GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
On 10 June 2021, the Italian DPA issued a €2,600,000 fine against the defendant, a delivery company, for unlawfully processing personal data of platform workers. The defendant appealed this decision to the Ordinary Court (Court). The Court annulled the decision of the DPA because although the decision was legitimate in terms of the violation found, the DPA's decision of the sanction was not. The Court found that the fine imposed by the DPA amounted to 7.29% of the defendant's turnover - significantly higher than the 4% parameter mentioned in Article 83(5)(a) GDPR and even higher than the average percentage (0.0019%) applied by the DPA to other sanctioned entities. Thus, the Court annulled the decision, without, however, modifying the amount of the sanction as the Court stated to not have this power under [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2011-09-01;150~art6 Article 10 of Legislative Decree No 150 of 2011]. The Italian DPA appealed this decision to the Italian Supreme Court. The main issue addressed by the Italian Supreme Court and brought by the DPA is the infringement or misapplication of Article 83 GDPR and [https://garanteprivacy.it/web/guest/codice Article 166 of the Italian Privacy Code], given that the sanction imposed was compliant with the provisions. The Supreme Court reiterated that Article 83 GDPR regulates the general conditions for imposing administrative sanctions, and each supervisory authority shall ensure that the administrative fines imposed are ‘in each individual case’ effective, proportionate and dissuasive. To be determined based on certain elements listed in Article 83(2) GDPR. The Supreme Court further noted that in the case of an intentional or negligent breach of several provisions of the GDPR, Article 83(3) GDPR requires that the maximum penalty shall not exceed ‘the amount specified for the gravest infringement’. In this perspective, the amount is set out in paragraphs 4 and 5 of Article 83 GDPR.
This case concerns a request for a preliminary ruling regarding the interpretation of [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 50 of the Charter of Fundamental Rights of the European Union,] Article 54 of the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A42000A0922%2802%29 Convention implementing the Schengen Agreement,] and provisions of [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2005:149:0022:0039:en:PDF Directive 2005/29/EC.] The Autorità Garante della Concorrenza e del Mercato (Italy's Competition and Markets Authority, AGCM) imposed a fine of €5,000,000 on Volkswagen Group Italia SpA (VWGI) and Volkswagen Aktiengesellschaft (VWAG) for unfair commercial practices. The companies marketed diesel vehicles in Italy from 2009 with software installed that distorted emission levels during pollution tests. VWGI and VWAG were accused of misleadingly promoting these vehicles as environmentally friendly. VWGI and VWAG challenged the AGCM's decision in Italian courts. While this action was ongoing, the German Public Prosecutor's Office imposed a €1,000,000,000 fine on VWAG for manipulating exhaust gas emissions in certain diesel engines. Part of this fine, €5,000,000, pertained to the conduct also addressed in the Italian proceedings. The German decision became final before the Italian decision. VWGI and VWAG argued that the principle of ne bis in idem (not being tried or punished twice for the same offence) as enshrined in Article 50 of the Charter of Fundamental Rights should prevent the Italian fine from being upheld. The court outlined when a fine could be considered criminal in nature in relation to unfair commercial practices. While the court does not directly mention the GDPR, this decision is relevant for GDPR fines. The court ruled that an administrative fine would be criminal in nature if three criteria apply [at paragraph 45]: Firstly, the legal classification of the offence under domestic law is irreleva
The Lithuanian Prosecutor General´s Office investigated one of its public prosecutors, who was found responsible of misconduct in its office. The research into the public prosecutor´s misconduct was authorised by a court order, allowing for the interception and recording of data transmitted over electronic communication. Following these findings, the Prosecutor General´s Office dismissed the public prosecutor from office. The public prosecutor contested the decision before the [https://administracinis.teismas.lt/ Regional Administrative Court (Vilniaus apygardos administracinis teisma)], which dismissed the claim due to the lawfulness of the criminal intelligence operations and process behind the data gathered. The controller then appealed the case to the [https://www.lvat.lt/ Supreme Administrative Court (Lietuvos vyriausiasis administracinis teisma)], as he alleged that the access by intelligence bodies to traffic data and actual content of electronic communications was such a serious interference with fundamental rights that access could only be granted to combat serious crime. The Supreme Administrative Court considered it apparent that [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 15(1) ePrivacy Directive 2002/58/EC], together with [https://eur-lex.europa.eu/eli/dir/2002/58/oj/eng Article 3]ePrivacy Directive 2002/58/EC thereof, extends the scope of that directive only to legislative measures requiring providers of electronic communications services to grant the competent national authorities access to data (as found in C-623/17 Privacy International). Moreover, it follows from [https://curia.europa.eu/juris/document/document.jsf?text=&docid=238381&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=22564108 C-746/18 Prokuratuur], that only actions to combat serious crime and measures to prevent serious threats to public security are capable of justifying serious interference with [https://eur-lex.europa.eu/eli/treaty/char_2012/oj Article 7
The data subject concluded a contract with an app operator (the controller) in 2017 for the use of a health and fitness app, which she used until 2021. The data subject submitted a request for a transfer of her training data from 2020 in a structured, commonly used and machine-readable format by virtue of Article 20 GDPR. The controller refused to do so because her request referred to an outdated version of the app which had been discontinued in the meantime, that is, the data were no longer synchronised to the servers of the controller and were only locally saved and processed on the data subject's device. Yet, the old app could still be used locally, hence, data processing only took place on the users' devices but the controller did not have access to the data and could thus not process them. Furthermore, users could access and download all of their training and health data from the website of the controlller, which the data subject did. The users were notified of this change in a sufficient way. However, the data subject argued that she had not been properly informed of the changes regarding the processing and, as a layperson, she could not have known the difference. Furthermore, she pointed out that the "raw data" provided was not useable for the average user and that the controller kept processing her personal data because her contract with the controller had never been amended nor terminated. The Austrian DPA (DSB) dismissed the complaint based on the fact that essentially no data was processed by the controller between 2020 and 2021 and thus Article 20 GDPR could not apply. Dissatisfied with the DSB's decision, the data subject filed an appeal with the BVwG, restating the arguments she had broguht before the DSB. The BVwG held that after the date of the discontinuation, the data subject's training data was no longer saved and processed on the servers of the controller and data processing only continued on the device of the data subject through her own acti
On 15 June 2020, a USB-stick containing a set of documents, including internal information of a company, was anonymoulsy sent to the Austrian DPA (Datenschutzbehörde - DSB) . The DPA thus started an ex officio investigation and concluded, by decision of 6 November 2021, that the controller, as head of the company, failed to meet security requirements as it saved personal data on a private and unsafe device. Upon learning about the decision, the controller appealed the latter to the Austrian Federal Administrative Court (BVwG), stating, amongst other things, that the DPA was not allowed to start such a procedure against the controller and the decision lacked a reasonable motivation. The controller also submitted that the DPA failed to take into account the fact that the USB-stick had actually been stolen by an employee of the controller. On its part, the DPA claimed that the appeal should be rejected by the Court. The Court considered the appeal to be admissible and held that it cannot be inferred from Article 58 GDPR that competent supervisory authorities may adopt declaratory statements on the unlawfulness of processing activities on the basis of an ex officio investigation. In its decision, the Court referred to the a judgment by the Supreme Administrative Court of Austria (Verwaltungsgerichtshof – VwGH) in case Ro 2020/04/0032-8, and held that Article 58 GDPR does not contain an explicit legal basis for such decisions to be issued. In particular, the Court stressed the fact that according to [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 Article 24 of the Austrian Data Protection Law (Datenschutzgesetz - DSG]), the DPA is only specifically allowed to issue declaratory statements on the infringement of a data protection provision on the basis of a complaint. Consequently, this is not possible in the case of an ex officio investigation by the DPA. In light of this, the Court held that the appeal should be upheld sinc
The data subjects in this case are co-owners of a property with two residential units with a total of six residents. A water meter was installed inside their house in order to record the property's total water consumption. The calibration validity of the water meter expired in 2020. The controller is a municipal special purpose association that operates a public water supply system. The association committee decided in 2019 to replace installed analog water meters with electronic water meters equipped with radio modules - which can be read remotely. This should have taken place in 2021 as part of the regular exchange of water meters. The municipal special purpose association informed the complainants about the expiration of the calibration period and the intended replacement of the water meter. The data subjects denied access to their property and objected to the installation of an electronic water meter with a radio module, making reference to their right to objection under Article 21(1) GDPR. With a notice, the controller obliged the data subjects to grant one of his employees access to the water meter, stating that in case of non-fulfillment they would impose a fine. The controller submitted that, among others, the requirements for an objection under the GDPR were not given in this case. The data subjects, however, continued to refuse access to their property and filed a lawsuit against the controller's decision for violation of their fundamental and privacy rights. The Administrative Court Bayreuth (VG Bayreuth) held that the notice of the municipal special purpose association was based on the statutes governing the public water supply facility. The installation of electronic water meters did not violate their fundamental rights to informational self-determination or to inviolability of the home, included in the Constitution of the Federal Republic of Germany. It also did not violate the provisions of the GDPR. For these reasons, the VG dismissed the case. Co
The plaintiff in this case is a German Consumer Protection Association (Verbraucherzentrale Bundesverband e.V.), while the defendant is LinkedIn Ireland Unlimited Company, an Irish social media company operating throughout the EU and worldwide. The plaintiff found that the website of the defendant makes use of cookies and other technologies like fingerprinting that automatically process personal data and monitor users behavior for analytics and marketing purposes. In its privacy notice of 2018, the defendant clearly stated that it ignores “do not track” (DNT) signals on its users’ browsers. DNTs are a browser setting that users can decide to activate, to request websites not to track their online activities. The defendant claimed it would not react to DNT signals, as there was no established “DNT standard” yet. Firstly, the plaintiff claimed that the use of DNT signals constitutes an expression of the right to objection of users under Article 21(5) GDPR against processing activities carried out for marketing purposes under Article 6(1)(f) GDPR, and that the defendant should stop ignoring such signals as doing so constitutes an unfair commercial practice. Secondly, the plaintiff found that when a user decides to first set up a LinkedIn account, the “off-LinkedIn visibility” option is usually pre-activated, which means that personal data of users is shown on the defendant’s partner websites. This, according to the plaintiff constituted a violation of Article 6(1)(a) GDPR, Article 25(2) GDPR, third sentence and Article 4(11) GDPR as well as provisions of the German Federal Law against deceptive commercial practices ([https://www.gesetze-im-internet.de/uwg_2004/ Bundesgesetz gegen unlauteren Wettbewerb, UWG]). Further, the plaintiff asserted in this respect that the defendant wrongfully relied on Article 6(1)(f) GDPR as a legal basis and acted contrary to Article 5(1)(a) GDPR and Article 5(1)(c) GDPR. After the defendant rejected the plaintiff’s warning letter, the p
In occasion of a hunting event, a data subject noticed that another person, the controller, took pictures and videos of him without his consent. Although the data subject clearly and specifically asked the controller to stop taking pictures of him, he kept photographing and recording him. The controller is an activist and deputy-chairman of an animal protection organization and had been publishing contents relating to hunting gatherings on the internet and social media platforms, which, according to the data subject, constitute unlawful processing of personal data. After the above-mentioned episode, the data subject made an access request under Article 15 GDPR by post, but the controller never replied. According to the data subject this constituted a violation of his right to privacy, in particular, he claimed that by taking and publishing pictures and videos of individuals without their consent, the controller violated Article 13 GDPR, Article 6 GDPR, Article 9 GDPR and Article 15 GDPR. The data subject thus filed a complaint with the Austrian DPA on 08 January 2019. In his submissions, the controller stated that he has been involved in the documentation of hunting events, specifically pheasant hunting ones, as in this case, to gather enough material in order to show how these animals are being hunted and to spread this information with the public. This material is then published online and would also be used for a press conference on the topic later that year. In this, he claimed to pursue journalistic purposes as a citizen journalist and thus fall under the protection of [https://ris.bka.gv.at/eli/bgbl/i/1999/165/A2P9/NOR40201397?ResultFunctionToken=0772c7e4-9cc1-4ff5-8299-e949f7c1a139&Position=1&SkipToDocumentPage=True&Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=30.10.2023&VonInkrafttretedatum=&BisInkraft
A data subject bought a TV and a wall mount from an electronics shop (the controller) and, upon returning the wall mount, she received the price of the TV back, which was more expensive. After acknowledging the mistake, one employee tried to contact her autonomously using her private Facebook account via Facebook Messenger, which is not a common practice of the controller. After unsuccessfully asking the controller to provide her with information regarding the employees who contacted her, the data subject filed a first-instance application with the Local Court of Bühl (Amtsgericht Bühl - AG Bühl). Among others, the data subject sought an injunction to obtain information on which employees (name and surname) of the controller had been given access to her personal data and to prohibit those employees to further use her personal data. The AG Bühl held that employees cannot be seen as ‘recepients’ according to Article 15 GDPR, and thus the data subject does not have a right to obtain from the controller information about their identity. The AG Bühl thus dismissed the action and the data subject appealed the decision to the LG Baden-Baden. The LG Baden-Baden, making reference to the CJEU Judgment in CJEU - C-579/21 - Pankki S, acknowledged that employees of a data controller cannot, in principle, be regarded as recipients under Article 4(9) GDPR. However, this only applies when employees process data under the supervision and following instructions of the employer. In the case at hand, the employee acted in her private capacity, thus outside the supervision of the employer and contravening its instructions. For this reason, the LG Baden-Baden held that the employee who privately contacted the data subject should be seen as a ‘recepient’ under Article 4(9) GDPR. Therefore, the data subject has a right to obtain from the controller information about the recipient (i.e. the employee’s name and surname) according to Article 15(1)(c), in particular, insofar as this informa
The data subject filed a complaint against the controller for the unnecessary storage of payment data. The data subject claimed that data were outdated and no longer useful to check their creditworthiness. The Austrian DPA held that storage was excessive and contrary to the GDPR. The controller appealed the decision, pointing out to have meanwhile erased data. This was, according to the controller, not on the basis of a legal obligation, but as a spontaneous gesture of good will. The Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG) upheld the controller’s appeal. According to the court, in lack of a law stating the contrary, a judge should assess the existence of a violation with regard to the time of the adoption of their decision. The court pointed out that § 24(6) of the Austrian Data Protection Law (Datenschutzgesetz – DSG) enables controllers to remedy to violations during proceedings before the DPA. The court stressed that such a national provision is not contrary to the GDPR. As matter of fact, Article 58 GDPR does not provide the DPAs with any power to adopt declaratory binding decisions about the existence of certain violations. What Article 58(6) GDPR does is exclusively to enable Member States to confer additional powers to the DPAs under national law. Austria decided to implement this provision by giving its DPA the power to ascertain the existence of ongoing violations, not violations that occurred in the past. In light of the above, the court invalidated the DPA’s decision.
The controller in this case is the owner of an online shop selling PC software, computer accessories and other items. On 29 June 2022, a data subject ordered €77 worth of items but did not make the payment. For this reason, the controller sought to engage a debt collection agency to enforce the payment, unsuccessfully. Hence the controller sued the data subject before the District Court of Düsseldorf (Amtsgericht Düsseldorf -AG Düsseldorf). In the course of the same procedure, the data subject asked the controller to obtain access to his personal data pursuant to Article 15 GDPR and to receive a copy of his data under Article 15(3) GDPR. The controller did not fulfil the request of the data subject, who filed a counterclaim in order to obtain access to his personal data. The controller submitted that it could not respond to the access request, because the data subject failed to prove his identity and it also claimed that the counterclaim constituted an abuse of right by the data subject. The data subject, thus asked the court to order the controller to comply with his request under Article 15 GDPR and to award him damages in the amount of at least €1,000 pursuant to Article 82 GDPR. As regards the counterclaim of the data subject, the AG Düsseldorf held that the controller had no legitimate reason to refuse to comply with his access request. The court clarified that the controller could not rely on the fact that the data subject failed to prove his identity. As a matter of fact, the court held that a controller may only ask for identification under Article 12(6) GDPR if there are reasonable doubts about the identity of the data subject, which could not be proven in this case. Hence, the court held that the controller violated Article 15 GDPR and this gave rise to a right to compensation for non-material damages under Article 82(1) GDPR. In calculating the amount of immaterial damages due, the court held that this should not depend on how economically powe
The data subject’s home was photographed in 2012 for the purposes of a tax valuation, under the Property Valuation Act. The photographs were initially processed lawfully (for tax valuation), but then afterwards put in a database and used for other purposes. The Municipal Executive of Breda (the controller) held these photographs and initially was the body responsible for tax valuations. In 2019, the Municipal Executive of Breda transferred these responsibilities to the West Brabant Tax Authority of Breda, which then became the competent public body for handling tax valuations in Breda. On 26 April 2020, the data subject (appellant) requested the Municipal Executive of Breda (the controller) to erase the photographs from their internal database. The photographs were focused on the architectural features of the home and the overall state of the property. However, from these photographs, the data subject’s license plate could be seen, as well as framed family photographs in the home. On 15 May 2020, the Municipal Executive of Breda refused to erase the photographs, because the database that they were held in was transferred to the West Brabant Tax Authority of Breda and erased from the Municipal Executive’s systems. The data subject objected to the Municipal Executive’s refusal and made a formal complaint against the Municipal Executive’s decision through its internal disputes system. On 24 November 2020, the Municipal Executive declared the claim unfounded and rejected the data subject’s request for damages. On 4 February 2022, the data subject appealed the Municipal Executive’s decision in court. The Court dismissed the appeal and declared the case inapplicable. The data subject appealed this decision. On 4 July 2023 the appeal was declared admissible by the Netherlands’s Administrative Jurisdiction Division of the Council of State (the country’s highest administrative court). The Court’s decision addressed two key issues, the applicability of the GDPR to th
The data subject is the owner of multiple companies that were subject to several investigations that subsequently led to him losing subsidy grants. The data controller filed a request to access all information related to him and his companies in the Tax Authorities' records to understand why the grant was lost. The data subject specifically inquired about any information on him that was processed by the Tax Authority's Fraud Signalling Provision (FSV) and whether he was being subject to automated decision-making. The Tax Authority confirmed that the data subject’s personal data was held by the FSV and indicated that the information was not used for automated decision-making or profiling. The Authority denied the data subject access to information held by the FSV because there was an ongoing investigation into the legality of the systems used by the Tax Authority. Following the rejection, the data subject appealed the decision and requested access to information about him in eight of the Tax Authority's systems, including the FSV. In a decision of 10 January 2022, the Tax Authority rejected the appeal and stated that the request fell outside of the scope of the initial request and that access could not be granted due to the ongoing investigation. The data subject appealed the decision of 10 January 2022 to the Gelderland District Court. The Court first evaluated if the controller met the obligation to grant access to data according to Article 15 GDPR. In this instance, the controller is the Minister of Finance, as they are responsible for the oversight of the Dutch Tax Authority. Given the first request's broad nature, which requested information from FSV and similar systems controlled by the Tax Authority, the Court acknowledged that ongoing investigations into these systems prevented the Authority from providing access to them. However, the Court ruled that the controller was required to confirm whether the data subject's personal data was held in systems used
The data subject was a Facebook user. According to the privacy settings selected at the moment of the facts, their phone number could be used by a third person to find the data subject’s profile on Facebook, even if the phone number itself was not public. Accordingly, information relating to the data subject could be linked to their phone number by anyone in possession of such a number. In 2021, unknown “third parties” automatically combined telephone numbers and matched them with Facebook profiles thanks to the above-mentioned function. In this way, telephone numbers could be assigned to identified users. This resulted in a data breach concerning 533 million people in 106 different countries. The data subject lamented that since the data breach they received phishing emails and calls. In light of the loss of control over their personal data, the data subject claimed damages under Article 82 GDPR. The Court of first instance rejected the data subject’s claim. The data subject appealed the decision before the Higher Regional Court of Hamm (Oberlandesgericht Hamm – OLG Hamm). The court upheld the first instance judgement. The court clarified that a claim under Article 82 GDPR requires the existence of three necessary elements: the violation of a GDPR provision, an actual damage affecting the data subject, and a causal link between violation and damage. Concerning the first element, the court preliminary pointed out the fact that the burden of proof concerning the non-existence of a violation is on the controller. This conclusion can be drawn on the basis of Article 5(2) GDPR, which imposes on the controller the obligation to prove compliance with GDPR. The court also ruled out that the controller could rely on any valid legal basis for the processing. The linking function provided by Facebook was neither necessary for the performance of the contract (Article 6(1)(b) GDPR), nor could be based on legitimate interest of the controller (Article 6(1)(f) GDPR). Conse
The dispute involved a data subject seeking complete access under Article 15 GDPR from the controller (a hospitla). Initially, the claim included multiple defendants and medical liability claims, which were dropped in favour of the data disclosure claim. The data subject alleged that the first defendant had not provided complete information, particularly concerning data shared with their liability insurance company. The Higher Regional Court Cologne held that the data subject was entitled to complete access under Article 15 GDPR. The court found that the previous access was incomplete, especially regarding the internal correspondence with the liability insurance. The data subject's claim for damages under Article 82 GDPR was, however, dismissed due to the lack of concrete demonstration of the alleged immaterial harm.
The Dutch Data Protection Authority, the defendant in this case, received multiple complaints regarding DPG's (a magazine publisher) practice of requesting ID verification for data erasure requests. DPG clarified that ID verification was solely for erasure requests made outside of its online platform. The defendant subsequently levied a €525,000 fine on the data controller due to a violation of Article 12(2) GDPR. The DPA found that requesting ID verification to facilitate an erasure request was disproportionate, and contrary to the obligation of facilitating the exercise of the right to access and deletion. DPG appealed the DPA's decision, and argued that the DPA's interpretation of Article 12(2) GDPR was wrong. They submitted that their privacy policy outlined their obligation to identify data subjects before facilitating erasure requests, and allowed that parts of the ID, such as the citizen service number and photo, might be hidden. Moreover, DPG argued that imposing the fine contradicted the principle of legal certainty (lex certa), and that the amount was contrary to the principle of proportionality. The Court deliberated whether DPG adequately facilitated the exercise of GDPR rights for the purposes of Article 12(2) GDPR. This provision obliges controllers to "facilitate the exercise of data subject rights under Articles 15 to 22." The Court interpreted "facilitation" in the context of Article 12(2) GDPR, in connection with Recitals 59 to 64 GDPR, concluding that data controllers must provide an accessible system for the exercise of data subjects' rights without introducing unnecessary obstacles. Firstly, though DPG was obligated to validate the identity for data erasure requests, their rigid procedure required an ID copy for every request, irrespective of the data involved. This approach was disproportionate because it did not differentiate between requests concerning sensitive and non-sensitive data, and requested ID verification for all types of r
The data subject lodged a complaint against a controller with the Bavarian DPA via email. The DPA never reacted to such an email. Therefore, the data subject brought an action against the DPA, lamenting that the latter did not take into consideration their original complaint within the legally established term of three months. Eventually, the DPA took action, examined the data subject’s complaint and rejected it for lack of any GDPR violation. The data subject accepted the merit of the decision and withdrew its principal legal action but also asked the DPA to bear the costs of the procedure. In the data subject’s view, the DPA’s lack of response still amounted to a failure to act for which the DPA was liable. The DPA refused to pay the costs arguing that the data subject’s email was not a complaint within the meaning of Articles 77 or 78 GDPR, as no GDPR violation by the controller was argued. Thus, the procedure continued exclusively with regard to the costs. The Administrative Court of Ansbach (Verwaltungsgericht Ansbach – VG Ansbach) upheld the data subject’s view. According to the court, the email sent to the DPA amounted to a complaint pursuant to Article 77 GDPR. The right to an effective remedy implies that the procedural requirements to file a complaint with a supervisory authority shall not be interpreted too strictly. The lack of response within the legally established term of three months in turn entailed a liability pursuant to Article 78(2) GDPR. The DPA did not show any compelling reason for which the decision was delayed. According to the court, informing a data subject pursuant to Article 78(2) GDPR is not a particularly high standard to meet. The court completely disregarded the outcome of the complaint on the merits. As the data subject had withdrawn its action, the main procedure was discontinued. However, the court ordered the DPA to bear the costs, applying a provision of German national law (§ 161(3) VwGO) by analogy.
The Silesian Voivode (the body in charge of an administrative district in Poland) declared a resolution of the Katowice City Council invalid. The resolution included an appendix specifying what type of personal data was to be processed for electoral purposes in the district council election campaign. Included in this was electoral candidates' PESEL number (national identifiction number), and electoral candidates' professions. The Voivode found that the inclusion of the electoral candidates' profession was not supported by law. It was not necessary for the criteria needed for eligibility, which are proof of age and permanent residence in the district. Moreover, it held that the inclusion of the PESEL number was in breach of the principle of data minimisation (Article 5(1)(c) GDPR). The Voivode also found that the City Council, which is not the controller of the data collected by the Municipality, was not authorised to decide on the purposes for processing of personal data, as this is the exclusive competence of the City Mayor as controller. The City Council challenged the decision of the Voivode. The Administrative Court in Gliwice overturned the Voivode's decision. It stated, among other things, that the inclusion of the PESEL number was not in breach of the principle of data minimisation. Its inclusion was deemed necessary for the purposes of processing, which was to confirm the residential eligibility of candidates. The Voivode appealed the judgment to the Supreme Administrative Court. The Polish Supreme Administrative Court held that the use of the PESEL number (the national identification number of an individual) to confirm electoral candidates' residential eligibility was incompatible with the principle of data minimisation Article 5(1)(c) GDPR as it was uneccesary for the purposes of processing. Residential eligibility could be confirmed through less invasive means. In addition, the obligation for candidates to disclose their profession was in violation o
The data subject's business profile appeared on an online platform operated by the controller. The profile displayed his name, address, telephone number, opening hours, profile pictures and information about peak visiting times. In 2020, the data subject submitted a request seeking the erasure of his personal data. He argued that he had not consented to the processing and that some of the published data were inaccurate. In particular, he claimed that profile pictures had been wrongly associated with his business profile. In 2021, the data subject lodged a complaint with the Austrian DPA against the controller. He alleged violations of his right to rectification (Article 16 GDPR), his right to erasure (Article 17 GDPR) and the right not to be subject to a decision based solely on automated processing (Article 22 GDPR). He argued that the controllers had rejected his erasure request and that the automatic assignment of profile pictures involved unlawful automated processing. The DPA asked the data subject to provide evidence of a rectification request and of a request concerning Article 22 GDPR. The data subject replied that his statements about inaccurate data should be treated as an implicit rectification request. He also argued that Article 22 GDPR did not require a prior request to the controller. The DPA rejected the complaint concerning Article 16 GDPR and Article 22 GDPR, as it found that the data subject had never submitted a rectification request or a request under Article 22 GDPR to the controllers, only a deletion request. During the proceedings, the controllers removed and corrected some information. However, the data subject maintained that incorrect profile pictures and opening hours continued to appear because of automated updates. First, the court held that the right to rectification under Article 16 GDPR generally required a prior request to the controller. The court noted that the data subject must identify which data are inaccurate and explain how
The data subject was employed by the controller, a company. After an alleged disciplinary offence, the data subject got a warning signed by the owner (and only shareholder) of the company. In particular, the letter stated that the data subject stored confidential information about the company on a USB pen drive. The owner of the company had found the USB and confiscated it. The data subject asked for access to their personal data, including the content of the USB, claiming ownership over the latter. They also asked the warning to be erased under Article 17 GDPR. Finally, the data subject claimed their right to compensation for damages suffered as a consequence of the unlawful processing. The owner declared that data originally stored on the USB were backed up and erased from the pen drive. They refused to grant access to the data and to delete the warning. The court of first instance rejected the data subject’s claims. No erasure under Article 17 GDPR could be asked to the controller, as the employment relationship between the parties had meanwhile expired. Article 15 GDPR was not applicable either, since the data subject did not own the content of the USB, namely the confidential information unlawfully collected from the company. Therefore, there was no right to compensation pursuant to Article 82 GDPR. The data subject appealed the decision before the Regional Labour Court of Baden-Württemberg (Landesarbeitsgericht Baden-Württemberg, LAG Bade-Württemberg) Concerning the right to erasure of the data subject, the court overturned the first instance judgement. The court noted that a warning was no longer necessary after the termination of the employment contract between the data subject and the controller. Therefore, Article 17(1)(a) GDPR applied. Concerning the right to access, the court clarified that the case at issue was a case of co-controllership. The employer (the company) was clearly controller within the meaning of Article 4(7) GDPR. However, the owner th