GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The case involved a data breach where a message intended for a job applicant was sent to a third party, leading to a cease-and-desist order and damages.
T-Mobile is the controller and the data subject a customer. In March 2021, a Dutch newspaper (NRC) published an article about the controller and the Central Bureau of Statistics (CBS), in which it was stated that the CBS conducted statistical research with large datasets, acquired from controller. The goal of this research was to look for solutions against urban congestion in large cities. The controller issued a press statement on its website on 11 March 2021, in which it stated that no personal data was shared since all data had been anonymised. On 12 March 2021, the subject requested access to the personal data the controller processed on him for the CBS’s research, pursuant to Article 15 GDPR. The controller, however, rejected the request since it claimed that it had not processed any of the data subject’s personal data. Since the data subject was convinced that the controller had to comply with his request, he brought the issue before court. The District Court Oost-Brabant managed the case. The Court partially upheld the claim. First, it considered that the controller did process personal data when providing datasets to the CBS, since the anonymisation of their customers’ location data, is processing personal data. Hence, the Court found that the controller had to comply with the data subject’s access request pursuant to Article 15. The Court stipulated that the controller had to indicate the exact nature and origin of the processed’ personal data, i.e., by providing GPS or customary coordinates, IMSI numbers etc. Although the controller claimed that it had deleted that data, it submitted no proof of this. Hence, the Court gave the controller the opportunity to “submit a statement by their Board”. The Court also required the controller to provide the essence of the joint-controllership arrangement with CBS pursuant to Article 26(2). Second, the Court found that it was competent to assess whether the controller should be ordered to comply with the obligations
The data subject was born in Turkey. His birth was first recorded in the civil status register in the district of Kayseri as 01 January 1956 and later corrected to 01 January 1958. When moving to Germany, which has been his country of residence ever since, in 1971, the data subject stated 01 January 1958 as his date of birth. This date was entered into the controller's register of residents. In 2015, his registered date of birth was changed to 01 January 1953 in Turkey after a decision of the District Court of Kayseri. Consequently, the data subject received a new Turkish passport stating this date of birth. When the data subject requested the controller to change his date of birth in its register accordingly, the controller refused due to a lack of certainty on his actual date of birth. The data subject pursued his request before the Administrative Court of Karlsruhe (Verwaltungsgericht Karlsruhe - VG Karlsruhe) where he was successful. The controller appealed against that decision and won before the Higher Administrative Court of Baden-Württemberg (Verwaltungsgerichtshof Baden-Württemberg - VGH Baden-Württemberg). Therefore, the data subject appealed the decision at the Federal Administrative Court. The Federal Administrative Court upheld the previous instance's decision, deciding that the data subject's request for rectification was unsuccessful. First, the Court agreed that the GDPR was applicable although the data subject's request had occurred before the GDPR's entry into force. Then, it confirmed the Administrative Court's application of Article 16 GDPR. The Administrative Court had correctly assumed that, while Article 16 GDPR was applicable, it could not be established that the data subject's birth date was indeed 01.01.1953. The Court confirmed that the right to rectification means the replacement of incorrect data with correct data. Consequently, there is no right to rectification if it cannot be established which data are correct. The Court disa
Controller Google and data subject is a plastic surgeon who had been conditionally suspended in 2016 for a lack of aftercare after an operation. Because Google then displayed search results that linked to articles about the data subject and their conditional suspension, the data subject requested Google to delete the search results pursuant to Article 17 GDPR. After Google rejected this request, the data subject brought the issue before Court, which upheld data subject’s claim. After Google appealed to this judgement, however, the Court of Appeal annulled the Court of First Instance’s judgement. According to the Court of Appeal, the right to freedom of expression and freedom of information of Google and of third parties, namely information providers and the general public, outweighed the right to privacy and personal data protection of the data subject. The data subject, however, argued that their request must be assessed on the basis of Article 10 GDPR. Moreover, the data subject also stated that they were wrongly ordered to pay the costs of the proceedings in both instances. According to the data subject, it follows from Article 47 of the Charter of Fundamental Rights and Article 79 GDPR, that they should not be ordered to pay those costs if their challenge is unsuccessful. Hence, the data subject then appealed in cassation to the Supreme Court of the Netherlands. The Supreme Court rejected the appeal. First, it considered the data subject’s argument that their request should have been assessed on the basis of Article 10 GDPR. The Supreme Court found that it was irrelevant to discuss whether the Court of Appeal should have done this. According to the Supreme Court, the Court of Appeal already assessed whether it was strictly necessary to process the sensitive data pursuant to Article 10 GDPR. Now, the Court of Appeal decided that this was the case, to protect the right to information and freedom of expression. Hence, the Supreme Court considered that the Court o
In June 2015, an insolvency administrator requested tax information of an insolvency debtor from a tax office. They did so in order to examine insolvency claims, invoking the Freedom of Information Act of the State of North Rhine-Westphalia. The tax office rejected the application with reference to the obligation of tax secrecy. The insolvency administrator successfully challenged the rejection before the lower administrative courts, which was in turn challenged by the tax office. In the meantime, the General Tax Code (Abgabenordnung - AO) was amended due to the entry into force of the GDPR. In particular, the AO now contains various grounds for exclusion of existing claims for access to information under the Freedom of Information Acts and the GDPR. Due to the questions of EU law raised by the case with regard to Article 23(1)(e) GDPR and Article 23(1)(j) GDPR, the BVerwG had suspended the proceedings and made a reference for a preliminary ruling to the CJEU. The CJEU (Case C-620/19) declared that it had no jurisdiction in view of the fact that the present case concerns legal entities to which the GDPR does not apply. After the proceedings resumed, the tax office claimed that § 32e and § 32c (1) AO would constitute a restriction on the requirement to provide access to information to the insolvency administrator. § 32e AO would amount to a Rechtsgrundverweisung. This means that since the insolvency administrator is not the data subject, the conditions for the right to access under Article 15 GDPR are not met, and § 32c (1) AO would constitute a permissible restriction on the right to information within the scope of the GDPR, as provided for by Article 23 GDPR. The BVerwG held that the insolvency administrator had no right to access of information of data from tax authorities. The court came to the conclusion with a Rechtsfolgenverweisung: § 32e AO extends the restrictions on the right to information provided for in Sections § 32a to § 32d AO under Article 15
In 2018, the Czech DPA held that the controller, a hospital, had violated the duty to implement sufficient security safeguards under § 13 of the Czech Law on Data Protection 2000 (implementing the Data Protection Directive). The DPA issued a fine of 1,634 EUR to the controller. The controller requested a judicial review of the DPA's decision. In 2020, the City Court of Prague (MSPH) confirmed the DPA's decision. The controller subsequently requested a judicial review at the Supreme Administrative Court (NSS). The appeal's main line of argument was that under Article 40(6) of the Czech Charter of Fundamental Rights and Freedoms, the court must apply a legal act enacted after the relevant events had taken place, provided that it is more favourable to the offender. In the specific case, the controller claimed that the MSPH should have applied the new law, namely the GDPR and its implementing act - the Czech Law on Data Processing 2019 - instead of the old Law on Data Protection 2000. The controller considered the former to be more favourable in two respects. First, the controller considered that it would not have been found in violation of the duty to implement sufficient security standards under Article 32 GDPR in the same way as it was found to be under § 13 of the Law on Data Protection 2000. This is because the controller's duty to "keep electronic records" under § 13(4)(c) of the Law on Data Protection 2000§ 13(4)(c) stipulates that the controller must "keep electronic records that make it possible to identify and verify when, by whom and for what reason personal data were recorded or otherwise processed". is nowhere to be found in Article 32 GDPR which does not explicitly refer to such a specific obligation and is therefore more favourable. Second, the controller argued that even if it had been a violation of Article 32 GDPR, the DPA or the court could not have issued a fine against it. Indeed, under § 62(5) of the GDPR implementing act - the Law on Data P
The data controller is a company that is building new houses in Zevenhuizen. People who were interested in buying these new houses could register as a candidate-buyer via the website of the controller. About 1100 people, including the data subject, signed up. During the registration, the controller collected confidential personal information of the data subjects (such as the first- and last name; place- and date of birth; email address; phone number; maximum amount they could borrow for the mortgage; yearly income etc.). In April 2021, the controller sent an email to everyone who registered for the project with an unencrypted Excel file attached, which contained the personal information of everyone who registered for the project. Following up on this mistake, the controller sent an email in which they acknowledge the data breach and an apologised for the violation of the privacy and security of the 1100 registered potential buyers. The data subject brought the issue before court and claimed immaterial damages from controller for unlawful processing of their personal data. The Court acknowledged that a substantial amount of personal data was leaked to all of the registered potential buyers. This is a form of processing (Article 4 GDPR) and it is unlawful since there is no ground for this processing (Article 6 GDPR). The controller had thus unlawfully processed the personal data of the data subject in breach of the GDPR. The Court explained that the loss of control over your personal data is a form of damage (Recital 85 GDPR). It also considered that the meaning of 'damage' has to be explained in line with the jurisprudence of the Court of Justice. While the controller claimed that the plaintiff had not suffered any legally relevant damages in line with Dutch civil law, the Court pointed out that Article 82 GDPR has to be interpreted in the context of EU law: the fact that the damages can't be directly quantified do not prevent the allocation of damages. The Court p
The controller is a company that is contracted to plan and build a new neighborhood (called the “Koningskwartier”) in the village Zevenhuizen. In 2021, people that were interested to potentially purchase a house in this neighborhood, could register on the website of the company. Approximately 1,100 persons, including the data subject, made use of this possibility. During the registration, various confidential personal data of these persons were collected, such as the first- and last name; place- and date of birth; email address; phone number; maximum amount they could borrow for the mortgage; yearly income etc. On 12 April 2021, the controller sent out an email to all persons that registered and attached an unencrypted excel file to this email, that contained all the personal data listed above. The data subject then replied to the email and notified the controller of the fact that they wanted to be reimbursed for the damages of the data breach. The controller tried to repair their mistake by sending out an email to all recipients regarding the mistake. However, they refused to comply with the data subject’s request, so the data subject brought the matter before court. The data subject requested the court to order the controller to pay him € 750 in material damages to purchase a new phone since he was being harassed by an unknown number via WhatsApp. Moreover, he wanted € 20,000 in immaterial damages because he feels “watched” and he lost his trust in other people. The controller explained this data breach was caused due to a human error and requested the Court to reject the data subject’s claim. First, the Court considered that the controller had no legal basis in Article 6 GDPR to send out an email that contained data subject’s personal data, and thus unlawfully processed the data subject’s personal data. Moreover, the Court noted that it follows from Recital 146 GDPR that the notion of “damage” must be interpreted broadly, and found that data subject’s damages
Tina Turner sued the organiser of a tribute show called "Simply The Best - Die Tina Turner Story" for injunctive relief. In her opinion, the photo and the name of the show gave the impression that she would be standing on stage in person or supporting the show. The question was whether the double looked too much like the original and whether advertising posters with her photo and the title "Simply The Best - The Tina Turner Story" gave the impression that the superstar herself was involved. In the first instance, the Regional Court of Cologne (LG Köln) held that the personality rights of Ms. Turner outweighed the artistic rights of the organiser. The Higher Regional Court of Cologne (OLG Köln) overturned this decision and held that the artistic freedom (Kunstfreiheit) outweighed the personality rights of Ms. Turner, who appealed against this ruling. The German Federal Court of Justice held that a claim for injunctive relief with regard to the use of Ms. Turner's likeness is not applicable on the grounds of the German Civil Code in conjunction with §§ 22, 23 KUG (Art Copyright Act). While the Court agreed with the previous instances that the pictures of the plaintiff constituted personal data pursuant to Article 4(1) GDPR, it based its decision on §§ 22, 23 KUG. Under the KUG, it is permissible to take and publish photos of people without their consent if it is in the "higher interest of Art", i.e. if the artistic value of such creation outweighs the personal rights of the person pictured. However, the Court did not decide on the relationship between the KUG and the GDPR. It rather left open the question whether the use of the plaintiff's image for the defendant's posters was for "artistic purposes" within the meaning of Article 85(1) and (2) GDPR and whether the conditions set out therein for the adoption or continued application of national provisions (i.e. the KUG) were fulfilled with regard to the constellation of the case in dispute. The Court merely held
The controller is an address publisher and direct advertising company that operates a data application in order to provide advertisers with personal data for targeted marketing measures. In 2019, the Austrian Data Protection Authority (DSB) initiated an ex officio investigation against the controller, following media reports about the alleged sale of personal data, in particular information about the political affinity of individual persons. Based on the findings, the DSB issued a fine of €18,000,000. The natural persons responsible for the infringements belonged to the economic unit formed by the controller as a legal person. Therefore the infringement was attributed to the controller. The controller appealed to the Federal Administrative Court (BVwG), arguing that it was not sufficient for a legal person to have committed a criminal offence for a fine to be imposed on it under the GDPR. As a legal person that cannot act on its own, the actions of a natural person must also be attributed to it but the DSB had omitted this attribution. The BVwG agreed with the controller's reasoning. Since the DSB had not named the natural person whose breach of the GDPR was to be attributed to the controller, the DSB's decision proved to be unlawful. The DSB filed an extraordinary official appeal against this decision with the Austrian Supreme Administrative Court (VwGH). It referred to the pending case of the Higher Regional Court of Berlin (KG Berlin) before the Court of Justice of the European Union (CJEU) (Case C-807/21) where the question at issue - as in the case at hand - is whether the supervisory authority must record and name those natural persons who are responsible for the infringement in order to enable attribution to the legal person, or whether this is not necessary. The DSB therefore requested to refer the question of the direct criminal liability of a legal person under Article 83 GDPR and the question of the compatibility of § 30 Datenschutzgesetz (Austrian Data
The controller is a private health insurance company. The data subject is a customer of the controller. The parties are in dispute about the validity of several increases to the insurance premiums. The data subject requested refund of overpaid premiums as well as information on all adjustments to the premiums in the form of notification letters sent to the data subject and supplements to the insurance policy to verify the lawfulness of the increases. The controller rejected both claims. Consequently, the data subject filed a lawsuit against the controller with the Regional Court of Essen (Landgericht Essen - LG Essen). The Regional Court of Essen rejected the data subject's claim entirely. Regarding the notification letters, the court concluded that the data subject has no right to access under Article 15 GDPR , because the notification letters are standardised letters sent to every policy holder and, therefore, not personal data under Article 4(1) GDPR. Moreover the court found that the controller can refuse to act on the request according to Article 12(5)(b) GDPR, because the request is excessive. The court held that the "repetitive character" of a request is just an example under Article 12(5) GDPR and that an access request can also be considered excessive if the request does not serve the purpose of verifying the lawfulness of the processing as stated in Recital 63. The court then established that the data subject's request does not serve this purpose but solely aims at verifying the validity of the premium increases.
The controller runs a gym. The defendant is the Bavarian DPA (BayLDA). The controller and the BayLDA were in dispute about the lawfulness of a video surveillance with six video cameras in the training rooms and the counter of the gym. The controller argued that the video surveillance served to prevent and solve thefts and damage to property, which had occurred several times in the past. In addition, the video surveillance served to prevent sexual harassment, as a continuous presence of the staff in all rooms could not be guaranteed. After a client of the controller requested the BayLDA to stop the video surveillance, the BayLDA issued a notice. It required the controller to refrain from observing the training areas with video cameras pursuant to Article 58(2)(f) GDPR. After that, the controller replaced the the video cameras with dummy cameras. The BayLDA argued that, while the legal basis for the video surveillance can generally be Article 6(1)(f) GDPR, the conditions were not met in the present case. In particular, the video surveillance was not not necessary as the controller could have considered less restrictive means such as increased staff and anti-theft devices. The controller argued that, due to the contractual relationship with the clients, it also had a secondary obligation to ensure their safety, in particular by preventing or solving thefts and assaults through video surveillance. In addition, the data subjects would be informed about the monitoring via signs and the general terms and conditions, thereby also consenting to the video recordings. The controller claimed that, after replacing the video cameras with dummy cameras, it could expect yearly damages in the amount of €10,000 to €15,000 since the clearance rate without the video camera was almost zero. The court held that the video surveillance was not lawful and that the BayLDA was entitled to require the controller to refrain from using video cameras in training areas pursuant to Article 58(2
The plaintiff (subcontractor) was a company providing cleaning staff to the defendant (general contractor). In this dispute, the plaintiff claimed the payment of an amount of € 9,837.71 from the defendant as remuneration for cleaning work by their employees of the defendant's properties. The defendant invoked a right of retention with regard to a claim for the provision of evidence of the payment of the minimum wage to the plaintiff's employees working in the defendant's properties. The parties also signed a contract which stated that the plaintiff is obliged to pay the minimum wage according to the German Minimum Wage Act (Mindestlohngesetz). According to this contract, the defendant had the right to demand up-to-date evidence of this at any time (e.g. submission of timesheets, payrolls, lists of employees). In case of non-submission of requested evidence, the defendant was entitled to withhold payments due. The plaintiff stated that they had fulfilled their obligation to provide evidence by submitting declarations from their tax advisor, according to which the minimum wage was paid. They also stated that the submission of their employees' pay slips, in particular, was precluded by the GDPR since the disclosure of such data would be a violation. The Higher Regional Court Brandenburg held that the declarations of the tax advisor were not evidence which could proof that the plaintiff has actually paid the minimum wage to the employees working on the premises of the defendant. According to the court, the plaintiff was not prevented by the GDPR from providing the defendant with evidence of the payment of minimum wage to the employees. On the contrary, this form of processing of personal data of the plaintiff's employees was, insofar as the limits of necessity and data economy are observed, permitted pursuant to Article 6(1)(f) GDPR. The Minimum Wage Act (Mindestlohngesetz) also includes the provision that in business relationships such as that between the palintiff
The plaintiff is a minor. A person unknown to the plaintiff opened an account on the social media platform Instagram at an unknown time with the user name "plaintiff_was_hacked". Pictures were posted on the account showing a young woman dressed only in underwear, with her face covered by a smartphone. The photos contained statements that gave the impression that the person depicted was interested in a variety of sexual contacts. After the plaintiff was recognised by other persons and approached about the content of the account, she reported the account to the platform operator and it was blocked. The plaintiff requested the Regional Court of Flensburg (LG Flensburg) to order both Instagram and the telemedia service provider to disclose information about the owner of the account, including their IP-address, based on the old German Telemedia Act. She claimed that she needed the requested information to enforce civil law claims in the form of injunctive relief and claims for damages for violations of personal rights against the owner of the user account. The LG Flensburg dismissed her application as the plaintiff had no substantive right to information against Instagram. Furthermore, it held that a general right to information against telemedia services as "non-interferers" did not exist under the current legal situation. A complaint at the same court was not successful either. The plaintiff appealed that decision at the Higher Regional Court of Schleswig-Holstein (OLG Schleswig). Before the OLG Schleswig, she requested that Instagram be allowed and obliged to provide her with the user's IP address used for uploading the posts and images retrievable, together with the exact upload time, their name, e-mail address, the IP address last used to access the account, and the user's telephone number. The appeal succeded with regard to the inventory data, but not regarding the IP addresses. The OLG Schleswig applied § 21(2) Telecommunication Telemedia Data Protection Act
The controller is the landlord, the data subject the tenant of a flat, which is located in a multi-party building. In 2019, the controller informed the data subject that they wanted to carry out an inspection of the data subject's flat due to complaints about strong odours and vermin in the stairwell. After finding the flat in a state of disrepair, the controller asked the data subject to clean and clear it out. They complied immediately. They then wanted to know which of their flatmates had complained about them. After the complaints were revised on the occasion of the cleaning, the controller suggested to let the matter rest. By means of the lawsuit, the data subject, on the basis of Article 15(1) GDPR, requested information on the personal data processed by the controller concerning them, including information about which of their flatmates had complained about them, as well as the payment of damages for pain and suffering, and the reimbursement of pre-litigation legal costs. The data subject failed with their request both at the Regional Court of Ravensburg (LG Ravensburg) and the Higher Regional Court of Stuttgart (OLG Stuttgart). According to both courts' reasoning, the controller would be acting contrary to the interests of the informant under data protection law if the name of the informant was disclosed. The German Federal Court of Justice (Bundesgerichtshof – BGH) held that the data controller may be obligated to provide information to the data subject pursuant to Article 15(1)(g) GDPR, depending on whether the information about them was accurate, and referred the case back to the OLG Stuttgart. The BGH explained that the claim of the data subject would only not exist if the informant's interest in not having their data disclosed or the interests of the controller outweighed the data subject's right to information. It emphasised that due regard must be paid to both the data subject's and the informant's fundamental rights pursuant to Articles 7(1) and
The applicant, Darren Williams, who was unvaccinated, challenged the lawfulness of using Covid Cert Check NI App to check people’s vaccination status before granting them entry into public places. The court refused to grant leave to apply for judicial review on the grounds that the applicant was not a data subject for the app. It argued that as someone who had not been vaccinated, the applicant would never be subject to the processing about which he complained. Therefore, he had no legal standing. The court further observed that the question whether or not the data processing by the app is necessary has substance. However, the court did not deem it fit to answer the question as elected representatives are best suited to assess public interest such as the public health interests in question.
The data subject (respondent) worked for a publicly listed company. The appellant is an international media organisation who obtained a confidential Letter of Request (LoR) sent by a UK law enforcement body (UKLEB) to a foreign state seeking legal assistance in criminal investigations against the data subject on corruption and conspiracy. The LoR contained confidential information about the UKLEB’s state of investigation on whether the data subject defrauded a publicly listed company. The appellant intended to publish an article with sensitive information from the LoR about the data subject's work for the company, the status of the criminal investigation and who and what were the targets of the UKLEB investigation. Before the publication, the appellant contacted the UKLEB and the data subject’s solicitor to inform them about their intentions. The UKLEB expressed concerns that the publication could seriously harm the investigations and advised the appellant not to proceed with the publication. The appellant ignored the warnings, and the article was published in 2016. Subsequently, the data subject was denied an interim injunction to prevent further publication on the grounds that the data subject’s right to privacy under Article 8 ECHR was outweighed by the appellant’s right to freedom of expression under Article 10 ECHR. The trial court later established that the factual basis for this decision was wrong, and the injunction should have been granted. At trial, the data subject claimed to have a reasonable expectation of privacy in information published in the Article and that the media organisation misused their private information by publishing the article. Applying the two-stage test summarised by Buxton LJ in McKennitt v Ash [2008] QB 73 (CA) to determine whether (1) the data subject has a reasonable expectation of privacy and (2) that expectation is outweighed by public interest, the trial court found that “there was a very clear public interest that the contents
This case is an appeal of a decision by the Norwegian DPA, in which they instructed Google to delete one search result, but denied the data subject's erasure request for the two other search results. The Privacy Appeals Board agreed with the DPA in that Article 6(1)(f) legitimate interest is the correct lawful basis and, in particular, their reasoning around the processing of personal data subject to Article 10 GDPR. Pursuant to Article 6(1)(f) GDPR, the Privacy Appeals Board conducted a balancing test, in which they weighed the interests of the controller and the data subject. When balancing these interests, the Board found several matters to support the data subject's erasure request. First, when a data subject actively requests erasure, cf. Article 21(1) GDPR, their interest should by default outweigh the search engine's interests. This is reinforced when Article 10 GDPR personal data is involved. Second, as the data subject was sentenced in 2011 and had served their prison time by 2016, the search results relate to old matters. Third, the personal data should be correct and up to date, cf. Article 5(1)(d), cf. the Article 29 Group's criteria number 4 and 7 in their [https://ec.europa.eu/newsroom/article29/items/667236/en WP225 guidelines]. The 2011 ruling included a ban on the right to run a business, however in 2019 a court removed this ban so that the data subject could become a general manager in the company where they had worked as a project coordinator and project leader for several years. This is the same company where they were currently working and which was planning to go public. One of the news articles where the search results were leading to, gave an imprecise description of this situation. The Board also pointed out that it is relevant whether a person is of public interest and found that the data subject is not, even though they have a leading role in a company due to go public. Finally, the Board emphasised the data subject's personal b
The controller operates a doctor search and rating platform under www.jameda.de. It posts the basic data of physicians as well as a grey silhouette as a profile picture with the notice "Only jameda customers can post a profile picture" on the portal without their consent. Users can submit ratings in the form of grades and free text comments. The controller offers doctors a paid "premium package" with which they can add a photo and additional information to their profile and with which the defendant contributes to better findability on Google. In early 2018, the data subject who is an eye specialist learned that a negative review had been posted about her on the controller's website. She was rated there as "arrogant, unfriendly, unprofessional". The data subject asked for this evaluation to be deleted and for the author to be informed. The controller refused, as well as to the deletion of the data subject's basic data. In her lawsuit, the data subject demanded the deletion of her basic data from the controller's portal. While that was successful in the first instance, the Higher Regional Court dismissed the action on appeal by the controller. The German Federal Court of Justice (Bundesgerichtshof - BGH) dismissed the data subject's appeal. The court found that the requirements of the right to erasure pursuant to Article 17(1) GDPR were not fulfilled. First, the processing was not unlawful pursuant to Article 17(1)(d) GDPR. As the processing was based on Article 6(1)(f) GDPR, the legitimate interests and fundamental rights of the data subject did not outweigh the interests of the controller. On the data subject's side, the court weighed her right to the protection of her personal data pursuant to Article 8 CFR, the not inconsiderable risks to her claim to social and professional standing (Article 7 CFR) as well as the economic success of her self-employed activity (Article 16 CFR). The court considered that the evaluations could directly affect competition with
On November 9, 1989, Günter Schabowski, member and spokesman for the Politburo of the Socialist Unity Party of Germany (SED - party in power in the eastern part of Germany during the cold war) read out the new travel regulations of the German Democratic Republic (DDR) at a press conference live on television. During the press conference he was asked by an Italian and German reporter about the date when the new regulations will come into force. Mr. Schabowski, looking a little perplexed at first, answers "To my knowledge - that is immediately, without delay". The new travel regulations allowed people to travel to foreign countries, especially Western countries, more easily than before. Immediately after the press conference thousands of East-Berlin's residents were flocking to the border, demanding their opening. The wall dividing Germany fell. The piece of paper, also known as the "Schabowski Note", from which Mr. Schabowski was reading the new travel regulations is now owned by the "Haus der Geschichte" Foundation in Bonn. The Foundation had bought the note in 2015 for 25,000 euros. The seller demanded anonymity, which the Foundation also assured him. But the path of how the note came to the first and later to the second seller, who sold it to the Foundation, is not completely clear. Mr. Schabowski´s family said that the Note was given to someone to take a closer look at it, but never given away permanently, they have asked the person to give it back, which did not happen. A journalist from the “Bild” Newspaper filed a lawsuit to disclose the wording of the agreement between the Foundation and the second seller and the name of both sellers. The Foundation refused to provide the information on the grounds that the seller had been promised anonymity as part of the contract. This provision was binding only between the second seller and the Foundation, the first seller did not insist on anonymity. The Administrative Court of Cologne (Verwaltungsgericht Köln - V