GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
Court case III OSK 4984/21
A court rendered a judgment in a case referring to a data subject. An individual, being a member of data subject’s family, published the judgement via their Facebook account and by placing its copy behind their car’s pane. The judgment was published in that way for 11 days. The data subject filed a complaint with the Polish DPA (UODO). The DPA dismissed the complaint as it considered that the personal data were published under Article 2(2)(c) GDPR, i.e. for purely personal activity. Additionally, the individual and the data subject were related. Thus, according to the DPA, the processing at stake fell outside GDPR’s scope of application. The data subject brought an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The court repealed the DPA’s decision. By referring to case C-101/01 and C-212/13, the court emphasised the exemption of purely private activity didn’t cover the processing which led to disclosing the data to unlimited number of people. Because the individual shared the data via Facebook, making it available to unlimited number of its users, Article 2(2)(c) GDPR didn’t apply. The DPA lodged a cassation appeal before the Supreme Administrative Court (Naczelny Sąd Administracyjny – NSA). The Supreme Administrative Court dismissed the cassation appeal. The court explained that the notion of purely personal activity was inherently limited. In particular, when the personal data were made accessible to an unrestricted number of people, for instance, social media users, it excluded the application of Article 2(2)(c) GDPR. The court based it reasoning on Recital 18 GDPR, case C-212/13 and WP29 [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2009/wp163_en.pdf Opinion 5/2009]. In the case at stake, the individual published the judgement referring to the data subject via Facebook. The post shared in such a way that every Facebook user could has accessed it. Hence, the individual’s data processing was not exempted from application of the GDPR.
In 2022, Norwegian, Slovenian, Greek, French, Spanish and Czech consumer protection organisation, on behalf of data subjects, lodged complaints with DPAs relating to the account creation process with Google. These complaints were then forwarded to the Irish DPA between September 2022 and March 2023 as the lead supervisory authority due to location of the controller and in accordance with the one stop shop mechanism. The complaints alleged dark patterns were used by Google in its account creation process. On 23 October 2023, the DPC decided to commence an inquiry and issued a notice of commencement. On 30 November 2023, Google objected to the commencement of the inquiry stating that the necessary information had not been provided to the DPC and to Google itself. Google posited that neither the account identifier information of each of the data subjects nor copies of the mandates of the consumer protection organisation representing the data subjects under Article 80(1) GDPR were presented to it. Google therefore questioned the DPC's jurisdiction over the matter. On 18 January 2024, Google initiated judicial review proceedings at the Irish High Court claiming that the DPC lacked jurisdiction over the inquiry as it was not in receipt of the above information. The Irish High Court sought to determine the admissibility of the complaints and did not analyse the content of the complaints. The DPC submitted to the High Court, that it has very wide discretionary powers as to when it can launch an inquiry and that no specific preconditions must be met. In response to Google’s argument that the DPC did not have the account IDs nor the mandates of the consumer protection authorities, the DPC purported that the EU law principle of mutual trust and the duty of sincere cooperation applied. As the lead supervisory authority, the DPC had to assume that the concerned supervisory authorities had forwarded the claim on the basis that the complaints were well constituted. In fact, the
Patērētāju tiesību aizsardzības centrs
The Consumer Rights Protection Centre ([https://www.ptac.gov.lv/en/about-us Patērētāju tiesību aizsardzības centrs] - PTAC) used distributed a video featuring a character imitating a well known journalist (the data subject). The campaign's aim was to make the consumers aware of risks associated with buying pre-owned cars. The PTAC didn’t obtain the data subject’s consent who opposed the making and distribution of that video. The data subject demanded PTAC to stop distributing the video and claimed compensation for the damage to his reputation. After PTAC rejected the data subjects request, the data subject initiated proceedings before District Administrative Court (Administratīvā rajona tiesa). The data subject claimed for compensation of non-material damage by an apology and payment of €2,000. The District Administrative Court found PTAC conduct was unlawful and ordered PTAC to pay €100 in compensation for non-material damage and to make a public apology. The Regional Administrative Court (Administratīvā apgabaltiesa), which heard an appeal, confirmed the finding that PTAC processed the data unlawfully, as there was no valid legal basis under Article 6 GDPR. As a result, PTAC was ordered to cease the processing. Moreover, the court also ordered the apology, under Article 14 of [https://likumi.lv/ta/id/110746-valsts-parvaldes-iestazu-nodarito-zaudejumu-atlidzinasanas-likums Law on compensation for damage caused by public authorities] (Valsts pārvaldes iestāžu nodarīto zaudējumu atlīdzināšanas likums), to be published on websites where the video was available. Nevertheless, the court dismissed the financial compensation for non-material damage. According to the court, the video was prepared to perform task in the public interest and the infringement itself was not of serious nature. Additionally, the court pointed out that the complicated nature of legal framework caused PTAC to misinterpret the applicable law. The data subject lodged an appeal before the Supreme
Ubezpieczeniowy Fundusz Gwarancyjny
A data subject filed a complaint with the Polish DPA (UODO) in September claiming that an insurance company (the controller) unlawfully processed and transferred their personal data to [https://www.ufg.pl/infoportal/faces/pages_home-page?_afrLoop=11910042574273553&_afrWindowMode=0&_adf.ctrl-state=nawhddp69_4 the Insurance Guarantee Fund] (Ubezpieczeniowy Fundusz Gwarancyjny). Under the Polish law, the Insurance Guarantee Fund held register of insured entities. The DPA asked the controller and the Insurance Guarantee Fund to make statements regarding the complaint. In December, the data subject filed a statement, lamenting the DPA's alleged inactivity and prolongation of the proceedings. Also, the data subject asked for the copies of all documents sent to the DPA by the controller and the Insurance Guarantee Fund. The DPA refused to provide the data subject with such copies and continued to process the case. The data subject filed a complaint with the Voievodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie), claiming proceedings were prolonged by the DPA's inactivity. In the meantime, the DPA issued a decision. The court upheld the complaint against the DPA inactivity. According to the court, the DPA proceeded the case with protraction. There was no extenuating circumstances explaining the fact that the DPA examined the case for four months. Thus, the DPA violated Article 35 of [https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU19600300168/U/D19600168Lj.pdf administrative procedure code] (kodeks postępowania administracyjnego) according to which in principle, DPA's should render their decision in one month. The DPA lodged the cassation appeal with the Supreme Administrative Court (Naczelny Sąd Administracyjny). The DPA stood on a position that it was Article 78(2) GDPR that determined the terms to examine the case. The court upheld the DPA's appeal. Article 78(2) GDPR was applicable to the case at hand. The three months term of Article 78(2) GDPR determined the time, in which the DPA was obliged to examine the case and issue a decision. Thus, Article 78(2) GDPR was a lex specialis, derogating the application of the general terms for case examination. Nevertheless, it was the DPA’s duty to inform the data subject about a delay in the closing of the case and its status, in accordance with Article 36 of administrative procedure code. If the DPA didn’t issues decision within three months, the data subject was entitled to bring a case for delayed proceedings by the DPA. However, the court of first instance failed to consider the DPA proceedings under Article 78(2) GDPR. Because of that, the case was sent back to the Voievodeship Administrative Court of Warsaw.
Court case PVN-2024-06
A data subject contacted the Norwegian DPA (Datatilsynet) asking for investigation against the Child Welfare Service in relation to its GDPR compliance. The request covered processing activities relating to data subject’s children. In response, the DPA explained that the [https://www.statsforvalteren.no/ State Administration] (Statsforvalteren) was competent to hear complaints, in particular, regarding data processing of municipality bodies. Thus, the DPA closed the case. Few months later, the data subject filed a complaint with the DPA in relation to data processing performed by the Police. Allegedly, the police breached the duty of confidentiality, disclosing a criminal report case to the Child Welfare Service. Additionally, the data subject asked the DPA to audit the municipality's data processing. The DPA informed the data subject that it is not competent to examine the processing activity's of the police. Also, again the DPA found no reasons to conduct further investigation against the Child Welfare Service, nor to audit the municipality. Hence, the DPA close the case. The data subject lodged an appeal with the Privacy Appeals Board (Personvernnemnda). The Privacy Appeals Board dismissed the appeal. According to the Privacy Appeals Board, the DPA closed the case since there was no complaint within the meaning of Article 77(1) GDPR in conjunction with Article 57 GDPR. The Privacy Appeals Board found that the mere suspicion of unlawful data processing, not yet linked to specific processing activities, did not oblige the DPA to initiate investigation. In the case at hand, the data subject asked the DPA to verify whether the Child Welfare Service violated GDPR in one of the mentioned cases. Nevertheless, the data subject’s claims were vague and general, expressing the data subject dissatisfaction with the Child Welfare Service conduct. Consequently, for the Privacy Appeals Board the data subject's request didn't constitute a complaint under Article 77(1) GDPR and the DPA was entitled to close the case.
Google LLC
The data subject is a journalist, who in 2011 started receiving backlash for publishing her research on generic drugs. Many websites posted abusive, defamatory and derogatory comments about her being transexual. Google associated her name with the derogatory and defamatory comments about her and, as a result, upon googling her name, those terms came up as an auto suggestion/auto completion in the search tool. In 2012, the data subject filed a case before the court of first instance (Athens Court of First Instance) against the U.S. based Google LLC and the Greek subsidiary, Google Greece, (controllers) requesting that the said auto suggestions/auto completions and links to the said pages would be deleted since they constituted a violation of her personality and damaged her honour and reputation. The court issued interim measures and then a decision ordering the controllers to cease and desist from associating in any way her name with these words and prevent any future posting of similar content in the search results. The court found that the controllers violated her personality rights under Greek law (Civil code, Articles 57-59) and awarded her €30,000 in non material damages. Nevertheless, the auto suggestions/auto completions regarding her name and the links were not deleted and the data subject contacted Google LLC and Google Greece multiple times in an attempt to resolve this. On their behalf, the controllers instructed her to file a request on their platform and point out the certain URLs for deletion. Both parties appealed before the court of appeal (Athens Court of Appeal). The controllers claimed that the court of first instance erred in the application of the law, arguing that they were not liable for the content of the third-party posts on the Internet appearing in the search engine and that they may remove specific URLs only if they are notified (with a specific reference) by the data subject. The data subject claimed a higher compensation. The court of appeal, in 2016, rejected the appeal. It made clear that both Google LLC and Google Greece were responsible for the technical and commercial operation of the search engine and the auto suggestions/auto completions feature and are considered controllers. It held that as controllers they were responsible for the content third parties posted on the Internet in the context of the operation of the search engine were bound to immediately comply with the court’s order. The controllers further appealed before the Supreme Court (Supreme Court of Greece- Areios Pagos). The Supreme Court upheld the decision of the court of appeal. First, it pointed out that online search engines, do not (in principle) create new, primary content, but merely indicate where existing content can be searched for, thereby providing a 'hyperlink' to the website containing the terms searched for. If the originating websites, web pages and blogs contain personal data, then their content in the search engine contains such data, in which case national and EU legislation on the protection of personal data applies. With references to the CJEU cases Google Spain ([https://curia.europa.eu/juris/liste.jsf?num=C-131/12 C-131/12]) and Lindqvist ([https://curia.europa.eu/juris/liste.jsf?language=de&num=C-101/01 C-101/01]), the court held that making available to internet users in a certain order of preference information published or posted on the internet by third parties must be classified as processing of personal data under Article 4(2) GDPR. Second, it held that therefore the search engine operators determine the purposes and means of carrying out the activities of the search engine, meaning that Google LLC and Google Greece must be qualified as the controllers of that processing under Article 4(7) GDPR. Third, it ruled that search engine operators shall be required to remove from the list of results, which appears after a search carried out on the basis of the name of a person, links published by third parties containing information relating to that person that are inaccurate or unlawful. In the present case, since the request for removal of the links to the websites was made in connection with application and issuing for interim measures in 2012, (which temporarily prohibited the controllers from making any such reference to the data subject in connection with the words), the court held that no further specific and concrete request was required from the data subject. The court held that she did not have to request the deletion again or proceed with the identification of the URLs to be deleted. Lastly, the court highlighted that this was in line with Article 8 and Article 11 CFR.
M.A.B.
A data subject brought two cases before the Administrative Court of Cergy-Pontoise (Tribunal administratif de Cergy-Pontoise) – the controller. The data concerning these case were processed in an automated data processing system called “[https://www.legifrance.gouv.fr/loda/id/LEGITEXT000006071341/2023-12-14 Sagace]”. After both cases had been decided, the data subject requested the access to their personal data connected to those cases. The data were processed in “Sagace”. The controller rejected data subject’s request, which caused the data subject to lodge a complaint with the French DPA (CNIL). The DPA stated the access request fell within the scope of the judicial capacity of courts and as such was excluded from jurisdiction of the DPA. The data subject appealed against the CNIL's decision to the Supreme Administrative Court (Conseil d’Etat). The court rejected the appeal. The access request at hand touched upon the exercise of judicial capacity by courts. This was because the “Sagace” system, which processed the data subject’s data, was designed to allow parties of administrative court proceedings manage pending cases. Also, according to the body of evidence, the access requests were directly linked to the proceedings initiated by the data subject – they wanted to verify whether the court took into account two pleadings delivered within proceedings. Hence, under Article 55(3) GDPR the DPA had no competence to decide cases referring to court’s exercise of judicial capacity. Within French legal system, Article 45 of [https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000049563368 Law of 21 May 2024 on the security and regulation of the digital space] (Loi n° 2024-449 du 21 mai 2024 visant à sécuriser et à réguler l'espace numérique conferred the court (Conseil d’Etat) with the authority to control data processing activities by administrative courts while exercise judicial capacity.
Autoriteit Persoonsgegevens
Due to a bankruptcy the data subject was represented by a bankruptcy trustee. The bankruptcy was lifted on 7 July 2022, ending the trustee’s authorization to represent the data subject. However, on 19 July 2022, an employee of a Dutch bank, ABN AMRO Bank (the controller), shared the data subject’s personal data with the former bankruptcy trustee of the data subject on the phone. The data subject lodged a complaint with the Dutch DPA (“Autoriteit Persoonsgegevens) for an unreported data breach by the controller (i.e. sharing his personal data with his former bankruptcy trustee). The controller admitted to the DPA that the bankruptcy trustee of the data subject should only have been informed that they were no longer appointed due to the discharge from bankruptcy of the data subject, and that therefore information of the data subject would not be shared anymore with them. The DPA interpreted the data subject's complaint as not directly referring to the data breach, but to the unlawful processing of sensitive personal data. To determine whether unlawful processing took place, further investigation would have been required. However, in this case, the DPA refrained from conducting further investigation. The DPA explained why it was not investigating the data subject’s complaint, referring to the [https://www.autoriteitpersoonsgegevens.nl/een-tip-of-klacht-indienen-bij-de-ap/behandeling-van-klachten-door-de-ap criteria on their website]. On their website the DPA states that to be efficient and effective, they have to make choices and therefore use the following criteria to determine whether the complaint qualifies for further investigation: the complaint is about a violation that is still ongoing, has a broader societal interest, there are no other proceedings pending, the complaint is specifically about a GDPR issue, and the subject of the complaint has not previously been investigated by the DPA. Taking into account the data subject's complaint, the DPA held that the alleged violation did not last long and the phone call took place quite some time ago. There was also no broader social significance and only the data subject was affected and the subject of the complaint did not fall within any of the DPA’s central themes of 2024. Lastly, the DPA held that the dispute between the data subject and the former bankruptcy trustee was not primarily a GDPR violation. The data subject appealed the DPA’s decision to not further investigate at the District Court of The Hague (“Rechtbank Den Haag”). The DPA argued that further investigation was not needed to establish wrongdoing. The controller’s sharing of the data subject’s personal data with the former bankruptcy trustee was unlawful. However, the DPA stated that the controller acknowledged the violation and mistakenly did not report the breach to the data subject. The court found that the DPA could refrain from conducting further investigation. According to Article 57(1)(f) GDPR, the DPA must deal with complaints to the extent appropriate. The court therefore held that the DPA has discretion to determine case by case whether to take corrective measures. The court found that based on the available information, the DPA could not yet determine whether there was a violation as for example it was not clear what personal data was shared during the phone call. The fact that the controller should have informed the former bankruptcy trustee that they were no longer appointed and that information should not be shared with them anymore, does not mean that there was a GDPR violation. Therefore, further investigation was required. However, the court stated it could follow the DPA’s reasoning for not further investigating the complaint based on the DPA's criteria. Therefore, the court held that the DPA could refrain from further investigating and thus dismissed the appeal.
Region Uppsala
The data subject lodged a complaint against the controller, the Region Uppsala, at the Swedish DPA (“IMY”) for recording telephone conversations without a legal basis for the processing. The DPA sent an information letter to the controller, informing them of the complaint, the applicable law and closed the case without taking any further action. The DPA held that the purpose of the letter was to give the controller the opportunity to review its processing and to correct any shortcomings themselves. The DPA therefore did not see any grounds to investigate the complaint further. The data subject appealed this decision at the Administrative Court of Stockholm (“Förvaltningsrätten I Stockholm”), arguing that the DPA has the obligation to take effective measures to limit violations. As the letter stated that the DPA did not intend to take further action, there was no incentive for the controller to remedy its violations. Therefore, the data subject argued that the DPA failed to investigate the matter with due diligence, even though it was clear from the complaint that the controller did not have a legal basis for its processing. The data subject further argued that information letters are not a corrective measure under Article 58 GDPR and can therefore not constitute as an effective measure. The data subject argued that this was also not in line with the [https://www.edpb.europa.eu/our-work-tools/our-documents/internal-documents/internal-edpb-document-022021-sas-duties-relation_en EDPB internal document on Supervisory Authorities’ duties in relation to alleged GDPR infringements]. The IMY held that the appeal should be rejected as the measure was sufficient. The IMY held that if the letter did not result in the controller correcting any shortcomings, the data subject was free to submit a new complaint at a later stage. The court assessed whether IMY had grounds for not investigating the data subject’s complaint further, beyond sending an information letter to the cont
MK
A data subject was under guardianship, duly appointed under German law ([https://www.gesetze-im-internet.de/bgb/ Article 1896 and 1897 BGB]). The guardian was a lawyer acting in a professional manner and belonging to the personal circle of the data subject. They, performed their duties for a certain time and was later replaced by another person. The data subject referred to the Local Court of Hannover (Amtsgericht Hannover – AG Hannover) for legal aid to access the data collected by the guardian when performing their duties. The AG Hannover rejected the application of the data subject. According to the court, since the guardian performed their duties in context of their professional activity it was not a data controller within the meaning of Article 4(7) GDPR. Hence, they were not obliged to respond to access request under Article 15 GDPR. Also, the court emphasised that the guardian was a legal representative of data subject under German law. That meant the guardian could process the personal data on behalf of data subject. The data subject appealed against the decision of the AG Hannover to the Regional Court of Hannover (Landgericht Hannover - LG Hannover). The appeal raised the court’s doubts whether a professional guardian was covered by the definition of controller in Article 4(7) GDPR. Also, the court deliberated about the problem of the guardian being a part of the data subject’s personal circle. As a result, LG Hannover decided to refer the following preliminary questions to the CJEU: # Is a legally appointed guardian who performs that activity in a professional capacity a controller within the meaning of Article 4(7) GDPR? # Is he or she required to provide information in accordance with Article 15 GDPR?’ The CJEU answered both question positively. The CJEU found the guardian as such to be a controller within the meaning of Article 4(7) GDPR. Firstly, the CJEU excluded the application of Article 2(2)(c) GDPR to guardian’s activity, namely the exception
Grindr
Grindr (the controller) is a location-based social networking app marketed towards the LGBTQ community. The app has an ad-based free version, but users can upgrade to paid subscription versions which include more features and are without ads. In January 2020, the Norwegian Consumer Council together with noyb lodged a complaint with the Norwegian DPA (“Datatilsynet”) against the controller for unlawful sharing of personal data with third parties for marketing purposes. This included GPS location, IP address, Advertising ID, age, gender and the fact that the user in question was on the controller's app. Users could be identified through the data shared, and the recipients could potentially further share the data. On 13 December 2021, the DPA fined the controller €6,4 million (NOK 65 million) for disclosing personal data to advertising partners without a valid legal basis, violating Article 6(1) GDPR. Furthermore, the controller violated Article 9(1) GDPR for disclosing special categories of personal data to advertising partners. On 14 February 2022, the controller appealed this decision at the Privacy Appeals Board (“Personvernnemnda”). The Privacy Appeals Board upheld the DPA’s decision. On 27 October 2023, the controller filed a lawsuit against the Privacy Appeals Board at the Oslo District Court (“Oslo tingrett”). The controller argued that the Appeals Board’s decision should be declared invalid or alternatively that the fine should be reduced. Disclosure of special categories of personal data The court held that by providing the App ID, the controller shared information with their advertising partners that a specific user is a user of their app. The court held that by just being a user of the controller’s app, one can draw the conclusion that the user is not heterosexual and thus is covered by sexual relationships and orientation under Article 9(1) GDPR. Thus, the court concluded that the controller disclosed personal data of special categories of personal da
AEPD
Clearview AI Inc. (the controller or Clearview) is a company established in the United States. The controller scrapes the internet for photos of faces. Users of its services can upload a photo of the face of a person and obtain other photos of the same person, based on facial recognition technology. They also obtain the URLs where those photos were found. These searches may identify a data subject’s social media accounts or other webpages that disclose further personal data about them. The controller claimed to have the biggest known database of facial images with more than 10 billion images. In February 2020, September 2020 and January 2021, the data subject submitted access requests as well as objections to processing to the controller via the email address privacy@clearview.ai. The controller did not respond until 29 January 2021, when it instructed the data subject to exercise its rights using a web form. The data subject submitted the form but did not receive a response. In March 2021 the data subject sent another email to the controller attempting to exercise their rights. The controller again responded by instructing them to fill out the web form. On 10 March 2021 the data subject filed a complaint with the Spanish DPA (AEPD) alleging numerous infringements of the GDPR. The AEPD archived the complaint in September 2021 on the basis that it lacked competence because the controller did not fall within the scope of Article 3(2) GDPR. This provision applies the GDPR to controllers established outside of the EU – in this case, the US – when they offer goods or services to data subjects in the Union of if they monitor their behaviour. The AEPD considered that the provision was not applicable in this case. The data subject initiated proceedings before the Administrative Chamber of Spain’s Audiencia Nacional (the Court) to challenge the AEPD’s decision. It argued that the AEPD is competent to handle the complaint because Clearview processed EU data subjects’ data
Johnny Ryan
On 12 September 2018, a data subject submitted a petition to the DPC concerning Google Ireland Ltd’s (the controller) data processing for targeted advertising through its real time bidding (RTB) online advertising system. A petition is an informal request which does not give a petitioner party rights in a GDPR procedure. Thus, in 2019, the data subject followed up his petition with a complaint alleging violations of Articles 5(1)(a), (c) and (f) GDPR. In particular, the complaint emphasised the lack of adequate safeguards to ensure the integrity of personal data. The complaint claimed that the controller’s use of the RTB system on millions of websites and broadcasting of personal and sometimes sensitive data to other tracking companies with no controls constituted the biggest data breach ever seen. In January 2020, the DPC informed the data subject that it had initiated an ex officio inquiry into substantially the same issues as the complaint. While the DPC confirmed that the data subject’s case was being treated as a complaint, the DPC also said that it was examining matters in the context of an inquiry that could substantially overlap with and influence the outcome of the complaint. Thus, it stated that it would handle the complaint in line with and based upon the progress of the inquiry. As the inquiry unfolded, it became clear that the data subject and DPC disagreed about how confidentiality and security concerns were implicated. The scope of the DPC's inquiry focused on legal basis and transparency issues rather than the Article 5(1)(f) GDPR claims. In several communications, the DPC stressed that it would “continue[] to have an open mind in relation to the central matters” of the inquiry and that when it resumed its examination of the Complaint, it would again consider whether issues relating to data security should be the subject of scrutiny. It also noted that the result of its investigation may end up being functionally the same, with the effect that the
CJEU case Joined Cases C‑182/22 and C‑189/22 Scalable Capital
Scalable capital (‘controller’) managed a trading application in which the data subject opened accounts and entered personal data to do so. In 2020, their personal data were seized by third parties whose identity remains unknown. According to the controller, those data had not been used fraudulently. The data subjects brought an action before the Amtsgericht München (Local Court, Munich, Germany) seeking compensation for the non-material damage which they claimed to have suffered as a result of the theft of their personal data. The court stayed the proceedings and decided to refer the following questions to the CJEU: # Does the right to compensation under Article 82(1) GDPR, including the determination of the amount of the compensation, have a purely compensatory function, and in some cases a satisfactory function? # Does the right to compensation also have an individual satisfaction function – understood as the private interest of the injured party in seeing the behaviour that caused the damage penalised? When determining the compensation, is additional weight attributed to only deliberate or grossly negligent data protection infringements? # Is the compensation for non-material damages to be determined on the basis of a structural order of precedence which attributes less weight to the detrimental effects of a data infringement than to the detrimental and painful effects associated with a physical injury? # Can a national court only award minimal compensation in the light of the non-serious nature of the damage? # Does identity theft under recital 75 GDPR require the offender to have actually assumed the identity of the data subject, meaning to have somehow impersonated that person, or does the mere possession of such data constitute identity theft? On the first and second questions First, the CJEU pointed out that it has already held that Article 82 GDPR fulfills a function that is compensatory and not punitive (§22 of the Judgement, and See [https://gdprhub.eu/index.php?title=CJEU_-_C-300/21_-_%C3%96sterreichische_Post_AG CJEU, 4 May 2023, Österreichische Post, C-300/21]). Accordingly, the right to compensation, in particular in the case of non-material damage, fulfills an exclusively compensatory function, in that financial compensation based on that provision must allow the damage actually suffered as a result of the infringement of the GDPR to be compensated in full (§23 of the Judgement). Second, the controller’s liability under Article 82 GDPR is subject to fault on the part of the controller, which is presupposed, unless the controller proves that it is not in any way responsible for the event giving rise to the damage. Article 82 GDPR also does not require that the severity of that fault is taken into consideration when setting the amount of the compensation allocated for non-material damages under that provision (§28 of the Judgement). However, the amount must be fixed in a way to compensate in full for the damage actually suffered as a result of the infringement (§29 of the Judgement). Therefore, the CJEU found that the severity and possible intentional nature of the infringement of the GDPR does not have to be taken into account for the purposes of compensation for damage under Article 82(1) GDPR (§30 of the Judgement). On the third question The CJEU noted that the GDPR does not contain any provision which defines the rules of the assessment of the damages under Article 82 GDPR, and hence, where an infringement of the GDPR has caused the data subject harm. In the absence of EU law on this matter, the legal system of each Member State is to prescribe the criteria for determining the compensation payable in that context, subject to compliance with the principles of equivalence and effectiveness (§33 of the Judgement). The CJEU noted that financial compensation under Article 82(1) GDPR must be regarded as ‘full and effective’ if it allows the damage actually suffered to be compensated in full (§35 of the Judgement). The CJEU explained that recitals 75 and 85 GDPR set out various circumstances that could be classified as a ‘physical, material or non-material damage’ without establishing a hierarchy between them (§37 of the Judgement). The CJEU also indicated that the recitals do not indicate that harm resulting from a data breach is, by its very nature, less significant than physical injury (§38 of the Judgement). Therefore, the CJEU considered that damages caused by a personal data breach are not, by their nature, less significant than damages caused by a physical injury (§39 of the Judgement). On the fourth question The CJEU recalled that it follows from settled case-law that the person seeking compensation for non-material damage under Article 82(1) GDPR must not only establish the infringement of the GDPR, but also that the infringement caused them damage, which cannot be presumed merely on the basis that the infringement took place (§§41 and 42 of the Judgement, and See [https://gdprhub.eu/index.php?title=CJEU_-_C-300/21_-_%C3%96sterreichische_Post_AG CJEU, 4 May 2023, Österreichische Post, C-300/21]). The CJEU also held that Article 82(1) GDPR does not require that the damage alleged by the data subject must reach a ‘de minimis threshold’ in order to give rise to a right to compensation. However, this does not preclude national courts from awarding compensation of a small amount provided that such compensation fully offsets that damage (§44 of the Judgement). Therefore, the CJEU held that where a damage is established, a national court may, where that damage is not serious, compensate for it by awarding minimal compensation to the data subject, provided that the compensation is such as to compensate in full for the damage suffered (§46 of the Judgement). On the fifth question The CJEU pointed out that the concept of identity theft is not expressly defined within the GDPR. However, identity theft or fraud are referred to in recital 75 GDPR as part of a non-exhaustive list of the consequences of processing personal data liable to cause physical, material or non-material damage, and in recital 85 GDPR as part of a list of physical, material and non-material damage that may be cause by a data breach (§54 of the Judgement). The CJEU also noted that the Advocate General observed in his opinion that in different languages, recitals 75 and 85 GDPR refer to the terms ‘identity theft’, ‘identity fraud’, ‘abuse of identity’, ‘misuse of identity’, ‘misappropriation of identity’ and ‘usurpation of identity’ without distinction. Thus, the CJEU held that the concepts of identity theft and identity fraud are interchangeable and no distinction can be drawn between them (§55 of the Judgement). The Advocate General also stated that the ‘loss of control’ or the ‘inability to exercise control’ over personal data are distinguished from identity ‘theft’ or ‘fraud’. The CJEU confirmed this approach and held that the theft of personal data does not, in itself, constitute identity theft or fraud (§56 of the Judgement). However, the CJEU specified that the compensation for non-material damage caused by the theft of personal data cannot be limited to cases where there was identity theft or fraud. Indeed, the theft of personal data can give rise to a right to compensation under Article 82(1) GDPR if the three cumulative conditions are met ((1) the existence of a violation of the GDPR, (2) the existence of a damage which has been suffered and (3) a causal link between the damage and the infringement). Therefore, the CJEU concluded that in order to give rise to compensation, the concept of identity theft implies that the identity of the data subject has actually been misused by a third party. However, compensation for non-material damage caused by a theft of personal data is not limited to cases where that data theft gave rise to identity theft or fraud (§58 of the Judgement).
CJEU case C‑590/22 PS (Incorrect address)
A consultancy firm (‘controller’) was informed by its clients (‘data subjects’) that their postal address have changed. In July 2020, the data subjects asked the controller to draw up their tax return from the previous year. Having received no reply, they contacted the controller who informed them that the tax return had been sent to them by post in September 2020. The new occupants of the former address of the data subjects informed them that they received an envelope with the names of the data subjects and that they had opened it by mistake. When they realized that these documents were not addressed to them, they placed the documents back in the envelope and handed it to close relatives of the data subjects so that they could collect it. When the data subjects collected the envelope, they found that it contained only a copy of the tax return and a cover letter. They assumed that the envelope also contained the original version of that tax return which included personal data including their names, dates of birth of the data subjects' and their children, tax identification numbers, bank details, information relating to their membership of a religious community, disabled status of a member of their family, professions and workplaces. The data subjects brought an action before Amtsgericht Wesel (Local Court, Wesel, Germany) seeking for compensation for the non-material damage under Article 82(1) GDPR, which they believe they have suffered as a result of the disclosure of their personal data to third parties. They assessed the damages at €15,000. The local court stayed the proceedings and referred the following questions to the CJEU: # To claim compensation under Article 82(1) GDPR, is it necessary to establish that a further adverse effect on the data subject has occurred, beyond the infringement of the GDPR as such? # Does the claim for compensation for non-material damages under Article 82(1) GDPR require the damage to reach a certain magnitude? # Is it sufficient that the data subject fears that their personal data have come into the hands of third parties, even though this cannot be positively established? # Does the national court have to apply mutatis mutandis the criteria for administrative fines of Article 83(2) GDPR when assessing compensation for non-material damage under Article 82(1) GDPR? # Does the amount of a claim for compensation for non-material damage have to be assessed by reference to the fact that the amount of the claim serves to have a deterrent effect? # When assessing the amount of a claim for compensation for non-material damage, does the simultaneous infringement of national provisions which relate to personal data but which are not intended to specify the rules of the GDPR have to be taken into account? On the first and second question Article 82(1) GDPR states that any person who has suffered material or non-material damages as a result of an infringement of the GDPR has the right to receive compensation from the controller or processor for the damage suffered. The CJEU indicated that there are three cumulative conditions for the right to compensation: (i) the existence of a violation of the GDPR, (ii) the existence of a ‘damage’, whether material or non-material, which has been ‘suffered’ and (iii) a causal link between the damage and the infringement (See CJEU, 4 May 2023, Österreichische Post, C-300/21, §32). Therefore, the CJEU held that not any infringement of the GDPR confers the right to compensation to the data subject by itself (§23 of the Judgement). The Court added that the mere infringement of the provisions of the GDPR is not sufficient to confer a right to compensation (§24 of the Judgement See CJEU, 4 May 2023, Österreichische Post, C-300/21, §42). Thus, the data subject is required to establish the infringement of the GDPR and that the infringement caused them damage (§25 of the Judgement and See CJEU, 4 May 2023, Österreichische Post, C-300/21, §§42 and 50). Therefore, the CJEU found that an infringement of the GDPR is not, in itself, sufficient to give rise to a right to compensation under Article 82(1) GDPR. The data subject must also establish the existence of damage caused by the infringement, without that damage having to reach a certain degree of seriousness (§28 of the Judgement). On the third question In the present case, the data subjects were seeking compensation for non-material damage in respect of a loss of controller over their personal data, without being able to establish the extent to which third parties actually became aware of such data (§30 of the Judgement). The CJEU held that the loss of control over personal data, even for a short period of time, may constitute a non-material damage within the meaning of Article 82(1) GDPR, provided that the data subject can show that they have actually suffered such damage, however slight (§33 of the Judgement). However, a mere allegation of fear with no proven negative consequences cannot give rise to compensation under Article 82(1) GDPR (§35 of the Judgement). Therefore, a data subject’s fear that their personal data was disclosed to third parties without it being possible to establish that that was in fact the case, is sufficient to give rise to compensation, if that fear, with its negative consequences, is duly proven (§36 of the Judgement). On the fourth and fifth questions First, the CJEU indicated that Article 83 GDPR determines the general conditions for imposing administrative fines, while Article 82 GDPR governs the right to compensation and liability. Therefore, these two articles pursue different objectives (§38 of the Judgement). Therefore, the CJEU considered that the criteria set out in Article 83 GDPR cannot be used to assess the amount of damages under Article 82 GDPR (§39 of the Judgement). As the GDPR does not define the rules on the assessment of damages, it is for the legal system of each Member State to prescribe the detailed rules regarding the criteria for determining the extent of the compensation payable in that context, subject to compliance with the principles of equivalence and effectiveness (§40 of the Judgement). Second, the CJEU held that as the right to compensation does not fulfill a dissuasive or punitive function, the gravity of the infringement cannot influence the amount of the compensation, and the amount cannot exceed the full compensation for that damage (§41 of the Judgement). However, the CJEU added that the financial compensation based on Article 82 GDPR must be regarded as ‘full and effective’ if it allows the damage actually suffered to be compensated entirely, without there being any need to require the payment of punitive damages (§42 of the Judgement). Therefore, the CJEU considered that in order to determine the amount of damages due as a compensation based on Article 82 GDPR, it is not necessary to apply mutatis mutandis the criteria for setting the amount of administrative fines under Article 83 GDPR (§44 of the Judgement). On the sixth question The data subjects argued that the infringement of provisions of the GDPR and of the German legislation applicable to tax advisers would result in an increase of the damages claimed under Article 82(1) GDPR. The CJEU indicated that pursuant to recital 146 GDPR, processing of personal data that is carried out in breach of the regulation also includes processing that infringes delegated and implementing acts adopted in accordance with the GDPR (§47 of the Judgement). However, the CJEU considered that the fact that the processing was carried out in breach of national law relating to the protection of personal data but not intended to specify the rules of the GDPR is not relevant for assessing the damages awarded under Article 82(1) GDPR. Therefore, the infringement of a national provision is not covered by Article 82(1) GDPR (§48 of the Judgement). The CJEU also added that if national law allows a national court to do so, it may award the data subject greater compensation than the full and effective compensation provided for in Article 82(1) GDPR, if the harm was also caused by the provisions of the national law (§49 of the Judgement). Thus, the CJEU concluded that to determine the amount of damages due as compensation under Article 82(1) GDPR, it is not necessary to take into account the simultaneous infringements of national provisions which relate to the protection of personal data, but are not intended to specify the GDPR (§50 of the Judgement).
DSB
The data subject applied for legal aid for court proceedings. The application for legal aid and the data subject’s objection as well as the decision of the district court to grant legal aid were submitted to the lawyer of the other party in the proceedings, who forwarded these documents, including the declaration of assets, to their client. Subsequently, these documents were forwarded by the other party in the proceedings to a third party. On 6 April 2023, the data subject lodged a complaint with the Austrian DPA (“Datenschutzbehörde – DSB”) against the other party for forwarding the documents to a third party. The DPA held that the forwarding of the application for legal aid, including the declaration of assets, violated the principle of data minimisation pursuant to Article 5(1)(c) GDPR. The other party appealed this decision at the Federal Administrative Court (“Bundesverwaltungsgericht - BVwG”). The court upheld the appeal and annulled the DPA’s decision. The court held that the DPA failed to question the third party, to whom the application for legal aid including the declaration of assets had been forwarded to, whether they had already been aware of the transmitted data beforehand. As the DPA had not made any findings on this question, the court could also not establish facts necessary for a decision on this matter. Therefore, the case should be referred back to the DPA to complete the facts of the case quickly and in a cost-saving manner. The DPA appealed this decision at the Supreme Administrative Court (“Verwaltungsgerichtshof - VwGH”) and argued that it cannot be inferred from the wording of Article 57(1)(f) GDPR that the DPA is obliged to investigate beyond "to the extent appropriate". In the present case, it could not be said that the "appropriate extent" of the investigation was not reached. Moreover, there was also a lack of case law from the Administrative Court on Article 57(1)(f) GDPR. The annulment of the DPA’s decision by the Federal Administr
Statistics Norway
On 19 February and 4 March 2023, a data subject contacted the Norwegian DPA to notify them about the Statistics Norway's (“the controller”) processing of personal data which they believed to be in violation with the GDPR. The data subject gave several examples on how the controller breached the GDPR, including that the controller collected all mobile data in Norway and that it sold confidential personal data identified by social security number. On 6 July 2023, the DPA replied in a letter that his inquiry had been dealt with. The DPA further stated that it would not carry out further investigations as they found it unlikely that a possible breach of the law would lead to corrective measures. Therefore, the DPA closed the case. On 25 July 2023, the data subject lodged a complaint with the DPA, requesting erasure from the controller and other controllers who received personal data from the controller. The DPA processed the complaint and upheld its decision to close the case without conducting further investigations. On 22 September 2023, the case was forwarded to the Norwegian Privacy Appeals Board (“Personvernnemnda”). The Privacy Appeals Board examined whether the DPA fulfilled their duty as supervisory body under the GDPR by closing this case without further investigations. According to Article 57(1)(f) GDPR, the DPA must handle a complaint lodged by a registered person and investigate, to the extent appropriate, the subject matter of the complaint and inform the registered person of the progress and outcome of the investigation within a reasonable period. The Board stated that the DPA has a certain freedom to decide how extensive the individual case requires investigation. In a previous case ([https://pvn.no/PVN-2017-09 PVN-2017-09]), the Board stated that the DPA is allowed to prioritise cases “to a certain extent that not all inquiries are treated equally thoroughly.” The DPA is required to fulfil its duty to investigate and provide information so that the parties of the case are sufficiently informed and that their assessment of the legality of the relevant processing of personal data appears sound. According to the Board, the DPA must take a position on the material question of whether the processing of personal data had been in breach of the GDPR after an investigation which can be quite superficial or in-depth depending on the nature of the case. If the DPA closes a case without taking a position on the material issues, this is a decision dismissing the case which gives the data subject the right to appeal to the Board. The question in this case was what leeway the DPA had, when it received an inquiry about possible breaches of the GDPR, to choose not to take a decision on whether the processing was in violation or not. It follows directly from the wording in Article 77(1) GDPR that the data subject must claim that an individual's personal data has been processed in a way that is in breach of the GDPR. The Board stated that this provision requires that the infringement must affect the person lodging the complaint. In the absence of this requirement, the notification should not be regarded as a complaint that obliges the DPA to carry out certain investigations. As both Article 57(1)(f) GDPR and [https://gdpr-info.eu/recitals/no-141/ Recital 141] state that the “investigation of a complaint should [...] be carried out to the extent that is appropriate in the specific case", the Board held that the case can then be dismissed without further investigation. The Board took into account a similar approach that was taken by the European Court of Human Rights (ECHR) on [https://www.coe.int/en/web/compass/the-european-convention-on-human-rights-and-its-protocols Article 34 ECHR]. This Article holds that the right of appeal exists only for the person who claims to be a victim of a violation of one or more of the rights in the convention. In the ECHR case [https://hudoc.echr.coe.int/eng#{%22itemid%22:[%22001-98428%22]} Tănase v. Moldova], the Court required that the person "must be directly affected by the impugned measure" in order to be considered a victim within the meaning of the Convention (see §104). Thus, the Court only decides on whether the application of the rules or the practice in question affected the person directly and in such a way that the convention has been violated. The Board stated that even if the ECtHR's practice under [https://www.coe.int/en/web/compass/the-european-convention-on-human-rights-and-its-protocols Article 34 ECHR] is not directly relevant to the interpretation of what constitutes a "complaint" in the sense of the GDPR, it can be applied similarly to the GDPR. The enforcement bodies (the ECtHR under the ECHR and the DPAs under the GDPR) must only deal with real and real cases from persons who can provide concrete and sufficient evidence that there has been a violation of protected rights. Statements of more or less unfounded suspicions or allegations without concrete evidence cannot trigger an obligation for the DPA to initiate investigations with the aim of clarifying whether there has been a GDPR violation of the processing of personal data. In several cases, the Board held that it is the task of the person lodging the complaint to explain the case and present documentation for the relationship complained of (see [https://pvn.no/PVN-2023-15 PVN-2023-15] and [https://pvn.no/PVN-2023-22 PVN-2023-22]). In this case, where the information provided in the inquiry did not in itself provide sufficient reason to suspect unlawful processing of personal data as the data subject is not personally affected, the inquiry could not be considered a complaint that obligated DPA to carry out further investigations according to Article 57(1)(f) GDPR. In such a case, the DPA can dismiss the case. Thus, the Privacy Appeals Board upheld the DPA’s decision to not further investigate the complaint.
CJEU case C-768/21 Land Hessen (Obligation of the data protection authority to act)
On 15 November 2019, the controller notified the Hessian DPA (“HBDI”) of a personal data breach pursuant to Article 33 GDPR as one of its employees had, on several occasions, unlawfully accessed personal data of one of the controller’s customers (“data subject”). The controller considered that this personal data breach was not likely to result in a high risk for the data subject as (i) it had taken disciplinary measures against the employee concerned, (ii) the employee had also confirmed in writing that she had not copied or retained the data, nor transferred it to third parties and (iii) she also promised not to do so in the future. In addition, (iv) the controller indicated that it would review the length of time for which access logs were kept. Therefore, the controller did not notify the data subject under Article 34 GDPR. However, the data subject became incidentally aware that his personal data had been improperly accessed and lodged a complaint with the HBDI regarding, inter alia, the failure to communicate the data breach to him in violation of Article 34 GDPR. On 3 September 2023, the HBDI informed the data subject that the controller did not infringe Article 34 GDPR, since the controller's assessment regarding the risk for the data subject was not manifestly incorrect. No corrective measures were adopted against the controller. The data subject lodged an action against this decision with the Administrative Court of Wiesbaden (Verwaltungsgericht Wiesbaden) asking it to order the HBDI to take action against the controller. The data subject indicated that the DPA had failed to handle his complaint in accordance with the requirements of the GDPR and, in particular, to adopt a measure under Article 58 GDPR. The Administrative Court of Wiesbaden referred a question to the CJEU: * When a DPA finds that a data processing has infringed the data subject’s rights, must the DPA always take action in accordance with Article 58(2) GDPR? Advocate General Priit P
juris GmbH
The data subject was a client of juris, a company operating a legal database (“controller”). On 6 November 2018, the data subject learnt that his personal data was being used by the controller for the purposes of direct marketing. The data subject therefore revoked his consent to receive information by the company by email or by telephone, and objected to the processing of those data, except for the newsletter which he wished to continue to receive. On January 2019, he received advertising leaflets to his business address. These leaflets contained a “trial personal code” which gave access to an order form for the controller’s products and included information relating to the data subject. This was confirmed by notary at the data subject’s request. In April 2019, the data subject informed the controller that the creation of those prospectuses constituted unlawful processing. He therefore requested compensation for the damage he suffered, under Article 82 GDPR. In May 2019, he received a new advertising leaflet and reiterated his objection by bailiff. The data subject sued the controller before the Landgericht Saarbrücken (Regional Court, Saarbrücken) requesting compensation for his material damage, relating to the costs of the bailiff and notary costs incurred by the data subject, as well as his non material damage. The controller argued that it has established a system for managing objections to marketing and that the late taking into account of the data subject’s objections was either (i) due to the fact that one of its employees had not complied with the instructions given or (ii) it would have been excessively onerous to take the objections into account. The Regional Court stayed the proceedings and referred four questions to the CJEU. The third and fourth questions were combined: # Is the infringement of the provisions of the GDPR which confer rights on the data subject sufficient to constitute non-material damage within the meaning of Article 82(1) GDPR? # Can the controller be exempted from liability by claiming that the damage was caused by the failure of a person acting under its authority under Article 29 GDPR? # In order to determine the amount of damages due as a compensation under Article 82(1) GDPR, is it necessary: #* To apply mutatis mutandis the criteria for setting the amount of administrative fines under Article 83 GDPR? #* To take into account of the fact that several infringements of the GDPR concerning the same processing operation affect the data subject? On the first question: Article 82(1) GDPR indicates that any person ‘who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered’. The Court indicated that the right to compensation under Article 82(1) GDPR requires three cumulative conditions: (i) an infringement of the GDPR, (ii) a damage suffered and (iii) a causal link between the infringement and the damage ([https://gdprhub.eu/index.php?title=CJEU_-_C-687/21_-_MediaMarktSaturn CJEU, C-687/21, MediaMarktSaturn]). The Court also noted that under Article 79(1) GDPR, every data subject has the right to an effective remedy if they consider their rights under the GDPR gave been infringed. However, the Court pointed out that this provision merely confers a right to bring an action without exempting them from their obligation to prove that they have actually suffered material or non-material damage. Therefore, the infringement of provisions of the GDPR which grant rights to the data subject is not in itself sufficient to found a substantive right to obtain compensation, irrespective of the degree of seriousness of the damage suffered by the data subject. On the second question: Article 82(2) GDPR establishes that any controller involved in the processing is to be liable for the damage caused by processing which infringes the GDPR. Article 82(3) GDPR indicates that a controller is exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage. The Court indicated that under Article 29 GDPR, persons acting under the authority of the controller and who have access to personal data may, in principle, process those data only on instructions of the controller. An employee of the controller is a natural person acting under the authority of the controller. Therefore, the controller must ensure that its instructions are correctly applied by its employees. A controller cannot avoid liability simply by relying on negligence or failure on the part of a person acting under its authority. The Court added that the exemptions provided for in Article 82(3) GDPR must be strictly limited to cases in which the controller is able to demonstrate that the damage is not attributable to it. Thus, the controller may only benefit from the exemption if it proves that there is no causal link between the breach of the data protection obligation incumbent on it and the damage suffered by the data subject. The CJEU concluded that the controller may not benefit of the exemption from liability under Article 82(3) GDPR if it demonstrates that it had given instructions to persons acting under its authority and that the persons failed to follow the instructions. On the third and fourth questions: Regarding the taking into account of the criteria set out in Article 83 GDPR, the Court indicated that the two provisions pursue different objectives: while Article 83 GDPR determines the ‘general conditions for imposing administrative fines’, Article 82 GDPR governs the ‘right to compensation and liability’. The Court added that Article 82 GDPR has a function that is compensatory, whereas Article 83 GDPR essentially has a punitive purpose. Therefore, the CJEU held that the criteria set out in Article 83 GDPR cannot be used to assess the amount of damages under Article 82. The Court pointed out that the GDPR does not contain any provision relating to the assessment of the damages due under the right to compensation pursuant to Article 82 GDPR. Therefore, the national courts must apply the domestic rules of each Member State. Regarding the taking into account of multiple infringement affecting the same data subject, the Court held that in view of the compensatory function of Article 82 GDPR, the fact that several infringements have been committed by the controller to the same data subject cannot constitute a relevant criterion for the purposes of assessing the compensation to be awarded. The Court indicated that only the damage actually suffered by that person must be taken into consideration when determining the monetary compensation.
CJEU case C-61/22 Landeshauptstadt Wiesbaden
Facts pending decision. Question referred: Does the obligation to take fingerprints and store them in identity cards in accordance with Article 3(5) Regulation (EU) 2019/1157 of the European Parliament and of the Council of 20 June 2019 on strengthening the security of identity cards of Union citizens and of residence documents issued to Union citizens and their family members exercising their right of free movement (OJ 2019 L 188, p. 67) infringe higher-ranking EU law, in particular (a) Article 77(3) TFEU (b) Article 7 CFR and Article 8 CFR (c) Article 35(10) GDPR and is it therefore invalid on one of those grounds?