GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Scania, a manufacturers of heavy goods vehicles in Europe, grants car repairers access to repair and maintenance information via a website. That website enables searches to be carried out either on the basis of general vehicle information, such as the model, engine or the year of manufacture, or on a given vehicle, by entering the last seven figures of the Vehicle Identification Number (VIN) of that vehicle. VINs in this context are serial numbers and should not be confused for license plates. Gesamtverband, a competitor of Scania, argued that the information granted by Scania to repairers is anti-competitive. It requested the court to order Scania to grant also independent operators (rather than just repairers) access to the above information. Allowing indepenant operators this information would ensure effective competition in the market for vehicle repair and maintenance information services, as it ensures that the independent vehicle repair and maintenance market as a whole can compete with authorised dealers. Alongside other questions, the referring court (while taking the view that, as a general rule, the VIN does not constitute personal data) asked whether Article 61 of Regulation 2018/858 must be interpreted as imposing on vehicle manufacturers a legal obligation to process data, within the meaning of Article 6(1)(c) GDPR. The CJEU informally split the question into two topics. Firstly, whether a VIN can be considered personal data. Secondly, if a VIN is personal data, is an obligation to provide a VIN compatible with the GDPR? On the first point, the CJEU held that VINs constitute personal data within the meaning of Article 4(1) GDPR, in so far as the natural person who has access to a VIN may have means which reasonably allow them to use the VIN to identify the owner of the vehicle to which it relates. It is for the referring court to examine whether that occurs in each case. To come to this decision, the court referenced Article 4(1) GDPR which states
On 2 December 2022, the data subject made an access request to the University of Utrecht (the controller), under Article 15 GDPR. In the request, the data subject asked for all information about my [their] records'. On 11 January 2023, the controller responded asking the data subject to clarify their request, as the original request was too general and not specific enough. On 13 January 2023, the data subject replied, noting that they did not need to provide the controller with any more information. On 10 February 2023, the controller set aside the data subject's request due to their lack of response and notified them thereof. The data subject subsequently brought a claim against the controller in the Central Netherlands District Court for the lack of response to their access request. The Court held that the controller was in violation of Article 12(3) GDPR, as they had failed to respond to the data subject's access request within the one-month deadline. The Court noted that, while the controller did respond with a request for more information, this response was after the one-month deadline established by Article 12(3) GDPR. Usually, a request for more information would have suspended the one-month deadline. However, in this case it was not suspended, as the response was done after the deadline had passed. The Court further held that there was no infringement of Article 15 GDPR, as the data subject did not respond to the controller's request for more information. As such, the controller was entitled to set aside the access request on 10 February 2023. As a result, the Court held that the controller was liable for damages for their violation of Article 12(3) GDPR, and awarded the data subject €707 in damages. The amount awarded was calculated on the basis of domestic administrative law, as the controller (the University of Utrecht) is an administrative body.
On 15 June 2019, the data subject made an access request under Article 15 GDPR to the Dutch Fiscal Intelligence and Investigation Service (FIOD). The FIOD is a government agency in the Netherlands responsible for investigating financial crimes, and is under the administration of the Ministry of Finance. On 7 August 2019, the FIOD responded to the data subject, stating that no personal data which the GDPR applied to was being processed by them. Instead, the data subject’s data was processed under the Police Data Act, which offered no equivalent right of access as under the GDPR. The data subject challenged the FIOD’s response at a District Court. In a judgment dated 22 November 2022, the District Court dismissed the data subject’s claims on the grounds that the FIOD’s activity’s fell under Article 2(1)(d) GDPR. This Article provides that the GDPR does not apply to the processing of personal data ‘by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.’ Consequently, the data subject had no right of access as the GDPR did not apply to the FIOD’s processing activities. The data subject appealed the District Court’s decision to the Council of State (Raad van State), the Netherlands’ highest administrative court. On 11 October 2023, the Council of State heard the data subject’s appeal. In the appeal, the data subject submitted that the District Court had erred in its reading of Article 2(1)(d) GDPR and should not have interpreted the Article as applying to the FIOD, as the FIOD was under the administration of the Ministry of Finance and was not a police body. As a result, the data subject argued that their data held by the FIOD fell under the GDPR’s material scope, and thus, they had a right of access to the data. The Council of State held that the District Court had correctly
The data subject took a civil claim against the controller, here the Child and Family Agency, for unlawfully disclosing her data. The controller had been in possession of sensitive data relating to childhood abuse suffered by the data subject. The controller accepted that it had caused a data breach, which resulted in the data subject’s now deceased brother having access to the information. The brother had been the subject of the report of abuse made by the data subject to the controller. After the report had been disclosed to her brother, her other siblings and family members also found out about the incident. The data subject reported that this caused her extreme distress and resulted in a lack of trust in the controller and further mental health problems. The court found that the data subject’s relationship with her family members had been damaged due to the data breach. The court reiterated that a breach of the GDPR does not automatically warrant damages. The court highlighted that in this case, the data subject had been retraumatised through the actions of the controller. The court classified the data breach as serious in nature and awarded the data subject with damages in the sum of €7,500. In setting this number, the court highlighted the controller’s role in handling sensitive data and the high level trust required.
A data subject lodged a complaint with the Norwegian DPA, who decided to merely inform the controller of their GDPR obligations and closed the case without further investigation. Dissatisfied, the data subject contested the closure. After some back and forth, the DPA revisited but ultimately upheld their initial decision. Consequently, as per national procedures, the case was escalated to the Privacy Appeals Board. They were tasked with determining whether the DPA could close a case by simply issuing an informational letter to the controller, without assessing any GDPR breaches, or if the data subject could require the DPA to examine their case and decide on the legality of their personal data processing. The Privacy Appeals Board overruled the DPA's decision and instructed them to reassess the case. Their reasoning was based on the data subject's right to lodge a complaint as per Article 77 GDPR, in conjunction with Recital 141, and Article 57(1)(f) GDPR. The Board referenced an earlier decision (PVN-2017-09), acknowledging the DPA's discretion in determining the scope of their investigations. However, they emphasised that this discretion does not extend to selectively processing complaints. In instances like this, where facts are clear but legal interpretation is in question, the DPA is obliged to decide on the lawfulness of the processing. The Board believed that failing to do so would conflict with Article 77 GDPR. Consequently, the DPA is required to assess the case and determine whether the controller unlawfully processed the data subject's personal data. If a violation is found, they must then consider the need for corrective actions in line with Article 58(2) GDPR.
In April 2023, a data subject complained to the UK Data Protection Authority (ICO) that a bank (the controller) had failed to update their systems, resulting in her personal banking data being sent to the incorrect address. Furthermore, even after she informed the controller of this fact, they continued to send her letters and cheques to the incorrect address. In May 2023, the ICO replied to her complaint. They stated that they had raised the issue with the controller who had provided a full response and addressed all the ICO's questions. The ICO was satisfied with the controller's response and their handling of the data subject's personal data and subject access requests. As such, the ICO closed the case. The data subject asked the ICO to show her the response from the the controller. The ICO took 26 days to reply and told her that they would not release it as it had been provided by the the controller's DPO for the sake of the investigation. In June 2023, the data subject appealed the ICO's decision to the First Tier Tribunal under Section 166 of the UK Data Protection Act (DPA 2018). Section 166 governs the Tribunal's jurisdiction to give orders to the Information Commissioner to progress complaints when the complaint has been made under Section 165 Data Protection Act or Article 77 UK GDPR.Article 77 remains the same in both the UK and EU GDPR. The data subject accused the ICO of failing to take reasonable steps to resolve her complaint in accordance with the DPA 2018. They argued that it was impossible for her to verify whether the controller had told the ICO the truth. Through appealing the decision, she wanted her complaint to be acted upon and to receive all the personal data related to her accounts held with the controller. The Tribunal struck out the data subject's appeal because it fell outside its jurisdiction. First, Section 166 DPA 2018 does not give data subjects a right of appeal against the merits of the Information Commissioner’s decisio
The case involves the unlawful transfer of personal data to US-based companies through cookies without proper consent.
A data subject applied for an open position at a credit agency in 2017. On 18 May 2023, the data subject made an access request under Article 15 GDPR giving the controller a two-week limit to reply. The controller did not respond within the deadline and the data subject reminded the controller of his access request. On 5 June 2023, the controller replied to the request, stating that it did not process any of the data subject’s personal data. The data subject then got back to the controller asking why it took so long to respond to his access request and the controller replied stating that it lawfully replied within the time limit foreseen in Article 12(3) GDPR. Still, the data subject believed that the controller violated Article 12(3) GDPR’s requirement that controllers provide information on data subjects’ requests “without undue delay”. In the data subject’s opinion, the one-month deadline of Article 12(3) GDPR is a maximum deadline; if it wasn’t so, the “without undue delay” would lose its meaning. In the data subject's view, in absence of particular circumstances, this means that controllers should answer within a week. Also, given the simplicity of the access request, the controller in this case should have been able to respect the two-week limit set by the data subject. The data subject claimed to be entitled to immaterial damages under Article 82(1) GDPR, as it suffered a temporary loss of control over his personal data and not knowing whether personal data concerning him were being processed, he could also not know whether the controller was lawfully processing his data or not. The data subject further claimed to have suffered emotional damages. For these reasons, he asked the controller for compensation in the amount of €1,000, which the controller refused to pay. The data subject then filed suit in the Labour Court of Duisburg (Arbeitsgericht Duisburg- ArbG Duisburg) in order to obtain compensation of at least €2,000 from the controller. In its submissi
The Danish Business Authority was formerly responsible for supervising compliance with the Danish cookie rules. Due to reorganisation, the supervision was transferred to the Danish Agency for Digital Government on 15 December 2022, who is the authority making the decision in this case. On 1 and 16 September 2022, Google LLC was sent consultation letters regarding the use of cookies on their website, which did not allow users to give granular consent. The text on the first layer of the cookie banner stated that by selecting "accept all", users agreed that Google could use cookies to process their data for four purposes. Users would also be given the option of dividing their consent under "More choices" on the second layer of the cookie banner. However, users were only given the option to split their consent over two purposes, different to the ones in the first layer. Secondly, the Agency found that Google did not provide users with adequate information about all cookies used on the website. It also pointed out that the information was not considered to be permanently available through direct and marked access on the website, as it was difficult for users to retrieve information when clicking away the cookie banner. On 13 September and 6 October 2022, Google Denmark ApS, Google LLC and Google Ireland Limited submitted comments to the letters. They argued that the material scope of the Danish Cookie Law is limited to the website operator, which in their cases is Google Ireland Limited. In light of this, they contested the Agency’s territorial competence to supervise Google Ireland Limited. Firstly, the Agency affirmed that the website owner is subject to the obligations regarding the use of cookies under the Danish Cookie Law. Meaning that Google LLC, as the website owner, was subject to its requirements. Henceforth, on the territorial scope, the Agency, citing the [https://edpb.europa.eu/our-work-tools/our-documents/internal-documents/internal-edpb-document-042021-
The Danish Business Authority was formerly responsible for supervising compliance with the Danish cookie rules. Due to reorganisation, the supervision was transferred to the Danish Agency for Digital Government on 15 December 2022, who is the authority making the decision in this case. Meta was sent a consultation letter requesting them to elaborate on the cookies it uses and on the cookie banner displayed on its website as it deemed that it did not provide sufficient information. Meta responded stating that it only uses technically necessary cookies for non-registered users, whereas a cookie banner requiring consent shows up for registered users. In the consent banner for registered users, Meta grouped the categories "Our cookies on other apps and websites" and "Cookies from other entities" under a single consent. Also in the consent banner for unregistered users, it is not possible to give a granular consent for different purposes as the only options were "Allow only necessary cookies" or "Allow necessary and optional cookies". In 2022, Meta changed the banner for unregistered users adding a link to the cookie policy allowing to manage one’s consent, but still only one consent could be given for several purposes. Further, the option to withdraw consent for non-registered users was presented in such a way, that users would have to click several times before finally withdrawing consent. In its letter, the Agency for Digital Government (Agency) also pointed out that Meta did not provide sufficient information on cookies and similar technologies used on its website. Meta responded stating that this corresponded to the [https://www.retsinformation.dk/eli/retsinfo/2013/9187 Guidelines of the Danish Business Authority of 2013] (repealed) which only required general information on the purposes of cookies to be provided. Meta adapted its cookie policy as of September 2023 adding a list of cookies and "The most common purposes of these cookies”. Upon receiving a stateme
The case involved a dispute between a patient (DW) and a healthcare practitioner (FT) regarding access to the patient's medical file. DW is the data subject and FT the controller. DW received dental care from the controller and suspected errors during the treatment. DW requested a free copy of their medical file from FT. FT insisted that DW should bear the costs associated with providing the copy, in accordance with German national law. Initially, DW's request for a free copy was granted, as the first-instance court based their interpretation of German national legislation in light of Article 12(5) and Article 15(1) and 15(3) GDPR. FT appealed this decision to the Bundesgerichtshof (Federal Court of Justice, Germany). The court stated that the solution to the dispute depends on the interpretation that should be given of the provisions of the GDPR. Therefore, the Bundesgerichtshof referred the case to the CJEU as a preliminary reference with the following questions: 1. Does the GDPR (Article 15(3) GDPR, read in conjunction with Article 12(5) GDPR) require the practitioner to provide a free copy of the patient's personal data when the patient's request is for a purpose other than those mentioned in the GDPR under recital 63? For example in this case, requesting a first copy of their medical file in order to hold a medical practitioner liable? 2. If the answer to the first question is negative: a) Can a national provision adopted before the GDPR came into force restrict the right to receive a free copy of personal data granted by the GDPR?In this case the rights granted by reading first sentence of Article 15(3), in conjunction with Article 12(5) of the GDPR under Article 23(1)(i) GDPR. b) If the answer to a) is positive, do the 'rights and freedoms of others mentioned under Article 23(1)(i) GDPR include being relieved of the costs and charges associated with providing a copy of the data? c) If the answer to b) is positive, does a national regulation that gives the d
In December 2005, the data subject took out a €202,500 mortgage for a house with ING Bank (the controller). In 2008, the data subject faced financial hardship and could no longer pay off the mortgage, and had to declare bankruptcy. In 2009, the house was sold at auction for €147,788, which left the data subject with a residual debt of €77,575 (due to accrued interest). The data subject enrolled in a debt-assistance programme that they completed in 2021. By this time, ING Bank had received €72,000 from the data subject and wrote off its claim. Despite that, ING Bank still had the data subject negatively registered in the Central Credit Information System (CKI) of the Bureau Krediet Registratie (BKR). BKR is the body which collects and manages all credit data in the Netherlands. On 6 December 2022, the data subject made an erasure request under Article 17 GDPR and an objection under Article 21 GDPR to have their negative registration no longer processed and removed. ING Bank refused both requests. In particular, ING argued that its legitimate interest in recording the data subject’s credit history overrode the data subject's right to be forgotten. On 19 April 2023, the data subject filed a claim with the Amsterdam District Court. The Court held that the interests of the data subject overrode those of ING Bank (the controller) in relation to the erasure request. In reaching its conclusion, the Court undertook a balancing test to determine whether the Bank had sufficiently demonstrated compelling legitimate grounds for processing which were capable of overriding the data subject’s interests and rights. In the balancing test, the Court determined the scope of the controller's legitimate interest through the purposes behind the Bank’s credit registration system. The Court understood the purpose of the credit registration system to be twofold: 1. To protect consumers from taking on too much debt; 2. To protect lenders against consumers who do not or cannot fulfil t
On 2 November 2020, Capital Letters (London) Limited informed its employee, Jashu Vestani, that he was the victim of a data breach affecting the company. Mr. Vestani later experienced cyber attacks and other fraudulent activities which he concluded had resulted from Capital Letters' data breach. On 4 January 2023, Vestani submitted a complaint about the data breach to UK DPA - the Information Commissioner's Office (ICO). On March 14, 2023, the ICO decided not to investigate the complaint further, due to lack of evidence directly linking the attacks to the breach. On 23 June 2023, Vestani appealed the ICO's decision to the First-Tier Tribunal. The ICO argued that under Section 166 of the Data Protection Act, the Tribunal cannot examine the underlying merits of the original complaint, only whether the ICO took appropriate action. As the expert regulator, the ICO has wide discretion in handling complaints that the Tribunal cannot override without evidence of mishandling. The core legal dispute centred on the scope of the Tribunal's authority to review the ICO's processing of data breach complaints and whether it can evaluate the regulator's decision itself or merely the appropriateness of internal procedures followed. The First-tier Tribunal decided that it can only review the actions of the ICO carrying out its obligations under section 165 of the UK Data Protection Act 2018, as empowered to do so by section 166 of the UK Data Protection Act 2018. The Commissioner has wide discretion as the expert regulator in complaint investigations. The Tribunal held its role was limited under the law to assessing the “appropriateness” of steps taken by the Commissioner, not re-examining the actual merits or substance of Mr. Vestani’s complaint itself. Accordingly, the Tribunal struck out the application.
The data subject, an asset management professional, undertook an agreement with PME Investment Services. The agreement was that the data subject would take over a housing project mediated by PME, and in return PME would be awarded a fee and a minor percentage of the subsequent sale of the apartments. However, the data subject failed to uphold the agreement. As a result, on 9 May 2018, PME filed a suit against the data subject. After a first decision, on 27 January 2021, the case was brought to the attention of the Court of Appeal of Den Haag. In those proceedings, in an attempt to avoid liability, the data subject relied on the GDPR to anonymise and redact deeds which were key to the proceedings, on the basis of Article 5(1)(c) GDPR (data minimisation). In a judgment dated 4 October 2022, the Court of Appeal of Den Haag ignored the anonymised deeds and ruled in favour of PME and made a compensation order based on calculations which did not take into account the anonymised deeds. As a result, the compensation order was significantly higher than it would have been if the anonymised deeds were taken into account. On 3 January 2023, the data subject filed an appeal against the Court of Appeal's decision to the Supreme Court of the Netherlands. The Supreme Court of the Netherlands dismissed the appeal. In their ruling, the Supreme Court clarified the relationship between the GDPR and domestic evidentiary rules in civil proceedings. The Court held that it was possible to give evidence in a manner compliant with the GDPR and confirmed the CJEU case of Norra Stockholm Bygg AB ([https://gdprhub.eu/index.php?title=CJEU_-_C-268/21_-_Norra_Stockholm_Bygg Case C‑268/21]). In that case, the CJEU held that the GDPR does not contain an absolute ban on sharing personal data in civil proceedings as that would be in conflict with the right to a fair trial in Article 6 ECHR. However, in doing so, the national court must take into account the principle of proportionality and bal
A data subject took a test to a German University in order to be admitted to a Degree in Medical studies. The data subject sent an e-mail to the coordination office for the test, submitting that he had taken the test in Frankfurt on 7 May 2022 and requested a copy of his examination file as it contained personal data about him, in accordance with Article 15(3) GDPR and citing CJEU case C-434/16. On 15 June 2022 the coordination office replied to the e-mail giving an overview of the personal data about him that were being stored and a scan of the information on test processing. In addition to this, the office sent him a copy of the test booklet where the content of the test was blackened but his answers and notes were readable. The data subject replied to the e-mail complaining about the blackening of the test questions and he asked to receive a copy of the test including the questions too, within a week. As he did not get a reply within one week he sent another e-mail to the coordination office stating that he would file suit with the Administrative Court of Karlsruhe (Verwaltungsgericht Karlsruhe - VG Karlsruhe). The office replied that they believed that such a request might be unfounded or excessive and they could not provide any more information than what they did. On 03 August 2022, the data subject, hereinafter the plaintiff, filed suit with the VG Karlsruhe asking to obtain a non-redacted copy of the test he took under Article 15(3) GDPR, not to delete certain data about him and requesting access to other information about the testing procedure. As regards the test questions, he submitted that even though questions per se do not constitute personal data, the multiple choice answers he chose to tick do reflect his own choices and thus can constitute personal data. In its submissions, the test coordination centre, as a defendant, argued that it complied with the access request under Article 15(3) GDPR by providing the plaintiff with a copy of the test booklet
A data subject installed at the front door of his house a camera provided by a telecommunications service provider, the controller. After noticing that he no longer received e-mail notifications from the front door camera he contacted the controller and received different and contradictory information about the causes of system's malfunctioning in different occasions. On this basis, he suspected that his personal data had been leaked due to a ransomware attack and again contacted the controller about this. The data subject later found out that his account had been automatically blocked and the controller replied that this occurred because the account had been improperly used. The data subject was thus certain that he had been subject to a personal data breach, which the controller should have informed him about under Article 12 GDPR in a transparent manner. As a consequence, he believed that this violated his rights under several GDPR provisions, including Article 22 GDPR and filed a complaint with the Austrian DPA (DSB). However, due to a delay in the procedure, the data subject filed an appeal before the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG) as he claimed that the DSB failed to take a decision within the prescribed time limit. On the basis of the submissions of the parties, the BVwG first of all ascertained that there had been no unauthorised access to the data subject's data and that the controller had credibly demonstrated that there had been no hacker attack, hence there had been no violation of Article 12 GDPR, Article 5 GDPR and Article 34 GDPR. The BVwG instead determined that the blocking of the complainant's email account was set by an algorithm due to unusually high activity as an anti-spam measure. Effectively, the controller had submitted that it noticed a high number of e-mails were being sent from the data subject's account within a short period of time, and suspected a misuse of his account. As regards the s
The data subject owned a mobile home, which was permanently pitched at a campsite. Between 31 March 2021 and 4 November 2021, the Municipality of Oisterwijk's tax authority charged the data subject for municipal taxes of sewerage and commuter tax. The data subject objected to the taxes through the Municipality's objection procedure. The data subject founded his objection on GDPR grounds and made the following claims: (i) he made an Article 15 GDPR access request, (ii) claimed that the taxes were invalid as they were calculated through automated means, and invoked his right not to be subject to automated decision-making under Article 22 GDPR, and (iii) made an erasure request under Article 17 GDPR. On 22 March 2022, the Municipality responded to the data subject's objection and provided him with a copy of his data held by them, in the context of the calculation of the commuter and sewerage tax charges. The Municipality rejected the data subject's Articles 17 and 22 GDPR requests. The data subject objected to the Municipality's response and appealed it to the Court of East Brabant. The Court held that the Municipality was entitled to reject the data subject's erasure request (Article 17 GDPR) and their Article 22 GDPR claim. In relation to Article 17 GDPR, the Court held that the Municipality had a legitimate aim in retaining the data and assessing whether the data subject could be rightly classified as a taxable person. Moreover, the Municipality was legally obligated to retain the data under national administrative law (Article 17(3)(b) GDPR). On the issue of Article 22 GDPR, the Court held that the Municipality had adequately demonstrated that all automated tax calculations were subject to sufficient human intervention, and thus did not fall under the scope of Article 22 GDPR. Consequently, they were entitled to reject the data subject's Article 22 GDPR claim.
Criteo placed tracking cookies without obtaining prior user consent and continued to collect cookies even after users had refused consent.
Clearview AI Inc. – the controller – is an American company the scraps the internet and collects pictures of millions of people in order to offer access to an extensive database for facial recognition. Since 2020, Clearview’s only clients are law enforcement agencies in third countries, which use the services provided by the company to investigate and prevent crime. The controller has no establishment in the EU, nor in the UK. The controller was found in violation of several GDPR provisions and fined £7.5 million by the British DPA. The controller appealed the decision arguing that the processing fell outside the scope of the (UK) GDPR, as Clearview did not monitor the behaviour of people in the EU within the meaning of Article 3(2)(b) (UK) GDPR. Also, the controller claimed that the material scope of (UK) GDPR was not satisfied, as Article 2(2)(a) GDPR (Article 3(2A) UK GDPR) explicitly excludes processing in the context from the scope of EU law. As a matter of fact – the controller argued – its clients used the service for law enforcement purposes, that are not covered by the GDPR. In light of the above, the British DPA did not have jurisdiction in the case at issue. At the outset, the First-tier Tribunal examined the applicability of the (UK) GDPR in light of its territorial scope. The court noted that, for Article 3(2)(b) (UK) GDPR to apply, the processing activities shall be ‘related to’ the monitoring of the behaviour of people in the UK. According to the court – referring to the EDPB guidelines on Article 3 GDPR – monitoring requires ‘an element of targeting and intentionality’ and the existence of a specific purpose for collection and reuse of the data. ‘Behaviour’ – the court also clarifies – necessarily implies some kind of action by the data subject. In the present case, the controller did not directly monitor data subjects in the UK. However, its services were offered in the context of (‘related to’) the monitoring undertaken by law enforcement agenc
On 28.11.2019, the data subject received their regional government's administrative decision regarding the recognition of previous qualifications and their experience in becoming a mountain sports guide. On 12.02.2020, the controller attempted to challenge the decision and sent an email to further recipients besides the affected authority. They expressed their concerns and included unredacted parts of the administrative decision. On 18.12.2020. the data subject lodged a complaint with the Austrian DPA (DSB) regarding the violation of their right to confidentiality under [https://ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=13.07.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=b2435486-6818-41ec-a0f8-4150a50eb221 §1(1) DSG]. On 09.12.2021, the DPA partly confirmed the data subject's complaint, stating that the the email contained personal data of the data subject under Article 4(1) GDPR. The controller subsequently appealed against the DPA's decision on 05.01.2022, arguing that their actions were justified by legitimate interests in safeguarding professional standards and public safety pursuant to Article 6(1)(f) GDPR. Furthermore, only parts of the administrative decision were cited, thereby adhering to the principle of data minimisation under Article 5(1)(c) GDPR. First, the court held that the data subject had neither consented to the processing of their personal data nor was the processing in their vital interest under [https://ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Tit