GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
A data subject was refused a loan after Schufa (the controller) had provided the data subject’s bank with a negative credit score. Schufa is a credit agency which provides third parties with information relating to individuals’ creditworthiness. The data subject requested Schufa to provide them with information relating to the data stored and to erase incorrect entries relating to them. As well as, to provide them with a detailed account of the logic involved in the determination of their credit score, and the significance and consequences of the processing of their data. Schufa responded by only providing the applicant with their credit score and a vague outline of its credit-score calculation process, noting that they were unable to disclose a detailed account of the calculation process as this would violate commercial secrecy. Moreover, Schufa noted that it only provided third parties with information which they used to reach decisions, while Schufa itself was not the party to determine the decisions. Following this, on 18 October 2018, the data subject filed a complaint against Schufa with the Hessian Commissioner for Data Protection (‘HBDI’), requesting that they order Schufa to disclose the logic involved in the determination of their credit score, and the significance and consequences of the processing of their data. On 3 June 2020, the HBDI dismissed the complaint, holding that Schufa’s processing was compliant with domestic law.[https://dejure.org/gesetze/BDSG/31.html §31 of the Bundesdatenschutzgesetz]. The data subject then appealed to the Administrative Court of Wiesbaden, under Article 78(1) GDPR. The Court stayed the proceedings and referred two questions to the CJEU. Only the first question is of relevance, as the CJEU did not consider the second. # Is a credit score issued by one party a decision for the purposes of Article 22(1) GDPR, where a third party draws strongly on that credit score to reach a decision? The Court held that a credit sco
The data subjects UF and AB underwent insolvency proceeding in Germany and were granted an early discharge from remaining debts by court decisions of 17 December 2020 and 23 March 2021 respectively. In accordance with § 9(1) Insolvenzordnung (Insolvency Code) and § 3(1)(2) InsBekV (Regulation on public notifications in insolvency proceedings on the internet), the official publication of these decisions on the debt discharges in the German insolvency register was erased after 6 months. SCHUFA Holding AG (SCHUFA), a German credit information agency had recorded these decisions on debt discharges in their own data bases and intended to store it for three years after registration, in accordance with a code of conduct under Article 40 GDPR approved by the competent DPA. UF and AB requested SCHUFA to erase the (no longer public) decisions on the debt discharges. SCHUFA refused and UF and AB lodged complaints with the Hessian DPA (HBDI) under Article 77 GDPR. The HBDI dismissed the complaints, finding SCHUFA's processing lawful. UF and AB each brought an action under Article 78 GDPR against the HBDI's decisions before the Verwaltungsgericht Wiesbaden (VG Wiesbaden), arguing that the HBDI was obliged to take measures in respect of SCHUFA to enforce the erasure of the entries concerning them. The HBDI requested the dismissal of the actions, arguing that Article 77(1) GDPR constitutes a mere "right of petition". Hence the VG Wiesbaden could only review whether the HBDI handled the complaints and informed the complainants of their progress and outcome but not review the substantive correctness of the decisions. On UF's and AB's requests for erasure, the HBDI argued that SCHUFA could store the decisions on debt discharges for as long as is necessary for the purpose of processing (i.e. assessing the creditworthiness of UF and AB) and that the storage period of three years after entry in the file according to the code of conduct should apply. The VG Wiesbaden doubted the HBDI’s
The Higher Regional Court of Cologne (Oberlandesgericht Köln, OLG Köln) decided on appeal on case 28 O 138/22 by the Regional Court of Cologne (Landgericht Köln, LG Köln). In the appealed judgment, the LG Köln ruled that, in order for a claim for damages under Article 82 GDPR to arise, the mere annoyance and suffering of emotional discomfort do not suffice. The data subject in that case, was a Facebook user whose personal data were disclosed as a consequence of a major data breach in 2019. The data subject appealed the decision by the LG Köln, restating his initial arguments and seeking again damages for loss of control over his personal data and emotional discomfort as a consequence thereof. On 07 December 2023 the OLG Köln pronounced its judgment. The OLG declared the appeal admissible. The court ascertained that there had indeed been several GDPR violations by the controller, and went on to assess whether they could give rise to the award of immaterial damages under Article 82 GDPR also in light of [https://gdprhub.eu/index.php?title=CJEU_-_C-300/21_-_%C3%96sterreichische_Post_AG CJEU in C-300/21.] The court held that even if the plaintiff did lose control over his data as they had been published in the darknet, in connection with his name and against his will, this, in turn, does not suffice to constitute an immaterial damage. Citing [https://gdprhub.eu/index.php?title=CJEU_-_C-300/21_-_%C3%96sterreichische_Post_AG CJEU C-300/21], the OLG ruled that the fact that there is no threshold that defines the existence of a damage, still does not mean that the person affected by a GDPR infringement is exempted from proving the negative consequences of the damage. In the present case, the OLG held that the plaintiff only proved the “negative consequence” suffered but not the immaterial damage itself. Hence, the plaintiff failed to prove that the loss of control over his personal data constitutes an immaterial damage and thus remains a merely abstract loss of control.
The data subject was an inmate in a prison. The controller operated the prison and employed a prison doctor. In a complaint to the Ombudsman board, the data subject said that the shower rooms caused skin irritation during cleaning work. On 27 April 2022, the Ombudsman board asked the Ministry of Justice for information. The prison’s legal office then asked the prison doctor to provide a medical statement to support the prison’s reply. On 04 May 2022, the doctor addressed what happened when the data subject contacted her in December 2021 and disclosed health data about the data subject. On 04 October 2022, the data subject filed a complaint with the Austrian DPA. They argued that there were outdated privacy notices and weak compliance in the prison, unauthorised internal access by prison staff to inmate data as well as unauthorised access to the data subject's phone, and unauthorised disclosure by a former lawyer who allegedly sought file access without a valid mandate and passed material to third parties. The data subject also accused the prison doctor of sharing sensitive health information without their consent and thereby violating Article 5 GDPR and Article 9 GDPR. On 22 February 2023, the DPA rejected the complaint. The data subject appealed to the Federal Administrative Court. First, the court focused on who qualified as the controller for the Ombudsman-related disclosure. It noted that Article 4(7) GDPR assigned controller status to the entity that decided the purposes and means of processing, not to individual employees acting on instructions. Second, the court upheld the DPA’s approach on the identification of the controller in a complaint. Following the national rule on complaint requirements (§ 24(2) DSG), the court held that when a complaint clearly targets a specific person who is not the controller for the processing, the authority has to dismiss the complaint. Third, the court held that the prison governor (as the prison authority) was the controlle
DW is a listed real estate company and indirectly holds around 163,000 housing units and 3,000 commercial units. The owners of these units are subsidiaries (holding companies) of DW and lease the units to other companies in the group (service companies). DW is only in charge or the central management. DW and the group of companies which it manages process the personal data of the tenants of said units. In 2017, the Berlin DPA informed DW during an on-the-spot inspection that companies within its group were storing personal data in a potentially infringent filing system. The DPA could not tell if it the storage was necessary nor if there were safeguards to ensure the erasure of data which was no longer required. DW told the DPA that it would move data to a more compliant database but this never materialised in practice. In 2019, the DPA fined DW €14,385,000 for intentional infringement of Article 5(1)(a), (c) and (e) and of Article 25(1) GDPR. The DPA found that DW intentionally failed to take the measures needed to allow personal data relating to tenants to be regularly erased or to check whether they had erroneously been stored. It also stated that DW had continued to store the personal data of at least 15 named tenants where such storage was not necessary. DW appealed this decision to Berlin's Regional Court. The court stated that the imposition of a fine on a legal person is regulated by national law (Paragraph 30 of the OWiG).The Act on Regulatory Offences: https://www.gesetze-im-internet.de/englisch_owig/index.html As a requirement for the imposition of the administrative fine against a legal person, German law requires that the original infringement shall be attributed to a natural person that is responsible for the legal person's compliance with the law. The Public Prosecutor's Office in Berlin filed an appeal with Berlin's Higher Regional Court. The Court observed that the limited liability regime of legal persons under national law is incompatible with
On 24 March 2020, the Lithuanian Minister of Health approved the development and implementation of an IT system for the purposes of recording and monitoring the data of persons exposed to the COVID-19 Virus, for epidemiological monitoring purposes. On 27 March 2020, a representative of the Lithuanian National Public Health Centre for the Ministry of Health (‘CNSP’) informed the IT company ‘IT sprendimai sėkmei’ (‘ITSS’) that the CNSP had selected it to create a mobile application for the above purpose. Once the mobile application was created, a privacy policy was developed in which the CNSP and ITSS were designated as joint-controllers. The application was available for download and functional between early April and the end of May 2020, during which it was used by 3802 persons. The application collected the following personal data from data subjects: their national identity number, geographical location, residential address, name and telephone number. On 10 April 2020, the Minister of Health entrusted the Director of the CNSP with the task of organising the acquisition of the mobile application in question from ITSS. Consideration was given to ITSS for the acquisition under domestic law, but no public contract for the formal acquisition of the application was concluded between the CNSP and ITSS. On 18 May 2020, the Lithuanian DPA opened an investigation into the mobile application and the data collected by it. By letter of 4 June 2020, the CNSP informed ITSS that due to lack of funding for the acquisition, the procurement process was terminated. On 24 February 2021, the Lithuanian DPA issued a decision which found that the application violated Articles 5, 13, 32 and 35 GDPR. As a result, the DPA imposed an administrative fine of €12,000 on the CNSP and €3,000 on ITSS as joint-controller, under Article 83 GDPR. The CNSP challenged the decision before the Vilnius Regional Administrative Court, arguing that ITSS must be regarded as the sole controller for the pur
The data subject was a civil servant for one of the companies (Bundesanstalt für Post und Telekommunikation (BAPT)) the controller manages the employee's health insurance benefits of. On 13 June 2018, the data subject sent a telefax to the controller, looking to exercise their Article 15 GDPR right to obtain from the controller a confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data in a detailed list. The controller responded on 2 July 2018, covering all aspects of Article 15 GDPR (a)-(h) in a one page document containing name, address, birth date, employee ID, tax ID, bank information, type of insurance, beginning of insurance as well as which group and pay scale. It also contained a general listing of billing documents and digitized receipts and outgoing mail since 2007. The data subject was not satisfied with this response, criticizing the lack of health data, missing information about the health reimbursement record for civil servants (Beihilfeakte), and an incorrect phone number. The controller replied to the complaint on 1 August 2018, saying that the phone number was deleted and offering examples of health data in the form of past doctors the data subject frequented. The data subject was yet again not satisfied and filed a disciplinary complaint at a data protection authority as the disclosure was deemed incomplete. The controller referred to Article 23 GDPR in conjunction with § 34(1)(2)(a) German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG), stating they store approximately 3,000 documents, some with multiple pages, relating to the client due to the retention period of 10 years. It also claimed that the employer of the data subject has expressly reserved the right to respond to data requests based on Article 15 GDPR for themselves. The data subject kept repeatedly reaching out to the controller about its incomplete data inquiry, on 27 August 2018, 02
A data subject filed a complaint with the DSB claiming a violation of his right to access under Article 15 GDPR. The DSB partially upheld the complaint of the data subject, ordering the controller, an address publisher and direct marketing company, to disclose to the data subject information about the target groups of personal data about him being processed for advertising purposes and the names of the recipients of such data as it failed to fully comply with the access request. The controller then appealed the decision before the BVwG, claiming that it is not obliged to disclose such information. The BVwG started evaluating the case but then suspended the proceedings, pending the decision of the CJEU in case C-154/21 and issued only a partial decision on 17 May 2022 (BVwG - W214 2233132-1/13E) annulling parts of the DSB's decision. In January 2023, the CJEU delivered its judgment in case C-154/21 and the BVwG continued the case in May 2023. Upon hearing further submissions by the parties, the BVwG issued its final decision on the remaining part of the case on 29 November 2023. In the second partial judgment the court considered the two parts of the DSB’s decision that had not already been decided, namely: (2a) the order to the controller to disclose the names of all recipients of the data subject’s personal data and (1) the declaration that the controller violated the data subject’s right to access as it failed to fully comply with his request under Article 15 GDPR. The Court first of all held that, part (2a) of the DSB’s decision should be dismissed, as the controller in its later submissions sufficiently proved that it was impossible for it to identify all recipients of the data subject’s personal data and thus it could and can not comply with the order to disclose their names. As regards part (1) of the DSB’s decision, the BVwG held that, even though it was indeed impossible for the controller to identify the recipients of the data subject's personal data, t
A data subject requested a copy of the personal data about him being stored by his former employer under Article 15(1) and (3) GDPR. The data subject believed that the response by his former employer, the controller, was incomplete and filed suit with the Regional Court of Nürnberg-Fürth. On 29 January 2021, the court dismissed the claim. Unsatisfied with the decision of the court, the data subject filed an appeal with the Higher Regional Court of Nürnberg (Oberlandesgericht Nürnberg, OLG Nürnberg), claiming again that his right to access to all personal data about him saved by the controller. The data subject, as former employee and board member of the controller requested access to personal data about him from January 2000 until September 2016, including, among others, correspondence, calendar appointments, offsetting of company shares and other information related to his role as board member. The OLG Nürnberg held first of all, that the appeal was admissible. Then, the court considered that the access request was sufficiently clear, as it basically reflected the wording of Article 15(1) GDPR and that it is generally not necessary for access requests to specify the data requested. Then, the court also considered that personal data about a data subject cover all information that is connected to that person, because of its content, purpose or effects. Further, making reference to C-307/22, the court clarified that the right to access under Article 15 GDPR is “without prerequisites”, meaning that a controller should grant access to personal data that is needed also for purposes other than those included in Recital 63 GDPR. Moreover, the court held that the access request cannot be considered an abuse of the data subject’s rights, since the right to data protection is a fundamental right and having access to one’s personal data is a way of protecting such right. The fact that, because of the long term of employment of the data subject, the personal data about hi
The data subject as a data subject in this case, was a candidate for the election of the students' parliament at the University of Hamburg. Upon signing up for candidacy the data subject was requested to disclose his date of birth in the candidacy registration form, but he claimed this to be unnecessary and filed his candidacy without providing his date of birth. The University rejected his candidacy on this basis, claiming that all candidacies must also entail the candidates' date of birth. The data subject decided to file suit against the member organisation of the University with the Administrative Court of Hamburg (Verwaltungsgericht Hamburg, VG Hamburg) The controller is the University of Hamburg, a legal entity under public law of the City of Hamburg. The Hamburg University Election Act (Wahlordnung, WahlO) stipulates that to be able to run for elections, every candidate must provide their full name, student number, date of birth, current home address and an email address. In its submissions, the controller argued that processing the date of birth of candidates was necessary for the purpose of identifying them beyond doubt and ensuring that the candidates were of legal age. On 11 February 2023, the VG Hamburg, in the first instance, held that the data subject's candidacy registration form was incomplete because the required date of birth was missing and that this requirement does not raise any data protection concerns. Hence, the court took the view that he had not submitted a complete form in a timely manner and therefore could not run for election. The data subject thus decided to appeal the decision to the Higher Administrative Court of Hamburg (Oberverwaltungsgericht Hamburg, OVG Hamburg). The OVG Hamburg first of all held that the GDPR applies because the date of birth of a data subject constitutes personal data and its use in the context of the election is to be considered data processing. Further, the OVG held that the only legal basis for such da
The data subject was employed by the controller in December 2016. In October 2022, the data subject requested access to their personal data under Article 15 GDPR, which the controller complied with. The data subject then sent another request and set a deadline until 16 October 2022. The controller did not respond by that date, and after multiple reminders and new deadlines, it provided a response that was delayed and incomplete, missing data on storage duration and recipients. The controller later supplemented the information by early December 2022. The data subject claimed that the controller violated its Article 15 GDPR duties by failing to provide timely and complete information, causing immaterial harm (loss of control over data). They sought compensation under Article 82 GDPR. In the previous decision, the lower court awarded €10,000. The controller appealed the decision. First, the court held that a delayed or initially incomplete data access response does not constitute “data processing” as defined in Article 4(2) GDPR. It pointed out that a missed or belated answer is not an active processing act but “non-processing” of data, and thus cannot trigger compensation under Article 82 GDPR, which requires an actual unlawful processing breach. The court also held that an immaterial damage claim must be tied to concrete harmful processing. Generalized assertions like “loss of control” or “frustration” are insufficient and must be proven. As a result, the court amended the first-instance decision and dismissed the data subject’s claim for non-material damages. Revision (appeal) to the Federal Labour Court was permitted.
A data subject having found that an American company had collected his personal data in order to publish it on its website, contacted it requesting for more information on the matter. On the same day, the data subject received an e-mail with a copy of the data, informing him that the company had deleted his personal data from its databases. Thus, the data subject filed a complaint with the Luxembourgish DPA requesting it to intervene and ask the controller responds to his request in accordance with the GDPR. Although the company had informed the data subject that it had deleted his profile from its website, it had at no time indicated whether, how, for how long and for what purposes it had stored the data subject’s personal data in its own databases or to which companies it had communicated that data. Thus, on 18 July 2019, the DPA wrote to the company requesting information on the contact information of the company’s representative in the EU designated under Article 27 GDPR. To which the company replied to not consider itself the controller of the data since their users are the controller and are responsible for ensuring that they individually adhere to data protection laws and regulations such as GDPR. In light of this reply, the DPA informed the data subject that because of this, it would not have the power to impose sanctions on the controller. By e-mail dated 29 May 2020, the data subject asked the DPA to send him a signed decision stating it could not, in accordance with Articles 12 and 13 of its internal rules of procedure, issue a decision. To which the DPA replied by e-mail on 8 July 2020. And on 18 September 2020 it reiterated to be unable to pursue the claim. Thus, on 1 March 2021, the data subject filed a complaint with the Administrative Tribunal. The Tribunal noted that the personal data in question had been deleted from the company's website and that the complainant’s lawyer failed to prove that his data had been processed by the company both at the t
A data subject requested the controller - Arbeitsmarktservice (the public employment service) - to change their gender in the database from "male" to "divers" following a court decision, that changed the subject's gender in the civil registry. The subject submitted an official document proving the change in the civil register. On 15 March, the controller replied that it could not do so, as the software in place does not permit other genders than "male" and "female". The subject then raised a complain to the Datenschutzbehörde, the Austrian data protection authority. The DSB suspended the proceedings on the basis of Article 38 of the General Administrative Procedures Act (AVG) until the CJEU delivers its judgement on the preliminary questions in case C-247/23. The data subject and complainant appealed this decision to the Bundesverwaltungsgericht (Federal Administrative Court) which held that the suspension was unlawful and ordered the DSB to proceed the investigations. The DSB appealed this decision to the Supreme Administrative Court. The Supreme Administrative Court ruled that the Federal Administrative Court decided correctly and rejected the complain.
In the decision leading to the appeal, the Dutch Employee Insurance Agency, the controller, refused to grant the data subject access to an anonymous tip, which led to an investigation into their sickness (ZW) benefits. The investigation revealed that the data subject had failed to comply with the duty to provide information, resulting in the recovery of €6,010 in unlawfully paid ZW benefits and a fine of €253.33. Following the request of their file, the data subject received all documents except the anonymous tip. The controller argued that the data subject’s interests were not harmed by the tip, stating that it was the investigation, not the anonymous tip, which constituted the direct cause for the recovery and the fine. Article 7(6)(i) Dutch Access and correction rights regulation ([https://zoek.officielebekendmakingen.nl/stcrt-2018-28604.html Regeling inzage en correctierecht UWV 2018]) (hereinafter: the Dutch Access and correction rights regulation), based on the GDPR, further allows for the controller to deny the data subject’s request to access where this is necessary and proportionate to protect the rights and freedoms of others. The data subject claimed ongoing harassment by an anonymous tipster, involvement in the childcare benefits scandal, issues with national institutions, privacy violations by the controller, and finally, an intent to initiate civil proceedings against the tipster. The controller responded by clarifying that the tipster wished to remain anonymous, constituting a situation where the general public interest in maintaining anonymity and ensuring continued reporting outweighs the personal interest of the data subject. The Court ruled that the controller’s decision to deny the data subject’s request is justified. The Court recognised that, under Article 7(6)(i) Dutch Access and correction rights regulation, a request for access may be partially or fully denied if it is necessary and proportionate to protect the rights and freedoms of
A credit reference agency (the controller), acting under Austrian law (Article 152 of the Law on business activity - [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10007517 Gewerbeordnung]), created an identity and creditworthiness database. Using the collected data, the controller assigned individuals with a creditworthiness score. Apart from identifying data, the controller processed a final score and the “interim” scores, used to create the final one. The database was framed and logically prepared within the Microsoft SQL Server software. The database consisted of various tables, defined and related to each other. The design of the database aimed at maximizing the performance of the database, inter alia by avoiding redundant storage of data. One of the people whose data had been collected in the database (the data subject) exercised their rights under Article 12 GDPR and Article 15 GDPR with the controller. They requested details on the processing activities pursued and the copy of the data in a “standard technical format”. The controller answered the access request and provided the data subject with the details of processing activities, in particular, the source of the data, data recipients, the creditworthiness score. The data subject, unsatisfied with the answer, lodged a complaint with the Austrian DPA (DSB) regarding the violation of Article 14 GDPR and violation of Article 15 GDPR, indicating the controller didn’t provide them with the copy of the data. The DPA dismissed the case. The DPA’s decision was appealed by the data subject with the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). In the meantime, the controller supplemented the information sent to data subject, explaining retention period, criteria of data deletion, and claiming that in previous six months there were no inquiries regarding the creditworthiness of data subject. During the proceedings before the court, the controller provided
The data subject complained to the Swedish DPA that his neighbors were conducting camera surveillance with cameras aimed at other’s plots and a common access road. The DPA investigated and concluded that the neighbours were not processing personal data. The GDPR was therefore not applicable and the case was closed. This decision was appealed by the data subject to Stockholm’s Administrative Court who dismissed the case. It reasoned that that the appealed decision did not affect the data subject in such a way that it is appealable. The data subject appealed the rejection to the Stockholm Court of Appeal. The Court of Appeal referred the case back to the Administrative Court. It stated that the Swedish DPA ruled on the substance of the data subject's complaint by rejecting it. The data subject should have an effective remedy under the GDPR. This decision by the Court of Appeal was appealed by the Swedish DPA to Stockholm’s Supreme Administrative Court. They argued that while data subjects have the right to an effective legal remedy, the decision to not open a case or close a case do not have any legal effects or significant consequences. The question for the Supreme Administrative Court was whether the Swedish DPA’s decision to close a supervisory case without action is appealable. The court decided that the data subject had the right to appeal. The right to an effective judicial remedy before the competent national court when a decision has legal consequences is outlined in Article 78(1) GDPR. To have legal consequences the complaint must be a legally binding decision and this includes decisions where the authority has dismissed a complaint. The same situation will arise as if the complaint case was directly closed without hearing the complaint. To ensure the right to an effective remedy, such a decision must also be considered as a legally binding decision within the meaning of Article 78(1) GDPR. Therefore, the appeal of the Swedish DPA is dismissed and the
A data subject filed a complaint against a bank with the Swedish DPA IMY, claiming he was denied access to his personal data. The DPA chose to close the case, explaining that they had informed the bank about the complaint to allow them to evaluate their own processing and rectify any shortcomings. The data subject appealed to the Administrative Court (Förvaltningsrätten) in Stockholm, but the appeal was dismissed. The court stated that the DPA's decision not to act on his complaint doesn't impact him in a way that qualifies for an appeal. Subsequently, the data subject took his appeal to the Administrative Court of Appeal (Kammarrätten), which also rejected it. The court argued that the decision did not significantly affect the data subject and was, therefore, not eligible for an appeal under the relevant legal criteria. Ultimately, the case reached the Supreme Administrative Court (SAC). The Supreme Administrative Court (SAC) overturned the decisions of the Administrative Court of Appeal and the Administrative Court, and referred the case back to the Administrative Court for reconsideration. In their ruling, the SAC cited Article 78(1) GDPR, which pertains to the right to an effective remedy against legally binding decisions made by a DPA. They referred to [https://gdpr.fan/r141 Recitals 141] and [https://gdpr.fan/r143 143], highlighting that a data subject should have access to effective legal remedy at the competent national court against a DPA's decision that legally impacts them. The SAC noted an example from Recital 141, including cases where the DPA dismisses or rejects a complaint, either wholly or partially. The SAC determined that a decision indicating the DPA's refusal to take the action requested in a complaint should be viewed as a legally binding decision, which is appealable under Article 78(1) GDPR. Therefore, since the data subject's complaint did not result in the desired actions, he is entitled to appeal.
In 2016 a data subject sought security clearance from the National Security Authority ("NSA") to participate in an event. The clearance was refused because of the personal data they held on the data subject. According to this data, the data subject had participated in 10 demonstrations between 2007 and 2016 which prevented him from being granted clearance. This fact was not disputed by the data subject. As required by Article 17 Directive 2016/680 (the "Law Enforcement Directive" or "LED"), as implemented by Article 42 of the Belgian implementation law, the data subject requested the Supervisory Body for Police Information ("OCIP" or "Supervisory Authority") to provide access to all the personal data the NSA held on him so that he could exercise his rights as a data subject. In reply, OCIP responded that the data subject only has an indirect right of access to that data and that OCIP itself would verify the lawfulness of its processing by the NSA. Having carried out the necessary checks, and in a narrow application of Article 17(3) LED,Directive (EU) 2016/680, the data protection law enforcement directive (LED), ensures the protection of personal data of individuals involved in criminal proceedings, be it as witnesses, victims or suspects. the OCIP informed the data subject that if necessary, the personal data had been amended or erased' from the police data banks.' This response did not give the data subject enough information to understand OCIP's decision. The data subject (in conjunction with Ligues des droits humains) filed an appeal before the Brussels First Instance Court. They asked, firstly, if the LED precluded national legislation to allow for judicial remedies against the decisions taken by the OCIP. Secondly, they asked for access to all the data subject’s personal data and the identification of the controllers and any recipients of the data. Lastly, they asked if national legislation could derogate from the right of access and allow the OCIP to merely s
Rabobank (the controller) provided a business loan of €86,000 to the data subject in 2008. In 2014, the controller terminated their financial relationship with the data subject, as the data subject was unable to meet payments on time and had exceeded their credit limit. In 2015, the data subject negotiated a new payment plan with the controller, but they were unable to maintain this. In September 2022, the data subject reached a new agreement with the controller, where the data subject paid €27,375 to the controller and the controller wrote off the remaining debt. On 6 October 2022, the controller formally waived their remaining claim against the data subject and the controller negatively registered the data subject in the national Credit Information System (CKI). Under domestic regulations, the data subject's negative registration could only be removed after five years by the controller, on 6 October 2027. On 6 February 2023 and 27 February 2023, the data subject requested the controller to remove his negative registration from the system so that he could purchase a commercial property. In response to both requests, the controller refused, noting that there were no compelling grounds to shorten the five year registration period. Following the controller's refusals, the data subject filed a claim with the District Court of Amsterdam, requesting that his negative registration be removed (erasure request). One of the grounds to exercise the right of erasure is an Article 21(1) GDPR objection to processing, where there are no overriding legitimate grounds for the processing (Article 17(1)(c) GDPR). Consequently, the Court considered the data subject's claim on the basis of Article 21(1) GDPR. The Court refused to enforce the data subject's request, as they found that the data subject had no overriding interests, rights or freedoms against the legitimate interests of the controller under Article 21(1) GDPR. The controller used Article 6(1)(f) GDPR as a legal ba
In September 2021, David Miles submitted a subject access request (SAR) to Brentwood Ursuline Convent High School (BUCHS). Dissatisfied with their response, Miles complained to the Information Commissioner in February 2022. When no progress was made on his complaint, Miles applied to the Tribunal in March 2023, seeking a directive for a response from the Information Commissioner's Office (ICO). His application to the Tribunal was prompted by the lack of action from the ICO in addressing his complaint. Subsequently, the ICO communicated with BUCHS and reported back to Miles, asserting that appropriate steps had been taken. The application was filed to prompt action from the ICO, which had not effectively responded to his initial complaint about BUCHS's handling of his SAR. The First-tier Tribunal (General Regulatory Chamber) struck out the application, finding no reasonable prospect of success for the appellant's case. The ruling emphasized that the Tribunal's role is not to judge the merits of the underlying complaint or the substantive outcome of the Commissioner’s investigation but to assess the appropriateness of the Commissioner's steps in response to a complaint. The Commissioner’s actions post-application were deemed appropriate, rendering the application unnecessary and disproportionate to continue.