GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
The rental company A Oy (the controller) regularly collected the personal identity numbers of minor children of families living in or applying for accommodation in rented accommodation. The Finnish DPA had ordered the controller to bring the processing operations regarding collection of the children's personal data into compliance with the GDPR, and to delete the collected personal identity numbers of minor children to the extent that there was no appropriate legal basis for their collection. In its decision, the DPA found that it was not necessary for the controller to, as a rule, collect the children’s personal data in light of the data minimisation principle stipulated in Article 5(1)(c) GDPR. The controller appealed the decision with the Administrative Court of Northern Finland which annulled the DPA’s decision. The Administrative Court viewed, inter alia, that the controller had a legitimate interest pursuant to Article 6(1)(f) GDPR for processing personal data of children for the purpose of its rental activities. Thereafter, the DPA challenged the court’s decision and appealed it with the Supreme Administrative Court in Finland. The DPA argued that the previous Court was incorrect to conclude that the processing in question was lawful because the controller had a legal basis under Article 6 GDPR. The DPA established that notwithstanding that the controller has a legal basis for processing, processing is still in breach of the GDPR when personal personal data are unnecessary for the specific purpose. In the view of the DPA, the court had failed to apply the principle of minimisation. The Supreme Administrative Court noted that the initial decision of the DPA did not address Article 6 GDPR. Therefore, the Supreme Administrative Court did not address the question of whether the controller had a legal basis within the meaning of Article 6 GDPR. The Supreme Administrative court focused on whether the controller’s collection of personal data of the children comp
In 2018, the data subject secured a loan from ING bank (the controller). Following this, several unauthorized activities occurred on his checking account, and the controller subsequently placed registrations with respect to the data subject in the Dutch Central Credit Information System (CKI). These registrations contained payment behaviour data, among other things the fact that for a certain period, the data subject was unable to fulfill their payment obligations set out with the controller. The data subject objected the CKI registrations on the basis of Article 21 GDPR, explaining that it had an impact on a loan he was taking out for a new house. The controller denied the request and further considered it as inadmissible under national provisions. The court dismissed ING's plea for inadmissibility under national provisions. The court then clarified that under national law, credit providers are mandated to process personal data and participate in the Central Credit Information System. The aim of the provision is twofold: firstly, it seeks to protect consumers from over-indebtedness and secondly, shield creditors from non-paying borrowers. The court added that the rejection of a request for data deletion under Article 21 GDPR needs to be justified by a compelling legitimate interest, subject to the principles of proportionality and subsidiarity. Legitimate interest must be assessed on the basis of currently known facts and circumstances of the case, including those after the CKI registration. The court pointed out that the data subject had inconsistent debt repayment patterns but fully cleared his debt in 2023 (i.e. after the CKI registration). In the balance of interest, the court considered that the controller's interest in maintaining the registration outweighed the data subject's interest in their removal. Consequently, the court dismissed the appeal.
The data subject was a Facebook user. According to the privacy settings selected at the moment of the facts, their phone number could be used by a third person to find the data subject’s profile on Facebook, even if the phone number itself was not public. Accordingly, information relating to the data subject could be linked to their phone number by anyone in possession of such a number. In 2019, unknown “third parties” automatically combined telephone numbers and matched them with Facebook profiles thanks to the above-mentioned function. In this way, telephone numbers could be assigned to identified users. This resulted in a data breach concerning 533 million people in 106 different countries. The data subject lamented that since the data breach they received phishing emails and calls. In light of the loss of control over their personal data, the data subject claimed damages for €1,000 under Article 82 GDPR. The court rejected the data subject’s claim. The court referred to the CJEU judgement in case C-300/21, stressing that a mere infringement of the GDPR cannot give rise to damages in itself. At the same time, the court acknowledged that no minimum threshold as a requirement of the right to compensation was admissible under EU law. The court also held that mere annoyance or emotional discomfort could not be used as a basis to substantiate the existence of a damage. In the present case, the data subject was not able to prove more than such a mere annoyance. In particular, further distress originating from the alleged phishing emails and calls could not be causally linked to the data breach. Therefore, the court concluded that the case fell within the category of mere GDPR infringement that could not be compensated as such, as European law does not accept the idea of “punitive damages”.
A company filed a complaint against an individual – the controller – that unlawfully processed personal data of its employees and shareholders. The Austrian DPA dismissed the complaint claiming that the company waited more than 1 year since the time it became aware of the unlawful processing before filing. Therefore, its right to lodge a complaint expired. The company appealed the decision before the Austrian Federal Administrative Court. According to the company, by refusing to examine the case in the merits the Austrian DPA violated Article 77 GDPR. The Austrian DPA argued that a legal person does not fall within the personal scope of the GDPR pursuant to Article 1(1) and (2) GDPR. Therefore, no discussion on the applicability of Article 77 GDPR was relevant in the case at issue. The court clarified that only data subjects within the meaning of Article 4(1) GDPR have a right to lodge a complaint with the competent supervisory authority pursuant to Article 77 GDPR. Legal persons are not included in the category of "data subjects", as the GDPR mentions only “an identified or identifiable natural person”. As a legal person does not fall within the scope of protection of the GDPR, but (potentially) only of national data protection law, the national legislator can establish time limitations in the exercise of the right to lodge a complaint. This was the case with Austrian law, which enables the DPA to reject a complaint when the latter was filed after one year since the relevant facts became known to the affected legal person. Therefore, the court upheld the DPA’s view and dismissed the appeal.
Following several episodes of vandalism, the city council of Regensburg installed surveillance cameras in a communal garden where migrants and marginalised groups of people usually spent their time. The data subject, who usually passed through that area, asked the Administrative Court of Regensburg to order the police to stop recording and remove the cameras. The court of first instance held that the case at issue did not fall within the scope of Directive (EU) 2016/680 (Law Enforcement Directive), but rather of the GDPR. Indeed, the exception under Article 2(2)(d) GDPR did not apply, since the controller was not a law enforcement agency acting with the aim to protect public security. The court also found that the data subject could not rely on injunctive relief against the unlawful processing pursuant to the German Civil Code. According to the judges, Article 79(1) GDPR provides data subject with a legal remedy that is only applicable to violations of Articles 13-23 GDPR individually affecting the data subject. Finally, the court found that the monitoring was in any case lawful, as it was based on a public interest pursuant to Article 6(1)(e) GDPR, namely the protection of public property from vandalism. The data subject appealed the judgement before the Superior Administrative Court of Munich (Verwaltungsgerichtshof München). At the outset, the court clarified that the protection of public property by a municipality does not trigger Article 2(2)(d) GDPR, as it cannot be considered an activity carried out in the context of the fight against crime. Therefore, the GDPR – and not the Law Enforcement Directive – was applicable. The fact that such a purpose could partially overlap with the prevention of crime was not deemed sufficient by the court to rule out the applicability of the GDPR. However, the court of appeal stressed that Article 79 GDPR does not explicitly limit judicial remedies to the rights enshrined in Chapter III of the regulation. Therefore, an inj
The plaintiff in this case is a consumer protection organization under German law. The defendant is a German energy and gas provider, which, with a view to lowering the risk of payment defaults, is in a contractual relationship with SCHUFA Holding AG and another credit rating agency, hereinafter the credit agencies. This contract foresees that whenever an interested individual submits a request for conclusion of an energy provision contract on the online form of the defendant, the latter sends the basic information about the interested persons to the credit agencies, that calculate a credit score about them, and receives information on the economic risks related to those individuals. The plaintiff read the general terms and conditions on the webpage of the defendant and under “Data Protection, Creditworthiness information” – “Data Transmission to SCHUFA and other agency” which stated that the defendant transmits data collected in the request for conclusion, the implementation and termination of a contract and data about non-contractual behavior to the credit agencies, on the basis of Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. The plaintiff considered that the transmission of so-called “positive data” on the implementation and termination of a contract to be unlawful and directed this in a letter to the defendant in December 2020, asking the plaintiff to cease using those clauses. In its view, the transmission of such data was not justified by any of the legal bases of Article 6(1) GDPR. The plaintiff first filed a lawsuit with the Regional Court of Darmstadt, which concluded that it was not competent to deal with the case and referred it to the Regional Court of Frankfurt am Main (Landgericht Frankfurt am Main, LG). The plaintiff asked the court to order the defendant to cease and desist from any further violations and to refrain from using the contested clauses in its terms and conditions in consumer contracts for energy supply. In its submissions, the defenda
The data subject was a Facebook user. According to the privacy settings selected at the moment of the facts, their phone number could be used by a third person to find the data subject’s profile on Facebook, even if the phone number itself was not public. Accordingly, information relating to the data subject could be linked to their phone number by anyone in possession of such a number. In 2019, unknown “third parties” automatically combined telephone numbers and matched them with Facebook profiles thanks to the above-mentioned function. In this way, telephone numbers could be assigned to identified users. This resulted in a data breach concerning 533 million people in 106 different countries. According to the data subject, Facebook violated the principles of “privacy by design” and “privacy by default”. They lamented that the settings just described were Facebook default settings and they could be changed only through a complex procedure. These default settings, alongside wiht the total lack of security measures by Facebook, made data scraping possible. The data subject lamented that since the data breach they received phishing emails and calls. In light of the loss of control over their personal data, the data subject claimed damages for €1,000 under Article 82 GDPR. Facebook replied that it was up to the data subject to change their privacy settings. Moreover, and despite Facebook’s subsequent attempts to prevent and mitigate risks, no measure could entirely protect users from scraping. The Regional Court of Lübeck (Landgericht Lübeck) upheld the data subject claim for damages and granted €500 of compensation. According to the court, the processing was neither based on consent (Article 6(1)(a) GDPR), nor contract (Article 6(1)(b) GDPR), nor legitimate interest of the controller (Article 6(1)(f) GDPR). With specific regard to consent, the court found that it was not informed informed within the meaning of Article 4(11) GDPR. Indeed, finding information about the
In this particular case, the controller had made an unlawful entry regarding a debt of the data subject with Schufa - a German credit ranking system. As a result, the credit score value of the data subject was negatively impacted. The data subject received a letter informing him about the registration and requested the controller to remove the wrong registration. He claimed that due to this negative entry, among other damages, his mental health was affected and that he could not enter into a certain energy supply contract. Later, the entry was deleted. The data subject however considered that he suffered damages in the past and filed a complaint with the Regional Court of Magdeburg. He claimed that he suffered material and non material damages of a total amount of €10,000. The controller argued that this action constituted an abuse of rights. The Court recalled that under Article 82 (1) and (2) GDPR, any person who has suffered material or non-material damage as a result of a violation of the GDPR is entitled to compensation for damages from the person responsible for the damage caused by the processing that violates the GDPR. The Court considered the wrong entry as an unlawful processing and noted that the data subject successfully proved that they had suffered non-material damages, including the damages for the data subject's mental health. Consequently, the Court awarded €4,000 of damages to the data subject.
The data subject in question received official communication from the Mayor of Maastricht, indicating their placement on the "Top-X" list. This list is composed of individuals or groups identified as causing disturbances or engaging in criminal activities. Subsequently, the mayor denied the data subject’s request to be removed from this list. There were two main grounds for the refusal: firstly, the data subject was not actively cooperating with law enforcement agencies and continued causing a nuisance. Secondly, the individual was not partaking in the necessary mental health services that could potentially prevent future disturbances. As such, the Mayor deemed it appropriate to maintain the individual's listing as a precautionary measure to mitigate potential future disruptions. The Court assessed whether the Mayor's processing of personal data constituted a violation of the principle of legality, and whether the Mayor was obligated to delete the data subject's personal data. In its assessment of the potential principle of legality violation, the Court highlighted that data processing is one of the responsibilities of a Mayor for fulfilling a task in the public interest, as specified by Section 172 of the Municipalities Act. Therefore, the public interest exception to the lawful processing of data under Article 6 (1) (e) of the GDPR is fulfilled. The Court further reasoned that the safeguards, which ensure data processing does not exceed what is necessary, established under Articles 8 (1), 5 (4, 5), 6 (1), and 11 (1) of the Covenant ICOV, comply with the requirement of collection of data for specific, explicit and legitimate purposes in Article 5 (1) (b) GDPR. The Court held that the Mayor was not obligated to delete the data subject's personal data, based on the exception provided in Article 17 (3) (e), which allows a rejection of a data deletion request when the data is being processed for a task of public interest.
The case revolves around a dispute between employees (the data subjects) and the Works Council (the controller) regarding access to the records of a works council election. The data subjects were employees at this plant and were eligible to vote and be elected in the election. However, their candidate list was deemed invalid due to the ineligibility of one candidate. Despite their candidate list not being included, the works council with thirteen members was elected and the results were proclaimed. The data subjects contested the election at the Trier Labour Court. They later requested full access to the election documents to prepare their case but received no response, leading them to file a motion for an injunction to access the records, either fully or partially, omitting any data revealing individual voting behavior. The Trier Labour Court granted partial access, excluding materials that might reveal individual voting behaviors. The Works Council appealed this decision, arguing the data subjects' request was too broad and violated data protection laws. The data subjects also filed a cross-appeal seeking full access. The Trier Labour Court initially decided that the data subjects had the right to access the election records, provided it did not violate the election secrecy guaranteed by § 14(1) of the Works Council Constitution Act and GDPR, thus rejecting the unrestricted access request. The Works Council was advised to grant access to the documents necessary for verifying the election's regularity but not those revealing individual voting behavior. Upon appeal, the District Labour Court Rhineland-Palatinate affirmed that while there was a legitimate interest in inspecting the documents, this right was limited by the need to protect election secrecy. Any request that broadly sought access to sensitive data revealing individual voting preferences without justification is unfounded. The District Labour Court Rhineland-Palatinate emphasized that general requests
This case concerns a judicial review against a 2021 decision of the Austrian DPA (Datenschützbehörde - DSB). The decision originally stemmed from a complaint filed by the NGO noyb, following the CJEU judgement in case [https://curia.europa.eu/juris/liste.jsf?num=C-311/18 C-311/18] ("Schrems II"). The Austrian DPA found that the use of Google Analytics by an Austrian website led to the transfer of personal data to the US in violation of Chapter V of the GDPR. At the same time, the supervisory authority ruled that Chapter V of the GDPR sets out obligation only for the data exporter - in the present case, the Austrian website - and not the data importer - Google LLC. Google LLC appealed the decision. Google stated that transfers were lawful as they relied on Standard Contractual Clauses (SCCs) pursuant to Article 46(2)(c) GDPR. It also claimed to have adopted a "risk-based approach" to the transfers, by implementing technical and organisational measures aiming at mitigating the risks to Europeans' data protection rights. The data subject also appealed the decision, arguing that Chapter V of the GDPR applies to data importers, too. In addressing the controller's appeal, the court confirmed that the data transfer to Google LLC was unlawful. Referring to the CJEU judgement in case [https://curia.europa.eu/juris/liste.jsf?num=C-311/18 C-311/18], the court held that SCCs can be considered effective only as long as - on their own or in combination with additional technical and organisational measures - they are able to compensate for the risks taken by a data exporter when transferring data to third countries. If the data exporter is not able to meet these requirements, data transfers are unlawful and shall not take place. With regard to the present case, the court found that even though Google had implemented certain organisational and technical measures, these were not sufficient to prevent US intelligence agencies from accessing Europeans' personal data. As
The Austrian Postal Service (Österreichische Post) (the controller) collected information on the political affinities of the Austrian population according to certain socio-demographic criteria. The controller generated statistics and had drawn a conclusion that a natural person (the claimant) had a high degree of affinity with a specific Austrian political party. The claimant had not consented to the processing, and felt offended by such attribution. The claimant said that the controller caused him great upset, a loss of confidence, and a feeling of exposure by storing data of such assumed political opinions of him. Therefore, the claimant brought an action for non-material damages before the Regional Court for Civil Law Matters in Vienna (Landesgericht für Zivilrechtssachen Wien) pursuant to Article 82 GDPR. The first-instance court rejected the claim for compensation. The Higher Regional Court of Vienna (Oberlandesgericht Wien), as the appeals court, upheld the judgment because it viewed a threshold was not reached as Austrian law requires damages to reach a certain ‘threshold of seriousnessness’. The decision was appealed to the Supreme Court in Austria (Oberster Gerichtshof), which referred to the CJEU for a preliminary ruling on the following matters: * 1) If the mere infringement of GDPR provisions in itself is sufficient for the right to receive compensation under Article 82 GDPR or is it required that an applicant must have suffered harm. * 2) If the assessment of the compensation depends on further EU law requirements in addition to the principles of effectiveness and equivalence. * 3) If a threshold exists for the damage caused by a GDPR infringement that goes beyond upset caused by the infringement to have a right to receive compensation under Article 82 GDPR. With regard to the first (1) question, it was established by the CJEU that Article 82 GDPR includes three cumulative conditions to give rise for the right to compensation. Those three conditions
The controller – CRIF – was a company that provided its client with information concerning the creditworthiness of third parties. The data subject asked the controller to provide them with a copy of their data undergoing processing. The controller replied by submitting a summary with the list of such personal data. In the context of a complaint before the Austrian DPA, the data subject lamented that this was not sufficient. However, the supervisory authority held that the controller did not violate the GDPR. The data subject appealed the DPA decision and the court referred the matter to the CJEU. The preliminary question concerned the scope of the right to a copy of data undergoing processing pursuant to Article 15(3) GDPR. According to the CJEU, the GDPR does not contain any definition of “copy”. However, this word, in its usual meaning, indicates a “faithful reproduction or transcription of an original” in opposition to a “purely general description” of data. The true question, however, was whether Article 15(3) GDPR covers “extracts from documents or even entire documents or extracts from databases”. The copy does not refer to the document as such but to the personal data undergoing processing, which must be complete. The Court stressed that the right to a copy – originally not provided by the data protection directive – aims to enable the data subject to protect their rights and interests under the GDPR. As the protection of data subjects’ rights is the rationale behind the right to a copy (and more in general behind the principle of transparency) a copy of data undergoing processing must reproduce data “fully and faithfully” in a manner that enables the data subject to exercise their rights. In conclusion, the right to a copy under Article 15(3) GDPR entails that data subject must be given a faithful and intelligible reproduction of all their personal data. This may include, to the extent that it is necessary to protect their rights and interests, copies of
On March 27, 2018 the Data Subject filed a complaint on CNIL againt Euronext group, specifically addressing the handling of her personal data by the Irish Stock Exchange, her employer, a subsidiary of Euronext. On March 28, 2022, the case was closed by CNIL because the Authority understood that the Irish Data Protection Authority is the one competente for addressing the issue, since the Data Subject employer, the Irish Stock Exchange, is a company located in Ireland. In addition, the Data subject and personal data processed was limited to this location. Dissatisfied with this outcome, the Data Subject sought annulment of the CNIL's decision for abuse of power and requested that the CNIL be instructed to sanction the companies involved. The Conseil d'État rejected the Data Subject's request, upholding the CNIL’s decision to close the complaint. The Court found that the CNIL correctly applied GDPR regulations, specifically Article 55 and Article 56, which dictate that in cross-border data processing situations, the Lead Supervisory Authority is generally that of the main establishment of the controller, unless the data processing is confined to a single member state and significantly affects individuals only in that state. In this case, the CNIL determined that the relevant data processing was indeed cross-border, handled by a central office in France, but the complaint was specific to the Data Subject employment in Ireland, making the Irish Data Protection Authority solely competent to address it.
An applicant (data subject) lodged an application for international protection with the Federal Office for Migration and Refugees in Germany (‘the Federal Office’). The Federal Office rejected the application, relying on the electronic ‘MARIS’ file which it had compiled, and of which contained the personal data relating to the applicant. The applicant bought an action against the Federal Office before the Administrative Court in Wiesbaden, Germany (Verwaltungsgericht Wiesbaden). The electronic ‘MARIS’ file was sent to court in the context of a joint procedure under Article 26 GDPR, via the Electronic Court and Administration Mailbox. However, the lawfulness of such transfer was questioned by the Court as the Federal Office was unable to evidence an arrangement of the respective responsibilities of the joint controllership, despite a request made to that effect by the Court. Furthermore, the Court expressed doubt that the maintenance of the electronic MARIS file with the combined provisions of Article 5(1) and Article 30 GDPR due to the Federal Office failing to produce a complete record of processing activities relating to that file upon request. The Court decided to stay the proceedings and refer the following questions to the CJEU: (1) whether the failure of a controller to comply with the accountability principle (Article 5(2)) amounts to ‘unlawful processing’ which would enable an individual to exercise their right to erasure or rectification under Article 17(1)(d) and 18(1)(b) GDPR. In particular, the controller in this case failed to maintain a record of processing activities (ROPA) pursuant to Article 30 GDPR and lacked an arrangement for joint procedure in accordance with Article 26 GDPR. (2) whether the fact that the data subject has given his or her express consent or objects to the use of his or her personal data in the context of judicial proceedings can affect the possibility of those data being taken into account. If that court were unable to consi
The data subject and the controller – an insurance company – litigated about the lawfulness of some premium adjustments in the data subject’s insurance policy. In this context, the data subject made an access request with the controller in order to obtain information on the basis of which the adjustments were triggered. The controller refused to comply with the data subject’s access request. The court of first instance aligned with the controller and declared the data subject’s action inadmissible. The Higher Regional Court of Hamm (Oberlandesgericht Hamm – OLG Hamm) upheld the court of first instance’s decision. The court did not exclude that in principle some of the information requested by the data subject were personal data within the meaning of Article 4(1) GDPR. Nevertheless, in this case the controller had the right to disregard the request in light of Article 12(5)(b) GDPR, as the latter was excessive. To ascertain whether an access request is excessive it is necessary, among others, to verify if the request pursues the goal of Article 15 GDPR, to be read in light of recital 63. In particular, an access request should enable a data subject to be aware of any processing operations concerning their personal data and check the lawfulness of said processing. In the present case, the data subject used instead the access request for a purpose which did not fall within the scope of data protection, namely to check whether premium adjustments were lawful under insurance law. The court stressed that this does not automatically entail that the data subject shall motivate their access request or distinguish between data protection purposes and other purposes. However, in cases where it is clear that the only purpose of the request is not related to data protection, the controller has a right to refuse to comply with the request. Finally, the court acknowledged that the issue could be the object of a preliminary reference to the CJEU. However, being the OLG Hamm not
The controller, an employer, hired a private detective to monitor the data subject, an employee, during a sick leave. Surveillance measures were due to the fact the controller had reasons to doubt that the data subject was actually sick. As a matter of fact, eventually the controller used the information collected in this way to fire the data subject. The latter appealed the decision before a labour court, claiming that the decision was unlawful. They also claimed non-material damages in violation of their personality right due to the surveillance. The court of first instance upheld the data subject’s claims and considered that damages had to be compensated pursuant to Article 82 GDPR. The controller appealed the first instance decision. The court rejected the controller’s appeal and confirmed that the data subject should be compensated for the damage suffered. At the outset, the court confirmed the unlawfulness of the surveillance measure. According to the court, regardless of whether the controlled tried to base the processing on contract (Article 6(1)(b) GDPR) or legitimate interest (Article 6(1)(f) GDPR), the requirement of necessity was not met in the present case. By choosing to monitor the data subject by means of a private detective, the controller did not adopt the less intrusive measure and also violated the principle of data minimisation. Concerning Article 82 GDPR, the court referred to the CJEU judgement in case [https://gdprhub.eu/index.php?title=CJEU_-_C-300/21_-_%C3%96sterreichische_Post_AG C-300/21], where the latter clarified that non-material damages under the GDPR cannot be granted in case of a mere violation of the Regulation. As a matter of fact, a negative consequence stemming from the violation must be proved. At the same time, it is not necessary that such a consequence reaches a certain threshold of seriousness to be compensated. The court found that the surveillance of the data subject by means of a private detective necessarily entaile
The data subject and the controller – an insurance company – had a civil proceeding concerning the increase of the contributions the data subject was expected to pay to be insured with the controller. In particular, the data subject claimed that such increases were illegitimate. To prove this point, the data subject requested access to their personal data pursuant to Article 15 GDPR. The controller denied access. Therefore, the data subject requested the Regional Court of Hamburg (Landgericht Hamburg – LG Hamburg) to order the controller to provide access to the information at issue. The court adjudicated on the access request in the context of the broader civil proceeding pending between the parties. The court rejected the data subject’s claim. In particular, the court found that the controller could refuse to consider the data subject’s access request pursuant to Article 12(5)(b) GDPR. As a matter of fact, the request was ‘excessive’ and could be framed as a case of abuse of right. According to the court, the purpose of Article 15 GDPR is expressed by Recital 63 of the Regulation, which clearly states that an access request should enable a data subject to become aware of data processing involving their data and check the lawfulness of processing operations. In the present case, the data subject tried to Article 15 GDPR for a purpose that had nothing to do with data protection. The dispute between data subject and controller was in reality only an insurance law dispute.
The plaintiff was a member of the defendant, a registered association with approximately 5,500 members, and requested that the association transferred a list containing the names, addresses and e-mail addresses of the association's members directly to them, i.e. without the involvement of a trustee. These data were necessary in preparation for the association's general meeting. The plaintiff's concern was to contact other members to organize opposition to the actions of the association's board. Following the general meeting, the plaintiff also intended to contact members in the same manner in order to initiate the calling of an extraordinary general meeting, pursuant to § 37(1) of the German Civil Code. After the Dortmund Regional Court denied the plaintiff's claim to transmission of the list of members, the plaintiff appealed to the Hamm Higher Regional Court (OLG Hamm). The court sustained the appeal. Interestingly, the court examined the dispute first from an association law perspective and then from a data protection perspective. National law (association law) First, the court stated that a claim requires a legitimate interest of the association member, which must not be outweighed by any secrecy interests of the association or legitimate interests of the association members in the context of a comprehensive weighing of interests in the individual case. The basic interest involved in this case, the organization of an opposition to the policy of the defendant's association board, must be considered as legitimate. This interest requires to get in contact with the other members also outside of the meeting of the members, for example in order to motivate these to participate in those meetings in the first place. In particular, the plaintiff had a legitimate interest in obtaining the e-mail addresses, since e-mail communication enables an almost free, direct, individualized exchange practically without time delay, but at the same time also asynchronous communicati
On 17 May 2020, the data subject exercised their right of access (Article 15 GDPR) at the Dutch Tax Authority, de belastingdienst (controller). The controller refused to provide access to the relevant files, which lead the data subject to file a complaint with the Dutch DPA on 17 June 2020. On 25 March 2021, the DPA rejected the complaint of the data subject. The reason for the rejection was not specified in this decision. On 2 November 2021, the data subject appealed the decision. According to Dutch administrative law, the DPA itself had to assess this appeal (in Dutch: bezwaar). On 3 May 2022, the DPA requested the controller to provide information regarding the data subject to assess this appeal. The controller replied on the same day and provided details about ongoing financial procedures between the controller and the data subject. On 2 June 2022, the controller made a decision regarding the data subject's access request. It is not clear from this ruling if the controller provided access and if so, in what from. On 11 July 2022, the DPA agreed with the appeal of the data subject and warned the controller for not answering the access request within the time limit, in violation of Article 12(3) GDPR. The data subject, who was apparently not satisfied, appealed this decision to the District court of Den Haag (in Dutch: Beroep). On 18 October 2022, the data subject filed another complaint with the DPA against the controller because it provided information to the DPA on 3 May 2022. In his appeal, the data subject filed claims against both the DPA and the tax authority. Regarding his claim against the controller, the data subject stated that the controller never informed him about its decision of 2 June 2022 regarding the access request. The data subject claimed a compensation of €25,000. Regarding his claim against the DPA, he stated that the DPA did not properly execute its tasks under the GDPR. For this, the data subject requested €25,000 for imma