GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
The case concerned the validity of two ordinary notices of termination issued by the former employer of the plaintiff, and the continuation of the plaintiff's employment with the second defendant. Among various claims in the proceedings, the plaintiff argued that their former employer violated their Article 15 GDPR obligations as a data controller. The plaintiff requested information under Article 15 GDPR from its former employer as a data subject. On 25 January 2021, they received an email response from the data protection officer of the data controller's parent company. The email included a reference to an attachment with the requested information. The plaintiff claimed that this constituted a violation of the GDPR, since they did not receive the information from the data controller, but from the data protection officer of the parent company. Furthermore, they claimed that the reference to the attached appendix in the email was not transparent. The plaintiff sought information from the former employer pursuant to Article 15 GDPR, the provision of copies of the personal data processed, and damages for violations of the GDPR. Concerning the "person responsible" for the provision of information The court held that the information was provided by the "person responsible", even though the sender of the information letter was not the controller itself, but the data protection officer of the parent company. According to Article 12 (1) GDPR, a controller must only take "appropriate measures" so that the notification obligation pursuant to Article 15 GDPR is fulfilled. This can be done by a delegated agent, which the data protection officer in the case at hand is. Concerning the form of the provision of information The court held that the information provided by email was sufficient. Pursuant to Article 12 (1) GDPR, the information must be provided in writing or in another form, if necessary also electronically. No formal requirement applies. Almost all correspo
Data subjects were a group looking for paranormal activities. They visited a cemetery in the municipality of Amersfoort (controller) to conduct a séance, "looking for energies of the deceased". This happened with the permission of the director of the cemetery. The parents of two children who were buried at the cemetery later found out about the séance and requested the data subjects' NAW-data (name, address and residence) from the municipality. They wanted to talk to them directly and possibly hold them liable for the damage they suffered as a result of the séance. The mother stated that it is absolutely not allowed to summon "spirits or devils" at graves in their Islamic culture. As a result of the séance, she claimed to have suffered serious psychological problems. The data subjects did not want their personal data to be disclosed. They had received serious threats because of the incident and felt unsafe. The municipality apologised for the events but stated that it was not obliged to disclose the personal data to the parents. It did offer to facilitate a conversation between the parties, during which the data subjects would remain anonymous, but the parents declined the offer. The parents were of the opinion that the municipality was acting unlawfully by not providing the personal data, so they brought the case before the court. The District Court of Midden-Nederland (Rechtbank Midden-Nederland - Rb. Midden-Nederland) heard the case. The Court stated that the data subject's did not consent to the disclosure of their personal data and this does not fit with the purpose for which the data was initially processed. It must therefore be tested against Article 6(1)(f) and (4) GDPR. The Court noted that (1) there must be legitimate interest, (2) the disclosure must be necessary and (3) it had to balance the interests of both parties: the right to protection of personal data and the safety of the research group and the right to information and effective legal p
The controller is an architect, building biologist, energy consultant and real estate expert. In 2020, the controller prepared an expert opinion on the value of a property on behalf of the data subject's former wife in the context of a family law dispute. The data subject who had not given prior consent was made identifiable in the expert opinion as the owner of the property by stating his full name. In 2021, the data subject sent an access request to the controller, to which the latter replied without attaching the expert opinion as such to the letter. With several more letters, the data subject claimed damages while calling the controller names and threatening exposure to the Architects' Chamber and the Data Protection Authority. With further letters, he targeted the controller's lawyer. Before the court, the data subject claimed that the information provided was incomplete because it lacked the expert opinion as such. He argued that data relating to any third persons could simply be redacted in the document. The controller claimed that the requested information was not included in the right to access and that any further information would infringe other parties' rights. In any case, the request was unfounded and excessive. The District Court of Pforzheim managed the case. The court dismissed the data subject's claim, agreeing with the controller. First, it held that the data subject's right to access had been fulfilled by the controller. According to the court, the scope of information owed under Article 15 GDPR is dependent on the controller's intention. Once the controller has given the information in accordance with what they believe constitutes the entirety of the data processed, the suspicion that the information provided is incomplete or incorrect cannot justify a claim to information to a greater extent. Essential for the fulfillment of the right to information is therefore the - possibly implied - declaration by the controller that the information
The Chief Ethics Commission was a Lithuanian body checking declarations of private interests by public officers. According to Lithuanian law, public officers were asked to provide a large amount of information about themselves and their partner, including name, personal identification number, social security number, employment status, membership or undertakings with trade unions and/or political parties and details about transactions over €3,000 concluded in the last 12 months. The Chief Official Ethics Commission then published information on its website (after removing sensitive data). Notably, the published information, whilst removing what was obviously special categories of personal data, would still include the name of their spouse, cohabitant, or partner. The data subject was a public officer who asked the annulment of a decision by the Chief Ethics Commission according to which they failed to disclose mandatory information. The data subject claimed that this mandatory declaration violated their data protection rights under EU law. The Lithuanian court sent a preliminary reference to the CJEU to clarify whether Lithuanian law establishing the obligation violated Articles 6(1)(c) and (e), 6(3) and 9(1) GDPR. The preliminary questions concern the issue whether the existence of a legal obligation – Article 6(1)(c) GDPR – or a public interest – Article 6(1)(e) GDPR – can authorise a mandatory disclosure of personal data of a public officer for online publication. According to the CJEU, such mandatory declaration of private interests was a limitation of the data subject right to privacy and data protection; therefore, it shall be compliant with Article 52(1) of the European Charter of Fundamental Rights. The CJEU noticed that the mandatory declaration was based on Lithuanian law and pursued a public interest, namely the prevention of conflicts of interest and corruption. However, the measure shall also be proportionate. The Court found the declaration appropriat
The data subject made a request upon Article 15 (3) GDPR to get access to her treatment Data from the time from 14th December 2020 to 19th February 2021. He has already received a Paper File in which X-Ray, MRI, and CT reports were missing. The data controller, a hospital where the data subject has received her treatment, has claimed, that she has received the X-Ray, MRI and CT reports on a Compact Disc (CD) in a PDF Format File, along with all the other documentation. The data controller has claimed €6,000 as the dispute value for the violation of Article 15(3) GDPR. The Regional Court in Cottbus has set in his decision the value on €1,000. The Higher Regional Court of Brandenburg confirmed the decision of the Regional Court in Cottbus. The court held that the data controller has partially fulfilled his obligation to provide the access to the data subjects’ own data since the majority of the Data requested was already provided in paper form, from which she could already get an insight into her treatment at the data controller’s institution. Due to this, the court held, that the value of the dispute could not be valued as high as it was claimed by the data subject. The court has dismissed the appeal and upheld the first-instance judgement.
The data subject had a phone subscription with T-Mobile (controller). The Central Bureau of Statistics (CBS) conducted statistical research with large datasets acquired from T-Mobile. T-Mobile stated that no personal data was shared with the CBS since all data had been anonymised. The data subject doubted statement from T-Mobile. He submitted an access request for the personal data T-Mobile processed for the CBS’s research. T-Mobile rejected the request stating that it had not processed any of the data subject’s personal data in this regard. Since the data subject was convinced that T-Mobile had to comply with his request, he brought the issue before the court. In an [https://gdprhub.eu/index.php?title=Rb._Oost-Brabant_-_C%2F01%2F371762_%2F_EX_RK_21-90_%28interim_decision%29 interim decision] the court held that T-Mobile violated Article 15 GDPR because any anonymisation process involves processing of personal data at least in the initial phase. The Court stipulated that T-Mobile had to indicate the exact nature and origin of the processed’ personal data. Although T-Mobile claimed that it had deleted that data, it submitted no proof of this. The court decided to suspend the proceedings and T-Mobile was given the opportunity to submit additional documents. T-Mobile submitted these additional documents in the case at hand. However, the data subject stated that these documents still did not include all the information requested. The court mostly adhered to its interim decision. It held that T-Mobile did provide all the information required under Article 15(1)(a), (c), (d), and (g) GDPR. The court found that an email where T-Mobile's director of Intelligence & Insights stated that "the data had been deleted" sufficient evidence of that fact. As there was no data, it could not be provided to the data subject. However, T-Mobile did not provide sufficient information about automated decision-making and profiling (Article 15(1)(h) GDPR). The Court ordered T-Mobile
A data subject made an access request to Comet s.p.a., the controller, to verify the lawfulness of the processing of her personal data for marketing purposes. In particular, she requested the information provided for in Article 15(1)(a) and (h) GDPR, and a copy of the personal data in possession of the controller. The controller did not respond to the request. Therefore, the data subject appealed to the Tribunal of Bologna, requesting an order for the fulfilment of her right under Article 15 GDPR. She stated that the controller must (have) processed her personal data, since she had a 'loyalty card' from the controller and documentation relating to the purchase of a smart TV (receipt and financing contract). The Court held that it was becoming increasingly crucial to protect people's rights when it comes to the processing of their personal data, especially from an economic standpoint. In doing so, it is necessary to remember that protecting people's fundamental rights cannot be sacrificed in favour of the interests of the market alone. The Court recalled that the GDPR, although known as the Privacy Regulation, actually has a far wider scope of application that extends beyond and individual's right to privacy, which is historically linked to their most private sphere. While the liberal concept of privacy requires essentially refraining from something for its protection, the current conception of privacy has an interactive and dynamic nature. It particularly concerns personal data and their circulation. The right to data protection is the cornerstone of the (positive) freedom to fully control the flow of an individual's own data. It is distinct from the (negative) freedom not to be interfered with in an individual's own private sphere. This is also, and above all, in the logic of market regulation covered by the GDPR. The Court added that it was sufficient to say that the Economist' described personal data as the new 'most valuable resource', i.e. the new oil. The
The data subject and his wife were in divorce proceedings. The wife mandated a chartered accountant (controller) to calculate her (future) alimony claims against the data subject. According to the data subject, the controller's report on the alimony claims was partially based on data that was not publicly available, especially data on the financial situation of a private foundation that was one of the data subject's sources of income. The data subject accused the controller of having obtained this data unlawfully. In July 2018, the data subject requested access under Article 15 GDPR from the controller, especially asking for information on the source of the data and a data copy. As the controller did not reply to the access request, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB) in August 2018. Before the DSB, the controller argued that the report on the alimony claims was based on documents provided by the data subjects wife. The data subject contested to have ever handed any information concerning the private foundation to his wife. The controller did not provide access to the data subject in the course of the procedure before the DSB. In April 2019, the DSB issued a decision and held that the controller had failed to comply with the data subject's access request and ordered the controller to comply or to inform the data subject of the reasons for not doing so under Article 12(4) GDPR. The controller appealed the decision, arguing that it could not comply with the data subject's access request because that would violate its statutory professional secrecy obligation under § 80 WTBG 2017 (Wirtschaftstreuhandberufsgesetz 2017) in connection with Article 15(4) GDPR, as the data subject's wife had not waived this secrecy obligation. The BVwG dismissed the appeal and upheld the DSB's decision (with some minor edits). It held that the professional secrecy obligation under § 80 WTBG 2017 does not provide a gen
The parties are in dispute about Hamburg Cancer Registry data processing and data transfers procedures. The data subject was diagnosed with breast cancer in 2019 and is a resident of the federal city-state of Hamburg. Treating physicians are legally obliged to transfer personal data of their cancer patients to the Cancer Registry. The Hamburg Cancer Registry (HKR) is an independent department of the regional Authority for Science, Research, Equality and Districts. Task of the registry is to identify cancers to be recorded in relation to the population, i.e. occurrence and frequency of diseases and their distribution according to age, sex and place of residence. Transferred data contains name, health insurance number, residence, data of birth, sex, sometimes personal habits (e.g. smoker) and health related data like diagnose, start, length and result of treatment. The data is processed in a confidential (physical) area within the HKR. Moreover, to pseudonymise the data, a set of hash-based control numbers will be automatically generated for every data set. Only the employees of the confidential area have access to the unencrypted personal data. Health related data sets will be shared with other cancer registers and cancer combating organizations on the federal level. The regional law applied here is the Hamburg Cancer Registry Act (HmbKrebsRG). The concerned data subject received a data protection declaration of consent and privacy information with her treatment contract from the hospital. The data subject gave consent to all data transfers at the end of April 2019. In March 2020, the data subject received a request from the University of Lübeck to take part in a cancer-study. According to the letter, contact was made, because the data subject was registered in the HKR. Subsequently, the data subject submitted a right to access request to the HKR. According to the HKR, the data subject received a complete overview of the stored data. This overview contained a
The data subject was an undocumented immigrant who lived in a shelter. He invoked his right to access and requested a copy of all his personal data processed by the municipality (controller), including internal emails and messages regarding the data subject (Articles 12 and 15(1) GDPR). He also requested access to personal data which was processed by the controller's employees using certain services, for example Microsoft (Office 365 and Exchange), Facebook (Whatsapp, Messenger), Telegram and Signal. His goal was to get insight in how the controller was monitoring and assessing him, to determine, among other things, which shelter should be offered to him. The controller asked the data subject to specify his access request, to which the latter did not reply (more precisely, the data subject stated that he was not able to specify his request any further because he did not know the specifics of the processing). The controller answered the request by providing a general overview of the personal data processed and three partially anonymized copies of documents. Being not satisfied with the controller's response, the data subject filed an action before the competent court. During the procedure, the court also revealed that the data subject had already send multiple similar access requests to the same controller in the past. The court concluded that the controller's answer to the access request was sufficient. The court found that the data subject had not sufficiently specified his access request. The general nature of his request would have placed a disproportionate burden on the controller, considering the large amount of personal data processed, which would result in disproportionate amount of time and financial resources spent by the controller to search for the requested personal data. The court also considered here that the data subject had already filed multiple similar requests in the past. Also, the controller had asked the data subject to specify his requ
VoetbalTV (the controller) is a collaboration between the Royal Dutch Football Association and Talpa Network. The online platform allowed fans to (re)watch and analyze professional video footage of football matches played by amateur players (the data subjects). VoetbalTV based its processing activities on a legitimate interest. = The Dutch DPA investigated Voetbal TV in 2019 and imposed a fine of €575.000 for processing personal data without a legal basis. The DPA held that VoetbalTV had a purely commercial interest, which can never be legitimate interest pursuant to Article 6(1)(f) GDPR. The DPA followed that a legitimate interest should (1) stem from a legal provision, (2) be worthy of protection and (3) have an urgent nature. According to the DPA, a purely commercial interests was not specific enough and lacked an urgent legal nature. VoetbalTV appealed this decision at the District Court. = The court found that the DPA gave a wrong interpretation of legitimate interest. It noted that having a purely commercial interest does not exclude a legitimate interest. The further held that the DPA did not sufficiently substantiate its decision. It should have investigated all the interests of VoetbalTV and weigh them against the violation of the privacy of those involved. Therefore, the Court held that the DPA should not have issued the fine and annulled the decision (see: [https://gdprhub.eu/index.php?title=Rb._Midden-Nederland_-_UTR_20/2315 UTR 20/2315]). The DPA appealed this decision at the Council of State. = During the appeal, the DPA stood by its strict interpretation of legitimate interest. The DPA argued that the District Court misconstrued the concept of legitimate interest, as a legitimate interest must follow from the law. It repeated that VoetbalTV's interest was purely commercial which does not qualify as a legitimate interest as this is not an interest provided for by law. The DPA substantiated this by saying that interpreting legitimate interes
The plaintiff sought the correction of a naturalisation certificate. He had been naturalised by the defendant (a German administrative body) on 28 July 2005. The naturalisation certificate was in the name of S. K., born on xx.xx.1967 in Khost/Afghanistan. However, it turned out that he had given false information about his identity when requesting naturalisation. He had been living in Germany since 1995 with false personal data from Afghanistan and naturalised with these personal details. In truth, however, he was a Pakistani citizen with the name S. R., born on xx.xx.1966. The applicant submitted a Pakistani identity card, a Pakistani birth certificate and a family registration certificate with details of his wife and children and requested that the naturalisation certificate be amended to read S.R., born xx.xx.1966 in N./Pakistan. The defendant informed the applicant that his request could not be granted. The naturalisation certificate had become effective despite the mistake in identity. The cause of the incorrectness of the certificate was that the plaintiff had given incorrect personal details. The naturalisation was thus not null and void, but only afflicted with defects which, however, were accepted for reasons of legal certainty after the expiry of the time limit of section 35 of the Basic Law. The defendant elaborated that there were many cases in which the naturalisation certificate contains a different name from the one the naturalised person uses, for example in the case of a name change after marriage. In this case, the naturalisation certificate is not corrected. Instead, the holder of the certificate is expected to prove to the relevant authorities that he or she is the person whose name appears on the certificate. The Administrative Court Stuttgart held that the plaintiff could not rely on Article 16 GDPR to rectify his naturalisation certificate. The court pointed out that according to Article 16 GDPR, the data subject has the right to demand th
The plaintiff owns a secondhand car dealership. One of the plaintiff's vehicles, driven by an unknown person, exceeded the permitted speed of 50 km/h. The police administration office sent the plaintiff a witness questionnaire and asked for the personal details of the responsible driver. The plaintiff stated that the person in the picture was not recognizable to him. The vehicle in question had been for sale and he had given it to persons unknown to him for test drives. He had always asked for a valid driver's license, which he only took a look at to make sure the person is allowed to drive. For reasons of protection of personal data, he did not store the data. The fine proceedings were then discontinued, but the authorities wanted to impose a requirement to keep a record of people driving cars that are registered in his name on the plaintiff. This can be imposed as an obligation under Article 31a StVZO - Road Traffic Licensing Regulations, if in the past a person who has more cars registered in his name, has failed to identify the driver of one of his cars. In the proceedings that followed, the plaintiff claimed that even if he did store the data for the period of the vehicle being driven by the other person, he would erase it pursuant to Article 17 GDPR after the drive. He argued that if it was not intended to buy the car, there was no actual legal basis under the GDPR to store such data. The Higher Administrative Court of Bavaria (VGH München) held that the plaintiff was required to document test drives and that this obligation was not contrary to Article 6(1) GDPR. Pursuant to Article 6(1)(f) GDPR, a controller may use the legal basis of legitimate interest even if those legitimate interests are pursued by a third party. Hence, the applicable legal basis for the plaintiff (the car dealer) was Article 6(1)(f) GDPR as the police, a third party, had a legitimate interest in fulfilling the tasks incumbent upon them in the public interest, which include the pro
The controller is the Municipal Executive of Bladel (an administrative body). The data subject is a dog trader (and her partner). In 2013, the police started an investigation to combat malicious dog trading. The data subjects were included in a report that was drawn up regarding this investigation. The investigation resulted in an enforcement action in 2016. The data subjects started administrative and civil proceedings on the (lawfulness of the) enforcement action. In March 2018, the data subjects submitted a request for erasure at the controller, concerning their personal data laid down in said report. The controller denied this request by decision of October 2018. The data subjects appealed this decision up until the Administrative Division of the Council of State. The Division found that the controller's decision lacked substantive reasoning and ordered it to issue a new one. The controller denied the data subjects request again by decision of November 2020. It held that retention of the personal data was necessary pursuant to Article 17(3)(e) AVG, to substantiate it's defense in the civil proceedings started by the data subjects. The data subject appealed this decision, stating that the controller cannot invoke the exception of Article 17(3)(e). She argued that the Article specifically refers to the establishment, exercise or substantiation of a legal claim, however it does not include the defense against one. The Division noted that not only the wording, but also the context and purpose should be considered when interpreting EU legislation (HvJ Tarola). This required a comparison of the different language versions (HvJ Consorzio). The Division found that the English, German and French version of Article 17(3)(e) all had a much broader scope than the Dutch text. They contained some translation of the word 'defense,' (defence; Verteidigung; défense) while the Dutch version merely used the word 'substantiation' (onderbouwing). The Division further noted that
The data subject submitted a complaint to the Basque DPA following the inclusion of unrelated sensitive medical data (her gender reassignment) in a report about her injured foot. After investigating, the DPA issued a warning to the controller, Osakidetza-Servicio Vasco de Salud, for violating the principle of data minimisation Article 5(1)(c). The controller appealed the decision to the Administrative Court No. 2 of Vitoria-Gasteiz, which upheld the appeal. The DPA then appealed that court's decision to the Administrative Chamber of the High Court of Justice of the Basque Country, which upheld the DPA's appeal. Finally, the controller appealed the High Court's decision to the Spanish Supreme Court. Before the Supreme Court, the controller argued that, in light of the fact that the personal data had been lawfully collected, the data subject was required to exercise her right of restriction of processing Article 18 GDPR before she could file a complaint with the DPA. As a secondary point, the controller argued that the DPA disregarded relevant circumstances, namely that the medical records were intended only for the data subject. Ultimately, the Court rejected the controller's arguments and dismissed the appeal. The Court first addressed whether, in a case where the controller carries out a processing activity that the data subject considers to be excessive and data has been already collected, the data minimisation principle from Article 5(1)(c) GDPR is directly enforceable, or whether the data subject must first exercise the right to the restriction of processing provided for in Article 18 GDPR. As explained by the Court, Article 18(1) GDPR, in particular in paragraph (d), is linked to Article 21(1) GDPR, which guarantees the right to object to processing. Both rights are of a temporary nature and relate to a disputed deletion of personal data collected on the basis of Article 6(1) (e) or (f). At no point had the data subject sought the deletion of her personal dat
The controller (an inspector of the Tax Administration Arnhem) imposed an additional turnover tax assessment of €25,269 on the data subject. After objecting to this decision by the controller, the data subject brought the case before the Court of Gelderland, which partially upheld his claims. The data subject then appealed the Court’s decision. During the appeal, the controller submitted two overviews of the data subject's trading stock: one which contained personal data (such as registration numbers of the cars, tax numbers of buyers, names of buyers, etc.), and one where the personal data had been redacted. The controller invoked confidentiality as referred to in Article 8:29 Awb to protect the data of third parties, and only wanted the anonymized version to be used in his defense. He argued that the submission of the overview including the personal data was in violation of the data minimization principle. The data subject argued that the overview including the personal data had to be submitted, as the anonymised overview would be a disadvantage to his procedural position. First, the Court of Appeal considered that the overview contained personal data, and that its submission to the Court had to be understood as ‘processing’ within the meaning of Article 4(2)(c) GDPR. It further noted that the controller had a legal obligation to provide the Court with documents ‘relating to the case’ pursuant to Article 8:42 Awb. The Court found that the overview did relate to the case, and held that the submission of the overview including personal data was not in violation of the data minimization principle (Article 5(1)(c) GDPR), since the processing was based on a legal obligation pursuant to Article 6(1)(c) GDPR.
The data subject used to work for Eega (controller), a company that guides disabled people towards employment. After termination of the data subject's employment, her employer restricted her access to the laptop as it was still in the data subject's possession. The controller filed a claim in interim relief proceedings demanding the return of the laptop. The data subject did not object to the laptop being returned. However she wanted to delete her personal data from the laptop first and invoked her right to privacy. The data subject filed a counterclaim to demand that she would be given the chance to erase her personal data from the laptop. The controller did not consider this a reasonable demand because (1) the laptop was meant for work-related purposes only (so not for storing personal information). In addition, (2) access to the laptop would give the data subject unauthorised access to its confidential work environment. The controller thus also invoked its right to protection of privacy-sensitive information. The District Court of Overijssel (Rechtbank Overijssel - Rb. Overijssel) concluded that both claims were partly justified. The controller’s claim was not fully justified, as the controller did not dispute that the laptop contained personal data of the data subject. The fact that the data subject was not allowed to put these data on the laptop was irrelevant. It was still personal data within the meaning of the GDPR and therefore protected by this Regulation. The data subject’s counterclaim was not fully justified, as granting her access to the laptop would give her access to the controller’s digital work-environment. This contained personal data for which the controller was responsible (other employees, clients). The Court held that the solution must be found in the middle. The Court proposed that laptop would be taken to the controller. Someone other than the data subject or the controller could then erase the data subject's personal data from t
The data subject is engaged in the dealing of firearms which are subject to a prohibition with a reservation of permission. Moreover, as became known in a separate court decision, the data subject is afraid of becoming a victim of kidnapping or robbery. The Federal Office of Economics and Export Control, the data controller, is the supervisory authority of the data subject in regards to the German laws on war weapons and has largely switched to electronic legal transactions via its communication portal: the electronic war weapons register. The data subject contacted the controller and complained that future information on the electronic war weapons register should only be transmitted by e-mail which is encrypted by a special software and objected to the current form of transmission as a precautionary measure under Article 21 GDPR and requested a restriction of processing under Article 18 GDPR. Additionally, the data subject complained about the controller's email communication, pointed out that the messages contained personal data within the meaning of Article 4(1) GDPR, and requested appropriate technical and organisational measures in accordance with the state of the art, such as end-to-end encryption, as well as the restriction of the processing pursuant to Article 18(1)(d) GDPR. The controller promised to carry out an examination but continued to use email to communicate with the data subject. The data subject took this as an occasion to apply for an exemption from the legally obligatory electronic notification of his weapon dealings. Eventually, his application was rejected and he was asked to continue using the controller's online portal for future notifications. As a response, the data subject brought an action for injunction before the Administrative Court of Frankfurt am Main concerning the controller's data transfers. The controller asked the court to reject the data subject's notion, reasoning that the data processing was justified by Article 6(1)(e) GD
The data subject distributed weapons of war and security products to the German authorities. Due to their "physical and chemical properties," the data subject's products were particularly suitable for illegal activities, and he feared becoming a target of kidnapping or robbery to obtain those products if his personal data were exposed. The German Federal Office for Economic Affairs and Export Control (hereinafter “Office”) was the supervisory authority of the controller within the meaning of the German War Weapons Control Act and the corresponding regulation on the implementation of this act. The Office maintained the electronic war weapons register and had switched to electronic legal transactions via its own communication platform. Emails sent out by this communication platform were sent with transport encryption, not end-to-end encryption. The data subject and the controller disagreed about the obligation to use end-to-end encryption in these electronic legal transactions. The data subject argued that the electronic legal transactions need to be safeguarded by end-to-end encryption. The controller and the Office argued that a transport encryption was sufficient and does not see the necessity to implement additional end-to-end encryption. The data subject requested a temporary injunction on the transmission of his personal data without end-to-end encryption by the controller pending a decision on the issue by the Administrative Court of Frankfurt. The Court held that transport encryption was sufficient for sending email via the controller's communication platform. According to Article 5(1)(f) GDPR, personal data must be processed according to the principles of integrity and confidentiality. The Court acknowledged that these principles are general and need to be specified, but it insisted that they impose concrete obligations, not merely goals for which to strive. The measures that must be taken are those that ensure a level of protection appropriate to the r
Undertakings with registered offices in Denmark were exporting cheese to third countries under the Designation “Feta”, “Danish Feta” and “Danish Feta cheese”, even if these products do not comply with the product specification for the PDO “Feta”. After a complaint by Greek authorities, Danish authorities replied that it was not contrary to EU law, as Reg.1151/2012 only applies to products sold within EU territory and not outside the EU. Thus, Danish authorities claimed to be allowed to use the name ‘Feta’ to designate Danish cheese exported to third countries where that name is not protected. The question that the CJEU needed to answer was whether the Kingdom of Denmark has failed to fulfil its obligations under Article 13 of Regulation No 1151/2012 and has infringed the principle of sincere cooperation laid down in Article 4(3) TEU. 1. Violation of Article 13 of Regulation No 1151/2012 The CJEU held that when interpreting [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32012R1151 Article 13(3) Reg.1151/2012], one must consider its wording and also the context in which it occurs and the objectives pursued by the rules of which it is part ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=252150&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=24294986 C-569/20 Spetsializirana prokuratura]). Concerning the wording of [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32012R1151 Article 13(3) Reg.1151/2012], the term “any use” includes the use of a registered name to designate products not covered by the registration which are produced in the EU and intended for export to third countries is not excluded from that prohibition. Concerning the context where this provision was adopted, two elements seem to be decisive. First, the fact that the regulation was adopted based on [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12008E118:EN:HTML Article 118(1) TFEU], which empowers the European Parliament and th