GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
On 9 March 2023, a data subject asked the Arbeitsmarktservice (the public employment service), as a controller, to change their gender on the platform from “male” to “divers”. In this, the data subject also submitted an official document proving the change of gender entry in the civil register. On 15 March, the controller replied that it could not do so as it was impossible to with the software used. A few days later, the data subject filed a complaint with the Austrian DPA (DSB) claiming that their right to rectification under Article 16 GDPR had been violated. In its submissions, the controller stated that it was planning to implement a system allowing to change one’s gender on the platform, but this would only be available in June 2023, that is, still within the deadline of additional two months foreseen in Article 12(3) GDPR. The controller claimed that, once the technical changes will be implemented, it will proceed to change the data subject’s gender. The data subject submitted that the controller could have complied with their request by June 2023, if the controller would have informed the data subject about the additional time needed, even though the controller actually had enough time before that in order to duly adapt its technical system. Since the controller did not do that, but instead answered that they will not follow the request, Article 12(3) GDPR is not relevant. Later, however, the controller let the DSB know that it would take it even longer to adopt the technical implementations required to allow the data subject to change their gender on the platform. The DSB, however, suspended the proceedings on the basis of [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10005768&FassungVom=2017-07-12&Artikel=&Paragraf=38&Anlage=&Uebergangsrecht= Article 38 of the General Administrative Procedures Act (AVG)] until the CJEU delivers its judgment on the preliminary questions in case C-247/23, received on 18 April 2023, which concern
The controller in this case is the operator of the Berlin S-Bahn train network. Its trains are provided with CCTV cameras and the recorded data is saved for 48 hours and then automatically deleted unless requested by law enforcement authorities. A data subject visited a train of the controller on 6 October 2020 and on the same day sent an e-mail to the controller requesting access to the CCTV recordings of the train she was on and asked not to automatically delete the recordings after 48 hours. The controller refused to do so since, it claimed, it can only provide such data to law enforcement authorities. The data subject then complained to the Berlin DPA (Berliner Beauftragte für Datenschutz und Informationsfreiheit - BlnBDI), which issued a reprimand against the controller for violating the right to access of the data subject under Article 15 GDPR. Following the decision, the controller, hereinafter the plaintiff, appealed the decision by the Berlin DPA, as a defendant, before the Berlin Administrative Court (Verwaltungsgericht Berlin - VG Berlin). In its appeal, the plaintiff claimed, among others, first, that its video recordings do not constitute personal data under the GDPR as the individuals are not identifiable; secondly, that even if they were to be considered identifiable perosnal data, the effort to fulfill such requests is disproportionately high making also reference to Article 11(1) GDPR, which states that controllers are not required to process further information in order to comply with an access request. Through this legal action, the plaintiff sought the annulment of the reprimand and a court ruling stating that it is not obliged, in any case, to retain CCTV recordings for more than 48 hours and make them available to data subjects requesting access. The Berlin VG ruled, first of all that the plaintiff was not obliged to provide the data subject with the CCTV video recorings in question. The court recognised that the data included therein doe
In June 2019, A had sent a request to Hospital X containing 18 points in which she wanted her son's medical records to be amended or supplemented. In a letter to A dated July 8, 2019, the hospital complied with two of these points. The other requests for correction/supplementation were rejected. The County Governor also approved the hospitals decision. In November 2019, A complained to the Data Protection Authority. The complaint was extensive and concerned several different data controllers. This case concerns a claim for rectification of medical records at Hospital X. On April 26, 2021, the Data Protection Authority asked Hospital X to provide an account of the case processing at the hospital and the assessments that had been made in relation to the complainant's deletion and rectification claims. Hospital X provided an account in a letter dated May 21, 2021. On July 15, 2022, the Data Protection Authority concluded that Hospital X had fulfilled its obligation to rectify/supplement and closed the case. On August 21, 2022, A filed another complaint against the DPA's decision. The DPA considered the complaint, but found no grounds to change its decision. The DPA referred the case to the Data Protection Board on April 19, 2023. The Board upheld the DPA's decision. The conclusion is that the right to rectification was fulfilled by the hospital pursuant to Article 16 GDPR. Firstly, it follows from the Health Personnel Act that health-related assessments, including assessments of the accuracy of medical records, must be made by the health enterprise and possibly by the state administrator. It is the health personnel who perform the health care who are obliged to keep patient records and who must assess what is relevant and necessary information about the patient and the medical assistance, cf. sections 39 and 40 of the Health Personnel Act. In this case, the County Governor (now the State Administrator) has already upheld the hospital's assessment, cf. section 42 of
The appellant in the present proceeding was an association which used an algorithmic system to objectively calculate the reputation rating of the natural and legal persons who created a profile (the data subjects) on their platform. The case stems from an investigation the Italian DPA had conducted on the appellant. At the end of the investigation, the Garante prohibited under [https://www.garanteprivacy.it/codice Article 154(1)(d) of the Italian Privacy Code] the mentioned data processing operations due to a breach of [https://www.garanteprivacy.it/codice Articles 2, 3, 11, 23, 24 and 26 of the Code]. The DPA decision was appealed by the company and ended up before the Italian Supreme Court, for three reasons. First, the appellant claimed that the previous instance did not adhere to well-established Supreme Court case-law on consent. Second, it highlighted that the math scheme of the algorithm was already available in the EU Patent Registry and easily recognizable. Lastly, the violation and wrongful application of [https://www.gazzettaufficiale.it/anteprima/codici/codiceCivile Article 41 of the Civil Code], [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 8(2) of the European Charter for Fundamental Rights], [https://www.garanteprivacy.it/codice Articles 13, 23, 26 of the Italian Privacy Code], as applicable at the time of the facts, and Article 7(4) GDPR with regards to the protection of the principle of economic initiative. The Supreme Court stated that the first two claims of the appellant had to be considered together as they were interrelated. It noted that the previous court had ruled that data processing by an algorithmic system could be considered transparent when the data subjects knew how the algorithm worked. Regardless of the explanation, the Supreme Court focused on the lawfulness of the processing and found that it is necessary for the data processing carried out by an algorithm to be subject to consent. This means that the data subj
A data subject submitted a request to the controller, a credit agency, to delete personal data relating to her. The data in question referred to three debts in the amounts of around €24, €35 and €1,000 which she had paid off by the time the complaint was filed. The controller responded that it would not delete such data and submitted that its processing activities relate to credit data which is relevant for establishing creditworthiness of data subjects on the basis of Article 6(1)(f) GDPR, as it has a legitimate interest to provide third parties, whose activities entail a credit risk, with accurate credit data. For these third parties it is essential to consult the database provided by the controller, in order to be able to assess the payment behavior of their potential contractual partners, such as the data subject in this case. The controller claimed that it is important to keep data relating to, among others, unpaid bills in their database, as they significantly increase the chances of future default and thus constitute relevant credit data. For the sake of accuracy under Article 5(1)(d) GDPR, the controller submitted that it is important to also keep records of debts that have been paid off, in fact, if the controller were to delete data relating to already settled debts of the data subject, this would create a distorted picture of her creditworthiness. In this case, the data subject had been sent several reminders by creditors before she actually settled her debts, whereby the creditors had to put debt recovery measures in place and suffered temporary damages from the unpaid bills. In the present case, the debts had been settled in 2019 and 2020, after being left unpaid for about three years. On 5 August 2022, the data subject brought a complaint with the DSB following the refusal by the controller to delete credit data relating to her, claiming also that the controller failed to inform her that data relating to her credit history were being saved for up to
During the COVID-19 pandemic, the Czech Ministry of Health made access to premises and events dependent on certain conditions, such as vaccination or a negative test. The operators of several commercial activities were required to check the fulfilment of these conditions with regard to their clients by means of a specific app developed by the government. Operators were requested to scan the COVID certificate of clients and verify with the app that the certificate was valid. An action for annulment against the decree setting these rules was brought before an administrative court. The court referred some preliminary questions to the CJEU. In particular, the court aimed to know whether the conversion of personal data from a machine-readable form (the QR code on the COVID certificate) to a human-readable one (the information displayed on the app) could be considered processing of personal data pursuant to Article 4(2) GDPR. The CJEU stressed in the first place that the concept of ‘processing’ pursuant to Article 4(2) GDPR has a very broad meaning, which is necessary to guarantee the effectiveness of the right to data protection. The verification process in the case at issue fell within such a broad scope, as it requires the use of personal data. In addition, the CJEU noted how Regulation 2021/953 – as the piece of legislation establishing common rules about the ‘EU Digital COVID Certificate’ – explicitly provides a legal basis of the verification process under Articles 6(1)(c) and 9(2)(g) GDPR. Therefore. the scanning of COVID certificates by means of an app constitutes ‘processing’ of personal data pursuant to Article 4(2) GDPR.
The Finnish Motor Insurers' Centre (the controller) had asked the Administrative Court of Helsinki (the Court) to overturn the Finnish DPA's decision, according to which the controller had been fined €52,000 for processing and requesting unnecessary patient information from healthcare providers. The controller filed the appeal claiming that it could not determine in advance whether certain information was necessary to settle a claim. The controller considered that under [https://www.finlex.fi/fi/laki/ajantasa/2016/20160460#L7P82 Section 82 of the Finnish Motor Liability Insurance Act], various information could be considered necessary, and therefore it had to process information other than that directly related to the traffic accident. The controller argued that it must evaluate both facts in favour of liability for damages and facts directly or indirectly against it, as well as other information necessary to assess the credibility of the evidence. In the controller's view, healthcare professionals would not ultimately be in a position to assess the legal question of what information is necessary to settle a claim. The Court noted that much of the injured party's health data may be necessary to assess the contribution of another injury to the occurrence of the relevant injury. Consequently, other health-related information necessary to settle a claim may sometimes be needed long before the traffic accident. In this respect, the Court considered that the information relating to healthcare appointments must, in principle, be considered as information necessary to establish the causation of the injury in order to settle a claim. Thus, the tasks related to the assessment of the claim belong to the core tasks of the insurance company and cannot be transferred, even partially, to the responsibility of the healthcare provider. The Court stated that the investigation carried out by the DPA could not be considered sufficient to prove that the controller had systematically
On 15 May 2023, a data subject filed an access request via e-mail to a controller, the operator of a gambling website, in accordance with Article 15 GDPR. Unsatisfied with the response by the controller, the data subject filed a complaint with the Austrian DPA (DSB). The DSB, however, issued a decision stating that it suspended proceedings against the controller until the lead supervisory authority in the case had decided. According to the DSB, the object of the complaint referred to a matter of competence of the authority in which the controller had its main establishment under Article 56(1) GDPR, which, in the case was the Maltese DPA. The DSB held that in such circumstances it is obliged under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 Article 24 of the Austrian Data Protection Law (Datenschutzgesetz - DSG)] to suspend the complaint procedure. The data subject instead was of the opinion that the DSB should have dealt with the case as the requirement of Article 56(2) GDPR was met. In fact, the complaint in this case substantially affected only data subjects in Austria. Also, the data subject argued that neither [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 Article 24(10) DSG] nor [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10005768&FassungVom=2017-07-12&Artikel=&Paragraf=38&Anlage=&Uebergangsrecht= Article 38 of the General Administrative Procedures Act (AVG)] provided for a legal basis for suspending proceedings. For these reasons, the data subject appealed the decision of the DSB before the Federal Administrative Court of Austria (Bundesverwaltungsgericht - BVwG). First of all, the BVwG clarified that the case clearly dealt with cross-border processing activities. The BVwG then reiterated that the handling of cross-border complaints involves three main steps: first, the roles of different authorities as concerned or lead supervisor
On 05.09.2019, the Austrian DPA (DSB) notified the controller of a customer loyalty program that they were initiating an ex officio investigation. The controller responded by answering the provided questionnaire and submitting further documents. On 23.10.2019, the DPA ruled that the investigation was justified and that the declaration of consent for profiling using certain registration methods (website, app, partner company store, flyer) did not comply with the requirements of Article 4(11) GDPR and Article 7 GDPR, nor were they provided in an intelligible way. If a contract covers several aspects, the declaration of consent must be clearly distinguishable. Regarding the website and flyer, the following was found: The website says 'Enjoy your personal benefits' without providing clear information that 'personal benefits' involves profiling. In an embedded box, the relevant points were merely referred to. Information regarding profiling was only accessible by scrolling down further. Concerning the flyer, the following information was provided under the signature field: 'This signature only applies to the declaration of consent and is voluntary. Your registration [...] is also valid without a signature.' Thus, it conveyed the impression that a signature was required to confirm the registration. Consequently, the controller was required to amend the declaration and to cease using any obtained consents for the purpose of profiling prior to 01.05.2020. The controller lodged a complaint. In addition to other information, the controller stated that the data processing was in accordance with Article 6(1)(a) GDPR, and that they had a legitimate interest under Article 6(1)(f) GDPR. The DPA ruled a preliminary decision on the complaint, thereby changing the ruling that the website and flyer did not meet the requirements under Article 6(1)(a) GDPR, and thus, the processing of personal data, collected in that cases, was forbidden. The other methods ensured that the consent was
The case focused on billing disputes and data retention obligations, not related to cookies or consent.
The data subject is contesting the validity of insurance premium increases in his private health insurance. He has filed a lawsuit demanding that the controller (defendant insurer) provide information about all premium increases from 2013 to 2016. This includes submitting documents that detail the amount of each increase, the specific tariffs involved, the letters sent to him with explanations, the amendments to the insurance policy, and the accompanying leaflets. This request is part of a step-by-step legal action in which he also seeks a declaration that the specified increases are invalid and the payment of an amount to be determined after the information is provided. The LG Gießen dismissed the lawsuit, but the OLG Frankfurt ruled in favor of the plaintiff, ordering the defendant to provide the requested information. The defendant has appealed this decision. The appeal is partially successful, resulting in the overturning of the OLG Frankfurt's decision concerning the information claim. According to the principle of good faith and fair dealing, an insurance policyholder may be entitled to information about past premium adjustments. To establish this right, it must first be shown that the policyholder could still have refund claims from previous premium increases if those increases were invalid, forming the basis for the request. Additionally, the policyholder must no longer have the relevant documents and be unable to reasonably obtain the necessary information independently. If these conditions are met, a determination must be made, taking into account the reasons for the loss of documents, whether the policyholder is justifiably uncertain about their rights. The policyholder must present and prove these relevant circumstances. However, a claim to a copy of the entire explanation letters and attachments cannot be derived from Article 15(1), (3) GDPR, as neither the letters themselves nor the attached documents in their entirety are considered personal data of
On 22 February 2019, a data subject submitted an access request to the controller, a logistics and postal service provider acting in its capacity as an address publisher and direct marketing company, that initially did not answer his request at all. Against this background, the data subject filed a complaint with the DSB. After hearing the controller, the DSB established that it did reply to the access request and it considered the complaint to be without object. In response to this, the data subject claimed that such answer was incomplete, as it did not receive information about the data recipients and of the existence of profiling. The DSB thus considered the complaint anew, as the claimed infringement changed to incomplete provision of information under Article 15 GDPR. In its submissions, the controller held that it did provide information about the categories of recipients and it did not inform the data subject about profiling, as it did not carry out such activities. The DSB partially admitted the complaint, holding that the controller infringed the data subject’s right to access as it did not provide sufficient information as to the data recipients, without explaining why providing such information would affect her protected interest as an address publisher. It also held that the controller failed to provide meaningful information about the logic involved and the scope and effects of processing according to Article 15(1)(h) GDPR as regards the marketing classification, which is to be considered “profiling” under Article 4(4) GDPR. The DSB thus ordered the controller to duly inform the data subject about the above mentioned within a period of four weeks. The controller still believed the information it provided to be complete, since it lawfully chose to provide information about the categories of recipients and not the recipients themselves and it considered that marketing classifications do not constitute personal data and that it did not carry out profil
In 2020, the Norwegian Consumer Council (NCC), with the assistance of noyb’s legal analysis, filed a complaint to the Norwegian Data Protection Authority against the dating app Grindr. The Norwegian DPA fined Grindr NOK 65 million for failing to collect users' valid consent for sharing data with third parties for profiling and advertising purposes from the Grindr App (Datatilsynet - 20/02136-18). This decision was appealed by Grindr in February 2022. They argued that; Grindr does not process special categories of data, had obtained valid consent, that there was no legal basis for imposing a fine and that the DPA has misinterpreted Article 83 GDPR when applying the fine. The Norweigen DPA re-considered the case but found no reason to change its decision. The DPA submitted the case to the Norwegian Privacy Appeals Board (Personvernnemnda) in December 2022. Both Grindr and the NCC were given the opportunity to submit comments. In August 2023, Grindr requested the right to attend and speak during the case under [https://lovdata.no/dokument/LTI/forskrift/2018-06-15-876 section 5(5) of the Regulations on the processing of personal data,] and requested that the Board's consideration of the case be postponed until the Court of Justice had ruled on cases [https://curia.europa.eu/juris/fiche.jsf?id=C%3B446%3B21%3BRP%3B1%3BP%3B1%3BC2021%2F0446%2FP&nat=or&mat=or&pcs=Oor&jur=C%2CT%2CF&num=C-446&for=&jge=&dates=&language=en&pro=&cit=none%252CC%252CCJ%252CR%252C2008E%252C%252C%252C%252C%252C%252C%252C%252C%252C%252Ctrue%252Cfalse%252Cfalse&oqp=&td=%3BALL&avg=&lgrec=en&lg=&cid=3298842 C-446/21 Schrems v Facebook Ireland] and [https://curia.europa.eu/juris/liste.jsf?nat=or&mat=or&pcs=Oor&jur=C%2CT%2CF&num=C-21%252F23&for=&jge=&dates=&language=en&pro=&cit=none%252CC%252CCJ%252CR%252C2008E%252C%252C%252C%252C%252C%252C%252C%252C%252C%252Ctrue%252Cfalse%252Cfalse&oqp=&td=%3BALL&avg=&lgrec=en&lg=&page=1&cid=3099852 C-21/23 Lindenapotheke] which at the time were both prelimary refer
An individual (“appellant”) made a request to their local council (Doncaster Metropolitan Borough Council - “controller”) under the Freedom of Information Act 2000 (“FOIA”) seeking information on the individual who was responsible for drawing a proposed cycle route. The controller rejected the request for information pursuant to section 40(2) FOIA, stating that the disclosure of information would contravene one of the data protection principles as the employee had not consented to the disclosure and the data would not have been processed in a fair and lawful way pursuant to Article 5(1)(a) GDPR. The appellant sought to argue that the name of the individual who created the public drawing was not considered personal data per Article 4(1) GDPR. The Tribunal held that the controller was correct to rely on the exemption provided in section 40(2) FOIA. Per the Tribunal, a disclosure of personal data following a FOIA request for information would be transmission, dissemination or otherwise making it available and is therefore processing for the purposes of Article 4(2) GDPR. Responses to requests for information under FOIA are published and, as such, are available for the whole world to view; they would not be exclusive to the appellant. To be lawful in accordance with Article 5(1) GDPR, publication must be necessary in the pursuit of the legitimate interest. In Goldsmith International Business School -v- The Information Commissioner and the Home Office [2014] UKUT 563 (ACC); (a) “necessary” means being more than desirable but less than indispensable or absolute necessity and can be summarised as “reasonably necessary”, (b) the test for necessity must be satisfied before consideration of whether the interests or fundamental rights or freedoms of the data subject should override the necessary disclosure and (c) the test of reasonable necessity itself involves the consideration of alternative measures and so a measure would not be necessary if the legitimate aim could
On 16 July 2021, the controller, the Institute for Employee Insurance, a public body, informed the data subject of a data breach. Five letters meant for the data subject were sent to the the wrong address. After a complaint made by the data subject to the controller, the controller offered €250 in compensation. The data subject did not agree with the amount offered and demanded €3000. In addition, she made an access request under Article 15. The controller rejected the claim of €3000. The data subject then appealed the controller's rejection of their initial claim and made another claim for compensation under Article 8:88 AWB to the controller as a public administrative body. Article 8:88 AWB provides that "the administrative court is entitled, at the request of an interested party, to order an administrative body to compensation for damage suffered or will suffer by the interested party." The controller rejected the data subject's claim under Article 8:88 AWB. The controller argued that Article 8:88 AWB did not apply to it because the matter involved sending letters to the wrong address, was a factual action, not a formal decision with legal implications for the purposes of Article 8:88 AWB. The data subject appealed this to the Administrative Court of Den Haag. The Court treated the data subject's case as a request for compensation under Article 8:88 Awb in connection with Article 82 GDPR. The Court made an order under Article 8:88 AWB ordering the Institute for Employee Insurance to compensate the data subject for the data breach. However, the calculation of the amount to be paid was based on Article 82 GDPR. The Court determined that for the purposes of non-material damages under Article 82 GDPR, a compensatory amount of €500 was fair and appropriate. The Court considered the psychological impact of the data breach on the data subject, but noted that the five letters were returned in sealed envelopes and there was no evidence of third-party use.
A data subject had submitted an access request to the Board of Public Prosecutor’s office seeking to obtain information about any personal data about him being processed by the Board. The Board, as a defendant, treated his request as a general access request under Article 15 GDPR and [https://wetten.overheid.nl/BWBR0014194/2023-11-01 Article 39(i) Judicial and Criminal Records Act (Wet justitiële en strafvorderlijke gegevens - WJSG]). Under [https://wetten.overheid.nl/BWBR0014194/2023-11-01 Article 39(i) of the WJSG], data subjects have the right to request the Board to obtain confirmation as to whether criminal records about them is being processed and, if so, to obtain information about the processing thereof. On 31 August 2022, the Board thus provided the data subject with two separate documents, one regarding the criminal records about him that were being processed under the WJSG and the other containing all other personal data about him being processed under the GDPR. The data subject, the plaintiff claimed that the response was incomplete. The defendant thus asked him to substantiate his request and the data subject answered that he wished to receive all data concerning him that was being processed. The defendant then added additional personal data and criminal records of the plaintiff that were found in its database. Still unsatisfied with the response, the plaintiff appealed against the judgment. The court issued its final judgment on 20 September 2023 and held that, since the access request by the data subject was drafted in general terms and had a broad scope, the defendant correctly replied with a general overview of the personal data and criminal records about him being processed. The plaintiff objected to this response and the defendant asked him to specify his request in line with Recital 63 GDPR. As the plaintiff again answered in general terms, claiming he requested access to all his personal data, the court held that the defendant was right in r
The Plaintiff submitted an application for the disclosure of reports on incidents involving biological agents to the controller, the Dutch Ministry of Social Affairs and Employment. On 6 December 2021, the defendant partially upheld the claim but only disclosed some information and withheld parts of the information in the eight documents submitted. In particular certain personal data and environmental information. The controller withheld data because the personal data concerned data relating to the health of the data subjects, which, in combination with information from other sources, made the data subjects identifiable. The reason for refusal to disclose was founded on [https://wetten.overheid.nl/BWBR0005252/2018-07-28 Articles 10 and 11 of the Dutch Government Information Act (Wob)], which says that information in the hands of Public authorities is generally public, except if it is contrary to overriding interest, in the sense of Article 9(1) GDPR. Health data, in particular, can constitute a particularly serious violation of fundamental rights, such as privacy rights, as Article 9(1) GDPR states. The controller also conceded that personal data (information on biological agents) was excluded from the disclosure, in line with the European Directive on Public Access to Environmental Information 2003/4/EC. The directive guarantees public access to environmental information held by or for public authorities, both upon request and through active dissemination. This was further implemented in [https://wetten.overheid.nl/BWBR0005252/2018-07-28 Article 10(4) Wob], which provides for an exemption for the publication of personal data if it concerns "environmental information on emissions into the environment”. However, according to the controller's opinion, biological agents are not emissions, and, therefore, they do not fall under the definition of "environmental information". The Court held the hearing on the matter on 7 August 2023, and its decision followed on 18 Septe
The data subject had been receiving unemployment benefits from NAV, the Norwegian Labour and Welfare Administration (the controller) since autumn 2015. With a decision of 2 October 2015, the controller suspended benefits to the data subject as he stated that he was in education, thus no longer entitled to receive them. Later, the data subject submitted more information stating that he was not an active student and the controller reassessed the case and started granting him benefits again from 30 November 2015. On 17 March 2016, the controller issued a new decision reversing its October 2015 decision to suspend benefits, so that the data subject was granted unemployment benefits also for the period of suspension. In relation to this, the data subject requested the controller to obtain access to his personal data and to rectify inaccurate data about him, namely the fact that he was in education or training while also receiving benefits, as stated in the decision of suspension of benefits of October 2015. On 26 May 2021, the controller refused to comply with the request for rectification of the data included in its decision of October 2015 as it added a note in that document referring to its corrected decision of March 2016. The data subject filed a complaint with the Norwegian DPA on 6 June 2021 asking the DPA to order the controller to provide him with all documents including his personal data and rectify inaccurate data about him and to assess any other GDPR violations by the controller. On 14 December 2021, the Norwegian DPA held that the controller could not comply with the data subject’s request to rectification/completion of his data according with Article 16 GDPR as the information was not per se incorrect and thus the first condition under Article 16 GDPR was not met. Given that the controller added a note to its decision of 2 October 2015 referring to its corrected decision of March 2016, it thus fulfilled the complainant’s request of rectification of
During an ongoing dispute at a Norwegian Court of Appeal regarding the award of occupational injury insurance between a complainant and an insurance company (the data controller), the latter forwarded some of the complainant's health information to an external psychiatrist as a private expert. However, in its judgment of 7 January 2022, the Court of Appeal did not find it necessary to give decisive weight to the private expert's assessment and disregarded it. On 22 November 2021, the Norwegian DPA received an enquiry from the complainant who argued that the data controller's disclosure to the private expert resulted in a breach of the GDPR. However, on 5 September 2022, the DPA dismissed the complaint because it concerned the processing of personal data that falls outside the scope of the Norwegian Personal Data Act under section 2, second paragraph, letter b, meaning that the DPA did not have any authority on the process, pursuant to Article 55 GDPR and [https://lovdata.no/dokument/NLE/lov/2018-06-15-38 section 20 of the Personal Data Act]. On 26 September 2022, the complainant filed a timely complaint against this decision and on 30 January 2023, the case was submitted to the Norwegian Privacy Appeals Board, which, on 15 September 2023, considered whether the insurance company's transmission of the case documents containing the complainant's health information to a privately engaged expert, in connection with the processing of a civil case before the Court of Appeal, falls outside the scope of the Norwegian Personal Data Act. The Norwegian Privacy Appeals Board noted that the present case fell within an exception of the Norwegian Personal Data Act. Accordingly, the Act shall not apply to cases decided pursuant to Norwegian Administration of Justice laws, such as the Dispute Act, as they provide sufficient safeguards for privacy. Regarding the complaint, the Norwegian Privacy Appeals Board observed that the processing of the complainant's personal data during the
In the present case, the data subject had made an application after the six-week time limit laid down in Article 35(2) UAVG. The facts are as follows. The data subject had taken out a student loan in 2002, and consequently, the details of it were registered in the Dutch Central Credit Registration Office (BKR). This body keeps records of private parties that have taken out credit. In early 2018, the data subject had applied for a loan and was denied due to the financial records on their credit history kept by the BKR. On 27 June 2018, the data subject submitted an objection to processing (Article 21 GDPR) to BKR. By a letter dated 23 July 2018, BKR responded in the negative, refusing to comply with the objection. On 30 October 2018, the data subject made a request to the court to order the controller to comply with the request made under Article 21 GDPR. The Court at first instance dismissed the application because it fell outwith the 6-week time limit under Article 35 UAVG. The data subject appealed this decision. The main question brought before the Court was whether it was possible to raise an objection to the procesing of personal data in summary proceedings following the six-week time limit set out by Article 35(2) of the UAVG (Uitvoeringswet Algemene Verordening Gegevensbescherming). The UAVG is the Dutch national transposition of the GDPR. Article 35 UAVG implements Article 79 GDPR, and provides: "1. If the decision on a request as referred to in Article 34 has been taken by a body other than an administrative body, the interested party may apply to the court with a written request to order the controller to comply with the request referred to in Articles 15 to 22 of the Regulation. 2. The application shall be made within six weeks of receipt of the answer from the controller. If the controller has not replied within the time limits referred to in Article 12, paragraph 3 of the Regulation, the submission of the application shall not be subject to a period." O