GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
52 results · Showing 41–52
Court case W214 2225733-1
The data subject filed in a complaint at the Austrian DPA, in which he claimed that such processing could be misleading users and distorting competition, because only the one who would pay, would be in a better position and it also would not be indicated that the position is upon payment. There was no option for comments and ratings from users or any other way to get a possible better position on a List, than buying one - paying the additional fee. A new database and with it connected processing was also not necessary, since there already was a database made by the federal ministry. Also, the commercial interests of the data processor did not override the fundamental rights of the data subject and the data subject also could not expect that his data will be processed like that. The data subject did not give his consent to this kind of data processing and demanded that the data processing stops. Furthermore, he claimed that the services of the data processor did not have any additional value or advantage – so that his potential customers could reach him better or have any informative advantage in comparison with the database of the federal Ministry where the data was primarily stored. There were also no legitimate interests of the data processor, which would allow the processing on the ground of Article 6(1)(f) GDPR or any other legitimate reason for the processing of personal data. The data subject also claimed a violation of Article 14 GDPR, since the information about the processing came after the processing has already started and was also poor in content. The data processor has upon notice complemented the privacy statement. The data controller claimed that his undertaking did not pursue solely commercial interests, but was also in the interest of the general public since it was a specialized search machine and made it possible to search for a therapist. This fact would give the undertaking of the data processor an additional value, which would override the int
Scalable Capital
Controller is Scalable Capital, a financial services company via which customers can invest in shares etc. Data subject is a customer of this company. Upon registration, they provided numerous personal data to the controller inter alia a photo of their ID-card. On 19.10.2020, the controller informed the data subject of a data breach. Unauthorised third parties had acquired access to the following personal data of data subject: first- and last name, title, address, e-mail address, mobile phone number, place of birth, place and country of birth, nationality, marital status, tax residence and tax ID, IBAN, copy of identity card, portrait photo, which was taken in the Post-Ident procedure. Moreover, this data was accessed by these third parties on three separate instances in the period from April to October 2020. In total, these third parties had copied and stolen 389,000 records of 33,200 affected persons. The attackers were able to access the whole IT system of controller because they had acquired the access information via controller’s former IT Service provider, CodeShip Inc. Although this service provider no longer provided IT services to controller since late 2015, the access data to controller’s system had never been changed. The stolen personal information was used to obtain loans, and was offered for sale on the Darknet. Because data subject feared for identity theft and other fraud, they brought the action before Court and claimed compensation pursuant to Article 82(1) GDPR, because controller violated Article 32(1) GDPR. The Court upheld the appeal and ordered the controller to pay € 2,500, - as non-material damages to the data subject. First, the Court considered that the controller violated Article 32(1) and Article 5(1)(f) GDPR because it failed to implement sufficient organisational measures to ensure an appropriate level of data protection. In this regard, the Court considered Article 82(4) GDPR and noted that it is irrelevant whether the security d
Court case 6 O 190/21
The data subject and his wife applied to the controller for real estate financing. For this purpose, they provided the controller with documents in various ways, including by e-mail and via a file transfer link. Also, they were given (an unencrypted) USB stick which they dropped into the controller's letterbox. This USB stick contained copies of identity documents, tax documents, data on existing properties, the advised property as well as other documents which were supposed to prove the financial capacity of the data subject and his wife. In the end, no contract was concluded. The controller returned the USB stick to the couple per letter. However, the USB stick never arrived. Hence, the data subject's wife contacted the controller because of the alleged loss of the USB stick. The controller initiated a "lost and found order", but this was unsuccessful. The data subject asserted non-material claims for damages against the controller in connection with the alleged loss of a USB stick containing his, and his wife's personal data. Hence, he requested the controller to pay damages in the amount of €25,000 on the basis of Article 82 GDPR. The controller refused payment. Subsequently, a claim for payment of €30,000 was brought before the court. The Court dismissed the action as unfounded and held that the data subject is not entitled to the asserted non-material claim for damages against the controller, although it was undisputed that the controller had not notified the DPA about the loss of the USB stick. The Court held that the data subject did not sufficiently substantiate that he and his wife suffered concrete non-material damage. The Court found that the defendant violated Article 34(2) GDPR, because he only informed the data subject of the alleged data loss. However, the information obligations of Article 34 GDPR provide, beyond the mere information about the data loss itself, that the information and measures mentioned in Article 33(1)(b) to Article 33(1)(d) GDP
BV QARIN ROTTERDAM, MOBILITY CENTRAL, VLAAMSE GEMEENTSCHAP
The Flemish Authorities granted a tender to an EU based-entity of a US company using the AWS cloud services. A Dutch company which was not chosen by the Flemish Authorities in the tender process challenged this decision before the Council of State on the basis of the: * violation of the provisions of the GDPR on transfers, since no adequate protection of the data could be afforded in the US. The Dutch company relied in particular on an [https://overheid.vlaanderen.be/sites/default/files/media/VTC/VTC_A_2020_05_advies.pdf opinion] from the Flemish Supervisory Commission ('Vlaamse Toezichtcommissie voor de verwerking van persoonsgegevens) according to which the use of AWS could not be compliant with the Schrems II ruling and the GDPR; * breach of Article 28 GDPR (the choice of a the processor does not provide sufficient guarantees); * breach of Article 32 GDPR (lack of appropriate technical and organisational measures) * lack of motivation of the decision to grant the tender The Council of State held that: * the EDPB and the Flemish Supervisory Commission were not opposed to the use of encryption as such, and such use could be an adequate supplementary measure to the SCCs in some circumstances; * the choice of the processor was not violating Article 28 - the claimant could not demonstrate that the controller and processor did not implement the necessary technical and organisation measures; * the decision was sufficiently motivated.
OLVG
The District Court of The Hague reduced a fine imposed on a private hospital by the Dutch DPA from €460,000 to €350,000 after the hospital improved its technical and organizational measures during the appeal phase. The Court also noted that the Dutch DPA has the power to interpret and give substance to Article 32 GDPR.
APD/GBA (Belgium)
On 1 September 2020, the Belgium DPA imposed a fine of €5,000 on a controller for sending unsolicited emails for electoral message and disclosure of emails (via CC). The controller did not agree with the fine and filed for appeal. Proportionality of the administrative fee The Court of Appeal overruled the DPA's decision for lack of justification as required by Article 83 GDPR, and lack of proportionality. The decision was sent back to the authority who is additionally required to pay back legal cost for €1,400, since the Court could not itself reform, or amend the decision.
Adpublisher AG
By a letter of 18 December 2019, registered at the Court as Case E-11/19, the Board of Appeal for Administrative Matters (BoA) made a request (in the context of appeals against decisions of the DPA of the Principality of Liechtenstein). The BoA requested for an advisory opinion in a case pending before the DPA between Adpublisher AG (a public limited company of Liechtenstein) and "J" for alleged infringement of Articles 5, 6 and 15 GDPR. The DPA upheld J’s complaint concerning the infringement of Articles 5 and 6 GDPR. Further, on its own volition, the DPA determined that there had been an infringement of Articles 7, 15 and 32 GDPR. By a separate letter of 18 December 2019, registered at the Court as Case E-12/19, the BoA made a request for an advisory opinion in a case pending before it between Adpublisher AG and "K" (for alleged infringement of Article 15 GDPR). The DPA upheld K’s complaint in part and determined that there had been an infringement of Article 15 GDPR. Adpublisher challenged both decisions before the BoA and requested that both decisions be set aside. The Court decided, pursuant to Article 39 of the Rules of Procedure, to join the cases for the purpose of the procedure and the final judgment. The questions examined by the court are referring to the general procedure of hearing a complaint under the GDPR and further national appellate proceedings. The first question by the referring body, is whether the proceedings under article 77 and 78(1) GDPR may be carried out without disclosing the identity of a complainant, and whether any grounds must be provided for non disclosing the identity of the complainant. The second question set by the referring body, is whether the free of charge nature of the complaint procedure under article 77 GDPR extends to subsequent proceedings before appellate bodies, or has an impact on the liability of the data subject to be ordered to pay costs. As per the first question examined, the court the Court held that disclosing personal data of a complainant in a procedure initiated by the complainant themselves is necessary in instances where the following would otherwise be inhibited: 1. The ability to carry out obligations under the GDPR, 2. The exercise of the right to effective judicial remedy and due process. Further, the court held that the referring body essentially asks whether the free of charge nature of the complaint procedure under Article 77 GDPR extends to proceedings before appellate bodies or has an impact on the liability of the data subject to be ordered to pay costs. The court held that the data subject cannot be made responsible for costs incurred in relation to proceedings where: 1. They have been made party to these proceedings under Article 78(1) GDPR by virtue of a data controller appealing against a supervisory authority’s decision and, 2. National law imposes this status on a data subject automatically. Consequently, where a data subject becomes a party to proceedings under Article 78(1) GDPR after a data controller appealing against a supervisory authority’s decision, and where national law imposes this status on a data subject automatically, the data subject may not be made responsible for any costs incurred in relation to those proceedings. ----
Court case 29 OWi 1/20
The fined company belongs to a group of companies which together form one of the five largest telecommunications service providers in Germany. Since the entry into force of the GDPR on 25.05.2018 and until 08.05.2019, the party concerned operated call centres for the group of companies. The call centre agents worked with a user interface based on the customer database of the company K. This provided the call centre agent with the information (personal data) necessary for processing customer enquiries. Callers usually reached a first-level support service agent first in the call centre. This agent first had to identify the caller. If the call was made under a telephone number assigned by the company, the respective record of the telephone number was directly displayed to the service agent. If, on the other hand, the call was from a foreign or suppressed telephone number, the customer was identified by the service agent on the basis of his name and date of birth or - alternatively - by stating the customer/contract or order number. The respective service agent was required to authenticate the caller as an authorised person. For this purpose, the date of birth was requested - insofar as this was not already necessary for calling up the correct data record in the context of identification. After authentication, the call centre agents were authorised to provide the caller with information and to accept change requests. For certain topics, the call centre agents of the first-level support forwarded the callers to other employees on the basis of an authorisation concept. For example, only the billing office could enter new bank details. A repeated or stricter authentication was not carried out towards these other employees after the authentication by the first-level support. In case the call centre agent could recognise that someone other than the customer was calling the call centre, the person concerned had not made any comprehensive arrangements. There were only special
Royal Schiphol Group N.V.
The Foundation is an organisation that does health care work on an unnamed continent. Claimant is a professional midwife in an undisclosed country; she followed a three-year training as a midwife with the support of the Foundation. In 2016, Schiphol and the Foundation signed a sponsorship deal, which, among others, allowed the Foundation to place its advertising in the terminals of Schiphol. Foundation shared the ad creatives with Schiphol, who then stored them on its servers and displayed them on the billboards. Picture of the claimant was used for one of those ad creatives and it has been displayed on one of the screens in Schiphol for approximately a year before the claimant informed the Foundation that she didn’t want them to use her portrait for the advertising in Schiphol. Claimant and the Foundation reached a agreement and the Foundation subsequently informed Schiphol that the picture in question could not be used anymore. Schiphol removed the portrait from its billboards. However, some time after this, Schiphol published an article on Platform dedicated to marketing, media and communications for professionals in this area. The article was about the sponsorship agreement between Schiphol and the Foundation and it included the picture of the claimant. On 29th of January the Foundation informed Schiphol that the picture should not have been used. Schiphol immediately requested the Platform to delete the picture and replace it with another picture. The article with the claimant’s picture was seen approximately 73 times and was also shared via Twitter. On 8 May 2019 the claimant’s lawyer wrote to Schiphol requesting a conversation about a compensation from Schiphol to claimant. The parties did not reach an agreement. Schiphol offered claimant a € 1500 compensation twice, claimant rejected the offer. According to the claimant, Schiphol has violated her portrait rights and her right to privacy by publishing her picture and other personal data visible on the pi
Morele.net
In November 2018, the company reported to the supervisory authority two violations related to obtaining by an unauthorised person access to the database, and consequently - to personal data of customers of the company's online shops. After the inspection, the DPA concluded that the company had breached the rules on personal data protection. The deficiencies consisted in the violation by the company of the principle of data confidentiality, consisting in the failure to ensure the security and confidentiality of the processed personal data, which resulted in unauthorised persons gaining access to the personal data of the company's customers, and in the violation of the principle of legality, reliability and accountability by not showing that personal data from instalment applications collected before 25 May 2018 were processed by Morele.net Sp. z o.o. on the basis of the consent of the person to whom the data referred. In September 2019 UODO imposed a fine on the shop Morele.net in the amount of 2,830,410 PLN (660,000 EUR). The company appealed against this decision to the Provincial Administrative Court in Warsaw. Did the technical and organisational measures applied by the company comply with the standards of security measures in the business activity of entrepreneurs in the area of e-commerce of a scale and nature similar to the scale and nature of the company's activity in 2018? Were the technical and organisational measures applied by the company appropriate taking into account the state of technical knowledge, the cost of implementation and the nature, scope, context and objectives of the processing, as well as the risk of infringement of the rights or freedoms of natural persons of different probability and seriousness of the threat? The Provincial Administrative Court in Warsaw dismissed the appeal. The Court agreed with UODO and found that the fine imposed was justified.
Court case II SA/Wa 2826/19
On 18.10.2019 the Polish DPA - UODO imposed a fine of PLN 40,000 on the Mayor of Aleksandrów Kujawski. UODO found that the Mayor violated: 1. Article 5(1)(a) and Article 5(1)(f) in connection with Article 5(2) by making personal data available to certain entities without a legal basis (without agreements on entrusting personal data); 2. Article 5(1)(e) in connection with Article 5(2), i.e. the principle of storage limitation and Article 24 GDPR through the lack of appropriate policies concerning the processing of personal data in the BIP (Biuletyn Informacji Publicznej); 3. Article 5(1)(f) in conjunction with Article 5(2), i.e. the principles of integrity and confidentiality, the principle of accountability, and Article 24 GDPR by failing to carry out a risk analysis of the Mayor's use of the YouTube channel for the transmission of the recordings of the deliberations of City Council; 4. [Article 5 GDPR#1f|Article 5(1)(f)]] in conjunction with Article 5(2), i.e. the principles of integrity and confidentiality, and Article 32 GDPR by failing to implement appropriate technical and organisational measures to safeguard the data of natural persons in connection with the storage of the recordings of the sessions of the City Council exclusively on the YouTube servers, without making and backing up those recordings in the own resources of the City Council; 5. Article 5(2), i.e. the principle of accountability and Article 30(1)(d) and Article 30(1)(f) by not indicating in the register of personal data processing activities, for activities related to the publication of information on the BIP website of the Municipal Council , all recipients of data and not indicating for these processing activities the planned date of data deletion in a manner ensuring data processing in accordance with the principle of limited storage. Apart from imposing a fine, UODO ordered the Mayor to: 1. stop providing personal data without a legal basis, 2. implement policies defining data processing p
NDC MEDIA GROUP E.G
The first complainant is a company that is engaged, inter alia, in the purchase and sale, rental and leasing of real estate. The second plaintiff is the sole shareholder of the first complainant. The defendant is a journalist working for the group NDC MEDIA GROUP E.G, a newspaper publisher. The plaintiffs submitted a civil action before the District Court of the Northern Netherlands against NDC MEDIA GROUP E.G regarding an online press article concerning their company. This article has been published also via the Facebook's page of the journalist who wrote the article. In support of the newspaper publisher, the journalist counterclaimed that the first plaintiff processed his personal data and disclosed them to a third-party, without his consent. Indeed, the first plaintiff disclosed through a Facebook message the data subject municipality’s Personal Record databased (BRP) extract to a third party for the purpose of initiated the proceedings against the publisher. The Court had to pronounce itself mainly on the lawwfulness of disclosure of personal data through social network. The Court went through the balancing test to assess whether the conditions laid down in Article 10(2) of the ECHR for a restriction of the right to freedom of expression have been met. The Court recalled that the right for freedom of expression can only be restricted if this is provided for by law and is necessary in a democratic society. For example, a restriction provided by law exists if the court comes to the opinion that the publications, are unlawful within the meaning of Section 6:162 of the Civil Code - this article is the general basis for claims for damages that arise from torts. The District Court found that there has been a violation of a fundamental right which, by its nature and in view of its seriousness, leads to a claim for damages. Regarding the violation of the GDPR, the Court found that the first plaintiff - the data controller - has an independent obligation to process personal date with an appropriate level of security. In the case at hand, the first plaintiff should not have obtained the personal data of the journalist without his consent and should not have disclose to a third-party for the sole purpose of initiating the proceedings. Thus, the first plaintiff violated Articles 5(1)(f), 6 and 32(2) GDPR. In addition, the Court ruled that the first plaintiff had to give a compensation of € 250.00 for fear and stress. Although the Court declared it was not clear what the negative consequence resulting from the disclosure have consisted of, the concept of damages had to be interpreted broadly.