GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
GOOGLE LLC
The data subject was a Dutch real estate entrepreneur who was criminally convicted. Google (the controller) was the operator of the internet search engine Google Search. When the name of the data subject was searched on the controller's search engine, results included an URL that referred to an article, in which it was stated, among other things, that they had criminal convictions. The data subject filed a complaint against the publisher of the article with the Netherlands Press Council, and the Press Council rejected the complaint, ruling that the publication did not violate the data subject’s privacy rights. Also, the data subject sent multiple requests to the controller to remove the URL linking to the article, and the controller rejected all of these requests. Finally, the data subject asked the court to order the controller to remove the specific URL that links to this article from its search results when someone searches for their name. The data subject stated that the article contained old and inaccurate information, and that it was harmful for their reputation and their ability to do business. They also stated that there was no strict public need for these details to remain accessible, and the controller lacked overriding legitimate grounds for processing this data. The court rejected the data subject’s request to remove the URL from the controller, finding that they failed to prove that a substantial portion of the information was manifestly inaccurate. The court clarified that the processing of personal data by a search engine is justified under Article 6(1)(f) GDPR, and that Article 17 GDPR grants a right to erasure only if processing is incompatible with the GDPR. Article 17(3)(a) GDPR makes clear that the right to removal does not apply when processing is necessary for freedom of expression and information, requiring a balancing test between with the data subject’s right to privacy and data protection. Article 21 GDPR allows individuals to object
Court case W137 2311069-1
A national of India, the data subject, lodged an application for international protection with the responsible Austrian authority, the controller, which was dismissed and a return decision was issued. Consequently, the data subject’s data was entered into the Schengen Information System (SIS), a system used to track return decisions for third-country nationals unlawfully staying in the EU. The data subject remained in the Schengen area and did not leave. Furthermore, he requested that the Austrian authorities delete his SIS entry, claiming that Portugal had promised him a residence and work permit if the SIS entry was removed. The controller refused to delete the SIS record because the return decision was still valid, the data subject had not left the EU and Portugal had not officially notified Austria of any residence permit grant or consultation as required. The data subject further lodged a complaint with the Austrian Data Protection Authority (DSB) for an alleged violation in the right to erasure under Article 17 GDPR. The DSB dismissed the complaint, finding the SIS data processing lawful. Then, the data subject appealed the decision to the Federal Administrative Court (BVwG). The appeal was dismissed as unfounded. The court held that the SIS entry was lawful under the relevant legislation and there was no legal ground for deletion. Moreover, the right to erasure did not apply, because the SIS processing was required to fulfill a legal obligation under Article 6(1)(c) GDPR and was performed in the exercise of official authority under Article 6(1)(e) GDPR, falling under the exception of Article 17(3)(b) GDPR. The court also clarified that the processing also met the exception under Article 9(2)(g) GDPR for sensitive data.
Court case W176 2250812-1
A data subject was employed by the controller for several years. In 2010 the controller and the data subject signed also a loan agreement. Before concluding the loan agreement, the controller carried out a credit check which resulted in a classification of the data subject’s creditworthiness, nevertheless, a further processing of data of the data subject for the purposes of automated decision-making including profiling did not take place. The controller terminated the employment on 2018. On 2020, the data subject filed a complaint against the controller for allegedly failing to provide complete information and to comply with the request of the data subject for the transfer of the data under Article 15 and 20 GDPR. At a later stage in the proceedings, the data subject withdrew the complaint relating to the exercise of rights under Article 20 GDPR. Although the controller provided several sets of documents between 2018 and 2020, the data subject claimed these were incomplete according to Article 15 GDPR, that the controller’s responses were insufficient and the legal basis for data processing was not clearly explained. The data subject also claimed that its loan-related information was only partially provided and the automated processing of its personal data for credit analysis constituted profiling under Article 4(4) and 22 GDPR. The controller stated that it had provided extensive data in paper and electronic form in a comprehensive and structured manner, that some data were unavailable or withheld to protect third-party rights and that information on the systematic analysis of credit risk was a trade secret. On 19 October 2021, the DPA partially upheld the data subject’s complaint, finding that the controller had violated the data subject’s right to information, because there was no reference to the processing purposes within the meaning of Article 5(1)(b) GDPR and the legal basis was not clear , and also the controller could not rely solely on business or trade se
Data Subject versus Dun & Bradstreet Austria GmbH
The data subject submitted an access request under Article 15 GDPR to Dun & Bradstreet Austria GmbH, a credit information agency, requesting information about how her personal data was being processed. The data subject subsequently lodged a complaint, claiming that the right of access had been violated by the credit information agency for not providing complete or correct information in response to the access request and its subsequent updates. The DSB partially upheld the complaint for violation of the right of access under Article 15 GDPR by the credit information agency and found that it violated the data subject’s fundamental right to data protection : a) Regarding the categories of personal data processed, b) Concerning the credit environment data of the data subject, c) With respect to the weighting of influencing factors used in the automated decision-making, and d) As to the scope and intended effects of automated decision making. The credit information agency lodged an appeal to the Federal Administrative Court, which, partially upheld the appeal regarding points a, b, and d and dismissed the appeal as unfounded regarding point c, emphasizing that the credit information agency violated Article 15(1)(h) GDPR by not providing sufficient information about the logic of automated processing and weighting of factors. The credit information agency then filed an appeal to the Austrian Supreme Administrative Court (VwGH), arguing that it had not violated Article 15(1)(h) GDPR. The VwGH suspended the case, awaiting rulings from the CJEU in SCHUFA Holding (Germany) and Dun & Bradstreet Austria (Austria), which dealt with similar issues around credit scoring and automated processing under GDPR. The Austrian Supreme Administrative Court (BVwG) dismissed the appeal. Under Article 15(1)(h) GDPR, data subjects have the right to meaningful information about automated decision-making and to exercise this right, automated decision-making as defined in Article 22(1) GDPR mu
Court case W256 2279237-1/6E
The data subject filed a complaint with the Austrian DPA on March 16, 2022. alleging that the controller violated his right to access under Article 15 GDPR by providing incomplete details about the specific recipients of their data or the reason why the disclosure of the specific recipients was not possible pursuant to Article 15(1)(c) GDPR., and by failing to provide a copy of the data or offering inadequate justification as to why issuing a copy was not possible under Article 15(3) GDPR. The authority upheld the complaint and ordered the controller to provide the requested information within four weeks or to adequately justify why this could not be done. The controller requested a suspension of the proceedings pending the outcome of another decision, but this request was rejected. The controller appealed the DPA’s decision. Meanwhile, the data subject has passed away. The Court upheld the appeal and annulled the contested decision because the data subject, a natural person, lost his party status in the proceedings upon his death. Since data protection rights are highly personal and extinguish upon the death of the data subject, they cannot be transferred to any legal successor, in accordance with the [https://www.ris.bka.gv.at/Dokument.wxe?ResultFunctionToken=ba0008f7-3b36-4f83-83ee-7878707b664e&SkipToDocumentPage=True&Abfrage=Vwgh&Entscheidungsart=Undefined&Sammlungsnummer=&Index=&SucheNachRechtssatz=False&SucheNachText=True&GZ=Ra+2016%2f04%2f0044&VonDatum=&BisDatum=29.09.2025&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Dokumentnummer=JWT_2016040044_20160418L00 case law of the VwGH]. The extent of a person’s participation in an administrative procedure depends not only on their status as a party but also on their party capacity, that is, their ability to hold procedural rights and obligations. If the party who initiated the proceedings before the administrative authority dies, the contested decision must be te
GGNet
The controller is GGNET, a mental health care institution operating in the Netherlands. The data subject sought medical treatment there after a reference by her general practitioner. The practitioner also forwarded to the controller the data subject’s medical records. After her first session with the social psychiatric nurse of the controller, the data subject decided she didn’t want to continue with the treatment and asked for her medical record to be deleted. The controller informed her that it deleted her medical records but retained a record regarding the erasure request. The data subject filed a complaint before the DPA (Autoriteit Persoonsgegevens-AP) requesting that the controller was ordered to delete the record regarding the erasure request. The DPA rejected her complaint, ruling that the controller could retain this record for the management of its health care services and under the medical treatment contract with the data subject, as referred to in Article 9(h) GDPR. The data subject challenged the decision of the DPA before the court of first instance (Gelderland District Court). The court dismissed the appeal as unfounded, affirming the DPA’s decision. Then, the data subject appealed against this ruling before the Highest Administrative Court (Council of State), claiming that the court of first instance misjudged the case. She claimed that the court did not recognise that the DPA should have taken enforcement action against the controller. According to the data subject, the record of the deletion request was not necessary for the management of the controller's health services nor there was a treatment agreement between the parties since she did not receive any treatment. The court held that the data subject’s right to erasure referred to in Article 17 GDPR could not be satisfied. First, it stated that the retention of the deletion request was necessary for the controller to manage its service, and in particular in order to justify why it no longer has certain medical records to regulators, such as the Health and Youth Care Inspectorate, health insurers and the DPA. Second, it pointed out that under the Dutch Civil Code, all medical procedures are covered by a medical treatment agreement and all care providers have the duty to keep a medical record regarding the treatment of each patient. The session of the data subject with the social psychiatric nurse for the assessment of her psychological condition constituted a medical procedure and therefore was subject to a medical treatment agreement. Therefore, the court held that the processing of the record of the deletion request, which constituted special category of personal data, was lawful under the exception of Article 9(2)(h) GDPR. The retention of the data was necessary for the management of the controller’s services and was also necessary under the medical treatment agreement. According to Article 17(3)(c) GDPR, the right to erasure could not be satisfied because the processing was necessary for reasons of public health in the field of public health in accordance with Article 9(2)(h) and Article 9(3) GDPR. The court concluded that the controller was not obliged to honour the request to erase the record and rejected the appeal as unfounded.
Data subject versus College van burgemeester en wethouders van de gemeente Amersfoort (the municipal executive board of Amersfoort)
The data subject was placed in the persoonsgerichte aanpak (PGA), a local multi-agency intervention programme in Amersfoort aimed at tackling repeated public disorder and safety issues. The police had referred him in December 2022 following multiple complaints of nuisance and repeated negative encounters, documented in a formal police report. His personal data was shared between various municipal partners under the PGA privacy covenant. In February 2024 the municipality informed the data subject that his PGA file had been closed due to the absence of further incidents, but that his data would remain stored for two years. The data subject objected, arguing that his inclusion in the PGA was unfounded, had damaged his reputation, and that continued storage constituted unlawful processing. He sought cessation of the processing under Article 21 GDPR. The municipality rejected his objection, upholding the continued retention of the data. The Court held that the processing of personal data pursued a task of public interest under Article 6(1)(e) GDPR, namely maintaining public order and safety. It accepted the police reports and the PGA expert’s assessment as a sufficient basis for the referral, and held that keeping the data for two years was proportionate to allow swift intervention if problems re-emerged. Although it was held that the data subject had a valid interest in challenging the lawfulness of the processing, the Court concluded that the municipality had demonstrated compelling legitimate grounds that outweighed his personal interest under Article 21 GDPR. The Court found that the municipality had not explained its decision properly at the time, so it formally struck down that decision. However, because the data processing itself was lawful, the outcome remained the same and the data could continue to be stored. The data subject’s appeal was therefore technically successful, but it did not stop the processing. The municipality was ordered to refund the court fe
Court case W292 2235791-1
The data subject lodged a complaint with the Austrian Data Protection Authority (DSB), alleging a violation of its right of access under Article 15 GDPR. Specifically, the data subject requested information from the controller about the recipients and categories of recipients to whom its personal data had been disclosed. In response, the controller provided a general list of all potential recipients but did not specify individual recipients. The DSB held that the controller had violated Article 15 by providing incomplete information. The controller appealed this decision to the Federal Administrative Court. The Court upheld the controller’s appeal. Referring to CJEU case law, the Court confirmed that data subjects have a right to be informed of specific recipients under Article 15(1)(c) GDPR, unless identification is impossible or the request is manifestly unfounded, in which case only categories of recipients must be provided. Applying this standard, the Court found that the controller had fulfilled its obligation by naming all potential processors, explaining the purposes of data transfers, and identifying processors who had not received the data. Since the specific recipients could not be identified due to a lack of documentation, documentation that is not legally required, the Court concluded that the information provided was sufficient and complete.
Council for Child Protection
The data subject submitted a request to the Minister for Legal Protection (now: the State Secretary for Justice and Security) to erase the files of her two sons held by the controller, the Child Protection Council (RvdK), pursuant to Article 17 GDPR. The files contained documents regarding the termination of her parental rights to both her children. On 15 September 2021, the Minister rejected the erasure request, arguing that the records should be retained under the Dutch Archives Act, and on 14 February 2022, he rejected the objection lodged against it. The data subject filed an appeal before the court of first instance against the decision of the Minister. By judgment dated 22 December 2022, the court dismissed it as unfounded. It held that the processing of the data subject’s children’s personal data was necessary for the fulfillment of a statutory processing obligation pursuant to Article 17(3)(b) GDPR. The data subject filed an appeal before the highest administrative court (Council of State-Raad van State). She argued that since the custody termination order for her youngest son had been lifted the files must be deleted because their content was incorrect and therefore unlawful. She further argued that the measure of custody termination for the eldest son should also be lifted because it was based on the unlawful RvdK files. The court held that the data subject did not present any reasons why the processing of the personal data was unlawful, nor has there been any such evidence. She is therefore not entitled to the erasure of the personal data in the RvdK files under Article 17(1)(d) GDPR. It also pointed out that these proceedings could not lead to a judgment on the measure to terminate custody. The court also ruled that RvdK was obliged by statutory law to retain the contested personal data in the files for the envisaged time period, according to the Dutch Archives Act. In the case of a custody order the time period would be 100 years. This means that,
Court case IX R 25/24
The data subject runs a business in the hospitality industry. A tax authority (controller) received an anonymous report against the data subject. The tax authority subsequently carried out a cash register inspection on the data subject which did not result in the finding of any wrongdoing. The data subject requested from the tax authority access to her tax files in order to gain knowledge of the content of the anonymous report, on the basis of her right to inspect files under the national fiscal code, but the tax authority rejected the request. She also made an access request under Article 15 GDPR, but the tax authority refused to provide the data about the anonymous report. In August 2023, the data subject appealed the decision of the tax authority before the tax court of first instance (Berlin-Brandenburg tax court). She requested access to the files and information on the content of the anonymous report by sending her a copy, or, alternatively, by informing her about the content, in accordance with Article 15 GDPR and the national fiscal code. The tax court dismissed the action, holding that the data subject was not entitled access to the file, because she did not have a right to inspect files under the national fiscal code and also the provisions of the national fiscal code preclude the exercise of Article 15 GDPR if the provision of information would compromise the performance of the authority. The data subject filed an appeal with the Federal Fiscal Court (BFH), claiming that her rights under the GDPR override the national fiscal code provisions. The court rejected her request to access the file both under her alleged right to inspect the files under the national fiscal code and her right to receive a copy of the notification under Article 15 GDPR, and dismissed the appeal as unfounded. First, it pointed out that the national fiscal code does not contain a provision according to which there is a right to inspect files but depends on the discretion
Municipality of Bremen
The municipality of Bremen (controller) operates of a public waste disposal system. By its decision in January 2022 , the controller issued a waste fee notice for the year 2022 in the total amount of €176,82 against the data subject with regard to his property. In February 2022, the data subject filed an objection against this fee notice before an appeal authority of the controller, arguing that the fee notice had been issued fully automatically, in violation of Article 22 GDPR, and was therefore unlawful. He claimed that his personal data had been processed fully automatically and unlawfully, resulting in an individual administrative decision detrimental legal effects. He also objected to the fully automated processing of his personal data. The controller rejected the data subject's objection as unfounded, in amendment to the fee notice produced by a clerk, dated 8 March 2023. According to the controller, Article 22 GDPR did not apply in the present case, as there was no automated decision in the individual case within the meaning of the provision. The mere program-supported calculation of fees according to a fixed fee schedule does not constitute a decision within the meaning of Article 22 GDPR. In any case, a possible breach of a legal reservation was cured by the notice amending the fee notice. In April 2025, the data subject filed an action before the court (Administrative Court of the Free Hanseatic City of Bremen-VG Bremen) where he challenged the fee notice (consisting of the original fee notice as amended by the later notice produced by the clerk). He persisted that his personal data had been improperly subjected to illegal automated processing, without the involvement of a human being, by the controller, which led to a decision with a direct legal effect on him. The data subject requested that the fee notice was set aside due to a violation of Article 22 GDPR. First, the court found that the initial decision of the controller of January 2022, regardin
Court case 11R86/25k
The data subject was a tenant in an apartment owned by the controller. Termination proceedings were pending between the parties. During those proceedings, the data subject submitted photos and documents suggesting that the controller had been monitoring them. They subsequently submitted an access request, seeking access to personal data processed about them, including among other things, information concerning their heating and hot-water consumption. The controller refused to provide the requested information. The data subject claimed that the refusal had left them with a feeling of powerlessness, stress and uncertainty about the extent to which their private activities had been monitored and their personal data processed. They therefore filed a claim for damages. The controller argued that the data subject’s access request was an abusive exercise of rights because it had been submitted in the context of the termination proceedings. It claimed that their sole intention was to obtain evidence for that dispute. It alleged that the data subject had not shown any interest in this information prior to the court proceedings. The controller also argued that the requested information was protected as its trade secrets. It further requested that the proceedings in this case be stayed until the termination proceedings and the proceedings pending before the Austrian DPA had been finally resolved. The first-instance court rejected the motion for a stay and upheld the data subject’s claims. It found that the access request was not abusive, as the data subject pursued legitimate purposes under Recital 63. It held that the data subject sought to obtain information about the data concerning them and verifying the lawfulness of that processing. It further held that trade secrets could override the right of access only in special circumstances and that the controller’s purpose to avoid giving the data subject an advantage in the termination proceedings was not sufficient. The controller appealed to the Higher Regional Court of Vienna (OLG Wien). It maintained that the access request was abusive and that it was entitled to refuse access in order to protect its trade secrets. The court referred to the CJEU judgment in [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0132 Case C-132/21] and ruled that it was permissible to pursue in parallel dual legal remedies, at least until a final decision has been issued. The court confirmed that an access request under Article 15 GDPR is not abusive where it serves a legitimate purpose within the meaning of Recital 63 GDPR. It cited [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62022CJ0307 CJEU C-307/22] and held that an access request may legitimately be used to obtain evidence for litigation. Regarding trade secrets, the court stated that protected information must be secret, commercially valuable and subject to appropriate confidentiality obligations. It found that the controller had failed to explain how the data subject’s own personal data could qualify as trade secrets against themselves. The court emphasised that the controller’s primary concern was that the data subject could gain an advantage in the termination proceedings with this information. However, it pointed out that neither GDPR nor the Austrian Code of Civil Procedure permitted a party to tactically withhold information merely to strengthen its position in a legal dispute. The court therefore dismissed the controller’s appeal in its entirety and upheld the award of €1,000 in non-material damages to the data subject.
Court case UTR 24/4044
The data subject requested access to personal data processed in the Fraud Signalling System (FSV), including the reason for inclusion, the municipality that requested his data, and whether he had received fraud codes. The FSV was a tool employed by the Dutch Tax and Customs Administration to monitor potential tax fraud by analysing citizens' personal data. The Minister (the controller) granted partial access to the FSV data, but rejected access to certain fraud codes, as they related to a third party’s data. The Minister also explained the reason for the data subject’s inclusion in the FSV, including the municipality’s request. The data subject argued that the response was insufficient and requested further details, including the exact date of inclusion in the FSV, the names of officials involved, and access to more systems. The controller provided the name of the municipality that made the request, but did not provide the names of employees involved or screenshots of the search in the FSV. The data subject contested the controller's decision, and brought the case to the Central Netherlands District Court. The court found that the controller had provided sufficient access to the data subject’s personal data in the FSV. There was no obligation to provide additional data or screenshots of the search. The court ruled that the controller was correct in not providing the names of employees or third-party personal data, as the data subject's request for access to other applications, systems, and correspondence was deemed outside the scope of the original access request. The case was dismissed, but the controller was ordered to pay €500 compensation for the delay in its response, but no additional data or documents were required to be provided to the data subject.
Appellant A and Appellant B (residents of Almere) versus College van burgemeester en wethouders van Almere (Municipal Executive of Almere)
The data subjects submitted a request to the Municipality of Almere (the controller), under Article 15 GDPR, seeking access to their personal data contained in their adult son's 'Social Support file'. In May 2019, the controller provided partial access, refusing to provide access to the extent necessary for the protection of third-parties, their son. The data subjects challenged the decision of the controller before the court of first instance (District Court of Midden), alleging that the controller withheld additional personal data. The lower court partly agreed, finding that more data should have been disclosed, but upheld the decision on the extent that data concerning third parties should not be disclosed. The data subjects appealed the decision before the the Council of State, claiming that it is up to them and not the controller or the court to judge whether the confidentiality and the right to privacy of others makes an intrusion into the lives of their families permissible. They also sought damages for exceeding the reasonable time limit to a fair and public hearing. The Council of State upheld the controller’s decision to withhold access to the data subjects' personal data where disclosure would have infringed the privacy of their adult son. It confirmed that in the event of a conflict between the full exercise of the right of access under Article 15 GDPR and the rights or freedoms of others, it is up to the controller to weigh them against each other. In this case the controller adequately justified the balancing of interests. Additionally, it found that the total duration of the proceedings, exceeding the reasonable period of four years by two years and two months, violated the reasonable time requirement under [https://fra.europa.eu/de/law-reference/european-convention-human-rights-article-6 Article 6 ECHR]. The court awarded €2,500 in damages, split among the Ministry of Justice, the Ministry of the Interior, and the controller.
E (the controller)
The data subject has been an employee of the controller since 1 February 2015. In April 2023, the controller was informed of several allegations against the data subject, claiming that the subject created a toxic work environment. To verify the claims, the controller began an internal investigation from 25 August 2023 until 11 January 2024. The final investigation report contained all allegations and the personal data of witnesses and accusers. The data subject claimed the investigation was biased and not objective, and that the resulting report has been used to justify disciplinary measures, rejections of part time work requests, and an attempted termination, and has been quoted in interviews with the press. To understand what has been said about them and verify how truthful the investigation was and if their data was processed lawfully, the data subject requested a copy of the investigation report, if necessary with redacted personal information, based on Article 15(1) and (3) GDPR. The data subject also argued that disclosure of the compliance report was not barred by the rights of the controller or third parties. They maintained that the defendant had no legitimate confidentiality interest, that economic interests were insufficient, and that the report did not qualify as a trade secret or be protected by whistleblower protections, as any third-party concerns could be addressed through redaction or anonymization. Also, the data subject claimed a statutory right of access to the report as part of her personnel file based on § 83(1) BetrVG and § 26 (2) SprAuG, arguing that secret personnel files are impermissible. Finally, the data subject argued that immediate enforceability should be possible, as no disadvantage would result and any confidentiality interests of other individuals had already been undermined by the controller quoting the report in court proceedings. Following that, the data subject requested to either get a copy of the investigation report, or
Data subject versus Private Credit Agency
The controller, a credit information agency, made two entries in its register regarding past default payments by the data subject from 2019 and 2021, in the amounts of €201 and €100, both of which were settled on 03.08.2023 and 07.05.2024. On 9 July and 9 August 2024, the data subject requested the deletion of the data and correction of her score but the controller refused. The data subject filed a case before the court of first instance (Regional Court of Regensburg-LG Regensburg) requesting the deletion of the entry, correction of the score value and injunctive measures against renewed storage by the controller. The court of first instance rejected her claims under Article 16 and Article 17 GDPR, holding that the controller’s interests outweighed the data subject’s, according to Article 6(1))f GDPR, and that there was no unlawful processing. Also, the data subject could not demand the complete deletion due to an alleged lack of necessity. The data subject appealed against this judgment before the court of appeal (Higher Regional Court of Nuremberg-OLG Nürnberg). She argued in particular that the court of first instance misjudged the allocation of the burden of proof, because the burden of proof for the existence of a legitimate interest in data processing lies with the controller and that the controller had not convincingly argued the necessity of storing the data for three years after the claims had been settled, invoking ECJ jurisprudence[https://curia.europa.eu/juris/liste.jsf?language=de&num=C-26/22 C-26/22], C-64/22, and [https://curia.europa.eu/juris/document/document.jsf?text=&docid=280623&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1 C-340/21] . The controller claimed that it had legitimate interest under Article 6(1)(f) GDPR, and referred to industry standards permitting a three-year retention. The Higher Regional Court of Nuremberg issued its preliminary legal view of the case (Hinweisbeschlüssen). First, the court of appeal held th
Court case KHO:2025:51
A data subject made an access request to a bank (controller) regarding log data concerning him and in particular the identity of the employees who processed his customer data between 1 November and 31 December 2013, the purpose of the processing and the dates on which the data were accessed. The data subject filed a complaint with the DPA requesting access to this data. In August 2020, the DPA dismissed his complaint stating that no order for access to the data will be issued because the log data in question do not constitute data concerning the data subject but they relate specifically to the employees who have processed the customer data. The data subject appealed this decision to the court of first instance (Administrative Court of Eastern Finland). In September 2021, the court of first instance requested a preliminary ruling from the CJEU asking if the right of access of the data subject under Article 15(1) GDPR is to be interpreted so that it includes information collected by the controller which shows who, when and for what purpose he has processed the data subject's personal data, in particular when it concerns data relating to the controller's employees. In June 2023 the CJEU ([https://curia.europa.eu/juris/document/document.jsf?text=&docid=274867&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1 Case C-579/21]) held, inter alia, that Article 15(1) GDDPR must be interpreted as meaning that the information relating to the times and purposes of the searching of a person's personal data constitutes information that a data subject is entitled to obtain from the controller under that provision. By contrast, that provision does not establish such a right to information concerning the identity of the employees of the controller who have carried out the searches under the authority and on the instructions of the controller, except where that information is necessary to enable the data subject to exercise effectively the rights conferred on him by the GDPR and provided that the rights and freedoms of those employees are respected. The court of first instance concluded that the data subject is entitled to be informed of the time of processing of his data to the extent that they appear in the user logs but not of the identity of the bank employees who carried out the processing. The controller appealed this decision before the Supreme Administrative Court (Korkein Hallinto-Oikeus - KHO) claiming that the data subject is not entitled to be informed of the exact time of the processing of his personal data to the extent that they are indicated in the controller’s user logs, but it is sufficient to be informed of the dates of the processing, since this would not make any difference in his ability to exercise his rights under the GDPR. The court annulled the decision of the court of first instance in respect on the decision on the time of the day of the processing operations. The court highlighted that the purpose of Article 15(1) GDPR is to ensure transparency of the processing of the personal data, without which the data subject would not be able to assess the lawfulness of the processing of their data and to exercise their rights laid down in the GDPR. The precision with which a data subject is entitled to be informed of the timing of processing activities concerning his personal data must be assessed in the light of the aforementioned purpose. The court concludes that the data subject is only entitled to receive information regarding the dates on which his data had been accessed even if the time of the day is indicated in the log files. This information is sufficient to assess the lawfulness of the processing of his data and fully exercise his rights under the GDPR. Finally, the court referred the case back to the DPA to issue a decision in this regard.
Data Subject versus The Dutch Tax and Customs Administration (Belastingdienst) under the authority of the Minister of Finance
In 2022, the data subject was notified that since 2014 he was registered in the Fraud Signaling Facility (Fraudesignaleringsvoorziening – FSV), a database used by the Dutch Tax and Customs Administration to register indications of fraud. The FSV did not comply with the GDPR and therefore since 2020 was no longer in use. The Minister of Finance investigated the incident on its own initiative and found that data subject's data had the not been shared with other agencies, the registration did not negatively impact the data subject and therefore he was not eligible for compensation. In November 2023, the data subject submitted an access request under Article 15 GDPR for his personal data stored in the FSV to the Minister. The Minister granted this request with a ministerial decision and provided an overview of his registration. The data subject disagreed with this ministerial decision and filed an objection claiming that the record provided was incomplete. Then the Minister provided additional data. The data subject filed an appeal against the ministerial decision on objection before the North Holland District Court (HAA) maintaining that the data remained incomplete. Furthermore, the data subject claimed that the FSV registration had long-term harmful effects on his reputation and business due to unlawful sharing with third parties and led to negative decisions by other agencies. Lastly, he seeked €25,000 in non-material damages. First, the court found no evidence that the data subject’s FSV data had been shared with other authorities. The negative decisions from other agencies were received before his registration in 2014. Second, the court also stated it was not competent to award damages in this case. According to national procedural law, only a civil court could assess claims for damages stemming from factual acts of the public administration, like data sharing, as the administrative court can only assess damages directly linked to unlawful decisions. The court concluded that the registration or hypothetical sharing of data did not qualify as such. Consequently, the court ruled that the appeal against the ministerial decision on objection unfounded.
IMY
The DPA’s fine Spotify (the data controller) provided customers (the data subjects) with an online function to download their data directly from the controller’s online platform. This download function was meant to provide data subjects with a response to their access requests. In 2019 three complaints were filed in Austria, the Netherlands, and Denmark. The complainants used the controller’s download function and claimed that they did not receive clear and complete information. The data subject who filed a complaint in Austria was represented by noyb. In response to the complaints, the DPA launched an ex officio investigation on Spotify’s handling of access requests from customers. In 2023, after years of inactivity and an interlocutory ruling from the Stockholm administrative courtThis ruling was purely procedural. It is not to be confused with the ruling of June 2024 from the same court, which reviewed the DPA’s decision and lowered the fine. For more information on the interlocutory ruling and the procedural background of the case, see the comment., the DPA finally issued a decision as the lead supervisory authority. The decision was adopted according to the GDPR’s cooperation procedure and addressed both the complaints and the broader findings of the DPA’s investigation. With regards to the controller’s general practices for handling access requests, the DPA found systematic violations of the right of access. Some of the information in the controller’s responses was incomplete, while other information was complete but unclear, as it was provided in the form of technical log files and without a sufficiently clear explanationThe Court upheld the DPA's reasoning on this point. For more details, please refer to the summary for the DPA's decision.. On these grounds, the DPA held that the controller violated violating Articles 15(1)(a)-(d) and (g), 15(2), and 12(1) GDPR. The DPA issued a 58,000,000 SEK (approximately €5,000,000) fine. With regards to the complaints,
Data subject versus Credit Agency
In October 2018, a data subject requested access under Article 15 GDPR from a credit information company (the controller, later merged into another entity). The controller provided a three-page response, listing basic personal data, addresses, financial details, and references to sources. It also denied conducting automated decision-making within the meaning of Article 22 GDPR. The data subject lodged a complaint with the DPA in December 2018, claiming the access was incomplete and failed to explain how data were linked to processing purposes, recipients, or legal bases. They also argued that automated decision-making and profiling (credit scoring) were taking place, contrary to the controller’s denial. The DPA failed to decide within the statutory time limit, leading the data subject to file an inactivity complaint. The case was then transferred to the Federal Administrative Court (BVwG). The Court stayed proceedings until the CJEU issued its preliminary ruling in case C-203/22 (Dun & Bradstreet). Following the preliminary ruling, the controller argued that it provided sufficient information to the data subject, as the CJEU had concluded that a controller did not need to provide a mathematical formula (algorithm) or a detailed description of each step of the automated decision-making process. In the case that the Court concluded it needed to provide further information, the controller argued that this would involve disclosing trade secrets. The Court partly upheld the complaint. It found that the controller had violated Article 15(1)(a) GDPR by failing to provide sufficiently specific information about the purposes of processing. According to the Court, the controller had provided information on the purposes that was too vague. Specifically, statements such as “improving user-friendliness” or “marketing purposes” did not meet the requirements under Article 15, 5(1)(b) or Article 12(1) GDPR. The Court stated that the controller had not clarified what data was us