GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
On 26 July 2021, a journalist informed the Cypriot DPA of a security vulnerability on an online platform. This online platform hosted ticket purchase sites of two Cypriot football clubs, OMONIA and APOEL (the controllers). This flaw in the system allowed a user to identify, through a reserved-seat icon, the name and ID number of the fan who had reserved the seat. By using that information, the user could then download the fan card, including the fan’s photograph. The DPA ordered the controllers to submit a personal data breach notification in accordance with Article 33 GDPR. In addition, it asked them to provide information on whether a penetration test had been carried out on the platform and to submit their contracts with the platform provider which acted as the processor of this data. Both controllers submitted the Personal Data Breach Notification Form and the requested documents. The DPA fined each controller €40.000 and the processor €25.000 for the violations of Article 24(1) GDPR, Article 25 GDPR and Article 32(1) GDPR. The controllers and the processor appealed the decision, mainly disputing their responsibility for the required security measures, their respective roles under the GDPR, and the proportionality of the fines. One of the controllers challenged only part of that fine. The court held that, by submitting the breach notification form, the controllers had accepted both that there had been a personal data breach under Article 33 GDPR and that they acted as controllers for the purposes of the GDPR. The court further held that the platform provider acted as a processor under the relevant contracts and was therefore bound by Articles 28 and 32 GDPR. The court upheld the DPA’s finding that the controllers and the processor had infringed the GDPR. It rejected one of the controllers’ arguments that it had no duty to carry out a penetration test before the platform was launched. The court held that Article 24 GDPR, Article 25 GDPR and Article 32 GDPR imp
The data subject was employed by HEP Proizvodnja d.o.o., an electricity and heat generation provider (the controller), at one of its hydroelectric plants. Their work involved the maintenance of computer systems. Their employment was later terminated in April 2022. While the data subject was on sick leave, one of the computers located in their office stopped functioning. The data subject claimed that, because of this malfunction, they came to the workplace, disconnected and rearranged some equipment, and then left. According to the data subject, their office contained both work-related and private computer equipment, including devices and hard drives on which their personal data and the personal data of third parties were stored. The controller stated that the engineering workstation located in the office used by the data subject had lost its uninterrupted power supply due to equipment failure. It was necessary to turn it on and log in so that business processes could continue uninterrupted. The controller further claimed that the data subject appeared at the workplace despite warnings from their superiors that their presence was not needed, entered their workspace, attempted to tamper with the equipment and prevented other colleagues from accessing the computer data. The controller launched an internal investigation for the security incident. The controller stated that the processing of the data subject’s data was carried out by its Corporate Security Office and was necessary to maintain operational continuity and security of the facility. The data subject filed a complaint with the Croatian DPA. They claimed that, during the investigation, the controller unlawfully accessed and processed their personal data, including data stored on several computers and hard drives. They argued that some of the data stored there were private, that special categories of personal data were processed, and that the controller could tell from the names of certain files, before opening
The controller ran 29 outdoor swimming pools in Berlin. In summer 2023, the controller introduced expanded identity verification checks and video surveillance measures due to safety concerns, such as aggressive behaviour and verbal and physical attacks by potential customers (the data subjects). Swimmers aged 14 and older were only granted access to the outdoor pools upon presentation of a photo ID, and video surveillance was implemented in the entry and exit areas. The video footage was stored for 72 hours. The DPA issued the controller a reprimand in August 2025. It held that the identity checks and the video surveillance were not necessary to fulfil the controller’s duties set forth in national law or ensure safety at the swimming pools and found a violation of Article 5(1)(a) GDPR. The controller appealed the DPA decision in September 2025. The court annulled the DPA decision and held that the identity verification checks and video surveillance had been necessary for the performance of a task carried out in the public interest within the meaning of Article 6(1)(e) GDPR. First, the court pointed out that the processing operations must serve objectives in the public interest in order to be lawful under Article 6(1)(e) GDPR. The aim of both measures was to prevent criminal offences, restore safety at the outdoor swimming pools for swimmers and staff members, and to protect the lives, health, and freedom of these individuals. This requirement was therefore fulfilled. Second, the court held that the criterion of necessity was also satisfied regarding both processing operations. According to the court, there did not appear to be a less intrusive measure that would interfere less with the fundamental rights of the data subjects and improve safety at the pools just as effectively than requiring swimmers to present a photo ID upon entry. Similarly, video surveillance was deemed the only viable option to ensure safety in the exit and entry areas, where the staff were e
INA, a petrol station chain in Croatia, appealed, AZOP's, the DPA's, €5000 fine. The fine was based on AZOP's decision that INA, as a controller, did not take all necessary measures to prevent unauthorised access and visibility of the real-time CCTV feeds to all customers. INA disputed this decision, claiming legitimate grounds for such data processing, stressing that projecting real-time CCTV feeds in petrol station shops to customers is an accepted and normal practice in the industry and by the consumers themselves. The Court upheld the DPA's decision regardless, on two crucial grounds: the lack of compliance with the cumulative requirements to fulfil Art 6 GDPR and Art 32 (1 and 2) GDPR. Firstly, the Court sided with the DPA, stating INA, did not meet two of the three cumulative conditions, in depicting a legitimate interest for the purpose of ensuring a timely response by employees and deterring perpetrators of criminal and infringing acts. Therefore, the Court accepted the reasoning that, the requirement of necessity is not met, as the timely reaction by employees and a rapid response in the event of a harmful incident, can be achieved even without customers having real-time access to the video surveillance system. As Art 6(1)(f) prescribes that three conditions must be met cumulatively for the data controller to be able to demonstrate its legitimate interest for a lawful basis, the prescribed conditions are not cumulatively met. Secondly, the Court highlights that the screen's placement in the premises of the retail shop of the petrol station itself, with clear visibility for all, is contrary to Art 32(1) and (2) GDPR. The Court stresses INA failed to take necessary protection measures in accordance with existing and foreseeable risks of unauthorized disclosure of personal data. This becomes especially relevant, as the the controller allows customers, as unauthorised persons, access to the live feed in real time, exposing the personal data to risks such as
The DPA had found that the controller had infringed Article 27 ZPOUZP by using CCTV inside and outside its premises without displaying a video-surveillance notice at the latest upon entry into the recording perimeter. ZPOUZP is the Croatian Act on the Implementation of the GDPR. Article 27 of this Act specifically regulates processing of personal data via video surveillance.The contested decision had further found that the controller had failed to display all relevant information required under Article 27(2) ZPOUZP, namely information about the controller and contact details through which data subjects could exercise their rights. The DPA imposed a fine €3,500 to the controller. The controller appealed this decision before the Administrative Court of Zagreb. The controller contested the legality of the DPA’s decision and requested its annulment. It argued that, as the DPA itself had acknowledged, there were several notices informing data subjects of the existence of video surveillance in the area. Therefore, according to the controller, it was incorrect to conclude that the notices were not visible upon entry into the recording perimeter. Regarding the contact point through which data subjects could exercise their rights, the controller further argued that it had clearly and sufficiently indicated that another entity, acting as processor, had been entrusted with the processing of the relevant personal data on its behalf. It pointed out that the processor’s phone number and email address had been provided. The DPA argued that it had correctly applied the law to the facts of the case. It acknowledged that several CCTV notices existed, but emphasised that the indication that the building was under video surveillance had to be visible no later than upon entry into the recording perimeter. In the controller’s case, the DPA considered that the first video-surveillance notice had been placed in such a way that data subjects would already be within a camera’s field of view
The data subject was a military officer against whom were launched disciplinary proceedings. These proceedings resulted first in the imposition of a fine against them and ultimately in their dismissal. The dismissal judgement was later annulled by the Supreme Administrative Court. The data subject lodged 14 complaints with the DPA from 11 April 2023 to 22 August 2024. The DPA pointed out that in the recent past, it had already decided on 19 previous complaints that the data subject had lodged with it. From these 19 cases, the data subject’s complaints were dismissed nine times. Eight complaints were upheld, and one was partially upheld. Moreover, the data subject had appealed three of these decisions. The DPA found that all of the new 14 complaints shared a common link. They were all related to the data subject’s employment-related conflicts and the disciplinary proceedings. They were also filed against individuals connected to the data subject’s former employment. In addition, the DPA noted the repetitive language in the data subject's submissions. The data subject in their complaints regularly alleged unlawful use of their data, unlawful disclosures and violations of their data subject rights. The DPA highlighted that on some occasions the data subject had filed a complaint with it as early as the day after the rejection of one of their requests. The DPA believed that the data subject was attempting to resolve issues with former departments and superiors through data protection complaints. It concluded that the data subject was using the complaints as a form of retaliation, rather than genuinely seeking to protect their legal rights due to an alleged data protection violation. The DPA emphasized that data protection proceedings should not be used as a means of pressure against former superiors. Consequently, the DPA determined that the data subject's complaints were abusive and their actions excessive. Deeming this an abuse of rights, the DPA decided not to proce
The case involves data processing for copyright enforcement, unrelated to cookies or consent mechanisms.
The controller (the operator of multiple large social networking platforms) offered "Business Tools" that third-party website and app operators could integrate into their services. These tools transmitted visitors' personal data, such as identifiers, contact details, browsing information and interaction data, to the controller. The data subject had used the social network since 2021. He had not consented to the controller's use of personal data transmitted through these Business Tools. The data subject brought proceedings seeking, among other things, a declaration that the user contract did not permit the processing of such data, an injunction against further processing, restrictions on the use of already collected data, deletion or anonymisation of the data, and compensation under Article 82 GDPR. The first-instance court rejected the declaratory claim, partially granted an injunction concerning the storage of off-site data, and dismissed most of the remaining claims. Both parties appealed. The court distinguished between two types of processing: the collection of personal data on third-party websites and apps through the controller's Business Tools, and the storage and further processing of data after transmission to the controller. Regarding the collection of data on third-party websites and apps, the court found that the controller and the third-party website operators were joint controllers under Article 26 GDPR. The controller failed to prove that the data subject had consented. However, the court rejected the injunction request against the controller for this stage of processing because the immediate infringement resulted from the conduct of the third-party website operators. The controller had contractually required website operators to obtain a valid legal basis and had not breached any specific duties arising from Article 26 GDPR. Third, the court held that the controller unlawfully stored personal data received through the Business Tools. The controlle
A data subject made an access request to a credit information agency (the controller) in 2023. He later filed a complaint with the Austrian DPA and alleged that the controller had violated his right of access under Article 15 GDPR by providing him partially flawed and inconsistent information. In particular, the data subject claimed that no information regarding the logic involved in the calculation of credit scores were disclosed by the controller. The data subject also stated that his right to information, rectification, erasure, restriction of processing, objection and the right not to be subjected to automated decision-making under Articles 14 and 16–22 GDPR had been violated. While the controller provided further access in course of the procedure, it argued that it provided all information required under Article 15 GDPR. After the DPA initially ordered the data subject to provide more information regarding his complaint, the DPA found no infringement of the GDPR. In particular, the DPA held that the data subject limited its access request to partial information and that he failed to exercise his rights under Article 16–22 GDPR before failing the respective complaint. The data subject subsequently appealed the decision to the Austrian Federal Administrative Court. The court dismissed the data subject’s appeal. First, the court interpreted the access request narrowly and found that the controller had not violated Article 15 GDPR. It stated that the data subject had limited his access request to concern certain information only and held that the controller had provided him all such information. Second, the court could not find any infringement of Article 14 GDPR: it held that the data subject had failed to elaborate why he considered his right to information had been violated. Furthermore, the court stated that Articles 16–22 GDPR had not been infringed, as the data subject had not exercised his rights under these provisions by sending the controller a corre
Third-party tracking tools processed personal data without user consent, violating cookie consent requirements.
A data subject brought a complaint to the DPA concerning the Järvenpää parish (the controller, a religious institution). The controller sent them a letter about their right to vote in the upcoming controller's elections. According to the data subject, the printed text in the envelope allowed third parties to infer that the data subject was a member of the Evangelical Lutheran Church. The DPA dismissed the complaint, and stated that the controller had not processed personal data expressing religious or political beliefs (Article 9 GDPR). In addition, the controller had a legal basis to process the data subject’s personal data through letters. This is because the controller had the duty to ensure that information related to the right to vote reaches the data subject. Finally, the DPA stated that the postal company distributing the envelopes had a duty of confidentiality. The data subject appealed the decision to the Administrative Court, who overturned the decision of the DPA. According to the court, the envelope allowed individuals to infer that the data subject was a member of the church. This indirect information on religious beliefs fell under the scope of Article 9(1) GDPR. Therefore, the controller violated Articles 5 and 9(2)(d) GDPR, as it was not necessary to include this data on the outside of the envelope. According to the court, the controller could have fulfilled the purpose of informing data subjects after the envelope was opened. The controller appealed the decision to the Supreme Administrative Court. The controller argued that including information on the elections on the outside of the envelope does not violate the GDPR, as religious communities have a strong freedom of religious communication. In addition, the controller argued that it implemented appropriate safeguards in processing the data subject’s data. On the other hand, the data subject argued that the controller did not comply with the requirements of data minimisation (Article 5(1)(c) GDPR)
The data subject applied for international protection in Austria on 22 September 2022. The controller (Austrian migration authority) rejected the application on 19 October 2022, issued a return decision without an entry ban, and entered the data subject's return alert into the Schengen Information System (SIS) on 21 November 2022. On 17 July 2025, the data subject asked the controller to delete the SIS alert. The controller refused the request. On 31 August 2025, the data subject lodged a complaint with the Austrian DPA seeking deletion of the SIS alert. On 31 October 2025, the DPA rejected the complaint because the return decision remained valid, the data subject had not proved departure from the Schengen area. The data subject appealed to the court, arguing that they had voluntarily left Austria, were lawfully residing in Portugal, and were in the process of obtaining a residence permit there. First, the court held that the controller had lawfully processed the data under Article 6(1)(c) GDPR and Article 6(1)(e) GDPR because EU immigration law required Member States to enter return decisions into the SIS. Second, the court held that none of the deletion grounds under the immigration law appled, as the return decision had not been withdrawn or annulled, the data subject had not demonstrated departure from the territory of the Schengen Member States, and Portugal had neither granted a residence permit nor notified Austria of an intended or completed grant. Third, the court found that Article 17(3)(b) GDPR did not require a deletion as the processing remained necessary to comply with a legal obligation and to perform a task in the public interest. The court also noted that the processing of biometric data contained in the SIS alert was permitted under Article 9(2)(g) GDPR because Union law authorised the processing for an important public interest and included appropriate safeguards. The court therefore concluded that the controller had no obligation to erase the
In December 2023, callers to a service telephone number operated by a public broadcaster (the controller) heard an automated message stating that calls were recorded and could also be broadcast. Several times during December 2023, the data subject called the service number. The controller recorded the call. On 12 December 2023 and again on 18 December 2023, the data subject complained to the DPA that the controller recorded calls without obtaining consent. The controller argued that the recordings formed part of its statutory quality-assurance obligations. It relied on national legislation requiring it to maintain a quality-assurance system and submitted that the recordings supported that objective. During the proceedings, it also stated that it would adapt its system so that future callers could prevent or interrupt recordings. The DPA upheld the complaint and found that the recording violated the data subject's right to confidentiality. The controller appealed to the Federal Administrative Court. First, the court held that the recording constituted processing of personal data and that the broadcaster acted as controller under Article 4(7) GDPR. Second, the court rejected the broadcaster's reliance on Article 6(1)(c) GDPR. Although national law required the broadcaster to operate a quality-assurance system, the court found that those provisions did not impose a sufficiently specific legal obligation to record callers. Recording service-line calls was not necessary to fulfil the statutory quality-assurance requirements, which could be achieved through other measures such as representative audience surveys, studies and audience consultations. Third, the court rejected using Article 6(1)(e) GDPR as a basis. While the broadcaster's quality-assurance activities served a task in the public interest, recording callers was not necessary for carrying out that task because less intrusive alternatives were available. Fourth, the court rejected Article 6(1)(f) GDPR. The cour
The website's cookie banner lacked a rejection option on the first layer, used dark patterns, and set non-essential cookies without valid consent.
The cookie banner did not offer an equally prominent rejection option, making it harder to refuse cookies than to accept them.
The data subject made an access request to a national security authority (the controller) who had conducted multiple security assessments about him. The data subject had been informed that the security assessment in connection with his use of the federal press service’s online accreditation had resulted in a negative recommendation. The data subject stated that the controller had provided him incomplete information as a response to the access request. In the proceedings before the court of first instance, the data subject demanded the controller to provide him access to complete and correct information according to Article 15 GDPR and claimed €100 in damages. In addition, he requested a declaration of the liability of the controller due to the inadequate execution of his access request. The court of first instance rejected the claims on the grounds of inadmissibility of legal recourse. The appeals court found GDPR did not apply to the case according to the exception in Article 2(2)(d) GDPR and held that the alleged infringement must be asserted before the DPA with legal recourse to the administrative court. The data subject stated in his appeal before the Austrian Supreme Court that he had the right to assert his claims in the ordinary course of law by virtue of Article 79 GDPR. The Austrian Supreme Court rejected the appeal with regard to the access request under Article 15 GDPR. It held that the data subject would only benefit from the dual nature of legal protection by the DPA and the civil courts within the scope of application of the GDPR. The court ruled that the GDPR was not applicable in the present case: the purpose of the security assessments was to evaluate the trustworthiness of a person and provide information on whether they would commit dangerous attacks. Therefore, they clearly fell within the scope of the exception in Article 2(2)(d) GDPR. The data subject was not able to prove that his personal data had also been processed for administrative, or
A data subject was a temporary agent working for the CJEU. In 2019, the data subject reported inappropriate conduct of a member of the General Court with whom they were working. The President of the General Court initiated proceedings, and an Advisory Committee issued an opinion that the member in question had breached provisions of the Code (the data subject was informed of this opinion). The data subject requested the relevant authority (“AHCC”) to open an administrative investigation and provide them with technical and financial assistance in potential proceedings before national judicial authorities. The authority opened an investigation and partially granted the request for assistance in September 2019. The data subject did not contest this decision, and filed a new request for assistance in 2021 on the grounds that new and substantial facts had arisen since the decision in 2019. The Appeals Panel considered this as a request for an internal appeal and declared it inadmissible. The Panel also dismissed the request on the merits, considering it unfounded. In 2019, the data subject also submitted an access request to the General Court and Presidents of the Court of Justice, in accordance with [https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Article 17 of the EUDPR]. The data subject requested access to documents relating to the whistleblowing and assistance procedures they had initiated. Both parties rejected the data subject’s access request, on the grounds that it would likely infringe upon the rights and freedoms of others ([https://eur-lex.europa.eu/eli/reg/2018/1725/oj/eng Article 17(4) and 25(1)(c), (g), and (h) EUDPR]). The data subject filed an internal appeal, which was rejected in 2020. The data subject filed a new access request in 2023. This request was rejected on the grounds that it had the same subject matter as the access request made in 2019. The data subject filed a case with the General Court to overturn the dismissal of the internal appeal.
The case focused on direct marketing and consent issues rather than specific cookie violations.
The background In 2021 Hungary adopted "Law LXXIX of 2021 adopting stricter measures against persons convicted of paedophilia and amending certain laws for the protection of children" ("the amending law"). The law introduced a number of rules to restrict the access of minors to content portraying or promoting gender identities that do not correspond to the sex assigned at birth, sex reassignment or homosexuality. The law also introduced new rules for access to public documents, requiring public bodies to allow broad access to information about individuals convicted of sexual offences against children. The alleged purpose of the law was to protect minors. In 2021 the Commission sent a formal letter to Hungary contesting the amending law's compliance with EU law. After some unproductive back-and-forth, the Commission escalated the case to the CJEU, requesting the CJEU to declare the amending law incompatible with EU law. The European Commission filed four pleas, claiming that Hungary violated of a long list of provisions from primary and secondary EU lawThe Commission alleged the violation of Articles 1, 7, 8(2), 11 and 21 CFREU; Article 2 TEU; Article 56 TFEU; Article 3(2) of the Directive on electronic commerce; Articles 16 and 19 of the Services Directive, Article 9(1)(c)(ii) of the AVMS Directive; and Article 10 GDPR.. Only the Commission's fourth plea invokes data protection law- specifically, [https://www.europarl.europa.eu/charter/pdf/text_en.pdf Article 8(2) of the EU Charter of Fundamental Rights (CFR)] ("Protection of personal data") and Article 10 GDPR ("Processing of personal data relating to criminal convictions and offences"). The fourth plea: Article 10 GDPR The alleged violation of the GDPR relates to the amended law's rules on access to information about individuals convicted of sexual offences against children. The law amended the "Law on the criminal record system" and made documents about sexual offences accessible to a broad audience. Under the ne
The property management company of a high-rise building (the controller) had a video surveillance system installed at the entrances of the building in 2021. The installation was approved by the homeowners' association. The footage was stored for 72 hours, and there was no live monitoring. Signs indicating video surveillance were posted at both entrances. The owner of an apartment in the building (a data subject) filed a complaint with the DPA in July 2023. The controller argued that the surveillance was intended to prevent and detect unauthorised access to the building and criminal offences. It also stated that there had been repeated incidents of vandalism and property damage prior to the installation of the cameras. The DPA issued it's final notice in April 2025 and held that no violation of the GDPR could be established. It considered the video surveillance necessary to protect the legitimate interests of data subjects - namely, the protection of property against damage and vandalism. The data subject appealed the DPA decision in April 2025. He argued that there was no particular threat that would justify the installation of a video surveillance system. According to the data subject, an on-site investigation carried out by the Berlin police supported this view. The court dismissed the data subject's appeal. It held that the DPA had fulfilled its obligation under Article 57(1)(f) GDPR and investigated the complaint to an appropriate extent. In addition, the court held that the video surveillance was lawful under Article 6(1)(f) GDPR. The court came to the conclusion that the controller's aim to protect property against vandalism and prevent criminal offenses constituted a legitimate interest within the meaning of Article 6(1)(f) GDPR. It referred to previous jurisprudence and pointed out that video surveillance could be only be justified for such purposes if there is a threat that goes beyond the general risks of daily life. This requirement was fulfilled in the