GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
The Belgian DPA had imposed a €40,000 fine on INFOBEL S.A., a commercial data broker (the controller), for processing and reselling personal data for direct marketing purposes without demonstrating a valid legal basis. The data at issue had been obtained from a telecom operator with which the data subject had took a telephone subscription in the past and were subsequently used and resold by the controller for direct marketing purposes. The DPA found that the controller had not demonstrated that the data subject had given freely given, specific, informed and unambiguous consent to the processing of his data for their resale for direct marketing purposes. Specifically, it held that the consent was not freely given, since the resale of personal data was not directly and objectively linked to the performance of the contract that concerned the provision of telephone services. The DPA also found that no separate opt-in had been offered for the specific purpose of reselling the data for direct marketing purposes, that the data subject had not been adequately informed as the controller’s identity was not mentioned anywhere in telecom operator’s general terms and conditions and that the consent was based on an opt-out rather than a clear affirmative act. The DPA had accordingly determined that the controller infringed article 5(1)(a) GDPR in conjunction with Article 6 GDPR and Article 24 GDPR. It had also ordered the controller to delete the personal data processed without a valid legal basis and to inform the recipients of those data of the decision and of the lack of a legal basis for the processing. The controller appealed the decision and challenged the fine before the Brussels Court of Appeal. It argued, inter alia, that the erasure order and the related obligation to inform recipients had become devoid of purpose because the relevant database had already been deleted in 2023. The DPA maintained that the erasure order was still justified because it had not been able to
TikTok Technology Limited, the controller, and TikTok Information Technologies UK Limited appealed a decision of the Data Protection Commission, the DPA, before the High Court. The DPA had opened an own-volition inquiry into transfers of personal data of EEA users of the TikTok platform to China. The controller operated the TikTok platform in the EEA and allowed personnel of China-based group entities to remotely access certain EEA user data. The controller accepted that the data included personal data and that the remote access constituted a transfer under Chapter V GDPR. The controller relied on standard contractual clauses and supplementary measures. It argued that the personal data was stored outside China and only remotely accessed from China. On this basis, the controller claimed that Chinese public authorities could not compel access to the data because, under the territoriality principle in Chinese law, Chinese authorities had no power to access data stored outside China. The DPA considered that the controller had not sufficiently demonstrated that the relevant Chinese laws would not apply to the personal data while it was being processed by personnel in China. The DPA also considered that the controller had failed to properly assess whether the transferred data received a level of protection essentially equivalent to that guaranteed in the EEA. During the inquiry, the controller also introduced Project Clover. This was a set of measures intended to localise EEA user data in Europe, restrict access by China-based personnel and reduce the data flows still accessible from China. Under Project Clover, certain data would remain accessible by China-based personnel, but the controller argued that this data would be subject to additional privacy-enhancing measures, including pseudonymisation and differential privacy. The DPA found that the controller infringed Article 46(1) GDPR between 29 July 2020 and 17 May 2023. It also found that the controller infringed Artic
On November 2024, a person (the requestee) made a request under the Freedom of Information Act 2000 to Kent County Council, the controller, concerning candidates who sat the Kent Test in September 2024. The requestee requested, for each candidate, the raw scores and standardised scores in English, Maths and Reasoning, together with the candidate’s date of birth. The request included anonymisation safeguards. In particular, the requestee asked the controller to exclude any results where fewer than five children shared the same date of birth and to remove candidates outside the normal cohort age range. The controller refused the request. It relied on section 40(2) FOIA, arguing that disclosure would involve the unlawful processing of third-party personal data. In particular, the controller considered that the combination of scores and dates of birth could allow the data subjects to be identified, including by parents or children who already knew some information about a candidate’s score or date of birth. The apellant requested an internal review. The controller upheld its refusal, stating that many combinations of raw scores, standardised scores and dates of birth were unique or occurred very infrequently. It concluded that disclosure would breach the principle of lawfulness, fairness and transparency under Article 5(1)(a) UK GDPR. The apellant then complained to the Information Commissioner, the DPA. The DPA found that the controller was entitled to rely on section 40(2) FOIA. The DPA considered that the requested information could constitute personal data because, when combined with existing knowledge held by certain individuals, it could allow individual children to be identified. The DPA further found that, although there was a legitimate interest in transparency and oversight of the Kent Test, disclosure would be an unwarranted interference with the rights and freedoms of the data subjects. It therefore concluded that Article 6(1)(f) UK GDPR could not be relied
A German user (the data subject) brought court proceedings against two online gambling service providers (the controllers) established in Malta. They offered online casino games and sports betting services that were accessible to everyone in Germany. The data subject requested access to the data concerning him processed by the controllers in April 2024. He wanted to obtain certainty about the lawfulness of the processing of his data and determine the extent of his gambling behaviour as well as the claims to which he was entitled against the controllers. The data subject claimed in court that the controllers had not fulfilled his access request and should therefore be ordered to jointly and severally provide him access to his complete gaming and transaction data pursuant to Articles 15(1) and 15(3) GDPR. The controllers stated that they had already provided the data subject access to the information he had requested and stated that the action should be dismissed. The court held in a partial judgment that the action was admissible and largely justified. In order to pay winnings to the data subject, the controllers inevitably had to verify his identity and thus process his personal data. The court ordered the controllers to provide the data subject information about the personal data processed in context of the customer relationship, particularly data concerning the data subject’s gaming history and all transactions on his gaming accounts. The access request was not manifestly unfounded or excessive within the meaning of Article 12(5) GDPR. The court also held the controllers had not previously provided the data subject access to the required information in accordance with Articles 15(1) and 15(3) GDPR. However, the controllers were legally independent and did not operate the online gambling websites jointly. Therefore, the obligation to fulfil the access request was to be limited to their individual websites.
The data subject had previously worked as an IT specialist of a city. In May 2019, his work computer was supposed to be handed over to another employee. The data subject had remained logged into his personal account on Facebook that contained conversations between him and other employees of the city. The employee responsible for handing over the computer printed out the conversations and gave them to the mayor (the controller), who used them to initiate disciplinary and criminal proceedings against the employees. The data subject filed a complaint with the supervisory authority regarding the processing of his personal data contained in the Facebook conversations. The DPA reprimanded the controller for violations of Articles 5(1)(a), 5(1)(b), 6(1), and 9(1) GDPR in September 2020. According to the DPA, there had been no legal basis for the processing of personal data that also included information about the data subject’s religion. The controller appealed the decision. The court of first instance held the case concerned the secrecy of correspondence instead of data protection and annulled the DPA decision in 2021. The Supreme Administrative Court overturned this decision in 2025 and referred the case to the court of first instance for re-examination. This time, the court of first instance dismissed the appeal and deemed the DPA decision correct. The controller appealed further to the Supreme Administrative court, arguing that he had not processed personal data. The Supreme Administrative Court dismissed the controller’s appeal as unfounded. In the court’s view, the data subject’s login credentials, profile information and information in the Facebook conversations clearly constituted personal data within the meaning of Article 4(1) GDPR: logging in allowed access to the profile of a specific natural person and therefore identified them. Second, the court held that the controller had undeniably processed personal data pursuant to Article 4(2) GDPR. The controller co
Kindred Group PLC and Risepoint Limited (the controllers) are companies that provide online gambling products. Several companies within Kindred Group PLC (Risepoint was initially in this group) offered online gambling products before a national law requiring a license entered into force. In response, several lawsuits were filed before courts regarding the validity of the gambling agreements between players and unlicensed online gambling providers. Several data subjects later requested access (Article 15 GDPR, or in the alternative, the right to portability under Article 20 GDPR) to the controller to receive information on specific transaction data and the types of games they participated in. The data subjects did not receive access and brought a claim to the court. The data subjects requested the court to hold both companies liable (jointly or separately) The court initially dismissed the claim based on the code of civil procedure, but allowed the data subjects to amend their arguments regarding the GDPR. Both companies argued that they were not controllers, and that the requests made by the data subjects were abusive. According to the companies, the data subjects requested access for the sole purpose of bringing legal actions against them. Finally, the companies argued that they did not have the obligation to comply with the requests under Article 15(4) GDPR. The court first clarified that both Kindred Group PLC and Risepoint Limited were controllers. Kindred Group PLC argued that it did not exercise any decisive influence over the purpose and means of processing. The court took into consideration the functional definition of “controller” under Article 4(7) GDPR and CJEU case law, rather than a formal definition.See cases C-40/17 (Fashion ID), margin 65; C-210/16 (Wirtschaftsakademie Schleswig-Holstein), margins 26 and 27 The court found that Kindred Group PLC was a controller for access made between May and October 2024, but not for requests made after October
On 13 March 2019, Sigma, a Cypriot TV channel operated within DIAS Media Group (ΕΚΔΟΤΙΚΟΣ ΟΙΚΟΣ ΔΗΜΟΣΙΑ ΔΙΑΣ ΛΙΜΙΤΕΔ), published a report disclosing financial information concerning a public figure in Cyprus (the data subject). The DPA treated DIAS Media Group as the controller responsible for the publication. The report formed part of coverage on whether there had been favourable treatment of a politically exposed person. On 15 April 2019, the data subject lodged a complaint with the Cypriot DPA concerning the disclosure of their financial personal data by Sigma and other media outlets belonging to the controller’s group. The DPA found that the controller had failed to properly balance the journalistic interest in publication against the data subject’s rights to privacy and data protection. In particular, the DPA considered that the controller had failed to demonstrate that it had taken into account certain balancing criteria, including whether the processing was carried out exclusively for journalistic purposes, whether it was strictly necessary to ensure the right to information on matters of public interest, whether the information was accurate and truthful, and whether there had been prior contact with the data subject. The DPA held that, by publishing information concerning the data subject’s financial situation, the controller had infringed the principles of lawfulness, fairness and transparency, data minimisation and accuracy. Therefore, it found that the controller infringed Article 5(1)(a) GDPR, Article 5(1)(c) GDPR and Article 5(1)(d) GDPR. Accordingly, the DPA fined the controller €10,000 and ordered it to remove the publication from the websites of all entities controlled by it within one week. The controller challenged the decision before the Administrative Court of Cyprus. It argued, among other things, that the DPA had violated its right to freedom of expression and its exercise of journalistic freedom under Article 85 GDPR. The court found that th
Istituto nazionale della previdenza sociale (INPS, the controller) is the Italian National Institute for Social Security. In 2021, the DPA fined the controller €300,000 for its data processing activities linked to a subsidy given during the pandemic (also called “the COVID bonus”). The DPA found that the controller had postponed its second screening of verifying the eligibility of data subjects to a later stage, on the grounds that there was a need to immediately pay the subsidy. The controller considered that politicians did not fall under the scope of eligible data subjects, as they were already enrolled in a mandatory social security scheme. The controller processed their personal data from databases to cross reference them with data subjects who had applied for the subsidy. The DPA found a violation of several GDPR principles: the principle of lawfulness (Article 5(1)(a) GDPR), data minimisation (Article 5(1)(c) GDPR), accuracy (Article 5(1)(d) GDPR) and accountability (Articles 5(2) and 24 GDPR). According to the DPA, the controller had not limited the cross referencing to data subjects that had received the allowance, but to those whose applications had already been rejected. In addition, the DPA found a violation of Articles 25 and 35 GDPR, as the controller failed to conduct a data protection impact assessment (DPIA). The DPA ordered the controller to erase all personal data that had been processed unlawfully and to carry out a DPIA before resuming its processing activities. The controller appealed the decision to the Court of Rome, and argued that the DPA’s decision was unfounded. The court upheld the appeal and dismissed the DPA’s decision. The court considered that the controller had processed data subjects’ data lawfully, as it had limited the amount of data to what was necessary to verify data subjects’ eligibility. The court also considered that the processing posed a low risk for data subjects’ rights, as the data subjects’ names were not disclosed. T
A prospective bidder in a compulsory auction wanted to find out who owned the property being sold and filed a request to inspect certain files with a court (the controller). The court of first instance granted them access to the files on the condition that the names and addresses of involved parties mentioned in the files (the data subjects) as well as previously deleted land register entries would be redacted from the document. The prospective bidder appealed this decision. The appeals court held that granting access to personal data contained in the documents was precluded by national law. The prospective bidder then appealed further to the Federal Court of Justice, which also examined whether their right to inspect documents was restricted by the provisions of the GDPR. The Federal Court of Justice overturned the appealed decision. It held that the controller had to grant access to the files without redacting the personal data of potential contacts, shareholders, and creditors of rights remaining in force contained in them. The right to inspection of files followed from national law. The court held that providing access to the files without first redacting the personal data of the data subjects did not infringe the GDPR. The processing by the court granting access to the files was covered by the legal basis in Article 6(1)(e) GDPR, as it was necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The basis for the processing was also laid down by Member State law within the meaning of Article 6(3)(b) GDPR. The national provisions about the right to inspection of compulsory auction files was proportionate to the aim pursued within the meaning of Article 6(3) GDPR: first, the right to access was limited to certain parts of the file. Second, the court pointed out that providing access to the unredacted files helps bridge the information gap among prospective bidders and opens
Federpol (the controller) is an association of private investigators. In 2021, the DPA fined the controller for distributing a newsletter to all members containing the minutes of a meeting with its executive board. The minutes concerned a case against a member who had sent a defamatory letter. The member was identified by name. The DPA found a violation of Articles 5(1)(a) and (c), and 6(1) GDPR as the controller did not have a legal basis to process the data (including the name of the member in the newsletter). The DPA fined the controller €5,000. In 2022, the controller appealed the decision to the court of Rome. The controller argued that the processing was lawful under legitimate interest, and in any case, contractual obligation. The court dismissed the appeal and ordered the controller to pay the fine. The court considered that the controller could have informed members without naming the data subject. The controller filed an appeal to the Supreme Court. The court dismissed the appeal and upheld the reasoning of the lower court. The court followed the reasoning of the lower court, and stated that the controller could have informed its members of the case without including the data subject’s name. The court considered this processing to be disproportionate in relation to the goal. The court dismissed the controller’s argument that there was a difference between disseminating the information and communicating it to members. The court stated that, while the data subject’s name did not fall under the scope of Article 9 GDPR, the controller needed the consent of the data subject to process their data. Therefore, a resolution adopted by a general meeting or generic consent for statutory purposes did not meet the requirements of consent. The court also dismissed the controller’s argument that the fine was disproportionate. The court held that the DPA had correctly applied and justified the fine in accordance with Article 83(2) GDPR.
In 2022, a Croatian media outlet published articles about a person (data subject) who was, at the time, a member of the management board of Zagrebački holding d.o.o, a City of Zagreb-owned holding company providing municipal and utility services. The articles disclosed their name, the company where they were employed, their position, gross salary, the model of their personal vehicle, the gross monthly allowance for using a private vehicle, and the amount of a fine imposed by the Croatian Commission for the Resolution of Conflicts of Interest. The data subject held the management board position from September 2021 to March 2023. The data subject lodged a complaint with the Croatian DPA, alleging that the publication infringed their right to the protection of personal data and requesting the removal of the articles. The DPA rejected the complaint and found no violation. It concluded that the published personal data were appropriate, relevant and necessary for informing the public, due to the data subject’s position at the time of publication and because the public interest prevailed. The DPA also found that the public interest in the continued availability of the articles outweighed the data subject’s request for erasure under Article 17 GDPR. It pointed out that Article 17(3)(a) GDPR stipulates that the right to erasure does not apply to the extent that the processing is necessary for the exercise of the right to freedom of expression and information. The DPA considered the Croatian Media Act, noting that it applied as a special law. The Act regulates conditions for media freedom, the rights of journalists and access to public information. The DPA determined that according to Article 8 of the Media Act, there was no violation of the right to privacy if a legitimate public interest prevailed over the protection of privacy in relation to journalistic activities. The data subject contested the DPA’s decision before the Administrative Court of Zagreb. They argued that
On 3 November 2021, a data subject filed a complaint with the Cypriot DPA against an individual who managed a club affiliated with the Pancyprian Judo Federation. The complaint concerned the unauthorised publication of photos and other material, including material depicting the data subject’s minor child, in the context of Pancyprian under-18 judo matches held under the federation’s auspices. On 13 December 2021, the DPA requested various information from the federation. The federation did not respond. The DPA then sent a reminder on 25 January 2022, but the federation again failed to respond. Subsequently, on 30 March 2022 the DPA issued a prima facie decision finding a breach of Article 31 GDPR due to the federation’s lack of cooperation and invited the federation to submit its position. The federation did not respond to this either. On 11 May 2022, the DPA issued the contested decision, finding that the federation had failed to cooperate with it despite repeated requests. It imposed a €5,000 fine for breach of Article 31 GDPR. The federation appealed against the decision, arguing that it was based on an incorrect application of the GDPR and contained legal and factual errors. The court noted that, for Article 31 GDPR, Article 58 GDPR and Article 83 GDPR to apply, the federation had to qualify as either a controller or a processor. The court found that the federation did not fall within the definition of processor under Article 4(8) GDPR. It noted that the DPA did not appear to have treated it as such. The court then examined whether the federation could be considered a controller under Article 4(7) GDPR. It held that the contested decision did not clearly explain why the DPA had classified the federation as a controller. The court inferred that the DPA may have reached this conclusion because the federation had forwarded a letter concerning a past personal data breach to all its members at the request of a lawyer from one of its member clubs. However, the court
Tagadamedia, the controller, organised online competitions on websites it managed. In this context, it collected participants’ personal data, including names, postal addresses, email addresses and telephone numbers. It then transferred this data to commercial partners for marketing purposes in exchange for payment. The DPA, carried out an on-site inspection at the controller’s premises and later initiated sanction proceedings. The DPA found that the controller’s consent mechanisms did not allow users to give free, specific, informed and unambiguous consent to the transfer of their data to partners for marketing purposes. The controller had used different versions of consent forms. One version displayed a prominent “I agree” button, while the option to continue without receiving partner offers was only available through a less visible link in smaller text. Another version included two buttons, “I agree” and “I decline”, but the visual presentation continued to emphasise consent. The controller later proposed a new form with two similar buttons, “I agree” and “Next step”. The DPA imposed a €75,000 administrative fine for breaches of GDPR Articles 6 and 30. It also ordered the controller, under a daily penalty of €1,000, to implement a compliant form collecting valid consent for the transfer of data to partners. The controller appealed the decision before the Court. The Court partly upheld the appeal. First, the Court rejected the controller’s procedural arguments regarding the DPA’s inspection and the referral to the restricted committee. It held that the competent public prosecutor had been informed in advance of the inspection and that the restricted committee had been validly seized and convened. Second, the Court found that the controller’s rights of defence had been breached in relation to one of the violations. The DPA’s report had alleged that the controller had engaged in unfair processing under GDPR Article 5 because it led users to believe that all transfe
The controller had been registered in the list of qualified consumer associations since 2001. In 2021, the registration authority initiated proceedings to verify whether the controller still met the registration requirements. The controller was required to submit a list of members containing the first name, surname, date of birth and address of at least 75 natural persons (the data subjects) as part of this review procedure. The controller refused to submit a corresponding list of members on two separate occasions, stating that this requirement raised data protection concerns and that the disclosure of personal data of the members would be irreversible. In addition, the controller considered the measure to be disproportionate. The registration authority subsequently removed the controller from the list of qualified consumer associations in April 2025. The controller filed an objection against the decision, which the registration authority rejected. In December 2025, the controller submitted an application for interim relief. The court dismissed the application for interim relief. It held that the processing of personal data that is inevitably associated with the creation of a membership list and its submission to the registration authority did not raise any data protection concerns as it was lawful under Article 6(1)(c) GDPR. In this case, the controller was subject to a legal obligation to submit a list of members to demonstrate that it met the registration requirements for qualified consumer associations under national law. Furthermore, the court held the measure was in line with the principle of data minimization under Article 5(1)(c) GDPR: first, the scope of the request was limited to data indispensable for the identification of individuals. Second, the court stated that the group of data subjects was also not defined in a disproportionately broad manner.
The data subject had been liable to pay broadcasting contributions to the Controller, a German regional public broadcasting authority, since 2007. Following objections to several contribution assessment notices, the data subject submitted a request under Article 15 GDPR seeking a copy of all personal data processed about him by the Controller. The Controller responded by providing the categories of personal data and related information specified under § 11(8) of the German Broadcasting Contribution Treaty (RBStV), which governs data subject access requests relating to broadcasting contribution records, together with general privacy information. The data subject argued that the response was incomplete because it did not include copies of all documents containing his personal data, including correspondence with him and third parties. The Controller maintained that it had fully complied with its obligations under the RBStV. After the Controller declined to provide additional information, the data subject brought proceedings seeking disclosure of all personal data concerning him processed by the Controller. The Court held that § 11(8) of the German Broadcasting Contribution Treaty (RBStV) constituted a lawful restriction of the broader right of access under Article 15 GDPR pursuant to Article 23(1)(e) GDPR. It found that the national provision was a valid legislative measure, respected the essence of the fundamental right to data protection, and pursued an important public interest by ensuring the effective financing and administration of the public broadcasting system. The Court further held that the restriction was necessary and proportionate, noting that requiring the Controller to comply with the full scope of Article 15 GDPR across more than 44 million broadcasting contribution accounts would impose a disproportionate administrative and financial burden capable of undermining that public interest. The Court also held that § 11(8) RBStV satisfied the safeguards r
The headteacher of a primary school in Austria was in charge of organising mandatory continuing training programmes for teachers at the school. The training programmes were provided by a University, which supplied schools with organisational staff known as programme coordinators. The data subject was proposed by the University as the coordinator for an upcoming training programme at the school. After being informed of this proposal, the headteacher asked a teacher about the data subject’s reputation in a face-to-face conversation. The teacher expressed a negative opinion about the data subject. The headteacher then sent an email from his professional email address, using a school computer and a designated server, to an employee of the University. In the email, he requested that another programme coordinator be assigned. He referred to the information obtained from the third party, according to which the data subject allegedly opposed the public school system and was in constant dispute with the relevant education authority. When the data subject became aware of the email, he requested access under Article 15 GDPR. In particular, he asked for the identity of the third party who had provided the information, as well as a copy of the personal data concerning him processed in the email. The headteacher refused to provide this information. He argued that he had not possessed or stored personal data concerning the data subject and had merely expressed concerns about the proposed appointment. The data subject brought legal proceedings. The first instance court dismissed the claim, and the appeal court upheld that decision. The courts found that the headteacher had acted as an executive officer of the legal entity governing the school. They also held that the means of processing, including the professional email address, server and computer, had been prescribed to him. Therefore, they considered that he could not be treated as a controller under the GDPR. The appeal court a
The headteacher of a primary school in Austria was in charge of organising mandatory continuing training programmes for teachers at the school. The training programmes were provided by a University, which supplied schools with organisational staff known as programme coordinators. The data subject was proposed by the University as the coordinator for an upcoming training programme at the school. After being informed of this proposal, the headteacher asked a teacher about the data subject’s reputation in a face-to-face conversation. The teacher expressed a negative opinion about the data subject. The headteacher then sent an email from his professional email address, using a school computer and a designated server, to an employee of the University. In the email, he requested that another programme coordinator be assigned. He referred to the information obtained from the third party, according to which the data subject allegedly opposed the public school system and was in constant dispute with the relevant education authority. When the data subject became aware of the email, he requested access under Article 15 GDPR. In particular, he asked for the identity of the third party who had provided the information, as well as a copy of the personal data concerning him processed in the email. The headteacher refused to provide this information. He argued that he had not possessed or stored personal data concerning the data subject and had merely expressed concerns about the proposed appointment. The data subject brought legal proceedings. The first instance court dismissed the claim, and the appeal court upheld that decision. The courts found that the headteacher had acted as an executive officer of the legal entity governing the school. They also held that the means of processing, including the professional email address, server and computer, had been prescribed to him. Therefore, they considered that he could not be treated as a controller under the GDPR. The appeal court a
The controller was an Austrian magazine publisher based in Vienna. Its business consisted in publishing and distributing weekly, monthly and other periodicals. The data subject was a long-standing customer of the controller. They held multiple subscriptions. On 7 March 2022, the data subject received an informational email with regard to one of their subscriptions. The email contained links allowing users to unsubscribe from further emails or manage their email settings. The unsubscribe link led to a website operated by the controller’s marketing software provider. The provider was a company specializing in mass email marketing solutions. Its parent company was headquartered in USA, while its subsidiary was based in Germany. The data subject complained to the controller and requested information regarding the receipt of this email. Additionally, they contended that the transfer of their data to the United States was unlawful. On 25 April 2022, the data subject lodged a complaint with the Austrian DPA. They argued that the controller had failed to properly respond to their access request, had not provided the required information under the GDPR and had apparently transferred personal data to the United States without a valid legal basis. The controller alleged that the failure to respond happened because of an internal error. It argued that it had subsequently provided the data subject with the information required under Article 13 GDPR, Article 14 GDPR and Article 15 GDPR. The controller further submitted that for the sending of informational emails, it used a marketing software provider, acting as a processor, which offered services for the mass sending of emails. According to the controller, only the data subject’s first name, surname and email address were shared for this purpose. It acknowledged that a transfer to third countries could not be ruled out, but argued that any such transfer was covered by Standard Contractual Clauses (SCCs) and additional technic
A debt collection agency (the controller) sent reminders to a customer (the data subject) for delayed installment payments related to a terminated electricity contract in November 2019. The data subject considered the claimed sums to be excessive and refused to pay. The controller transmitted the information on outstanding debts of €795 and €817 to a credit information agency, which in turn made negative entries in its database. This lowered the credit score assigned to the data subject by the credit information agency. The data subject sued the controller for disclosing outstanding receivables to the credit information agency. The court of first instance ordered the controller to revoke the negative entries contained in the credit ranking database and awarded the data subject €500 in damages. The controller appealed this decision. The appellate court held that there had been no legal basis for the transmission of personal data, as the data subject had not consented to the processing and the requirements for legitimate interests pursuant to Article 6(1)(f) GDPR were not met. However, the court considered that the data subject had not suffered any non-material damage within the meaning of Article 82 GDPR. The controller appealed the case further to the Federal Court of Justice. The Federal Court of Justice dismissed the controller’s appeal and referred the case back to the appellate court. First, the court held transmitting the personal data to the credit information agency had been unlawful due to the lack of a legal basis. It pointed out that the requirements for processing based on legitimate interests laid down in Article 6(1)(f) GDPR were not met. As such, legitimate public interests in preventing the granting of credit to those who are unable or unwilling to pay could justify the transfer of data to credit information agencies. However, no meaningful indications regarding the data subject’s ability or willingness to pay could be derived from the credit inform
SAINTS & STARS B.V. (the controller) is a company that operates several gyms. In 2025, a data subject cancelled their membership and requested the controller to erase all their personal data in accordance with Article 17 GDPR. The controller sent two general marketing emails after terminating the data subject’s membership. The controller argued that it had a legal obligation to retain the data subject’s data, as they had not paid the final invoice. The controller also claimed to have unsubscribed the data subject from its marketing emails list. The data subject brought a case to the court, requesting the court to order the controller to erase their data and pay €750 in non material damages. During the proceedings, the court informed the data subject that their claim for erasure would be rejected, as they did not file the case within the time limit set by national law. The data subject stated that they no longer wished their data to be deleted, but still maintained their claim for damages. The court first clarified that the deadline applied for the erasure claim and not the claim for damages, as the six week limit under national law applies to requests under Articles 15 to 22 GDPR. The court then stated that it was not in dispute that the controller unlawfully processed the data subject’s data to send them marketing emails. The controller processed this data without a valid legal basis under Article 6 GDPR, as the data subject did not consent to this processing. However, the court refused to award the data subject damages. Under Article 82 GDPR, a violation of the GDPR in itself is not sufficient to grant a data subject damagesSee also C-300/21 (Österreichische Post), margin 32. According to the court, the data subject did not provide evidence beyond stating they felt “genuine discomfort“ when receiving the emails after canceling their membership. This was insufficient to establish non material damage. The court dismissed the case.