GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
On 4 October 2020, the controller sent a non-anonymised court judgement of the Regional Criminal Court (Landesgericht für Strafsachen) as a PDF file to a different recipient via WhatsApp. Less than a year later, on 28 July 2021, the same non-anonymised court judgement was sent to the same recipient again, this time via email. The data subject lodged two complaints with the DPA (DSB) regarding the violation of their right to secrecy under [https://ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=05.07.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=431b02ed-230a-4be2-a50e-f77708a2abbc § 1(1) DSG]. In the first proceedings (DSB-D124.5125), the DPA ruled on the transmission of the judgement via WhatsApp and notably highlighted that the transmission via email was not the subject of the proceedings. In the second procedure (DSB-D124.0310/22) concerning the transmission via email, the DPA dismissed the complaint on the grounds that the data subject had no legitimate interest of legal protection and referred to its first administrative decision. The data subject appealed against the second decision of the DPA and asked the court to decide in that subject matter. In their opinion, the two transmissions of the judgement at different times represent two separate data processing operations. First, the court held that, in this specific case, there was no identity of the subject matter in comparison with the first proceedings within the meaning of § 68(1) AVG. In accordance with established legal practice ([https://ris.bka.gv.at/Dokument.wxe?Res
The data subject was employed as a wrapping technician by the controller, a company in the advertising technology industry. While employed, the data subject agreed to the production of photos and a promotional video which featured him prominently. After leaving the company on 1 May 2019 to work for a competitor, the data subject requested the controller multiple times to cease using and delete the photos and video featuring him, but the controller initially did not comply. On 21 February 2020, the controller finally removed the materials after receiving multiple formal requests from the data subject’s legal representative. The data subject sought non-material damages under Article 82 GDPR due to these violations, including the unauthorized use of their image for commercial purposes. The LAG Baden-Württemberg decided that the delayed response to an access request under Article 15 GDPR does not constitute non-material damage in itself. The court clarified that a mere breach of GDPR provisions is not sufficient to establish a claim for damages under Article 82 GDPR. The rationale is that the law requires concrete evidence of harm beyond the violation of GDPR regulations. First, the court held that the controller’s unconsented use of the data subject's image post-employment violated Article 17 GDPR, justifying a compensation of €10,000 due to the significant damage to their personality rights along with the commercial exploitation without permission. Second, it addressed the data subject's request for detailed information on all personal data processed by the controller under Article 15 GDPR. The court noted this request lacked the specificity required by § 253(2) No. 2 ZPO. Consequently, it ruled that a general request for all personal data does not meet the necessary clarity and precision. Finally, the court rejected the claim for additional damages due to the delayed compliance with the access request, ruling that no non-material damage was proven by the data subj
Following a criminal offence, the data subject was identified by the police through video surveillance cameras. The footage of the cameras was used as evidence during the criminal trial, on the basis of which the Court of First Instance convicted the data subject. In his appeal to the Ljubljana Higher, the data subject claimed, among other things, that the footage of the video surveillance cameras, as well as all other evidence obtained based on the footage, should be excluded since the cameras lacked an information notice. The Ljubljana Higher Court noted that the Court of First Instance, in accordance with case-law, explained the meaning of the right to privacy and the concept of expectation of privacy in criminal law. It pointed out that the right to privacy is not absolute, as it can be limited, for example, by the rights of others and in situations provided for by the Constitution of the Republic of Slovenia. Furthermore, the Higher Court explained that for the admissibility of evidence in criminal cases when such evidence was obtained in breach of the right to privacy, the standard of expected privacy should be taken into account. The Court cited the [https://hudoc.echr.coe.int/eng#{%22appno%22:[%2263737/00%22],%22itemid%22:[%22001-61228%22]} Perry case], where the ECtHR took the view that the normal use of video surveillance cameras in places such as streets, shopping centers or police stations does not in itself raise concerns about the right to respect for private life under [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 8(1) ECHR]. Likewise, in the present instance, the Higher Court noted that the cameras were recording streets, courtyards or the vicinity of commercial buildings and the area in front of an ATM, where an individual could not expect privacy in the absolute sense. Thus, the recordings did not disproportionately interfere with the defendant's right to privacy. The Higher Court further found that the Co
The plaintiff - the data subject, suffered damage to his vehicle with the vehicle identification number, which is insured with the defendant, on 28.03.2022. The defendant processed and settled this claim as the liable insurer on the basis of a cost estimate submitted by the plaintiff. The calculated repair costs excluding VAT amounted to EUR 3,351.93. The defendant then forwarded the following information to the HIS Information System (HIS - Hinweis- und Informationssystem, a federal directory of the German insurance industry); Date of the fictitious settlement, reporting body, Motor vehicle Reference number of the reporting body, The defendant - the data controller, did not delete or arrange for the deletion of the entry despite a request from the plaintiff or his attorney of record. The data subject claims that the entries in the HIS directory are incorrect, as their vehicle was repaired and therefore there is no fictitious settlement of the damage. Moreover, there was no need for storage due to the repair carried out. In this case, the parties were arguing if the data of the data subject could be deleted upon Article 17 GDPR from the federal Notice and information system, since there was no reason to retain the Data in the system, since the insurance paid for the repair. The court held that, in the case of a fictitious settlement of vehicle damage exceeding EUR 1,500, the comprehensive insurance of the policyholder is authorized to report the occurrence of a fictitious settlement, the amount of the incurred damage, and the vehicle identification number to the HIS Information System. Even in the case of a (flat) claimed repair of the damage with a remaining diminished value, there is still an overriding interest in this reporting, and therefore, no deletion under Article 17 GDPR is required. Even in the event of a proper and expert repair, a balancing of interests under Article 6(1)(f) GDPR indicates a continued interest of the insurer in reporting the data to
The data subject and the controller were bound by an insurance contract. The controller increased the premium and the data subject claimed that such an increase was unlawful. Therefore, the data subject made an access request, to which the controller refused to reply. The data subject challenged the lawfulness of the premium increase in court and contextually asked the judge to order the controller to provide access to the requested information. The court of first instance dismissed the data subject’s access claim, stating that the latter was merely instrumental to prove the unlawfulness of the premium increase, without any autonomous data protection purpose. The data subject appealed the decision. The Higher Regional Court of Koblenz (Oberlandesgericht Koblenz – OLG Koblenz) overturned the first instance judgement. First, the court stressed how information concerning premium increases in an insurance agreement, like in general all contract details related to an individual, are personal data within the meaning of Article 4(1) GDPR. Second, the court referred to the CJEU judgement in case C-487/21 to clarify the scope of the data subject’s right to a copy of their personal data pursuant to Article 15(3) GDPR. The data subject had a right to a faithful and understandable reproduction of all their personal data processed by the controller. The court also pointed out how the right to a copy shall enable the data subject to enforce further data protection rights, such as right to erasure, rectification or objection. Finally, the court stated that the controller could not rely on Article 12(5) GDPR to avoid to reply to the access request. As a matter of fact, that is possible only insofar as a request is manifestly unfounded or excessive. It was uncontested by the controller that personal data were processed, therefore the request was not manifestly unfounded. Regarding the “excessiveness” of the access request, the court of first instance held that it did not dire
The data subject made a complaint against the respondent, as organ's of the respondent searched through the data subject's office in 2020 and took seven pictures on a private cell phone of the complainants office, the contents of a box and handwritten notes on files. The complaint is focused on the data processing that took place in the secret search and how the respondent violated the complainants fundamental right to privacy under the GDPR. The complaint was made in a timely manner because the complainant only found out after the oral hearing the data processing that occurred during the search of the office.The complaint was filed within the one year complaint period from the time the matter became know in connection with section 85 (4) GOG. The searched violated article 8 of the ECHR, the complainants right to a private life. It is clear the data processing was carried out, outside disciplinary or criminal proceedings exclusively on behalf of the respondent which makes it clear this was not processed out by an impartial disciplinary court. This in turn affected the judicial independence of the judge. According to section 85 (1) GOG, a prerequisite to admit a complaint is that it must violate a fundamental right to data protection by an organ that exercises judicial activity, which is not the case here as there is no connection with court or legal proceedings, it was an issue that took place in the company. The processing of data was necessary for official supervision and therefore, had no corresponding legal basis. The respondent requested the complaint to be rejected and if necessary dismissed. Initially, there was confusion over which court department this complaint needed to be assigned too, in the beginning it was not assigned to a court department as the authority in charge assumed there would be a decision-complaint procedure, eventually the court departments were assigned once the files attached were examined in the legal department and the contents w
In May 2018, Stichting Bureau Krediet Registratie (BKR, the controller) began charging a fee to data subjects for requesting access to their data in a digital format. Data subjects could obtain a paper copy of their data for free, but only once a year. Following the DPA’s investigation, the controller has modified its processes. Since April 2019 data subjects have been able to access their data for free. In addition, in March 2019 the controller changed the number of times a year data subjects can receive a paper copy of their data by post. The Dutch DPA found that this practice was an infringement of privacy legislation, and imposed a fine of €830,000. controller then appealed in court. The court ruled that controller violated both Article 12(2) and Article 12(5) GDPR. The court found that controller's policy of limiting free access to once a year and charging for electronic access was inconsistent with the GDPR's requirements. The court emphasized that the GDPR requires data controllers to facilitate individuals' rights to access their data easily and free of charge, especially when data is processed electronically. The court rejected controller's argument that the GDPR's rules were unclear, stating that controller, as a professional organization, should have been aware of its obligations. The court acknowledged that the violations were related and reduced the fine by 20% due to the interconnected nature of the breaches. However, the court also found that the original fine of €830,000 was disproportionate and further reduced it to €668,000.
The data subject requested the Employee Insurance Agency (a governmental organisation, controller), to delete her phone number because she no longer wanted to be contacted by them. She also requested the erasure of her phone number from two messages stored in the digital 'mailbox' of the controller. The controller deleted her number for contacting purposes, but refused to delete her number from the digital mailbox. It argued that these documents were part of its social security files and had to be stored on the basis of a legal obligation arising from the Archiefwet (Archive Law). The data subject brought an action with the Court of Noord-Holland (case 20/4820). The Court considered that the controller was not obligated to delete the phone number from its files. She appealed this decision with the Council of State, claiming that the controller unlawfully processed her data and that it was not necessary to store it. In her view, the Archiefwet did not provide a legal basis for processing in the specific case and it breached the principles of minimisation, lawfulness and necessity. The Dutch Council of State considered that the data subject did not bring additional arguments than in first instance and that the Court of Noord-Holland adequately motivated its decision. The Council of State also held that if there is a legal obligation to store files in the exercise of official authority vested in the controller, then the right to erasure under Article 17 is not applicable as long as the retention period runs, as stated in Article 17(3)(b). Archiving as such does not breach the GDPR. Consequently, the Council declared the appeal unfounded.
The data subject was an employee of the company Ballymaguire Foods, the controller, and was responsible for supervising other 20 employees. During a meeting in March 2019, the Quality Control Manager showed CCTV footages to several managers and supervisors as an instance of poor food safety practice for the purpose of identifying corrective actions. While the data subject was not present in the meeting, they were informed about it by other employees. The data subject initially filed a complaint with the Irish DPA, but was not assigned to a complaint handler due to a backlog of complaints. Then, they filed a lawsuit before the Circuit Court, pursuant to [https://www.irishstatutebook.ie/eli/2018/act/7/section/117/enacted/en/html#sec117 section 117 of the 2018 Irish Data Protection Act]. In addition to claiming that the further processing of the CCTV footage was illegal, the data subject requested compensation for non-material damages on the grounds that they felt humiliated and more stressed at work after the incident. In response, the controller argued that employees were aware of the purposes of the CCTV system as informed in its privacy policy. In addition, it maintained that there was a legitimate interest in the use of the images and classified the alleged damages as mere "upset, anxiety and embarrassment". First, the Court found that the controller had failed in its duty of transparency as it had four different privacy policies in place, none of which were in the native language of the data subject. In addition, the Court highlighted that the controller cannot rely on legitimate interest without first carrying out an assessment of that interest in relation to the rights and freedoms of the data subject. For these reasons, it held that there was a violation of the data subject’s rights under the GDPR. Second, the Court referred to the decision rendered by the CJEU in the the UI v Österreichische Post case (Case C-300/21), in which it ruled that while there is
The data subject was marksmen from 2012 until about 2017 and participated in competitions. Controller 1 (first appellant in the present case) operates a website that offered shooting accessories and lessons. Controller 2 (second appellant in the present case) also operates a website where they added blogposts concerning these competitions and offered shooting lessons including advertisement for a company. Several reports by the two controllers, published on their respective websites, included an image and the name (and nickname) of the data subject. However, the data subject had never explicitly consented to this publication nor was there a contractual agreement at any time. The publications were mainly for advertising purposes. Controller 1 issued two of the reports in question; on 30 July 2015 and on 9 November 2015. Controller 2 published the other two reports, namely on 10 August 2016 and on 18 September 2016. The controllers took down the reports in September 2018 and November 2018, respectively. On 17 February 2019, the data subject filed two complaints before the DSB (Austria) for infringement of their fundamental right to data protection by the two controllers. The DSB joined the two cases in its decision of 13 July 2020 accepting the complaint and deciding in favour of the data subject: According to this decision, controller 1 unlawfully processed the data subject’s personal data from 9 November 2015 until 30 September 2018. Controller 2 unlawfully processed the same data from 10 August 2016 until November 2018. Both controllers appealed against this decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG), claiming that their activities were covered by the media exception of [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=2&Paragraf=9&Anlage=&Uebergangsrecht= § 9(1) Austrian Data Protection Act] (Datenschutzgesetz - DSG). First, the BVwG considered the application o
{{CJEUdecisionBOX | Case_Number_Name = C‑252/21 | Date_Decided = 2023-07-07 | ECLI = ECLI:EU:C:2023:537 | Reference_Body = OLG Düsseldorf | Reference_Case_Number_Name = Kart 2/19 | Initial_Contributor = at | Judgement_Link = https://curia.europa.eu/juris/document/document.jsf?pageIndex=0&doclang=EN&docid=275125 | Opinion_Link = https://curia.europa.eu/juris/document/document.jsf?pageIndex=0&doclang=EN&docid=265901 | Party_Name_1 = Meta Platforms Inc., formerly Facebook Inc. | Party_Link_1 = https://about.meta.com/ | Party_Name_2 = Meta Platforms Ireland Limited | Party_Link_2 = | GDPR_Article_1 = Article 6(1)(a) GDPR | GDPR_Article_2 = Article 6(1)(f) GDPR | GDPR_Article_Link_1 = Article 6 GDPR#1a | GDPR_Article_Link_2 = Article 6 GDPR#1f | EU_Law_Name_1 = Article 4(3) TFEU | EU_Law_Name_2 = Article 101 TFEU | EU_Law_Link_1 = https://eur-lex.europa.eu/eli/treaty/tfeu_2016/art_4/oj | EU_Law_Link_2 = https://eur-lex.europa.eu/eli/treaty/tfeu_2016/art_101/oj | National_Law_Name_1 = § 19(1) GWB (in EN) | National_Law_Name_2 = § 32(1) GWB (in EN) | National_Law_Link_1 = https://www.gesetze-im-internet.de/englisch_gwb/englisch_gwb.html#p0062 | National_Law_Link_2 = https://www.gesetze-im-internet.de/englisch_gwb/englisch_gwb.html#p0227 | Party_Name_3 = Facebook Deutschland GmbH | Party_Name_4 = Bundeskartellamt | Party_Name_5 = Verbraucherzentrale Bundesverband e.V. | Party_Name_6 = | Party_Name_7 = | Party_Name_8 = | Party_Name_9 = | Party_Name_10 = | Party_Name_11 = | Party_Name_12 = | Party_Name_13 = | Party_Name_14 = | Party_Name_15 = | Party_Name_16 = | Party_Name_17 = | Party_Name_18 = | Party_Name_19 = | Party_Name_20 = | Party_Link_3 = | Party_Link_4 = https://www.bundeskartellamt.de | Party_Link_5 = https://www.vzbv.de/ | Party_Link_6 = | Party_Link_7 = | Party_Link_8 = | Party_Link_9 = | Party_Link_10 = | Party_Link_11 = | Party_Link_12 = | Party_Link_13 = | Party_Link_14 = | Party_Link_15 = | Party_Link_16 = | Party_Link_17 = | Part
On 20 May 2021, the data subject (claimant) received a letter from the Dutch Inland Revenue, notifying him that he had been unlawfully registered in the Dutch Inland Revenue's (Belastingdienst) database - the Fraud Signalling Facility (FSV). The controller in this case was the minister of Finance, as the Dutch Inland Revenue is under the administration of the ministry of Finance Overall, the use of this facility did not comply with the GDPR, as too many employees had access to the data and the data retention period was too long. Some individuals’ data was wrongly included and wrongly used. The controller attempted to rectify this by revoking tax employees' access to the FSV on 27 February 2020 and removing it as a point of use from the Tax Administration's implementation of (tax) legislation. In a letter dated 25 June 2021, the data subject objected to the recording of his data in the FSV. In this letter, he made an access request under Article 15 GDPR, a data rectification request under Article 16 GDPR, and an erasure request under Article 17 GDPR. The controller responded on 22 July 2021, partially responding to the access request (Article 15 GDPR), but refusing the requests made under Articles 16 and 17 GDPR. The data subject brought claims against the incomplete response to his data access request, and refusal of data rectification and erasure requests. The court found no violation of Article 15 GDPR, but found a violation of Articles 16 and 17 GDPR. Firstly, the controller’s response was GDPR-compliant for the purposes of Article 15 GDPR. An incomplete response to an access request was not inherently a violation of Article 15(3) GDPR. The controller had provided a summary of the data subject’s personal data, along with an explanatory note outlining the processing purposes. In reaching its conclusion, the court referenced CJEU judgment of 4 May 2023 (ECLI: EC: C: 2023: 369), wherein it was established that Article 15(3) GDPR does not confer the right to obta
Meta Platforms Ireland (Meta) offers the social network service Facebook within the EU. Other online social network services - including Instagram and WhatsApp - are offered by other undertakings belonging to the Meta group. The business model regarding Facebook essentially consists of personalised advertisement based on the production of detailed profiles of Facebook-users and users of the other online services offered by the Meta group (the users). The users provide data directly to Meta when they sign up to Facebook. In addition, Meta collects data of the users from the social network services provided by the Meta group as well as third-party websites and apps (“off-Facebook data”) and links such data to the users’ accounts. The aggregate view of the data allows Meta to draw detailed conclusions about those users’ preferences and interests. Meta processes such data on the basis of a contract it enters into with a user when the user signs up to Facebook and accepts the general terms of use. In order to use Facebook, the user must accept the general terms. The Federal Cartel Office (Bundeskartellamt) brought proceedings against Meta Platforms, Meta Platforms Ireland and Facebook Deutschland (the companies). By its decision, the Bundeskartellamt prohibited those companies from 1) making – in the general terms of use – the use of Facebook subject to the processing the user’s ‘off-Facebook data’ and 2) from processing the data without the user’s consent, with regard to private users residing in Germany. The Bundeskartellamt viewed that the use of such general terms constitute an abuse of Meta’s dominant position on the market for online social networks for private users in Germany, in particular, since the processing of the 'off-Facebook data' is not consistent with the underlying values of the GDPR and cannot be justified in the light of Article 6(1) and Article 9(2) GDPR. It followed, that the companies brought an action against the decision before the Higher Re
The data subject had faced insolvency proceedings, which were announced on a publicly accessible database. This publication is legally retained and made publicly available for 6 months following insolvency proceedings under German law.§3 of the Ordinance on Public Announcements in Insolvency Proceedings and Restructuring Matters on the Internet (InsBekV) available, [https://www.gesetze-im-internet.de/insobekv/__3.html here]. A credit agency (the controller) had negatively registered the data subject using the information from the public database and transmitted the data subject’s negative registration to its contractual partners. As a result, the data subject was unable to apply for credit products. After being rejected for various credit-related applications due to their negative registration, the data subject filed a suit against the credit agency in the Regional Court of Münster. The Court held that the controller was in violation of Article 6(1) GDPR, as they lacked a legal basis for processing the data subject’s data. The Court held that the controller was unable to rely on Article 6(1)(f) GDPR for processing, because the economic interests of the controller could not override those of the data subject. Moreover, the controller had retained the data subject’s insolvency information beyond the 6-month period provided for under domestic law. The data subject’s interests and rights took precedence over those of the controller. The negative registration created an unwarranted detriment to the data subject’s economic life. The Court concluded that the controller’s processing significantly interfered with the data subject’s constitutional right to self-determination under Article 1,2 of German Basic Law, the right to data protection under Article 8 of the European Charter of Fundamental Rights, and the data subject’s general freedom of action, freedom of contract, and the freedom to exercise a profession. Consequently, the controller was unable to rely on Article
This judgement stems from one of the 101 complaints filed by the NGO noyb in the context of data transfers to the US. The data subject lamented a violation of Chapter V GDPR due to the unlawful transfer of their personal data in lack of a valid legal basis. The controller made use of analytical tools by Google on their website. When visiting such a website, the data subject triggered a transfer of personal data to the US, where Google processes personal data imported from Europe. Data transfers between US and EU were originally based on an Adequacy Decision by the Commision, in turn based on the transatlantic legal framework known as 'Privacy Shield'. Nevertheless, after C-311/18 (“Schrems II”), the Commission’s adequacy decision concerning was invalidated by the CJEU. Consequently, controllers could export data only on the basis of alternative tools guaranteeing an adequate level of protection, such as Standard Contractual Clauses (SSCs). The Austrian DPA held that SSCs implemented by the controller – the “data exporter” – could not guarantee an adequate level of protection, mainly due to their inability to limit the power of US intelligence agencies to access personal data stored by Google. The controller appealed the decision. The controller claimed that data transferred were not personal data and that in any case Chapter V GDPR envisages a risk-based approach, which was taken into account by the controller. Finally, the controller also argued that the data subject had no legitimation to bring action, as at the time of the events they were working for the NGO that represented them in the procedure before the DPA. The Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG) rejected the appeal. First, the court denied that the fact that the data subject worked with the NGO representing them pursuant to Article 80 GDPR could exclude their legitimation to file a complaint against the controller. About the qualification of the information transferre
A plaintiff servant who worked for the defendant sued to get his ability to work reinstated, as allowed by German law (Section 46 BBG). The lawsuit was most likely against the German government, but the court decision (which hasn't been made public yet) didn't clarify this. The dispute centered on whether certain documents should be removed from the man's personnel file and other police records. These documents included disciplinary files, a statement about a "reactivation review," and related information. Both the plaintiff and the defendant disagreed with the initial court ruling issued by the Administrative Court of Regensburg (judgment of January 25, 2023) and appealed. The plaintiff wanted more documents deleted, while the defendant appealed to keep the "reactivation review" statement. The court ruled in favor of the defendant. The court found that the documents were relevant to the plaintiff's employment history and should be kept. The court also found that the plaintiff did not have a legitimate interest in having the documents removed. First there is a moot point: Even if the court ruled in the plaintiff's favor, it wouldn't change anything. The defendant already agreed to remove the documents. Also there is no legal basis: the laws cited by the plaintiff (§§ 112 & 113 BBG and GDPR) don't guarantee removal of documents unless proven false or irrelevant. Personnel files aim to present a complete picture of the employee's history, including disciplinary actions. Removing documents generally goes against this goal. There is only an exception for serious misconduct: only serious misconduct accusations might warrant removal to allow for future career advancement without the burden of past issues. In simpler terms, the court ruled that since the documents were already being removed, there was no need for a formal decision.
The controller fired the data subject for having declared to be in the workplace when they had actually left the office. To substantiate this claim, the controller used images from the video surveillance system. The data subject objected to the decision before a labour court, claiming that data obtained in violation of the GDPR could not be used in a labour procedure against the data subject. In particular, the controller did not fully comply with their obligation to inform in accordance with Article 13 GDPR. The court of first instance upheld the data subject’s position. The controller appealed the decision and lost also in second instance. Therefore, they brought the case before the German Federal Labour Court (Bundesarbeitsgericht - BAG). The court further acknowledged that in principle, according to Article 17(1)(d) GDPR, personal data shall be deleted when they were unlawfully processed – in this case ‘collected’. However, Article 17(3)(e) GDPR provides for an exception for those cases in which processing is still necessary for the establishment, exercise or defence of legal claims. The court pointed out that Article 17(3)(e) GDPR also requires a balancing of interests oriented by proportionality. As a matter of fact, the defence of one’s rights before courts is a fundamental right enshrined in Article 47 of the European Charter of Fundamental Rights. Thus, the data subject’s fundamental rights to privacy and data protection (Articles 7 and 8 of the Charter) should be seriously threatened in order to justify an erasure. The impact of a video surveillance system on a data subject is that the latter’s self-determination could be impaired. However, in the case at issue the data subject was not limited in their behaviour by the video surveillance. To the contrary, despite aware of the cameras, they committed a disciplinary offence. What the data subject invoked to limit the use of the recording as evidence was not a constitutionally protected right, as data prot
The data subject filed a complaint against the controller - a credit ranking agency. In the original procedure before the Austrian DPA, the data subject claimed that their rights resulting from Article 15(1)(h) GDPR were infringed as the controller did not sufficiently inform them about the logic and algorithm used for the processing of their personal data in the context of an automated decision about the data subject's creditworthiness. The controller replied that the processing at issue was not 'automated decision-making' pursuant to Article 22 GDPR, but only 'light profiling' under Article 4(4) GDPR. Therefore, the controller claimed that Article 15(1)(h) GDPR did not apply in the first place. Moreover, the controller argued that the algorithm regulating profiling could not be disclosed, being part of business secrets of the company. The Austrian DPA upheld the complaint and issued a decision against the controller, ordering the latter to provide access to the information requested by the data subject. The controller appealed the decision with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG), stating that they provided the data subject with sufficient information. The court upheld the controller's appeal. First, the court noted that, according to Article 15(1)(h) GDPR, in case of automated decision-making the controller shall provide the data subject with an explanation about the logic behind the processing. However, this 'logic' shall not be understood as the algorithm or mathematical formula underlying the automated decision. Rather, the controller shall provide the following pieces of information: a) categories of personal data and why they are relevant to the creation of the profile; b) how the profile is created by automated means, with specific regard to the statistical method used; c) why the profile is relevant for the decision; d) how the profile is actually used in the context of the decision. In the case at issue, the c
This judgement stemmed from an appeal against a decision of the Magdeburg Administrative Court. In the original proceeding, the applicant challenged the procedure for the election of the data protection commissioner for the German state Saxony-Anhalt. According to the applicant - a candidate for the same position - the election procedure was not transparent and thus contravened to the requirements set forth in Article 53(1) GDPR. In particular, the data protection commissioner was appointed under state law by the regional Parliament. Members of the parliamentary groups could make proposals but there was no mandatory public call for applications. Furthermore, the applicant stressed that Article 54(1)(c) GDPR establishes an obligation for all EU Member States to put in place a law to provide more legal clarity about the election procedures of the heads of the DPAs. The applicant asked the court to temporarily block the election procedures and refer the case to the CJEU, in order to check whether the principle of transparency was respected. The court of first instance rejected the claim. Therefore, the applicant appealed the decision before the Higher Administrative Court of Saxony-Anhalt (Oberverwaltungsgericht Sachsen-Anhalt - OVG Sachsen-Anhalt). The court found that the applicant's appeal was inadmissible. The court held that the applicant was not eligible to bring such a claim because there was no subjective rights involved. Article 53(1) GDPR establishes requirements which are in the public interest and they cannot be invoked by an individual. Incidentally and without delving into the merits, the court also noted that offices at state level have staff chosen through democratic elections by voters or indirectly by other electoral bodies. The court stressed how the procedure designed by the state law does not jeopardise transparency, as it is immediately clear which names are proposed and by whom. Moreover, the election by a parliamentary assembly is explicitly e
On 24 May 2023, the Belgian DPA issued a decision in which it ordered a ban on the transfer of tax data of accidental US citizens residing in Belgium to the US. Despite the fact that Article 96 GDPR provides that agreements concluded prior to GDPR which comply with the EU legislation at the time of their conclusion are still valid under GDPR, the DPA considered the FATCA agreement as not in line with the GDPR (see GDPRhub summary). The controller filed an appeal with the Appeal Court requesting that the decision be suspended and annulled. The Court indeed has jurisdiction to suspend a decision if, prima facie, it appears that the decision could be annulled and if the immediate execution of the decision is likely to cause serious harm that would be difficult to repair. The controller argued that the decision violated Article 96 GDPR by holding that the FATCA agreement was invalid and that its execution caused serious harm to Belgium's international reputation and relations. The Court considered that, contrary to the interpretation of the DPA, Article 96 GDPR does not provide for a time limit on the validity of international agreements concluded prior to the GDPR. In addition, the Court held that if the decision was not suspended, the Belgian State would not be able to meet its commitments to the USA, i.e. to transfer the data before 30 September. The contested decision placed the Belgian State at odds with its international commitments, whereas Article 27 of the Vienna Convention on the Law of Treaties states that a party may not invoke the provisions of its domestic law to justify its failure to perform a treaty. The Court then carried out a balance of interests and considered that although the transfer of the data potentially infringed the provisions of the GDPR, the objective was to prevent tax fraud, i.e. an objective of general interest. This objective outweighed the interests of the data subjects. As a result, the Court decided to suspend the DPA's decis