GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
Court case Ro 2023/04/0045
The operator of a loyalty program (the controller) provided customers (the data subjects) with the option to collect points in order to receive discounts. During registration, data subjects were asked to consent to their data being used for profiling. Having consent under Article 6(1)(a) GDPR as the legal basis, the controller performed automated analyses of purchasing behavior to personalize advertising. The Austrian DPA (DSB) initiated an ex-officio investigation, conducted an on-site inspection and found that the consent for profiling did not meet GDPR standards under Articles 4(11) and 7 GDPR. The information about profiling was not clearly visible or easy to understand, and the consent was bundled with registration and acceptance of terms instead of being given separately. The DSB declared the processing regarding profiling unlawful since there was no valid consent or other legal basis. The controller was ordered to stop processing data for profiling purposes until it had a valid legal basis and was granted a six-month period for compliance. The controller appealed to the Federal Administrative Court (BVwG), which upheld the appeal and overturned the DSB’s decision. The DSB then appealed to the Supreme Administrative Court (VwGH), which partially overturned the BVwG’s ruling, siding in part with the DSB. The case returned to the BVwG, which rejected the controller’s appeal but modified parts of the DSB’s decision. The controller subsequently appealed against this BVwG decision to the VwGH. The VwGH rejected the controller’s appeal and upheld the BVwG’s decision regarding the prohibition on profiling, confirming that the prohibition was not disproportionate. It only applied to unlawful profiling and did not affect any future processing based on valid consent. The court held that consent was invalid under Article 4 and Article 7 GDPR, because there was bundled with registration and acceptance of terms and the privacy policy, the visual design did not make the
LIdl
The controller is Lidl, the discount food retailer. Lidl offers consumers a loyalty program, "Lidl Plus". Via Lidl Plus, registered users receive personalised product information and offers, also from third-party providers. Customers can register via the Lidl app and create a "Lidl Plus account". The terms and conditions for registering, which customers have to accept, stated that "Participation in Lidl Plus is free of charge." It also stated that the app collects users’ data in order to send them personalised offers and promotions and described in more detail which data is processed. Lidl also processed the data to optimise the Lidl Plus program. In January 2025, the Federal Consumer Association (Verbraucherzentrale Bundesverbands) (plaintiff) filed a case against Lidl before the court of first instance (Stuttgart Higher Regional Court-OLG Stuttgart) on the grounds that it breached its obligation to indicate the total price of the service which applies to distance selling contracts, in accordance with the provisions of the national Civil Code (Articles 312 et seq. BGB) in conjunction with the national Introductory Act on Civil Codes (Article 246a Section 1(1)(5) EGBGB). The plaintiff claimed that according to Article 312d(1) BGB(1) In the case of contracts concluded outside of business premises and in the case of distance contracts, the entrepreneur is obliged to inform the consumer in accordance with Article 246a of the Introductory Act to the Civil Code. The information provided by the entrepreneur in fulfilment of this obligation shall become the content of the contract, unless the contracting parties have expressly agreed otherwise. in conjunction with Article 246a Section 1(1)(5) EGBGBPursuant to § 312d (1) of the Civil Code, the entrepreneur is obliged to provide the consumer with the following information: 5. the total price of the goods or services, including all taxes and duties, or in cases where the price cannot reasonably be calculated in advance due to the nature of the goods or services, the type of price calculation;, Lidl was obliged to provide information about the total price of the service. Lidl infringed these provisions by stating in the conditions of participation that participation was free of charge and by not stating that consumers must provide a fee in the form of personal data. The provision of personal data was the price for using the app. According to the plaintiff, a price does not necessarily have to be paid in a monetary amount. The plaintiff requested that Lidl was ordered to refrain from offering the conclusion of a contract in connection with the app "Lidl Plus" under these terms and to be obliged to inform consumers of the total price. Lidl on the other hand, claimed that it is was not obliged to inform customers in this case because the exception of Article 312(1a) BGB applied, according to which the above mentioned obligation does not apply if the trader processes the personal data provided by the consumer exclusively in order to meet his obligation to perform or to comply with his legal requirements. In this case the purpose was the provision of personalised information. In any case, according to Lidl, even if Article 246a Section 1(1)(5) EGBGB was relevant, information on the total price would not be required, as this obligation only covers situations where there is a payment in money, but not the provision of personal data. The court assessed the plaintiffs allegations regarding LIdl's conduct from a consumer and competition law perspective. In particular it assessed the claims that Lidl did not provide the legally required information about the total price and that it incorrectly stated that participation was free of charge for the consumer. The court found no violations and decided to dismiss the case. Consumer protection law First the court asserted that Article 312d(1) BGB in conjunction with Article 246a Section 1(1)(5) EGBGB on distance selling contracts constituted consumer protection provisions within the meaning of the national Law on injunctions for consumer rights and other violations (Section 2(1) sentence 1 UKIaG). Second, the court held that what is to be understood by the "price" for the provider of services according to Article 246a Section 1(1)(5) EGBGB must be determined in accordance with the requirements of European consumer protection laws. Article 312d(1) BGB in conjunction with Article 246a Section 1(1)(5) EGBGB, constitute national implementations of Article 6(1)(e) of the Consumer Rights Directive (Directive 2011/83/EU) and Article 2(7) of the Directive on certain aspects of contracts for the supply of digital content and digital services (Directive 2019/770/EU). The concept of "price" in both Directives is only to be understood as the remuneration in money or a digital representation of a value. The court held that, the provision of personal data by the consumer is not covered by this definition. The court further pointed out that, in contrast, the protection of the consumer, who should be clearly and unambiguously be made aware of the implications of their consent to the provision of their personal data, is guaranteed by the requirements for informing the data subject in accordance with Article 13 and Article 14 GDPR. There are no indications that the legislator intended to extend the existing data protection information obligations with the provision in Article 6(1)(e) of the Consumer Rights Directive on the indication of the total price. Therefore, since the consumer did not have to pay a price or other costs, the fact that Lidl described its services as free of charge was not objectionable according to Article 246a Section 1(1)(5) EGBGB. The court found that the plaintiff was not entitled to the asserted a claim for injunctive relief pursuant to Section 2(1) UKIaG because Lidl did not violate any of the consumer protection laws relevant to the decision here. Competition law The court held that a claim for injunctive relief did not arise from the violation of a prohibition under competition law either, since Lidl did not incorrectly state that participation was free of charge for the consumer, pursuant to the national Act against Unfair Competition (Section 3(1) UWG in conjunction with Sections 5, 5a UWG). The court mentioned that the Guidance on the interpretation and application of Directive 2005/29/EC of the European Parliament and of the Council concerning unfair business-to-consumer commercial practices in the internal market states that it can be considered a misleading practice if products are presented as "free" in the online sector, but personal data is collected from users without adequately explaining to the consumer how this data and user-generated content is used.Products presented as ‘free’ are especially common in the online sector. However, many such services collect personal data of users such as their identity and email address. Importantly, the UCPD covers all commercial practices concerning ‘free’ products and does not require payment with money as a condition for its application. Data-driven practices involve an interplay between EU data protection legislation and the UCPD. There is an increasing awareness of the economic value of information related to consumers’ preferences, personal data and other user-generated content. The marketing of such products as ‘free’ without adequately explaining to consumers how their preferences, personal data and user- generated content are going to be used could be considered a misleading practice in addition to possible breaches of data protection legislation. (page 68) However, in this case Lidl explained the collection and use of personal data in the terms of use in an appropriate manner. Since no costs within the meaning of Article 246a Section 1(1)(5) EGBGB incurred for the consumers, the participation was free of charge. By describing it this way Lidl did not conceal the fact that the consumer must provide personal data and did not in any way deceived consumers. According to the court, anyone reading the terms and conditions would also be informed in detail about which data is collected and processed. Data protection law The plaintiff did not claim that information obligations under the GDPR had been violated and this was not apparent from its statement of claim, which is why the court decided not to examine these provisions.
Court case W258 2242162-1
The resident of a flat (a data subject) filed a complaint with the Austrian DPA (DSB) alleging that her neighbor (the controller) had unlawfully recorded her and her children in her private garage and disclosed the images to a third party. The data subject and the controller were neighbors living in a shared residential complex with individual garage boxes in a common underground garage. The controller claimed that he had only a wildlife camera in his own car, or that he received the photos anonymously on a DVD, but these explanations were later found contradictory and not credible by the DPA. The DSB found that the controller had infringed the data subject in the right to secrecy. He unlawfully took pictures of the data subject using at least one camera installed in the garage box and he transmitted unlawfully these images to a third party. DSB argued that the GDPR is applicable because the data processing had intervened in the sphere of third parties. The processing of data was not exclusively for personal or family activities and thus did not take effect the household exception of Article 2(2)(c) GDPR. The controller appealed to the Federal Administrative Court (BVwG). The Court dismissed the appeal and upheld the DSB’s decision. The court held that the video recording of natural persons, provided that it enables the identification of the data subject, constitutes processing of personal data, that falls within the scope of the GDPR, see CJEU case law. However, in accordance with Article 2(2)(c) GDPR, the regulation does not apply to the processing of personal data by natural persons for the exercise of only personal or family activities, see CJEU case law. Insofar as video surveillance extends only partially to the public space and is therefore directed to an area outside the private sphere of the person who processes the data in this way, the court found that it cannot be regarded as an exclusively “personal or family” activity, under CJEU case law. The cont
Data Subject versus B. GmbH (a private security company responsible for security operations at a shopping centre in Bavaria)
The controller is a private security company providing security services at a shopping centre in Bavaria. In January 2021, a security guard working for the controller asked multiple times the data subject to leave the seating area owned by the controller. The situation became tense, to the point that the police was called. In 26 July 2021, the data subject lodged a complaint with the Data Protection Authority (Bavarian Data Protection Authority - LfD Bayern) against the controller, alleging that the security guard started recording him without his consent with his body-worn camera. According to the data subject this constituted unlawful processing of personal data under the GDPR. The controller explained that the guard activated the camera only after the data subject repeatedly refused to leave a restricted seating area, that the recording was communicated to the data subject, that a red indicator light signaled recording, and that the footage was deleted once its purpose of identifying the individual for possible civil action had been fulfilled. The DPA held that it was no longer possible to clarify whether the data subject had been aggressive or whether the bodycam had only been activated after the announcement. The DPA therefore assumed that the security guard had acted in accordance with its operational policy. It decided to rejected the complaint, finding that the recording was justified under Article 6(1)(f) GDPR as necessary for the controller’s legitimate interests of protecting property and ensuring safety. The data subject then appealed the decision of the DPA before the court of first instance (Administrative Court of Ansbach - VG Ansbach). The court upheld the DPA’s decision, holding that the DPA had sufficiently investigated the matter and properly exercised its discretion under Articles 57 and 58 GDPR. It found no violation of the GDPR, noting that the processing was proportionate and limited to a specific incident. The data subject appealed again the decision of the court of first instance before the court of appeal (Administrative Court of Munich - VGH München) arguing that he was not informed about the recording, that the DPA’s investigation had been inadequate and that corrective action should have been ordered despite uncertainty over the lawfulness of the recording. The Court dismissed the appeal, finding no basis to reopen the case or question the DPA’s assessment. The Court held that the use of a body-worn camera by the controller's private security guard was lawful under Article 6(1)(f) GDPR, as it served legitimate interests in protecting property, maintaining order, and ensuring staff safety. The recording was held to be proportionate, limited to a specific instance of confrontation, and was accompanied by visible notice through an activated red light. The Court further held that the DPA had lawfully exercised its discretion under Articles 57 and 58 GDPR, having adequately investigated the complaint and finding that no infringement occurred. The DPA was not required to impose corrective measures where a violation could not be established. Accordingly, the appeal was dismissed, and no procedural or investigative failings were found.
Actor (data subject)
The data subject is a widely known actor and professional voice actor. The controller operated a YouTube channel with an associated online shop. The controller published two political satire videos on YouTube. The videos used an AI-generated voice that closely imitated the data subject’s voice. Viewers in the comments identified the voice as that of the data subject. The videos ended with references to the controller’s online shop, which sold merchandise linked to the channel’s political positioning. On 28 September 2023, the data subject contacted the controller and objected to the use of his voice. He requested cessation of use and reimbursement of legal costs. The controller submitted a cease-and-desist declaration but refused to pay damages, arguing that the voice was synthetic, lawfully acquired from an AI provider, and used for satire rather than advertising. The data subject claimed that the AI-generated voice constituted use of his personal voice, that the processing occurred without consent, and that it created the impression that he endorsed the videos and products. He sought compensation equivalent to his usual licensing fees and reimbursement of legal costs. First, the court held that the controller unlawfully interfered with the data subject’s right to his own voice. Although the voice was AI-generated, it closely imitated a distinctive personal characteristic attributable to the data subject. The court considered that a significant part of the audience would associate the voice with the data subject, which was sufficient to establish personal attribution. Second, the court addressed the issue under data protection law and noted that the use of an AI-generated voice imitating a real person can qualify as processing of personal data. The court examined Article 6(1) GDPR and found no valid legal basis. The data subject had not given consent under Article 6(1)(a) GDPR. Contractual necessity under Article 6(1)(b) GDPR was irrelevant. The controller relied on Article 6(1)(f) GDPR, arguing legitimate interests linked to satire and freedom of expression. The court rejected this argument after balancing interests. It found that the processing primarily served the controller’s commercial interests, as the videos increased reach and indirectly promoted the online shop. The court stressed that the controller could express political opinions and satire without using an identifiable imitation of the data subject’s voice. The data subject’s rights therefore outweighed the controller’s interests. Third, the court held that no exemption applied under Article 85 GDPR. The processing was neither journalistic nor genuinely artistic in a way that would justify overriding the data subject’s rights, particularly given the commercial context and the lack of transparency about the AI-generated nature of the voice. As a consequence, the court ordered the controller to pay €4,000 as a fictitious license fee for the unauthorised use of the voice and €1,155.80 for reimbursable legal costs, plus interest.
Meta Platforms Inc
The plaintiff is a consumer organisation registered as a qualified entity from another Member State of the European Union within the meaning [https://eur-lex.europa.eu/eli/dir/2020/1828/oj/eng Directive 2020/1828]. The respondent, and controller, is the subsidiary of Meta Platforms Inc., Meta Platforms Ireland Ltd. On 14 April 2025, Meta announced, via press release and via in-app notifications and emails, that from 27 May 2025 it would start using the public content of adult users and their interactions to train its AI models in its products. On 27 June 2025, the plaintiff filed a preliminary injunction application before the higher regional court (Higher Regional Court Schleswig-Holstein - OLG Schleswig). It requested that Meta stops, for the purpose of the development and improvement of AI technologies and regarding consumers in Germany, the processing of: 1. personal data published by users on their Facebook and Instagram accounts and personal data collected about them by third parties and transmitted to Meta on the basis of legitimate interest, 2. special categories of personal data published by them on the Facebook and Instagram services without their explicit consent, and 3. content created and shared by users on the Facebook and Instagram services for use outside of these services without providing for this in the General Terms and Conditions for the respective platform usage agreements. 4. in the alternative, to prohibit Meta from combining personal data from Facebook with personal data from Instagram and/or to further use personal data from Facebook and/or Instagram in other services provided by Meta without giving end users the specific choice and obtaining their effective consent. The plaintiff argued that the contested data processing violated Article 6 and Article 9 GDPR, as well as the prohibition of merging and the prohibition of further use under Article 5 DMA. It further claimed that no effective objection was made possible for the data subjects, especially if they were not registered users of Meta’s platforms. It also argued that data from advertising partners would also be used for the development of the AI applications. On the other hand, Meta claimed that compliance with the provisions of Article 6 and Article 9 GDPR was ensured by the de-identification and tokenisation of the individual learning data sets. Obtaining the consent of users to the processing of their data for the development and improvement of AI models was disproportionate. It further claimed that the likelihood that its AI model will extract personal data from private individuals is extremely low, due to the various protective measures taken. Lastly, Meta stated that "AI at Meta" is not a separate service, but an integrated function of all its platforms. The court rejected the interim injunction application as inadmissible. The court held that the element of urgency required for the issuance of an interim relief, under the Federal Act Against Unfair Competition (§12UWG), the Act on injunctions in consumer law and other infringements (§5 UKlaG) and ECJ case law ([https://curia.europa.eu/juris/liste.jsf?language=en&num=C-465/93 Case C-465/93]), was absent. The further questions of admissibility, in particular with regard to the active legitimation of the plaintiff for the injunction, and the question of the merits of the application are therefore irrelevant. First, it held that it remains undisputed that the plaintiff in the injunction was already aware of the conduct complained of due to Meta’s announcements some time before it began. In particular, the processing of personal data based on legitimate interest instead of consent, the processing of special categories of personal data, the use of the content published on Facebook and Instagram to develop and improve AI technologies outside these services (like Meta’s AI application ‘Llama’), the processing of personal data of data subjects appeared in institutional profiles and that the processing would affect more people, where all known from the emails sent by Meta. Insofar as the plaintiff claimed that Meta actually uses personal data of its users for AI training, which it receives from advertising partners, it has not made this disputed allegation credible. Second, the court held that the plaintiff waited for a month to file the application for a preliminary injunction after becoming aware of Meta’s alleged imminent infringement, so there was no longer any urgency with regard to the requested legal protection. The plaintiff also failed to demonstrate a valid reason as to why it waited until Meta had actually began the objectionable conduct to file the application. Nevertheless, the court pointed out that de-identification and tokenisation can be completely or partially reversed. Against this background, the processing of special categories of personal data covered by Article 9 GDPR cannot be processed under the legal basis of legitimate interest. It should also be borne in mind that it is not possible for data subjects to find out whether their data are being unlawfully processed in the AI’s learning data set and AI model itself.
Association Mousse
Association Mousse (referred to as “Mousse”) filed a complaint with the DPA against SNCF Connect (a platform allowing people to purchase rail travel documents, the controller). The controller required data subjects to choose between “Mr” or “Ms” when purchasing tickets on its website. Mousse argued that this was unlawful under Article 5(1)(a) GDPR, as the controller did not have a legal basis to process this data. In addition, requiring this information violated the principle of data minimisation (Article 5(1)(c) GDPR), as well as the controller’s transparency obligations (Article 13 GDPR). The DPA dismissed the complaint, stating that the controller had not violated the GDPR. Furthermore, the controller had a valid legal basis to process data subject’s genders under necessity for the performance of a contract (Article 6(1)(b) GDPR). Finally, processing this data complied with the principle of data minimisation, as addressing data subjects in a personalised manner was an accepted practice in commercial, civil and administrative communications. Mousse appealed the decision to the Court, arguing that an accepted practice does not mean it is necessary for the performance of a contract. Furthermore, the obligation to disclose one’s gender is a violation of the right to respect for private life, and risked potential discrimination against the data subject. The Court decided to stay its proceedings and refer a preliminary question to the CJEU. In its decision (C-394/23 Mousse), the CJEU found that the generalised processing of passengers’ genders was not necessary for the performance of a contract or for the legitimate interest of personalised commercial communication. Following the CJEU decision, Mousse requested the Court to issue guidelines regarding the issue, and argued that the CJEU decision implied the DPA decision should be overturned. The controller requested the Court to clarify whether it could still process the data for specific services, or offer a choice other than “Mr” and “Ms”. The Court first stated that the processing of data subjects’ genders was not necessary for the performance of a contract, in accordance with the reasoning by the CJEU. The Court also noted that while national laws such as the Transport Code require passengers to present a document verifying their identity, it is unclear that an absence of a gender would make it more difficult to identify the passenger. Finally, offering specific services such as compartments reserved for women did not justify processing data related to a person’s gender. The Court also stated that the controller did not need to process the data subjects’ genders to send them personalised commercial communication, as the communications could have been carried out without this data. Therefore, the controller could not rely on legitimate interest (Article 6(1)(f) GDPR), as it did not meet the necessity requirement. The Court saw no need to assess whether the data subject had the right to object to the processing of their gender. The Court overturned the decision of the DPA, and ordered the State to pay €3,000 to Mousse.
Court case W258 2299744-1
A company (the controller) was operating a video surveillance system, consisting of a total of nine external and indoor cameras. After an anonymous complaint, the DSB opened administrative criminal proceedings and found that the controller had unlawfully processed personal data in the period from March 2022 to at least May 2022 and data subjects located in the following reception areas were recorded, including during payment transactions and PIN code entries. In fact, approximately 637 PIN entries were estimated to have been recorded. The processing of personal data carried out by the video surveillance system considered from the DSB not to be proportionate to its intended purpose and to go beyond what was necessary for the intended purpose of the surveillance, without a relevant legal basis and in defiance of the principle of fairness and data minimization violating Article 6(1), Article 5(1)(a) and Article 5(1)(c) of the GDPR respectively. As a result, the appellant was fined €1.5 million with an additional €150,000 in procedural costs. The controller appealed, arguing that some footage did not contain identifiable personal data, that many customers used payment methods not requiring PIN entry or covered it during entry, and that surveillance was necessary for security purposes. It also claimed the fine was disproportionate, particularly because the turnover of the parent company was improperly considered in its calculation. It requested the penalty decision to be fully repealed and the proceedings discontinued, or alternatively, that the penalty be reduced to a warning, or at least that the fine be adjusted to a proportionate and appropriate amount. On 2024 the Appeal submitted further to the Federal Administrative Court. The Court partially upheld and partially dismissed the appeal. Specifically, it found that the video surveillance system violated 5(1)(a), 5(1)(c), and 6(1) GDPR due to the lack of a valid legal basis and excessive data collection. It argued
Court case 30 C 138/21
The data subjects were clients of the controller, a tax consultancy firm. In August 2019, the data subjects informed the controller by email that their previous address had changed and provided their new one. In July 2020, the data subject instructed the controller to prepare their income tax return declaration for 2019. The data subject’s contact details from the previous tax return, which still contained their former address, were automatically imported. For this reason, the tax return was sent to the previous address. The new residents of the house opened the envelope containing the relevant documents. The data subjects filed a case before the court of first instance (Local Court Wesel - AG Wesel) requesting compensation for immaterial damages from the controller in the amount of €7,500 each. They claimed that the disclosure of their personal data, including health data, to third parties made them feel exposed and stigmatised causing them pain and suffering. The controller claimed that even if the new residents had opened the letter and taken note of its contents, which is disputed, this was not attributable to it. According to the controller, this was an independent and punishable act of the third parties which had interrupted the causal chain of the controller's actions. First, the court ruled that the controller violated the principle of accuracy Article 5(1)(d) GDPR by not deleting the data subject’s former address from the database in its entirety. It was irrelevant that the address was automatically inserted by a program since it was the controller’s obligation to ensure that the address was no longer stored in the system at all. The court pointed out that a breach of the accuracy principle also constituted an unlawful processing of personal data. Second, the court held that that the data subjects already suffered loss of control of their data. Whether the third parties interrupted the causal chain of events by opening the letter without authorisation was irrelevant for the occurrence of damage. The damage had already occurred with the sending of the letter to their former address. The extent to which the third parties took notice of the content of the letter was only relevant for the extent of the damage, not the occurrence of it. Lastly, the court ordered the controller to pay €500 to each data subject as compensation for immaterial damages, pursuant to Article 82(1) GDPR. The court considered this amount appropriate because, despite the sensitive nature of the data, the data subjects did not suffer further damage beyond the pure loss of control.
Data Subject versus Telecommunications Company
In March 2020, the data subject concluded a postpaid mobile phone contract with a telecommunications provider (controller). The following day, the controller reported the existence and terms of the contract, including its type, duration, and the parties involved (positive data) to SCHUFA, a credit information agency. It did not report any payment default information (negative data). The data subject was informed about this practice in the contractual documentation. On October 2023, the data subject became aware of the entry, following an access request to SCHUFA under Article 15 GDPR. The data subject brought a case before the court of first instance (Regional Court Nürnberg-Fürth-LG Nürnberg-Fürth) claiming that the transfer of his positive data was unlawful because he never provided his consent. Furthermore, the unlawful transmission of his data to SCHUFA caused him emotional distress, reputational concern, anxiety and a loss of control over his personal data. He also referred to an earlier rejection of a credit application for a television purchase (valued at approximately €800) and argued that the SCHUFA entry had contributed to this outcome. The data subject sought: # compensation for material and immaterial damages under Article 82 GDPR; # a cease-and-desist order against further transmissions without consent; # a declaration of liability for potential future damages. The controller defended that the processing was lawful, arguing that the data was limited to positive contractual information, that the transmission was necessary for fraud prevention and credit risk assessment in mass-market telecommunications services, and that Article 6(1)(f) GDPR provided a valid legal basis. The court of first instance dismissed the action as unfounded stating that the data subject had no claim against the controller for the damages sought under Article 82(1) GDPR, as he had not been able to prove to the court's satisfaction that he had suffered material or non-material da
Court case 11 C 157/24
The data subject concluded a contract with a telecommunications company (controller) for the provision of telecommunications services . The controller provided the data subject with a leaflet, informing him about the transfer of data regarding the conclusion of the contract (positive data) to credit information agencies. On the same day, the controller transmitted the name, date of birth and address of the data subject as well as the contract number and the date to Schufa, a credit information agency. In the meantime, the data subject was involved in consumer insolvency proceedings, for failing to settle personal loans. The data subject later became aware of the data transfer to Schufa and filed a case before the court of first instance (Regional Court of Singen - AG Singen). He maintained that the transfer was unlawful because he never provided his consent and climed immaterial damages of least €500, under Article 82(1) GDPR. He alleged that due to the data transfer he suffered from anxiety, a sense of loss of control over his data and worried about his creditworthiness, which affected his sleep and therefore his quality of life. The controlled argued that he transmission of positive data to credit information agencies was permissible for reasons of fraud and over-indebtedness prevention and that the data subject was not entitled to any damages. The court rejected the case as unfounded. First, it held that the data subject had no claim for damages arising from Article 82(1) GDPR because the processing of personal data was lawful, under Article 6(1)(f) GDPR. The transfer of the data subject’s contractual data was necessary for reasons of fraud, identity theft and over-indebtedness prevention, thus serving the legitimate interest of the controller. Second, the court ruled that the data subject did not suffer immaterial damage from the data transfer. It pointed out that since he was involved in consumer insolvency proceedings, there were serious doubts that his concerns about his creditworthiness could only be attributed to the transfer of contractual data to Schufa. Furthermore, the data subject failed to demonstrate sufficient harm attributable to the loss of control of his data.
Data Subject v. Music Streaming Service (and its processor and sub-processor)
The data subject was a user of the controller’s France-based music streaming service since 2015. The controller used an Israel-based company as a processor on the basis of an agreement pursuant to Article 28 GDPR. Their agreement foresaw that upon termination of their contractual relationship the processor must sent back all personal data it processed on behalf of the controller and then arrange the deletion of all copies retained by it or its sub-processors in 21 days. The processor engaged a group affiliate as a sub-processor, without ensuring a proper sub-processing agreement. In November 2020, the contractual agreement between the controller and the processor was terminated. with a deletion confirmation only being received in February 2023. In November 2022, the controller became aware of a hacking incident that exposed customer personal data, including names, birthdates, and email addresses, which were offered for sale on the darknet. The controller submitted a personal data breach notification to the DPA and informed the data subjects accordingly. The data subject filed a case before the court of first instance (Regional Court Duisburg - LG Duisburg) demanding immaterial damages. The Regional Court Duisburg rejected the case as unfounded, citing lack of proof of damage and insufficient evidence of actual data exposure. The data subject filed an appeal before the court of appeal (Higher Regional Court of Düsseldorf - OLG Düsseldorf). In the meantime he was able to obtain the leaked list on the darknet and prove that the data published therein concerning him originated from the controller. He claimed that the controller was not allowed to transfer the data to the processor at all, it did not check whether its processor had deleted the data, and there was no contractual relationship between the processor and sub-processor. The data subject requested for: - Compensation for non-material damages for data protection violations in the amount of €3,000,
Deutsche Bahn Fernverkehr AG
From October 2023 to December 2024, Deutsche Bahn Fernverkehr AG, the national railway company of Germany (controller), offered certain low-cost tickets ('Sparpreis' and 'Super Sparpreis') exclusively in digital form. To purchase these tickets—via app, telephone, or at the counter—data subjects were required to provide either an email address or a mobile phone number to receive a digital ticket or order number. The purchase was not possible via the ticket machines. A consumer protection organisation filed a claim before the Higher Regional Court Frankfurt (OLG Frankfurt am Main), requesting a cease and desist order, arguing that the controller processed personal data without a valid legal basis. The court held that the controller violated Article 5(1)(a) GDPR for processing personal data without a valid legal basis by requiring data subjects to provide an email address or mobile phone number in order to purchase the discounted tickets. First, it found that the controller failed to obtain freely given consent under Article 6(1)(a) GDPR since it did not offer an equivalent alternative for purchasing the ticket without providing personal data. Therefore, data subjects were not able to make a genuine and free choice, and therefore the consent could not be considered valid. The court referred to judgment [https://curia.europa.eu/juris/document/document.jsf?text=&docid=275125&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1 C-252/21 ECJ] in which it confirmed that consent is invalid when it is tied to the performance of a service without an alternative. The court also highlighted that the controller held a dominant market position in long-distance rail transport in Germany. This market power reinforced the lack of voluntariness in the purported consent, as data subjects had no reasonable alternative to using the controller’s services. Second, the court held that the data processing is not justified under Article 6(1)(b) GDPR, processing of contract data. It held th
Court case 22 C 1423/25
In 2022, the data subject, a partner in an auditing and consulting firm, entered into a phone contract with a telecommunications company (controller). The data subject received the contractual terms and conditions, as well as the data protection information sheet. The contract included a clause that authorized the transmission of personal data to credit information agencies for the protection of the controller's legitimate interests or those of third parties. The data subject was also informed of their rights under the GDPR, including the right to withdraw consent. Subsequently, the controller transferred data about the conclusion of the telecommunications contract to a credit information agency (CRIF GmbH). The data subject brought a case to the District Court of Nürnberg and requested €1,500 in damages from the controller and demanded it stops unlawfully processing the data subject’s data. The controller rejected the claim, arguing that the data processing was necessary and based on contractual agreements. The court dismissed the data subject’s action for the following reasons: Regarding damages The court found no basis for the damages claim under Article 82 GDPR . The data subject admitted that no tangible damage could be concretely identified. Referencing case law by the CJEU, the court held that the mere assertion of fear about potential consequences is insufficient to justify compensation under Article 82 GDPR. Regarding the lawfulness According to the court, the data subject had consented to the disclosure of his personal data to the credit information agency when the contract was concluded by agreeing to the provisions in the data protection information sheet . The consent was also necessary for the controller to protect its legitimate interests, and the data subject had been informed of this upon entering into the contract. Consent, in accordance with Article 7 GDPR, was therefore validly given. Furthermore, there was no evidence that the consent for the data transmission to the credit information agency was forced. The data subject was informed from the outset about the data processing and had other mobile providers to choose from or they could have renegotiated the contract terms. Also, according to the court, the data provided by the data subject are of little significance in terms of its potential impact, as it does not include any negative financial information or details that would harm the data subject’s reputation. Further, the court recalled that the wording of Article 4 GDPR does not contain an "absolute" prohibition of making consent conditional for the performance of a contract. In conclusion, the controller could lawfully base the transmission to the credit information agency on the data subject’s consent.
Court case 8 AZR 117/24
The data subject is a renowned lawyer specialised in employment law and the controller a university operating as a corporation under public law. In 2020, the data subject was sentenced for fraud by a court of first instance (Regional Court of Munich I). In 2022 the Federal Court of Justice overturned this judgment. In June 2021, the controller advertised a temporary position for a lawyer, to which the data subject applied for, enclosing all relevant documents, and then went through the interview process. In July 2021, the data subject received a rejection notice from the controller, stating that it can be seen from publicly available online sources that the data subject had been sentenced for fraud by the court of first instance. Even though the judgement is not yet legally binding, he could only be hired under the resolutory condition of a clean criminal record. He was also informed that another candidate, who matched the requirements better, had been selected. In December 2022, the data subject filed a case with the Court of First Instance (Düsseldorf Labor Court -ArbG Düsseldorf) claiming, amongst other things, that he is entitled to material and immaterial damages due to the unlawful collection of his personal data. The core of the allegations is that that the controller collected the data from the internet without him being aware, the collected data was incorrect and since the controller did not inform him about the processing he was not given the opportunity to comment which had an influence to the outcome of the selection process. The controller claimed that the position had been filled with another applicant who demonstrated better professional competence in comparison to the data subject. The knowledge of the criminal proceedings against the data subject and their evaluation in relation to the position were additional reasons for the rejection. The data subject is not entitled to damages under Article 82(1) GDPR, because the personal data collection d
Facebook User
The controller managed a social media platform (Facebook) that the data subject had an account on. In 2019, the platform experienced a data breach via their Contact Import Tool (CIT) that affected the personal data of the data subject, specifically the phone number. The data breach was only noticed in 2021, after which the data subject asked the controller directly to pay €500 in non-material damages due to the loss of control over their data and exposure to scams sent to their contact details. The data subject also demanded the controller desist from sharing their personal data to third parties in the future, and included an (Article 15) right of access request. The controller denied paying damages and held that they provided an adequate amount of data protection measures. This resulted in the previous court decision, in which the court held that non-material damages (Article 82) can be caused by losing control over personal data and begin with the illegal scraping, and not just when the illegal processing of the scraped data starts. Furthermore, these damages don't necessitate the existence of further emotional pain or financial damages. It also considered that the CIT is not covered under Article 6(1)(b) because it is not necessary for the fulfillment of a contract. It awarded the data subject €250 in non-material damages. That decision was appealed by the controller. The high court argued that there could have been no non-material damages because the scraped data only contained the phone number and gender of the data subject, but not their first or last name. It acknowledges that the interpretation of damages should be kept broad in reference to Recital 146 and that there is no need for a specific severity or significance, but insists that a breach of data protection law itself does not necessarily constitute non-material damages. Data subjects should still have to prove that there have actually been causal consequences to the data breach and that a loss of c
Verbraucherzentrale Bundesverband
The Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband – vzbv) brought an action against ImmobilienScout24 GmbH, the operator of an online real estate platform in Germany. The controller offered users a “self-disclosure form” to fill out before contacting landlords. This form collected extensive personal data, such as name, address, employment details, and income. Some fields were marked as mandatory. The website also promoted credit reports by a German credit information agency (i.e. SCHUFA), stating that landlords increasingly required them before apartment viewings. The vzbv claimed that this practice violated the GDPR because the data were collected without a valid legal basis. It further argued that the SCHUFA advertising was misleading under the German Unfair Competition Act (Gesetz gegen den unlauteren Wettbewerb – UWG), as it falsely suggested that tenants were obliged to provide credit reports at an early stage. Accordingly, vzbv requested two injunctions to stop the processing of personal data in connection with the self-disclosure form and to prohibit misleading advertising about SCHUFA credit reports. The Regional Court of Berlin (Landgericht Berlin – LG Berlin) upheld both claims. It found that the controller’s data processing violated Article 5(1)(a) in conjunction with Article 6(1) GDPR, and that its advertising breached the UWG. The Court held that the controller had no valid legal basis for collecting data via the self-disclosure form. There was no valid consent according to Article 6(1)(a) GDPR, as filling out the form could not be considered voluntary and unambiguous and the processing lacked a specific purpose. Many fields were mandatory and the purpose of processing was only vaguely described. The court also found that the processing was not necessary for pre-contractual measures under Article 6(1)(b) GDPR, as it was not indispensable to initiate rental negotiations. Similarly, the Court rejected that there was a le
A natural person (the controller)
A natural person (the controller) installed CCTV cameras on his property. Aside from his own property, the cameras covered a part of the property of a neighbour (the data subject) as well as the public road. The data subject filed a complaint with the DPA to challenge the recording of his property. The DPA held that the controller had no legal basis for recording the data subject’s property and the public road. On these grounds, it issued an injunction against the controller to stop the unlawful processing (by dismantling the cameras or restricting their field of view) or, as an alternative, to suspend the recording and later provide DPA with a written assessment of his legitimate interest to process personal data (Article 6(1)(f) GDPR). The controller unsuccessfully challenged the decision with the Tallinn Administrative Court and later escalated the case to the Tallinn District Court. The District Court of Tallinn dismissed the controller’s challenge. = The DPA and the lower court both held that the case at hand did not fall under the household exemption of Article 2(2)(c) GDPR. In this regard, the DPA and the lower court referred to Ryneš, a pre-GDPR era ruling of the CJEU. According to Ryneš, the household exemption (then found under Article 3(2) of the now-repealed Data Protection DirectiveDirective 95/46/EC (available [https://eur-lex.europa.eu/eli/dir/1995/46/oj/eng here]).) does not apply to CCTV surveillance when the cameras also cover public space. On the other hand, the controller held that the household exemption applied to his case and that the Ryneš ruling was irrelevant because it applied Article 3(2) of the Data Protection Directive rather than 2(2)(c) GDPR. The Tallinn District Court upheld the previous findings: the household exemption did not apply to the case for the reasons clarified in Ryneš, i.e. the cameras covered public ground. The Court also clarified that Ryneš was still relevant to the case at hand because Article 2(2)(c) GDPR does not differ in substance from Article 3(2) of the Data Protection Directive. = In the controller's view, the assessment of legitimate interest was up to the DPA rather than the controller. By issuing an injunction for the controller to assess its legitimate interest, the DPA essentially delegated its task to the controller, contrary to the principle of legal clarity and "the general principles of administrative law". The Court dismissed the argument. Under the principle of accountability (Articles 5(2) and 24(1) GDPR), the controller must both assess and demonstrate that the processing of personal data complies with the GDPR. Therefore, the DPA's injunction for the controller to assess its legitimate interest, simply enforced the principle of accountability and did not delegate the DPA's tasks. = The controller observed that the GDPR includes no explicit obligation to carry out a written analysis of legitimate interest. For this reason, the controller argued that the DPA's injunction to present such a written analysis, had no basis in the law. The Court conceded that there is no general obligation in the GDPR to prepare a legitimate interest analysis as a written document. However, the Court still held that the DPA's injunction was legitimate. The DPA observed that under Article 58(2)(d) GDPR, a DPA may “order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period”. The Court held that the DPA's injunction was functional to bringing the processing into compliance with the principle of accountability and that it was appropriate and not disproportionate to this purpose. Therefore, the DPA acted within its powers when it issued its injunction to provide a written assessment of legitimate interest.
Court case 18 SLa 959/24
The controller is a company that is active in metal processing. Its factory building consists of a production hall where steel is processed, a break room, two offices, and an adjoining storage room. There are 34 video cameras in those spaces which cover the entire area 24 hours a day and the video footage is kept for at least 48 hours. Cameras are also positioned in the offices. However, the parties disagree on whether the cameras in the offices are merely "dummy" devices. The cameras are capable of filming in high resolution. Images from the video feeds can be evaluated “live” while they are being recorded. Information signs regarding video surveillance are located at every access door. Employees consent to video surveillance through a short, general clause in their employment contract. The data subject was an employee working with machinery in the production hall who's workplace was located a few metres away from a surveillance camera. The camera surveillance was the subject of a legal dispute between the controller and the data subject before the Labour Court Dortmund in 2023. The dispute was resolved through a settlement agreement. As part of the settlement, the controller agreed to provide the data subject with information about the video surveillance. However, after receiving this information, the data subject claimed that it was incorrect and insufficient and that the stated purposes of the video surveillance did not justify its extent. In 2024, the data subject pursued his claims with his lawsuit, which was filed with the court of first instance (Labour Court Dortmund). He demanded that the controller would provide the correct information and cease video surveillance. In its decision of 2024, the court of first instance dismissed the right of access claim and upheld the rest of the claim ordering the controller to pay the data subject €15,000 in compensation for a serious unlawful infringement of the data subject's personal rights. In the meantime the e
Meta Platforms Ireland Limited
In April 2025, Meta Platforms Ireland Limited (Meta) publicly announced that it would use personal data from its users' public profiles to train artificial intelligence from 27 May 2025, unless users object to this processing. In May 2025, the German Consumer Rights Organisation "Verbraucherzentrale NRW" (plaintiff) brought an interim injunction case against Meta before the High Regional Court of Cologne, to prevent the processing of publicly provided user data. Following a preliminary and summary examination, as part of the interim proceeding, the High Regional Court of Cologne held that Meta did not breach the GDPR or the DMA, noting that this assessment is consistent with the regulatory assessment by the Irish DPA responsible for Meta. The Hamburg DPA (Hamburg Commissioner for Data Protection and Freedom of Information) stated at the hearing that the use of user's personal data for AI training purposes is legally possible. The court held that the processing is lawful within the meaning of Article 6(1)(f) GDPR, even without the data subjects' consent, and that Meta pursues a legitimate interest by using the data for the training of artificial intelligence systems. He further pointed that the fact that large amounts of data, also from third parties including minors and sensitive data within the meaning of Article 9 GDPR, are processed, does not outweigh this consideration. The High Regional Court of Cologne rejected the interim measure.