GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
The data subject made an erasure and a rectification request to the controller – a credit ranking agency. The controller deleted all the data concerning the data subject. The data subject lodged a complaint with the Austrian DPA for excessive erasure and violation of the right to data rectification. The Austrian DPA upheld the complaint with regard to the excessive erasure and rejected the part concerning data rectification. In particular, rectification was no longer possible after the controller deleted all the data subject’s personal data. The data subject appealed the decision before the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The court rejected the appeal and overturned the DPA decision also in the part concerning the alleged excessive erasure. According to the court, the data subject’s claim that the erasure was excessive was based on the fact that the complete lack of information on the data subject in the databases of the controller could be interpreted by a third party as lack of creditworthiness. The court rejected this argument and stated that due to the complete lack of personal data following the erasure no processing could take place: mere assumptions by third parties that are based on non-existence of certain data do not constitute processing and are therefore not subject to the GDPR. Therefore, right to erasure pursuant to Article 17 GDPR was not violated. Again due to the lack of information after the deletion, the right to rectification pursuant to Article 16 GDPR did not come into play at all. The data subject appealed the decision before the Supreme Administrative Court. The Supreme Administrative Court dismissed the appeal. The court acknowledged that a data subject has in principle the right to a partial deletion pursuant to Article 17 GDPR. However, this does not entail that a complete deletion of data by the controller violates the right to erasure. As a matter of fact, the controller – at least in this case – was u
The controller was a logistics and postal service provider also active in the fields of direct marketing and address publication. The data subject requested the controller to provide access to personal data concerning them pursuant to Article 15 GDPR. Deeming the controller’s reply insufficient, the data subject went to court to enforce their right to access. The data subject asked a full disclosure of which data were effectively shared and with whom, as the controller’s reply did not comply with the principles of accuracy and comprehensibility under Article 12(1) GDPR. During the civil proceeding it became clear that the controller processed and shared with third-parties data concerning the data subject’s marketing profile and potential political affinities with third-parties. However, the controller did not disclose the identity of specific recipients in the access request, but only their broad categories (e.g. advertising companies, IT-companies, NGOs). The controller denied that statistical data about data subjects’ political and philosophical affinities (the so-called marketing profiles) were personal data covered by the GDPR. The controller also replied that it could not disclose recipients’ identity because of several reasons, such as business confidentiality and a disproportionate effort on its side, as it did not keep a record of all the disclosure operations. Also, the controller argued that there is no obligation to disclose the identity of specific recipients under the GDPR, but only the categories of recipients. The first instance court upheld the controller’s defense. The court of appeal confirmed this judgement, stating that the GDPR gives the controller a free choice whether to share specific recipients or broad categories of recipients. As the controller disclosed such categories during the first instance proceeding, Article 15 GDPR was not violated. The Austrian Supreme Court sent a preliminary reference to the CJEU, which decided the case with j
The North Rhine-Westphalia Consumer Center brought an action against Telekom Deutschland GmbH, a German telecommunication company. The legal dispute before the District Court of Cologne concerned several points. First, the Consumer Center questioned the lawfulness of the controller's disclosure of personal financial data to credit ranking agencies, in particular SCHUFA Holding AG and CRIF Bürgel, in the context of the performance of mobile communication contracts. The controller provided these companies with personal data of its costumers in order to check their creditworthiness and prevent fraudolent behaviours. Second, the Comsumer Center doubted that the controller's privacy policy was GDPR compliant. Furthermore, in the opinion of the Consumer Center, the controller did not validly collect consent for the use of cookies on its website but rather relied on dark patterns in the cookie banners, that inevitably misled users. Finally, the transfers of customers' personal data to third countries - including the US - for analysis and marketing purposes violated GDPR. The Consumer Center claimed that when customers visited the controller's website, personal data like IP address and information about browser and device used by the visitor were transmitted to Google LLC. Therefore, the Consumer Center requested the court to order the controller: a) to refrain from transferring personal data to credit agencies, in particular SCHUFA Holding AG and CRIF Bürgel, when carrying out and/or executing mobile communication contracts. b) To refrain from using the privacy policy with regard to existing mobile communication contracts with consumers and from relying on such clauses for any future contracts. c) To bring the cookie banner design in compliance with the GDPR, especially by embedding an easy option not only to consent to cookies, but also to refuse them. d) To refrain from transferring personal data of consumers to third countries for advertising and marketing analy
This case concerns a class action filed by the Data Privacy Foundation, an organisations which pursues redress on behalf of victims of privacy intrusions in the Netherlands, against social media company Meta. The complaint filed by the foundation was directed at unlawful personal data processing practices by Meta, through their Facebook service. The three defendants in the lawsuit were three companies of the Meta group (Meta Platforms Inc; Meta Platforms Ireland Limited; and Facebook Netherlands BV). The complaint filed by the Foundation consists of four main issues. Firstly, the claim submitted that Meta infringed their transparency obligations in Articles 5, 12, 13 and 14 GDPR by failing to sufficiently inform users of a number of processing operations. Secondly, the Foundation submitted that Meta processed personal data in lack of a legal basis in violation of Article 6 GDPR. Thirdly, it was claimed that Meta unlawfully processed special categories of personal data (Article 9 GDPR). Fourth, and finally, Meta did not obtain valid consent for the use of cookies, tracking of surfing behavior, and app use outside the Facebook service – for advertising purposes – in violation of the Article 11.7a of the Dutch Telecommunications Act. Each of these issues, and the details of the claims made by the Foundation, will be discussed further below. Issue 1 – Transparency obligations The complaint filed by the Foundation detailed a number of ways through which Meta infringed its transparency obligations under the GDPR. Firstly, the controller did not inform data subjects about the disclosure of personal data to external developers who could process personal data for their own purposes. From 2010, Meta (then called "Facebook") introduced an API (Graph API 1.0) to allow other software developers to link their software to the Facebook service. This API makes it possible to exchange data and communicate between different software systems. Prior to the first use, permission was req
After failing a language test, a data subject requested the test provider (controller) to provide her a copy of her examination paper under Article 15(3) GDPR. The controller offered the data subject to consult her paper at its office but refused to provide a copy. It argued that the majority of the paper did not contain personal data under the meaning of Article 4 GDPR and that it had an interest in secrecy that justified its refusal to provide a copy under Article 15(4) GDPR. Unsatisfied, the data subject brought an action with the Amstgericht Frankfurt (local Court of Frankfurt). First, the Court did not follow the controller's argument concerning the non-personal nature of the data included in the paper. Indeed, the answers of the data subjects and the comments of the examiner constituted personal data under Article 4 GDPR. The test questions however were not personal data. Second, the Court weighed up the right of the data subject to obtain a copy and the interest of the controller in secrecy under Article 15(4) GDPR. It considered that the test questions constituted trade secrets within the meaning of national provisions and that the development of these language test represented a complex procedure involving considerable economic effort. These tests are used in naturalization procedure and due to a lack of secrecy, there could be a risk that the examination would no longer be considered sufficient to determine language skills for this purpose. As a result, the entrepreneurial freedom of the controller could be threatened. The Court therefore considered that on the basis of its interest to secrecy, the controller could refuse to provide a copy under Article 15(4) GDPR. It also took into account that the right to access was not entirely denied since the data subject could consult her paper at the controller’s office.
The controller operated a 24-hour self-service petrol station with a retail shop, both accessible by everyone. Following a complaint, the DPA requested the plaintiff to provide information about the video surveillance. In their response, the controller pointed out, that they had installed cameras in the shop and outdoor, including the self-service gas station area. According to the controller, the self-service gas station property is damaged five to six times a year. It also happened that customers forgot the fuel nozzle in the vehicle and drove off. The video surveillance recordings was stored on a hard drive for about six to eight weeks. The controller added that they determined the annual damage in the gas station operation in the amount of € 10.000 – including vandalism and break-ins. The video recordings had a crucial function with regard to these offences. A storage period reduced to 72 hours, as asked by the original complainant, was unreasonably short. The controller also argue that compensation for damages would be made considerably more difficult by a 72 hours storage period. In addition, according to the controller, the GDPR Regulation does not provide for any rigid deletion periods. The DPA ordered the plaintiff to limit the storage period of the video recordings. In the event of non-implementation, incomplete implementation or late implementation, a penalty payment was threatened. The DPA further explained, that it not objected Article 6(1)(f) GDPR as legal basis for the video surveillance. However, any video surveillance encroaches on the fundamental right of natural persons. Video surveillance measures have a high degree of intervention intensity. Numerous people are included in the surveillance action who are not related to specific misconduct. Video recordings should therefore be deleted immediately if they are no longer necessary to achieve the purposes for which they were collected. Although there are no rigid retention limits stated in the GDPR,
The data subject was a computer scientist and Facebook user. While using Facebook's social media services, the data subject provided several mandatory personal data, including their first name, last name and sex.. These data points, including the system generated "Facebook ID", were publicly visible by default on the user profile. In addition the data subject added his mobile phone number. The mobile phone number was also visible by default but the user could change the visibility in the settings. The data subject limited the visibility to the "target group search“ setting, but left the searchability option for his mobile phone number visible. In 2021, unknown “third parties” published data, that has been scraped from the website in 2019. The data subject lamented that since then he received anonymous calls and spam emails. This entailed negative psychological consequences for him. Thus, the data subject asked for €500 in non-material damages under Article 82 GDPR. The controller replied that data scraping - which is not hacking - does not entail a violation of the GDPR by the controller, as no mandatory security measures where circumvented and the plaintiff made an informed decision to voluntarily share their phone number on the site. The court rejected the request for damages under Article 82 GDPR. The court held that there was no breach of duty by the controller that could trigger damages. The publication of the mobile phone number wasn‘t mandatory and the data subject had the (unused) option to hide the phone number on their profile. The court was of the opinion, that the controller did not breach its duty to adequately protect the personal data of users in accordance with Article 32 GDPR. The controller was not obliged to take protective measures to prevent the collection of already publicly accessible information. The controller also did not violate the principle of "privacy by default" enshrined in Articles 24 and 25(2) GDPR. It was undisputed that only th
The data subject was tried and convicted in a criminal proceeding. He served his sentence in prison and started a new life afterwards. He found a job, made new friends and was in a romantic relationship. After some time, his girlfriend and friends became aware of the data subject’s criminal past through an article published on an online newspaper 18 years before the facts at issue. Shocked, they decided to cut any relationship with the data subject. The data subject asked the controller the removal of the content, which was no longer necessary to pursue journalistic freedom to inform, and compensation for damages suffered due to the publication. The controller removed the article, but refused to compensate the data subject. The controller objected that it did not have an obligation to remove all the contents from its website that were no longer relevant for the public debate. The court of first instance upheld the controller’s view and rejected the data subject’s claim for damages. As the facts dated back to a time when the GDPR was not yet in force, the Court of Cassation denied that the Regulation was applicable at the facts at issue. To the contrary, Directive 95/46/EC regulated the matter. However, the legal reasoning developed by the court substantially follows the structure of Article 17 GDPR and therefore constitutes a relevant interpretation of such a provision. The Court of Cassation upheld the judgement of first instance. According to the judges, a necessary element in the right to erasure is a gap between a depiction of the data subject which is no longer updated and the current situation of the latter. This gap is assessed from the point of view of the data subject, as they are in the best position to evaluate what does no longer correspond to the present. Therefore, the right to erasure can be activated only by the explicit request of the data subject to the controller. The court also stressed that an excessively broad interpretation of the right to
The plaintiff made a request for access to information relating to the minutes of an inspection carried out at a school by the State Labour Inspectorate. The school’s principal (the defendant) provided the plaintiff with documents relating to the inspection. However, they did not provide certain annexes, which formed an integral part of the inspection documentation. When asked about this, the defendant explained that the missing annexes contained information on the salary of teachers. In their view, this constituted sensitive data and, for this reason, could not be shared. The plaintiff appealed to an appeal body in the municipality. The appeal body recalled that in accordance with [https://sip.lex.pl/akty-prawne/dzu-dziennik-ustaw/dostep-do-informacji-publicznej-16913107/art-5 Article 5(1) of the Polish Act on Access to Public Information], access to public information may be restricted to ensure privacy and protect personal data. The Polish Act on Access to Public Information is one of the national laws that regulates the access to public information and the protection of personal data under Article 86 GDPR. However, the restriction under its [https://sip.lex.pl/akty-prawne/dzu-dziennik-ustaw/dostep-do-informacji-publicznej-16913107/art-5 Article 5(1) of the Polish Act on Access to Public Information] does not apply to persons performing public functions ([https://sip.lex.pl/akty-prawne/dzu-dziennik-ustaw/dostep-do-informacji-publicznej-16913107/art-5 Article 5(2) Polish Act on Access to Public Information]). The appeal body held that it was crucial to determine whether a teacher qualifies as a public body or as exercising public function. Then, the protection under the GDPR with regards to their salary, would not apply. The appellate authority concluded that teachers and administrative staff do not perform public function and, therefore, their salary is protected as personal data relating to the material status of an individual under the GDPR. The plaintiff a
on 21 April 2022, the complainants filed a complaint with the data protection authority alleging the unlawful consultation of their professional mailboxes by the DPO of defendant when investigating the leak of an internal mail to a trade union organization, ACV. The complainants state that they were not aware of this processing and that it should not have happened without their consent. The disputes chamber has dismissed the complaint on the grounds of (i) the absence of a high risk within the meaning of Article 35.5 GDPR and (ii) the fact that the present complaint is only a side dispute that is part of a broader trade union dispute for which it is not competent . When appealing against the decision of the litigation chamber, the complainants rely on the following defenses: (i) violation of the dismissal policy of the litigation chamber; (ii) violation of the right to participate during the pre-litigation phase and ask the court to annul the contested decision and order the data protection authority to pay the costs of the proceedings. Regarding the motivation of the dismissal, the litigation chamber admits that due to a technical error, the contested decision once refers incorrectly to a 'technical dismissal', while it is clear that they mean a dismissal for reasons of expediency, since the litigation chamber considers a hearing on the merits undesirable and refers to 3.2.1. of the dismissal policy that deals with the dismissal for reasons of expediency. The court follows the reasoning of the DPA and dismisses this part of the complaint. the Court of Appeal refers within this framework to an earlier judgment that the DPA, as a supervisory authority, is completely independent under Article 52 GDPR in the performance of the tasks and powers entrusted to it and, as a result, has a discretionary power to decide whether or not to dismiss a complaint. With regard to violating the adversarial debate, the law establishing the data protection authority makes a clear dist
A woman (the controller) used intimate photos of her husband (the data subject) and his lover in a divorce proceeding. According to the data subject, the controller also shared this material with a third party, namely the husband of the other woman involved. The pictures were originally uploaded on a cloud service by the data subject himself. Credentials to access the cloud were noted down in a notebook kept next to the computer, which was accessible to all the members of the family. The data subject filed a complaint with the Austrian DPA (Datenschutzbehörde - DSB). The DSB dismissed the complaint. On the one hand, disclosure before the civil court was necessary to prove the data subject’s responsibility in the divorce dispute. On the other hand, disclosure to third parties could not be proved. The Federal Administrative Court confirmed that a disclosure to third parties could not be proved. As a matter of fact, the former husband of the data subject’s lover got the pictures only indirectly from an anonymous email addressed to his lawyer. In particular, the Court pointed out to the fact that credentials to access the data subject’s account on the cloud were easily available to everybody living in the house. Concerning the disclosure in the civil proceeding, the pictures were undoubtedly special categories of personal data under Article 9(1) GDPR, whose processing is in principle prohibited. However, in this case processing was covered by the exception under Article 9(2)(f) GDPR. The Court stressed that, for the exception to apply, processing should be “necessary” to the purpose stated in this provision, which means that a judicial claim or defence would not be possible without the processing. Nevertheless, such a requirement shall not be interpreted too strictly. In the Court’s opinion, when disclosure in judicial proceeding is deemed not relevant by the judge, this does not automatically entail a violation of Article 9 GDPR. The only case in which Article 9(2)(
A data subject sent an access request to 16 different controllers in multiple countries pursuant to Article 15 GDPR. Deeming the reply of these controllers not sufficient, the data subject lodged several complaints with the Austrian DPA. In the context of one of these complaints, the supervisory authority held that the request was excessive and dismissed it pursuant to Article 57(4) GDPR. The data subject appealed the decision before the Austrian federal administrative court supported by the non-profit noyb. The data subject lodged a complaint with the Austrian DPA for an alleged violation of Article 15 GDPR by one of the controllers. The DPA dismissed the claim on the basis of Article 57(4) GDPR. According to such provision, a DPA may charge a reasonable fee or refuse to act when a data subject’s request is either manifestly unfounded or excessive. Article 57(4) GDPR specifically mentions the case of repetitive claims. The federal administrative court pointed out to the fact that 16 almost identical complaints by the same data subject and in a time span of 7 months was a considerable amount of work for the supervisory authority. Another relevant point in assessing whether the claim was excessive was the fact that several controllers were based outside Austria and sometimes outside the EU. Due to the cooperation mechanisms envisaged by Articles 56 and following GDPR, the Austrian DPA would be forced to invest a large amount of resources in dealing with the data subject’s request. Concerning the controllers that were not based in the EU, the DPA was instead fully dependent on the availability to cooperate of other (when existent) supervisory authorities. The fact that in some cases only one day elapsed between the month envisaged by Article 12(3) GDPR as a deadline for the controller’s reply and the complaints was also an element suggesting that the request was excessive. In light of the above, the federal administrative court endorsed the supervisory authority
The data subject was a federal civil servant who applied for assistance from the controller, the German Federal Administrative Office. The data subject attached to his application 13 copies of receipts with special categories of personal data – in particular information about his health. The receipts included nine invoices and statements from various specialist doctors in 2019, detailing the individual services provided and, in some cases, including diagnostic information, along with four prescriptions for medications. The controller should have returned the copies to the data subject, but due to an administrative error, the data subject received the copies concerning a third person and the data subject´s receipts were also accidentally sent to a third person. After the controller got back the receipts from the third person, they were eventually sent to the data subject. Due to this error, health data of the data subject was disclosed to a third person, without any legal ground. This violated the data subject's general right of personality and his right to informational self-determination. Therefore, the data subject claimed €3,000 as compensation for damages pursuant to Article 82(1) GDPR. The court found the disclosure unlawful as occurred in violation of Article 9(1) GDPR. In the quantification of damages the court ruled the following. First, there was nothing to indicate that the data were made known to other persons, other than the known (wrong) recipient. In this respect, it could be assumed that the risk of further dissemination of the data subject's health data by the third party did not materialize. The controller immediately demanded the return of the receipts from the third party and returned them to the data subject after it had noticed the incorrect dispatch. Further, the court held that the incorrect dispatch of the aid vouchers was only due to simple negligence; the court did not find any gross negligence or intent in the unlawful disclosure. Fina
This ruling is the result by an appeal of Rossel & Cie, a large media company (controller), which was fined €50.000 by the Belgian DPA after an investigation on their cookies practices (see [https://www.gegevensbeschermingsautoriteit.be/publications/arrest-van-22-februari-2023-van-het-marktenhof-ar-953-beschikbaar-in-het-frans.pdf here] for the DPA decision and here for the GDPRhub summary). The Belgian law empowers the board management of the DPA to issue a referral in order to open an ex officio investigation (Article 63(1) of the Law establishing the Belgian DPA). This referral needs to indicate that there are "serious indications of a practice that could give rise to an infringement of the fundamental principles of personal data protection. In this case, the board management issued a referral on 16 January 2019 without mentioning any reference to serious indications of potential infringements, or any evidence for that matter. The investigation was however considered open on that date. On 7 March 2019, an handwritten note was drawn up by the investigation service (so, not by the management board (!)) containing several reasons for starting the investigation, among others the high amount of visitors of the controller's websites. On 16 June 2022, the DPA issued decision 103/2022, fining the controller for several GDPR related violations. The controller appealed this decision at the Market Court in Brussels, stating that the DPA's board management referral did not indicate the reasons to investigate. It was thus irregular, and implied that the investigation service was irregularly seized. As a result, the DPA decision was also invalid. The court confirmed that the management board had issued the referral to investigate the controller on 16 January 2019. The referral constituted the only administrative act leading up to decision 103/2022. The internal note of the investigation service of 7 March 2019 could not be considered as (a part of) the referral,
In this case, the data subject, a 1972-born individual, applied to the controller, an eCommerce company selling garden and Indoor furniture, for a position. The data subject, with a diverse career background including roles in banking, IT security, and sales, highlighted his qualifications in a structured email application. Despite following up, the controller rejected the application. On 14 June 2021, the data subject claimed age discrimination and demanded compensation of €1,500, and refused a subsequent interview invitation. Additionally, on 14 September 2021, the data subject requested detailed information about stored personal data under Article 15 GDPR. The company responded on 21 September 2021, stating that no further data beyond the email correspondence was stored. The data subject pursued legal action for damages under Article 82 GDPR and argued that information used by its legal representatives from an online database violated his right to informational self-determination and should be deleted. The court held that the data subject's claims were unsubstantiated, dismissing the case on grounds of abuse of rights. Firstly, the court determined that the data subject used the GDPR and the General Equal Treatment Act (AGG) claims purely to obtain compensation, a purpose not aligned with the intended spirit of these laws. Although the court confirmed that the data subject had followed the appropriate procedural timelines (e.g., filing within the three-month period as required by the AGG), it nonetheless ruled the actions as abusive under § 242 of the German Civil Code (BGB). Next, the court acknowledged some GDPR violations by the controller, noting a partial failure to provide information required by Article 15 GDPR and Article 13 GDPR. However, it found these insufficient to warrant damages under Article 82 GDPR, especially since these claims appeared to be integrated as part of a larger strategy for financial gain rather than genuine data protection concern
A data subject made an access request with the Dutch Tax Administration (the controller). The controller decided to deny the request. The data subject raised several objections against this decision, but the controller declared it unfounded. The data subject appealed this decision. The Court considered the appeal grounded and ordered the controller to fulfill the access request. Following this first decision, the controller answered the request with a general indication of the personal data it processed and for what purpose (information usually available in privacy policies). It also provided the data subject with their most commonly processed personal data. Last, the controller generally referred to Article 13(4), Article 14(5) and Article 23 GDPR for possible non-disclosure. The data subject found the answer incomplete and lodged a further appeal to the Court. In an attempt to explain why some information had not been included in the response, the controller argued that the response was based on what it could find on its general system. The other IT systems had not been searched, because there were too many and this would therefore constitute a disproportionate burden. The District Court of Rotterdam held that searching a general system was not sufficient. The Court found that the controller's view that there were too many systems was not supported by evidence, unsubstantiated, and insufficient reasoning to suffice with the limited search it conducted and that the controller's general reference to grounds for exemption in the GDPR was insufficient. The controller had therefore not complied with the data subject's request. Furthermore, the Court held that the controller should have specified purposes, recipients and sources per Article 15(1). The mere listing of the personal data found, followed with a general explanation of how the Tax Administration handles personal data was not enough. The Court held that this did not allow the data subject to verify the law
This case started in the context of a litigation between the data subject and their insurance company – the controller. While pending this civil proceeding, the controller contacted the data subject’s dentist to ascertain whether the requirements to cover the data subject’s medical expenses were fulfilled. The controller disclosed to the dentist personal information concerning the litigation between controller and data subject. Immediately afterwards the controller contacted the data subject, acknowledging that the disclosure was a mistake and informing them that the company already asked the dentist not to use those data. The data subject lodged a complaint with the competent supervisory authority, claiming that personal information disclosed by the controller to the dentist was false and damaged the data subject’s reputation. Moreover, the controller did not take action to rectify the content of the communication. The supervisory authority pointed out that disclosure was unlawful because not necessary. However, it also considered not to have the authority to ascertain whether data were also false or inaccurate, as the civil proceeding was still pending. Since the controller already took steps to limit the adverse consequences of its unlawful processing, the DPA decided not to adopt further measures. The data subject brought an action against the supervisory authority under Article 78 GDPR, but the court found that the DPA did not violate its duties. The data subject appealed the decision. In the court of appeal’s view, Article 77 GDPR cannot be interpreted as imposing on the DPA a mere duty to examine the complaint, investigate on the matter and inform the data subject within a reasonable term. This conclusion was supported by the structure of Article 78 GDPR, which is strictly intertwined with Article 77 GDPR. Indeed, Article 78(2) GDPR provides the data subject with the right to an effective judicial remedy whenever the DPA does not handle a complaint or d
After receiving several complaints, at different times, about unwanted promotional phone calls from ENEL Energia (the controller), one of Italy's most important energy providers, the DPA initiated its investigation. At the end of 2018 and the beginning of 2019, the DPA made two requests for information to the controller. It then submitted a third request on 17 December 2019, which went unanswered. The DPA followed up with a fourth request on 10 July 2020, which the controller replied to on 14 January 2021. Then, on 14 May 2021, the DPA notified the controller of the initiation of the sanctioning procedure. On 16 December 2021, the Italian DPA fined the controller €26,513,977 with its [https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_9735672 decision of 9735672]. The controller appealed the decision to the Tribunale ordinario di Roma (Court) arguing that the Italian DPA failed to comply with the 120-day deadline for notification of the beginning of the sanctioning procedure, which the DPA should have complied with. To begin with, the Court noted that the Italian DPA had issued [https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9107640 Regulation No 2/2019] concerning the identification of terms and organisational units responsible for the administrative procedures. In accordance with [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29.pdf/b1787d6b-6bce-07da-a38f-3742e3888c1d?version=7.0 Article 166(5) of the Italian Privacy Code], the Regulation gives the DPA a time limit of 120 days from the establishment of the violation to notify the controller of the beginning of the sanctioning procedure. Subsequently, the Court addressed the DPA’s claim that the 120-day time limit was not mandatory. The Court stated that the time limit must be regarded as peremptory under [https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:1990-08-07;241!vig=
The data subject was an employee of the controller, X-FAB (a semiconductor foundry), and held two functions in the company: he was the chairman of the work council and the DPO of X-Fab and other companies of the same group of undertakings. However, on 1 December 2017, the data subject was dismissed from his duties as a DPO, at the request of the [https://gdprhub.eu/index.php?title=TLfDI_(Thuringia) DPA of Thuringen (TLfDI) (Germany)]. As a precautionary measure, the other undertakings also decided to dismiss him, based on the second sentence of Article 38(3) of the GDPR, which had in the intervening period become applicable. Dissatisfied, the DPO brought action before the a Court in Germany, asking to be reinstated in his position. The controller argued that his positions as a DPO and as the chair of the work council were incompatible as there was a potential conflict of interests between the two functions. In subsequent proceedings, both the courts of first instance and of appeal upheld the data subject’s action. The controller then appealed to the Bundesarbeitsgericht (Federal labour court of Germany). This Federal Court observed that the outcome of this appeal would depend on the interpretation of EU Law. Specifically, the Bundesarbeitsgericht stated that the question arose as to whether the second sentence of Article 38(3) GDPR (He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks) precludes national legislation from making the dismissal of a DPO subject to stricter conditions than those laid down by EU law. If this was the case, the Court wondered whether that provision had a sufficient legal basis. The Court also noted that it would be necessary to determine whether the functions of chair of the works council and of DPO may be performed simultaneously the same person or whether that would give rise to a conflict of interests within the meaning of the second sentence of the aforementioned ar
This case relates to an employment dispute between a fireworks company, the controller, and a former employee; the data subject. The data subject was initially a managing director of the company and, later on, a sales manager. The company imported fireworks and sold them to re-sellers who then sell these fireworks to ‘end-users’. While being employed by the company, the data subject also ran his own business outside of work, selling the fireworks directly to these 'end-users'. The employment dispute between the parties concerned two main issues: the payment of incentive-based bonuses; and a post-contractual non-competition clause. The data subject sought to recoup unpaid bonuses, while the controller argued that the data subject’s actions, in running this business outside of work, violated the post-contractual non-competition clause; a claim the data subject refuted as there was an agreement in place that they were allowed to engage in this business while they were an employee of the company. During this dispute, the data subject submitted an Article 15 GDPR access request in order to obtain personal data held by the company concerning him. The controller refused to provide this information, and the data subject did not receive it until 20 months later, when the controller disclosed the documents as part of the lawsuit. The data subject claimed that their former employer had violated Articles 12 and 15 GDPR, by failing to respond to the request, and sought non-material damages in the amount of €10,000; calculated as €500 for every month the controller failed to respond. With regards to the data protection aspect of this case, the court held in favour of the data subject, finding that the controller had violated Article 15 GDPR, and its obligations under Article 12 GDPR. The court found that the data subject was entitled to €10,000 in non-material damages, as Aricle 82(1) GDPR allows for such damages and that a violation of the GDPR itself is sufficient for compens