GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Court case 6 K 788/20.WI
The data subject requested information from a credit rating agency acting as controller regarding the calculation of his credit score. The score was used by third parties, such as lenders, to assess the data subject’s creditworthiness and had a significant impact on his ability to conclude contracts. Relying on Article 15 GDPR, the data subject sought access not only to his personal data but also to information on how the score was generated. The controller provided general information but refused to disclose details about the functioning of the scoring system, arguing that the algorithm and weighting factors constituted trade secrets and that the score itself did not amount to automated decision-making. The data subject lodged a complaint with the DPA, which was later rejected. The data subject brought an appeal before the Administrative Court, arguing that the credit score resulted from automated processing and had legal or similarly significant effects, thereby entitling him to the additional information required under Article 15(1)(h) GDPR. The court upheld the data subject’s claim. After hearing the parties, the court stayed the proceedings and referred the case to the CJEU (C-634/21 and C-203/22). The questions posed regarded the interpretation of Article 22, and whether credit scoring can amount to automated decision-making. The court then relied heavily on the CJEU's reasoning in assessing the case at hand. It held that credit scoring qualifies as automated decision-making within the meaning of the GDPR, as the score is generated exclusively by automated means and is intended to be used as a decisive factor in contractual decisions affecting the data subject. The fact that third parties ultimately rely on the score does not negate the automated nature or significance of the processing. Accordingly, the Court found that Article 15(1)(h) GDPR applies. The controller is therefore required to provide the data subject with meaningful and understandable information about the logic involved in the scoring process, as well as information about the significance and envisaged consequences of the processing for the data subject. The Court clarified that this obligation does not require disclosure of the source code or full algorithm. However, the information provided must go beyond abstract descriptions and must enable the data subject to understand, in concrete terms, how relevant factors influence the score and how the score affects decision-making.
complainant (controller)
On 7 April 2021, the data subject requested access to their data under Article 15 GDPR. The controller replied on 12 April 2021 and provided further information on 27 May 2021 after the data subject made a further enquiry. As the controller's privacy policy listed significantly more data being collected, the data subject lodged a complaint with the Austrian DPA (DSB) on 13 July 2021. They argued that the data provided and its sources were incomplete. On 03 January 2022, the DPA partly upheld the complaint and ruled that the controller violated the right of access by not providing information pursuant to Article 15(1)(h) GDPR, as the calculation of the creditworthiness constitutes profiling under Article 4(4) GDPR. On 09 February 2022, the controller appealed, stating that its calculations were not based on automated processing and that providing further information would reveal trade secrets. The proceedings were stayed until the CJEU's preliminary ruling in [https://infocuria.curia.europa.eu/tabs/document/C/2022/C-0203-22-00000000RP-01-P-01/ARRET/295841-EN-1-html 'Dun & Bradstreet Austria' (C‑203/22)]. By letter of 15 May 2025, the court resumed the case. During the entire proceedings, the controller gradually provided further information on the personal data being processed and the calculation of the credit score. Hence, the following data is used to calculate the credit score: Name, age, gender, address, macroeconomic statistical parameters, payment history. The calculation itself is performed automatically using an algorithm and the same formula unless the controller's customers order a different score model. First the court ruled that the controller had an obligation to provide information under Article 15(1)(h) GDPR, as all three cumulative requirements pursuant to Article 22 GDPR were stated to be met: A credit score was calculated ('decision'), which predicts various aspects of the data subject, including their economic situation, for example. This constitutes profiling within the meaning of Article 4(4) GDPR ('based solely on automated processing, including profiling'), impacting the decision-making of third parties regarding contractual relationships with the data subject ('produces legal effects [...] or [...] similarly significantly affects' concerning the data subject) . Second, the court held that the controller failed to provide meaningful information under Article 15(1)(h) GDPR to sufficiently explain why the data subject had been assigned a particular credit score, including the logic and weighting of the data categories in question, and its corresponding effects on the data subject. Third, the court ruled that the controller asserted the presence of trade secrets in very general terms without providing the allegedly protected information to the DPA or the court. Fourth, the court held that no appeal to the Austrian Supreme Administrative Court (Verwaltungsgerichtshof) was admissible pursuant to [https://ris.bka.gv.at/eli/bgbl/1930/1/A133/NOR40201324?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=B-VG&Gesetzesnummer=&VonArtikel=133&BisArtikel=&VonParagraf=&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=13.07.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=4c0c3096-fcc5-4494-8001-860e8840f341 Article 133(4) B-VG], as no (further) indications of legal questions of fundamental importance were raised. The court based their ruling, among others, in accordance with the following CJEU's judgments: In [https://juris.curia.europa.eu/juris/document/document.jsf?text=&docid=280426&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=1505002 'SCHUFA' (C‑634/21)], the court ruled that the concept of 'automated individual decision-making' under Article 22(1) GDPR encompasses the provision of a probability value regarding a data subject's 'ability to meet payment commitments', on which a third party heavily relies to decide whether 'to establish, implement or terminate' a contract with that data subject. In [https://infocuria.curia.europa.eu/tabs/document/C/2022/C-0203-22-00000000RP-01-P-01/ARRET/295841-EN-1-html 'Dun & Bradstreet Austria' (C-203/22)], the court stated that the wording of Article 15(1)(h) GDPR must be understood as meaning that the controller must provide clear, transparent and understandable information about the methods and principles used to produce the data subject's credit score. If the controller claims that sharing this information would disclose trade secrets or data of third parties, the competent DPA or court must balance the competing rights and interests to determine the extent of the disclosure.
Court case W254 2253351-1
The data subject requested access under Article 15 GDPR from the controller (a credit information agency). The controller provided the personal data it held, including the data subject's name, date of birth, address and business role, as well as information about the sources of those data. The data subject considered the response incomplete and requested further information. The controller provided additional information, including the companies that had queried the data subject's creditworthiness between 2014 and 2021 and the credit scores disclosed to them. The data subject then lodged a complaint with the DPA. The data subject argued that the controller processed more personal data than it had disclosed, pointing in particular to the broader categories listed in the controller’s privacy notice and the absence of information about certain data sources. During the DPA proceedings, the controller provided another response, saying that the credit score could change based on statistical criteria linked to economic developments, which it considered non-personal. The data subject appealed the DPA's decision. During the court proceedings, the controller provided further information. It explained that the credit score was calculated using, among other things, payment history data, name, age, sex, address, and the first and last confirmation of the address. However, the controller still did not disclose the specific data covered by the statistical parameters linked to general economic developments that it had used when calculating the data subject’s credit score. First, the court rejected the argument that the controller must have processed additional personal data merely because its privacy notice listed broader categories of data. The privacy notice described data that the controller could theoretically process, but this did not establish that the controller actually processed those data in relation to the data subject. Second, the court examined whether the statistical parameters used in calculating the credit score constituted personal data under Article 4(1) GDPR. It relied on the broad definition of personal data and the principle that information becomes information “about” a person when its content, purpose or effect links it to that person. The court also referred to existing case law recognising that statistical probability statements can constitute personal data when they provide an assessment relating to an identified or identifiable person. It applied that reasoning to the credit-scoring process. Although the statistical parameters relating to general economic developments did not themselves relate to the data subject, the controller fed them into the algorithm used to calculate that particular person's credit score. By doing so, the controller linked the parameters to the data subject and used them to make an assessment of that person's creditworthiness. The parameters therefore became personal data within the meaning of Article 4(1) GDPR. As a result, Article 15(1) GDPR also covered those statistical parameters. Finally, the court partly upheld the appeal and held that the controller had violated the data subject’s right of access under Article 15(1) GDPR by failing to disclose the statistical data relating to the data subject that it had used to calculate the credit score. It otherwise upheld the DPA's assessment that the controller had provided complete information about the other personal data it processed and their sources and rejected the remainder of the appeal.
Court case Ra 2023/04/0271
A data subject lodged a data protection complaint against a credit information agency (the controller) with the Austrian Data Protection Authority (DSB). The data subject requested access under Article 15 GDPR to understand how his personal data were processed, specifically regarding the calculation of his creditworthiness score, including the logic, factors, and rules applied. At that time, the controller maintained two datasets about him: one as a private individual and one as a sole trader. Following a prior deletion request by the data subject, the controller deleted certain data related to his previous debt settlement proceedings. Regarding the controller's response to the access request, the data subject argued that provided information was inadequate.He claimed that he was entitled to a full explanation of how the score was generated and how the underlying data influenced it. The DSB initially sided with the data subject, finding that the controller violated Article 15 GDPR by deleting one dataset after the access request and providing insufficient information on the remaining dataset. The DSB ordered the controller to clarify and supplement the information provided. The controller further appealed to the Federal Administrative Court (BVwG), which overturned the DSB’s decision. It found that the deletion of the dataset had been at the request of the data subject, and therefore did not constitute a violation. Regarding the second dataset, the court held that the access provided was sufficient because the creditworthiness score value of 0.01 was a manually assigned neutral baseline, not a result of an automated decision or profiling. Consequently, no automated decision-making under Article 22 GDPR occurred, and the data subject received adequate information about the sources, parameters, and general methodology for future creditworthiness assessments. The data subject then filed an extraordinary revision with the Administrative Supreme Court (VwGH) . The S
Court case Us I-755/2025-8
The data subject was a member of the management board of Zagrebački holding, a company owned by the City of Zagreb, from 3 September 2021 until 31 March 2023. A television broadcaster published several pieces, including a video on its YouTube channel, reporting on the data subject’s resignation. The publications mentioned his name, role, employer, salary, and information on the brand of his private car. The data subject filed a complaint with the Croatian Personal Data Protection Agency (AZOP), claiming that the publication constituted unlawful processing under the GDPR because the media lacked a valid legal basis under Article 6, the reporting was inaccurate and excessive, and it did not serve any genuine public interest. He latter further claimed during the lawsuit against AZOP's decision that the authority had incorrectly and incompletely established the facts, misapplied substantive law, and breached procedural rules. He emphasized that the published personal data was unrelated to transparency in public administration, that he was neither a public figure nor a political actor, and that any public interest ended once he left office on 31 March 2023. He invoked his right to erasure under Article 17 GDPR and sought removal of the content, annulment of AZOP’s decision, or alternatively, a remittal for a new procedure. AZOP contested the lawsuit in full, maintaining that it had acted in accordance with Article 34 of the Croatian GDPR Implementation Act and Article 77 GDPR. It argued that the publication fell within a justified public interest under Article 8 of the Croatian Media Act and that it had properly carried out a balancing test between privacy (Article 8 ECHR) and freedom of expression (Article 10 ECHR). According to AZOP, the reporting was necessary, proportionate, and not sensationalistic, and did not excessively intrude on the data subject’s privacy. It added that consent was not required because the processing relied on legitimate interest under Article 6(1)(f) GDPR. The Administrative Court dismissed the action and upheld AZOP’s decision. Because Zagrebački holding is a city-owned and publicly funded company, the court considered information about the data subject’s salary, compensation for using his private vehicle in official duties, and his managerial role to be directly connected to the use of public resources. This placed the publication within the legitimate public interest in transparency recognised by Article 8 of the Media Act. In its proportionality assessment, the court accepted AZOP's application of Article 5 and 6 GDPR, emphasizing that the published data did not touch upon the data subject’s family or intimate life but related solely to his public functions. Publication was therefore limited to what was necessary to inform the public about the management of a publicly owned company. The data subject’s claims that the publication was false or harmful to his reputation did not alter the outcome, as AZOP is not empowered to determine the truthfulness or tone of journalistic content, particularly under the journalistic exemption in Article 85 GDPR. Issues of accuracy or reputational harm must instead be pursued through media-law mechanisms such as requests for correction or civil actions. On the erasure request, the court held that the right to be forgotten under Article 17 GDPR cannot override freedom of expression and information where media reporting is involved. Although the data subject no longer served on the board, the publication continued to contribute to public understanding of how a major public entity was run during his tenure, thus the public interest persisted and erasure was not justified. Finally, the court reiterated that consent was not required because Article 6 GDPR offers alternative lawful bases for processing. Since Article 6(1)(f) was satisfied, the absence of consent was irrelevant. Concluding that AZOP had properly applied the law and that the interference with the data subject’s privacy was proportionate, the court upheld the decision and denied the data subject’s claim and costs.
Court case 202304463/1/A3
A data subject, a resident of Amsterdam, had a conflict between 2016 and 2017 that led to him leaving his home. During that period, several reports about him were allegedly made to the municipal Care and Residential Nuisance Hotline. Believing that information about him had been collected and shared within the municipality, the data subject submitted a request to the Municipal Executive of Amsterdam, the controller, to access all personal data processed about him by the Hotline under Article 15(1) GDPR. The controller treated the request as one made under Article 15 GDPR, which grants data subjects the right to access their personal data and provided him an overview of how his data had been processed and a partly redacted copy of the file. Parts of the file were redacted to protect the privacy of third parties who had made or were involved in reports. The data subject filed an objection, arguing he was entitled to full access, including names and the unredacted content. He claimed a legitimate need to access his full file to gather evidence for potential civil and criminal proceedings and defend himself. The controller rejected that, maintaining that the redactions were necessary. The data subject then appealed to the District Court of Amsterdam, which ruled that while the controller correctly withheld the identities of third parties, its decision had not clearly indicated what personal data about the data subject had been received from other parties, nor had it explained adequately with which authorities his data had been shared. The court partially annulled the decision and ordered the controller to reconsider these points. Following the judgment, the controller issued a new decision, providing a revised overview that included the personal data about the appellant obtained from others, but still excluding any data that could identify third parties. The data subject lodged a further appeal to the Council of State, arguing that his interests had not been properly w
Court case Az. IX B 72/25
A data subject submitted an access request under Article 15 GDPR to the court administration of the Financial Court Berlin-Brandenburg (Finanzgericht Berlin-Brandenburg - FG). The data subject considered the response incomplete. Subsequently, they filed a complaint with the Brandenburg State Commissioner for Data Protection (Landesbeauftragter für den Datenschutz Brandenburg) under Article 77 GDPR but did not receive a reply within three months. The data subject then brought an action for inaction under Article 78(2) GDPR against the supervisory authority. They requested that the authority order the court administration to answer their access request immediately and completely. The Financial Court referred the dispute to the local Administrative Court (Verwaltungsgericht - VG), stating that the German Fiscal Code gives financial courts jurisdiction only for GDPR disputes concerning tax authorities and tax matters. The data subject challenged this referral, arguing that the court administration is a public body, its data processing occurs in a tax context, and the financial courts were therefore competent. The Bundesfinanzhof (BFH) rejected the complaint. It held that a request under Article 15 GDPR to a court administration does not involve processing by a tax authority and is not a tax matter. The granting or refusal of access by a court administration constitutes general administrative activity, not judicial activity. Therefore, the German Fiscal Code does not grant financial courts jurisdiction. The BFH confirmed that the correct legal route for an inaction complaint under Article 78(2) GDPR in this context is through the administrative courts. The referral by the Financial Court to the local Administrative Court was lawful. The data subject’s appeal against the referral was dismissed, and the costs were to be borne by the data subject.
Royal Dutch Aviation Association
On 14 May 2025 the data subject suffered an injury during a parachute jump in the context of a training programme with the Royal Dutch Aviation Association (the controller). The data subject submitted an access request under Article 15 GDPR, asking the controller to receive the incident report regarding his injury. The controller rejected this request on the grounds of confidentiality. The data subject then submitted a request to the civil court, requesting access to the incident report. He claimed that information about how the incident happened is his personal data, as it described his behaviour, and as such Article 15 applied. The controller, on the other hand, affirmed that information about the accident did not amount to personal data. It also stated the that incident report was covered by confidentiality, and it amounted to a lawful restriction of data subject rights and obligations under Article 23 GDPR. The controller further specified that if, after a thorough analysis of the report, it will deem it necessary to conduct deeper investigations on the event, then the report will be published. For the time being, it could only submit to the data subject an account of his direct personal data which is present on the cover page of the incident report, including his full name, surname, age, residence, height and weight. The court partially upheld the data subject’s request, but only as far as it concerns the direct personal data on the cover page on the incident report. It rejected the access request to the detailed information about the incident. First, it confirmed that incident data is personal data, and thus the right of access under Article 15 applied. As for the question on confidentiality, the court agreed with the argument of the controller regarding restrictions to rights and obligations under Article 23. The national GDPR implementation act (UAVG), in Article 41, specifies that access requests (among other rights) may be refused on the grounds of protecting public safety. Reference was also made to Regulation 376/2014 on aviation safety, requiring the strict application of the rules on confidentiality in the reporting of incidents. Information collected on incidents cannot be used for purposes other than improving aviation safety, and not to determine faults or liability. Based on this, the court agreed that confidentiality interests outweighed the data subject’s right to access. The court ordered the controller to provide access to the personal data of the data subject that is present on the cover page of the report. The remaining part of the data subject’s request was rejected.
Court case W291 2298748-1
A data subject wished to be addressed in a gender-neutral way and claimed they were misgendered by two companies (the controllers) in profile settings, tickets, and train announcements. They initially sent a tweet to one of the involved controllers asking whether gender-neutral options would be available and later filed a complaint with the Equal Treatment Commission and the Austrian Data Protection Authority (DSB), claiming a violation of their right under Article 16 GDPR. The DPA rejected the complaint, arguing that the data subject had not submitted a formal request for rectification to the controllers. The complainant then appealed to the Federal Administrative Court. The Court dismissed the appeal, holding that there was no violation of the GDPR because the data subject had not submitted a formal request for rectification. Article 16 GDPR requires a clear and specific request for correction, and vague or indirect statements, such as tweets or general demands for a change of the controller’s practice, do not satisfy this requirement. During the proceedings, it became clear that the data subject’s statements, primarily concerned the implementation of a future change of the controller’s practice to allow a gender-neutral option for all users, rather than a concrete request to correct their own personal data. In addition, some corrections had already been made to the data subject’s profile and invoices, while oral misgendering in trains and via loudspeaker announcements was found to fall outside the scope of the GDPR, as such statements were not stored in any personal data filing system. Finally, the Court noted that the minutes of the Equal Treatment Commission hearing could not be relied upon as full proof, as the hearing had been recorded only in audio form and not documented in accordance with the requirements of [https://www.ris.bka.gv.at/Dokumente/Erv/ERV_1991_51/ERV_1991_51.pdf Austrian administrative procedure law (AVG).] Statements made during the Equal Treatment Commission proceedings therefore did not constitute a formal exercise of the right to rectification under Article 16 GDPR.
Court case 19 U 1468/25 e
The data subject filed a lawsuit with the Munich Regional Court against the controller, a credit information agency. The data subject claimed to have suffered damages due to automated decision-making carried out by the controller, more specifically receiving rejections due to his credit score when renting an apartment and applying for car financing. The Court dismissed the case on the grounds that no violation of Article 22 GDPR was found, and did not award damages because a GDPR breach is a pre-requisite for awarding damages under Article 82. The data subject then filed for an appeal with the Munich Higher Regional Court, asking, among other things, for a declaration of illegality of credit scoring based on automated processing, compensation for immaterial damages, and specific information on score calculation under Article 15(1)(h). The court noticed the parties that it intends to dismiss the data subject’s appeal in full. The court could not produce a declaration of illegality of credit scoring based on automated processing. It reasoned that the mere creation of a score does not constitute a legal decision under Article 22. Also, the rejections faced by the data subject were not exclusively, if at all, based on the credit scoring, but on other factors. Thus, there is no demonstrable link between the scoring and the rejections. For Article 22 to apply, three cumulative conditions have to apply: a) the presence of a decision b) the decision must be solely based on automated processing including profiling c) the decision produces legal effects or similar impact on the data subject According to the court, the creation of a score cannot amount to a legal effect or similarly impactful effect concerning the data subject. Moreover, the data subject could not sufficiently prove that the data processing resulting in the credit assessment had a meaningful weight on the decisions of third parties. Thus, Article 22 GDPR cannot be applicable. The data subject, i
Ministry of Finance, the Minister
A data subject, a former employee of the Dutch Tax and Customs Administration, requested access to his personal data under Article 15 GDPR. In response, the Ministry of Finance (the controller) sent an overview of the processed data. Considering it incomplete, the data subject lodged an objection, further specifying their request. They requested email correspondence containing the user IDs of team members, the purposes for which the personal data was used, and its recipients. In its new decision dated 30 May 2024, the controller identified an email message containing the data subject's personal data. It partially complied by granting access to the personal data within it, but did not specify the purpose of processing and the recipients of the data. The data subject appealed the part of the decision concerning the email to the District Court. They argued that merely providing the processed personal data was insufficient and that the access right under Article 15(1) GDPR entitled them to receive information on the purpose of the processing and the recipients of this data. The controller justified its decision by arguing that the data subject asked more than what was required under Article 15(1) GDPR. It also supported its decision by referring to the restrictions under Article 23 GDPR in conjunction with national law (Article 41 UAVG). It further contended that the information requested might not be available or reproducible to begin with. The court annulled the contested decision and ordered the Ministry to adopt a new decision. The court first distinguished between the "right of access under Article 15 GDPR" and the "right of access to administrative documents". The former does not require the controller to disclose the underlying administrative documents, provided that the controller fulfils the purpose of Article 15 GDPR. The purpose of Article 15 GDPR is to enable the data subject to verify the lawfulness of the processing of their personal data. Information about the purposes of the processing and the recipients of the data is therefore directly relevant. The court held that the controller should have provided this information to the data subject unless it could successfully demonstrate that the restrictions under Article 23 GDPR, as implemented by national law (Article 41 UAVG), applied. Any restriction must be necessary and proportionate to the objective pursued. The court found that the controller did not explain why the restriction was necessary and proportionate. The contested decision therefore lacked due care and adequate reasoning. Lastly, owing to the duty to implement Article 15 GDPR, the controller could not simply state, without justification, that the information requested did not exist. The court annulled the decision; the Minister was ordered to reimburse the court fee of €194 and to adopt a new decision within six weeks, instead of providing a simple overview of the processed data.
X (formerly Twitter)
The controller is X Corp., the provider of the social media platform X, formerly known as Twitter. The data subject, an X user, made an access request to X under Article 15 GDPR, requesting access to personal data held about him, including information about automated decision-making (“ADM”) under Article 22 GDPR. His request was not satisfied. The data subject filed a case before the court of first instance (Amsterdam District Court - Rechtbank Amsterdam) demanding the satisfaction of his rights. On 5 July 2024, the court of first instance ordered X to respond to the data subject’s access request and provide details on ADM including specific information about some function of X like “reputation scores”, “labels“ and a particular system (“system y“). X then appealed the decision of the court of first instance before the Court of Appeal (Gerechtshof Amsterdam - AmsterdamCourt of Appeal). X sought the annulment of the contested decision, or in any case the exclusion from the data to be provided, data from which the operation of X's content moderation systems, spam filters and advertising settings could be deducted. X maintained that the court of first instance should not have ordered it to give (full) access to the data processing in the “system y“. According to X the system contains trade secrets and sensitive security information, which if fallen in the wrong hands could lead to abuses of the platform. X had therefore, for the time being, only provided a redacted version of “system y“ to the data subject, in which all confidential information had been deleted. X further requested the court of appeal to impose a disclosure prohibition (gag order - mededelingenverbod) to the data subject within the meaning of the Dutch Code of Civil Procedure (Rv) (Article 28(1)(b)) with regard to the unredacted version of “system y“ that had yet to be submitted. This request covered all information that has been omitted from the full version of the documentation “system y“
Court case W256 2278150-1
A psychiatric-neurological doctor (the controller) made a report in which a data subject was diagnosed with a borderline personality disorder. The data subject claimed that this diagnosis was incorrect, because the controller did not form an independent medical opinion but instead copied a previous assessment made by another psychiatrist, and formally asked the controller to amend the report. The controller rejected the request, affirming that they stood by their professional diagnosis. The data subject then filed a complaint with the Austrian Data Protection Authority (DSB), arguing that the controller violated their right to rectification under Article 16 GDPR. The DSB dismissed the complaint, reasoning that the diagnosis in a medical expert report represents a professional judgment, not a factual assertion. Under Article 5(1)(d) and 16 GDPR, only inaccurate facts can be corrected, not evaluative or interpretative assessments. The data subject appealed this outcome to the Federal Administrative Court (BVwG), arguing again that the diagnosis was medically incorrect and should therefore be rectified. The Federal Administrative Court (BVwG) upheld the DSB’s decision and dismissed the complaint as unfounded. The court explained that the right to rectification under Article 16 GDPR applies only to objectively incorrect factual information. The law does not permit the correction of subjective professional evaluations, which include diagnoses, assessments, or conclusions drawn by medical experts in the course of preparing a report. Such judgments are inherently interpretative and cannot be subjected to an “accuracy check” under the GDPR. Although the data subject believed the diagnosis to be incorrect, the court emphasized that medical diagnoses are value judgments, even if they rely on factual observations. These value judgments cannot be rectified simply because the person concerned or another doctor disagrees. The relevant question is not whether the diagnosis is m
Data Subject versus Stichting Regiecentrum Bescherming en Veiligheid (RBV - Foundation for the Center for Protection and Safety)
The controller is the Management Centre for Protection and Security, a center offering protection to children, young people and adults in Friesland (Stichting Regiecentrum Bescherming en Veiligheid-RBV). Between 2015 and 2018, several departments of RBV were involved in the data subject's life and therefore created and maintained a file containing his personal data. On 10 June 2024, the data subject, invoking Article 17 GDPR, requested the destruction of the file. RBV agreed, confirming in writing on 26 November 2024 that the file would be destroyed within six weeks. Before the scheduled deletion, on 6 December 2024, the data subject filed a case before the court of first instance (District Court of North Netherlands) seeking immediate destruction of the file. RBV subsequently destroyed the file on 7 January 2025. The court of first instance dismissed the data subject's claim on 5 February 2025 because the RBV had already agreed to and completed the data erasure. The data subject, appealed the decision of the court of first instance before the court of appeal (Court of Appeal Arnhem-Leeuwarden), requesting the court to order RBV to notify other "processors" of his file about its destruction, based on Article 17(2) GDPR. First, the Court held that Article 17(2) GDPR applies only when data have been made public, for instance, published online or in publicly accessible register in a way where others may view or reuse them. Ordinary exchanges of information with authorities or institutions do not amount to “making public,” and thus RBV had no duty to notify other controllers of the deletion of the data under this provision. Second, the Court pointed that Article 19 GDPR requires controllers to communicate the erasure of personal data to each recipient to whom the personal data have been disclosed, and not just processors, without further or specifically directed request from the data subject, unless doing so is impossible or disproportionate. In this case, the
Child Protection Board
The data subject requested the deletion of all his proceedings-related data stored by the child protection council. The council granted the request as to criminal investigations, but not to child protection investigations. The data subject filed a lawsuit with the Court, affirming the controller did not provide sufficient grounds for not deleting child protection investigation data. Moreover, this was accompanied by a claim for damages for deleting criminal investigation data with too big of a delay. The Court partially upheld the complaint. It agreed with the controller that child protection related data fell within the exception of Article 17(3)(b) GDPR, as it amounted to processing carried out in the public interest or in the exercise of official authority under Article 6(1)(e) GDPR. Provisions of national law sufficiently demonstrate the controller’s necessity to process personal data for the performance of its tasks in the public interest. Moreover, the controller adequately demonstrated that they were timely in the deletion of the criminal files, within a month from the request by the data subject. As such, no administrative fine was imposed by the Court. Still, the removal took place more than one year after proceedings, allowing for other government entities to consult the documents, thus causing distress in the data subject. Essentially, the controller was not proactive in the deletion of data about the criminal proceedings. Due to this, the data subject was entitled to symbolic compensation of €125.
Court case 29 K 6375/25
On 16 May 2025, the data subject made an access request to the controller by letter. On 20 May 2025, the controller informed him that his letter had been received and that his request was being examined, but clarification could take time. On 23 June 2025, the data subject brought a case before the court of first instance (Administrative Court Düsseldorf -VG Düsseldorf), claiming that the controller failed to satisfy his request. The court pointed out that the one month deadline in Article 12(3) GDPR only refers to the provision of the status report on the measures taken pursuant to the request. According to the court, it does not set a deadline for the fulfillment of the rights or claims of the data subject enshrined in Articles 15-22 GDPR. In this case the controller provided the data subject with a status report in due time. Therefore, it complied with its obligation to inform the data subject of the measures taken to satisfy his request for information within the one-month period pursuant to Article 12(3) GDPR. The court found the action inadmissible.
CJEU case Case C 312/24 Darashev
The data subject is a police officer, holding various positions at the Internal Security directorate-general of the Bulgarian Ministry of the Interior (controller). In March 2016, investigative proceedings were commenced concerning an unknown offender in connection with an offence of theft. A few days later, the data subject was arrested and after being detained in police custody for 24 hours, he was released. Subsequently, he was neither placed under formal investigation nor charged, but he was the subject of several investigative measures, which in the course of 2016, were suspended without the offender having been identified. The controller stored the data about the criminal investigation on his personnel file, as provided by the ministerial instruction relating to personnel files, issued as a regulatory act pursuant to the statutory authorisation provided for in the Law on the Ministry of the Interior (ZMVR). The data subject continued his duties as a police officer and took part in selection procedures for promotion to other posts within the Ministry but he was rejected. The data subject brought an action before the Sofia District Court (Sofiyski rayonen sad) seeking compensation for non-material damage for the fact that he has not been promoted or transferred to other duties on account of his having been a suspect in the investigation. In addition, he asked that his name be erased from the database kept by the controller, in which he is mentioned as a suspect. In this context the court decided to stay the proceedings and to refer some questions to the CJEU for a preliminary ruling, regarding the interplay of the GDPR with the Law Enforcement Directive (LED), and more specifically regarding the storage of data concerning the official in his personnel file. The questions were combined and reformulated by the AG as follows: # whether Article 2(1) GDPR and Article 9(1) LED are to be interpreted as meaning that the GDPR applies to the storing, by a public autho
CJEU case C-655/23 Quirin Privatbank
The data subject ("IP") was a candidate in a staff selection process for the bank Quirin (‘the controller’), which took place via an online portal. An employee of the controller, using the online portal's messaging service, erroneously sent a third party a job offer only intended for the data subject disclosing details about the data subject's salary exceptions and the salary offered to them. The data subject brought an action before the Regional Court seeking an order that the controller refrain in future from processing, either by itself or through third parties, his personal data relating to the selection process, ‘if that processing occurs as it did in the message sent via the online portal’. The data subject also claimed non-material damages. The Landgericht (Regional Court) partially upheld the application, however the data subject pursued all his claims in full through two instances. Against that background, the Federal Court of Justice (Bundesgerichtshof - BGH) referred six questions to the CJEU for a preliminary ruling: # May the data subject require the controller to cease and desist further unlawful onward transfer of personal data under Articles 17 or 18, or any other provision GDPR, if the data subject does not request the controller to erase the data, where unlawful processing of personal data has already taken place? # If the answers to Questions 1 is in the affirmative, does the right to obtain a prohibitory injunction under EU law exist only if a risk of recurrence exists? # If the answers to Questions 1 is in the negative: Must Article 84 GDPR, in conjunction with Article 79 thereof, be interpreted as permitting the national court to confer on the data subject a right to obtain a prohibitory injunction against the controller prohibiting further unlawful onward transfer of those data in accordance with the provisions of national law? # Do simple negative feelings (such as discontent, annoyance, anxiety and fear) fall within the meaning of moral damage in accordance with Article 82(1) GDPR? # Must Article 82(1) GDPR be interpreted as meaning that the degree of seriousness of the fault of the controller is a relevant factor in assessing compensation for non-material damages? # If the answers to Questions 1 or 3 are in the affirmative: Must Article 82(1) GDPR be interpreted as meaning that, in assessing the amount of non-material damage to be compensated, the fact that the data subject concerned has a right to obtain a prohibitory injunction in addition to the right to compensation can be taken into account as reducing the claim?’ The CJEU directed the AG to consider only four of the six questions: # May the data subject require the controller to cease and desist further unlawful onward transfer of personal data under Articles 17 or 18, or any other provision GDPR, if the data subject does not request the controller to erase the data, where unlawful processing of personal data has already taken place? # If the answers to Questions 1 is in the affirmative, does the right to obtain a prohibitory injunction under EU law exist only if a risk of recurrence exists? # If the answers to Questions 1 is in the negative: Must Article 84 GDPR, in conjunction with Article 79 thereof, be interpreted as permitting the national court to confer on the data subject a right to obtain a prohibitory injunction against the controller prohibiting further unlawful onward transfer of those data in accordance with the provisions of national law? # If the answers to Questions 1 or 3 are in the affirmative: Must Article 82(1) GDPR be interpreted as meaning that, in assessing the amount of non-material damage to be compensated, the fact that the data subject concerned has a right to obtain a prohibitory injunction in addition to the right to compensation can be taken into account as reducing the claim?’ = The AG pointed out that the lack of explicit recognition of injunctive relief in the GDPR seems to be the origin of the referring court's uncertainty. However, the AG stated, that to interpret a provision of EU law, account must be taken not only of its wording. == The AG took the view that the data subject’s claim for injunctive relief can be inferred from Articles 5(1)(a) and 6(1) GDPR, read together with Article 79(1) GDPR. In the AG's view, the data subject’s right to injunctive relief is a corollary of the data subject’s right that any processing of personal data must be lawful. Otherwise, the AG opined, the legal protection provided for personal data would be incomplete. Thus the AG concluded, that a data subject has the right to demand that a data controller refrain from further unlawful processing in accordance with the GDPR and the option to apply to a court for an order imposing that obligation to desist on the controller. == The AG argued, that in line with his findings above Articles 5 and 6, together with Article 79 GDPR, make it unnecessary to consider the effects of [https://gdprhub.eu/Article%2017%20GDPR Articles 17] and 18 GDPR as a basis for injunctive actions. However, for completeness's sake the AG opined that neither Articles 17 nor 18 GDPR is, by itself, sufficient to act as the basis for the data subject’s right to require the controller to refrain from further unlawful processing (similar to that already carried out). The AG discussed in this context the interpretation of specifically Article 18(1)(b) GDPR, finding that it cannot be inferred from it that the data subject has a right to injunctive relief, because the aim of that provision is to prevent, temporarily and for a legitimate purpose of the data subject, the controller from carrying out the legal obligation which results from unlawful processing, by erasing the personal data concerned without delay. = As in the AG's view the GDPR provides a sufficient basis to justify the data subject’s right to injunctive relief, he did not consider whether that same solution may be reached by relying national law. = The AG opined, that it is for each Member State to draw up rules governing actions for an order to desist which are aimed at preventing the recurrence of unlawful processing, pursuant to the principle of procedural autonomy within the principles of equivalence end effectiveness. The AG considered, that the German procedural rules to prevent the recurrence of unlawful processing of personal data do not seem to infringe those two principles because they are the same as the rules laid down for similar situations by national law. Additionally and those rules do not appear to impose an excessive burden on individuals bringing such an action. = The AG opined, that the concept of ‘non-material damage’, within the meaning of Article 82(1) GDPR, must be given an autonomous and uniform definition which does not seem to fit to the German interpretation of non-material damage. The AG stated, that according to the CJEU's interpretation, Article 82(1) GDPR has an exclusively compensatory aim while the German concept of non-material damages also pursues preventative aims. The AG found, that the aim of the compensation under Article 82 GDPR is not the same as the aim of actions for an order to desist, because the latter does not redress damage already suffered. Thus, the AG concluded, that in assessing the amount of non-material damage resulting from unlawful processing that is to be compensated because it has already occurred, the fact that the data subject is also entitled to seek an order to desist, in future, from any further unlawful processing similar to that already carried out, is not a mitigating circumstance. The CJEU answered the first three questions together, and the rest separately. = Similar to the AG, the Court first stated that the context and objectives of a provision of EU law must be taken into consideration in its interpretation. The Court also reiterated that data subjects benefit from a right to lawful processing of their personal data, which is the corollary of the general obligation of controllers to not process data in a way that is inconsistent with the GDPR. However, the Court did not follow the opinion of the AG, and held that the GDPR does not confer a data subject with the right to bring an action for an order that the controller desists from unlawful data processing in the future. This is because the GDPR does not have specific provisions for this, and this right cannot be inferred from Article 17 or 18 GDPR. The wording of the right to an effective judicial remedy under Article 79(1) GDPR does not require Member States to provide a specific remedy such as a restraining order as a preventative measure. Nonetheless, the Court stated that the GDPR also does not prevent Member States from providing a preventative remedy like the one requested by the data subject. The GDPR aims to ensure harmonisation of national legislation regarding data protection, however, it expressly gives Member States a margin of discretion in implementing its provisions through its opening clauses. This was the case even if the provisions of Chapter VIIII GDPR do not include opening clauses; according to the Court, the EU legislator did not intend to include an exhaustive harmonisation of remedies available. = The Court first stated that under Article 82(1) GDPR the data subject has the right to obtain compensation for damage suffered from the controller or processor. The concept of non-material damages also must be given an autonomous and uniform definition specific to EU law. With this, the data subject is required to demonstrate a violation of the GDPR, as well as damage from said violation. The Court held that negative feelings, such as fear or annoyance, caused by a loss of control over personal data falls under the scope of non-material damages under the GDPR. Loss of control as non-material damages is specified in Recital 85 GDPR. However, the data subject must demonstrate these negative feelings. = The Court stated that Article 82(1) GDPR does not define the rules in assessing damages, and therefore, national courts must apply national law as long as the principles of equivalence and effectiveness of EU law are respected. Under German law, the degree of seriousness of the fault of the person responsible for the damages is a criterion used when assessing damages. The Court stated that compensation under Article 82 GDPR has an exclusively compensatory function, and not a dissuasive or punitive one. This means the degree of seriousness and possible intentional nature of the controller’s actions cannot be taken into consideration. = Here, the Court reiterated that the GDPR does not define the rules for assessing damages under Article 82 GDPR. However, national law must comply with the principles of equivalence and effectiveness of EU law, and therefore must ensure the data subject receives full and effective compensation. The Court followed the reasoning of the AG in stating that non-material damages cannot be reduced when the data subject can obtain injunctive relief; compensation under Article 82 GDPR has an exclusively compensatory nature, and is therefore a separate measure to an injunction aiming to prevent the occurrence of new damage.
Court case 2025/AR/253
The Disputes Chamber of the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit – GBA) adopted a decision concerning Mediahuis NV in connection with an asset deal for the sale of Jobat’s activities. Jobat was a job platform operated within the Mediahuis group, with Mediahuis acting as its controller. In the course of the asset sale, Mediahuis transferred Jobat’s user database, containing personal data of jobseekers and employers, to the buyer, Hors BV. A data subject complained that this transfer was unlawful under the GDPR, as Mediahuis had not identified a valid legal basis or properly informed the affected users. The GBA found that Mediahuis had failed to conduct a proper and documented assessment of the legitimate interest it relied upon under Article 6(1)(f) GDPR. The GBA also found that Mediahuis had not properly informed data subjects as required by Article 5(1)(a), Article 12, and Article 13 GDPR. Mediahuis appealed the decision before the Market Court (Court of Appeal of Brussels). It argued that the GBA had breached the principle of legal certainty , misinterpreted the definition of “processing” under Article 4(2) GDPR, and violated Mediahuis’s rights of defence. Mediahuis also claimed that the GBA had not been consistent with its own dismissal policy and that the complaint constituted an abuse of rights. The Court dismissed the preliminary arguments of Mediahuis. It held that the data subject had not abused their rights and that the GBA retained discretionary power to decide whether or not to dismiss a complaint under Belgium law and Article 57(1)(f) GDPR. The Court clarified that controllers have no “right to dismissal” and that the GBA did not need to justify a decision not to dismiss a complaint. However, the Court found several substantive flaws in the GBA’s decision. It ruled that the Disputes Chamber had given contradictory reasoning by treating the data transfer as both a separate “processing” under Article 4(2) GDPR and a mere step
Court case W256 2235360-1
The Public Employment Service (the controller) is a body responsible for implementing the federal government’s labour market policy. The controller developed a model for calculating jobseekers’ labour market opportunities (“AMAS”), as a tool for advisors to use in assessing jobseekers’ labour opportunities. This model uses data subjects’ personal characteristics (e.g. age, gender, education, previous career) to predict their future chances of integrating into the labour market. The controller planned on making its use mandatory from 2021 onwards. However, it also implemented measures to ensure that AMAS was used as a secondary opinion only; for example, advisors were trained to use AMAS and assess labour market opportunities independently. Advisors were also obliged to explain data subjects the conclusions reached by AMAS, and discuss any possible concerns. The DPA initiated an ex officio investigation, and prohibited the controller from processing personal data using AMAS because the controller did not have a suitable legal basis. Furthermore, the processing was profiling within the meaning of Article 4(4) GDPR, and the prohibition of automated decision-making under Article 22 GDPR applied in any case. The controller appealed the decision to the Federal Administrative Court (BVwG), who annulled the decision of the DPA. According to the BVwG, the controller is allowed to carry out this processing of personal data in accordance with national law. The DPA appealed the case to the Supreme Administrative Court (VwGH)You can read the GDPRhub summary here: VwGH - Ro 2021/04/0010-11. The VwGH stated that there was a possibility that AMAS constituted automated decision-making within the meaning of Article 22(1) GDPR. This was the task of the BVwG to investigate; according to the VwGH, the processing would be prohibited if there was automated decision-making unless the exceptions under Article 22(2) GDPR were met. The Court first stated that AMAS engaged in profiling in