RBStV, the broadcaster confirmed that such agencies could receive personal data as processors within the meaning of Article 28 GDPR. After learning this, the data subject requested access to the controller–processor agreement concluded between the broadcasting authority and P. GmbH, arguing that he was entitled to verify whether it met the formal and substantive requirements of Article 28(3) GDPR. This request was rejected by the broadcasting authority. The data subject then brought an action before the Administrative Court of Munich (VG München), which dismissed the claim, holding that neither § 11(8) RBStV nor the GDPR provided any legal basis for such an inspection right. The data subject subsequently filed an application for leave to appeal with the Higher Administrative Court (VGH München). The Court dismissed the data subject's application for leave to appeal and upheld the decision of the lower court. The Court held that neither the GDPR nor the national broadcasting law (§ 11(8) RBStV) conferred any right for individuals to inspect a controller–processor agreement concluded under Article 28 GDPR. The Court held that the authority to verify compliance with Article 28 GDPR lies exclusively with the competent supervisory authority under Article 51 GDPR, not with private individuals. For data subjects, Article 15 GDPR provides a right of access only to their own personal data, not to contractual documents between a controller and its processor. Accordingly, the Court found that the plaintiff lacked a legitimate legal basis for inspecting the contract, and that the broadcasting authority had lawfully refused the request.
A (data subject)
The data subject was employed by a company (the controller) for one month in 2016. In 2022 the data subject filed a request, asking for information about any ongoing processing of his data. The controller responded but the data subject considered the response to be incomplete: in the data subject’s view, the response did not provide sufficient details about the completeness of the copied provide to them, the duration of the data storage, and the specification of the recipients of the data. After some back-and-forth, the controller eventually provided the information he requested, two months after the initial request. The data subject asked the controller for monetary compensation for the delay. After the controller refused, the data subject sued the controller with the Labour Court, claiming damages under Article 82(1) GDPR. Specifically, the controller claimed that he suffered non-material damages over a week-long loss of control over his personal data, due to the controller's delayed response. The Labour Court awarded €10,000 in damages but the controller appealed the decision. Later, the Regional Labour Court overruled the decision and rejected the damage claim. In turn, the data controller challenged the appeal before the Federal Labour Court- Germany’s court of last instance for labour cases. Before this Court, the data subject claimed that a delay in responding to an access request, in and of itself, constitutes a loss of control over one’s data and gives rise to a claim for non-material damages under Article 82(1) GDPR. The Court upheld the appealed decision and denied damages. In particular, the Court held that the controller’s delay in responding to an access request, does not, in and of itself, constitute a loss of control (and, therefore, does not necessarily cause non-material damage). The Court used the case law of the EU Court of Justice as a starting point. With regards to the compensation of non-material damage, the CJEU held that a loss of control of control over one’s data is, in and of itself, non-material damage and therefore compensable under Article 82CJEU, Case C-200/23, Agentsia po vpisvaniyata, 4 October 2024, margin number 150 (available [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62023CJ0200 here]).. However, a merely hypothetical risk of data misuse, cannot, in itself, lead to compensationCJEU, Case C-687/21, MediaMarkt Saturn, 25 January 2024, margin number 68 (available here).. On this basis, the Federal Court of Labour held that data subjects can claim non-material damages over the loss of control over their data and the negative feelings caused by such loss of control. This was also true for a short-term loss of control that did not result in data misuse (as in the case at hand). However, the Court also held that in order to claim damages, data subjects must prove the loss of control. To this end, it is not enough for a data subject to simply claim that a GDPR violation created a hypothetical risk for data misuse. Rather, the data subject needs to prove that there was a concrete risk that their data would be misused. In other words: in order to claim non-material damages over loss of data control, data subjects need to prove that the loss of control actually occurred. This means proving that they had objectiveWith regard to the objective nature of this criterion, the Court referenced its own case law. See BAG July 25, 2024 - 8 AZR 225/23, margin number 33 and June 20, 2024 - 8 AZR 124/23, margin number 15. and well-founded reasons to worry about data misuse (again, regardless of whether their data were actually misused). In the case at hand, the data subject merely claimed that the controller’s response was late and that he suffered a negative emotional situation as a result of the delay. However, he did not claim that there was a risk of data misuse or prove the existence of this risk. The Court therefore rejected his damage claim.
UODO (Poland)
A data subject filed a complaint with the Polish DPA (UODO) against a controller in May 2022. The DPA ordered the complaint to be supplemented by a description of alleged violations and expected actions to be taken by the DPA against the controller. In July 2022 the data subject filed another complaint, against another controller who allegedly unlawfully processed their data for marketing purposes. In November 2022 the DPA decided to join both proceedings initiated by the data subject. According to the DPA, the complaints referred to the same subject matter, namely unlawful phone number processing for marketing purposes. In April 2023, the DPA notified the parties that the examination proceedings were over, and the parties were entitled to present their position as to the collected evidence ([https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU19600300168/U/D19600168Lj.pdf Article 10(1) of the Code of Administrative Procedure - Kodeks postępowania administracyjnego]). In July 2023 the data subject issued a motion with the DPA to accelerate the proceedings. Afterwards, the data subject lodged a complaint against the DPA inactivity with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie - WSA Warszawie). In the meantime, in October 2023 the DPA issued a decision, closing the case at hand. The WSA Warsaw upheld the complaint. According to that court, Article 78(2) GDPR set forth a three-month term to examine the case. The DPA failed to do so. In particular, the court found the DPA took no action several times during the proceedings and that such an inactivity was not substantiated. The fact that the decision was eventually issued was irrelevant for the inactivity complaint. The DPA lodged a cassation appeal before the Supreme Administrative Court (Naczelny Sąd Administracyjny – NSA). The Supreme Administrative Court dismissed the cassation appeal. The court emphasised that the scope of inactivity covered situations when a DPA exceeded the time given to examine a case. Under Article 78(2) GDPR the DPA was obliged to examine the case and issue a decision within 3 months. If the DPA knew the case required extensive examination proceedings, they were obliged to notify the data subject about the delay, inform them about the status of the case and indicate when the case would be closed. However, court held, that the DPA did not perform any of those actions. Thus, the cassation appeal was dismissed as unfounded.
The Federal Republic of Germany
Until 2019, personnel files for an unnamed federal institute in Hannover were managed by the employees of the State of Lower Saxony. An employee of the Institute (the data subject) objected to this practice several times and eventually filed a complaint with the DPA. Additionally, the data subject sued the Federal Republic of Germany. In her lawsuit, the data subject claimed that the processing of personal data by the employees of the State of Lower Saxony was unlawful and cause non-material damage. The Federal Republic conceded that the processing of personal data was unlawful but contested the claim for damages. The Regional Court and the Higher Regional Court both rejected the claim for damages. In particular, the Court of Appeal rejected the claim for two reasons. First, personal data was transmitted to State employees under an obligation of confidentiality. For this reason, the data subject did not lose control of their data. Second, the Court held that even if a loss of control had occurred in the case at hand, the mere loss of control over personal data did not, in itself, constitute a form if immaterial damage. The Federal Court of Justice reversed the Higher Regional Court’s findings on the damages. Throughout the ruling, the Court consistently referred to the case law of the EU Court of JusticeThe Court referred to numerous cases. See for instance: CJEU C-456/22, Gemeinde Ummendorf, 14 December 2023 (available [https://curia.europa.eu/juris/document/document.jsf?docid=280630&doclang=en here]): C-687/21, MediaMarktSaturn, 25 January 2024 (available [https://curia.europa.eu/juris/document/document.jsf?docid=282062&doclang=en here]). First, the Court held that the data subject lost control of their data due to the unlawful access of State employees. In this regard, the Court held that the fact that the State employees were under an obligation of confidentiality, did not exclude a loss of control. However, the Court held that these confidentiality obligation
Clearview AI
On the 27 May 2021 noyb filed a complaint against Clearview AI, here the controller, with the Austrian DPA (Datenschutzbehörde – DSB). Clearview AI is a company which provides a facial recognition platform allowing users to compare photos of people with images of them found online. noyb brought forward that the controller could not rely on a legal basis for the processing of personal data of the represented data subject. More importantly, noyb requested for the data processing activities of the controller to be banned by the DPA under Article 58(2)(f) GDPR. The DSB found that the controller had violated the GDPR (see DSB (Austria) - 2022-0.277.156). However, the DSB decided that the erasure of the personal data was an appropriate measure under Article 58 GDPR and that the additional prohibition therefore would not be necessary. noyb appealed the dismissal of the prohibition request to the Federal Administrative Court of Austria (Bundesverwaltungsgericht – BVwG). noyb’s argument noyb stated that the mere confirmation of a violation did not provide adequate legal protection from future unlawful data processing. noyb explained that even if the controller deleted the data subject’s personal information, it was likely that the controller would again process the data subject’s pictures as its business model is based on finding pictures of people online and processing them. Further, noyb argued that the data subject did have a subjective right to a prohibition on the processing as it was the only effective option available. The controller continuously scans the internet for pictures so if the data subject’s pictures were deleted it would only be a matter of time until they would be processed again. Additionally, a subjective right to an injunction was necessary as otherwise data subjects would have to bring a separate action for an injunction. This would put data subjects at a disadvantage particularly in regard to the cost of bringing such an action. noyb therefo
Court case 1 R 461/24 OVG
The data subject filed a complaint with a DPA regarding a GDPR violation. When the DPA did not decide to the data subject's satisfaction the data subject initiated administrative court proceedings to order the DPA to take effective supervisory action. Regarding this proceeding the data subject was issued an administrative court cost statement, to which it filed an objection at the Administrative Court of Schwerin (Verwaltungsgericht Schwerin - VG Schwerin). The data subject argued that Article 57(3) GDPR, which ensures cost-free procedures before the DPA, should also apply to judicial proceedings. The VG Schwerin dismissed the objection. The data subject then appealed the court’s decision to the Higher Administrative Court. The Higher Administrative Court clarified that Article 57(3) GDPR only applies to tasks performed by the DPA, such as handling complaints and taking action based on data protection law. The court emphasized the difference between administrative proceedings before DPAs and judicial proceedings. It relied on Section 188 of the German Code of Administrative Court Procedure ([https://www.gesetze-im-internet.de/englisch_vwgo/englisch_vwgo.html#p0866 Verwaltungsgerichtsordnung - VwGO]) to determine the rules regarding court costs, finding that this provision is conclusive on exemptions for court costs and does not include exemptions for GDPR related claims. Thus, it reached the conclusion that Article 57(3) GDPR does not cover judicial proceedings, which are a separate legal process governed by national law. In its ruling, the Higher Administrative Court rejected the appeal, affirming that Article 57(3) GDPR, which guarantees cost-free procedures before DPAs, does not extend to judicial proceedings. The court stated, that it did not find it necessary to refer the question of judicial costs for GDPR claims to the CJEU.
Meta
Meta Business Tools transmitted data to third parties without user consent, violating consent requirements for third-party tracking.
Datenschutzbehörde
On 17 February 2020, the data subject lodged a complaint with the Austrian DPA. He complained that the controller had not responded to his access request under Article 15 GDPR for access within one month. On 22 April 2020, the DPA made the decision to refuse to act on this complaint, arguing that it was “excessive” under Article 57(4) GDPR. The DPA observed in particular that, over a period of about 20 months, the data subject had sent it 77 complaints arguing that various controllers failed to respond within one month to his requests for access or erasure. Also, the DPA highlighted the fact that the data subject regularly contacted the DPA by telephone in order to report additional facts and to make additional requests. The data subject brought an action before the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). On 22 December 2022, the BVwG upheld the data subject’s action. It held that, in order for requests to be "excessive” under Article 57(4) GDPR, it is not enough that these requests had been made repeatedly and frequently, but it is also needed that they had been manifestly vexatious or abusive. The DPA appealed this judgement before the Supreme Administrative Court (Verwaltunsgerichtshof – VwGH). This court decided to stay the proceedings and refer the following questions to the CJEU for a preliminary ruling: # Must the concept of “requests” in Article 57(4) GDPR be interpreted as meaning that it also covers “complaints” under Article 77(1) GDPR? # Must Article 57(4) GDPR be interpreted as meaning that, for requests to be “excessive”, it is sufficient that a data subject has merely addressed a certain number of requests to a DPA within a certain period of time, irrespective of whether the facts are different and/or whether the requests (complaints) concern different controllers, or is an abusive intention on the part of the data subject required in addition to the frequent repetition of requests (complaints)? # Must Article 57(4) GDPR be in
Court case 14 O 472/23
The data subject, a user of a popular music streaming service (the controller), sued the controller after her personal data (such as her name, email address, and usage preferences on the platform) was exposed in the darknet. After the controller's service provider (the processor) mishandled the data by transferring it to an unsecured environment it was accessed by hackers and published on the darknet. The contract between the controller and the processor concluded in 2020 while the breach occurred in 2022 affecting data sets dated back until 2019. The incident was reported to the French DPA (CNIL) in November 2022 but individual notifications were sent out only in early 2023. The contract had specific requirements for maintenance of adequate security measures and data deletion. The controller admitted that a data breach occurred but claimed it was caused by actions outside their control and post termination of the contract and that they relied on the announcement made by the processor that all their data would be deleted. They also argued that former employees of the processor mishandled the data after the service contract was terminated. The data subject argued that the breach led to significant distress. She noticed an increase in phishing and spam emails targeting her and reported that the breach caused anxiety, sleep disturbances, and a lot of time spent securing her online accounts and changing passwords. The data subject also raised concerns that the controller failed to provide timely information about the breach. The company advised users to change their passwords as a precaution but did not give the data subject the full information she had a right to under GDPR, particularly regarding what specific data was affected and who accessed it. The court held that the controller failed to properly monitor its data processor's compliance with data protection obligations according to Article 28 GDPR, especially concerning the deletion of personal data. The controller did not request confirmation of the actual deletion of data within the required 21-day period after contract termination. This failure led to potential data security risks and ultimately contributed to a hacking incident. The data processor only sent a vague announcement of deletion, not a formal, detailed confirmation. The controller should have obtained written confirmation of data deletion and could have followed up with further checks, such as an on-site inspection, but did not do so. The court held that Under Article 82(1) GDPR, compensation is available for both material and immaterial damage, and while the data subject did not present material damage, she successfully claimed immaterial damage due to the loss of control over her personal data. In line with previous rulings - especially the BGH's lead decision in the Facebook scraping case the court found that the mere loss of control over the data constitutes an immaterial damage. The court assessed this immaterial damage to be compensated by €100 concluding that this amount was reasonable and sufficient and rejecting higher compensation based on psychological harm, as the data subject did not provide sufficient evidence of psychological impairments, such as anxiety or sleep disorders, beyond the loss of control. General concerns about spam or phishing were considered part of this loss of control, and the court noted that the data subject failed to substantiate her claims with medical evidence, ultimately limiting compensation to €100. The court also determined that the controller must compensate any future material damages. This is based on the fact that the data subject’s right to control their personal data has been violated and is still at risk of further misuse, meaning the potential for future harm is real and not just hypothetical. The court also clarified that this includes future non-material damages, which may not be foreseeable at this point but are part of the ongoing harm caused by the breach.
MK
The data subject is employed by the controller, a company governed by German law. In 2017, the group of companies to which the controller belongs introduced a cloud-based new software as a personnel information management system. In that context, the controller transferred personal data of its employees from the to-be-replaced software to a server of the group’s parent company in the USA. The controller and its works council had concluded an agreement confirming acquiescence to the introduction of the new software, which limited the transfer of data to certain categories. In that context, the data subject brought applications before the Labour Court (Arbeitsgericht Ulm - AG Ulm) and then before the Higher Labour Court (Landesarbeitsgericht - LAG Baden-Württemberg) for access to certain information, erasure of data concerning him, and compensation. Not fully satisfied in the course of these procedure, the data subject brought an appeal before the Federal Labour Court (Bundesarbeitsgericht - BAG), claiming that the transfer of his personal data to the parent company’s server was neither necessary for the purposes of the employment relationship (as the controller still used the to-be-replaced software) nor for the purpose of testing the new software, since the use of dummy data would have been sufficient. Additionally, the data subject claimed that, even if the works agreement confirming acquiescence could constitute a valid basis for that processing, the authorisation contained therein was exceeded, since the controller transmitted data other than those provided for. The Federal Labour Court stayed the proceedings and referred the following questions to the CJEU: # Is a national legal provision that has been adopted pursuant to Article 88(1) GDPR – such as [https://www.gesetze-im-internet.de/bdsg_2018/__26.html Paragraph 26(4) of the German Federal Data Protection Act] (Bundesdatenschutzgesetz - BDSG) – and which provides that the processing of personal data, includin
Court case W2522299666-1/6E
A public-law body (the data controller) sent a letter to an individual (the data subject) inviting them to receive a Covid-19 vaccination. On 14 December 2021, the data subject submitted a complaint with the Datenschutzbehörde (hereinafter DSB/data protection authority), alleging that the controller had violated their right to confidentiality of personal data under §1(2) DSG since they could not establish how the controller obtained information about their vaccination. Following a series of proceedings conducted against the wrong responsible party, the data subject identified the correct controller through a letter dated 01 August 2024. In particular, the data subject requested: (i) a finding of a violation of their fundamental rights; (ii) a prohibition of further data processing under §22(4) DSG; and (iii) the imposition of a fine. Decision of the Data Protection Authority (DSB) By means of a decision rendered on 03 September 2024, the DSB upheld the complaint in part. Firstly, it held that the controller had unlawfully accessed and processed the data subject’s records from the central vaccination register and central patient index. In the absence of a legal basis in accordance with §1 para. 2 DSG, the DSB maintained that the data subject’s right to confidentiality was infringed upon. Secondly, the DSB dismissed the request for prohibition of processing given that the processing had already been completed and therefore fell short of the standard stipulated under §22 para 4 DSG. Thirdly, it rejected the request for a fine for two-fold reasons: the data subject held no subject right to demand one, and fines cannot be imposed on bodies of public law under §30(5) DSG. The data subject subsequently appealed the decision to the Federal Administrative Court on grounds that they found it “outrageous” that their vaccination data had been shared. Despite a court order issued on 02 October 2024 to clarify their grounds of appeal, the data subject did not submit further statements. On standing to appeal The Federal Administrative Court held that a complainant lacks the necessary legal standing to appeal a DPA decision where the DPA has already fully ruled in their favour on the core issue. Since the DSB upheld the data subject’s complaint and found a violation of their right to confidentiality under §1(2) DSG, the data subject did not suffer legal grievances from that part of the decision and had no grounds to challenge it. On the prohibition of data processing The Court furthermore held that §22(4) DSG is a discretionary provision which requires a finding of imminent danger—namely, a significant and immediate threat to the data subject’s protected confidentiality interests—before a prohibition of processing may be ordered. This condition was not met because the processing had been brought to an end. Moreover, the Court maintained that §22(4) DSG does not confer a subjective legal entitlement on the data subject to demand such a measure. On the imposition of a fine As its last point, the Court held that fines cannot be imposed within the framework of administrative proceedings, and that no subjective right to demand the initiation of fine proceedings can be derived from Article 77(1) GDPR or §24(1) and (5) DSG. Additionally, the Court held that fines cannot be imposed on bodies of public law in accordance with §30 para. 5 DSG. In light of these reasons, the Court concluded that the data subject’s subjective rights were not violated. Overall conclusion Since the DSB’s decision had granted the data subject their rights in all the areas where they held a subjective right, and only dismissed or rejected their requests in realms where no such right existed, the prerequisites for a valid appeal were unfulfilled. The complaint was thus dismissed as inadmissible in its entirety. The Court further held that no appeal on points of law was admissible pursuant to Art. 133 para. 4 B-VG, as the decision rested on long-established and consistent case law of the Austrian Administrative Court and raised no legal question(s) of fundamental importance.
Facebook/Meta
The data subject is a user of Facebook (the controller). In April 2021, data of approx. 533 million Facebook users were made public on the internet. An unknown third party had used the possibility of finding user accounts through the users’ phone numbers for scraping Facebook by trying out randomly generated phone numbers. Through this method, they were able to obtain user profiles with matching phone numbers. The data subject in this case was also among the people affected by this scraping incident; his user ID, first and last name, workplace, and gender were included in the data set and were therefore linked to his phone number. Notably, while the data subject had set his phone number to be visible only to himself, he had left the searchability setting at the default "Everyone," allowing others to find his profile via his phone number. The data subject claimed that the controller did not take appropriate measures to avoid the exploitation of the contact tool that allowed users to be found through their phone numbers. He sued the controller for damages and sought a declaratory judgment to acknowledge his future right to compensation. This declaratory judgment concerning damages is standard in German law due to statutory limitations that would otherwise prevent a person from bringing claims after a period of three years (such as for long-term consequences of a car accident). After the data subject was granted €250 in non-material damages by the Regional Court of Bonn (Landgericht Bonn – LG Bonn), the controller appealed to the Higher Regional Court of Cologne (Oberlandesgericht Köln – OLG Köln), which then overrode LG Bonn’s decision and fully dismissed the action. The data subject, in return, appealed the case to the German Federal Court of Justice (Bundesgerichtshof – BGH). In its first decision under the [https://www.gesetze-im-internet.de/zpo/__552b.html new leading decision procedure], the Federal Court of Justice (Bundesgerichtshof, BGH) partially overruled
Landesbeauftragte für Datenschutz und Informationsfreiheit
In 2016, the data subject had been investigated and convicted due to tax evasion by a German Regional Court. The data subject alleged that the investigative file concerning him had been leaked to third parties including a journalist who used the contents of the file for their reporting. First, the data subject lodged a complaint with the DPA of the federal state of North Rhine-Westphalia (Landesbauftragte für Datenschutz und Informationsfreiheit des Landes Nordrhein-Westfalen – LDI NRW) in 2017 which was rejected on the ground that the the disclosure of court files forms part of the administration of justice and that the DPA lacks competence on this matter. In response to this, the data subject brought a case against the DPA to the Administrative Court Düsseldorf (Verwaltungsgericht Düsseldorf – VG Düsseldorf) in 2019. The claim was rejected as the complained of breach and the following proceedings had been concluded prior to the entry into force of the GDPR in 2018 (see 29 K 7031/19). However, the DPA treated the case taken by the data subject in 2019 as a complaint and began investigating the alleged data breach. The DPA requested information on the potential data breach from the Regional Court as well as all involved public prosecution offices. It did not request information from the tax investigation department as it considered this entity not to fall within its competence. On the 1 June 2022, the DPA issued a decision stating that it had found no violation of the data subject's rights. On the 4 July 2022, the data subject brought a case to the Administrative Court Düsseldorf (VG Düsseldorf) contesting the decision of the DPA dated 1 June 2022. The data subject alleged that the DPA did not diligently investigate the circumstances which in his eyes proves an active failure to act within its margin of discretion. He detailed that a violation should not be left unpunished just because it cannot be concretely identified. In addition, the data subject claimed that he has a right to demand from the DPA to use its power under the GDPR in order to eliminate the rights violation. In his eyes, the abatement of action by the DPA violated Article 77 GDPR and Article 78 GDPR. Moreover, he demanded the court to commit the DPA to prohibiting the Regional Court and the public prosecutor's office from sharing personal data with the press or alternatively to annul the decision by the DPA dated 1 June 2022. The DPA submitted that as long as the courts are exercising their judicial functions, the DPA is stripped of its monitoring function. Where the DPA identified processing which fell within its competence, it investigated these. For the DPA, the central question was which department or person leaked the personal data to the press. The DPA requested information from the concerned departments but due to a lack of competence, the tax investigation department was not questioned. In the oral hearing, the data subject stated that he did not expect the DPA to take action against the tax investigation department. The court held, that the data subject’s claim is unfounded and that the decision dated 1 June 2022 by the DPA does not violate the data subject’s rights. Further, the data subject has no right to the requested prohibition of sharing personal data with the press executed by the DPA, as the Regional Court and public prosecutor are themselves responsible for the assessment on the lawfulness of the data processing. As state bodies, the Regional Court and the public prosecutor themselves decide on adequate purposes and means of the data processing. The court acknowledged, that objectively the data processing may have been unlawful as the data subject had not given consent and that the disclosure to the press was not necessary for the exercise of judicial functions. Regardless, the court declared that the data subject has no right to the issuance of regulatory measures by the DPA, as the controller remains unidentified. The questioned entities all responded to the requests of the DPA stating that no personal data had been disclosed to the press. This fact precludes the DPA from taking corrective action under Article 58(2) GDPR. If a controller cannot be identified, the DPA cannot work towards a remedy nor issue corrective measures or sanctions. The court declared, that Article 57 GDPR does not define the scope of investigation necessary for determining the controller. The court held that the DPA had appropriately exhausted its margin of discretion and that further questioning of the relevant institutions did not amount to a failure of appropriate assessment. The court declared, that there was no evidence indicating that the questioned persons violated the requirement to cooperate with the DPA under Article 31 GDPR nor that they unlawfully withheld information in violation of Article 58(1)(e) GDPR. The court highlighted that if the public prosecutors, who by their nature investigate suspects, could not determine a possible suspect for the alleged leak to the press it is justifiable for the DPA not to continue this investigation. In addition, the court found that there was no evidence suggesting that another institution subject to the competence of the DPA could have been responsible for the data breach. The court accepted that an on-site inspection of the concerning institutions and questioning of the involved employees was theoretically possible but would go far beyond the capacities of the DPA. Combined with the lapse of time, the low likelihood of determining the controller and the fact that only one data subject was affected by the breach rendered any further action unreasonable as it would impair the ability of the DPA to effectively deal with other complaints. The court also rejected the data subject’s claim for a new decision as it concluded that the DPA had investigated the data subject’s claim according to the significance of the violation to the data subject as well as the gravity of the violation.