GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
The controller is a publisher who made an online publication containing personal data of the data subject, which could still be found in the websites archives. The data subject requested deletion of this information from the archive based on their right to be forgotten (Article 17 GDPR) but the controller denied the request for undisclosed reasons. Subsequently, the data subject complained to the Polish DPA, claiming that the controller had no legal basis to publish the respective personal data. Polish law provides exemptions from the applicability of the GDPR for journalistic activity, based on Article 85(2) GDPR. According to [https://lexlege.pl/ochr-danych-osob/art-2/ Article 2(1) of the Polish Data Protection Act], most of Chapter II and III of the GDPR do not apply to press materials. The DPA argued that the publication was a manifestation of 'journalistic press activity' and therefore did not need a legal basis under the GDPR based on the exception contained in [https://lexlege.pl/ochr-danych-osob/art-2/ Article 2(1) of the Polish Data Protection Act]. Hence, the DPA refused to open administrative proceedings against the controller and rejected the complaint. The data subject (the plaintiff) complained in national court against the DPA's (the defendant) decision to not initiate proceedings. The dispute essentially concerned two issues. First, whether the maintenance of a particular publication on the publisher's portal - in the archives - constituted 'press activity' which partially excluded the applicability of the GDPR. Second, whether Article 17 GDPR applied also in matters relating to press activity. With regards to the first issue, the Provincial Administrative Court in Warsaw ruled that any publication, no matter when released, also when containing personal data, is to be considered press material. Concerning the second point, the Court recalled Article 17(3) GDPR, which excludes the application of the right to be forgotten when it is 'necessary' for
The data subject was a Facebook user. While using the service, the data subject provided different personal information, including their city of residence, “relationship status” (both publicly visible on their Facebook profile) and phone number (not immediately visible on the platform). However, according to the privacy settings selected at the moment of the facts, the phone number could be used by a third person to find the data subject’s profile on Facebook. Accordingly, information relating to the data subject could be linked to their phone number by anyone in possession of such a number. In 2021, unknown “third parties” automatically combined telephone numbers and matched them with Facebook profiles thanks to the above-mentioned function. In this way, telephone numbers could be assigned to identified users. This resulted in a data breach concerning 533 million people in 106 different countries. The data subject lamented that since then they received anonymous calls and a huge amount of spam. This entailed negative psychological consequences for them. Thus, the data subject asked for €1,000 in non-material damages under Article 82 GDPR. The controller replied that data scraping - which is not hacking - does not entail a violation of the GDPR by the controller, as no mandatory security measures where circumvented. In Facebook’s view, third parties merely had access to publicly available information. The court rejected the request for damages under Article 82 GDPR. Pursuant to this provision, any data subject has the right to receive compensation for material or non-material damages whenever their rights under the GDPR were infringed by a controller or processor. In assessing the oral declarations of the data subject, the court held that the data breach, despite annoying, did not seriously harm the data subject. As a matter of fact, the data subject was only concerned about the possibility that their data could be misused in the future. According to the court,
The case entailed a dispute between a bank (the data subject) and a tax office (the processor). In 2019 the plaintiff, here the bank, had received a letter from the tax office, here the data processor, which informed the plaintiff about results of certain tax investigations in relation to investment funds in which the plaintiff was custodian. The plaintiff sent the tax office a letter on the basis of Section 91 of the Fiscal Code to exercise his right to be heard and for inspection of those fails. The tax office rejected the letter and also following objection of the bank. In response the plaintiff filed a lawsuit with the Munich Finance Court against the rejection of the information on the basis of Article 15(3) GDPR. The bank was aiming to obtain a copy of its data processed by the tax office and annul the earlier decision of the tax office. The tax office rejected the claims of plaintiff and provided that right to inspect the files or to receive a copy of the content of the files concerned does not fall under the scope of Article 15 GDPR. Furthermore, the tax office was ofmthe opinion that a claim for the information had already expired as the plaintiff already had the needed information. The FG München dismissed the claim. It held that, even though data subject would have a right to a acess under Article 15 GDPR, then it does not extend to current circumstances. The court held that GDPR does not vest the data subject with a right to full texts within a file, especially if the files contain unrecorded source data. The court ruled that the right to information under GDPR extends in the present case only to the input data processed for the specific tax assessments. The court was of the opinion, that the tax office had done all that is necessary and that is required by law by providing the plaintiff with the documents on capital gains and there are no reasons to doubt about the truthfulness of the tax office. The plaintiff can exercise rights stemming from p
The data subject held a property insurance policy with a controller, insuring against storm damage. The Controller is member of the Association of the German Insurance Industry and reports to the Insurance Industry's Reference and Information System. On 15 March 2019, the data subject submitted eight photos claiming storm damage to his property and the controller compensated the €2,840 claimed damage. Subsequently, on 17 December 2019, 3 February 2020, and 1 March 2020, the data subject filed additional claims using the same photos. The controller refused payment for these claims and subsequently canceled the insurance policy and reported the data subject to the informa HIS GmbH, operator of the Insurance Industry's Reference and Information System, indicating "anomalies in the claim process." The data subject filed a complaint with the DE-HE DPA, which transferred it to the DE-BW DPA as lead authority for the customers insurance. The DE-BW DPA ordered the controller to delete the entry in the Insurance Industry's Reference and Information System, arguing the controller lacked legitimate interest under Article 6 GDPR#1f. The VG Stuttgart overturned the DE-BW DPA's decision, stating that the controller had a legitimate interest under Article 6 GDPR#1f to report the anomalies to the Insurance Industry's Reference and Information System. The court emphasized that the legitimate interest does not require an actual fraud attempt, only that fraud-related anomalies exist according to Insurance Industry's Reference and Information System's guidelines. The court held that the data subject's insurance company was entitled to assess and manage risks based on potential fraudulent behavior. The repeated use of identical photos for separate claims indicated a significant probability of fraud, justifying the controller’s actions. Further, the data subject's rights did not outweigh the insurance company's legitimate interests. First, the court held that the controller’s processin
The case concerns the legality of a request for documents. The controller was the owner of several apartments. The Bavarian tax authority required the controller to provide several documents, including their rental contracts. The controller submitted the rental contracts but redacted the names of the tenants. They explained that it was not possible to disclose personal data without consent. The names were also not necessary for an examination of their actual income. The tax office dismissed the objection and requested the landlord to submit the names of the tenants. The tax office stated that a tax payer is obliged pursuant to § 90 Section 1 of the Fiscal Code (Abgabenordnung - AO) to cooperate in determining the facts. This obligation to cooperate also includes the obligation to submit documents. The tax office needed the names of the tenants and the respective rental agreements to check the tax-relevant circumstances. As a matter of fact, tenants' name were required in order to assign payment flows to the respective tenancy individually. Therefore, the document request was appropriate and reasonable. The controller was entitled (and obliged) to name the tenants to fulfill their tax obligations in accordance with Article 6(1)(c) GDPR. The controller brought an action before the finance court. They took the view that the personal data of the tenants contained in the apartment rental contracts were protected by the GDPR. The landlord was therefore not allowed to disclose this data to third parties without the tenants' consent. The Nuremberg Financial Court dismissed the action. The tax office was allowed to request the documents at issue. The German legislator used the open clause of Article 6(1)(c) and (e) GDPR, in combination with Article 6(2) and Article 6(3) GDPR, to create a legal basis for the processing of personal data by tax authorities pursuant to § 29(b) AO. The processing of personal data by a tax authority is permitted if it is necessary to fulf
An employer dismissed an employee for having allegedly faked their sick leave. The employer also refused to provide access to the employee’s personal data following an access request pursuant to Article 15 GDPR. The data subject brought action against the controller for unjustified dismissal and claimed non-material damages under Article 82 GDPR for failure to reply to the access request. The court of first instance upheld the data subject’s claim and granted €1,000 of compensation for violations of Article 15(1) GDPR. The controller appealed the decision, arguing that there was no basis for the claim. The data subject appealed the decision, too. In the data subject's opinion, damages awarded were not sufficient. The Regional Labour Court of Hessen (Hessisches Landesarbeitsgericht) confirmed that the controller disregarded their duties pursuant to Article 15 GDPR, as they did not provide access to requested information within the deadline set forth in Article 12(3) GDPR. This led to liability for non-material damages. The Court completely refused the idea that Recital 146 GDPR can be interpreted as limiting the applicability of Article 82 GDPR to processing operations infringing the Regulation. To the contrary, non-compliance with an access request can give rise to damages because it occurs in the context of a processing, even if it cannot be considered "processing" itself. In addition, the Court denied that non-material damages require a certain degree of seriousness to be taken into account. The court of appeal also increased the total amount of the compensation to €2,000. The court stressed that damages have a special and general preventive function, alongside with a compensatory one. However, an even higher compensation was not admissible, as the lack of reply to an access request merely entails insecurity and lack of control over personal data, but not a violation of the data subject’s personality rights.
A data subject was accused of a criminal offence and refused to consent to the collection of her genetic and biometric data (Photographs and fingerprints), which the Bulgarian Police required to create a record. The data subject also refused to let the police take a sample for the purpose of creating a DNA profile. In the end, the police did not collect this data. The police went to a Bulgarian Criminal court (Spetsializiran nakazatelen sad), which was also the referring court in this case. Here, the police asked the court to authorise the forced collection of the genetic and biometric data, considering there was enough evidence to convict the data subject of the crime. The police position was mostly based on Bulgatian law (ZMVR, Law of the ministry of Home affairs) authorising the collection of biometric and genetic data for, among the others, law and order purposes. However, the referring court had doubts whether the such law was actually compliant with EU law. This Bulgarian law did refer to Article 9 GDPR, but did not refer to [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016L0680&from=DE#d1e1816-89-1 EU directive 2016/680]. The latter is an EU directive which concerns the protection of personal data regarding processing of competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. This directive states that the processing of certain special category data, including genetic and biometric data, can be lawful if this is compliant with EU law or national law. The Bulgarian law had even taken over some of the wording from Article 10(a) of this directive for its national provision. The court determined that there were two problems resulting from the fact that this national law contained a reference to the GDPR, but did not mention the aforementioned directive. The first problem was the fact that the GDPR was not applicable to the processing
In this case an individual was seeking to exercise data subject rights on behalf of his deceased father, against a bank (the controller). The individual in question had submitted an access request to the bank and subsequently made a complaint, dated 1 October 2018, alleging that the information he received from the controller was incomplete. In particular, he asserted that his father’s bank details were not included, even though he had inherited the data subject rights of his father. On 19 August 2021 the DPA rejected the complaint, the individual subsequently appealed this decision to the Federal Administrative Court (BVwG), on 24 September 2021. The BVwG dismissed the appeal in its entirety. In doing so, the Court referred to Recital 27 which clarifies that “this regulation does not apply to the personal data of deceased persons”. Furthermore, the court outlined that “an assertion of the right to information (right to access) under Article 15 GDPR on behalf of the father through his son as heir, is out of the question…. The fundamental right to data protection or the right to information is a highly personal right that only the data subject can exercise themselves… Accordingly, highly personal rights cannot be inherited”. Accordingly, the data subject had no right to access this data under Article 15 GDPR.
The Swedish Privacy Authority (IMY) decided on 21 June 2021 that AB Storstockholms Lokaltrafik (SL) would pay an administrative fine of SEK 16 million under the General Data Protection Regulation of which - SEK 4 000 000 relates to SL's use of body-worn cameras to preventing and documenting threats and violence, through the use of pre-recording technology for one minute, - SEK 8 000 000 relates to SL's use of body-worn cameras to ensure the identity of passengers liable to pay a surcharge, and - SEK 4 000 000 relates to SL's failure to provide information to data subjects. SL first intended to use the body-worn cameras on 4-10 ticket inspectors in the metro during a test period starting from December 2018. Test period was extended and later introduced permanently. The body-worn cameras are used since they became permanent by about 55 ticket inspectors on weekdays and 20 ticket inspectors on public holidays across the network. The technology works as follows a camera and microphone continuously record images and sound. The cameras have a circular memory that allows any video footage older than one minute to be is automatically cleared unless the ticket inspector activates a recording. Then the footage from one minute back from when the recording was activated (so-called automatic pre-recording). The ticket inspector has been instructed to activate recording when the to issue a surcharge or when threatening or violent situations arise. The footage from the camera is uploaded after the shift to a server where it reviewed by a few evidence administrators. The case was appealed to Stockholms förvaltningsrätt, where they dismissed the administrative fine regarding against SL's use of body-worn cameras to preventing and documenting threats and violence, through the use of pre-recording technology for one minute, Förvaltningsrätten considers that the evidence supports that SL's use of body cameras with a one-minute pre-recording is both necessary and propo
In June 2020, the data subject made an access requesto to the controller, her employer, pursuant to Article 15(1) GDPR. The controller rejected the request and refused to provide information. Shortly afterwards, the employment relationship ended between the parties. In November 2020, the data subject asserted her claim for a copy of her personal data processed by the controller within the meaning of Article 15(3) GDPR. In addition, she judicially demanded compensation for non-material damages of at least €5,000 pursuant to Article 82 GDPR, as the controller had not complied with the obligation to provide the requested data in time. In the first instance, the Bamberg Labour Court awarded the data subject a claim for payment of non-material damages in the amount of €4,000 pursuant to Article 82(1) GDPR in conjunction with Article 15 GDPR. In the opinion of the Labor Court, violations must be effectively sanctioned and the damages must have a deterrent effect in order to help the GDPR achieve its purpose. The judgment was appealed by the controller. During the appeal, the controller argued that the data subject was motivated not by concerns regarding the use and processing of her personal data, but rather by a desire for personal gain. The controller requested that the lower court's judgment to be revised accordingly. The State Labour Court Nürnberg upheld the controller's appeal. On the basis of Article 82(1) GDPR, the data subject was not entitled to compensation for non-material damages from the controller, as the data controller's actions did not meet the legal definition of data processing under Article 4(2) GDPR. As a matter of fact, a violation of Article 15 GDPR regarding the obligation to provide information does not automatically entail the controller's liability in terms of damages. To the contrary, any claim for damages under Article 82(1) GDPR requires an unlawful data processing as defined under Article 4(2) GDPR. Cases of incorrect or delayed inform
This case is an appeal of a decision in which the DPA fined a municipality (the controller) about €352,555 (NOK 4,000,000) for violating Article 5(1)(f) GDPR, Article 24 GDPR and Article 32 GDPR after a serious ransomware attack led to highly sensitive personal data being irreparably lost and sold on the dark web. The controller disagreed with the DPA on the part of the decision pertaining to the fine and asked them to reconsider their position. After the DPA had reviewed the case again, they found no grounds to change their decision and so, as per Norwegian procedures, referred the case to the Privacy Appeals Board. In their comments to the Privacy Appeals Board, the controller argued that the grounds for an administrative fine were non-existent. They also held that they had implemented sufficient technical and organisational measures available to them as per their internal resources and in line with Article 24 GDPR and Article 32 GDPR. The Privacy Appeals Board reviewed the case, both parties' arguments, grounds for imposing an administrative fine as per the GDPR, as well as the objective and subjective grounds for assessing if personal data breaches took place. After assessing the controller's personal data practices, the Privacy Appeals Board held that they agreed with the DPA in that the various deficiencies represented fundamental shortcomings in the controller's information security, resulting in violations of Article 24 GDPR and Article 32 GDPR. When assessing the subjective grounds, however, the Privacy Appeals Board noted that the DPA had taken an incorrect legal standpoint and interpreted the legality inaccurately. They disagreed with the DPA's interpretation that the Chief Municipal Executive was objectively responsible for the personal data breaches, regardless of him acting negligent. In the Privacy Appeals Board's view, the insufficient IT security must be sees against a lack of focus over time, long before the Chief Municipal Executive was employed
The controller operates several websites. The data subject stated that, as a consumer, he ordered household goods from the controller's online shop in 2020, giving his name and address. According to the data subject, the controller violated data protection law in several ways. He stated that the controller had deliberately integrated malware into its site, which manipulated the data subject's internet browser. Thereby, personal data had been unlawfully processed by the controller itself, as well as being irrevocably forwarded to foreign third party companies in order to track his online behaviour by setting cookies without his consent. Due to the alleged violations, the data subject claimed to be entitled to injunctive relief for infringement of Article 6(1) GDPR. Furthermore, he argued the infringement of Article 26 GDPR (joint responsibility) and Article 44 GDPR (third country transfer). The controller argued that the data subject had not sufficiently substantiated his claim since he had neither specified the processing of his data that allegedly took place nor described it accurately. Moreover, according to the controller, there is no basis for a claim because the GDPR does not provide for injunctive relief under civil law. The Regional Court Wiesbaden found the data subject's action both inadmissible and unfounded. First, the court stated that the data subject's claim was not sufficiently specific as it did not specify what exact behaviour he wanted to prevent with the injunction. Then, the court added that the lack of specification of the exact data processing activity also made the claim unfounded as the data subject had not even given information on what and when he ordered in what specific online shop of the controller. To the court it was clear that the data subject was not concerned with being affected in a specific case where he saw his personal rights violated, but rather a fundamental abstract clarification. There had been no pre-judicial correspon
During the Covid-19 pandemic, a vaccination hub accidentally disclosed by email personal data of several hundred people, including their choice to adhere to the mass vaccination. One of the data subjects involved in this data breach asked the controller for non-material damages. They claimed that the violation posed significant risks to their fundamental rights. In particular, they stated to have received a phishing email from an alleged "European Consumer Protection Agency" aiming to steal their and other data subjects’ data from the vaccination hub’s previous email. The data subject also claimed that data could end up in the hands of violent anti-vaccination militants. Therefore, the data subject held to be entitled to non-material damages for an amount of €10,000 pursuant to Article 82 GDPR. In the first instance judgement, the controller stressed that the data subject made their own vaccination data publicly available on Facebook. Thus, no violation occurred with regards to their health data. Moreover, the controller claimed that Article 82 GDPR requires fault, whereas in the present case there was only slight negligence by an employee of the controller. In addition, the controller denied that the data subject suffered any negative consequence: the fundamental rights violations lamented were in fact just abstract and unlikely to happen. In any case, no causal link between such negative consequences and the controller’s conduct could be found. The controller also stressed that the definition of non-material damages under GDPR was unclear and several questions concerning the interpretation of Article 82 GDPR were currently pending before the CJEU. The Court of first instance found that Article 82 GDPR applied in the case at issue. The controller unlawfully processed personal data, including health data, and violated Articles 5(1)(f), 9 and 32 GDPR. A “loss of control” over personal data is sufficient to substantiate non-material damages in accordance with Articl
This case concerns an access request submitted by a data subject, under Article 15 GDPR, to a money transfer and payment services company which primarily offers consumer and digital money transfers, the controller. The access request was submitted on 24 July 2019. On 16 December 2019, the data subject filed a complaint with the relevant DPA. The controller responded on 21 February 2020 that it had complied with the access request “in full and good time”. At this point in proceedings, the data subject was able to see, from the controller’s statement, that the controller had used an online platform to comply with the access request. The data subject had previously received two emails through this online platform, but did not want to open them as the sender was not known to her at the time and the controller had not informed her that they would be using this system. According to their submissions to the DPA, the data subject had concerns over this platform, and did not want to use it, as it required her to create an account and provide an ID card. She therefore requested that the controller send a physical copy of the requested information via a trackable express courier service, the controller agreed to do so. The proceedings before the DPA continued and, in a submission dated 2 August 2021, the data subject asserted that the controller had not provided the information via courier as agreed. The DPA held in favour of the data subject, finding that the controller had violated Articles 12 and 15 GDPR, and ordered them to provide the information within 4 weeks. The controller appealed this decision to the Federal Administrative Court (BVwG), essentially alleging that the DPA had issued its decision unlawfully and on the basis of inadequate findings of fact. The controller submitted that the data subject had submitted the access request on 24 July 2019, then on 8 August 2019 the controller asked for proof of identity, which the data subject provided on 16 August 2019. Aft
The controller run some websites that make use of Google tools. When users interacted with such tools their personal data were transferred to the US, allegedly in violation of the GDPR. The data subject visited some of these websites via web crawling and claimed damages for data protection violations. The controller considered the data subject's request unfounded and brought an action for injunctive relief before the Regional Court of Baden-Baden. The controller asked the court to order the data subject to refrain from further warnings and requests, as the data subject had no right to compensation under the GDPR. The court held that the controller's request was admissible and justified. The court pointed out that the CJEU case law allows the application of national law enabling judges to check the existence of abuses of EU rights by the parties (see [https://curia.europa.eu/juris/liste.jsf?nat=or&mat=or&pcs=Oor&jur=C%2CT%2CF&num=C-373%252F97&for=&jge=&dates=&language=en&pro=&cit=none%252CC%252CCJ%252CR%252C2008E%252C%252C%252C%252C%252C%252C%252C%252C%252C%252Ctrue%252Cfalse%252Cfalse&oqp=&td=%3BALL&avg=&lg=&page=1&cid=2070463 C-373/97]). In the present case, such parameter is the standard of "good faith" under § 242 of the German Civil Code (Bürgerliches Gesetzbuch - BGB) which, according to the court, the data subject had violated in the present case. This results from the fact that, contrary to the data subject's submissions, their primary interest when accessing the websites was the generation of claims for damages against the controller. The court rejected the data subject's statement that their main concern was to denounce data protection violations. Besides, the court held that the risk that inexperienced users came to the webpages was very low. A violation in the form of unlawful data transfers materialised only because the data subject intentionally looked for it with an aim of asking for non-material damages. As a further argument to substantiate the
This case originally concerned a complaint filed by a (soon-to-be-ex) husband, the data subject, against his (soon-to-be-ex) wife. During divorce proceedings the wife had commissioned an expert to calculate the amount of maintenance she would be due. This was determined on the basis of the data subject’s personal information – including income, property value, and the economic figures of a private foundation of which both parties were beneficiaries – which the claim alleges had been obtained unlawfully. For clarification, it is important to note from the outset that, in this case, the controller is the expert who was commissioned by the wife, and the wife is a third party within the meaning of Article 4(10) GDPR. Initially the complaint was filed with the DPA, which stated that it could not be established how the wife had obtained the relevant data. Furthermore, the authority found that while in principle the information was personal data worthy of protection, the existence of overriding legitimate interests on the part of the complainant’s wife made the processing lawful (Article 6(1)(f) GDPR). It was also pointed out that the wife, as a beneficiary of the private foundation, had a right to information in accordance with § 30(1) of the Austrian Private Foundation Act. This decision was appealed to the Federal Administrative Court, the data subject argued that an economic interest in accessing the information – whether it be the wife’s legitimate interest or the expert’s interest in fulfilling a contract – should never outweigh his constitutionally protected fundamental right to data protection. Also, according to the established case law of the civil courts, a private expert opinion is merely a private document which exclusively reflects the opinion of its author and is not suitable evidence in divorce proceedings. The Federal Administrative Court upheld the appeal and found that the controller, as the responsible party, had unlawfully processed the data in violati
On 26 April 2019, a shareholder of a Hungarian public limited company attended its general meeting. The meeting was recorded and the shareholder, as a data subject, asked the company, as the controller, to send him the recording. The controller only provided him with the excerpts which reproduced his contributions, excluding those of the other persons attending the general meeting. The data subject filed a complaint with the Hungarian DPA asking it to order the controller to provide the complete recording, which the DPA refused in its decision of 29 November 2019. After this, the data subject started two proceedings at the same time, one against the controller and one against the Hungarian DPA. The first proceeding was filed with the Budapest Regional Court based on Article 79(1) GDPR. In this proceeding, the data subject asked the Court to order the controller to provide him the entire recording. The Regional Court found that the controller had violated the data subject's right of access and upheld his request. This decision became final. The second proceeding was filed with the Budapest High Court pursuant to Article 78(1) GPDR. In this proceeding, the data subject asked the High Court to anull the DPA's decision. This Court would later ask the preliminary questions to the CJEU which resulted in this ruling. As the decision of the Regional Court had already become final, the High Court was faced with a problem when it had to decide the request for annulment of the DPA decision. This is because both procedures referred to the same facts, which could lead to contradictory decisions and, consequently, to legal uncertainty. According to the High Court, the DPA's independence would be compromised if it were bound by the decision of the Regional Court. In those circumstances, the High Court decided to stay the proceedings and to refer the following questions to the CJEU for a preliminary ruling: ‘(1) Must Articles 77(1) and 79(1) GDPR be interpreted as meaning that
A data subject sent an access request to the Austrian Post (the controller) to obtain information about what personal data about him was processed as well as whether it was disclosed to third parties, and if yes, who these recipients were. The controller provided a generic response regarding the recipients of personal data, only referring to a general website naming activities of the recipients, such as telephone directories or marketing actors. The controller did not inform the data subject about the specific identity of the recipients. Consequently, the data subject took action before Austrian courts in order to obtain information about specific recipients. Both the court of first instance and appeal dismissed the action by stating that Article 15(1)(c) GDPR gives the controller disrection to choose whether they wish to provide information about 'recipients' or 'categories of recipients' only. In the meantime, the controller provided information with regards to the categories of recipients, which included charities, NGOs and political parties, but refused to reveal their identity. The Austrian Supreme Court decided to refer the matter to the Court of Justice of the European Union (CJEU, the Court) in order to obtain clarification on the interpretation of Article 15 GDPR. The Supreme Court asked the following preliminary question: 'Is Article 15(1)(c) of the GDPR to be interpreted as meaning that the claim is limited to information on categories of recipients if specific recipients have not yet been determined in the case of planned disclosures, but the right to information must necessarily also extend to recipients of these disclosures if data have already been disclosed?' Advocate General Pitruzzella noted that provisions of EU law must be interpreted in a way as to ensure their effectiveness. Since Article 15 GDPR provides a genuine right of access, it is a necessary pre-condition for the exercise of other data subject rights under the GDPR. Moreover, it fol
On 4 April 2022, the Belgian DPA issued [https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-48-2022.pdf decision 48/2022], in which it fined Brussels Airport €200,000 for the use of thermal cameras and temperature checks for COVID-19 detection purposes. It also fined the Ambuce Rescue Team €20,000 for carrying out a second test (second-line control) for passengers at Brussels Airport with a temperature of 38°C or higher. The DPA held these controllers lacked a lawful ground for processing these special personal data. For more information on this decision, see the [https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_48/2022 GDPRhub summary]. Ambuce and the Airport both appealed this decision with the Market Court, where they were jointly decided. Both parties questioned the impartiality of the DPA, because one of its members was also the ‘program director’ at a non-profit focused on digital data protection (NOYB). This was supposedly incompatible with his mandate as a member of the Dispute Chamber of the DPA and in violation with Articles 52(1) and 52(2) GDPR and Article 44(1) WOG. Ambuce and the Airport also questioned their qualification as joint controllers as far as the second-line control was concerned. Lastly, they argued that the fines imposed on them were not adequately justified. Brussels Airport further argued that the DPA misused its power. According to the Airport, the purpose of the contested decision was to set an example and to denounce the practice of not consulting the DPA in any legislative initiative. In addition, the DPA allegedly breached the principles of reasoning and due care. Further, Ambuce stated that the publication of the press release of 17 June 2020 infringed Article 54(2) GDPR and Article 48(1) and Article 64(3) WOG. This press release described that the DPA was 'worried' about the installation of these thermal camera's. In addition, Ambuce held that it's rights of defence and article 92(3) WOG were n
The controller is a Dutch public broadcaster. On their website, they offer a forum, on which registered people can post articles and respond to other articles. The data subject was since 2015 a member of the form and published over 20.000 posts on the forum. On 14 June 2021, the data subject requested access to the posts, in which, according to the controller, he was guilty of picking a personal fight and writing an off-topic post. On 3 February 2022, the controller banned the data subject, because of a fight with another member on the forum. On 21 February 2022, the data subject requested access to information on which house rules he allegedly broke, the messages that allegedly broke these house rules, the opening post of the topic and other posts by others, insofar as they are relevant to establish the violation, any comments on the posts, the comments made by this third party about the data subject that also violated the house rules. On 7 March 2022, the data subject repeated his access request to the controller. On 25 March 2022, the data subject started an action by application (“verzoekschrift”) at the the District Court of First Instance of Central Netherlands (“Rechtbank Midden-Nederland”). The data subject requested the court to order the controller provide a copy of his personal data as requested in his access request, but also all the information under Article 15(1) GDPR. The data subject further requested the court to impose a penalty. The controller argued that the data subject had no right of access, because the data subject’s profile name was not personal data. As it was a pseudonym and not the actual name of the data subject, the data subject was not identifiable. Moreover, the controller invoked journalistic exception under [https://wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=43&z=2018-05-25&g=2018-05-25 Article 43 of the Dutch national implementation law of the GDPR] (“Uitvoeringswet Algemene verordening gegevensbescherming – UAVG