GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
The parent of a school pupil (the data subject) was concerned that the municipality (the controller) violated children's privacy rights on a number of occasions. The parent sent a request to the controller under Article 15 GDPR, to access the data subject's student file but the request was denied. The parent informed the Norwegian DPA about this rejection as well as the alleged violations on behalf of the controller. She believed to be exercising her right under Article 77 GDPR to lodge a complaint with a supervisory authority. The DPA did not open an investigation into the individual complaint but advised the parent to contact the controller's data protection officer. Later on, the parent was informed that the DPA had started an ex officio investigation into the controller's routines for internal control and information security. The DPA stated that that the questions put to the controller were related to the municipality's duties as data controller, and not to the data subject's rights. The DPA completed the investigation and proceedings without an order or fine against the controller. The parent complained to the DPA about this decision using an internal administrative appeal, which is possible under the Norwegian [https://www.sdir.no/en/shipping/legislation/laws/procedure-in-cases-concerning-the-public-administration/ Public Administration Act]. However, the DPA rejected this complaint by stating that the parent was not a party to the ex officio investigation against the controller and could not appeal the decision. Under a national administrative law procedure, the parent's case was referred to the Norwegian Privacy Appeals Board (Privacy Board). The Privacy Board had to assess whether it was correct of the Norwegian DPA to reject the parent's complaint. It recalled that the DPA chose to open an ex officio investigation. In these proceedings, no individual decision was made, as the DPA, after obtaining the controller's explanation, gave guidance and then c
The data subject used to be an employee at the municipality (controller) until 8 July 2008. On 6 May 2021, the data subject requested rectification of all changes made until this date in their files. The central question of this ruling is whether or not the data subject's request could be seen as a rectification request within the meaning of the GDPR. The court ruled that the data subject’s request to rectify changes made to his employee file could not be classified as a request within the meaning of Article 16 GDPR. The court stated that Article 16 GDPR is limited to rectifying incorrect personal data and completing personal data which is incomplete. The court stated that this was not the initial intention of the data subject, who only made his request more specific at the hearing for this ruling. However, even with this clarification, the data subject was not able to prove that his request was a rectification request within the meaning of Article 16 GDPR. The court also noted that the request did also not qualify as a request for getting access to personal data (Article 15 GDPR), erasing personal data (Article 17 GDPR) or restricting the processing of personal data (Article 18 GDPR). The court concluded that the data subject's request was not a request within the meaning of the GDPR. Therefore, a (lacking) response from the controller to this request was not a "decision" (Besluit) within the meaning of Article 6(2)(b) of the General Administrative Law Act (Awb), a Dutch administrative law provision. The data subject's request itself could also not be regarded as an "application" (aanvraag) in the sense of Article 1(3)(3) Awb either. Because of the fact that both the request from the data subject, as well as the (lacking) response from the controller did not fall under these national provisions, the appeal was deemed inadmissible by the court.
The plaintiff applied to the District Police Chief (the defendant) for access to public information, namely footage of a video recording taken during vehicle and traffic control carried out by the police on 17 February 2017. By decision of 29 December 2017, the defendant refused to provide access to the entire recording, including the requested car registration numbers available on the footage. The decision was substantiated by the obligation to protect the personal data of individuals visible on the recording. Moreover, given that the plaintiff requested access to the data in the form of digital files - the obliged authority was not in a position to ensure adequate and irreversible anonymisation of the data. Upon receipt of the request for public information, the obliged authority verified it accordingly, then notified the applicant in writing, without issuing a separate administrative decision. The plaintiff objected to this decision first internally at the defendant authority, then in court. The court of first instance determined that the information requested by the plaintiff constituted, in principle, public information. In that judgment, the court also stated that such a broadly defined request covering, inter alia, material from the video recorder mounted in the car belonging to the district police - may include data infringing the privacy of natural persons. The court ruled that the defendant was right in refusing the request based on protection of personal data. Subsequently, the plaintiff filed a cassation appeal requesting that the judgment be set aside in its entirety. The Supreme Administrative Court recalled the first instance ruling. It stated that the video recording contained images of the persons controlled, as well as the registration numbers of the vehicles subjected to roadside checks, which would make it possible to identify those persons. This would consequently violate [https://arslege.pl/zasada-ochrony-zycia-prywatnego/k15/a5278/ Article
The data subject registered at a platform which required her to enter her e-mail address, name, birthday, and gender. Additionally, she entered her phone number, which was an optional disclosure. The default privacy option of the platform disclosed the personal data to any person that has the data subject’s e-mail address or phone number. Between 2018 and 2019, a third-party collected the personal data by web-scraping the controller's service. In practice, the third party created lists with potential phone numbers and uploaded them to the contact-importer of the platform to detect if the numbers could be associated with users who did not change the default privacy options of the platform. By guessing the correct phone number, this allowed the third party to connect the phone number with the data subject's profile and access all the provided information. In April 2021, the third party published all the scraped personal data. The data subject filed an action against the platform, claiming that the latter did not take any security precaution to prevent the personal data form being scraped, for instance by means of a security captcha. The data subject asked the defendant to pay non-material damages. In its defense, the defendant argued that the scraping did not constitute a data protection breach because the information accessed was publicly available. The court held that the action is admissible but unfounded. The data subject was not entitled to the payment of non-material damages pursuant to Art 82(1) GDPR. The court noted that, according to the wording of the provision, the damage must be "suffered", from which it follows that the damage must actually have occurred and not merely be feared. The concept of damage was to be interpreted broadly according to Recital 146 GDPR, however, a mere infringement of the provisions of the GDPR would not be sufficient to be able to claim non-material damages. Rather, concrete damage must be proven. The data subject had no
The controller is a cyclist who took pictures of parking offences and, together with a short description, sent it to the police authority in charge to report the offence. The case at hand concerned photographs taken in June 2020 of various vehicles that showed the parking situation and the vehicles' license plates. In June 2021, the competent DPA issued a reprimand against the controller in accordance with Article 58(2)(b) GDPR. The DPA argued that taking and redirecting pictures of the parking offences constitutes processing of personal data and that the controller did not fulfil their informational duties pursuant to Articles 13(1)(d) and 14(2)(b) GDPR. The authority claimed that there was no legitimate legal basis under Article 6(1) GDPR for the processing, as the controller neither obtained a consent of the vehicle owners nor had a legitimate interest that would justify the processing. The controller was requested to pay an administrative fee of 100 euros. The controller filed a complaint against the DPA's decision in a written statement at the Administrative Court of Ansbach. The Administrative Court Ansbach overturned the DPA's decision. It held that the reprimand issued by the DPA is unlawful because the claimant did not violate any provisions of the GDPR, which is a condition for a reprimand pursuant to Article 58(2)(b) GDPR. Material scope of the GDPR According to the court, the GDPR applies in the case at hand since taking pictures of vehicles and forward them to the police constitutes the processing of personal data in accordance with Article 2(1) GDPR and Article 4(1) GDPR. A license plate is information that allows the identification of a natural person, despite the fact that the provision of additional information from authorities is necessary to identify the data subject. Furthermore, the household exemption laid down in Article 2(2) GDPR is not applicable since the processing of personal data is leaving the private sphere. The pictures taken w
The data subject was the director of two foundations engaged in activities with regard to the Islam. Foundation 1 focussed on, among other things, arranging funerals in accordance with Islamic rules. Foundation 2 focussed on promoting and disseminating knowledge about the Islam. The data subject was also the Ultimate Beneficial Owner (UBO) for both foundations.see comment Both foundations used Mollie B.V. (the controller) as a payment service provider. To be in compliance with the Money Laundering and Terrorist Financing (Prevention) Act (Wwft),Mollie B.V. conducted a customer due diligence, where it requested and obtained data on the data subject in his capacity as the UBO for both foundations. Following a periodic inspection, the controller terminated its services to both foundations. It stated that the account was no longer a good fit due to recent changes in legislation and its internal policies. Later, the controller informed Foundation 1 that the service was terminated, partly due to its affiliation with foundation 2, as it had become aware that foundation 2 might have used its payment system for improper purposes. Foundation 1 contested the termination in court. However, in a preliminary ruling, the Court held that the controller lawfully terminated the contract. The data subject then submitted multiple access requests with Mollie B.V. which, in turn, denied all of them. Therefore, the data subject brought the matter before the court. The data subject requested the Court to order the controller to provide him with all personal data relating to him in the context of the customer due diligence. More specifically data relating to him (i) in his capacity as UBO, (ii) regarding signals received by the controller, (iii) regarding transactions, and (iv) regarding the risk profile drawn up and risk classification. The data subject further requested the purposes for processing, the categories of personal data concerned and the recipients of his data. In addition,
An Austrian data subject made an access request with Spotify. In January 2019, the data subject filed a complaint in response to Spotify's answer to the access request with the Austrian DSB. Subsequently, the complaint was forwarded to the Swedish IMY as the lead supervisory authority for Spotify. After three years of inactivity, the data subject requested a formal decision under Section 12 of the Swedish Administrative Law ("Förvaltningslagen (2017:900)"), which allows to demand a decision within four weeks, if a case is pending for more than six months. The IMY refused the demand, claiming that it is undertaking a parallel ex officio investigation into Spotify and that the complainant is not a party to the procedure. Section 12 of the Swedish Administrative Act would not apply to complainants under Article 77 GDPR as the complainant in such a case does not have a party status, according to the preparatory work of the Act. The Administrative Court held that in light of recitals 141 and 143 of the GDPR, Article 8 of the CFR, Articles 57(1)(f), 77, and 78 GDPR a complainant has a number of individual rights. In the court's view, the competent supervisory authority is obliged to process and investigate all submitted complaints concerning the processing of a data subject's personal data to an appropriate extent. Furthermore, any unsuccessful complaint must result in a reasoned decision against which the data subject must have the right to an effective remedy (see also the decision of the Stockholm Court of Appeal of 18 May 2022 in Case No 1426-22). A complainant cannot be placed in a worse position, solely because IMY chooses to deal with the complaint in the context of an additional ex officio investigation. In the view of the Administrative Court, the complainant is therefore a party to the case as far as his complaint and the processing of his personal data are concerned and can rely on Section 12 of the Swedish Administrative Law to get a decision within four w
Proximus, a provider of telecommunications services provider in Belgium, also provides telephone books and telephone enquiry services for the public (hereinafter "directories"), according to the Law about Electronic Communication. These directories contain the name, addresse and phone number (hereinafter "information") of the different public telephone services providers (hereinafter "operators"). Other directories, published by third parties, exist. The information of these subscribers are communicated regularly to Proximus by the operators, except those of subscribers who expressed their wish not to appear in the directories published by Proximus. In Belgium, the distinction between the subscribers who want to appear in a directory and those who don't, is in practice expressed by assigning a code in the registration of each subscriber, namely "NNNNN" to the subscribers whose information can appear, and "XXXXX" to the subscribers whose information stays confidential. Proximus transmits the information it receives to other providers of directories. The complainant is a subscriber of the telephone service operato Telenet, who is active on the Belgian market. Telenet does not provide directories but transmits the information of its subscribers to providers of directories, among them to Proximus. The 13th January 2019 this subscriber demanded Proximus not to have appear his information in the directories published either by Proximus or by third parties. Following this demand, Proximus modifiier the status of this subscriber in its information system, so that the information of that subscriber should not made public any more. The 31st January 2019, Proximus received from Telenet a periodic update of the data of the subscribers of the latter. This update contained new data of the concerned subscriber, which were not indicated as confidential. This information was handled automatically by Proximus and were registered in a way that they appeared again in the directory of
In 2022, the German Federal Statistical Office, the controller, ran the 2022 census. As part of the census 2022, it also conducted a building and housing census (GWZ). In this vein, the controller requested information about the property of the data subjects in June 2022, which the latter did not comply with. The data is collected via an online form on the official Census 2022 homepage or via a paper form that is thereupon digitalized by a third party. In July 2022, the data subjects requested information about the data processing of the controller via Article 15 GDPR. Among other things, the data subjects wanted to know if the personal data would be processed in a third country. The data subjects opposed the data collection, claiming that the collected personal data was not sufficiently protected and that the incorporation of Cloudflare was not in line with the Schrems II judgment of the CJEU. In its response, the controller clarified that all collected data is exclusively processed by servers of the Federal Statistical Office. The integration of the company Cloudflare within the official Census 2022 homepage concerns only the generally accessible information and its functionality. In September 2022, the data subject filed a suit, claiming that, among other things, that the collected personal data was not sufficiently protected. Especially the incorporation of Cloudflare into the official Census 2022 was not in line with the Schrems II judgment by the CJEU. Collection of data The court held that the request by the defendant to provide information concerning the building and housing census did not violate the provisions of data protection law and was compatible with the provisions of the GDPR. The collection of data within the framework of the Census 2022 served the performance of a task in the public interest. The Census 2022 is a federal statistic and therefore a prerequisite for political decisions, to continuously collect, process, present and analyse da
The controller advises and guides companies on matters such as brand positioning, corporate identity, business models and revenue models. The data subject had a business that facilitates spaces for retreats, trainings and workshops. The controller believed that the data subject wrongfully failed to pay its invoice, and it claimed payment of the invoice, among other things. The data subject disputed this and refused to pay the additional invoices. Therefore, the controller took the matter to court. To substantiate their defence, the data subject requested the Court to order the controller to provide digital copies of all recordings it made of conversations and (Zoom) video conferences between them, pursuant to article 843a of the Code of Civil Procedure (CCP) and/or Article 15 GDPR. The data subject stated that during the Zoom-calls, they were notified by an on-screen notification at the beginning of the call that it would be recorded. Concerning the data subject's claim under Article 15 GDPR, the Court noted that the controller stated, with reasons, that a significant portion of the requested recordings could not be provided, because they did not exist. The Court held that it was the data subject's responsibility to assert and provide evidence that the controller actually had these recordings available. The data subject, however, did not provide such evidence. The Court deemed it not plausible that the controller had more recordings at its disposal than it claimed to have, and rejected the claim under Article 15 GDPR on this point. Regarding the residual recordings, the Court pointed out that Article 15(3) GDPR gives the data subject the right to be provided with a copy of the personal data being processed. The Court followed that this right does not automatically entitle a data subject to access a copy or transcript of the original document on which their data is recorded. For example, a data subject is not entitled to the latter, in so far as the objective pursu
The data subject requested the Chamber of Commerce (the controller) to shield the visiting address of his foundation - which was also his home address - in the Commercial Register. On 15 December 2020, the controller denied this request, stating that it was mandatory to include a foundation’s visiting address in the Commercial Registry. The data subject objected to the controller's decision, but the latter dismissed the objection as unfounded. In response, the data subject filed an appeal against this decision. In the appeal, the data subject requested a foreclosure of their address, until the moment of the appeal decision. Initially, the controller refused to do so. However, after an order from the interim relief judge, the controller did foreclose the address. The controller should have assessed the initial request against the conditions set out in section 51(3)(a) of the HRB 2008, in which these conditions of the case have been met. Furthermore, At the hearing before the Board, the data subject applied for damages for exceeding the reasonable time limit provided for in Article 6 ECHR. In cases such as the one at issue here, the basic principle is that the objection and appeal phases together may not exceed two years. The objection phase may not exceed six months and the appeal phase may not exceed eighteen months. In this case, the two-year period was exceeded, with no justification. The Court of Appeal held that the appeal was well-founded and annulled the contested-decision. Meaning, that the data subject was eligible for the suppression of the entry of their residential address, on the basis of probable threat. Moreover, the data subject was awarded €500 in damages for exceeding a reasonable time limit, pursuant to article 8:88 of the AWB.
The controller carried out activities in the field of media. Via its website, it published articles, that were also sometimes published in national newspapers. Among these articles was a 28-page file about the data subject. One article referred to the data subject as a master swindler. Another article stated that the data subject sold phone cards to detainees and scammed them. The publications included the data subject's full name, date of birth and a photograph. The data subject deemed these publications unlawful pursuant to the GDPR and Article 8 ECHR and took the matter to court. The data subject claimed that the controller was liable for €40,000 in damages and also requested a ban on any future publications about him. The Court of First Instance dismissed the claims. It considered that the controller processed the personal data for journalistic purposes and that in this case, the freedom of expression of the controller outweighed the protection of the data subject's privacy. The Court noted that the press has a watchdog function, in particular with regard to fraud and the importance of warning the public about it. The data subject appealed the decision of the Court of First Instance. He opposed the Court's finding that the controller processed personal data for journalistic purposes on its website. According to the data subject, the controller's purpose was to make people look bad and that the controller acted out of spite. The controller had no legal ground for processing pursuant to Article 6 GDPR. Therefore, the journalistic exception laid down in Article 43 of the Dutch Implementation Act for the GDPR (UAVG) was not applicable. The Court of Appeal of Amsterdam stated, firstly, that the term 'journalistic' within the meaning of Article 43 UAVG should be interpreted broadly. The Court found that controller's website aimed to inform the public about fraudulent activities. The data subject's statement that the controller's purpose was to make people look bad
This case concerned a Hungarian provider for internet and television services (controller) and the Hungarian DPA. A technical error caused problems for the functioning of the controller’s server. After this, the controller created a database for testing (test database), to which the personal data of one third of its customers was copied. This personal data was originally kept in another database (original database), which was coupled with the website of the controller. This original database contained personal data of subscribers for the controller's newsletter, for the purpose of direct marketing. The original database also contained data of system administrators who provided access to the interface of the website. On the 23 September 2019, the controller learned that an ethical hacker managed to get access to the test database which contained the data of 320,000 data subjects. The hacker notified the controller and provided a line of code from the test database as proof of the security issue. The controller fixed this issue, signed an NDA (Non Disclosure Agreement) with the hacker and gave him a reward. The controller also deleted the test database. The controller notified the DPA on 25 September 2019, which started an investigation into the controller. In its decision of 18 May 2020, the DPA held that the controller violated Articles 5(1)(b) GDPR and 5(1)(e) GDPR by not deleting the test database after conducting the necessary tests and fixing the errors. By not deleting this database, the controller kept the personal data of data subjects without any purpose for almost one and a half years. The DPA ordered the controller to investigate all its databases and also gave the controller a fine of 100,000,000 Forint (€248,000). The controller appealed this decision at the Fővárosi Törvényszék (Judge for the agglomeration of Budapest), which asked the following preliminary questions to the Court of Justice of the European Union (CJEU). 1) Should the purpose limitati
The data subject made an access request to the municipality of Sluis (controller) on 18 August 2020. The controller responded on 24 September that they found no personal data related to the data subject and that it planned to reject the request. It also asked the data subject to specify their request by 9 October 2020, suspending it until that date. The data subject responded on 29 September 2020, requesting the controller to issue a decision and taking the point of view that the controller had exceeded the deadline. On 28 October 2020, the controller officially denied the request. The data subject sent another letter on 12 November 2020, requesting the controller to issue a decision based on his previous letter. On 20 December 2020, the data subject submitted a formal objection with the controller for not taking a decision for periodic penalty payments in a timely manner. The controller rejected the objection. The controller also sent the notice of objection to the court to treat as appeal. The Court initially ruled the appeal inadmissible, as the court fee had not been paid in time. The data subject objected to this decision, stating that he was not able to pay the fee. The objection was upheld on 17 September 2021. The initial ruling did not go into the request for penalty payment's. The Court found that the data subject made access requests to six other municipalities, for which the data subject also claimed penalty payments. On top of this, no clear purpose of the access request could be deduced. The data subject was not known by the controller and did not make use of the possibility to specify his request. Last, the data subject never objected to the controller's decision to deny the access request from 28 October 2020. The Court held that since data subject only made an access request and the subsequent request for a decision on periodic penalty payment's for monetary gains. Therefore, the data subject abused legal instruments. As a result, the Court ruled
Stichting Brein is a foundation involved in collectively counteracting and preventing copyright infringements. Ziggo is one of the largest internet service providers (ISPs) in the Netherlands. In December 2020, Brein started the "FLU-warning campaign". The aim of this campaign was to send warning letters to holders of IP addresses of which Brein, using special software, had found that they had uploaded copyright infringing material via BitTorrent for at least two times in a span of four weeks. However, Brein did not possess the name and address details of the torrent users, but only their IP-adresses. Hence, it needed the cooperation of Internet Service Provider (ISP) to link an IP address to name and address details. With this information, Brein would be able to send the warning letters. Ziggo, however, did not want to cooperate voluntarily. Therefore, Brein filed a submission at the Midden-Nederland Court of First Instance (Rechtbank) to force Ziggo to send the warning letters to the respective users. The first instance Court rejected this submission in a previous interim relief proceeding. This Court of First Instance held that combining IP addresses and contact details of ISP clients entailed the processing of personal data relating to criminal convictions and offences or related security measures (criminal data) pursuant to Article 10 GDPR. The ISP didn't receive a permit from Dutch the DPA to process criminal personal data, and therefore lacked a legal basis. The Court also held that Articles 32 and 33 UAVG (Dutch law for the implementation of the GDPR) were the only provisions which contained 'appropriate safeguards' as stated in Article 10 GDPR. Brein appealed this ruling. The Court of appeal held that it had to answer two questions: (1) if there was a legal basis that could force the ISP to cooperate with the request of Brein and (2) if the ISP was even allowed to combine the contact details and the IP addresses in the first place. The Court held that bo
The controller published a screenshot of an advisory board video call meeting on his webpage, where among others, a local politician, the data subject, could be seen. As a response, the data subject filed a complaint to a DPAWhich exact DPA was concerned was not further specified in the decision. which, subsequently, issued a decision on the matter. In the decision, the DPA stated that the publication of the screenshots and videos violated the personality right of the data subject. Even a possible justification pursuant to Article 6(1)(f) GDPR due to the fact that (1) the data subject is a public figure and (2) it would be in the public interest to know what he is doing, would not prevail over the data subjects interest to not be defamed. Information about the his work is available in the protocol of the meeting, which is available to the public. The general public could get a better picture of the work from the protocol than from a screenshot, which does not provide any context, except the visual appearance of the data subject. Therefore, there was no need to process the data by publishing it in a visual form on a website. The main purpose of the publication of the screenshot was to defame the data subject, not to inform the general public about his work. The decision ordered the controller to erase all personal data and prohibited the future recording of videos or screenshots of the advisory board meetings. Subsequently, the controller filed a lawsuit against the DPA's decision at the Administrative Court in Bremen. In its decision, the court held that the decision from the DPA was legally correct and dismissed the case. The publication of the screenshots and videos on a private webpage, which is mostly used by the data controller to express his views and not to inform the general public about current affairs, constituted a processing of personal data in the sense of Article 4(2) GDPR. Therefore, the data controller needed a lawful ground for processing in
The defendant allegedly took out household contents insurance with the insurance company 'Nationale Nederlanden' (the controller). Under this insurance, the defendant made claims for damages based on false documents. The controller found out and claimed damages from the defendant for submitting claims based on false documents. The defendant disputed that he made those false claims, and, moreover, that he took out any insurance at all. He alleged identity fraud by a former employee of the controller (the data subject). The defendant stated that the data subject received the money paid by the controller through some sort of fabrication. To prove this, the defendant claimed the release of the data subject's name and address details. In addition, the defendant argued that if it would be ordered to pay, he would have a claim against the data subject for that amount. He therefore believed it was in his interest to call the data subject in indemnity. The controller disputed that it had to provide the address details. It argued that, the defendant did not sufficiently substantiate his interest in requesting the release of the data subject's name and address details. It also stated that the request was in violation of Article 6(1)(f) GDPR. First, the Court stated that pursuant to Article 843a(1) of the Code of Civil Procedure (CCP), the defendant may demand certain specified documents relating to a legal relationship in which they are a party from the person who has these documents at their disposal. The defendant must however have a legitimate interest in receiving the documents. The Court stated that, without the name and address details, the defendant would be unable to hold the data subject liable for the damages resulting from the claim alleged by the defendant. The defendant thus had an interest in granting the claim to provide the name and address details. The Court added that it was not necessary for defendant to show that his underlying claim would succeed. It wa
The data subject was a client of a bank (the controller). In 2020, the controller terminated their bank account based on "poor customer knowledge". Consequently the data subject filed a lawsuit against the controller in order to be allowed to open bank accounts again. In the course of the proceedings, the data subject requested access to a voice recording of their call with the controller. However, the controller refused access to the voice recording and provided the data subject with access to a transcription of the recording instead. The Court started by recalling that the supervisory authority has an obligation to process complaints. It is nevertheless clear from the wording of Article 57(1)(f) GDPR that the authority has a certain amount of freedom to choose in which cases to investigate. It is therefore not clear that the data subject will receive a legally binding decision in relation to a personal data controller from a DPA. This suggests that the authority's handling of complaints cannot replace a data subject’s right to bring an action to court. The Court of Appeal therefore concluded that it was competent to hear the case. Further, the court stated that the the right of access it not about the data subject being able to check whether the bank carried out its risk assessments correctly, but about the data subject's interest in their personal data being processed lawfully. Article 15(3) GDPR on the right to obtain a copy aims to ensure this interest and does not extend beyond that. Thus, the data subject was entitled to a copy of the personal data in such a form that they could exercise their rights under the GDPR. According to the Court, it follows from case law, with reference to Case C-212/13 and C-345/17, that pictures and sounds constitute personal data. Hence, a voice recording should be deemed as personal data. In line with Article 15(3) GDPR, the data subject had the right to receive a copy of their personal data as it is a prerequisite for other r
A number of data subjects attended a festival, during which they were allegedly recorded by a surveillance system without a legal basis. The data subjects contested that their right to information had been restricted by the controllers and processors, since they requested to be sent a copy of their personal data and to restrict further processing in accordance with Article 18(1) GDPR, which was met with the reply that the recordings had been deleted and that the data was not of personal nature due to it only showing persons up to the waist. The data subjects filed a complaint with the Austrian DPA who investigated the case. The defendants and alleged controllers were in the business of event management, advertising and consultancy. Part of their activities included counting visitor numbers and filtering this information into categories of age and gender. They recorded the visitor numbers at the festival through, among others, surveillance cameras. The defending parties denied that they were controllers pursuant to Article 4(7) GDPR. They argued that they organised the festival and processed the data of the data subject's on behalf of a contract with the local municipality, who should be deemed the controller. The municipality, however, had terminated the contract with the defendants. The defendants were in the process of disputing the validity of the termination in separate civil law proceedings in front of a regional court. Consequently, the Austrian DPA decided to suspend its decision on a complaint according to § 38 AVG until the regional court had decided in a civil law suit on whether the defendants in the complaint proceedings had acted on behalf of a valid contract with the municipality. The DPA believed that the answer to the question whether a valid contract was in place was an essential preliminary question to establish who the controllers were pursuant to Article 4(7) GDPR. The data subjects brought in a complaint against this decision by the DPA at
A German employer attempted to terminate their DPO’s employment contract without notice. The reason was that the employer claims that the DPO did not perform their duties adequately over a period of several years. The DPO contested the validity of this termination under § 6(4) BDSG, which only allows employers to terminate the employment of their DPOs for "important reasons". A month prior, an auditing company had issued an expert opinion on a lack of data protection measures and associated risks within the company where the DPO is appointed. Implementing such data protection measures would have taken up considerable additional working time of the DPO. However, they did not notify their employer that they could not undertake such tasks. The DPO argued that these tasks were of a structural nature and therefore not their responsibility, but that of the management board. The Labour Court of Heilbronn held the termination of the employment contract is invalid. DPOs enjoy special protection in the context of termination of employment under § 38(2) BDSG and § 6(4) BDSG in conjunction with § 626 BGB in Germany. The special protection of DPOs, which is in addition to that awarded under Article 38(3) GDPR, is permitted under EU law. As aforementioned, the BDSG only allows terminations of DPOs for "important reason". On the other hand, pursuant to § 626 BGB, the employment relationship may be terminated without observing a notice period if, considering all circumstances, there are facts on the basis of which the DPO cannot reasonably be expected to continue the employment relationship even until the expiry of the notice period. However, the court declared the dismissal of the DPO to be invalid, as no reasonable grounds to warrant such a termination were found. The justification of termination was based exclusively on the failure of the DPO to complete their responsibilities as opposed to evidence of a concrete breach of duty, which is not a valid ground for termination