GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
The controller was a telecommunication company. In its contracts with the customers, the controller informed the latter that personal data, including “positive data”, could be transferred to the credit ranking agency SCHUFA. The controller and SCHUFA were in a mutually advantageous relationship: the former got reliable information to check potential customers’ creditworthiness, the latter improved its scoring system. According to the plaintiff, a consumer association, such data sharing violated Articles 5(1)(a) and 6 GDPR, as neither contract nor legitimate interest could be used as a legal basis for transmission of data to SCHUFA. Therefore, the consumer association asked a court to stop the disclosure of so-called “positive data” to SCHUFA. By "positive data" we refer to personal data that do not show any data subject’s negligence in the performance of the underlying contract with the telecommunication company. In response to the legal claim, the controller raised several points. Firstly, the association did not have legal standing, as it represented consumers and not data subjects. Secondly, the controller argued that Article 80(2) GDPR did not apply at the case at issue, as no concrete violation of the GDPR with regard to a specific data subject was alleged by the association. The association lamented an abstract violation as a consequence of the controller’s privacy policy. In the merits, the controller stated that the disclosure of personal data to SCHUFA was subject to strict and clear requirements. Data processing was covered both by Article 6(1)(b) and (f) GDPR, as it was necessary to perform telecommunication contracts and prevention of credit risks and fraud was a legitim ate interest of the controller and society at large. Thanks to the disclosure the consumers also improved their SCHUFA “score” through positive data points. From the outset, the court clarified that the GDPR aims to protect the data subject’s fundamental rights not only as a citizen, b
A dispute arose about material required by the election committee for conducting works council elections at an online eyewear retailer employing nearly 400 people. The employer had partially complied with requests by the election committee but withheld some email and postal addresses, citing privacy concerns and the feasibility under data protection laws. The matter was taken to court to resolve whether the employer must provide complete information. The court affirmed the employer’s obligation to provide the complete list of email and postal addresses, detailed by location and job function, as required by the election committee to smoothly conduct the works council elections. The ruling referenced multiple laws, including § 24 WO and § 26 BDSG, stating the processing of personal data for election purposes is lawful without employee consent, due to its necessity for the election process. The court also clarified that data protection concerns did not outweigh these statutory obligations.
A data subject found that an American company (controller) had collected personal data about him and was marketing it on its website. The data subject contacted the controller about this, who responded with an automated message asking him to fill in an identity verification form in order to process his request. On 8 July 2020, the data subject requested the Luxembourg DPA to order the controller to comply with his request. He believed that the controller had violated Article 15 GDPR for not handling his access request correctly and 27 GDPR for not having an establishment in the EU. The DPA asked the data subject to provide correspondence with the controller. In August 2020, the DPA informed the data subject that it would no longer deal with his request as the controller was US based and the DPA therefore had no power to impose measures under the GDPR. The data subject insisted that the controller offered services on the internet and that a simple search via a search engine would find his personal data on the controller's website. He also asked why the DPA felt it did not have the authority to investigate in the US. On 16 October 2020, the DPA replied by letter that it had contacted the controller but that without its response it was impossible to proceed. It also repeated that it had no means of action against a US based controller. The data subject, represented by noyb, appealed this decision of the DPA to the administrative Court (hereafter the Court) to have the DPA's letter reversed or annulled. He considered that he had a standing to act under Article 78 GDPR, especially since his data was still present on the controller's site. He argued he was therefore damaged by the DPA's decision not to pursue with his request. The data subject also argued that the DPA had violated Article 77 GDPR. Finally, he explained that the controller did not provide a copy of his access request, reason why he could not provide this document. First, the Court considered that th
A data subject found that an American company (controller) had collected personal data about him and was marketing it on its website. On 5 April 2019, he contacted the controller, who replied the same day with a copy of his personal data and informed the data subject that it had deleted his personal data. Still on 5 April 2019, the data subject lodged a complaint with the Luxembourg DPA to have the controller act on his request in accordance with the GDPR. After requesting the data subject to provide its correspondence with the controller, on 6 March 2020, the DPA informed the data subject that the controller was US based and that it would therefore be impossible to pursue his complaint. The data subject replied several times and asked among other things for clarification on the administrative procedure and in particular of the rules on investigations. The DPA finally replied by letter that the opening of an investigation was not systematic whenever a controller is subject to a complaint. In this case, the DPA considered that it was not relevant to open an investigation since it had no means of action against a US based company. On 1 March 2021, the data subject, represented by noyb, lodged an appeal with the administrative Court (hereafter the Court) requesting the reversal or cancellation of the DPA's letter. On the basis of Article 78 GDPR, the data subject considered that he had a standing in bringing the action. The Court considered that both at the time of his complaint of 5 April 2019 and the lodging of the appeal, the data subject's data had already been deleted from the controller's website. Consequently, the court considered that the data subject did not prove that data processing was taking place when he lodged his appeal. The Court also held that under Article 51 GDPR, the DPA is responsible for monitoring the application of the RGPD by controllers, "so that it is no longer called upon to intervene from the moment that any possible disregard of the
A company’s (controller) activity was to buy metal residues from dental practices and laboratories. In this purpose, the controller was searching for contact details of practitioners and laboratories from publicly accessible directories such as the Yellow Pages. These data included surname and first name of the practice owner, address and phone number and were stored on the controller’s database. The controller then used these data to contact dentists and researchers to find out if they were selling metal residues. A dentist complained to the Saarland Administrative Court which ordered the controller to stop the processing of dental practices’ owners for advertising purpose without consent and to delete the data stored under a €2,500 penalty. The controller appealed this judgment with the Higher Saarland Administrative Court, requesting from the administrative Court to rescind the decision. The controller claimed that it had a legal basis for the processing. It explained that the purpose of the advertising was to make a profit, which is a legitimate interest within the meaning of Article 6(1)(f) GDPR. The processing must also be necessary for this purpose. The controller considered that it was “simply a question of whether an equally suitable but less intrusive means is available”. In this case, it held that a contact by telephone only lasts about one minute on average while postal mail would require additional administrative work on the part of the data subject. It concluded that contact by telephone was a milder option than contact through postal mail. The controller added that under the GDPR, data processing would only lack legal basis if the interests of the data subject outweighed the legitimate interest of the controller. An equal impact on the data protection interests of the data subject was therefore not sufficient. The Administrative Court requested to dismiss the appeal. It added that this kind of advertising had an anti-competitive nature. Accordin
The data subject was an entrepreneur managing a worldwide chain of hotels. Since 2012, the data subject went through a series of insolvency proceedings. After that, when their first name and surname were entered in a Google search, the autofill system completed the search key with the word “bankrupt”. The same word was used in some of the webpages whose URLs Google indexed under the data subject’s name. The data subject requested Google to delist some URLs linking them with the insolvency, arguing that the content of such pages did not match reality. Google refused to delist the URLs by arguing that there was a public interest in keeping that information available. Therefore, the data subject brought action against Google for violation of their right to erasure under Article 17(1)(d) GDPR. Alongside with delisting, the data subject asked for the deletion of the word “bankrupt” in Google’s autofill function. The court of first instance partially upheld the data subject’s claim and ordered Google to amend its autofill function. On the other hand, the court rejected all the other claims concerning URLs delisting. Both the data subject and the controller appealed the decision. The Supreme Regional Court of Frankfurt (Oberlandgericht Frankfurt am Main) rejected the data subject’s appeal. According to the court, the legal requirements set forth in Article 17 GDPR were not met, as the controller’s freedom of information prevailed on the data subject’s right to erasure. Facts described in the URLs listed by Google, despite not accurate from a strictly legal perspective, had do be understood as expression of a subjective opinion. According to the judges, the use of the word “bankrupt” does not trigger nuanced legal considerations in the mind of the average internet user. On the contrary, it expresses both a general situation in which a certain person cannot pay their debts – which was true in the present case – and a (negative) judgement that cannot be proved or disproved
A court of first instance ordered a municipality – the controller – to compensate one of its employees – the data subject – for non-material damages suffered as a consequence of an unlawful processing of personal data. In particular, the accidental publication of certain data unnecessarily affected the data subject’s reputation. The controller appealed the decision arguing that the court of first instance granted compensation for a GDPR violation without considering whether such a violation actually harmed the data subject. The Court of Cassation rejected the controller’s appeal. According to the court, the right to compensation for non-material damages directly stems not only from Article 82 GDPR, but also from Article 8 ECHR and Articles 2 and 21 of the Italian Constitution. In the first place, the court held that the right to compensation for non-material damages is not excluded by the fact that the controller subsequently brought processing operations into compliance with the GDPR. Second, the court stressed that not every violation necessarily leads to liability under Article 82 GDPR. As a matter of fact, the violation must have entailed actual harmful consequences on the data subject. That said, it is not necessary that the harm suffered meets a minimum threshold, being subject to compensation also a “marginal” damage. In this case, the Court of Cassation upheld the judgement of the court of first instance, as the latter considered the violation in its context and determined that type of data and factual circumstances objectively gave rise to non-material damages.
On 28 March 2022, the Swedish DPA (IMY) fined Klarna AB (the controller) €730,000 (SEK 7,300,000) for not providing data subjects with adequate information related to their processing activities. IMY found that the controller violated the GDPR in the following respects: * It did not provide information about the purpose and the legal basis for data processing relating to the service "My economy", * It provided incomplete and misleading information about the recipients of different categories of personal data when they were shared with Swedish and foreign credit reference agencies. * It did not provide information about which countries outside the EU/EEA personal data was transferred to, and where and how data subjects can access or obtain documents regarding safeguards that applied to the applicable transfer. * It provided incomplete information about retention periods and the criteria to determine these periods. * It provided inadequate information about the data subjects' rights which did not comply with the principle of transparency, in particular the rights to request from the controller the erasure of personal data under Article 17 GDPR, to restrict processing of personal data Article 18 GDPR, to data portability under Article 20 GDPR and to object to the processing under Article 21 GDPR * Its privacy policy lacked meaningful information about the logic, significance and foreseen consequences of automated decision-making, including profiling, under Article 22(1) GDPR. The controller appealed the decision to the administrative court, challenging the basis of IMY's decision. It claimed, in particular, that IMY relied heavily on non-binding guidelines. The controller argued that both Swedish and European administrative law fundamentally require that an intervention (especially fines) against an individual may only take place if there is clear support in binding statute. Despite this, the controller claimed that it has been fined too heavily for violating non-bindi
On 20 April 2020, the data subject exercised his right of access and information under Article 15 GDPR by sending a request to the Minister of Finance. He was asking more specifically whether his data were processed in the fraud alert system "Fraude Signalering Voorziening" (FSV) and/or other undisclosed databases. In the affirmative, he requested a copy of such data. The Minister stated in his answer that no personal data could be found in the FVS. The data subject considered this answer insufficient and asked the Minister to reconsider its position. He claimed that the Minister could not limit the data search to FVS alone, but also had to consult all other systems in response to his request. He didn't refer to specific system, arguing that he could not be aware about their names or even existence, some of which possibly being secret or undisclosed to the public. In this respect, he refered to a report by KPMG mentioning a possible existence of non identified systems used by the tax authorities. In addition, the data subject claimed that the Minister did not provide sufficient information regarding the search method used. The Minister refused to give further information. As a consequence, the data subject lodged an action with the District Court of Amsterdam, which declared the appeal unfounded. He therefore appealed before the Council of State against the decision of the District Court of Amsterdam The Council stated that the report of KMPG, which mentions possible systems that have not been identified, does not imply that it is plausible that there are other systems whose existence is kept secret by the tax authorities and the Ministry. Next, the Council of State confirmed that in his answer to the request of access and information the Minister has provided sufficient insight into how he searched for personal data and indicated that other search methods would have led to a similar result. For the above reasons, the Council of State declared the appeal unfou
The data subject was admitted urgently to the hospital after an anxiety crisis. On arrival, she was treated by a psychiatrist who wrote a report. This report mentioned elements of the personal and family life of the data subject. Some months later, she was admitted urgently to another hospital. A doctor also wrote a report in which personal details were mentioned, including data about her sexual and professional life. The data subject considered that the processing was unlawful since she had not given her consent to the collection. She also considered that the collection of her data was not necessary for the performance of the hospital's care mission and that she had not been informed of her right to rectification. She nevertheless exercised her right to rectification by letter without result. The data subject therefore brought an action before the Administrative Tribunal of Paris to obtain damages for moral prejudice resulting from an infringement of her privacy. The court rejected her claim and she appealed to the Administrative Court of Appeal (Cour administrative d'appel de Paris). The arguments of the hospitals are not explained in the decision. The Court explained that according to national law, hospitals must draw up a medical file for each hospitalised patient. This file must include among other things the information received from the patient and the reasons for hospitalisation. According to the Court, the information received in this case by the two hospitals allowed the psychological state of the data subject to be assessed and medical decisions to be taken. This data could therefore be entered in the data subject's medical file and processed in accordance with Articles 6(1)(e) and 9(2)(h) GDPR. The processing therefore had a legal basis and did not have to be based on consent. The Court added that under Article 17(3)(c) GDPR, the hospitals could decide not to erase the data in question. Indeed, the data was useful in order to assess the data subjec
In this decision, Blauw Research B.V., a market research agency (controller) had a processing agreement with NEBU B.V., a software provider (processor). On 10-11 March 2023, the processor suffered a cyber attack by which third parties gained unauthorized access to its servers and data was extracted. The processor informed the controller about it two days after the attack took place. The controller requested more information and the processor confirmed that data (passwords) had been stolen and personal data (stored in cloud databases and surveys) were leaked. After repeatedly requesting information, unsatisfied with the processor's replies, the controller brought the case to the Court of Rotterdam. During the proceeding, the controller explained that it considered that, based on the processing agreement, the processor must provide information regarding security incidents and data breaches at all times. It also argued that the information provided following the cyber attack was not sufficient to meet the requirements set out in the agreement. The processor objected to such claim. As a result, the controller claimed to order the processor to: # provide information about (i) the details of the cyber attack; (ii) how and with what methods the system was recovered after the attack; (iii) an overview of which customers' personal data were leaked; (iv) the perpetrators of the attack; (v) which preventive and reactive technical and organisational measures were taken; (vi) internal reporting within the organization of the processor about the cyber attack that has taken place; # in the future, within 4 hours after new information is available, transfer this information to the controller and send an update on the state of affairs twice a day (at 14:00 and 19:00); # appoint a forensic investigator to find out the root-cause analysis; and # provide all necessary assistance and to answer all controller's questions. In the event of non compliance, the controller claimed a penalty
The data subject was a judge working at the Austrian Federal Administrative Court. An internal judicial body – the controller – opened a disciplinary investigation concerning the data subject’s performance at work, including the latter’s mental health. The disciplinary body concluded the investigation with a final report and an evaluation of the data subject, which were subsequently notified to them. The data subject brought action against the controller for violation of Articles 5(1)(a) to (c), 6 and 9 GDPR. According to the data subject, the investigation would have been hampered by many inadequacies and investigative mistakes in the processing of their personal data. In particular, the controller would have picked and chosen pieces of evidence, deliberately ignoring fundamental elements. The Austrian Federal Administrative Court dismissed the data subject’s claim. According to the judges, data protection law cannot override the rules delimiting jurisdictions. A review of the investigation methods by the Federal Administrative Court would encroach upon the competence of the disciplinary body, which is a judicial body as well. In other words, a data subject cannot use data protection law to limit the investigative powers of a judicial body whose jurisdiction is subject to.
The Court of Milan rejected a claim brought by the data subject against the controller, ING Bank, relating to the non-compliance with an access request made on the basis of Article 15 GDPR. The Court accepted the arguments of the controller, who denied having processed the data subject's data, and stated that they failed to prove that the bank was the controller in relation to the processing of their data. On this basis, it rejected the claim. The data subject challenged the decision with appeal to cassation, arguing that there was a wrong application of Articles 12 and 15 GDPR. The DPA highlighted that Article 12 GDPR burdens the controller with the obligation to provide data subjects with information regarding the existence of personal data as a result of the access request presented by them. Therefore, contrary to what was decided by the first instance, Ing Bank should have provided a complete reply to the access request within one month or at least should have asked for a deadline extension. The DPA stressed the incontrovertible fact that Ing Bank had not met the request for access to the documents, making it impossible for the data subject to know whether it possessed their personal data and to verify the legitimacy of the data collection. According to the Court of Cassation, the controller should have responded to the request, even if the response was a negative one. Contrary to what was held by the first instance Court, it held that the burden of showing whether or not it is processing personal data is on the controller and not on the data subject making the request. Similarly, it emphasized that, pursuant to Article 12(5) GDPR, the controller has the burden of demonstrating the manifestly unfounded or excessive nature of the request. In any case, the Court of Cassation stated, from the literal wording of the last-mentioned provision it clearly emerges that the controller must always acknowledge the request, even in negative terms, as it cannot hide beh
The data subject made an access request to the Police Authority (note: the decision does not specify which authority exactly) to receive information on how their personal data was processed by the National Operations Department. In response, the Police provided certain personal data of the data subject (file number, type of investigative task, type of offence, the data subject's role in the case, and the processing unit). Additionally, the Police gave the data subject information about what kind of data are normally processed similar cases. The Police refused to provide any further information with reference to Chapter 4, Section 5, of the Swedish Criminal Data Act (brottsdatalagen, the Swedish law implementing Directive (EU) 2016/680) and Chapter 5, Section 1 of the Swedish Data Protection Act (dataskyddslagen). The Police argued that such further information is covered by secrecy obligations, and that providing such information could jeopardise ongoing investigations, other police actions or future activities. The data subject presented that they only had received a summary of the processing activities, but did not receive access to their personal data. Also, the data subject stated that the Police had not provided information about the purposes of the processing activities for which their personal was processed. The Police viewed that the appeal should be dismissed. The Police argued that, in their view, 1) the GDPR does not give the data subject a right to obtain a copy of the information if the right to information can be ensured by other means. Secondly, the Police stated that 2) they did not have information of the actual recipients of the data subject's personal data in archived criminal investigations. The Police said that it could only provide the data subject with information about the categories of recipients. Additionally, the Police argued that, in their view, 1) the data subject does not have a right to know who has provided information of the data s
Request by drivers to Ola Netherlands BV for access as referred to in Article 15(1) AVG to certain personal data concerning them (including 'ratings' given by passengers) and for information as referred to in Article 15(1)(h) AVG (information on the existence of automated decision-making within the meaning of Article 22 AVG). Protection of passengers' personal data. Is adaptation of the initial access request possible in the court proceedings? Request for information on, inter alia, the 'fraud probability score' used by Ola, the 'earning profile' as well as the allocation of rides to drivers. Scope of the right to information under Article 15(1)(h) GDPR. Does the request for information concern decisions which have legal consequences for the drivers or otherwise significantly affect them? Can Ola invoke an exception to the drivers' invoked right to information? In what way must the information request be acted upon? Drivers also request portability of certain personal data under Article 20 GDPR. The court: Annuls the contested decision insofar as it rejected the request of [appellant sub 1] et al. concerning: a) the initial request of [appellant sub 1] et al. based on Article 15(1) GDPR for access to the GPS data concerning them; (b) the initial request by [appellant subsection 1], based on Article 15(1) GDPR, for access to the driver device data relating to them: device details, IP address, device mobile number, login time and frequency and time of usage site/application/services; (c) [appellant sub 1]'s initial request, based on Article 15(1) GDPR, for access to personal data concerning them as referred to in paragraph 3.29 under a to d; (d) the initial request by [appellant subsection 1] c.s., based on Article 15(1)(h) GDPR, for information about the existence of automated decision-making within the meaning of that provision, in so far as that request relates to the creation of the fraud probability score, the earning profile and the allocation of journeys; and
Request by Uber drivers to Uber for information under Article 15(1)(h) GDPR (information on the existence of automated decision-making within the meaning of Article 22 GDPR) after their accounts were deactivated by Uber; scope of the right to information under Article 15(1)(h) GDPR. Are the deactivation decisions based solely on automated processing? Can Uber rely on an exception to the information right invoked by the drivers? How should the information request be acted upon? The Court orders Uber to grant the information requests of [appellant sub 1] , [appellant sub 2] and [appellant sub 4] based on Article 15(1)(h) of the AVG within one month of service of this order in the manner described under par. 3.28, subject to a penalty payment in the amount of €4,000.00 for each day or part thereof that Uber fails to comply with this order.
This decision is the result of an appeal (and incidental appeals) filed against a decision from the District Court of Amsterdam (available on GDPRhub). The District Court ordered Uber to provide its drivers with information regarding the their rating by passengers but rejected several other requests for information under Article 15. The different drivers had different requests in appeal. This included information about device data, driver's profile (i.e. an internal note Uber employees use to transfer customer service requests from drivers to other Uber employees), tags (labels in the custumer service system), reports per journey (reports based on passengers' feedback), individual ratings per passenger, upfront pricing (automated system that calculates the price for a ride in advance based on various factors) and batched matching system (automated system which links drivers to passengers). Under Article 15, they also requested information about the recipients, the processing purposes, categories of personal data and existence of automated decision-making referred to in Article 22. Some drivers also requested portability within the meaning of Article 20. Uber argued among other things that the qualification as personal data depended on whether the information in question was or not intended for internal consultation and deliberation. The Court assessed each request to determine if they fell into the scope of Article 15(1). Its assessment can be summarized as follows. For the access to the driver's profile, the Court considered that it contains a representation of the driver's specific request. The driver's profile constituted personal data and therefore falls within the scope of Article 15(1). Concerning access to the tags, the Court stated that it contained information about the relevant driver and therefore also falled within the scope of Article 15(1). Regarding the reports per journey and the individual ratings, they are both based on feedback by pa
During the Covid-19 pandemic, the Minister for Education and Culture of the Land Hessen established a legal framework to enable remote education through video-calls. According to this framework, pupils (or pupils’ parents) should give their consent to the processing of personal data. However, no similar provision applied to teachers. A Committee of teachers brought an action before the Wiesbaden Administrative Court. According to the defendant, the provision that enabled the regional government to process data without teachers’ consent was § 23 of the Hessisches Datenschutz- und Informationsfreiheitsgesetz (Law on data protection and freedom of information of the Land Hessen). This provision would set “more specific rules” concerning workers’ data protection rights in accordance with Article 88 GDPR and in derogation to GDPR itself. However, the Administrative Court suspected that the controller did not comply with Article 88(2) GDPR, as the latter provision requires “suitable and specific legislative provisions” to be adopted in order to protect data subjects’ rights. The German court wondered whether a national provision that does not meet this requirement, such as § 23 of the German data protection law, could be seen as a legitimate implementation of Article 88 GDPR. Moreover, the court was not certain about the faith of such a provision, in case a national judge found it in contrast with Article 88(2) GDPR. In order to better clarify the relationship between paragraphs (1) and (2) of Article 88 GDPR, the German court issued a preliminary reference to the CJEU. In the first place, the CJEU clarified that Article 88 GDPR covered the facts at issue in the main proceeding and more in general public employment, as this provision is not specific to the private sector. According to the CJEU, it is the existence of a relationship of subordination between the employee and the employer and not the legal nature of this relationship that justifies the open clause provid
The parties disputed a data access request under Article 15 GDPR and claims for damages. The plaintiff, employed since 1990 and accused of workplace misconduct, requested access to interview records involving allegations against them. The defendant provided redacted copies of processed data. The plaintiff sought unredacted copies and damages, claiming the redactions obstructed proof of alleged workplace harassment. * Article 15 GDPR grants the right to access personal data, including unredacted data, irrespective of the plaintiff's intent for obtaining the data. * Section 34(1) BDSG alongside Section 29(1) BDSG limits data disclosure when third-party confidentiality or interests are at stake. * Employers must justify non-disclosure by proving that revealing specific data harms their interests or those of others.
The controller embedded Google Fonts on its website. When a user visited the website, their personal data were transferred to Google Inc. in the US. Considering that the controller violated Chapter V of the GDPR, a data protection association deployed an automated system – a so-called “web crawler” – to detect data transfers through Google Fonts tools. Then, the association representing the data subjects contacted the controller and asked for non-material damages under Article 82 GDPR. Meanwhile, the controller had updated its website and removed the Google Fonts. The controller argued that the claim for damages was part of a broader initiative affecting hundreds of thousands of controllers in Germany. The controller stressed that the individual data subjects represented by the data protection association never manually and directly visited its website. Thus, the controller brought action against the association and asked the Regional Court of Munich (LG Münich) to declare the association’s claims unlawful. The German Court upheld the controller’s arguments. The court did not consider whether the controller violated the GDPR by undertaking data transfers to the US, nor whether the data subjects implicitly consented to such transfers by accepting to visit the websites. Instead, the court focused on the fact that a person that did not directly and manually visited a website could not feel any annoyance or uncertainty with regard to the transfer of their personal data to a third country. From this perspective, the use of web crawlers played a major role in ruling out an actual infringement of data subjects’ rights. The court also stated that, even imaging that the use of web crawlers was compatible with a violation of the data subject’s informational self-determination, the data subject provoked the situation against which they complained. In light of the above, the Court adopted a decision declaring the lack of legal basis for any claim for damages under Article 8