GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
On 17 February 2020, a data subject (the complainant) lodged a data protection complaint under Article 77(1) GDPR for breach of the right of access under Article 15 GDPR by a company. By decision of 22 April 2020, the DPA refused to deal with the data protection complaint under Article 57(4) GDPR on the basis that between 28 August 2018 and 7 April 2020, the complainant had submitted 77 data protection complaints that were essentially the same and regularly contacted by phone the DPA. Thus, the complainant brought an action against the decision before the Austrian Administrative Court, which, on 22 December 2022, upheld the complaint and annulled the DPA decision because it could not be said with certainty from Article 57(4) GDPR when a request is ‘excessive’, but it could be derived that they had to be frequent but also ‘manifestly vexatious or abusive in nature’, which the DPA had not demonstrated. The DPA challenged this judgement before the Supreme Administrative Court (Supreme Court). On 6 July 2023, the Austrian DPA requested the Supreme Court to refer a question to the CJEU, namely, whether the concept of ‘request’ in Article 57(4) GDPR could be interpreted as also covering ‘complaints’ under Article 77(1) GDPR. The Supreme Court stated that the concept of ‘requests’ within the meaning of Article 57(4) GDPR is not defined more precisely in the GDPR. Nonetheless, Article 57(2) GDPR and Article 57(3) GDPR suggest that the concept also includes complaints under Article 77(1) GDPR since the handling of complaints is a primary task of any supervisory authority, which should facilitate their submission and provide services free of charge. Additionally, if the CJEU would answer affirmatively, the following questions were referred. Firstly, the Supreme Court noted that carrying out an extremely large number of complaints does not constitute an abusive assertion of rights. However, an abuse of the right conferred by Article 77(1) GDPR could be claimed if a data su
A data subject was registered in the information system of the company [https://www.verifone.com/ Verifone], a payment service provider (controller). After changing her identity, she requested a court in the USA to order the rectification of her customer account data (surname, first name, email) and of her data appearing in other documents such as orders. The court refused, and the data subject referred the matter to the French DPA (CNIL). The CNIL contacted the controller to ask it to rectify the data subject's customer account data, which it did for the customer account data but not for the other documents. The CNIL considered that the documents drawn up before the change of identity did not need to be rectified retroactively because the change of identity happened later. The data subject took the CNIL's decision to the Conseil d'Etat (Supreme Administrative Court). For the documents drawn up before the identity change, the Conseil d'Etat considered that the data could not be considered as inaccurate since they were accurate at the time and for the purpose of the processing. These documents therefore did not contain any inaccuracies that should have been corrected under Article 16 GDPR. Consequently, the Conseil d'Etat upheld the CNIL's decision, considering that the CNIL correctly applied Article 16 GDPR.
In the original case before the Austrian DPA, the data subject filed a complaint, claiming that the controller (a bank) recorded their phone calls and there was no possibility to opt-out from such a processing. Clients were informed about the recording by a tape announcement at the beginning of the call. The controller justified the processing as a legitimate interest pursuant to Article 6(1)(f) GDPR, stating that recording was necessary to ensure the best service quality for clients. The controller also referred to their obligations under EU law, especially [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32014L0065 Directive 2014/65/EU (MiFID II)], and national banking laws, such as [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20010182 § 66(1) Payment Services Act] (Zahlungsdienstegesetz - ZaDiG) and [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20009943 § 33(2) and (3) Securities Supervision Act 2018] (Wertpapieraufsichtsgesetz 2018 - WAG). The DPA upheld the data subject's claim and issued a decision against the controller. The controller appealed this decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). To the arguments mentioned above, the controller added that that it was impossible not to record all incoming calls. Furthermore, the controller questioned the DPA's competence, as the case allegedly fell under the WAG and not the GDPR. The court rejected the controller's appeal. The court confirmed that the DPA was competent. The data subject's complaint was about their right to confidentiality of personal data. The infringement of Article 6(1) GDPR could lead to an infringement of [https://ris.bka.gv.at/geltendefassung.wxe?abfrage=bundesnormen&gesetzesnummer=10001597&tid=121676594&ShowPrintPreview=True § 1(1) Austrian Data Protection Act] (Datenschutzgesetz - DSG) which contains the fundamental right to data protection. The right t
The controller was a company that allowed their employees to use the company vehicle. One of these cars was used to commit traffic offences. During the police investigation, it was not established which employee had driven the car at that time. Therefore, the competent administration asked the controller to disclose the identity of the driver. In addition, the administration ordered the controller to keep a log of their vehicles, the people to which they were provided and other details concerning the services offered by the controller. The legal basis for such an obligation can be found in the German traffic law. The controller refused to comply with the order and appealed it before a court. The controller argued that the GDPR precludes the disclosure of personal data of the driver(s) to the authorities and the keeping of a logbook with the drivers' names. The first instance court rejected the claim and the controller appealed the decision before the Higher Administrative Court of Rhineland-Palatinate (Oberverwaltungsgericht Rheinland-Pfalz, OVG Rheinland-Pfalz). The court of appeal upheld the first instance judgement. According to the court, both the disclosure of personal data of the drivers and the keeping of a log with personal data of the latter were permissable pursuant to Article 6(1)(f) GDPR. As a legal basis, the controller could (and should) rely on the protection of the legitimate interests of the authorities in fulfilling tasks incumbent upon them in the public interest, which include the prosecution of administrative offences. Moreover, the court observed how the further stages of the processing were also permissable from the public authority side under Article 6(1)(e) GDPR.
The data subject was a Facebook user. According to the privacy settings selected at the moment of the facts, their phone number could be used by a third person to find the data subject’s profile on Facebook, even if the phone number itself was not public. Accordingly, information relating to the data subject could be linked to their phone number by anyone in possession of such a number. In 2019, unknown third parties automatically combined telephone numbers and matched them with Facebook profiles thanks to the above-mentioned function. In this way, telephone numbers could be assigned to identified users. This resulted in a data breach concerning 533 million people in 106 different countries. The data subject lamented that since the data breach they received phishing emails and calls. In light of the loss of control over their personal data, the data subject claimed damages for €1,000 under Article 82 GDPR. According to the District Court of Deggendorf (Landgericht Deggendorf), the controller did not violate its duty of transparency pursuant to Article 5(1)(a) GDPR, as it provided a multi-layered explanation of what data were processed and how. It was up to the data subject to read this data protection policy and change the relevant settings. To the contrary, the data subject willingly provided their phone number, even if such piece of information was not necessary to use the social network. In the view of the court, the controller did not contravene its obligations pursuant to Article 32 and 33 GDPR either, since the data subject consciously made public their private details, with consequences that were transparently explained by the controller in its privacy policy. Therefore, no obligation concerning security measures and data breaches came into play in the case at issue. In a long obiter dictum, the court also concerned itself with the problem of Article 82 GDPR and the compensability of non-material damages. The court stressed that following the CJEU judgeme
The controller (Lääkäriklinikka Estetic Oy, a medical clinic) had asked the Administrative Court of Helsinki (the Court) to overturn the €5,000 administrative fine imposed by the Finnish DPA and the DPA's decision, according to which the controller had not implemented the data subject's access request. The controller filed the appeal claiming that it had already fulfilled the data subject's access request as far as it concerned the personal data it processed. The controller emphasised that it did not have access to the patient records of another company whose surgeon had treated the data subject at the controller's premises. The controller argued that the DPA should have requested an explanation from the other company as well, because the data subject was not a patient of the controller, but a patient of the other company. The controller also stated that the DPA's actions had not been based on a sufficient and appropriate investigation. The DPA emphasised that the data subject had received treatment from the controller at the controller's premises and that the controller had not informed the data subject that their patient records are in the possession of another company. The DPA also stated that the controller had not instructed the data subject to request their personal data from another company or otherwise informed the data subject about the matters related to the controllership of their personal data. The Court noted that, despite the opportunity reserved for it, the controller had not sufficiently demonstrated that some other entity had acted as a controller of the personal data generated in connection with the treatment that took place on its premises. In its appeal, the controller had not denied that the data subject had received treatment from the controller. Thus, the Court stated that the controller had to be considered as a controller within the meaning of the GDPR. In light of this, the Court agreed with the DPA that the controller had violated Articl
The plaintiff (data subject) objected to premium increases by the defendant, a private health insurer (controller). The data subject requested information regarding possible premium adjustments from 2012 in order to demonstrate that the premium increases were invalid. In particular, the data subject brought a claim for access to personal data under Article 15(1) GDPR, which related solely to the value of the triggering factor for the recalculation of the premium in the tariff at issue. The triggering factor is the percentage threshold by which the cost for insurance services or mortality probabilities must have changed in order for the insurer to be able to increase premiums for health insurance policies such as the one at stake.cf. § 203(2) Insurance Contract Act (Versicherungsvertragsgesetz - VVG) sentences 1 and 3 in conjunction with § 155(3) sentence 2 Insurance Supervision Act (Versicherungsaufsichtsgesetz - VAG) and § 155(4) sentence 2 VAG, respectively Muschner, in Langheid, Rixecker, Versicherungsvertragsgesetz, § 203 VVG margin number 23a (2017 Munich). The request for access was therefore aimed solely at being able to examine the legality of the premium increase. According to the data subject, the controller did not fully reply to the access request. After the Frankfurt (Oder) Regional Court dismissed the action as unfounded, the data subject appealed to the Brandenburg Higher Regional Court (OLG Brandenburg). (1) The court held that the value of the triggering factor for the recalculation of the insurance premium does not constitute personal data within the meaning of Article 4(1) GDPR as it is a mere calculation parameter without direct reference to the data subject, and hence does not fall within the material scope of the GDPR. (2) In an obiter dictum, the court also held that, even accepting the idea that the factors at issue constitute "personal data", the controller has a right of refusal under Article 12(5)(b) GDPR for abuse of the right of access
Plaintiff is the umbrella organization of the consumer advice centers in Germany. Defendant is a media company. The media company integrated about 18 third-party-cookies on its website like Double Click from Google. They relied this on Art. 6 (1) (f) GDPR. The company did not implement any information about that on their start page and linked to the privacy policy not before implementing and analyzing the cookies. These cookies enabled profiling via tracking across different platforms. The plaintiff sent a warning on 20 June 2019 which the defendant declined on 14 August 2019. The defendant implented in August 2019 an opt-in cookie banner and changed their privacy policy. The plaintiff is of the opinion that there is no legitimate interest of the defendant and neither the weighting up would turn out in favor of the defendant. The plaintiff criticizes the insufficient information and continues that the incorrect legal basis leads to the false imagination that it is allowed to implement cookies without consent. The defendant is of the opinion that it is necessary because they otherwise would not be able to implement their offers on their website free of cost and also the cookies were set by third parties. The court is of the opinion that browser settings allowing a transfer of data are no active consent for lack of a deliberate decision of the affected persons. Further the court held that the setting of cookies from third parties is attributable to the defendant as they were payed for that. The court does not follow the opinion of the defendant that the freedom of press includes the advertisement as there is a certain part of jounralistic work needed for Art. 85 GDPR.
This ruling of the Belgian court of appeal (Marktenhof) concerns the Belgian Railway company SNCB/NMBS (controller), a company with the Belgian state as its only shareholder. During the COVID-19 Pandemic, the controller was ordered by the Belgian government to start an initiative to promote train travel. On 13 October 2020, the controller emailed railway pass holders to inform them about the use cases of this travel pass and also provided COVID-19 related information. This e-mail resulted in GDPR related discussions on Twitter, specifically regarding the lack of the possibility to object. The Belgian DPA started an investigation on that matter and found that by not providing the possibility to opt-out of receiving similar emails, the controller violated Articles 12(2), 21(2) and 21(4) GDPR. Moreover, the DPA held that the controller violated Article 5(1)(a), 5(1)(c), 5(2), 6(1), 12(2), 21(2) and 21(4) GDPR. The controller was fined €10,000 (a summary of this decision is available on the [https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_71/2022 hub]) and decided to appeal the decision with the Appeal Court on the following grounds: First, the controller contested the applicability of the GDPR, considering that the e-privacy directive was applicable as lex specialis. Second, the controller stated Article 6 ECFR had been breached because it had not been able to comment on a piece of evidence. Third, the controller stated that the decision of the DPA was based on an inaccurate and incomplete representation of the facts. Among the others, the controller disputed the DPA’s definition of ‘Direct marketing’. It added that it had sent the e-mail in the first place because it was obligated to do so pursuant to the government's instruction. It had to provide COVID-19 related information and promote its full service as part of its public service obligation. Fourth, the controller argued that the DPA did not properly motivate the GDPR violations in the disputed decision
The data subject used the service provided by Facebook, the controller. The controller's service allowed users to select whether they wanted to be seen publicly, among others their phone number. If this function was set to be visible to everyone then the phone number could be linked with the person's profile and such profile could be found by everyone using in possession of the phone number. This function was the default setting. A data breach in 2019 had as a consequence that unauthorised third-parties could link phone numbers and profiles because of the above-mentioned function. 533 million Facebook users were affected. Consequently, the data subject claimed in court non-material damages pursuant to Article 82. They alleged a series of unsolicited calls and phishing emails following the breach. The court rejected the data subject's claim. The court held that the controller did not breach the GDPR because the processing was lawfully based on consent. The data subject voluntarily agreed to the privacy policy when registering. According to the court, the privacy policy was also presented in a transparent manner in accordance with Article 5(1)(a) GDPR. Moreover, the obligations under Article 25(2) GDPR, according to which the protection of personal data has to be ensured by design and by default, were also not infringed because the controller's service explicitly gave the data subject the option to customize the settings in privacy-friendly terms. Furthermore, the controller did not infringe its confidentiality obligation under Article 5(1)(f) GDPR, as the data subject did not change the above mentioned function after the data breach occurred. An infringement pursuant to Article 33 and 34 GDPR was also excluded by the court because legally speaking there was no data breach to begin with. Not only the data subject willingly made public their personal data, but also did not change the settings after scraping event, as stated above. Thus, the controller was obliged
The parties were in dispute over claims for damages, injunctive relief and information in relation to the use of the social media platform Facebook operated by Facebook (now: Meta) and a data scraping incident. The data subject is a Facebook user. Facebook operates a social media platform and is the data controller. Among other features, Facebook provides its users with the ability to import contacts from their address book, called the Contact Import Tool. The purpose of the tool is to allow users to import contacts and thus find friends on Facebook's social media platform. The Contact Import Tool has been abused by unauthorised third parties to harvest contact information from Facebook users. By enumerating batches of possible phone numbers, it was possible to manipulate the tool to return personal information about Facebook users. The data queries were automated. This made it possible to extract large amounts of data from Facebook's user database. Unauthorised third parties were able to match the phone numbers on Facebook with certain publicly available data to further identify specific individuals. At an unknown time, presumably between January 2018 and September 2019, third parties read personal data (specifically name, gender and user ID) from Facebook's database and were able to associate specific phone numbers with each record. At the beginning of April 2021, the data sets obtained in this way were made available for download on the Internet in a well-known "hacker forum", including the data set of the data subject. The data subject is of the opinion that he is entitled to non-material under Article 82(1) GDPR, because Facebook made the plaintiff's personal data available to unauthorised third parties. In particular, Facebook did not adequately protect personal data from web-scraping attacks, for example by using "security captchas" to make it more difficult for software to make automated queries. The data subject further argued that Facebook failed to co
The data subject created an account with the controller in order to purchase goods online. In this context, they allegedly were forced to give consent to the processing of their personal data for the purpose of advertising. The data subject lodged a complaint with the Austrian DPA. The Austrian DPA declared the processing unlawful. The controller appealed the decision, arguing that the data subject was not actually "forced" to create a customer account to purchase the goods. As a matter of fact, they could have ordered the goods by using a so-called “guest” option, which would not imply any processing for advertising purposes. To the contrary, the creation of a customer account implies that a user wants to have access to discounts and be informed about offers concerning the controller's products. The court upheld the controller’s appeal. Pursuant to Article 4(11) GDPR, consent must be freely given. In light of Article 7(4) GDPR, this is clearly not the case when the conclusion of a contract is made dependent on the data subject’s consent, unless consent is necessary for the performance of the contract. Thus, the court checked the nature of the contract in the case at issue. The court found that it was not possible to separate the creation of an account with the controller from the purchase of goods online. Such an account did not exclusively serve the purpose of sharing offers and discounts with the data subject. The purchase of goods could rather be seen as the main object of the contract. For such a purpose consent to the processing of personal data for advertising was not necessary. The court then checked whether the guest option could be a valid alternative to achieve the object of the agreement. The court rejected the DPA’s argument that the guest option was no valid alternative to the creation of an account with regard to the purchase of online goods. The court acknowledged that the use of a guest option entails an additional effort for the user, namely the
The data subject made an access request with the controller – a mail services provider. The controller delivered targeted political advertisements and the data subject why they were assigned to certain political affinities. However, in the data subject's view, the controller’s reply was not complete. For example, it did not contain the sources of the data and how the data subject was associated with certain political preferences for the purpose of political advertising. The data subject lodged a complaint with the Austrian DPA. The Austrian DPA upheld the complaint and found a violation of Articles 12(1) and 15(1)(g) and (h) GDPR, as the controller did not provide information about the sources and about how the affinity between the data subject and certain political groups had been inferred. The controller appealed the decision, arguing that the information asked by the data subject was not personal data but only “marketing classifications” to which neither profiling within the meaning of the GDPR nor Article 22(1) GDPR applied. The court upheld the controller's appeal. First, according to the judges, the sources were duly disclosed in the answer to the access request. The disclosure was also transparent and comprehensible, complying with the requirements of Article 12(1) GDPR. Second, concerning the alleged violation of Article 15(1)(h) GDPR, the court found that the controller provided sufficient information to understand the logic behind the automated decision-making pursuant to Article 22(1) and (4) GDPR. As a matter of fact, data processed were address, age and sex of the data subject; the method used a “statistical” one; and the purpose of the processing was to avoid to deliver irrelevant advertisement to the data subject. The court did not concern itself with the problem whether the processing at issue was profiling, nor with the issue whether the “marketing classifications” were actually personal data. The court stated that the disclosure of the algorithm
The data subject was an employee of the controller. The data subject claimed that a manager addressed them through their official email address, even if the communication concerned personal issues unrelated to work. Thus, the data subject filed a complaint with the Austrian DPA. The Austrian DPA dismissed the complaint because it was lodged after more than 1 year after the data subject became aware of the alleged infringement. The data subject appealed this decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG) for violation of Article 77 GDPR. The court clarified that Article 77 GDPR, providing for the right to lodge a complaint with the competent DPA, does not establish any deadline for the exercise of such a right. However, the activity of the DPAs is regulated by national procedural law within the limits of Article 58(4) GDPR. In lack of a regulation addressing the matter, specific rules governing procedures before the DPAs are subject to the principle of procedural autonomy of the Member States. The only limits to such a broad discretion of the Member States are the principle of equivalence – according to which procedural guarantees concerning European rights cannot be lower than guarantees set forth in the context of merely national rights – and the principle of effectiveness, which states that the exercise of European rights shall not be made impossible or excessively difficult in practice. In the present case, the court pointed out how that the 1-year limitation period applied both to GDPR-related complaints and complaints which were exclusively based on national law. Therefore, the protection offered by the Austrian legislator respected the principle of equivalence. Moreover, the introduction of such a deadline was considered necessary by the legislator, as the assessment of excessively old data protection violations would be in practice very difficult, if not impossible. In light of the above, the court rejected the
The plaintiff was a user of the defendant's social media plattform. He registered his profile with his phone number and didn't change the preset visibility option to "not visible". This option is set to "visible" in order to get found by phone number, the users get informed about this during registration. Business Insider on 4/3/2021 published an article reporting about scraping of phone numbers from the defendant's platform by unknown third parties. On July 2, 2021, The plaintiff sent a letter to the defendant demanding payment of damages and a cease and desist order, the defendant responded to the plaintiff's letter on September 30, 2021. On November 25, 2022, The Irish Data Protection Commission fined the defendant for violating the GDPR with €265 million for violating the GDPR and ordered the defendant to take remedial action. The plaintiff has not yet been the victim of identity theft; her account at the defendant's platform has also not been taken over by unknown third parties. The plaintiff has since changed the settings in her account so that her telephone number can no longer be accessed via the contact import tool. The plaintiff argues that she has been victim of a data breach, received (but did not answer) several calls from outside the country, that she lost control over her data and was in big worries about misuse of her data. She mentioned that she's getting a lot of strange short messages with apparent fraud attempts. This was due to missing security controls on the defendant's platform. The defendant argues, that the claim was to dismiss as the claims were too vague and the claim for a declaratory judgment lacked interest. The requirements for a claim for damages under Article 82 GDPR were not met since scraping was not hacking. In addition the defendant argued the loss of control alleged by the plaintiff was not sufficient. The claim is inconcise: text messages and calls from the beginning to mid-2019 described by the plaintiff are not necessarily
The data subject requested the Dutch DPA enforce the GDPR against the Council of State. In particular, the data subject asked the DPA to review whether giving journalists access to procedural documents was in accordance with the GDPR. The DPA declared itself not competent to decide on the processing operations undertaken by a court in its "judicial capacity". The data subject appealed this decision before the District Court Midden-Nederland. Among others, the data subject argued that if the DPA lacked competence to decide on their enforcement request, it should have forwarded it to an independent supervisory authority. The GDPR committee of the Council of State, mentioned by the DPA, did not qualify as independent. The court referred preliminary questions to the CJEU on the interpretation of 'judicial capacity' in the sense of Article 55(3) GDPR. The CJEU decided on 24 March 2022 (C-245/20) that it is part of a court's exercise of its "judicial tasks" within the meaning of Artilce 55(3) GDPR to temporarily provide journalists with documents containing personal data that originate from a judicial procedure, in order to enable them to report more effectively on the progress of that procedure. The Court implemented the CJEU decision and held that the DPA was right in declaring itself not competent. As a matter of fact, under Article 55(3) GDPR a DPA does not have the competence to oversee processings such as the ones at issue in the present case. The Court mentioned Recital 20 GDPR, which allows to specific bodies within the judicial organisation of each Member State to supervise data processing by courts and other judicial authorities. The Dutch legislator intentionally left the organisation of judicial supervision to the judiciary itself. The Council of State created a specific GDPR committee to handle such supervision. The committee is competent to overview processing operations undertaken within the Council of State's judicial tasks, according to GDPR in Article
The judgement of the Court of Appeal of Milan was appealed following its confirmation of the ruling of the Court of First Instance, which had established the illegitimacy of the dismissal of a manager (the defendant) by Banca Widiba Spa (the applicant) on 8 May 2018. The defendant was fired due to conduct of insubordination and breach of the duties of diligence and loyalty as well as of the general principles of fairness and good faith for having relations with competing businesses and for having avoided a preventive technical assessment, causing doubts over the genuineness of the illness underlying his many absences. The Court of Appeal, agreeing with the Court of First Instance, ruled the illegitimacy of the first two disciplinary charges as they were the result of investigative monitoring of company e-mails and tailing, which did not ensure the proportionality and procedural guarantees against arbitrariness of the employer and lacked justification for such invasive monitoring, violating the right of the worker’s right to respect for his correspondence. The applicant filed for an appeal against the decision to the Supreme Court of Cassation (Supreme Court). The Supreme Court established an infringement of [https://www.cgil.unimi.it/wp-content/uploads/2014/01/l_300_70.pdf Article 2 of the Italian Worker’s Statute], [https://www.cgil.unimi.it/wp-content/uploads/2014/01/l_300_70.pdf Article 3 of the Italian Worker’s Statute] and [https://www.cgil.unimi.it/wp-content/uploads/2014/01/l_300_70.pdf Article 4 of the Italian Worker’s Statute] and [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 113 of the Italian Privacy Code], [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 114 of the Italian Privacy Code] and [https://www.echr.coe.int/documents/d/echr/convention_ENG Article 160 of the Italian Privacy Code] in connection with the protection of the confidentiality of the employee, [https://www.echr.coe.int/documents/d/echr/convention_E
The data subject was a Facebook user. According to the privacy settings selected at the moment of the facts, their phone number could be used by a third person to find the data subject’s profile on Facebook, even if the phone number itself was not public. Accordingly, information relating to the data subject could be linked to their phone number by anyone in possession of such a number. In 2019, unknown “third parties” automatically combined telephone numbers and matched them with Facebook profiles thanks to the above-mentioned function. In this way, telephone numbers could be assigned to identified users. This resulted in a data breach concerning 533 million people in 106 different countries. The data subject lamented that since the data breach they received phishing emails and calls. In light of the loss of control over their personal data, the data subject claimed damages for €1,000 under Article 82 GDPR. According to the court, the controller contravened to its obligation to guarantee integrity and confidentiality of data pursuant to Article 5(1)(f) GDPR and violated the principle of privacy by default and by design (Article 24 GDPR). The controller was aware of the risks that web scraping entails and still did not adopt appropriate security measures pursuant to Article 32 GDPR, such as removing the matching function described above. Concerning the existence of non-material damages pursuant to Article 82 GDPR, the court found that combining telephone numbers with other personal data potentially exposes users to several risks, including identity theft and targeted criminal activities. Therefore, an “abstract damage” could be compensated in the present case. To the contrary, no concrete negative consequence was actually proved by the data subject. In particular, the alleged phishing emails and calls could not be causally linked to the data breach, as other causal explanations were possible. In light of the above and considering that the data subject suffered
The Works Council Chairman of a subsidiary was appointed as the DPO of the mother company and its German subsidiaries in 2015. With the parallel appointment of the same person as the DPO for the whole group of undertakings, the mother company, the controller, aimed to synchronize the privacy standards in the group. In 2017, the controller asked the DPA of Thüringen whether such an appointment was lawful, due to concerns of conflict of interests and lack of reliability as under [https://dejure.org/gesetze/BDSG_a.F. § 4f(2) of the German Federal Privacy Law (Bundesdatenschutzgesetz - BDSG)]in its old version (a.F.). The DPA communicated in writing on 24 November 2017 that the requirements for a DPO appointment were not fulfilled at that time since the DPO was also the Works Council Chairman, therefore the appointment was null for incompatibility. Hence, the DPA declared that the controller did not have a DPO from 2015 on and that it should appoint a new DPO by 8 January 2018 or it would risk a fine of €50,000. As a consequence, the controller informed the DPO that it would revoke his appointment of 2015 with immediate effect. Upon entry into force of the GDPR, the controller also sent him a separate revocation letter referring to the operational reasons under Article 38(3) GDPR, second sentence. The DPO therefore filed a lawsuit in front of the Labour Court to challenge his revocation. In its submissions, the controller requested that the appeal be dismissed since the incompatibility of offices constitutes an important reason within the meaning of [https://dejure.org/gesetze/BDSG_a.F. § 4f(3) BDSG (a.F.)] and [https://www.gesetze-im-internet.de/bdsg_2018/index.html § 38(2) BDSG, § 6(4) BDSG] in conjunction with [https://www.gesetze-im-internet.de/bgb/ § 626 of the German Civil Code (Bürgerliches Gesetzbuch -BGB)]. In the first instance, the Labor Court of Dresden upheld the claim of the DPO and the Regional Labor Court of Saxony also dismissed the controller's
A medical doctor, the controller, used the national health care portal to access information about the vaccination status of a data subject who had applied for a job. The DPA opened an investigation against the controller who, in turn, acknowledged a violation of Article 9 GDPR, as they unlawfully processed health data of the data subject. The DPA imposed a €3,500 fine for the violation of Article 9 GDPR. The fact that the controller was a doctor, that they processed special categories of data and that they did it intentionally were considered aggravating factors in the quantification of the fine. The controller appealed the decision, claiming that the fine was disproportionate. In assessing the proportionality of the fine, the Federal Administrative Court examined how the DPA applied Article 83(2) GDPR at the facts at issue. Concerning Article 83(2)(a) GDPR, it is true that the controller position as a doctor should be considered an aggravating factor. However, the court also found that these data should have been disclosed in any case to the controller during the job interview, according to Austrian law. In this context, the court found particularly relevant that the controller processed only vaccination data and no other special categories of personal data pursuant to Article 9 GDPR. The court also regarded the fact that the processing occurred during highly stressful times of the pandemic as a mitigating factor pursuant to Article 83(2)(k) GDPR. Finally, the court disregarded the intentional character of the violation (Article 83(2)(b) GDPR) as an element to determine the amount of the fine. In light of the above, the court reduced the amount of the fine to €2,000.