GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
The data subject is a public employee of a state authority and involved in family law proceedings. In the course of the proceedings, she filed a lawsuit to seek a declaration that four judges, which were involved in the proceedings, violated her right to data protection by disclosing data from the family law dispute to her public employer without authorisation and requested that they cease and desist from violating her right to data protection in the future. The defendants pointed out that during her family law proceedings, the data subject developed a history of filing numerous and extremely detailed regular disciplinary complaints against judges responsible for her law suits, succeeding more than 100 complaints a year. Furthermore, the data subject shared many of her correspondence with the court with her employer by placing their email address in the "cc" in an email and it was found that fax submissions by the plaintiff had shown the area code assigned to the data subject's state authority. Due to the excessive amounts of complaints, the judges have been given reasons to believe that she may not be able to properly represent herself in front of the court in her family law disputes or commit to her public employment. To ensure an exhaustive evaluation of the situation, some judges who were ruling in the family disputes got into contact with her employer and disclosed personal data concerning the family law proceedings. The first instance court held that the data processing is legal pursuant to Article 6(1)(c) GDPR and Article 6(1)(e) GDPR. The GDPR does not provide any specific regulation regarding employment data protection law other than Article 88 GDPR, which allows employment data to be regulated by the member states. Due to her employment at a public office, the data processing was lawful upon § 22 Nr. 1 SaarlDSG, which regulates that data processing is allowed when the data processor is a public office and the processing is needed for the beginning or t
Chetu Inc (the controller) is a Florida based company that has a branch in the Netherlands. It develops, produces and publishes software and provides consultancy and support for information technology. The data subject worked for the controller since 14 January 2019. The data subject signed a statement stating that his employment was “at-will employment”, meaning that the company may terminate the employment relationship without cause or previous notice, at any time. On 23 August 2022, the data subject received an e-mail from the controller announcing his attendance for the Corrective Action Program (CAP)-virtual classroom where he had to be logged in during the entire work day, to share his screen and leave his camera on. On 25 August 2022 the data subject responded, stating he was uncomfortable being monitored 9 hours a day by camera, and that it was an invasion of his privacy, as he already has his activities on his laptop and his screen being monitored. After two more warnings for the data subject to his camera on, the controller sent an e-mail the same evening, stating that the data subject’s employment is terminated with the reason being: “Refusal to work, Insubordination.”. The Court held that the summary of the dismissal was not legally valid, following the requirements under article 7:677(1) of the Dutch Civil Code (BW). The provision states that there must be an ‘urgent reason’, the dismissal must be without delay, and the reason must be communicated to the employee in a timely and sufficiently clear manner. The e-mail sent to the data subject listed “refusal to work” and "insubordination” as the ‘urgent reasons’. The Court found that the reason was not sufficiently clear, as the email had no explanation on the nature and seriousness of the behaviour which underlay the ‘urgent reasons’ stated in the e-mail. The e-mail correspondence also did not sufficiently prove that the data subject refused to perform his assigned activities. Hence, the alleged refu
The plaintiff was the owner of a plot of land in the association area of the defendant, which operated a public water supply facility for the area. The building located on this property was used by the plaintiff and their employees exclusively as an architectural office. After the defendant had announced that the existing water meters would be replaced and converted to electronic water meters with the option of radio reading, the plaintiff objected by letter. The defendant rejected this objection and argued that the right of objection pursuant to [https://www.gesetze-bayern.de/Content/Document/BayGO-24 Article 24(4) sentence 5 of the Bavarian Law on Municipalities] did not apply to the plaintiff's property because a commercial enterprise was located there. Therefore, no personal data could be read out. Eventually, the water meter was installed using coercive measures and the plaintiff initiated court proceedings. In its judgement of 29 July 2021, the Administrative Court of Munich ordered the defendant, upon complaint by the plaintiff, to switch off the radio module of the electronic water meter in the plaintiff's property. The court ruled that the right to object was exercised properly and should have been granted. However, the defendant appealed this position by referring to of [https://dejure.org/gesetze/GG/13.html Article 13(1) of the German Basic Law] on protection of personal data. Accordingly, the right to object only existed if the data concerned the occupants of houses. In the case of rooms used for commercial or professional purposes, it was not possible to draw conclusions about personal data because of the associated contacts with business partners and visits by customers. The court in appeal had to consider, among others, whether information from the electronic water meter could be considered as personal data pursuant to Article 4(1) GDPR. The court first noted that the the primary reason for the right to object to the installation of a water mete
The labour and mines inspection (controller) requested an employer to provide documents about its employees (data subjects) within 8 days. The controller is a public body tasked with supervisory authority to conduct controls and examinations. It has the authority to request documents and information from controllers regarding their employees (Article L.614-4(1)(a) Labour code). These documents had to contain information about, amongst other things, the beginning, end and duration of the daily work, extensions of the normal working time, the hours worked on Sundays, holidays and night work, information about wages, residence – and work permits, medical certificates and training certificates. (Articles L.614-4, paragraph (1) and L.614-5 Labour Code). The employer provided the requested information to the controller on 11 February 2020. However, the employer didn’t provide all the requested files according to the controller. After the Employer failed to provide the additional files, the controller fined the employer €8000. After objections of the employer, this fine was reduced to €6000. The employer appealed this fine at the court, stating that the controller was not entitled to demand the documents regarding salaries and proof of payment. It referred to written declarations of its employees, stating that the legal, administrative and contractual requirements in the law had been fulfilled. Therefore, there was no reason for the employer to provide these documents to the controller. According to the employer, its employees had also objected against the transfer of their salary-information to the controller, referring to their right of data protection. The employer also made an argument justifying the lack of communication regarding a holiday-register. The employer was obliged to keep a register on the legal leave of its employees according to Article L.233-17 of the Labour Code. The controller stated this register was not subject to any particular formalism and that
The social and health authority of the city of Helsinki (the controller) had asked the Administrative Court of Helsinki (the Court) to overturn the Finnish DPA's decision, according to which the controller had no legal basis to process the background information of applicants applying to volunteer as a child support person. The controller filed the appeal claiming that the processing of personal data was necessary to comply with its legal obligations under Article 6(1)(c) GDPR. The controller claimed that [https://www.finlex.fi/fi/laki/ajantasa/2014/20141301 the Finnish Social Welfare Act] and [https://www.finlex.fi/fi/laki/ajantasa/2007/20070417 the Finnish Child Welfare Act] oblige and entitle it to extensively process the background information of support person applicants, on the basis of which it can be assessed if they pose a threat to the child's physical and psychological integrity. The Court agreed with the controller that determining the background of volunteers working with children could be considered necessary in order to fulfil its obligations under [https://www.finlex.fi/fi/laki/ajantasa/2014/20141301 the Finnish Social Welfare Act] and [https://www.finlex.fi/fi/laki/ajantasa/2007/20070417 the Finnish Child Welfare Act]. However, the Court noted that pursuant Article 6(2) GDPR, the processing of personal data related to the organisation of support person activities is regulated in more detail in [https://www.finlex.fi/fi/laki/ajantasa/2002/20020504#P5 Section 5 of the Finnish Act on Checking the Criminal Background of Persons Working with Children], according to which the municipality may only request an extract from the criminal record from the applicant. In light of this, the Court agreed with the DPA that the personal data processed by the controller had exceeded what was necessary and relevant for the original purpose of the processing, therefore violating Article 6 GDPR and Article 10 GDPR.
The controller is a sports club in the legal form of an association. To, in its own words, 'give more meaning' to the sport, its vision and the memberships of its members, the controller worked with sponsors. It provided these sponsors with personal information of its members (the data subjects) such as names and addresses. Some members complained to the Dutch DPA that they did not give the controller explicit consent to provide its sponsors with their personal data. The Dutch DPA investigated the matter and found that the controller had disclosed the personal data without consent or any other legal ground, in breach of Article 5(1)(b) and Article 6(1) read in conjunction with Article 5(1)(a) GDPR. The DPA fined the controller €525,000. The controller appealed the DPA's decision at the District Court of Amsterdam. It stated that there was, in fact, a legal ground for processing and this was its legitimate interest under Article 6(1)(f) GDPR. The DPA continued to be of the opinion that the controller had no legitimate interest and that the processing was not necessary to pursue such alleged legitimate interest. The parties were divided on the interpretation and scope of legitimate interest within the meaning of Article 6(1)(f) GDPR. According to the DPA, it followed from the grammatical interpretation of this term that there must be an interest laid down in a law. According to the controller, any interest was justified unless prohibited by law. The Court noted that there were three cumulative conditions according to established case law of the CJEU for processing on the grounds of legitimate interest: (1) the pursuit of a legitimate interest of the controller, (2) the processing must be necessary and (3) the controller's legitimate interest must outweigh the interest or fundamental fights and freedoms of the data subject(s). The Court held that it could not without reasonable doubt decide whether the controller had a legitimate interest. There was no established
The data subject went through a turbulent divorce with her ex-partner. Afterwards, her ex wrote a book about it. Some parts of the book contained information on the data subject’s medical status. Coincidentally, the publisher of the book used to worked at the hospital (the controller) where the data subject was a patient. On top of that, the publisher was the ex’s new partner. After the book was published, the data subject requested the controller for access to the logging data of her patient record. The logging data revealed that her ex’s new partner frequently accessed her patient file for four years. The data subject therefore filed a complaint with the controller, to which the controller replied in a letter. The controller stated that the ex's new partner's employment had been terminated. However it could not establish that she was the reason that the data subject's medical information was published in the book. The data subject was not satisfied with the content of the response and took the case to court. The data subject claimed that the controller was liable for the (non-material) damages that she suffered because (1) the controller took insufficient measures to protect her medical data and (2) insufficiently investigated the data breach. In addition, the data subject argued that the controller was liable for damages caused by its employee (the ex’s new partner/publisher) who accessed her medical records and subsequently published those in the book. The Court held that the controller's monitoring policy did not meet the necessary standard, as it was non-existent. As a result, logging by employees with unrestricted access (like the present case) was not monitored at all and only two patient files were randomly checked every month. The Court found that this fell short, given the amount of personal data processed by the controller. It therefore held that the controller violated Article 32 GDPR, as no appropriate measures were taken to protect the data subject'
EU law restricts the ability of Member States to implement broad data retention requirements and access regimes as part of combating market abuse, and requires national courts to exclude improperly obtained evidence in accordance with EU law principles. On 22 May 2014, a judicial investigation was initiated into VD and SR for insider dealing and related offenses. On 23 and 25 September 2015, the Autorité des marchés financiers (the French Financial Markets Authority (hereinafter AMF)) provided the investigating judge with personal data from telephone calls made by VD and SR. The AMF had collected such data under French law, namely Article L. 34-1 CPCE. VD and SR challenged the use of this telephone data, on the grounds that it infringed Article 15(1) e-Privacy Directive. On 20 December 2018 and 07 March 2019, the French courts rejected the claims brought by the parties, relying on Article 23(2) Regulation No. 596/2015 relating to market abuse, which allows competent authorities to access such data where there is suspicion of insider dealing. The Court firstly noted that the wording of the provisions in the Regulation only refer to the authority's power to "require existing" data records, suggesting that the EU legislature did not intend to mandate data retention obligations. The Court also held that the context and objectives of the legislation support the interpretation that it only governs access to existing data, not an obligation to retain data generally and indiscriminately. The Court concluded that a broad interpretation that would allow mandating data retention would deprive the clear wording of the provisions of effectiveness, which the Court cannot do according to its settled case law. The purpose of the EU legislation on insider trading — namely, Directive 2003/6 and Regulation No 596/2014 — is to protect the integrity of EU financial markets and enhance investor confidence by preventing the improper use of inside information. However, the EU legislat
The data subject was registered at 'Bureau Krediet Registratie' (BKR, an agency for debt registration) by a bank (controller). The registration meant the data subject had a high risk profile. This registration would make it harder for the data subject to receive loans. According to this registration, the end date of the data subject's debt was 22 September 2020. The data subject stated various reasons for the fact that she had been in debt during this time, such as a failed relationship and issues at work. The data subject purchased a house on 19 July 2022. She stated that she needed financing quickly, and demanded that the controller would delete the credit registration at the BKR. She stated that she had regained her financial stability since 2020 and would move to a better house, which was the reason why she needed the mortgage. The controller declined to delete the registration. It stated that it didn't decide in the data subject's favour after conducting a balancing exercise. The District Court of First Instance of Amsterdam noted that the controller had rejected a request from the data subject according to Article 21 GDPR. The court stated that under Article 21(1) GDPR, a data subject has the right to object to processing if they provide concrete reasons for their 'specific situation'. The data subject has to prove the facts surrounding this specific situation when necessary. Controllers on the other hand must provide their legitimate interest when a data subject makes a claim under Article 21(1) GDPR. It must balance its own compelling legitimate interests against the fundamental rights or freedoms and interest of the data subject. The court held that this balancing exercise could also include circumstances which occurred after the credit registration. The court held that the controller had two compelling legitimate interests: (1) to warn other creditors of the risk and (2) protecting the consumer against accumulating too much debt. The data subject
The data subject had a car insurance and suffered an incident. They reported the incident to the insurance company, the controller. The controller alleged that they provided incorrect information about the collision and considered the report as a fraud. It then registered the data subject in two databases: the CBV of the Dutch Association of Insurers (used by insurers to coordinate investigations and perform analyses) and the external referral register (used by financial institutions when assessing insurance applications and claims). The data subjects sought to cancel both registrations, but the controller denied to do deregister them, so they filed an action before the Court. The Court had to determine whether these registrations should be cancelled under the provisions of the GDPR, namely Articles 21(1), 17(1), and Article 6(1) (e) and (f). First, the court referred to the provisions of the Protocol Incident Warning System Financial Insitutions 2021, specifically Article 5(2)1 which lists the requirements for deletion of registers. In the present case, tt concluded that a fraud was indeed committed and stated that this qualified as a criminal offence under Article 350 of the CPS. Therefore, the Court considered that the principles of proportionality and subsidiarity were respected and that the controller had a legitimate interest in protecting the financial sector from fraud. No violation was found and the data processing was considered as legal.
The data subject contracted a private health insurance with the controller. The controller informed the data subject that their insurance premiums would increase. The data subject received the corresponding insurance certificates from the controller. Subsequently, the data subject unsuccessfully requested additional supplementary information about the increase of premiums. Consequently, the data subject decided to sue to controller, arguing that the controller is obliged to give them access to the supplementary information pursuant to Article 15 GDPR. Additionally, the data subject referred to other court proceedings which held invalid comparable premium increases from the same insurance company, to clarify the reasons for their claim for supplementary information. The court dismissed the claim based on Article 15 GDPR. It held that the access request constituted an abuse of rights (Section 242 of the German Civil Code). According to this principle, an exercise of a right is not permitted if, among other things, the claimant takes advantage of a formal legal position or asserts something in which he or she has no self-interest worth protecting. According to the intention of the data subject, the requested information is to serve exclusively the pursuit of benefit claims. This is a purpose completely unrelated to the purpose of Article 15 GDPR. According to recital 63 of the GDPR, the right of access under Article 15 GDPR serves the data subject to be aware of the processing of their personal data and to be able to check its lawfulness. Thus, Article 15 GDPR is intended to enable a lawfulness check on data processing operations. The data subject should be able to assess the scope and content of the stored data. Moreover, the information received through Article 15 GDPR also serves to enable the data subject to exercise further rights under the GDPR, in particular the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, and the
The Belgian 'Gegevensbeschermingsauthoriteit' (DPA) received multiple complaints against IAB, a digital advertising company (alleged controller). The complaints concerned the ‘Transparency and Consent Framework (TCF), which was developed by the alleged controller. TCF is a standard technical framework that enables websites, advertisers and ad-agencies to obtain, record, and update consumer consent, objections and preferences for web pages. TCF was meant to help companies to become more GDPR compliant. Also, TCF makes it overall easier to record preferences of data subject for companies that use the so called ‘consent management platform’ (CMP), which is an interface that appears when a data subject first navigates to a websites or uses an application for the first time. Here, a data subject can give consent for the collecting and/or sharing of personal data or object to the processing of his/her data. These preferences are then saved and encoded in a ‘TC-string,’ which can be shared with other companies. The CMP also places a cookie on the device of the data subject in question. The TC string and this cookie could also be coupled with the IP-address of the data subject. Following the several complaints, the DPA started an investigation into IAB. After the DPA finished its investigation, it fined the alleged controller €250,000. In its decision, the DPA held amongst other things that IAB was the controller with regard to the processing of the registration of consent and objection of data subjects in the TC-string. The DPA also held that the alleged controller had to bring its processing activities in compliance with the GDPR. It had to provide a legal ground for processing in the context of TCF. It also needed to restrict its customers from using an opt-in consent in the CMP-interface, where data subjects would consent to legitimate interest (Article 6(1)(f) GDPR) as a legal basis. In addition, the alleged controller had to implement appropriate technical and organi
The respondents issued a Europe-wide invitation to tender for the procurement of a digital discharge management software. One of the exclusion criteria ("A-Criteria") was the software-related compliance with a GDPR draft contract. Additionally, the fact that the data is exclusively processed in an EEA data centre where no subcontractors / group companies are located in third countries, was designed as an evaluation criteria ("B-Criteria"). Both the applicant and the interested third party submitted a bid. The respondents awarded the contract to the third party. The applicant complained that the interested third party should have been excluded from the tender evaluation because, among other things, their bid violated the mandatory legal requirements of the GDPR by processing personal data on servers to which third countries had access. They used A. S.à.r.l. as a subcontractor. The agreement between the third party and A. S.à.r.l. in implementation Article 28 GDPR allowed A. S.à.r.l. to disclose personal data processed on behalf of the customer without or contrary to the customer's instructions and to transfer such data to a third country if this were necessary to comply with laws or binding orders issued by a state authority. Moreover, a supplementary addendum to the agreement stated that A. S.à.r.l. would challenge any unreasonable request by a governmental body. This would already show that A. S.à.r.l. assumed that it would be subject to a request for surrender by the US authorities. The respondent and the interested third party argued to the contrary that the bid did not constitute an infringement against the GDPR since a theoretical possibility of access by the third country did not constitute a transfer of personal data. Moreover, the defendant used standard contractual clauses and implemented the supplementary provisions required by the ECJ under the Schrems II case law through further agreements with A. S.à.r.l.. The procurement chamber agreed with the applic
The plaintiff, who suffered severe shoulder pain and had an unstable biceps tendon, underwent surgery at the defendant hospital on 10 January 2019. Despite an elective medical agreement with the defendant anesthesiologist, he did not participate in the surgery due to unavailability. Post-surgery, the plaintiff reported numbness in her left cheek and speech difficulties, which she claimed were initially dismissed by the hospital staff. Subsequent medical evaluations found no acute issues, but a suspected hypoglossal nerve palsy was diagnosed. The plaintiff declined the recommended corticosteroid therapy. On 16 February 2019, the plaintiff requested full disclosure of her medical data under GDPR from the hospital, which provided her treatment documentation, claiming it was complete. In November 2019, she initiated an independent evidence procedure, resulting in an expert report. The plaintiff claimed the surgery caused nerve damage due to faulty intubation and positioning and that the hospital's response to her complaints was inadequate and delayed. She also alleged insufficient information on corticosteroid therapy, leading to her rejection of the treatment, and claimed ongoing health issues and job loss due to the surgery complications. The court dismissed the plaintiff's claims, ruling that no treatment errors occurred during the surgery or in the hospital's response to her complaints. The expert testimonies confirmed that the surgery and postoperative care were conducted according to medical standards. The court found the plaintiff's positioning and intubation during surgery to be proper and the complications she experienced to be rare, inherent risks not resulting from malpractice. The documentation of the plaintiff's care was deemed sufficient, and the plaintiff's claim of earlier complaint communication was unsupported. Regarding the GDPR claims, the court held that the hospital had provided all required personal data and adequately fulfilled its disclosure o
A patient (the data subject) was treated in a hospital. Because she believed that an error had been made, she held the hospital liable. The hospital involved its liability insurer. On behalf of this liability insurer, a doctor from another hospital assessed the data subject's medical file. He checked whether the treatment had been carried out correctly. This doctor did not see the data subject nor was she involved in the investigation in any other way. The data subject found out that this other doctor had made an assessment of the treatment and tried to get access to the findings. The doctor who made the assessment refused her access. The data subject then filed a disciplinary complaint against this doctor with the Regional Medical Disciplinary Tribunal. The Regional Tribunal declared the complaint unfounded. The data subject appealed against this decision to the Central Medical Disciplinary Tribunal. The data subject argued that she should get access to the medical assessment based on the inspection rights from the Medical Treatment Contracts Act (MTCA) laid down in the Dutch Civil Code (article 7:456 BW). However, the Central Tribunal held that the data subject could not appeal to these rights, as an exception in the MTCA was applicable (article 7:464 BW). According to the Central Tribunal, the nature of the legal relationship (the trial) between the data subject and the hospital opposed this. It explained that the hospital had the right to prepare their defence against the data subject's liability claim 'in freedom and seclusion'. In that context, they must also be able to call in another doctor to assess the course of treatment, without the data subject being able to inspect the findings. The Central Tribunal therefore held that there was no obligation to make the medical assessment available to the data subject and declared the complaint unfounded. As a rule, decisions of the Central Tribunal cannot be appealed. However, cassation is possible if it is in the
The case concerns a dispute regarding the validity of an ordinary termination of a data protection officer's (DPO) employment relationship. The plaintiff had been working for the defendant as the company DPO starting on 1 February 2018. In a letter dated 13 July 2018, the defendant, the plaintiff's employer, terminated the employment relationship with effect from 15 August 2018. In order to make the termination effective, the defendant invoked a restructuring measure which had led to the discontinuation of the plaintiff's need for employment. The plaintiff applied for a declaration to declare that the employment relationship between her and the defendant was not terminated by the defendant's notice of termination. The plaintiff invoked a special protection against the dismissal of DPOs pursuant to section 38(2) in conjunction with section 6(4) sentence 2 of the German Federal Data Protection, according to which DPOs may not be dismissed without observing a notice period unless facts exist which entitle the employer to terminate the employment relationship for "good cause". The defendant filed a motion to dismiss the action, arguing that the plaintiff could not invoke the special protection as the law would violated Article 38(3) GDPR which mandates that DPOs shall only be protected from dismissals which relate to the performance of their tasks. Consequently, the court asked the CJEU for a preliminary ruling on whether, as argued by the defendant, the national and European norms are in conflict. The CJEU answered that the norms are not in conflict. Therefore, the German Federal Labour Court decided to agree with the plaintiff. According to the CJEU (see C-534/20), Article 38(3) second sentence GDPR is to be interpreted as not precluding a national rule, under which a data protection officer employed by a controller or processor may be dismissed only for good cause, even if the dismissal is not related to the performance of his or her duties, provided that that ru
The applicant’s marriage to Ms D was converted into a registered partnership, after which the applicant and Ms D entered into a covenant for the termination of the registered partnership and a partial dissolution of the matrimonial community of property. The community of property was successfully dissolved in 2004. In the abovementioned covenant, the applicant and Ms D had agreed to continue their joined ownership of the life insurance policy. In particular, there was first an obligation to share the value with each other upon payment and second Ms D had the obligation to reimburse the applicant annually for the subscription of the insurance. A dispute arose in relation to ASR’s compliance with the GDPR obligations. Hence, the applicant will be referred to as the data subject and ASR will be referred to as data controller. In particular, the data controller informed the data subject of the personal data kept on him by the data controller. However, the data subject believed that this information was inaccurate and incomplete. Therefore, the data subject initiated several procedures against the data controller. The first four requests concern the right to inspection. Precisely, a request for full access of the data subject’s data kept by the data controller, based on article 15 GDPR. Moreover, a request for an overview of the contacts the data controller had with third parties, as well as a list of documents added to the data subject’s file on request of third parties. Finally, the data subject requested a copy of the complete file of his documents from either 2004 or 2016 onwards. With his final three requests, the data subject asked the court to order the data controller to handle the agreement with the data subject in accordance with the GDPR, to delete all personal data of the data subject after proper termination of the agreement and to order a payment of the material and immaterial damages suffered by the improper implementation of the GDPR. First, the Cour
The data subject submitted an access request with the municipality of Westerveld (controller). The controller responded that a name and postal address were insufficient to verify his identity and it needed additional information from the data subject. The data subject then wrote the controller that it would file an appeal against the controller for not responding to his request in good time if it did not respond soon. The controller responded that it already did, and re-sent its previous letter. The data subject therefore submitted an appeal with the court for not responding in good time. The Court considered that by not identifying himself, the data subject was partly responsible for the fact that no decision was made. It noted that the data subject did not argue that the controller's request for additional information was unlawful. The Court held that the data subject's appeal constituted an abuse of procedural rights and deemed the appeal non-admissible. The data subject appealed the court's decision at the Council of State. The Council of State heard the case together with three similar appeals from the data subject, namely 202004183/1/A3, 202006929/1/A3 and 202006950/1/A3 (see comments). Both parties were present at the hearing. During the hearing, the data subject argued that he had not abused his procedural rights. Contrary to the court's consideration, he did argue that the controller's request for additional information was unlawful. The data subject stated that the fact that he did not respond to the controller's unlawful request did not make his appeal an abuse of his procedural rights. The Council stated that abuse of procedural rights is only present if a right or power was used so blatantly without reasonable purpose or for a purpose different from that for which they were granted, that the use of those rights or powers shows bad faith.RvS 19 November 2014, ECLI:NL:RVS:2014:4135. A more or less excessive reliance on government offered facilities
The data subject owned a house with his ex-wife that was financed with a mortgage from the controller. After the divorce, the data subject sold the house and retained a residual debt of €61,502.89. The data subject then became depressed and was unable to work. In 2013 and 2014, he received a reduced income under the Dutch Sickness and Benefits Act. Following debt mediation, the data subject repaid €12,224.96 over three years. The controller wrote off the remaining €49,354.75, and the debt was discharged on October 5th, 2021. On June 8th, 2022, the data subject was once again employed and with his current partner, he signed a purchase agreement for a new house. The couple had until 5 September 2022 to come up with the necessary funds to complete the purchase, but they were denied a mortgage because the data subject's previous debt with the controller was still registered in a credit registry. On 4 July 2022, the data subject requested the controller to remove his name from the credit registry so that he could obtain a new mortgage. On 12 July 2022, the controller rejected the data subject's request. The data subject then filed a claim at the District Court of Amsterdam requesting that it to order the controller to remove his name from the credit registry. The legal basis for processing the data subject's personal data was Article 6(1)(f) GDPR: a credit registry protects the legitimate interests of consumers against excessive lending and protects lenders against borrowers who cannot or will not repay their loans. The Court took no issue with this legal basis, and the data subject did not dispute these legitimate interests. That being said, the data subject still had the right to object to processing under Article 21 GDPR and have his personal data deleted from the registry under Article 17 GDPR so long as these legitimate interests did not override his right to erasure. Weighing these interests, the Court considered that the data subject ran into financial problems
Plaintiff believed that the first instance authority had ilegally obtained, stored and processed his personal data related to registration of permanent residence without his consent or knowledge, he also claimed material and non-material damages because of this breach and not filling obligation in conection to data minimisation principle. Plaintiff requested deletion of his personal data. First instance authority made a decision, he appealed and second instance (Ministry of Agriculture,Forestry and Food). Administrative court has decided that plaintiff should have first appeald to Information Commissioner (Informacijski pooblaščenec) and then after that plaintiff would be allowed to start administrative dispute before Ministry. Since main issues were procedural nature, court did not go into judging matters of processing personal data. Given the content of the plaintiff's request, the defendant did not act correctly when it transferred his complaint for consideration to an authority which, according to the clear provisions of ZVOP-1, is not a competent authority for decision-making at the second level. Incorrect legal instruction on the right to appeal and wrongful conduct of the first-instance authority cannot be to the detriment of the party who acts on it.