GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
The case concerned a decision by Vergabekammer Baden-Württemberg (Procurement Chamber Baden-Württemberg), the administrative authority that reviews public procurement procedures. A publicly owned company (Regionale Kliniken Holding RKH GmbH, today RKH Regionale Kliniken Holding und Services GmbH), owned only by municipalities and regional authorities and therefore subject to public procurement law, invited tenders for the procurement of software for digital administration in an open procedure throughout Europe.https://ausschreibungen-deutschland.de/843547_Software_fuer_Digitales_EntlassmanagementReferenznummer_der_Bekanntmachung_2021-20-WEI-OV_2021_Ludwigsburg The criteria contained, among other things, requirements for data protection and IT security. The company inviting the tenders received offers from company A and company B (Pflegeplatzmanager GmbH)https://gruendelpartner.de/newsroom/gruendelpartner-erwirkt-weitreichende-entscheidung-zur-unzulaessigkeit-von-cloud-und-it-dienstleistungen-durch-us-tochterunternehmen-in-deutschland/. Company A used the services of company C (Amazon Web Services EMEA S.à r.l.)The decision was pulished via [http://web.archive.org/web/20220812064735/https://rewis.io/urteile/urteil/ocw-13-07-2022-1-vk-2322/ rewis.io]. The used clauses are unique to [https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf AWS]. a subsidiary of company D (Amazon Web Services, Inc.) based in the United States, as a sub-processor. Its servers were located in the EU. Company C included clauses in its offer stating that it would not disclose customer data to any third party, except as necessary to maintain or provide the services, or as necessary to comply with the law or a valid and binding order of a governmental body. After reviewing the offers, the publicly owned company issued a decision where it awarded the contract to Company A, as their evaluation of the price was the most economical. Company B challenged this decision. It argued that company A had
The data subject had lost his insurance certificates. He therefore sent an access request under Article 15(1) GDPR to the insurance provider (the controller) to obtain them. The Regional Court of Erfurt (LG Erfurt) held that the question of whether Article 15 GDPR may be used for non-data protection-related requests or whether it is an abuse of rights is controversial and the case law is not consistent on the matter. Therefore, it requested a preliminary ruling from the CJEU on the following questions: 1. Is Article 15(3) GDPR in conjunction with Article 12(5) GDPR to be interpreted to the effect that the controller is not obliged to provide the data subject a first copy of his personal data processed by the controller free of charge if the data subject does not request it for purposes referred to in the first sentence of recital 63 to the GDPR (namely to become aware of the processing of his personal data and to be able to check its lawfulness) but instead pursues another - non-data protection-related but legitimate - purpose? 2. If the answer to question 1 is no: a) Can a national provision of a Member State which was adopted before the entry into force of the GDPR be considered as a restriction on the right to a free copy of the personal data processed by the controller under Article 23(1) GDPR? b) If the answer to question 2a is in the affirmative: Is Article 23(1) GDPR to be interpreted as meaning that the rights and freedoms of other persons referred to therein also include their interest in being relieved of the costs associated with the provision of a copy of data pursuant to the first sentence of Article 15(3) GDPR and other expenses caused by the provision of the copy? c) If the answer to question 2b is affirmative: In the doctor-patient relationship, does the provision of a copy of the patient's personal data from the patient's file always and irrespective of the specific circumstances of the individual case give the doctor a right to charge the pati
The complainant saw his right of access violated, since video recordings of therapy sessions had not been sent to him. The DPA dismissed the complaint as unfounded. Consequently, the complainant filed an appeal against this decision. The BVwG did not (yet) take a decision on the merit of the case but stalled the procedure it filed a request for preliminary ruling on the question the interpretation of Article 15(3) GDPR in August 2021. See decision BVwG - W211 2222613-2/12E. Once the CJEU has passed its judgment on the matter, the BVwG will resume the case.
An insurance policy holder (the claimant) had a private health insurance with an insurer (the defendant). After the defendant made certain premium adjustments within the framework of the existing health insurance contract, the claimant initially unsuccessfully requested information on premium adjustments from the defendant. The claimant then asserted that he had the right of access to information from the defendant under Article 15 GDPR concerning the years 2018, 2019, and 2020 to the effect that the defendant had to inform him of the amount of the respective premium adjustments and the information transmitted for this purpose in the form of insurance certificates. The Regional Court Kassel (LG Kassel) first considered if the amount of a health insurance premiums constituted personal data. It held that it could not be regarded as personal data as it does not reflect the individualized insurance protection of the insured persons, taking into account their health conditions. It merely provides information on the price of the insurance cover for a particular person as laid down in the insurance contract. Even though there are individual tariffs for the premium amounts, it does not enable the identification of an individual. Therefore, the amount a person spends on their health insurance cannot be regarded as personal data. Consequently, the claimant had no right to access under Article 15 GDPR. Second, the Court considered whether the claimant could have invoked their Article 15 GDPR rights if the data in question had been personal data. It held that, in light of Recital 63 GDPR, the intent and purpose of the right of access is to make the data subject aware of the processing of personal data and enable them to verify the lawfulness of data processing. The claimant, however, invoked Article 15 GDPR exclusively to examine and check the premium adjustments made by the defendant for possible mistakes which the protective purpose of the GDPR does not cover. Consequently
The controller is ING, a Dutch bank, and the data subject is one of its former employees. The controller had received signals of fraud: an anonymous report which stated that the data subject was involved in money laundering, skimming money of supermarkets he co-owned, and mortgage fraud. This, together with other elements, led the controller to monitor the email use of the employee, after which it became clear that the data subject had structurally used his work-equipment for private purposes. The controller requested the Subdistrict Court to dissolve the employment agreement on grounds of the culpable acts or omissions of the data subject. The Court, however, dismissed the request because it was unclear whether the controller had respected the conditions set by the ECHR in Bărbulescu for monitoring employees' email use. The Court held that, according to these requirements, the following questions must be asked:1. Was the employee informed in advance of (the nature of) possible monitoring of correspondence and other communications by the employer? 2. What was the scope of the monitoring and seriousness of the breach of the employee’s privacy (or: proportionality)? 3. Did the employer have legitimate grounds to justify the monitoring applied? 4. Would monitoring have been possible with less intrusive methods and measures? 5. What we're the consequences of the monitoring for the employee? 6. Have adequate safeguards been provided for the employee, especially in the case of intrusive monitoring? The Court stated that it was unable to assess whether (1) ING had a justification for monitoring the business emails, and (2) whether the monitoring was legitimate and proportionate. It therefore denied the controller's request who, in turn, appealed the Subdistrict Court’s decision. First, the Court of Appeal noted that the Subdistrict Court incorrectly referred to the guidelines listed in Bărbulescu as cumulative conditions. It followed that these conditions do not all hav
The controller is an operator of a search engine. If a user used specific keywords in a name-based search, the search engine showed search results that contained the following wording: "T ENTREPRENEUR, CMO AND VICTIM OF DOMESTIC VIOLENCE BY I, BOYFRIEND AND INVESTOR IN HER COMPANY I come from a privileged background, a loving family, I have a higher college degree, I’ve been an entrepreneur for as long as I can remember, I’m a CMO, I speak 5 languages fluently… and I was in an abusive relationship with a venture capitalist. The emotional abuse escalated into physical abuse and on the 23rd of April 2021 I ended up in hospital and he was incarcerated.” Images of the data subject were also included. The data subject requested an interim injunction stopping the search engine from listing search results containing the quote and his images. The Regional Court of Cologne (LG Köln) held that the application for an interim injunction is admissible and well-founded. The proceedings were brought against the controller on the basis of Article 79(2) GDPR. On the merits, the court ruled that the operator of a search engine is considered to be the controller within the meaning of Article 4(7) GDPR and that the controller is requested to delete the data subject’s personal data as the requirements of Article 17(1)(c) GDPR and Article 17(1)(d) GDPR are met. The processing of the data subject’s personal data in this case is not necessary for exercising the right of freedom of expression and information under Article 17(3)(a) GDPR. In particular, the rights of the data subject under Articles 7 and 8 of the Charter of Fundamental Rights of the EU (CFR) were in this case held to outweigh the freedom of the controller to conduct a business under Article 16 CFR and the freedom of expression and information under Article 11 CFR. In conducting the balancing exercise, it was decisive for the court that the data subject made it credible that the cited statements were untrue or opinions with
The controller published a judgement produced by a local court which included the full names and addresses of the data subjects. It also published an agenda of a municipal council meeting which contained the names of the data subjects several times. Both documents were made available on the controller's homepage. The Court was of the opinion that the controller violated Article 5(1)(a) GDPR by publishing the personal data online. In considering whether the data subjects should consequently be entitled to compensation under Article 82(1) GDPR, the Court expressed its opinion that the mere loss of control over one's data does not constitute non-material damage. The Court reasoned that the concept of non-material damage should require that a certain threshold of inconvenience is crossed. It therefore deemed that not every unlawful processing of personal data should lead to a claim under Article 82(1) GDPR. The Court stayed the proceedings and requested a preliminary ruling by the CJEU on whether the concept of non-material damage requires that the data subject suffers a noticeable disadvantage and an objectively determinable impairment of their interests or whether a mere short-term loss of control over their data suffices.
The controller was the Minister for Legal Protection. The 2 data subjects have been in a relationship since 2020 and are expecting a baby. On February 2021, they were investigated because they were expecting a baby by the Child Care and Protection Board (RvdK), after a Request for Investigation (VTO) from Child Protection Overijssel (JBOV). The RvdK made a report following this request. The report included two attachments, containing a timeline from June 2013 to November 2020, and a forensic psychological investigation of data subject 1. On March 2021, the data subjects requested the controller to erase the attachments, as they were in their view no longer relevant. They concerned information on data subject 1, her ex-partner and the children they have together. They argued that this was separate from the investigation regarding the baby they were expecting. Moreover, they stated that the JBOV promised them orally to leave the past alone. The controller denied this request, as the RvdK needed the information for the exercise of its statutory task of public interest. The data subjects objected this decision, which the controller declared unfounded. The data subjects then filed an appeal at the court. In the appeal, the data subjects stated that there were no compelling legitimate grounds to process the attachments, that outweigh their interests. They argued that processing cannot be necessary, as the information is seriously outdated and obsolete. They also argued that retention of the data is not important with respect to the RvdK's task of public interest. They felt that it was disproportionately invasive of their privacy for the purpose served. The controller contested these arguments and stated that the importance of conducting a proper investigation outweighed the invasion of the data subjects' privacy. The Court stated that while the attachments relate to the past, this did not make them outdated. It followed that they contained information on data subject
In January 2020, the data subject requested access under Article 15 GDPR from an Austrian credit reference agency (controller). The controller replied that it processed (among other data) eleven database entries on the data subject, concerning debts that had not been settled on time. The debts ranged between €42,70 and €186,84. At the time of the reply to the access request, all debts had been settled; some already in July 2014, others only in September 2019. Furthermore, the controller processed eight data sets on (former) addresses of the data subject. The data subject requested the controller to erase all data, arguing that she had not been able to get a loan to buy furniture for her apartment due to a low credit score assigned by the controller as a consequence of the processed data on previous debts. The data subjected also stated to have been employed for over a year with a high income and that she had been able to settle all debts. Hence her creditworthiness should be considered restored. The controller erased a database entry on a €72,95 debt from 2019, but refused to delete anything else, arguing that there was no reason for erasure under Article 17 GDPR as the processing was still necessary and lawful under Article 6(1)(f) GDPR. In June 2020, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB), arguing that further processing of the data was not necessary due to the low amount of the individual debts and the fact that all debts have already been settled. Hence, the interests of the data subject also outweighed those of the controller under Article 6(1)(f) GDPR. The controller contested these arguments but erased two further database entries on previous debts (on a €37,70 debt and a €46,45 debt, both settled in 2014) and several old addresses. In September 2020, following a further exchange of submissions before the DSB, the controller deleted four more database entries (on debts ranging from €85,40 to
The controller was Toplofikacia Sofia EAD, a heating company in Bulgaria. The data subjects were customers of the controller. The controller submitted a copy of the data subjects' mortgage deed as evidence in a separate court procedure before the District Court of Sofia. The controller had obtained a copy of the document in the normal course of business with the data subjects. Bulgarian law required that the controller establish the property rights of its customers before executing a contract to supply heat. The Administrative Court of Sofia found that the controller had processed data on the property and financial situation of the data subjects contained in the mortgage deed without a legal basis under Article 6 GDPR and ordered the controller to pay the data subjects €127.82 Euro (250 BGN) each as compensation for non-material damages. The controller appealed the decision, taking the view that the lawful bases for processing the data subjects' personal data were "data subjects' consent," "neccessary for performance of a contract," and "necessary for compliance with a legal obligation," under Articles 6(1)(a), 6(1)(b), and 6(1)(c) GDPR respectively. The Supreme Administrative Court of Bulgaria upheld the decision by the lower court in its entirety. First, the Court confirmed that the controller had processed the data subjects' personal data: The mortgage contained the data subjects' personal data because it contained their names as well as financial and property information (all relating to identified natural persons per Article 4(1) GDPR), and the controller processed that data initially by collecting it. The Court clarified that retaining the data and later producing it before a court were further processing that required a legal basis under Article 6. Next, the Court acknowledged that the data subjects did in fact consent to the initial processing (collection) of their personal data, but it stressed that this consent extended only insofar as processing was nec
The French DPA had received a complaint on 28 May 2018 regarding the lawfulness of processing by Amazon Europe Core ('Provider' or 'The company'). The French DPA had forwarded this complaint to the Luxembourg DPA under the 'one stop shop' mechanism of Article 56 GDPR. The luxembourg DPA started an investigation regarding Amazon's use of cookies and its compliance with the GDPR and the ePrivacy directive. However, the French DPA started its own investigation into Amazon's compliance with Article 82 of the French Data protection act, a national implementation of Article 5(3) of the ePrivacy directive. (directive 2002/58/EC). This investigation regarding Article 82 had resulted in decision [https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729 SAN-2020-013]. In this decision, the French DPA fined Amazon €35,000,000 for the failure to obtain prior consent and the failure to inform users of their rights with regards to the processing of their data, which was mandatory under Article 82 of the Data Protection Act. The DPA found that when a user visited the "Amazon.fr" site, a large number of cookies with advertising purposes were automatically placed on the data subjects computer. Because this type of cookie was not essential to the service provided by the controller, the DPA considered that the controller had not complied with the obligation to obtain the consent of Internet users before depositing the cookies. Amazon appealed this decision at the Conseil d'Etat, the French Supreme Administrative Court, and requested its annulment. Amazon also asked the Conseil to refer several questions to the CJEU for a preliminary ruling. Among other arguments, Amazon claimed that the French DPA had made an incorrect interpretation of the law regarding its competence and had disregarded its competence by imposing the contested sanction. The controller also stated that the involvement of the French DPA, when the Luxembourg DPA was already involved, constituted a violation of A
A data subject filed a complaint with the Bulgarian DPA because a courier, Speedy AD (the controller) had delivered a parcel addressed to them to another person, which was located at the address and is not the addressee. On 04.09.2021, for the data subject was prepared and sent a parcel, which parcel contained a form letter with personal data- two names, an address and a telephone number in connection with an organised service action for the car of the data subject. On the same date, the data subject has informed the controller, that did not reside at the address indicated for delivery and die not indicate a new address for redirection of the shipment. The parcel was delivered by a courier of Speedy AD on 5.09.2019, despite a timely phone call from the addressee on 4.09.2019 that they not live at the address. It was delivered to an unknown person who signed instead of the data subject.The employee of the controller did not perform identity verification and did not reflect this properly in the system of the controller. The Bulgarian Supreme Administrative Court (ВАС) finds that the data on the bill of lading and in the shipment - two names, mobile phone number, address of previous residence, the capacity of the data subject as the owner of a specific and individualized vehicle, constitute personal data. The acts of receiving, storing and transmitting personal data in the context of the delivery of a shipment constitute processing of personal data. The statutory requirement that postal items be provided to recipients in person constitutes a measure to protect the personal data subject in order to verify the identity of the recipient and to ensure the lawfulness of the processing of personal data as a response to the obligations of the controller to put in place appropriate technical and organisational measures within the meaning of Articles 24 and 25 GDPR. The Bulgarian Data Protection Authority (CPDP) found a breach of Article 5(1)(a) GDPR and Article 5(1)(f) GDP
The plaintiff, a journalist, sought access to information in connection with the granting of "old-age compensation due to health problems" to former members of the Bundestag. He requested an anonymised or otherwise redacted overview of cases between 2000 and 2020 from the Bundestag, broken down by year and with information regarding whether they had been decided positively and negatively, as well as the number of cases since 2006 in which compensation had been paid out without their requirements being met. In addition, he requested an affirmation regarding the correctness and completeness of the information as well as access to all relevant administrative files. The German Bundestag rejected the plaintiff's applications on the grounds that access to information was contrary to the protection of personal data. It was highly likely that the applicant would be able to identify the persons concerned. This resulted from the fact that only a relatively small number of MPs left the German Bundestag prematurely. Since the career of individual MPs could be easily traced (e.g. by means of an internet search) the information and the files could be attributed to a narrowly defined group of persons, even if the documents were redacted. Insofar as the MPs were deceased, the disclosure would be contrary to the post-mortem right of personality. None of the persons concerned and none of the relatives of the deceased had declared their consent. The interest of the data subjects in secrecy outweighed the interest in information of the plaintiff, because the requested information was connected to the political mandate of the individuals concerned. In addition, it concerned sensitive health data. In three steps, the court held that the information concerning former members of the Bundestag is protected insofar as they are still alive. The court first established that the information concerning still living former members of the Bundestag constituted personal data. In accordance wi
The Labour Chamber of the Spanish National High Court dealt with an appeal from a case in which a trade union sued a company for not providing their workers a corporate email and asking for a personal email instead (among other things). The workers were working remotely since the COVID-19 pandemic, and the company demanded their private emails in order to be able to communicate with the workers for diverse matters such as holidays requests, leaves, etc. This was established by a clause in their contracts. The company had also previously agreed to provide corporate emails to the workers. Additionally, the company had suffered a data breach in which their employees' private emails had been compromised. Upon this, the trade union had also asked the company to provide the list of such emails so they could communicate with the workers. The company replied that they would not provide the workers' emails without their consent. Given these facts, the Court first remarks that the law obliges the employer to provide their workers every means necessary to achieve develop their professional activity. In this regard, also, the law regulating remote work, passed in 2020, establishes that in any case, companies shall be obliged to provide the means, equipment, tools and consumables required for the development of remote work. Additionally, the Court highlights that the Court's case law has already established that demanding workers to provide their personal email or phone is a violation of GDPR, since, should they be necessary for the development of the workers' activity, they should hence be provided by the company. Therefore, the company would have breach the data minimisation principle from Article 5(1)(c) GDPR. With regard to the union's demand to provide a list of the workers' emails, the Court stated that, also according to the Court's case law, providing such list does not require consent since it is necessary for the development of the purposes of the right (and freedo
“A” brought an executive action against “B”. After this, an enforcement proceeding was started with an order to impound two vehicles. However, it became clear that it was impossible to impound the vehicles. After this, the pursuing creditor requested the controller to provide information about the journeys of these vehicles in question since a specific date. The controller is an entity responsible for collecting toll fees on highways with the use of an electronic system, thus monitoring the passage of vehicles at certain points installed on the road for this purpose. The controller is therefore able to register traffic and collects personal data from its clients. The controller is also responsible for the treatment of such data. The controller stated that it couldn't supply information concerning toll records (date, time and place) because this was part of the the concept of protection of privacy. These toll records could only be shared with the consent of data subjects, the owners of the cars. After this, the pursuing creditor requested the lifting of professional confidentiality from the controller so the record of the journeys of the cars could be disclosed, whic could result in the cars being seized. The Court held that those responsible for processing personal data, as well as those who, in the course of their duties, have knowledge of the personal data processed, are bound by professional secrecy, even after the end of their functions (Article 10 of Lei 58/2019), which directly mentions Article 38(5) GDPR. Lei 58/2019 is a national law for GDPR implementation). This duty of secrecy must give way to the duty to provide legally required information, particularly to the judicial authorities, and to the duties of the National Commission for Data Protection (Article 8 of Lei 58/2019). The Court held that the records collected by the controller are personal data which fall under the concept of protection of privacy and for which there is an obligation of con
The data subject submitted an access request to the controller, Osterreichische Post AG, and she received a letter in response dated 10.12.18. The data subject submitted a complaint to the Austrian DPA (DSB) on 18.02.20 alleging that the controller had no legal basis under which to process her data and that the response she received to her request was incomplete and thus violated her right to access her personal data. The DPA rejected the data subject's complaint on the grounds that her right to file a complaint had expired per § 24(4) DSG because more than a year had elapsed between the time she discovered the alleged violation and the time she filed her complaint. The data subject appealed on the grounds that the unlawful processing of her data had continued until 13.11.19 when her personal data were deleted by the controller. The controller admitted in a letter to the DPA that the last of its marketing data had been deleted on 13.11.19 but claimed the complainant data subject's personal data had been deleted almost a year earlier on 13.12.18. The Federal Adminstrative Court annulled the contested decision and remanded the matter back to the DPA. Whether the data subject had a right to file a complaint depended entirely on which party's timeline was correct. This was a factual question which was the competence of the DPA, not the Court. The DPA had relied on the controller's submission without verifying it independently, so the Court ordered the DPA to perform its own investigation.
This case is an appeal of a decision by the Norwegian DPA, in which the Norwegian DPA fined a company (the controller) about €12,000 (NOK 125,000) for conducting an unlawful credit rating in breach of Article 6(1) GDPR, and required them to implement a policy for conducting credit ratings per Article 24 GDPR. The controller disagreed with the DPA on the first part of the decision, pertaining to the fine, and asked the supervisory authority to reconsider its position. After the DPA had reviewed the case again, they found no grounds to change their decision and so, as per Norwegian procedures, referred the case to the Privacy Appeals Board. The unlawful credit rating was conducted by the company's managing director, who was in conflict with the data subject in an inheritance dispute. In their comments to the Privacy Appeals Board, the company's attorneys claimed that the managing director had to be seen as a 'third party' and that the credit rating was lawful because he pursued a legitimate interest. The Privacy Appeals Board reviewed the case and agreed, first, with the DPA in that an acquiring company also acquires the prior (acquired) company's controller's responsibilities, even if the breach occurred before the company was acquired. Next, they noted that the relevant lawful basis of the processing in question (the credit rating) is Article 6(1)(f) GDPR, legitimate interests, and that it is the company who has the agreement with the credit rating agency and, thus, a legitimate interest in obtaining credit rating information. The Privacy Appeals Board noted that it is obvious that the managing director obtained credit rating information for use in the private inheritance dispute and not for the company's legitimate interests. They also concluded that the case is not related to a "third party" as defined in Article 4(10) GDPR and that this claim builds upon an obvious misinterpretation of the legal text. The Privacy Appeals Board held that the managing director'
The controller is the City Government of the Municipality of Maastricht. The data subject used to work for the controller. The data subject filed an access request but found the controller’s response insufficient. After the controller rejected her objection, the case was brought to the Court. The Court found that the controller violated general principles of good administration. The Court gave the controller the opportunity to rectify its mistakes and ordered the controller to make a new substantive decision on the data subject’s access request within six weeks. If the controller were to refuse access, it must explain why refusal was necessary and proportionate. The Court extended the deadline in a second interlocutory decision. In the new substantive decision, the controller provided an overview of each specific processing of the data subject‘s personal data. However, it omitted several details about the data subject, in particular about her as a former employee. The controller weighed the interests of the employee and the rights and freedoms of others and based this omission on Article 15(4) GDPR in combination with [https://wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=41&z=2018-05-25&g=2018-05-25 Article 41(1)(i) Implementation Act GDPR]. The controller provided the information it omitted to the Court. The Court justified the omission in an interim decision of 20 December 2021. This judgement builds on those interlocutory judgements. The Court upheld the data subject’s appeal from the contested decision because of violations of the principles of good administration, and it annulled the decision. However, it also upheld the legal consequences of the annulled part of the contested decision, as the defects of the contested decision had been remedied. Then, the Court considered the data subject’s appeal to the new substantive decision. First, the Court stipulated that Article 15(1) GDPR does not include a right to access every specific processing
The controller is Ziggo bv. The data subjects are customers of Ziggo. Ziggo is the largest internet service provider in the Netherlands. Stichting BREIN is dedicated to claims against copyright infringements on behalf of its members. BREIN states that more than 200 e-books are made available to the public through an 'open directory' with an IP-address made available by Ziggo. BREIN demands Ziggo to send a warning to the user to which the IP-address belongs for said copyright infringement. Ziggo refuses to send such a message. Alternatively, BREIN wants Ziggo to provide NAW-data (name, address and residence) of the user of the IP-address. This will enable BREIN to send the letter independently. BREIN also demands all of the above for every customer of Ziggo that infringes on the copyright of its members through an open directory in the future. BREIN states that the copyright infringement in question is established. In addition, BREIN states that Ziggo does not need a permit from the Dutch DPA nor a DPIA for these actions. Ziggo disputes these notions. The Court notes that it cannot establish that the user of the IP-address made the copyright infringement. In the hypothetical situation that an infringement would be established, the Court held that Ziggo would still need a permit from the DPA pursuant to Article 33(4)(c) UAVG. First, to connect the IP-address and NAW-data in order to send a warning and second, for the provision of NAW-data to BREIN. BREIN's argument that no personal data is processed by Ziggo on behalf of BREIN was disregarded by the Court, as Ziggo would use the IP-address provided by BREIN to connect the IP-address and NAW-data on behalf of BREIN. Furthermore, the Court held that Ziggo would need a DPIA (Article 35 GDPR). The Court also dismissed BREIN's argument that this is not obligated because it only constitutes an IP-address and not the processing of large amounts of criminal data. The Court stated that the (possibly large) amount of person
The controller is the SCHUFA Holding AG, the biggest German credit rating agency. The data subject is as a businessman operating an one-man business in the steel pipe trading sector and working as a commercial agent as a side-job. In the past, insolvency proceedings had been initiated against the data subject which was published - as required under German law - on the insolvency announcement portal "www.insolvenzbekanntmachungen.de". On March 25 2020, these proceedings were terminated. Under § 3(1) of the German Insolvency Announcement Regulation (InsoBekV) (a provision implementing and specifying EU insolvency law) entries in the insolvency announcement portal must be deleted not later than six months after the termination of the insolvency proceedings. The respective entry on the data subject was deleted during this period in the portal. The controller, however, stored the information about the insolvency proceedings in their own database even after this period. As a result of these records, the data subject was not able to switch his health insurance, rent an apartment or conduct business without prepayment. On 30 November 2020, the data subject requested the controller to stop disclosing the personal information from his insolvency proceedings to third parties and delete the information. The controller rejected the request of the data subject. It argued that its customers have a legitimate interest to know that the data subject had been insolvent during the time of the insolvency proceedings even after the six months period has elapsed. It considered a three years storage period appropriate as laid down in the "Rules of conduct for the review and deletion periods of personal data by the German credit agencies" ("Verhaltensregeln für die Prüf- und Löschfristen von personenbezogenen Daten durch die deutschen Wirtschaftsauskunfteien") ("Rules of Conduct"), an internal policy of the association of the biggest German credit rating agencies ("Die Wirtschaftsauskun