GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
This dispute is between a tax payer (data subject) and an inspector of the Dutch Tax Authority (the controller). The data subject was mentally ill and his parents provided the care and assistance he needed. On his tax return, the data subject used several deductions for specific care costs. The Tax Authority, however, deemed these deductions unlawful and issued corrections in 2013. Since then, his tax returns were manually audited and corrected in 2016, 2017 and 2018. The data subject was also included in the database 'Fraud Notification Facility' (FSV). After rejecting the data subject’s objection to these corrections, the case was brought to court. During the proceedings, the data subject expressed the suspicion that he had been the subject of ethnic profiling. As a result, the deductions for specific healthcare costs had been unjustly scrutinised for years. He followed that this suspicion was confirmed by a letter from the Tax and Customs Administration (dated 27 May 2021), stating that his data had been included in the database FSV. The data subject argued that his inclusion in the database did not comply with the GDPR. The Court stated, with reference to a judgement of the Dutch Supreme Court, that if the Tax Authority finds that deductions were incorrectly applied in a tax return, it can manually check that individual's tax returns of the following years.[https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:HR:2021:1748&showbutton=true&keyword=ECLI%3aNL%3aHR%3a2021%3a1748 HR 10 December 2021, ECLI:NL:HR:2021:1748] In principle, this also applies if that observation leads to the storage of the taxpayer's data in a database, and even if that data processing is in itself unlawful. The court held that this may be different if the audit results from a risk selection based on a criterion that violates a fundamental right of the data subject (such as a violation of the prohibition of discrimination on the basis of origin, orientation, or religion). Howev
The controller operated a care service where the data subject was employed. The controller filmed the data subject in their work environment and published a thirty-six second video on Youtube for promotional purposes. The data subject had previously given verbal consent to the filming but had not received any further information about the purpose of the filming or their rights. Later, the data subject objected to the use of the video and claimed €6,000 in damages during proceedings before the labour court. The controller deactivated the video immediately afterwards. The parties involved reached an agreement and settled the dispute. The data subject had applied for legal aid for claiming damages up to €6,000. The ArbG Kiel granted it up to the amount of €2,000. Thereupon, the data subject then appealed to the LAG Schleswig-Holstein for legal aid in the amount of €6,000. The court upheld the original decision. The controller infringed the GDPR by filming the data subject and publishing the clip because the data subject had not given written consent and was not informed about the purpose of the data processing or their right to withdraw consent. The data subject is entitled for maximum damages of up to €2,000, but not €6,000 as requested. The data subject does not have to prove that damage within the meaning of Article 82(1) GDPR has occurred, as a breach of the GDPR itself constitutes non-material damage. Recital 146, sentences 1 and 6 GDPR support this interpretation, as the claims for damages serve to support the objectives of the Regulation and in particular to provide effective protection of individuals’ rights. The court confirmed that damages in this case can amount to a maximum of €2,000. The controller did not film the data subject in intimate situations or discriminate them and the data subject gave verbal consent to be filmed. Furthermore, the controller reduced the harm by taking the video down immediately after the data subject requested it. However, on
Mr X had filed a complaint with the Belgian DPA because his ex-wife was posting pictures of his son on Facebook. The litigation Chamber closed the case. The litigation Chamber further suggested the complainant to request a mediation to a dedicated service within the DPA, in order to reach an amicable settlement witht he other party. The complainant started the procedure on 30 December 2019 and only received an answer from the DPA on 18 May 2020. After several reminders, on 1 October 2020, the DPA informed the complainant that the mediation did not succeed. The complainant sued the DPA for damages before the Brussels court for not dealing with his case in a timely manner and with the appropriate care. The Tribunal held that the Belgian DPA lacked diligence on the following grounds. First, no explanation was given to the complainant on the different steps undertaken to handle the complaint, despite the numerous reminders sent by the complainant. Second, no response was provided despite the DPA having committed to do so before 15 August 2020. Third, not having handled the case within a reasonable period of time. The DPA was ordered to pay a symbolic amount of 1 euro to the complainant, since no further damage could be demonstrated by the complainant as a consequence of the lack of diligence.
The controller was the parent company of a conglomeration that operated a cross-company and cross-sector customer loyalty programme. Customers at participating retail outlets could register as members, collect points on the basis of their purchases and subsequently redeem them to receive discouts and other perks. The controller processed personal data obtained from participants in the loyalty program to, among others, automatically generate consumer profiles to create targeted ads. The controller claimed consent as the legal basis for this processing pursuant to Article 6(1)(a) GDPR and in its privacy policy stated that this consent was voluntary and could be revoked at any time. The DPA initiated an official investigation and, based on the results of this investigation, also initiated administrative penal proceedings against a subsidiary of the controller. On 26.7.21, the DPA fined the subsidiary €2,000,000 for using legally invalid consent and thus unlawfully processing the personal data of participants in its loyalty program. The subsidiary appealed to the Federal Administrative Court (BVwG). The DPA also initiated administrative penal proceedings against the controller (the parent company), fining it €8,000,000 for the unlawful processing of personal data relating to the loyalty program. The controller also appealed this decision to the BVwG, arguing that, among others, there was not only a lack of the necessary elements of the offence but that the controller could not be found at fault for the violation. The Court stayed proceedings pending a ruling by the European Court of Justice (CJEU) in C-807/21 - Deutsche Wohnen SE. In that case the Higher Regional Court Berlin (KG Berlin) referred the following questions: 1) Is Article 83(4) to (6) 1 to be interpreted as incorporating into national law the functional concept of an undertaking and the principle of an economic entity, as defined in Articles 101 and 102 TFEU, as a result of which, by broadening the pr
An Irish Hospice placed CCTV cameras in the staff tearoom, following advice from Gardai (Irish Police) after graffiti had been left on a table saying: "Kill all whites, ISIS is my life". The incident happened in 2015, shortly after terrorist attacks in Paris. A sign was placed beside each camera which read: “Images are recorded for the purposes of health and safety and crime prevention.” The same information was included in the hospice policy. The CCTV footage, that was reviewed as part of security investigation, revealed numerous unauthorised breaks of the data subject, who was one the hospice employees at that time. Although there was no suggestion that the data subject had any involvement in the graffiti incident, the data collected from the CCTV prompted disciplinary proceedings against him. The data subject made a complaint to the DPC. The complaint was rejected, on the basis that the CCTV images were not processed beyond the original security purpose. It was argued by the hospice that the evidence for the data subject's disciplinary proceedings was based on records from a key fob used by the data subject to enter the tearoom. The data subject appealed to the Circuit Court. The Circuit Court upheld the DPC’s decision. The data subject appealed again to the High Court. The High Court found that the DPC incorrectly interpreted the term "processing" under the Data Protection Act 1988. The DPC appealed the decision to the Court of Appeal. The Court of Appeal upheld the High Court decision. The Court decided that: 1. The data subject was not made aware, at or before the time when the data was obtained, of the purpose for which the data was intended to be processed, contrary to the fair processing requirement of the Section 2D of the Data Protection Act 1988. 2. Based on the Court’s analysis of Article 29 of the Data Protection Directive of 1995 entitled “Working Party on the Protection of Individuals with regard to the Processing of Personal Data”, the CCTV dat
The controller is Scalable Capital, an online stockbroker. The data subject is a customer of the controller. The controller informed the data subject about a data breach which had occurred on 19 October 2020. A third party had accessed parts of the data subject's personal information, potentially including personal, tax and contact data and their IBAN. The breach was conducted by using the credentials of CodeShip Inc., a "Software as a Service" company which the controller had contracted in the past. The contract was terminated in 2015. After the termination, the controller did not delete or change the credentials of CodeShip Inc. The third party obtained the credentials by means of a cyber attack against CodeShip Inc. The third party used CodeShip’s – still valid – credentials three times between April and October 2020 to gain access to the controller's database. Some of the data obtained was supposedly used for identity theft or for other fraudulent behaviour. After the breach, the controller paid the data subject a one-year subscription to the identity protection service “meine SCHUFA Plus”. The court ordered the controller to pay €1200 as non-material damages to the data subject. The court found that the controller violated Article 32(1) and Article 5(1)(f) GDPR because it had not implemented technical and organisational measures to ensure an appropriate level of security, especially in regards to “integrity and confidentiality”. The controller contributed to the data breach and potential identity theft by not deactivating or changing CodeShip’s credentials for several years. Although it could not be verified by the court that the data subject’s identity was fraudulently used by a third person, the court found that the risk alone establishes an immaterial damage pursuant to Article 82(1) GDPR. When assessing the amount of damages pursuant to Article 82(2) GDPR, the court considered as mitigating factors that the data was not used for any fraudulent behaviou
A data subject made an access request with an address publisher and direct marketing company, the controller, asking it specifically to provide him with information about his data stored in relation to "political preference" and about the recipients of his "target group" data. As the controller only partially complied with the access request, the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde, DSB) claiming a violation of his right to access under Article 15 GDPR. The DSB partially upheld the complaint of the data subject, stating that (1) the controller did not fully comply with his access request and ordered the controller to (2a) disclose to the data subject the names of the recipients of his personal data, (2b) provide him with comprehensible information on the terms of the advertising groups, in particular about the key terms used, relevant parameters, and their allocation to the data subject, and (2c) to provide generally understandable information about the term "possible target group - academics" to the data subject. The controller appealed the decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG), claiming that it is not obliged to disclose the names of the recipients of the data subject's personal data, as that would mean disclosing its sales channels and customer relationships. The BVwG started evaluating the case but then suspended the proceedings, pending the decision of the CJEU in case C-154/21 and issued only a partial decision on 17 May 2022. In the first partial decision n. W214 2233132-1/13E, the BVwG limited its decision to points (2b) and (2c) of the DSB's decision. In this respect, the court agreed with the controller stating that the DSB had gone beyond what was requested by the data subject in his complaint. In fact, the data subject's complaint under Article 77 GDPR was very clear and limited in scope. However, the DSB went on to assert a violation of Article 12 GDPR and Ar
On 17 August 2018, the data subject requested that the Dutch DPA takes enforcement action against a cinema (the controller) on the basis of the GDPR, because the cinema no longer accepted cash payments. As a result, the purchase of a cinema ticket was only possible by means of a debit card payment at the box office or through the cinema’s website. Snacks and drinks could also no longer be paid for with cash. Personal data, namely the bank account number, the amount and the payment date, were processed for these debit card payments in addition to the visitor's name, email address, telephone number, transaction data and IP address when purchasing via the cinema’s website. The data subject believed that he should be able to go to the movies anonymously as there is no necessity for the processing of personal data. On 16 April 2019, the Dutch DPA denied the data subject’s request to take enforcement action against the controller. The DPA also dismissed the data subject’s objection on 27 November 2019 as it believed that the GDPR had not been violated. The processing of personal data when purchasing a ticket or snacks and drinks was considered necessary for the performance of a contract (Article 6 (1)(b) GDPR). The processing of personal data as a result of visiting the website was considered necessary for the maintenance and improvement of the website (Article 6(1)(f) GDPR). According to the DPA, there was no reason for enforcement action. The District Court of First Instance of Gelderland considered whether the DPA was entitled to concluding that the cinema had not violated the GDPR and hence had no authority to take enforcement action. First, the court considered the processing of personal data when paying with a debit card for the purchase of a cinema ticket or snacks and drinks, and iDeal when purchasing a cinema ticket through the website. Processing of personal data may be lawful if it is necessary for the performance of a contract under Article 6(1)(b) GDPR.
The data subject has a health insurance contract with the controller. The controller increased the premiums during the contract. The data subject payed the increased premiums for a while but then filed a lawsuit against the controller demanding a refund as well as access to all supplements to the insurance policy and all notification letters sent to him during the contractual relationship under Article 15 GDPR. The court of first instance, the Regional Court of Aachen (Landgericht Aachen – LG Aachen), ruled in favour of the data subject. The controller appealed this decision arguing that the right to access under Article 15 GDPR does not grant a right to access to documents but its only purpose is to make the processed data transparent. Moreover, it argued that granting the access to such a wide extent would amount to an inadmissible discovery of evidence which is contrary to the civil procedural principle that each party must bring forward its evidence itself. Lastly, the controller also invoked the excessiveness of the request under Article 12(5) GDPR alleging that the data subject uses Article 15 GDPR only to verify the validity of the premium increases and not to verify the lawfulness of the processing. The Higher Regional Court of Köln (Oberlandesgericht Köln – OLG Köln) rejected the arguments of the controller and upheld the lower court’s judgement. First, the court referred to case law by the German Supreme Court (Bundesgerichtshof – BGH decision from 15.06.2021, case no. VI ZR 576/19) to establish that personal data under Article 4(1) GDPR means information which by virtue of its content, purpose or effects, is linked to a specific person. The court then concluded that the supplements to the insurance policy as well as the notification letters meet these requirements. For the supplements the court found that they show the content and conditions of the insurance cover provided to the data subject by the controller. Regarding the notification letters the cou
The controller is the Minister of Finance. The data subject’s personal data was processed by the Tax Authority because it suspected him of not fulfilling his tax obligations. This suspicion was raised after the Fiscal Information and Investigation Service (FIOD) had carried out a criminal investigation into the data subject’s tax consultant. As a result of the Tax Authority’s investigation, the data subject had to pay additional taxes. The data subject claimed that the processing was unlawful requested the controller to erase his personal data pursuant to Articles 17(1)(d), 17(2), and 19 GDPR. The controller rejected this request. The data subject objected to the rejection. The controller declared the objection to be unfounded. The data subject then brought the case before the Court. The data subject argued that there were two instances of processing: (1) the selection of the personal data by the Tax Authority of the data collected by the FIOD, and (2) the transfer of personal data from the FIOD to the Tax Authority. The data subject claimed that the Tax Authority processed his personal data without a legal basis, and for a different purpose than it was initially collected for (by the FIOD). The controller, claimed that the selection and collection of the personal data did not fall within the scope of the GDPR, because the Tax Authority acted in the context of assistance to criminal investigations under the Police Information Act at that time. Moreover, the controller stated that there was a legal basis since the Authority had to process for the fulfilment of a statutory obligation, and the performance of a task in the public interest, even though the transfer of the personal data to the Tax Authority did fall within the scope of the GDPR, The Court rejected the data subject’s claim and held that the processing by the Tax Authority had been lawful. First, the Court stated that the FIOD’s processing of personal data falls within the scope of the LED (Directive 201
VIVALIA, a public network of hospitals, launched a call for proposals to find a contractor to process patient data of hospitals for statistical purposes. The public contract was awarded to 3M Belgium, a Belgian company that had been in the news for allegedly transferring data to the US and Russia without appropriate safeguards. On this basis, a spin-off of the UC Louvain (CIBES), which also took part in the public procurement procedure, challenged VIVALIA's decision before the Council of State. The Council of State considered that, before awarding a public contract, the public authority ought to make the necessary verifications regarding the submitted proposals and to correctly motivate the reasons why it could consider that the selected proposal presented the "sufficient guarantees" to consider that the entrusted data and information would be processed in compliance with the GDPR. The decision to award the contract was suspended, without the Council of State examining whether or not the two bidders (CIBES & 3M) complied with the GDPR.
The controller was a regional tax authority in Bavaria, the Bayerisches Landesamt für Steuern (BayLfSt). The BayLfSt held tax dossiers concerning the tax case of the data subject. These dossiers contained internal correspondence, third party statements, notes, and handwritten comments from itself and other Bavarian tax authorities, namely the lower regional tax authority Finanzamt Neu-Ulm and the higher regional tax authority Bayerisches Staatsministerium der Finanzen für Landesentwicklung und Heimat (BayStMFLH). These dossiers also included a complaint via email by the data subject against the BayStMFLH from 2016 and complaints, a challenge on grounds of bias and a demand for a penalty against employees of the Finanzamt Neu-Ulm from 2019. The data subject requested access to dossiers from the Finanzamt Neu-Ulm on 28.10.2019. The BayLfSt received a request to access under Article 15(1) GDPR on 07.11.2019. The data subject wanted to access information on which department processed the dossiers. The data subject specifically requested a colour copy with the aim to differentiate between notes of responsible employees. On 17.12.2019, the data subject received a reply from BayLfSt. The BayLfSt confirmed that it held information about the complaints, the correspondence between the data subject and the authorities, and the correspondence between both authorities. The BayLfSt also confirmed the existence of internal notes and internal correspondence between the two authorities (Finanzamt Neu-Ulm and BayLfSt) concerning the data subject's access request in the dossiers. No further information was disclosed. The reply included instruction on the right to appeal. On 13.01.2022, the data subject filed a lawsuit against the Finanzamt Neu-Ulm and the BayStMFLH in regard to the notice of rejection from 17.12.2019. The court registered the lawsuits separately. The case under consideration is the law suit against the BayLfSt. The data subject based his demands on the suspicion that
The controller is an elementary school. The data subjects are pupils of the controller. Under the Bavarian Ordinance on Measures for the Prevention of Infection (16. Bayerische Infektionsschutzmaßnahmenverordnung – 16. BayIfSMV) , the controller required the the data subjects to show Covid-19 test certificates before being allowed to in-person classes. Moreover, pupils were obliged to wear face masks in school if they could not provide an exemption certificate by a doctor. The controller stored the certificates for 14 days, as prescribed by the Ordinance. On 31 January 2022, the data subjects requested the controller to delete the stored test certificates and stop further collecting them, which was rejected by the controller. Consequently, the data subjects filed an application for interim relief with the Administrative Court of München (Verwaltungsgericht München - VG München) on 10 February 2022 to order the school to stop storing and collecting the test and mask exemption certificates. In its statement of defense, the controller explained that it does not retain any certificates of the data subjects anymore, because it had filed a criminal complaint against the parents of the data subjects with the prosecutor's office on 7 February 2022 because of the suspicion of forgery of documents and had transmitted all the certificates as evidence in the course of the criminal complaint. The data subjects did not contest this statement of the controller. The court rejected the application for interim relief in its entirety. The court held that the application regarding the mask exemption certificates was already inadmissible when the data subjects filed the complaint, because, according to the uncontested statement of the controller, it transmitted all of the certificates to the prosecutor's office and did not store any certificates anymore. The court further reasoned that, because the duty to wear a mask in school was dropped on 2 April 2022, there were no indications su
The controller is an employer who allegedly surveilled its employees work phones and work email accounts from January until March 2021. The DSB (Austrian Data Protection Authority) heard of this conduct in media reports and initiated an ex officio investigation into the matter on 31 March 2021. On 29 July 2021 the DSB adopted an administrative act in which it declared the processing of the controller unlawful. The controller initiated court proceedings against the act claiming that its conduct was lawful and that the DSB - neither under national law nor under the GDPR - had the power to declare the processing unlawful. It argued that Article 58(2) GDPR does not provide a DPA with such a power, because "declaring the unlawfulness" is not listed there. Moreover, § 24 DSG (Austrian Data Protection Act) which provides the DPA with the power to make such a declaration only applies to proceedings which were initiated by a complaint and not by the DSB itself. The Federal Administrative Court (Bundesverwaltungsgericht – BVwG) decided in favour of the controller and set the administrative act aside. It found that there is no provision in national law or the GDPR that gave the DSB the power to declare the processing unlawful. The court first established that § 24 DSG, which provides the DSB with such a power, only applies to complaint proceedings and not ex officio proceedings. The court also rejected an analogous application of § 24 DSG, because it found that the legislator purposefully regulated complaint and ex officio proceedings differently so that there is no room for an analogous application. Moreover, it reasoned that in a complaint proceeding there is a data subject who may have a legal interest in the declaration in order to pursue further individual claims against the controller like a claim for damages; in ex officio proceedings no such interest exists. The court further found that there is no legal basis in the GDPR either, since Article 58(2) GDPR does n
The data subject was a former managing director of the controller. Following a complaint from the data subject accusing the controller of restoring data on his work laptop after termination, and thus violating his rights to access, erasure, restriction, and objection. In its decision, the DPA held that, in principle, an employer could not consult private emails of his employees, even if the company forbade the use of its tools for personal use. The DPA outlined that there were exceptions to this principle, for example in the case of pending legal proceedings and that the legitimate interest in defending itself in court constituted a valid legal basis for the processing of data. The DPA therefore considered that the controller had a legitimate interest for the processing of the data subject's data for the five previous years. In conclusion, the Belgian DPA ordered the controller to comply with the GDPR and imposed a €7,500 fine. The controller filed an appeal with the Belgian Court of Appeal arguing that the DPA’s decision was not reasonable and proportionate and, thus, had to be annulled. The controller firstly pointed out that the DPA did not specify if the data targeted was exclusively the data relating to the data subject’s private life or the professional data. Furthermore, it stated that the DPA did not justify the choice of a five years time period for the validity of the legitimate interest. It considered that it continued to have a legal interest in the processing since two other proceedings were pending between the controller and the data subject. In its defense, the DPA argued that its choice of setting the time limit for the legal basis of legitimate interests at five years was reasoned and based on a balancing test. It however left open the starting point of this period, which would be determined during the implementation of the corrective measures. The Court noted that the contested decision did not fix the starting point for the five year
Meta Platforms Ireland (Meta) manages the social network Facebook in the European Union. Facebook Germany GmbH is a separate entity and “promotes the sale of advertising space on the internet address www.facebook.de”. Facebook contains a section called App Centre that allows users to access free games provided by third parties. While accessing these games, it is indicated that some personal data is shared with the gaming company, and the ability to publish data on behalf of the user is also given to the gaming company. Federal Union of Consumer Organisations and Associations, Germany (Federal Union) initiated an action for injunction before Regional Court, Berlin (Landgericht (LG) Berlin) in Germany claiming that the information provided by the games in the App Centre is unfair, and the ability of posting information on behalf of the user is a general condition that is to the disadvantage of the user. LG Berlin ruled against Meta, and this decision was appealed before the Higher Regional Court, Berlin (Kammergericht (KG) Berlin) which too was decided against Meta. Thereafter, Meta brought an appeal on a point of law before the Federal Court of Justice (Bundesgerichtshof (BGH), and the Court referred the following question for a preliminary ruling by the CJEU: “Do the rules in Chapter VIII, in particular in Article 80(1) and (2) and Article 84(1), of Regulation (EU) 2016/679 1 preclude national rules which – alongside the powers of intervention of the supervisory authorities responsible for monitoring and enforcing the Regulation and the options for legal redress for data subjects – empower, on the one hand, competitors and, on the other, associations, entities and chambers entitled under national law, to bring proceedings for breaches of Regulation (EU) 2016/679, independently of the infringement of specific rights of individual data subjects and without being mandated to do so by a data subject, against the infringer before the civil courts on the basis of the pr
The controller was an insurer, and the data subject was one of its policy holders. In 2012, the data subject subject suffered a whiplash injury in a car accident and was later diagnosed with "post-traumatic depressive adjustment disorder with somatization." In 2014, the data subject filed a claim with the controller for occupational disability; the data subject had been self-employed as a management consultant and energy technician. The controller rejected the claim on the basis that the data subject had not provided adequate proof of disability. On October 28, 2015, the data subject applied to the district court of Wels for a conditional payment order to be issued against the controller. At the time of the DPA's decision, the civil proceedings were suspended. In 2016, the controller offered the data subject a one-time payment of €25,000, which the data subject rejected. The insurance contract between the two parties was terminated in October 2017. On May 13, 2019, the data subject emailed an access request, requesting specifically the "risk assessment" associated with her contract and the "reserve amount" associated with her disability claim. In a response dated Nobember 27, 2019, the controller asked the data subject for an explanation of what she meant by those terms. On April 26, 2020, the data subject filed a complaint with the Austrian DPA alleging that the controller had violated her right of access and additionally requested all of her personal data processed by the controller. The controller responded that it had answered the data subject's access request to the best of its ability and that the terms she used were not meaningful to the firm. The controller claimed the data subject believed she was entitled to an insurance payout and was abusing data protection law for her benefit in the related civil procedure. As the complaint was the first time the data subject had requested all her personal data, the controller sent a 200-page response including among ot
The data subject was a former employee of the controller. After having received an allegedly incomplete answer to his access request, the data subject lodged a complaint with the DSB (Austria). The DSG rejected to handle the complaint under Article 57(4) GDPR - considering it excessive - since there were at least 137 complaints of the data subject registered with the DSB. Moreover, these 137 cases were concerning only two subject matters. The first subject matter was that his son's citisenship was allegedly falsely recorded as Italian instead of German with the Austrian public authorities. The second subject matter was that the controller - his former employer - violated his data protection rights during the employment relationship. As the data subject was dissatisfied with the rejection but could not afford legal proceedings himself, he applied for legal aid (this means the exemption from court fees) with the BVwG in order to bring a legal action against the DPA's decision. The court rejected the application of the data subject because it found that the requirements for legal aid under national law were not met. One of the requirements is that the intended legal action may not appear futile. The court, however, concluded that a legal action against the DSB's decision appears futile, because the DSB rightfully rejected to handle the complaint under Article 57(4) GDPR. The court reasoned that the complaint was excessive, because the data subject had already lodged numerous complaints with the DSB about the same two subject matters (137) and the present complaint was closely linked to these complaints.
This case is between a data subject and the city government of The Hague (the controller). In 2019, the data subject requested access to her personal data pursuant to Article 15 GDPR. The controller partially complied with the request on 6 November 2019, after which the data subject claimed that not all information within the scope of her access request had been provided to her. Eventually, on 15 December 2020, the controller provided her with more documents. According to the data subject, however, this was not enough because the scope of her access request included all e-mails that were sent by the (so-called) “youth director”. This is a government employee who functions as a main contact person between a family and the different governmental agencies. The city government, however, stated that these emails could no longer be found in the system, since the respective youth director is no longer employed, and his personal email inbox is no longer available. Moreover, other youth directors could not find any other emails that relate to the data subject, in their common email inbox. According to the data subject, this was negligence on the side of the controller. Hence, she brought the issue before Court. The Court rejected the claim. The Court stated that the data subject did not make a plausible claim that the city government did not fully comply with the access request. In this regard, the Court considered that the city government had already conducted a new search in 2020, which led them to provide more documents on 15 December 2020. According to the Court, it was not implausible that there are no more emails to provide to the data subject. Moreover, the Court stipulated that it is not relevant that the personal inbox of the former youth director may have contained personal data relating to the data subject’s children. After all, the Court stipulated that the controller provided all information that is required under Article 15 GDPR.
The data subject exercised their right to mandate an organisation to lodge a complaint in their name under Article 80 GDPR. A similar right is also found in the national law, with the difference that it also allows to stand as a litigant. From a procedural point of view, Article 80(1) GDPR does not establish the right to stand as a litigant, but the power to bring a complaint or court proceedings on behalf of the data subject. Thus, while the authorised representative Art. 80 GDPR is authorised to represent within the meaning of the GDPR, it would have to be rejected pursuant to § 67 (3) sentence 1 VwGO (AdministrationCourt Code) in the absence of the requirements of the enumerative catalogue (Numerus Clausus) of § 67 (2) sentence 2 VwGO. The mentioned provisions of the Administration Court Code define exactly which Institutions can be litigators in court and legally represent someone, the organisation could bring Act in the name of the data subject under in the proceedings held upon GDPR (ex. filing in a complaint at the national DPA), but in procedures which are regulated in national law, could not be signed as a litigant for someone else. Due to the procedural failure, the court dismissed the appeal.