GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
This case is an appeal of the decision 20/01648 by the Norwegian DPA (Datatilsynet), in which it imposed a fine of NOK 100,000 (approx. €10,000). The defendant asked for the fine to be overturned or reduced significantly, due to the company's "critical financial state". The Privacy Appeals Board assessed if a fine could be imposed as per Article 83(5) GDPR, cf. Article 83(2) GDPR, and in which case, how large it should be. The Board agreed with the DPA that the installation of the camera was not discussed with the employees in advance, as claimed by the defendant, since there were no evidence of such discussions. The Board noted that continuously surveilling a workplace is very intrusive for the employees, and also for the customers since there were no proper signage or information about the surveillance, and finds this to be a serious violation of the GDPR. The Board agreed with the DPA in that the defendant's actions are serious and criticizable, deserving of a sanction and which justified the level of the fine. This was further substantiated by the lack of technical and organisational measures for GDPR compliance in the company.
The controller is a credit reference agency. The data subject entered into a contract with a mobile phone provider under the address of his parents. The mobile phone was used by the data subject's brother. During the term of the contract, the mobile phone provider was unable to debit an amount due and, therefore, sent debt collection letters to the registered address. However, the data subject did no longer live at his parents' address. The debt was then settled in the short term, but the mobile phone provider terminated the contract and initiated a negative entry in the controller's debt register. One year later, the data subject requested the controller to delete the negative entry, because he has never received any which the controller refused. The controller felt it was entitled to keep the entry, because the debt has not been paid initially and two debt collection letters had been sent to the parents' address. Subsequently, the data subject obtained a judgement ordering the controller to delete the entry. The controller, however, did not immediately comply with the judgement. As it turned out, the data was still processed by the controller and shared with its customers. Only three months later, after the data subject again requested deletion, the controller finally removed the entry. The data subject then initiated new court proceedings claiming damages for the unlawful storage of its data. The controller applied for the dismissal of the claim, arguing that the negative entry was stored lawfully and the data subject did not suffer any damages. The incident partially occurred before the GDPR came into effect. The facts of the case were therefore partly assessed on the old version of the German Data Protection Act (BDSG a.F.). The Regional Court Hannover (Landgericht Hannover - LG Hannover) awarded €5000 in damages to the data subject according to Article 82 GDPR, since the the processing of the data by the controller violated the old German Data Protection A
The Austrian DPA decided that the data controller specialising in credit assessments (C. Ges.m.b.H.) had to disclose meaningful information about the logic involved in the automated decision-making process concerning the data subject's data on the issue of her creditworthiness despite the algorithm being protected by trade secrets. This decision was then appealed by the data controller to the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). Reportedly, such algorithms may be protected under Article 2(1) Directive 2016/943. The right to access personal information in an automated decision under Article 15(1)(h) GDPR is given additional meaning in enabling the data subject to contest such a decision under Article 22(3) GDPR. Thus, the Federal Administrative Court upheld that the data controller had infringed the data subject’s right to access her data related to an automated decision since the controller did not provide meaningful information on the logic involved in the decision under Article 15(1)(h) GDPR. However, after the ruling, the data controller did not provide further information. Hence, the data subject made an application for enforcement to the enforcement authority, the Vienna City Council, which did not fulfil its obligation and used a power it was not entitled to, as it found that the controller had already sufficiently fulfilled its obligation to provide information, despite the controller not providing any further information. According to Austrian law, since the data controller's complaint against the decision of the executing authority was admissible, and the executing authority did not fulfil its obligation, the administrative courts of first instance must, therefore, take a decision in the present proceedings instead of the executing authority. In light of this, the Regional Administrative Court Vienna (Verwaltungsgericht Wien - VGW) attempted to answer the question of whether a data controller can refuse to provide the data subjec
The data subject is the shareholder of two companies that were part of a German airline (hereinafter “companies”). The controller is the insolvency administrator of these companies. The accounting of the companies was done by an accounting department, respectively by an external service provider. A German Local Court ordered the seizure of the business records, in particular the accounting records. Afterwards, the controller continued to provide the data subject with access to the accounting systems. The parties dispute whether full access was granted in the process. The data subject requests that the controller shall be obliged to set up full data access by means of an interim injunction. The data subject bases the claim, inter alia, on Article 15 GDPR. The controller requests that the application for an interim injunction shall be dismissed. The court ruled that a right to access pursuant to Article 15 GDPR likely did not exist in this case. Subsequently, it did not find the urgency necessary for an interim injunction. The court did not share the data subject's view that data created or received under their management would in any case be personal data concerning them, irrespective of the detailed content. In any case, however, this did not result in any particular urgency in the sense of a ground for injunction. According to the court, there is no legal principle that the assertion of the right to information under data protection law would always be urgent or that the claimant should not be referred to assertion in the main proceedings.
The controller operates a cross-company and cross-sector customer loyalty programme called "J*Club". Customers of participating retail outlets can register as members, collect points based on their purchases and subsequently redeem these points to receive discounts, etc. According to the privacy policy, the legal basis for the processing is consent pursuant to Article 6(1)(a) GDPR which is voluntary and can be revoked at any time. In October 2019, the Austrian Data Protection Authority (DSB) conducted ex officio investigations and found that the controller's procedure did not fulfill the requirements of consent, therefore Article 6(1)(a) GDPR could not be used as a legal basis for processing. Since the controller had not made use of other legal bases, the processing was unlawful. The controller appealed that decision before the Federal Administrative Court (BVwG). It argued that it had used legitimate interest, Article 6(1)(f) GDPR, beside consent as a legal basis. Subsequently, in December 2019, the DSB amended its decision. It held that 1) the request for consent by the controller does not meet the requirements pursuant to Article 4(11) GDPR and Article 7 GDPR and that no other legal basis can be considered and the aforementioned processing is therefore unlawful. 2) the controller shall be prohibited from processing personal data for the purpose of profiling within the scope of Clause 1 and 3. 3) the complainant shall be granted a period of six months to implement point 2. The BVwG granted the controller's appeal and annuled the decision in its entirety without replacement. It held that the DSB had incorrectly only based its decision on the lack of consent and not on other possible legal bases, thus not performed an exhaustive investigation. According to the BVwG, the sole examination of the legal basis of consent could not necessarily establish a violation of the principle of lawfulness and thus also no entitlement to the remedial power under Article 58(2)(d
A water meter with a radio module is installed at the claimant's home (data subject) by a municipal water supplier (defendant, controller). The data subject believes that the installation of the radio water meter violates their fundamental right to data protection, as the device allows conclusions to be drawn about individual water use, which constitutes personal data. At their request, the controller switched off the radio module, for which the controller imposed the costs on them in the form of an administrative fee notice. The data subject appealed the fee notice. The Administrative Court of Cottbus (VG Cottbus) held that the installation of a water meter with a radio module may already be considered data processing (Article 4(2) GDPR). Although the installation does not yet directly process data in the sense of storage, a necessary preparation, which is undoubtedly only aimed at enabling data processing, is also subject to Article 4(2) GDPR. In the present case, the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller Article 6(1)(e) GDPR. The municipal water supplier's by-laws explicitly state that it collects data on consumption via measuring equipment and that this is done using a water meter and its readout. Article 12(5) GDPR in conjunction with Article 18(1)(d) GDPR does not prevent the charging of an administrative fee for the deactivation of the radio module of the water meter if the interests of the controller outweigh those of the data subject and the customer only objects in principle to the collection of data and does not invoke any grounds under Article Article 21(1) GDPR arising from their particular situation. The mere concern for one's own data protection and fear of "forced digitisation" are only general or principled interests, but not particular or individual, so that Article 21(1) GDPR does not apply.
The controller is a municipality. The data subject owns property in the controller’s district. The data subject won a lawsuit against the controller, obliging it to connect the data subject’s property to the municipal drinking water supply. The judgement was limited to the supply needed for a single-family home. The controller complied with the judgement and connected the data subject’s property to its water supply system. It also installed an analogous water meter (not a smart meter) at the beginning of the water pipe to measure the consumption of the data subject’s property. The water meter is checked once a year by the municipality. The results are stored in the municipality’s software application which is hosted in an Austrian datacenter. The data is retained for thirty years to exercise or defend against possible legal claims. Moreover, because multiple times in the past the data subject used vast amounts of water, exceeding the need of a single-family home by far, the municipality installed a system that measured the daily consumption of the data subject. At the beginning, the system worked as follows: An incremental encoder was installed on top of the water meter. This incremental encoder sent digital signals to a programmable logic controller (PLC) at the water supply facility of the controller every time water was used by the data subject. The programmable logic controller counted the signals and if the usage of the data subject exceeded the threshold of 950 liters per day, the PLC closed the solenoid valve of the pipe, cutting of the water supply to the data subject's property. The counter was automatically reset each day to zero. After five months the controller switched to a system where the water supply was not automatically shut off by the PLC but an employee was notified to check whether the alarm was accurate and, if yes, to shut off the water supply manually. After the data subject learned about this conduct of the controller, she asked the contro
In 2019, the data subject, a bank, received a letter from the controller, the tax authority, informing it of a number of investigation results and announcing that the data subject would have to pay the taxes in the cases discovered by the investigation. Furthermore, the letter contained tax summary reports on the change of the data subject's capital gains tax filings in tax matters of various investment funds. Subsequently, the data subject applied to the controller for the right to be heard and to inspect and access the files, based on the German Fiscal Code (Abgabenordnung - AO) and Article 15 GDPR. The controller refused, arguing that the data subject already had knowledge of the files on capital gains tax and that all other documents listed were part of investigation files in criminal tax proceedings conducted by public prosecutor's office. Regarding the investigation files, the controller questioned whether Article 15 GDPR was even applicable. It stated that the data subject might be able to substantially complicate investigations if given access. The data subject argued that it did not have full knowledge of the data processed. It claimed that when balancing the parties' interests, its own would outweigh the controller's. The Financial Court of Munich (FG München) had to decide whether the data subject had a claim under Article 15 GDPR, what was the scope of the data subject's claim and whether the claim was satisfied by granting access to individual documents or providing copies. The FG München dismissed the claim. It held that, while the data subject generally would have a right to access pursuant to Article 15(1) GDPR, that did not encompass the data in question. First, the court established that the GDPR applies to the bank as a data subject since § 2a(5) AO orders the corresponding application of the GDPR to entities with or without legal capacity such as the data subject in this case. Then, the court clarified that there is no general right to inspe
The controller is a newspaper. It published an article about the alleged harassment, unnecessary and illegal detention of a Turkish Cypriot woman who was on the Police Alert-List. The article revealed the names and photographs of the two police officers carrying out these actions. These officers then lodged a complaint with the DPA of Cyprus (Commissioner). Following the receipt of the complaint, the Commissioner informed the newspaper that the publication would violate the principle of data minimisation as well as Article 6(1)(f) GDPR. However, in doing so, the Commissioner did not disclose the existence of the complaint itself. The controller did not respond to this communication from the Commissioner, who in turn contacted the newspaper again, setting a four week deadline for an answer. This time the commissioner disclosed the existence of the complaint and the complainants, without however providing the controller with a copy of the complaint. The controller's lawyer responded, stating that the first letter was inadvertently not answered, and further stated that their client had no possibility to contest the complaint because it is not aware of its content. A few days later the Commissioner imposed a fine on the controller without further notice. The controller appealed this decision with the competent Administrative Court. The Administrative Court annulled this decision on the grounds that the conduct of the Commissioner violated the right to be heard. The court referred to Article 43(1),(2) Law N. 158 (I)/1999, which is the Cypriot Law on General Principles of Administrative Law. Article 43(1) Law N. 158 (I)/1999 stipulates that everyone who is affected by an administrative measure must have the right to be heard, except in cases expressly provided by law. Article 43(2) Law N. 158 (I)/1999 stipulates that an administrative body which intends to base its decision on allegations against a person must provide that person with the opportunity to submit its
The Dutch financial regulator, Bureau Financieel Toezicht (BFT), provided a journalist with a copy of a decision and an accompanied letter. The decision and letter had been issued by the Chamber of Bailiffs (kamer voor gerechtsdeurwaarders) in a disciplinary proceeding against a company. The BFT provided the journalist with the documents without anonymizing them. The company and two individuals (the plaintiffs) complained that this was a data breach under the GDPR. The plaintiffs demanded that it should be reported to the Dutch DPA Autoriteit Persoonsgegevens (AP). In December 2019, the BFT informed the plaintiffs that there was no need to report the incident as a data breach under the GDPR. The plaintiffs complained. In January 2020, the BFT ruled that the complaint was inadmissible, meaning that the plaintiffs didn't have the right to have the action reviewed by a court. The plaintiffs appealed the BFTs decision to declare the complaint inadmissible. In June 2020, the District Court of Midden-Nederland ruled on the appeal. The District Court reversed the BFT's January 2020 decision and ordered the BFT to issue a new decision on the objection. In addition, the District Court ruled that, as an administrative court, it didn't have jurisdiction to decide on compensation issues. The applicants appealed the District Court's decision to the Supreme Administrative Court (Raad van State). BFT filed an incidential appeal, which is an appeal filed after an opposing party has already filed an appeal. The Supreme Administrative Court held a hearing in October 2021. At the hearing, it became clear that the plaintiffs and BFT now agree that it was wrong to disclose the documents to the journalist without anonymizing them. The Supreme Administrative Court now had to answer three questions: 1) Were there any legal remedies against the BFT's decision? 2) Does an administrative court have jurisdiction to decide on applications for compensation? 3) Should the request for compensat
On 20 December 2018, the data requested access to his personal data from his previous employer, the Minister of Finance. On 5 February 2019, he filed a complaint with the Dutch DPA (Autoriteit Persoonsgegevens) to take enforcement action against the Minister, because the Minister did not timely and fully comply with his access request. At the same time, he filed administrative appeal against the Minister’s failure to make a timely decision, and brought the issue before Court. On 9 April 2019, the Court acknowledged his claim and ordered the Minister to comply with the access request, which the Minister did on 1 May 2019. On 8 January 2021, the DPA rejected the data subject’s complaint for enforcement against the Minister, for two reasons. First, because the Court had already ruled that the decision had not been made within due time, the DPA would not have to rule anymore whether or not the decision had been made timely. Second, regarding the question whether or not the request had been fully complied with, the DPA considered that this would require further investigation. However, the alleged infringement was not considered to be harmful enough, according to the DPA’s own "Policy Rules on Prioritising AP Complaints Investigation", and therefore did not handle the complaint. According to the data subject, the Court’s judgement proves that the Minister violated the GDPR and the DPA therefore had to take enforcement action. Hence, he appealed to the DPA’s rejection of his complaint, before Court and claimed that the DPA should issue a fine against the Minister. Moreover, he requested to be compensated for immaterial damages. The District Court Amsterdam rejected the claim. First, it considered that the DPA has limited resources and receives tens of thousands complaints every year. Hence, the DPA has to consider which complaints they handle, and which complaints have a higher priority to be dealt with. The Court found that it follows from Article 57(1)(f) GDPR that the
In 2019, the first defendant (the "developer") developed an app for students to rate school teachers (the "app"). In December 2019 the developer founded the second defendant (the "platform"), a limited liability company, and offered the app for download using the platform. In early 2020, the Austrian Data Protection Authority conducted an ex officio investigation into the platform's data protection conduct. This investigation was later ceased without a formal decision. The claimant was a school teacher whose name and school could be seen in the app, making him subject to ratings by users of the app. They argued that the data processing on the app violated their rights to data protection. They never consented to be subject to ratings on the app and argued that there was also no other legal basis under Article 6(1) GDPR that the app could rely on to make the data processing lawful. They further argued that the app didn't provide sufficient safeguards to prevent people other than their students to rate them. In their lawsuit, the teacher demanded the first instance court, Landesgericht Wien (LG Wien), to disallow the possible future processing of his personal data by the defendants and to order the defendants to erase the data relating to the teacher under Article 17 GDPR. The LG Wien dismissed the lawsuit, holding in essence that the legitimate interests to provide ratings on the teacher outweighed their interests under Article 6(1)(f) GDPR. Hence the court considered the processing to be lawful. The teacher filed an appeal. The second instance court, Oberlandesgericht Wien (OLG Wien), upheld the lawsuit and ordered the developer and the platform to stop the processing until it was ensured that only actual students of the teacher could rate them. It argued that, as the app offered no safeguards against unjustified ratings by random strangers, the teacher's interest under Article 6(1)(f) overrode that of the developer and the platform and the data were to be deleted un
Stichting Brein is a foundation involved in collectively counteracting and preventing copyright infringements. Ziggo is one of the largest internet service providers (ISPs) in the Netherlands. In december 2020, Brein started the "FLU-warning campaign". The aim of this campaign was to send warning letters to holders of IP addresses of which Brein, using special software, had found that they had uploaded copyright infringing material via BitTorrent for at least two times in a span of four weeks. Since Brein only had the IP address of these uploaders, and not their name and address details, it needed the cooperation of ISPs to link an IP address to name and address details. Ziggo, however, did not want to cooperate voluntarily. Hence, in this interim relief proceeding, Brein requested the Court to order Ziggo to forward Brein's warning letters to the relevant Ziggo customers. The interim relief judge rejected Brein's request because Ziggo does not (yet) have a permit as listed in Article 33(4)(c) Implementation Act, to process the IP addresses. First, the Court noted that the IP-addresses are personal data for both Ziggo and Brein, referring to CJEU-cases Breyer and Mircom, since Brein has the legal means to force Ziggo to hand over name and address details related to a specific IP-address. Secondly, the Court considered that the IP addresses are personal relating to criminal offences, Article 10 GDPR, because copyright infringement is a criminal offence according to Article 31-33 Dutch Copyright Act. Even though there is barely any prosecution on the basis of these offences, [https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/ontwerpbesluit_dutch_filmworks.pdf the Dutch DPA has previously held] that processing of personal data of persons against whom there is a more or less well-founded suspicion of acts that infringe a copyright, must be regarded as the processing of personal data regarding criminal offences. Third, the Court marginally assessed
The claimant is a data subject who purchased a Smart TV from the defendant, a consumer electronics chain. After a certain period of use, the device broke down. On the device, the claimant had stored personal data such as names, account details and payment data for several apps. The defendant requested the return of the device for repair but the claimant was not asked to delete and/or remove personal data before sending it in. Although faulty, the device had enough functionality to allow a user to log out from any apps. Notably, the claimant did not log out of their Amazon app before leaving the TV with the defendant. Later, the parties agreed that any repair of the device would be disproportionately costly and so the TV should be written-off. The claimant’s understanding was that the device would be destroyed. However, the defendant re-sold the unit without performing a factory reset or data wipe. Subsequently, someone used the claimant's Amazon account through the unit to make a small in-app purchase. The claimant became aware of the transaction and, following a complaint, the defendant refunded the cost incurred and provided a shopping voucher as a gesture of goodwill. The claimant argued that the defendant breached its data protection duties by disposing of the device without first wiping any data stored on it, and brought an action for damages in the High Court for misuse of private information, breach of confidence, negligence, and breach of data protection law under Article 82 UK-GDPR and sections 168 and 169 of the [https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted Data Protection Act (DPA) 2018]. The defendant applied for the claim to be struck out under 3.4(2)(a) and (b) CPR or, alternatively, to grant summary judgement under 24.2 CPR since “it did not process the data and was not a data controller because it did not know about the data, had not been made aware of it, and reasonably believed it to be the responsibility of the claimant. Furtherm
On 7 December 2020, the French DPA (CNIL) imposed two fines totaling € 100 million on Google LLC and Google Ireland Ltd for violating Article 82 of the French Data Protection Act (which transposes the ePrivacy Directive). Google (1) had not obtained the user’s consent before depositing advertising cookies in the user’s terminal equipment, (2) had lacked to provide information, and (3) had not implemented a mechanism to refuse the cookies. Google did not agree with the CNIL’s decision and brought the issue before court. First, it claimed that, since there is cross-border processing, the Irish DPA (DPC) is the lead supervisory authority since Google’s main establishment in the EU is in Ireland, and the CNIL therefore did not have competence to rule on this matter according to the one-stop-shop mechanism. Second, it found the fine to be disproportionate. Hence, it requested the Council of State to annul the decision, and to refer two preliminary questions to the CJEU, asking: (1) whether the one-stop-shop mechanism provided for in Article 56 GDPR is excluded in the context of cross-border processing that falls within the scope of both the ePrivacy Directive and the GDPR, and (2) whether Article 15a ePrivacy Directive violates the right to data protection because does not provide an obligation, but rather an option, “for the competent national regulatory authorities to adopt measures to ensure effective cross-border cooperation in the enforcement of national laws adopted pursuant to the directive and to create harmonised conditions for the provision of services involving cross-border data flows”. The Council of State rejected Google’s appeal. First, according to the Council, the ePrivacy Directive, implemented in the French Data Protection Act, does not provide for the application of the one-stop-shop mechanism as mentioned in Article 56 GDPR. Although the requirements for consent are regulated by the GDPR the deposit of cookies is regulated by the ePrivacy Direct
The Director of a public school was requested to provide a comprehensive set of information related to the members of its public education board. The information requested included, inter alia, the name, age, completed academic education, position held, and remuneration. The Director provided the information requested, but refused to disclose the members' remuneration, claiming that the provision of this information would violate the employee's privacy and data protection rights. Upon request to review the decision, the Director upheld it. The Director explained that information related to the expenditures of a public body on the remuneration of its employees is indeed public information, but that this did not imply that the employees would consent to the publication of their names and individual remuneration. Referring to a decision of the Polish Supreme Court in case [https://orzeczenia.nsa.gov.pl/doc/389F848379 I OSK 695/14], the Director pointed out that what is considered public information is the amount of public funds allocated to a given position as a base salary, not the exact remuneration a particular person receives (which may include many other elements, such as social benefits, deductions, etc.) The claimant appealed this decision with the Head of the Municipality, which in turn upheld the contested decision, pointing out that individual remuneration attached to a specific name is personal data under Article 4(1) GDPR. Additionally, the Head of the Municipality maintained that according to Article 11 of the Polish Labour Code, an employer is obliged to respect the rights and dignity of employees, including their right to privacy, and therefore to keep salary information secret. In view of the above, the claimaint filed a complaint before the The Provincial Administrative Court in Rzeszów (Wojewódzki Sąd Administracyjny w Rzeszowie - WSA Rzeszów). The WSA Rzeszów overturned the decision from the Head of the Municipality. The court held that the remun
In 2020, the data subject requested access to data concerning him from the tax authority (the controller) after a tax audit had been carried out on his wife. The controller replied that the data processed in this context did not concern the data subject. In February 2021, the controller reported a data breach to the competent supervisory authority. In the course of the tax audit, the case handler had sent the data subject's mobile phone number to his wife's work email address via unencrypted email without his consent. Subsequently, the data subject filed a complaint with the German Federal Data Protection Authority (BfDI). In March 2021, the data subject filed an action for information. In particular, he desired information on all data about him stored by the controller since 1972, a copy of the data and the deletion of all data. The Finance Court Berlin-Brandenburg fully rejected the data subject's claim. First, regarding the data subject's right to access pursuant to Article 15(1) GDPR, the court held that the data subject was not entitled to the requested unlimited and unspecified data disclosure. It stated that this right against controllers who process large amounts of data only exists if the request is sufficiently specified. The court rejected the data subject's view which mainly referred to the wording of the provision. Instead, it made a systematic argument. The court used Recital 63(7) GDPR and a comparison with Article 14(5)(b) GDPR according to which the fulfilment of information obligations vis-à-vis a person affected by a data collection from third parties can be omitted if the provision of this information proves to be impossible or would require a disproportionate effort. Here, the court emphasised that some scholars even apply Article 14(5)(b) GDPR analogously to Article 15(1) GDPR even though it did not create an analogy itself. In particular, the court argued that, if Article 15(1) GDPR had to be interpreted widely, the exercise of comprehensi
Controller is the municipality of Eindhoven. The data subject found out that an email that they sent to the municipality on 15 January 2017 (in which they complained about their neighbours), had been forwarded and had ended up with their neighbours, without blacking out their email-address. Because they had not given consent for this, and the processing for personal data was not necessary to fulfil a public interest, the data subject requested the municipality to (1) rectify personal data mentioned in letters of 7 April 2016 and 14 November 2018, and (2) compensation for damages caused by forwarding their personal data without a legal basis. After the municipality had rejected the request, the data subject [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBOVE:2019:1827 brought the issue before court]. The District Court of Oost-Brabant dismissed this appeal, after which the data subject appealed this judgement before the Council of State. On appeal, the data subject argued that (1) The municipality had exceeded the decision period of one month as per Article 12(3) GDPR for their request to rectify the personal data, (2) the municipality should have also rectified personal data in the letter of 14 November 2018, and (3) The District Court had wrongly considered that the data subject was not entitled to compensation. The Council of State rejected the appeal. First, the Council stated that the municipality complied with the data subject's access request within the decision time of one month as per Article 12(3) GDPR. Second, the Council of State held that the right to rectification of personal data pursuant to Article 16 GDPR only applies to inaccuracies that can be easily and objectively ascertainable. Since the letter of 14 Novemer 2018 concerned impressions and conclusions with which data subject did not agree, the Council found that the rejection of the request for rectification was well-founded. Lastly, although it is not disputed between parties
Plaintiff A is a former employee of defendant C. Defendant C accuses plaintiff A of a series of misconducts in connection with their employment, namely: (1) to have made false statements when concluding their emplyoment contract, (2) to have breached data protection regulations by having her husband draw up the duty roster and, thereby, providing an unauthorized person access to the personal data of other employees, (3) to have instructed other employees to provide care services to clients beyond the allowed limited field of acivity of said employees, (4) to have repeatedly postponed appointments with new clients without reason, and (5) to have stopped working for several afternoons without permission to pursue private activites. Plaintiff A disputes these assertions and claims that after the termination of the employment relationship between plaintiff A and defendant C, defendant C made an active effort to contact potential future employees of plaintiff A to inform them of the disputed misconducts and is filing for injunctive relief. The court ordered the defendant to cease and desist from actively approaching potential future employers of the plaintiff to make their claims. It pointed out that both the protection of personality guaranteed by Article 1 and 2 of the German basic law as well as the legal basis for the processing of personal data of Article 6(1)(f) GDPR (the legitimate interests of a data controller or a third party) require a balancing of interests between (1) the rights of a former employer to provide information to a new employer about the performance and conduct of a former employee and (2) the personality and data protection rights of an employee. It held that while in principle employers are entitled to forward information regarding the employee's performance and conduct, none of the claims, to the extent that they were substantiated by defendant C, met the necessary proportionality threshold of the German basic law and the GDPR to entitle d
In June 2018 the data subject sent a request under Article 17 GDPR to the credit reference agency, requesting the erasure of all processed data on previously unsettled debts. The data subject stated that all debts have been settled in 2013 in the course of fulfilling a payment plan resulting from insolvency proceedings. After the credit reference agency refused the erasure, the data subject filed a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB) in July 2018. The credit reference agency argued before the DSB that the data were still relevant for correctly assessing the data subject's creditworthiness under Article 5(1)(d) GDPR. Deleting the data would lead to incorrect results. In addition, the credit reference agency's interests under Article 6(1)(f) GDPR would outweigh those of the data subject. Furthermore, the credit reference agency demanded that the DSB would not deviate from Austrian case law prior to the applicability of the GDPR, according to which payment experience data could be stored for up to 7 years after the respective debt has been settled. The DSB partially upheld the complaint, ordering the credit reference agency to erase the data on a €497 debt from their database as it had been settled in February 2013. Regarding data on a €481 debt which had been settled in April 2018, the DSB rejected the complaint, as it considered this data still necessary to assess the data subject's creditworthiness and agreed with the credit reference agency that the processing can be based on Article 6(1)(f) GDPR. The credit reference agency filed an appeal against the the DSB's order to erase the data on the €497 debt. The BVwG upheld the DSB's decision. It emphasized that at the point of the decision of the BVwG, the debt had been settled for more than 9 years. Consequently, it considered the data to be to no longer relevant for assessing the data subject's creditworthiness. The BVwG also mentioned that even under case law prior to