GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
ZS is employed at KISA since the 1st January 2002. KISA, obliged according to the GDPR as well as the BDSG (Federal Data Protection Law) to nominate a DPO, nominated him the 27th February 2004 as Data Protection Officer. With letter the 15th August 2018 discmissed KISA ZS as DPO with effect 31st August 2018 and justified this, that a conflict of interest exists between his activity as DPO and his other professional activity. ZS argued that in this case there is a lack of an important reason justifying his dismissal. The Federal Data Protection Law stipulates that: The dismissal of the data protection officer shall be permitted only by corresponding application of Paragraph 626 of the Bürgerliches Gesetzbuch (German Civil Code). According to this law, dismissal is only legitimate if there are facts which justify, based on an important reason, the dismissal without notice. Article 626 of the Civil Code states: The service relationship may be terminated by either party to the contract for a compelling reason without complying with a notice period, if facts are present on the basis of which the party giving notice cannot reasonably be expected to continue the service relationship to the end of the notice period or to the agreed end of the service relationship, taking all circumstances of the individual case into account and weighing the interests of both parties to the contract. The second sentence of Article 38(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as not precluding national legislation which provides the a DPO employed by a controller or a processor can be only dismissed due to an important reason, even when the dismissal is not in relation of his taks, as far as this rule does not undermine the achi
In June 2020 the Municipality of Ummendorf published meeting minutes and a judgement by the Administrative Court of Sigmaringen on their website. The meeting minutes contained the names of a data subject and the judgement their names and address of domocile. Interestingly, the names of the other parties within the judgement had already been redacted by the municipality before uploading it to their website. The data subject claimed damages under Article 82(1) GDPR and argued that no minimum threshold should be applied. The municipality argued that Article 82(1) requires proof of noticeable disadvantage and objective comprehensible impairment of personal interests. For a non-material damage to exist, they argued that the deminimis threshold must be exceeded. The case was appealed to the Ravensburg Regional Court who reffered one question to the CJEU: 1) Does Article 82(1) GDPR require noticeable disadvantage and comprehensible impairment of personal interests from the data subjest, or is the mere short-term loss of control over their personal data for a few days which did not have a noticeable consequence sufficient for non-material damages? The CJEU decided that Article 82(1) GDPR has its own definition under EU Law and that this definition overrides national legislation. Other conditions for establishing liability, such as in this case the tangible nature of the damage or the objective nature of the infringement, cannot be added. First, non-material damages under the GDPR require three cumilative conditions (para 14): 1) The existence of the infringement of the GDPR 2) damage that has been suffered and 3) a causal link between that damage and infringement (see [https://gdprhub.eu/index.php?title=CJEU_-_C-300/21_-_%C3%96sterreichische_Post_AG C-300/21 - Österreichische Post AG] and C‑340/21 - Natsionalna agentsia za prihodite). Second, Article 82(1) GDPR does not reference national law which means that a member state's definitions of non-material damages bey
This decision is the result of an appeal against a Spanish DPA (AEPD) decision (a summary is available on GDPRhub) which fined Banco Bilbao Vizcaya Argentaria, SA (BBVA) a total of €5,000,000 for violating articles 6, 13 and 14 of the GDPR. The bank filed a judicial appeal against the DPA decision. Among other aspects, BBVA claimed that there was a total disconnection between the object of the procedure by the DPA and the complaints made by the data subjects. It argued that the DPA used specific and individual facts and complaints as an excuse to initiate a sort of general review of BBVA's practices and their data protection policy. While rejecting some of the arguments of BBVA, the Court agreed that there is a relevant disconnection between the initial complaints and the final DPA decision. The Court stressed that Article 57(1)(f) GDPR enables the DPA to investigate facts or the subject matter of the complaint. However, the Court considered that this would not cover the opening of a general procedure against the data protection policy itself. In its reasoning, it referred to one of its previous decisions from 23 April 2019 (Rec. 88/2017), in which it defined criteria for the application of the principles of the administrative sanctioning procedure within the scope of the DPA. In the case at hand, the judges agreed that the DPA failed: (i) to examine the facts reported in the complaints; (ii) to make an assessment of the evidence in relation to those facts; and (iii) to link the facts to the data protection policy document. Rather, they found that the DPA opened a general investigation into the data protection policy of BBVA. In the Court's view, the DPA was bound by the facts of the data subject complaints. Therefore, the DPA is (at least initially) limited to investigate said facts or the "subject matter of the complaint". The Court invoked the principle of legality, provided for in Article 25(1) of the [https://www.boe.es/buscar/pdf/1978/BOE-A-1978-31229-c
A data subject submitted an access request to Klarna Bank AB (the controller). However, the controller did not provide all the requested personal data, including information regarding recipients to whom personal data of the data subject had been disclosed. After an unsuccessful follow-up request, the data subject filed a complaint with a German DPA. The complaint was transferred to the Swedish DPA in an Article 60 GDPR procedure. The Swedish DPA held in decision DI-2021-10263 that the controller should provide information about the actual recipients, not only categories of recipients, when the data subject expressly requests it. The DPA reached this conclusion by interpreting Article 15(1)(c) GDPR in light of the principles of fairness and transparency (Article 5(1)(a) GDPR) as well as the provision under Articles 19 GDPR. Thus, the DPA reprimanded the controller for a violation of Article 15 GDPR. The controller appealed this decision before the Stockholm Administrative Court. The controller argued, among others, that Article 15(1)(c) GDPR should be interpreted as allowing the controller to choose whether to give access to categories of recipients or specific recipients in a manner similar to the information requirements in Articles 13(1)(e) and 14(1)(e) GDPR. The Stockholm Administrative Court (the Court) recalled that Article 15 GDPR gives an individual the right to be informed as to whether a controller is processing personal data relating to them and, if so, to be provided with tailored information about the processing. The Court stated that it is up to the data subject to make the choice whether to exercise their right to know the recipients or categories of recipients to whom personal data were disclosed. The Court held that Article 15(1)(c) GDPR must be interpreted as obliging the controller to satisfy the data subject's request to the best of its abilities. If the data subject expressly requests access to information regarding the actual recipients of
The controller's business was the assessment of individuals' creditworthiness. For this purpose, the controller stored personal data in a database. One of these individuals was the data subject. In addition to the data subject's personal and address data, the controller saved a note about the data subject's bankruptcy proceedings in its database. Based on the outcome of such proceedings, the data subject's bankruptcy payments had to be concluded by 2018. In 2019, the data subject requested the controller to delete all negative entries related to his the creditworthiness. The controller rejected the request. Subsequently, data subject lodged a complaint in 2020 which, essentially, focused on the (i) rights to rectification (Article 16 GDPR), (ii) right to erasure (Article 17 GDPR), (iii) right to restriction of processing (Article 18 GDPR), and (iv) right to object to processing (Article 21 GDPR). All rights used by the data subject served the overarching goal of stopping or limiting the controller's processing. Moreover, the data subject argued that after three years of the conclusion of bankruptcy proceedings and after the related payments had ended, credit assessment companies have to delete an affected data subject's personal data. (It was unclear on what basis the data subject came up with the time span of three years.) The controller responded that the right to data protection had not been breached. In regards to (i) the rectification request, the controller reasoned that as interests of the parties would have to be balanced, a three year retention period could not simply be assumed. In regards to (ii) the right to erasure, the controller based the legitimacy of its processes on the sanctioning of the process through Austrian national law, namely, [https://www.ris.bka.gv.at/Dokument.wxe?Abfrage=Bundesnormen&Dokumentnummer=NOR40032660 § 152 GewO], which regulates the disclosure of information by credit ranking agencies, and [https://www.ris.bka.gv.at/eli/rgbl/
The plaintiff, in search of employment, participated in a reintegration program managed by the Board. Believing the program was providing insufficient assistance, they requested access and further rectification to all the personal data related to 'monitoring', 'logging', 'control', and 'detection' for the period from January 6, 2017, to January 6, 2018. While providing the documents in their possession, The Board stated they do not have any data in relation to the access request and further rejected the request for rectification on 7 July 2021, citing that they are not obliged to rectify professional opinions and impressions. The plaintiff objected to the rejection of their requests, which the Board declared inadmissible and partly unfounded on 18 February 2022 through a decision. In the case at hand, the plaintiff appealed the aforementioned decision. Access to Data (Article 15 GDPR): The court held that the board conducted a reasonable search and provided all available documents. The mere suspicion of additional data was not sufficient to prove they existed, and the burden of proof of such documents lied with the plaintiff. Right to Rectification (Article 16 GDPR): The court agreed with the board that professional opinions, impressions, and conclusions are not subject to rectification. The data the plaintiff wanted to rectify fell into this category and could not be altered. Procedural Conduct: The court found that any delay in the board's decision-making was reasonable under the circumstances and in accordance with existing procedural law and cases. Conclusion: The court dismissed the plaintiff's appeal, ruling that the board had complied with its obligations under the GDPR. The plaintiff was not entitled to further data access, rectification, or compensation. Thus, the court rejected the claims for damages, including those based on alleged violations of the GDPR and delays in the procedure. The court also declined to refer preliminary questions to the Court
The case concerned, among other things, a data subject's Article 15 GDPR access request to acquire supplementary information about their increased insurance premiums from their private health insurance provider. The health insurance provider was the concerned controller in this case. As, at the time being, had often been the case in Germany, the court of first instance (in this case, the Regional Court Stade), had held that the access request was "excessive" since, contrary to Recital 63 GDPR, the request did not serve to further data protection related matters. Therefore, the lower court had had decided that the controller had a right to refuse the request under Article 12(5)(b) GDPR. The data subject appealed the decision. OLG Celle, a court of second instance, overturned the decision of the lower court in respect to its holding on the excessiveness of the data subject's access request. Contrary to the Regional Court of Stade, OLG Celle argued that Recital 63 GDPR - which states that the purpose of the right to access is to make data subjects aware of the processing of their personal data and to give them the possibility to verify the lawfulness of the processing - only mandates that the requested information concerns personal data in the sense of Article 4(1) GDPR. Moreover, OLG Celle also held that a singular access request can never be excessive for the purposes of Article 12(5) GDPR as the GDPR only described the case of frequent repetition as a standard example for the assumption of an excessive application. Moreover, OLG Celle stated that the GDPR does not have any requirements which data subjects have to meet to justify their access requests. "The motivation of the plaintiff is irrelevant because the regulation does not make the right to information dependent on a specific objective of the claimant and accordingly the access request does not have to be substantiated", so the court. Consequently, OLG Celle overturned the decision in this respect.
Prompted by two complaints again decisions of the Austrian DPA, which were brought in before it, the Austrian Federal Administrative Court questioned the constitutionality of § 9(1) Austrian Data Protection Law (DSG) and sent an application to the Austrian Constitutional Court for the assessment of the constitutionality of § 9(1) DSG. Besides through the GDPR, and in contrast to the majority of other EU member states, data protection in Austria is also covered by the constitutional right to data protection and secrecy pursuant to § 1 DSG. This stood in contrast with § 9(1) DSG, which provided a blanket data protection exemption for a broad category of media actors. The first complaint, which the Federal Administrative Court took note of, was the case G 287/2022, which concerned an alleged data protection breach of a media company. The company had published a report and images of a house search, including unredacted pictures of a data subject's business card. The DPA rejected the complaint, arguing that considering the "media privilege" pursuant to § 9(1) DSG, it was not competent to handle the complaint. In complaint number two, concerning case G 288/2022, data subjects argued that a publishing company and a broadcasting company had unlawfully disclosed a "data leak" at an e-mail box attributable to the data subjects. Similar to the complaint mentioned above, the DPA deemed itself not competent pursuant to § 9(1) DSG. The data subjects in both cases appealed to the Federal Administrative Court which further sent an application to the Constitutional Court for the assessment of the constitutionality of § 9(1) DSG. The Austrian Constitutional Court sided with the data subjects and held that the "blanket" exemption, which § 9(1) Data Protection Act gives to media owners and journalists, is unconstitutional and not in line with the requirements of Article 85 GDPR. § 9(1) DSG provides - in implementation of the obligation under EU law pursuant to Article 85(1) GDPR
The controller managed a website – www.jameda.de – where personal data of doctors’ where collected and made available to internet users. These data included at least: name, academic degree and specialization of the practitioners, as well as professional addresses and telephone numbers. Data were processed without data subjects’ consent. The controller also offered doctors the option to add further information to their basic profile by paying a price. This optional service included the possibility to upload pictures, statements, articles, videos etc. Both basic and “premium” profiles enabled users to anonymously publish their “reviews”, which were attached to the doctor’s profile and publicly visible. The data subject was a doctor reviewed on the website, but they never consented to the processing of their personal data by the controller. He brought several allegations against the controller and requested a civil court to order the controller to erase the profile and stop several processing operations. The Regional Court of Munich (Landgericht München – LG München) declared the processing unlawful and imposed on the controller the erasure of the profile insofar as personal data of the data subject were associated with user reviews. However, the data subject appealed the part of this judgement that was not favourable to them. In particular, the data subject asked the court of appeal to check whether the controller violated the GDPR by implementing for premium profiles a design that infringed the data subject’s fundamental rights. More specifically, in the data subject’s view, services offered to paying customers indirectly put the data subject in a position of disadvantage, as basic profile holders were not allowed to personalise their page. In addition, the appeal concerned the fact that the data subject’s basic profile was used to display advertisements regarding other doctors who decided to subscribe to the “premium” option, again damaging the data subject’s profes
The controller is a private company, running a compare-and-review website for healthcare practitioners. The data subject is a dentist, whose personal data (name, academic title, field of practice, address, and telephone number of the office) was published through an online profile of her on the controller's website. The data subject did not consent to this data processing. Pursuant to Article 17(1)(d) GDPR, the data subject requested that the profile on the website of the controller should be deleted. The controller did not comply with the request. Consequently, the data subject brought the case to court. The courts of first and second instances held that, in view of the current design of the rating portal, the data subject was neither entitled to the deletion of the profile nor to an injunction against the publication of such a profile. There was no unlawful data processing by the controller since the weighting of the conflicting interests required by Article 6(1)(f) GDPR was in favour of the controller. The data subject decided to appeal the case again on the same grounds. This time to the German Federal Court of Justice (Bundesgerichtshof - BGH). The German Federal Court of Justice confirmed the decision of the previous courts. It held that the data processing was lawful upon Article 6(1)(f) GDPR since the interests of the data controller and the general public outweighed the interest of the data subject. By collecting, storing and passing on the ratings, the data controller provides the public using the portal with an insight into personal experiences and subjective assessments of patients of the respective practitioner, which readers can take into account in their own choice. Moreover, the controller's business model was supported by the right to conduct a business pursuant to Article 16 CFR. Additionally, pursuant to Article 11 CFR, the general public has a right and interest to freely express their opinions. The court also held that the rating of practi
A company (the controller) inspected the e-mail inbox and automatically forwarded an e-mail of its former employee (the data subject) after she had objected to processing of her personal data under Article 21 GDPR. The data subject filed a complaint with the Norwegian DPA, claiming that there was no legal basis for accessing and processing her e-mails in such a form. The DPA initiated proceedings and asked the controller for explanation. After not receiving any information past the deadline, it rendered a decision. The DPA held that automatic forwarding of the contents of the data subject's e-mail box could not be based on Article 6(1)(f) GDPR nor any other valid legal basis. The controller did not comply with its duty to carry out a balancing of interests after the data subject had objected to the processing, under Article 21 GDPR. Finally, the DPA held that the controller did not comply with its duty to inform the data subject of the forwarding of her e-mails, violating Article 13 GDPR. The DPA concluded that the infringements were intentional and serious. Hence, the DPA imposed a NOK 100,000 fine on the controller. It also ordered the controller improve internal control and routines for access to employees' and former employees' e-mail boxes. The controller appealed this decision to the Norwegian Privacy Appeals Board (Privacy Board). First, the Privacy Board considered whether the DPA had been correct in imposing a fine on the controller. It recalled that Article 83(1) GDPR obliges DPAs to ensure that the imposed fines are effective, proportionate and dissuasive. In this regard, the Privacy Board held that illegal forwarding of e-mails is a violation of the basic principles of lawfulness and transparency (Article 5(1)(a) GDPR). When basic rules for the protection of employees' privacy are disregarded as in this case, the violations must be regarded as serious. Therefore, the DPA was correct to impose a fine on the controller. Second, the Privacy Board conside
TU and RE were directors and shareholders of investment companies. Three articles were published in the news criticizing their companies and showing pictures of TU and RE suggesting a luxury lifestyle. These articles were accessible upon research of their names in Google. TU and RE requested Google, as controller to de-reference the links to the articles from the list of search results when researching their names. Google refused to comply with this request. TU and RE therefore brought an action with the Landgericht Köln (Regional Court Cologne) to have the Court order Google to de-reference. They argued among other things that the articles contained inaccurate claims and defamatory opinions. After the dismissal of their action in first instance, TU and RE filed an appeal with the Oberlandesgericht Köln (Higher Regional Court Cologne). This appeal was also dismissed. TU and RE appealed this second decision with the Bundesgerichtshof (Federal Court) which referred two questions to the CJEU. Oskar J. GstreinThe Right to be Forgotten in 2022, 20 December 2022, available on https://verfassungsblog.de/rtbf-2022/ summarized these questions as follows : # "How should courts handle requests for de-referencing in cases where applicants claim that the information presented by a news outlet are inaccurate, and in which the legality of the publication depends on whether the claims are factually true? # Is there an obligation of search engine providers such as Google to delete thumbnails from search engine results, even if the results contain a link to the original source?" For the first question, the Court explained that the processing by the search engine (in this case Google) constitutes a processing of personal data and must be distinguished from the publication on the website. The Court then recalled that the right to data protection is not absolute and must be balanced with the right to freedom of expression. In this context, the Court held that it is to the person req
On 4 April 2022, the Belgian DPA issued [https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-47-2022.pdf decision 47/2022], in which it fined Charleroi Airport €100,000 for the use of thermal cameras and temperature checks for COVID-19 detection purposes. The DPA held that the controller lacked a lawful ground for processing these special category data, see the [https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_47/2022 GDPRhub summary]. The controller appealed this decision with the Market Court. The controller questioned the impartiality of the DPA by referring to several reports in the national press. These reports showed an appearance of partiality, according to the controller, which was enough to call the decisions of the DPA into question. The nature of these news reports were not specified in the ruling. The controller further argued that the DPA had misued its powers. According to the controller, the DPA had stated multiple times in the press that the controller did not have a legal basis for its use of thermal cameras. However, the DPA did not issue any opinion of give recommendations to the controller so that it could improve its processing. The controller stated that it would have followed the instructions of the DPA if the DPA had taken a clear position regarding the legality of the controller's processing. The controller had also requested the anonymization of the decision. Despite this, the decision was published alongside a press report. According to the controller, the choice to publish a non-anonymised decision and to publish press report alongside it constituted a misuse of power by the DPA. The controller also stated that the DPA had misued its powers with regard to the determination of the fine. The controller also argued that the DPA did not properly apply the criteria described in Article 83 GDPR for determining the fine and had not consulted the EDPB Guidelines regarding Article 83 GDPR ([htt
The plaintiff request the responsive legal Court is the local Court where the plaintiff lives. The Superior Administrative Court Kassel say the plaintiff get the right ti referred this case to local court of Oranienburg. the local proper court of Oranienburg is responsive to decide this case because the statistic authority do not act in the exercise of sovereign powers himself if the data are internal operated or the request the data by a technical operating by webservers. the operation of webserver is not in the exercise of sovereign powers.
The defendant (and simultaneously controller) is a private company which provides health insurance services. The plaintiff (and data subject) is one of their costumers. Under the insurance agreement, the defendant could adjust the insurance premiums. At an unspecified time, the defendant decided to do so. In response, the plaintiff sought information from the defendant about the increased contributions. He requested information and documents regarding all contribution adjustments from January 1, 2011. The defendant refused the request. Subsequently, the plaintiff engaged in court proceedings. He argued that even though he had a statement of reasons, a document provided by the controller which outlined the reasons for the premium increases, he had lost the insurance certificates and accompanying documents from the years 2011 to 2020. This information would be necessary to calculate whether the increase of insurance premiums was legitimate. The plaintiff based his right to receive information, among other things, on Article 15 GDPR. The court of first instance decided to reject the claim and argued that Article 15 GDPR only provides data subjects with the right to have summaries of their processed personal data but not concrete documents, files or records. The data subject decided to appeal the court's decision. The court of appeal upheld the decision of the lower court by stating that the concerned access request cannot be supported by Article 15 GDPR. First, it pointed out that, according to Article 15 GDPR, controllers must provide a data subject with the personal data which is processed by them. The right of the data subject to receive information serves the purpose of becoming aware of the processing of the data and to check its lawfulness. Second, the court deemed the plaintiff's use of Article 15 GDPR an "abuse of rights". The court argued that the purpose of Article 15 GDPR was for data subjects to obtain an overview of the personal data processed by
A data subject received a letter from the Dutch Ministry of Finance (controller) stating that they (the data subject) had been included in the Fraud Identification Facility (FSV), a filing system used by the controller. In the letter the controller elaborated further that the FVS did no longer exist and informed the data subject of the possibility to access their data as well as the possibility of them having suffered damages due to inclusion in the FSV. The data subject filed an access request with the FSV. On 19 October 2022 the controller answered to the data subject’s request, providing an overview of all their personal data contained in the FSV in accordance with Article 15 GDPR. The data subject considered this answer as incomplete and appealed this decision stating that they want to know the reason for being included in the FSV as well as that they have suffered damages from being wrongly included. In its defence, the controller stated that the platform did no longer exist, it was therefore not possible to find out how the information ended up in the system. The court held that the data subject had to prove the existence of further information than what was included in the answer to the access request. In this case, the data subject did not sufficiently demonstrated the existence of further personal data than provided by the controller. The court found the appeal to be unfounded.
This ruling started by the appeal that the data subject submitted to the High Court of Justice of Catalonia against the resolution of the Police Directorate General in which the data subject was suspended from their duties due to a serious violation. On the 5th of April of 2019, the data subject was assigned one shift which finished at 7. The data subject is a police officer who works at the Border Inspection post at Barcelona airport and that day, around 4:25 manifested feeling sick and having migraines which was written down in a statement that was handed over to the Inspector to finally leave their place of work. However, it was later discovered that the data subject went back to the airport at 6:25, took a flight to Tenerife and that the purchase of the ticket was done the 28 of March of that year. The resolution challenged states that the data subject deliberately faked their sickness to be able to take that plane and to leave their place of work which is foreseen in the Law regarding the disciplinary regimen of the National Police (Ley Orgánica 4/2010, de 20 de mayo, del Régimen Disciplinario del Cuerpo Nacional de la Policía) as a serious violation. The defendant claimed, among other things, the nullity of the resolution due to the unlawfulness of the evidence since the access to the data regarding the boarding of the flight was done in violation of their fundamental right to privacy and data protection and the presumption of innocence and, alternatively, the data subject claimed that the sanction was disproportionate. The High Court took into consideration a resolution of the present case by the Spanish DPA in which the authority upheld the complaint submitted by the data subject for the unlawful collection of their data regarding the boarding of that flight. Additionally, the Court considers that such collection could have been legal within a disciplinary proceeding -as in the present case- if the Police would have performed such investigative steps by th
In Case C-37/20, YO, a real estate company, lodget a request to Luxembourg Business Registers (LBR) pursuant Article 15 Law of 13 January 2019 (Law of 13 January 2019 of Luxembourg establishing the Beneficial Owner Register - transposing the provisions of Article 30 Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing) requesting that access to the information concerning WM, its beneficial owner, contained in the register, to be restricted solely to the entities mentioned in that provision, on the ground that the general public’s access to that information would seriously, actually and immediately expose WM and his family to a disproportionate risk and risk of fraud, kidnapping, blackmail, extortion, harassment, violence or intimidation. On November 20, 2019 the request was rejected by LBR arguing that WM’s situation does not meet the requirements of Article 15 Law of 13 January 2019, since WM cannot rely either on ‘exceptional circumstances’ or on any of the risks referred to in that article. On 5 December 2019, WM brought an action before the tribunal d’arrondissement de Luxembourg (Luxembourg District Court, Luxembourg), maintaining that his position as executive officer and beneficial owner of YO and of a number of commercial companies requires him frequently to travel to countries whose political regime is unstable and where there is a high level of crime, which creates a significant risk of his being kidnapped, abducted, subjected to violence or even killed. In that regard, the referring court raised the question of the interpretation to be given to the concepts of ‘exceptional circumstances’, ‘risk’ and ‘disproportionate’ risk within the meaning of Article 30(9) Directive 2015/849, as amended. In Case C‑601/20, Sovim lodged a request to LBR, pursuant to Article 15 Law of 13 January 2019, requesting that access to the information concerning its beneficial owner, contained in th
On 25 January 2018, the plaintiff filed a request with the Parliament (the defendant) to access the list of candidates for the National Council of the Judiciary. The documents requested contained a list of citizens supporting a given application and/or lists of judges supporting a given application. By decision of 27 February 2018, the defendant refused to comply with the request. The plaintiff appealed this decision to the Court of First Instance. The Court of First Instance ordered the defendant to comply with the request to access document, but only after having anonymised the judges' personal identification number (PIN). The Court held that the PIN was not related to the public function performed by the judges, and therefore should not be made available. During the Court of First Instance proceedings, the Polish DPA initiated ex officio proceedings concerning the same matter and ordered the defendant (the controller) to restrict any further processing of personal data, including refraining from making them publicy available in any form. After not having received any information several months after the decision of the Court of First Instance, the plaintiff started proceedings regarding inaction by the defendant. As a result, the Court of Second Instance ordered the defendant again to comply with the request. The defendant filed a cassation appeal before the Supreme Administrative Court. The main argument of the defendant was the DPA decision, which contrary to the Court of First Instance order, prohibited the defendant from disclosing the information. In the cassation appeal, the Court considered whether the information ought to be disclosed and whether a DPA decision to not comply with a public information access request could overturn a court judgement on the same matter. The Supreme Administrative Court ruled that the Court of First Instance exercised the constitutional right to control the activity of public administration and ruled legally that the
Stichting onderzoek Marktinformatie (SOMI), Stichting Take Back Your Privacy (STBYP) and Stichting Massaschade & Consument (SMC) are three Dutch Foundations focused on class actions. The Foundations all separately sued the TikTok group (the controller). TikTok is a social media platform where users can post, view, like and share videos. SOMI summoned TikTok Ireland, while STBYP and SMC started class actions against multiple TikTok entities. As the cases were similar, they were considered together in this preliminary ruling. = The foundations claimed that the controller violated the fundamental rights of children (all foundations) and adults (SMC). In particular, the way that the controller processed personal data violated the GDPR, the Telecommunications Act and the Media Act. In addition, the controller violated provisions of mandatory consumer and media law. The foundations stated that the controller shared personal data of users with third parties without a legal basis. The foundations each requested the Court to designate it as the exclusive representative within the meaning of [https://wetten.overheid.nl/jci1.3:c:BWBR0001827&boek=Derde&titeldeel=14&artikel=1018&z=2022-10-01&g=2022-10-01 Article 1018(1) of the Code of Civil Procedure] (Wetboek van Burgerlijke Rechtsvordering- Rv) for the data subjects as described in their summons. This concerned minors for SOMI and STBYP and minors and adults for SMC. Regarding the jurisdiction, the foundations stated that the Dutch Court had jurisdiction under Article 79(2) to 80 GDPR, as well as under [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2012:351:0001:0032:en:PDF the Brussels I Regulation] (Brussels I) and [https://wetten.overheid.nl/jci1.3:c:BWBR0001827&z=2021-01-01&g=2021-01-01 Code of Civil Procedure]. = The controller requested that the Court declared itself incompetent to take note of any claims that fell within the scope of the GDPR. According to the controller, the right to bring proceeding