GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
On 6 June 2018, a complaint was lodged against 3 controllers (LGS Handling Ltd, Louis Travel Ltd, Louis Aviation Ltd) regarding the implementation of an automated system for managing, monitoring and controlling the sick leave absences of their employees using a scoring tool known as the Bradford Factor. The Bradford factor is calculated based on the number of occasions of absence and the total number of days absent in a 52-week period. The Cypriot DPA ("Commissioner") indicated that the date of sick leave and the frequency of taking sick leave, insofar as the data subject’s identity is disclosed constitutes “special categories of personal data” as defined by Article 9(1) GDPR. Employers are entitled to exercise supervision over the frequency of sick leave and/or the validity of sick leave, however, this right must not be exercised within the limit set by the relevant legal framework and should therefore be limited to what is necessary. The Commissioner decided that the rating of statutory sick leave was beyond the competence of the employer and that the legitimate interest assessment was inconclusive. The decision also indicated that the legitimate interest assessment would have been valid if the automated system was simply counting the number of absences due to sick leave without multiplying with other factors such as frequency. The Commissioner therefore concluded that the controller had in fact breached Articles 6(1) and 9(2) GDPR and therefore imposed an administrative fine of €70, 000, €10,000 and €2,000 respectively. The controllers appealed this decision in front of the Cypriot Administrative Court on 25 October 2019. The appeal focused on whether the system they were using was investigated correctly. The administrative court decided that the Commissioner did not have the power nor the authority to impose on controllers whether or not to use a system because its power is limited to investigating whether the processing carried out is lawful. The a
The controller, an Public Employment Service Austria, processed the personal data of the data subject in connection with his file. On 21 February 2019, 15 March 2019 and 25 November 2020, the data subject sent access requests to the controller by fax, each time explicitly insisting on delivery of the response by registered post, addressed personally and refusing delivery by email. With the November 2020 request, he also sent a blank DVD-R by post, asking the controller to copy the data onto it. The controller responded to each request with a printed access response sent by registered letter, the responses were substantially identical and the DVD-R was returned unused. The controller's usual practice is to provide access electronically through an online account. The access responses included the data subject's basic data, insurance and benefit periods and a chronological log of case notes "Informationen/Gesprächsnotizen/Vermerke", which listed attachments where relevant but did not include copies of entire documents. The data subject was aware of the content of the documents listed as attachments, since he himself had submitted them to the controller. None of the three responses referred to a specific case note dated 17 October 2018, recording a phone call between the controller and the data subject's family doctor about his health. The data subject repeatedly and specifically requested this note. The controller only produced it during the proceedings before the Federal Administrative Court, in a submission of 29 June 2023, which the Court forwarded to the data subject in July 2023. The data subject lodged a complaint with the Austrian DPA in February 2020, arguing that the access provided was deficient because copies of documents were missing, unexplained abbreviations were used, the response was not delivered in a common electronic format and it contained incorrect data. The DPA partially upheld the complaint (ordering the controller to explain certain abbreviation
On 9 April 2020, the data subject sent an access request to the controller, the legal representative of the data subject's former landlord. The controller provided the data subject with information about their personal data that was processed and about a rental agreement and communications between the data subject and their landlord, without providing copies of these to the data subject. On 11 May 2020, the data subject lodged a complaint with the Austrian DPA ("Datenschutzbehörde"), arguing that the controller violated their right of access by providing incomplete information. In particular, documents like their rental agreement and email correspondence were missing. On 22 July 2021, the DPA dismissed the complaint, stating that the right of access does not include providing entire documents. On 30 August 2021, the data subject appealed the DPA's decision at the Federal Administrative Court ("Bundesverwaltungsgericht"), claiming the controller did not provide all information about the origin of the data and did not provide copies of certain documents. Copies of documents like land register and company register extracts, as well as various correspondence between the data subject, the controller and the data subject's former landlord were still missing. On 13 July 2023, the controller provided the additional information on the land register and company register extracts. Regarding the origin of the data The court found that the data subject's argument was vague and that the controller explained the sources of the individual data in a transparent way. There is thus no violation of right of access under Article 15(1)(g) GDPR as the origin of all the relevant data was clear. Regarding the land register extract of property and the commercial register extract The court took into account [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=2&Paragraf=24&Anlage=&Uebergangsrecht= Section 24(6) of the Austrian data prote
The North Rhine Westphalia Consumer Protection Association ([https://www.verbraucherzentrale.nrw/ Verbraucherzentrale NRW]) claimed for an injunction against the use of cookie banners on [https://www.wetteronline.de/ wetteronline.de], a wesite operated by WetterOnline Meteorologische Services GmbH, the controller. The controller used a cookie banner to collect users' consent to not necessary cookies without providing a reject option on the first layer. The data subject could only refuse to give consent by clicking on the “Settings” button to reach the second layer, where they then had an “Accept all” button or a “Save” button. The cookie banner also had an “Accept & Close X” button in the top-right corner, on both first and second level. In a judgement dated 4 May 2023, the Regional Court of Cologne (Landgericht Köln, LG Köln) dismissed the action as it considered the claim of the Association to be too broad and claimed that it could not impose a specific cookie banner design on the controller. The Association appealed against this judgement to the Higher Regional Court of Cologne (Oberlandesgericht Köln, OLG Köln) and specified its claim. Firstly, the OLG Köln considered that the controller designed their cookie banner without an equivalent "reject option" either at the first or second layer. The OLG pointed out that the average user does not realise what the “Save” button represents - namely refusal to provide consent for the use of not necessary cookies. Therefore, the OLG decided that consent could not be regarded as freely given and sufficiently informed under Article 4(11) GDPR. Secondly, regarding the “Accept & Close X” button, the OLG considered that the “X” symbol is known to users as a way to close a window, but not to consent to the use of cookies. The average user would not be aware that this constitutes consent, even if the “Accept & Close” is located directly next to the “X” symbol. The OLG also noted that it was not easy for data subjects to recog
The controller (LähiTapiola Keskinäinen Henkivakuutusyhtiö, a life insurance company) had asked the Administrative Court of Helsinki (the Court) to overturn the Finnish DPA's decision, according to which the controller had no legal basis to process the health data of life insurance applicants and it processed the data unnecessarily. The controller filed the appeal claiming that it must be able to process health data, because the health status of the insured party and the risks associated with it are at the centre of the risk assessment related to the granting of the insurance. The controller considered that insurance applicants must also be considered insured parties in accordance with [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L2P6 Section 6(1)(1) of the Finnish Data Protection Act], according to which insurance institutions may, despite the general prohibition in Article 9(1) GDPR, process the health data of the insured party and the claimant, which is necessary to determine the liability of the insurance institution. The controller also stated that the order issued by the DPA, on the basis of which it should assess the time period for which it is necessary to request health data, is vague and unspecified. The controller considered that it must be able to process all health data in order to assess which precise information is ultimately relevant. The Court noted that neither the Finnish Data Protection Act nor its preparatory material have defined what is meant by the insured party in connection with the application of the Act. However, in the Court's view, the preparatory material of the Act does not support as an interpretation that the legislator intended to extend the concept of "insured party" to apply also to the applicant an insurance before the conclusion of an insurance contract. In this respect, the Court also stated that the "insured party" is defined in [https://www.finlex.fi/fi/laki/ajantasa/1994/19940543#L1P2 Section 2(1)(5) of the Finni
The controller (OP-Henkivakuutus Oy, a life insurance company) had asked the Administrative Court of Helsinki (the Court) to overturn the Finnish DPA's decision, according to which the controller had no legal basis to process the health data of life insurance applicants. The controller filed the appeal claiming that it must be able to process the health data because the health status of the insured party and the risks associated with it are at the centre of the risk assessment related to the granting of the insurance. The controller also considered that insurance applicants must also be considered insured parties in accordance with [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L2P6 Section 6(1)(1) of the Finnish Data Protection Act], according to which insurance institutions may, despite the general prohibition in Article 9(1) GDPR, process the health data of the insured party and the claimant, which is necessary to assess the risks of the insurance institution. The Court noted that neither the Finnish Data Protection Act nor its preparatory material have defined what is meant by the insured party in connection with the application of the Act. However, in the Court's view, the preparatory material of the Finnish Data Protection Act does not support as an interpretation that the legislator intended to extend the concept of "insured party" to apply also to the applicant of an insurance before the conclusion of an insurance contract. In this respect, the Court also stated that the "insured party" is defined in [https://www.finlex.fi/fi/laki/ajantasa/1994/19940543#L1P2 Section 2(1)(5) of the Finnish Insurance Contracts Act], according to which the insured refers to the party that is currently subject to personal insurance or non-life insurance policy. Thus, the Court considered that this definition could be used as a starting point for interpretation also when applying [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L2P6 Section 6(1)(1) of the Finnish Da
A data subject served as a witness during a committeee hearing held by the Austrian national parliament. Against his wishes a publication of the minutes of the hearing, which included his full name, were published on the website of the Austrian Parliament. The data subject complained to the DPA and requested an erasure of his data under Article 17 GDPR, stating that he was working as an undercover investigator and that a publication exposing his identity would affect his ability to do his job. The DPA rejected the complaint. It stated that the DPA is a body of the executive. Therefore, it does not have competence to oversee the activities of the committee under national law. This is because it considered the committee (the controller) to be a part of the legislative body. Under the principle of the separation of powersThe system of separation of powers divides the tasks of the state into three branches: legislative, executive and judicial. These tasks are assigned to different institutions in such a way that each of them can check the other. As a result, no one institution can become so powerful in a democracy as to destroy this system. in Austria, the executive cannot oversee the legislature. The data subject appealed this decision. The Federal Administrative Court anulled the DPA's decision. It held that the GDPR applies to acts done by the legislature because the GDPR concerns all data processing, irrespective of who carries it out. Therefore, the DPA was competent to review the decision. Moreover, it held that the legislature cannot rely on the exemption outlined in Article 2(2)(a) GDPR. The DPA appealed this decision. The Supreme Administrative Court referred three questions to the CJEU: 1) Does the GDPR apply to the activities of a Parliamentary committee of a Member State? 2) If question 1 is answered in the positive, do the activities of this committee fall under national security as defined by Recital 16 GDPR, therefore, making Article 2(2)(a) GDPR app
The statute of a company was changed by a natural person who was the majority shareholder. As a consequence of the changes, some personal data of him and the other company's partners were wrongly included. Among such data, there were names, monetary amounts and bank account details. As per national law, the new articles were prepared by the notary of the majority shareholder, and sent to the the registry of the court (Companies Court) and then forwarded by the court to the Office of the Moniteur belge for publication. After the publication, the notary, having realised the mistake, was authorised to request the deletion of the above sensitive data on behalf of the data subject (the majority shareholder) under Article 17 GDPR. The Moniteur Belge refused and the data subject filed a complaint with the Belgian DPA. The Belgian DPA reprimanded the Moniteur Belge and ordered them to comply with the erasure request within 30 days. The Belgian State appealed this decision to the Brussels Court of Appeal seeking an annulment of the DPA's decision. Specifically, they argued that it was uncertain whether the Moniteur Belge was a controller as per Article 4(7) GDPR. The passage had been processed by several 'successive controllers' (the notary who drew up the extract, the registry of the Court and the Moniteur Belge, who published the extract as it stood due to national law requirements). Moreover, since the parties did not claim joint controllership, it was also uncertain whether the Moniteur Belge was solely responsible for compliance with the GDPR. With this in mind, the court referred two questions to the CJEU: 1) Does Article 4(7) GDPR mean that a Member State's official journal, responsible for publishing official documents under national law (such as the one in the case), has the status of a data controller? 2) If so, does Article 5(2) GDPR mean that only that journal in question need to comply with the data controller's responsibilities? Or are the responsibilities i
A real estate development company, the controller, contacted an owner of real estate, the data subject, asking her whether she would be interested in selling her property. The data subject claimed to have requested deletion of her personal data under Article 17 GDPR but kept receiving messages from the controller thereafter. Thus, on 26 April 2020, the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde, DSB). In its submissions, the controller argued that it obtains data about real estate properties on sale by requesting access to the land registry of property addresses and it processes personal data according to Article 6(1)(f) GDPR. Further, the controller stated that it nonetheless complied with the deletion request as it pseudonymised the data of the data subject and added a note next to the address of her property that it should no longer be consulted in the land registry. The DSB held that the controller did violate the data subject’s right to deletion as it failed to fully erase her personal data. First, according to the DSB, the interests of the data subject outweighed those of the controller and that it was still possible to identify the data subject using the address of her property. The controller decided to appeal the DSB’s decision on 14 May 2021 to the Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG), claiming that the DSB failed to properly assess the case. The controller submitted that it deleted the data of the data subject when she requested it and then her data mistakenly reappeared in her database, which is why she was contacted again by the controller. However, the controller remedied this by pseudonymising her data. Hence, the DSB should have differentiated between the two processing activities: the data subject only requested deletion of her data with respect to the first set of processing activities. As regards the second set of processing activities, the data subject never asked for erasure.
A judicial officer (data subject) of an Austrian prison was injured by a prisoner in 2021, following which he reported the offence and started legal proceedings against the prisoner. During the criminal investigations, the judge granted access to the files to the accused, which included personal data of the data subject, among others information about her injury, annual salary, marital status and contact details. These data had been provided to the judge by the employer of the data subject, the Federal Ministry of Justice, who joined the proceedings as a co-participating private party and was represented in this by a state attorney. According to the data subject the controller should not have disclosed such information about her and this constituted a violation of her right to privacy, hence she filed a complaint with the Austrian DPA ('DSB'). The state attorney, hereinafter the controller, submitted that the employer had suffered a financial damage as a consequence of the sick leave of the data subject and had to provide documents about her health status to prove the damage in accordance with Austrian Criminal Procedural law. The controller believed this to be compliant with Article 9 GDPR. The data subject instead claimed that the documents should have been redacted. On 11 November 2022, the DSB dismissed the complaint stating that its competence is limited to verifying whether the documents provided by the controller were appropriate to serve as evidence for the investigation, which it confirmed. The DSB claimed that it cannot rule on the content of the documents adduced by a representative of a public authority during a court procedure. The data subject appealed the decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG) claiming that the controller provided more unredacted documents to the court than strictly necessary, thereby violating Article 5(1)(c) GDPR. The BVwG first of all considered that the DSB erred in assumi
A data subject received a certificate confirming his vaccination against COVID-19 from the Budapest Office (‘controller’). On 30 April 2021, the data subject lodged a complaint with the Hungarian DPA, claiming that (i) the Budapest Office did not create or publish a privacy notice on the issuance of these certificates and (ii) there was insufficient information regarding the purpose and legal basis of the processing, and the rights of the data subject, as well as how those rights should be exercised. The controller explained that the issuance of these certificates relied on a national Hungarian Law, Decree 60/2021. Therefore, the legal basis for the processing was Article 6(1)(e) GDPR and the processing of special categories of data under Article 9(2)(i) GDPR. In accordance with Decree 60/2021, the controller obtained the personal data by an automated transmission from the Electronic Healthcare Service Space operator and from the body responsible for recording the personal data and addresses. Therefore, the controller also argued that pursuant to Article 14(5)(c) GDPR, it was not required to provide information on the processing. The controller nonetheless created a privacy notice and published it on its website. On 15 November 2021, the Hungarian DPA dismissed the complaint considering that the controller did not have an obligation to provide information since the derogation laid down in Article 14(5)(c) GDPR was applicable to the processing. The DPA found that the fact that the controller published the information on the processing on its website even though it had no legal obligation to do so was deemed to be a good practice. The data subject challenged the decision of the Hungarian DPA before the Budapest High Court which annulled the DPA decision and ordered it to conduct a new procedure. The Budapest High Court claimed that Article 14(5)(c) was not applicable as some of the data related to the certificates were not collected by another body but were rather ge
The controller, the Public Employment Service in Austria, supports workers in (re)integrating into the labour market by offering various services, including a counsellor that discusses labour market opportunities with the jobseeker. In order to assess the jobseeker’s labour opportunities on the market, the controller used an algorithm to calculate the degree of probability for jobseekers to be employed for a certain number of days, based on: (1) age group, (2) gender, (3) country group, (4) education, (5) health impairment, (6) care responsibilities, (7) occupational group, (8) career history and (9) the regional labour market situation and the duration of cases at the controller. The algorithm did not include motivation, self-help potential of the jobseeker, addiction, debt or housing situation. Based on this, the algorithm divided jobseekers into the following three groups: (1) Service jobseekers with high labour market opportunities, (2) Care jobseekers with low labour market opportunities, (3) Consultancy jobseekers with medium labour market opportunities. The result was used as a starting point for counsellors to work with jobseekers to assess their potential and any obstacles in the labour market integration. The algorithm itself was not used for job placement, but only for targeted support and assistance, meaning, choosing the right support strategy based on which group the jobseeker was assigned to. The controller claimed it had a legal basis under Austrian national law (the Arbeitsmarktservicegezetz, AMSG) to process data with the help of an algorithm. Under Article 4(4) GDPR, this processing of data is considered profiling. According to Austrian data protection law (see [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563 Article 1 §2 DSG]), processing for the performance of a public task needs to be authorised in Asutrian law. However, the DPA found that a legal basis for this processing could not be found in the AMSG. The
The Public Employment Service (AMS) is a service provider under public law with its own legal personality, which is responsible for implementing the labour market policy of the federal government. In order to support workers in their (re-)integration into the labour market, it offers various services which are implemented by its counsellors. In order to support counsellors in assessing the labour market opportunities of jobseekers, the AMS has developed a concept for calculating the labour market opportunities of jobseekers (AMAS). In concrete terms, AMAS uses an algorithm to automatically calculate the probability of currently registered customers being employed for a certain number of days within a certain period in the future. For this purpose, a so-called IC is calculated from the following data: age group, sex, Group of States, Education, Health impairment, Caring duties, professional group, pre-career, Regional labour market performance, Duration of the business case at the AMS. Based on the calculated IC, a classification is made into the following groups: Service clients with high labour market opportunities, care clients with low labour market opportunities, Counselling clients with medium labour market opportunities. The results of the AMAS ought to be used in the guidance process and be a starting point for the counsellors to determine, together with the client, the optimal support strategy (subsidies and support services). The final decision on the assignment to a client group is always made by the counsellors. Originally, the Data Protection Authority (DSB) initiated an ex officio investigation into the matter and concluded that, the AMS was prohibited from processing data with the help of the AMAS with effect from 1 January 2021, unless there is a suitable legal basis for the data processing. In the contested decision, the Austrian Federal Administrative Court held that the Public Employment Service could lawfully process personal data belonging to jo
The Medical Service of Health Insurance (the controller) is Germany's public health insurance medical review service. It provides expert reports when people say they are unable to work, as well as for its own staff. Before becoming unable to work, the data subject worked for the controller. The insurance company that was paying their benefits requested an expert opinion from the controller. The controller obtained health information from the data subject's doctor in the form of a medical report, which was then distributed to the data subject's coworkers. The data subject believed that their medical data had been unlawfully processed and sought €20,000 in damages from the controller, who rejected the claims. According to the data subject, the evaluation should have been performed by another organisation in order to prevent coworkers from accessing their medical data. Furthermore, they considered the security procedures around their medical report's archiving to be inadequate. After being rejected at first and second (Landesarbeitsgericht Düsseldorf) instance, the the data subject appealed to the Federal Labour Court, who referred the case to the CJEU with the following questions: On the topic of health data 1) Does Article 9(2)(h) GDPR prohibit a medical service of a health insurance fund from processing its employee’s health data when it is a prerequisite for the assessment of that employee’s working capacity? 2) If the Court answers Question 1 in the negative (with the consequence that an exception to the prohibition on the processing of data concerning health laid down in Article 9(1) GDPR is possible under Article 9(2)(h) GDPR) in a case such as the present one, are there further data protection requirements, beyond the conditions set out in Article 9(3) GDPR, that must be complied with, and, if so, which ones? 3) If the Court answers Question 1 in the negative, does the permissibility or lawfulness of the processing of data concerning health depend on the fulf
The data subject had a Facebook account since 2008. On 16 May 2018, nude images were uploaded to data subject’s account. The controller (“Facebook”) temporarily blocked the data subject’s account. The account was unblocked the same day. On 28 November 2021, the data subject posted a video of an artist on his Facebook profile. The controller deleted the video and after review, reactivated the account. On 23 December 2021, images or videos of child sexual abuse were published by third parties via the data subject’s account. The controller blocked the data subject’s account again. The data subject tried to persuade the controller to reopen their account, but failed. On 17 January 2023, the data subject contacted the controller with a letter from a lawyer, requesting the controller to restore their account and asserted claims for, amongst others, information and correcting their data. A few days later, the data subject regained access to their account. The data subject then went to the Regional Court (“LG Stuttgart”) to request correction of all the data subject’s data by deleting all deletion and blocking notices under Article 16 GDPR and Article 17 GDPR. The data subject argued that the controller no longer needed the user data relating to the deletion and blocking processes. The controller argued that the question of the lawfulness of the reasons behind the blocking notices was only a value judgement that is not subject to rectification and that the blocking notices were still needed for quality assurance and legal defence. The Regional Court dismissed the case. There was no claim for deletion, because according to the Court, incorrect data would not be stored by the controller. It only stored documentation on what had occurred, such as when the data subject was blocked on the controller’s platform. According to the findings of the Regional Court, a reset of the offences counter was also ruled out, as all offences expired after one year and were therefore no long
In May 2018, a data subject, respresented by noyb - European Centre for Digital Rights, filed a complaint with the Austrian DPA. The latter referred the case to the Irish DPC as lead supervisory authority under Article 56 GDPR and a cooperation procedure under Article 60 GDPR was initiated. On 11 January 2023, the DSB transmitted to the data subject the final decision by the DPC in accordance with Article 60(7) GDPR and informed her that the EDPB’s binding decision under Article 65(1)(a) GDPR would be published thereafter. Two days later, on 13 January 2023, the DSB transmitted the binding decision of the EDPB of 5 December 2022 to the data subject. The DSB informed the data subject that the parts of the original complaint that were not addressed by the DPC's decision are still pending before the DPC. On 7 February 2023, the data subject filed an appeal with the BVwG, claiming that the transmission of the DPC’s decision by the DSB should be considered a partially dismissing or rejection decision within the meaning of Article 60(9) GDPR. Since the DPC and the EDPB failed to address some of the points raised in the complaint, the communications of the DSB, together with the decision of the DPC could not be interpreted as a positive decision in accordance with Article 60(7). In the complainant's view, the communication by the DSB therefore constitutes an official decisions within the meaning of [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10005768&FassungVom=2019-05-09&Artikel=&Paragraf=58&Anlage=&Uebergangsrecht= section 58 et seqq. of the Austrian General Law on Administrative Procedures (Allgemeines Verwaltungsverfahrensgesetz, AVG)]. In its submissions, the DSB argued that Article 60(7) GDPR applied in this case and the DPC would still be handling the case. The BVwG first of all assessed whether the pronouncement of the DSB constituted a decision within the meaning of [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Ge
The data subject received unemployment benefits from a regional office (the controller) of the Austrian Public Employment Service (AMS). From 18 November 2016 until at least 19 January 2019, the regional office processed the data subject's personal data in connection with benefit eligibility checks. The processing included scheduling control appointments and ordering medical examinations to assess the data subject’s ability to work. The processed data included identification data and health data, such as references to heart problems and doubts about work capacity. The controller also transferred health-related information to a pension institution. The data subject argued that the controller processed her data during periods in which no active supervisory or benefit relationship existed, including periods of illness and periods in which benefits had been suspended. She also argued that the controller accessed social security data without a legal basis during those periods. On 25 July 2019, the data subject filed a complaint with the DPA against the controller. The DPA forwarded the complaint to the federal organisation of the AMS, not the controller (the regional office responsible for the data subject). The DPA later rejected the complaint, as it held that AMS Austria was the controller as the regional offices lacked separate legal personality. It also held that the processing was lawful because the AMS had statutory duties to verify eligibility for unemployment benefits. The data subject appealed the DPA decision before the Federal Administrative Court. First, the court held that the GDPR applied because while the alleged infringement started before the GDPR became applicable on 25 May 2018, it continued on after. Second, the court held that the DPA had incorrectly assessed AMS Austria as the controller. The court noted that Article 4(7) GDPR expressly recognises a “public authority” as a controller. It also referred to Article 6(1)(e) GDPR, which covers processi
A Pakistani national residing in Germany (the data subject) is suspected of having killed a person together with his brother and other persons in Pakistan, where he is wanted by warrant. This created an alert on the Schengen Information System (SIS) stating that he should be denied entry into the Schengen zone. The data subject upon travelling to Italy was arrested at the border to be extradited to Pakistan. Pakistan however, failed to submit an extradition document despite Italy's requests. Therefore, the arrest was revoked by the Italian Court of Appeal in Brescia. Based on this, the data subject argued that he was now innocent and requested the deletion of the alert on the SIS system under Article 17(1)(d) GDPR.This is because Article 53(1) Regulation (EU) 2018/1861 which governs the operation of the SIS system refers to the GDPR and allows data subjects to invoke their rights under it, even if they are not for example an EU national. The reason for the data subject invoking the GDPR is that Article 53(1) Regulation (EU) 2018/1861 which governs the operation of the SIS system, refers to the GDPR and allows data subjects to invoke their rights under it when their data is processed by the system. The Federal Police Headquarters of Germany rejected the request for deletion multiple times. The alert was lawful and according to national law, data of foreigners who are the subject of an alert for refusal of entry can be stored on the basis of public safety. The voiding of the arrest warrent in Italy could not be held to override this public safety. The extradition had failed for formal reasons rather than because the data subject was innocent. The arrest warrant issued by Interpol Pakistan had not been withdrawn and therefore, there was still a valid reason to hold the alert in the SIS system. The data subject appealed the decision to the German Court in Potsdam arguing, among other reasons, that his rights had been infringed and that the data should be deleted
With its first question, the referring court asked whether the fact that a GDPR violation effectively occurred automatically entails that the controller did not comply with its obligations to implement appropriate measures under Articles 24 and 32 GDPR. According to the Advocate General, appropriate measures shall be in line with the state of the art. However, this cannot guarantee that in exceptional situations they will always be effective. In addition, Article 32(1) GDPR specifically mentions that the controller may take into account the “cost of implementations” that a certain security measure entails. With its second question, the Supreme Administrative Court tried to ascertain what kind of test should a judicial authority perform when assessing the suitability of the measures adopted by the controller. The Advocate General stressed that judicial scrutiny cannot be limited to the existence of measures in place. The third question concerned how to allocate the burden of proof concerning the suitability of the security measures. In the Advocate General’s Opinion, it is the controller who has to bear such a burden. The data subject, in the context of an action pursuant to Article 82 GDPR, shall prove a GDPR infringement, the existence of a damage and a causal link between the former elements. However, a burden of proof on the data subject concerning the suitability of the measures would make the fulfillment of the action almost impossible in practice. With the fourth question, the referring court asked whether the fact that the data breach occurred because of third parties’ actions entails that the controller was no longer liable under Article 82(3) GDPR. The Advocate General categorically excluded this interpretation, highlighting that a controller ceases to be liable only when it shows the lack of fault on his side. The fifth question concerned the notion of non-material damage. In particular, the court wondered whether the data subject’s concern that their data
The data subject had asked the Administrative Court of Hämeenlinna (the Court) to overturn [https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_9970/163/2019 the Finnish DPA's decision], according to which the media outlets owned by Sanoma Media Finland Oy (the controller) were not obliged to erase personal tax information because it was processed for journalistic purposes. The data subject filed the appeal claiming that the controller had processed their personal data unlawfully, and claimed that, unlike individual news that utilises public tax information, the tax information portals published by the controller do not contribute to the emergence of an important social debate. The data subject considered that the tax information portals contained information covered by the protection of people's privacy, which enabled the precise identification of individuals, and which had caused harm to the data subject and their family. The data subject also stated that if the Court considered that the tax information had been processed solely for journalistic purposes, the processing of personal data in the tax information portals had in any case violated Article 5(1)(a) GDPR and Article 32 GDPR, because the large-scale and permanent publication of personal data of a large number of people did not meet the requirements set for the security of processing. The controller emphasised that the tax information portals enable public debate on socially significant topics related to taxation, such as income disparity. The publication of tax information promotes opportunities to make observations related to society, especially when the information is available to everyone free of charge. The DPA pointed out that the question is not whether tax information can be published, but whether [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L5P27 Section 27(1) of the Finnish Data Protection Act] applies, according to which certain provisions of the GDPR do not appl