GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Data Subject versus Telecommunications Company
In 2021, the data subject concluded a postpaid telecommunications contract with a telecommunications provider (controller), which included a discounted purchase of an expensive mobile phone . The controller transferred the data regarding the registration of the data subjects’ mobile phone contract to SCHUFA, a German credit reference agency. The data are considered “positive data” (i.e. non-adverse contractual information). In September 2023, the contract was terminated. In October 2023, SCHUFA deleted the data about the data subject. The data subject brought legal proceedings against the controller before the court of first instance. They argued that the controller transmitted his data unlawfully as the transmission had occurred without their explicit consent and did not qualify for any other lawful basis under Article 6 GDPR. They also asserted that the controller had not adequately informed them of the transmission. The data subject requested the following relief from the court: a. Non-material damages due to the transfer of their contract data to SCHUFA. b. An injunction preventing future transmission of positive data to SCHUFA. c. A declaratory finding of liability for damages under Article 82 GDPR. d. Reimbursement of legal expenses under GDPR as immaterial damages. They also sought to refer the matter to the CJEU for clarification. The court of first instance rejected the data subject’s claim. In 2024, the data subject appealed the decision before the court of appeal (Oberlandesgericht Koblenz-OLG Koblenz). The court ruled the claim to be wholly unfounded. First, the court decided that the controller lawfully transmitted the data subject’s data to SCHUFA. The controller pursued the legitimate interest of fraud prevention and ensuring creditworthiness assessments (Article 6(1)(f) GDPR), serving the socio-economic interests of the telecommunications industry. More specifically, the court stated that the rights of the data subject at this case ‘
Court case Az. 8 AZR 209/21
The data subject is an employee of the controller, a Germany-based company, belonging to an international Group whose parent company is based in the US. In 2017, the Group introduced a new cloud-based HR software for testing, as a new uniform personnel information management system throughout the group. The provisional agreement for the new software stipulated that its use for personnel administration during the test period was prohibited and that and only certain personal data could be used at that point like surname, first name, date of joining the Group, place of work, business telephone number. Contrary to the agreement, the controller uploaded the data subject’s, salary information, private residential address, date of birth, marital status, social security number, nationality and his tax ID to the Group’s cloud which were processed there till 2019. The data subject filed a case before the Labour Court claiming that the processing of real personal data was not necessary for testing purposes but rather so-called dummy test data was sufficient for the test phase. In any case, the controller processed data beyond what was permitted in the agreement. He claimed compensation in non material damages in the amount of €3,000. The Labour Court (ArbG Ulm) dismissed the action and the Regional Labor Court (LAG Baden-Württemberg) dismissed the data subject’s appeal. In 2022, the data subject further appealed this judgement before the Federal Labour Court. The Federal Labour Court, requested a preliminary ruling from the CJEU on legal questions concerning the interpretation of Article 88(1) GDPR in connection with agreements for the purposes of employment pursuant to the Federal Data Protection Act (BDSG) Section 26 para. 4 Federal Data Protection Act (BDSG). The CJEU ([https://curia.europa.eu/juris/liste.jsf?language=de&jur=C,T,F&num=C-65/23 C-65/23]) stated that that national rules adopted for the processing of personal data in the employment context must comply
Court case 4 U 120/24 e
A telecom provider (the controller) concluded a contract with a customer (the data subject). Afterwards, the controller forwarded the subject’s data to the credit information agency SCHUFA Holding AG. The disclosure of the data were base on the controller’s interest in preventing fraud. The data subject brought an action with the Regional Court of Würzburg. He claimed that the disclosure of his data was unlawful. So, he required compensation for non-material damages under Article 82 GDPR, injunctive relief, and a declaration that the controller would be liable for all future material and non-material damages caused by the disclosure. The Regional Court of Würzburg dismissed the requests. The data subject then appealed the ruling with the Higher Regional Court of Bamberg. The Court dismissed the request and held that the controller lawfully disclosed the data to Schufa. In its analysis of the controller’s legitimate interest, the Court referred to the three requirements laid out by the case law of the Court of JusticeCJEU, Case C-252/21, Meta Platform and Others, 4 August 2023, margins 105 and following (available [https://curia.europa.eu/juris/document/document.jsf?text=&docid=276478&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=60751 here]). and held that they were fulfilled in the case at hand. First, the Court held that the controller had a real and legitimate interest in avoiding fraud. In this regard, the Court pointed out that many individuals conclude a large number of phone plans in a short time, without paying for those plans, in order to keep the phones that come with them. Credit information agencies such as the controller can help telecom providers avoid such frauds. Furthermore, the Court pointed out that Recital 47 GDPR lists fraud prevention as an example of a legitimate interest of the data controller. Then, the Court held that the processing of the data was necessary to prevent fraud. In the Court’s view, it was not apparent that less
Court case W171 2298465-1
On 10 November 2023, an ambulance service (the controller) transported a patient (the data subject) during a medical emergency. In the course of this operation, the controller collected personal data through the data subject's e-card. This included the data subject’s name and address. The stated purpose for this initial data collection was to provide emergency services. On 11 December 2023, the controller sent a postal donation request to the data subject for paramedic training, referencing the prior emergency transport. On 26 December 2023, the data subject filed a complaint with the DPA. They argued that the data used included health data within the meaning of Article 4(15) GDPR, meaning the controller could not rely on legitimate interests (Article 6(1)(f) GDPR) to further process the data. Moreover, the processing for direct marketing without consent violated the GDPR and their right to confidentiality of their personal data. In a response dated 13 March 2024, the controller argued that the change of purpose was permissible under Article 6(4) GDPR. The further processing complied with Article 14 GDPR because said change was noted in the footer of the donation letter. Furthermore, the controller contended that no special category data (Article 9 GDPR) was processed. On 1 July 2024, the DPA upheld the complaint. It found that the further processing of the data subject’s information for the purpose of sending a donation request violated their right to confidentiality under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597 National data protection law (DSG)] and was unlawful under the GDPR. Strikingly, the DPA found that the data constituted personal data under Article 4(1) GDPR and also as health data under Article 4(15) GDPR. None of the exemptions under Article 9(2) GDPR applied, rendering the further processing unlawful under Article 9(1) GDPR. Even if the data in question had not qualified as health data, the DPA fou
Court case III OSK 5037/21
In March 2020, the Ombudsman requested the DPA to initiate proceedings regarding several laws that introduced an obligation for judges and prosecutors to declare their membership in an association, which would then be included in a Public Information Bulletin. The declarations of membership included associations to churches, religions, political parties, and functions similar to trade unions. The Ombudsman argued that the law was unconstitutional. In addition, the Ombudsman requested that the DPA issue an order restricting the processing of this data, specifically to prohibit the publication in the bulletin until proceedings were complete. The DPA dismissed the case in April 2020. The DPA stated that Article 6(1) GDPR provided a legal basis for the processing based on a legal obligation (Article 6(1)(c) GDPR) and necessity for the public interest (Article 6(1)(e) GDPR). Finally, the DPA stated that it did not have the competence under Article 57 GDPR to decide on the issue of constitutionality; this was a matter the Ombudsman should have taken to the Constitutional Court. The Ombudsman appealed the decision to the Court of First Instance, arguing that the DPA should have also considered whether the law fulfilled the requirements of public interest and proportionality under Article 6(3) GDPR. The Court upheld the reasoning of the DPA, stating that law has a legal basis in accordance with the GDPR. According to the Court, GDPR does not give the DPA broader powers, since the this was not foreseen by the EU legislator or provided by national law. The Ombudsman appealed the case to the Provincial Administrative Court, who dismissed the case. The Ombudsman requested the Court to reconsider, or alternatively, the Supreme Administrative Court. In addition, the Ombudsman requested the Supreme Administrative Court to refer a preliminary question to the EU Court of Justice (CJEU). The Provincial Administrative Court referred the case to the Supreme Administrative Court. I
Croatian Pensions Institute
An employee of the Croatian Pension Institute (controller) provided an employer with information about the work history and potential pension size of one of their employees (data subject) without the data subject’s knowledge or consent. The employer then used this information to pressure the data subject into retirement in order to avoid formal termination procedures and the paying of required severance payments. The data subject suffered extreme emotional distress due to fear of loss of her livelihood and took sick leave. The data subject later had to find alternative employment. The data subject brought a claim for non-material damage against the controller for the emotional distress caused by the alleged improper disclosure of her personal data. During the trial before the Kutina Munuicipal Court, the controller argued that the data subject could not show evidence of damage and that, in any event, the personal data in question was not sensitive and would be known to any employer. The Court rejected the controller’s contention that the personal data in question was not sensitive. In doing so, the Court accepted that a data breach had occurred, as there was no lawful basis for the disclosure. Accordingly, the Court found that the controller had violated Article 6 & 24 GDPR. The Court accepted that the emotional damage suffered by the data subject warranted the awarding of monetary compensation and ordered the controller to pay the data subject €1,500.
Court case Us I-2208/2024-6
A controller brought an action before the Administrative Court of Zagreb seeking annulment of a decision made by the Agencija za zaštitu osobnih podataka (Croatian DPA) where they were fined €2,500. The contested decision had found that controller had infringed Article 13 GDPR by using CCTV in and outside of their premises, a kebab shop, with signage only being visible upon entering the store. It was also found that an outdoor terrace had no signage at all. The controller argued that the fine amount was excessive and requests annulment of the decision and its adoption without the fine. The controller further agued that in relation to the outdoor terrace, this area is only accessible through the shopping centre where there are existing signs highlighting that CCTV is in operation. The controller contended that a warning under Article 58(2)(1) GDPR in lieu of a fine would have been more appropriate in the circumstance. The DPA argued that the decision was taking lawfully and based on a correct application of the law. The DPA noted that the small notices were not visible to data subjects before entering the recording perimeter and the notice published on the controller’s website was insufficient and did not include the contact details of the controller. The DPA further submitted that they were obliged to impose and administrative fine in the circumstances as a more lenient sanction in this case was not provided for under the law. The Court firstly highlighted an inconsistency in the contested decision. The DPA had at one point highlighted the existence of CCTV in the outdoor terrace, but further on in the decision, failed to include this area in the list of areas covered by CCTV. The Court further noted that although the decision found an infringement of Article 13 GDPR on the part of the controller, there were no reasons for this provided in the decision. The Court was further critical of the lack of clarity in the DPA’s decision as to the existence or the absence o
Court case UTR 24/4233
The data subjects held health insurance with a provider. After failing to meet their payments and incurring medical expenses, a civil claim was initiated between the data subjects and their insurance provider. During the course of the proceedings, third-party stakeholders were allowed to submit financial and medical documents for consideration by the court which concerned the data subjects. On June 1st 2023, the data subjects filed a complaint with the AP (Dutch DPA), alleging that the third parties were wrongfully allowed to provide the documents in the civil proceedings. The DPA assessed the data subject’s complaint but did not conduct a full investigation, claiming firstly that the complaint was not a GDPR issue, and secondly, that the DPA cannot act sufficiently effectively to resolve the dispute. After the data subject’s objection, the DPA examined the complaint. The DPA assessed the necessity of inclusion of the medical and financial documents by the third party and found that there existed a legitimate interest. In September 2023, the DPA rejected the data subject’s claims that the processing of these files was prohibited on the grounds of Article 9 GDPR, noting that the processing was necessary for the substantiation of a legal claim. The data subjects appealed this decision to the District Court of Central Netherlands. In their appeal, they sought that the DPA’s decision be overturned and that they be provided compensation for the unlawful use of their personal data. The data subjects claimed that the documents, by their nature, should disallow their inclusion in the court proceedings by the third party. The documents reveal the medical service which the data subject’s have used and also reveal the specific medication taken by one of them. The Public Prosecutor issued their advice to the Supreme Court. The Public Prosecutor advised that the third parties did hold a legitimate interest for the inclusion of the documents in the civil proceedings. The Public Prosecutor noted that these documents were necessary in order to establish which claims were still open, and which payments still had to be made. The Public Prosecutor found that the DPA had correctly found that this personal data could be processed by the third parties as it was required for the exercise and substantiation of a legal claim. After finding that the DPA had not erred in their decision, the Public Prosecutor accordingly recommended that the Supreme Court rule that the data subjects are not entitled to compensation.
Court case 15 U 249/24
A credit information agency (the controller) stored data regarding three undisputed and settled claims against an individual (the data subject) for a total of about €750. The last of these claims dated to February 2022 and was paid in December of the same year. In November the data subject reached out to the controller and requested the erasure of the claims. The controller only erased the oldest claim and refused to delete the other two, claiming that the retention was justified under the legal basis of its legitimate interest. The two remaining claims were updated with a settlement note. Additionally, creditworthiness scores were calculated based on the claims and were disclosed to a number of third parties: several banks, an energy supply company, and a telecommunications company. The data subject requested the Regional Court of Cologne to order the erasure of the two remaining claims. The data subject also required compensation for immaterial damages. The Regional Court dismissed both request and held that the legitimate interest of the controller justified the retention of the data for three years. The data subject challenged the ruling and claimed that the legitimate interest of the controller did not justify the storage of settled claims for longer than six months. In this regard, the data subject referenced the case law of the EU’s Court of Justice. The controller requested the Court to dismiss the appeal. It argued again that it had a legitimate interest in storing the data, based on empirical analyses showing a correlation between an individual’s paid debts and their risk for insolvency. The controller also argued that the retention complied with a relevant code of conduct drafted by the Association of credit information agencies and approved by the Hessian DPA. The Court reversed the first instance ruling: it held that the storage of the data was unlawful and awarded non-material damages. On the lawfulness of the data storage The Court held that the controller stored the claims unlawfully. This finding was based on both national law and the case law of the Court of Justice. First, the Court referred to the SCHUFA HoldingJoint cases C-26/22 and C‑64/22, SCHUFA Holding and Others, 7 December, 2023 (available here) ruling of the EU Court of Justice and held that the controller could not store information about the data subject’s debts for any longer than the law allowed for this information to be stored in public databases. Then, the Court observed that under the Civil Procedure Code§§ 882e Abs. 3 Nr. 1., debts must be erased from the public insolvency registry as there is proof that they have been paid. On these bases, the Court held that the storage of paid debts fails to balance the interest of the controller with that of the data subject. Therefore, the Court held that the processing could not be based on the controller’s legitimate and was ultimately unlawful. With regards to lawfulness, the Court also held that the code of conduct invoked by the controller, could not be taken into account for the purpose of assessing the balancing of legitimate interest. On damages The Court partly upheld the data subject’s claim for damage. In this regard, the Court held that the controller damaged the data subject’s reputation by providing third parties with credit scores based on the data. The Court valued this damage €500. The Court clarified that this damage was a direct consequence of the disclosure of the data to third parties, regardless of any further consequences of such disclosures. The Court explicitly left two questions open: whether the unlawful storage of the data constituted a loss of control for the data subject over their data, and whether the storage itself harmed the data subject’s reputation. The Court held that the questions were irrelevant because, in the case at hand, the data were disclosed and the disclosure caused reputational damage. The Court rejected the data subject’s damages claim with regards to the further adverse consequences they suffered from the storage and disclosure of the data. The Court held that such consequences (i.e.: the refusal of certain third parties to conclude a contract with the data subject) occurred at a time when the controller was still entitled to store the data.
City of Espoo
The City of Espoo (controller) had implemented Google Workspace for Education in the primary schools under their remit. The controller relied on Article 6(1)(c) GDPR to do so, believing the measure necessary for compliance with their legal obligation to organise basic education. On 30th December 2021, the Finnish DPA held that Article 6(1)(c) GDPR did not provide a valid lawful basis for the processing in question, and the use of the e-learning platform was not in compliance with the GDPR. The DPA noted that processing based on the ground of legal obligation must explicitly refer to the nature and purpose of the processing. The DPA commented that the Basic Education Act does not refer to the nature of the processing or require the implementation of an e-learning platform, thus leaving the controller with significant discretion in fulfilling their obligation and rendering the use of this provision as a legal obligation inappropriate. During the investigation, the DPA also highlighted the fact that this processing operation involved the collection of large amounts of data (including sensitive data) of children who are vulnerable data subjects, both while they are at home and at school. Also, the amount of data processed was far higher than that which would be processed under a traditional pre-school education arrangement. Additionally, the controller had to accept Google’s standard terms and conditions which limited their ability to control the processing taking place. The DPA therefore concluded that the use of such an e-learning platform cannot be automatically considered necessary and proportionate to allow the controller to justify the processing without having performed a case-by-case assessment in light of their obligation to organise basic education. On 30th June 2023, the Administrative Court rejected the controller’s appeal against the decision. The Court reasoned that the Basic Education Act does not define the means of processing and thus leaves the controller with too much discretion in order to rely on the provision as providing a legal obligation to introduce the system. The Court also noted that the processing was not limited to what was necessary and proportionate for school purposes and the limited discretion that the controller had over the system after agreeing to the platform’s general terms of use. The controller then appealed to the Supreme Administrative Court, requesting that the decision of the Administrative Court and the DPA be annulled and confirmation that they may rely on Article 6(1)(c) for this processing operation. In their submissions, the controller argued that the use of Google Workspace is necessary to comply with both their obligation to provide basic education and also their obligation to equip pupils with computer skills (ICT) available in the public domain. The controller argued that both the DPA and the administrative court have failed to take proper account of this. The controller also called for a more detailed analysis of the different offerings present in the Google Workspace environment by examining each independently deployable application to assess the extent to which the lawful basis may apply. The “all-or-nothing” approach in assessing legitimacy of the system adopted by both the DPA and the administrative court was inappropriate, the controller argued. The DPA requested that the controller’s claims be dismissed. The DPA submitted that the obligation to provide basic education simply could not lead to an obligation to use Google’s educational software, that such a measure is not necessary for the provision of basic education. The DPA further argued that the processing in question is extensive and the controller is unable to exercise control over the pupil’s personal data, nor even to provide an actual explanation of how the processing is conducted, instead relying on service descriptions and contractual terms provided by Google. According to the DPA, the controller has not demonstrated that they have performed a proper assessment of the e-learning system. At the outset, the Court noted that the lawful basis under Article 6(1)(c) must be interpreted strictly as it entails the processing of personal data without the consent of the data subjects. The Court referenced the judgment in C-394/23 Mousse in finding so. The Court also noted that processing under this basis must be based on Union or Member State law meeting an objective of public interest and must be necessary and proportionate to achieve those objectives. The Court then considered whether the Basic Education Act even constitutes a legal obligation of the controller, compliance with which the use of an electronic education platform could be based upon. The Court highlighted that the decisions of both the Administrative Court and DPA concluded that the fulfilment of the obligation under the Basic Education Act could not be seen as requiring the use of an e-learning platform. The Court disagreed with this premise. The Court acknowledged the existence of the controller’s obligation under the Basic Education Act to provide basic education. The Court further referenced the National Board of Education’s objectives as to the content of basic education which stress the importance of technological literacy for pupils. The Court reasoned, therefore, that such an objective must be deemed to require the use of ICT-based learning environments to develop these skills in basic education. The Court concluded that there exists, therefore, a clear and precise legal basis for the processing of personal data necessary for the use of such applications for this purpose. The Court thus found that compliance with the controller’s obligation under the Basic Education Act may provide a basis for the use of an electronic education platform. This differed from the findings of both the DPA and the Administrative Court. As the decisions of the Administrative Court and the DPA were based on an incorrect premise, the Court found them to be incorrect. The Court noted that while the controller’s obligation does not require the use of the Google platform specifically, this does not necessitate a different assessment, as the GDPR obviously never specifies services or products required to be used by name. The Court concluded that the DPA erred in finding that the controller’s obligation under the Basic Education Act could not provide a lawful basis for the use of an online education platform. The Court did not deem it necessary to consider the extent that the specific processing in question could be considered as fulfilling the controller’s legal obligation. The Court also noted that the Google Workspace platform used different types of personal data for different purposes, for example for identifying users, developing applications etc. The applications could also be used independently of each other. The Court found that the fact that the processing of personal data is not necessary for a specific purpose does not necessarily allow the conclusion that the processing is incompatible with the lawful basis under Article 6(1)(c). This differed from the findings of both the DPA and the Administrative Court on this point, and the Court found their reasoning to be wrong. The Court also referenced the DPA’s comments about the different uses of personal data present in the Google Workspace system (for identifying users, for developing services etc.), the sensitivity of the data involved, and the lack of oversight by the controller on the processing. While the Court did confirm that the controller would have to comply with the other provisions of the GDPR as they relate to these points, these issues were irrelevant from the perspective of the lawful basis, upon which the DPA focused. In conclusion, the Court found that neither the DPA nor the Court could have concluded on the basis of the ground advanced that the processing could not be based on Article 6(1)(c) GDPR. The case was remitted back to the DPA for reconsideration.
CJEU case C-710/23 Ministerstvo zdravotnictví
L.H. lodged a request with the Ministry of Health (the controller) for information concerning the identification of persons (the data subjects) who had signed contracts for the purchase of COVID-19 screening tests concluded by the controller, as well as certificates relating to those tests and demonstrating that they may be used on the territory of the EU. The controller partially granted L.H.’s request redacting the forename, surname, signature and position relating to the data subjects who had signed certificates on behalf of the legal persons concerned and, in some cases, the email address, telephone number and website of those legal persons. The reason to justify the redaction was the protection of the personal data of the data subjects referred to in those certificates, in accordance with the requirements of the GDPR. According to the controller, the data subjects operate from China and the United Kingdom, where the legal persons issuing the certificates are registered, and that the domicile of those is unknown to it. It is therefore impossible for the controller to inform and consult them on that subject. Czech case law provides for an obligation to inform or obtain the opinion of data subjects concerned by a disclosure request. L.H. brought an action for annulment of the controller’s decision to disclose only redacted information before the Prague City Court. The court upheld that action, holding that the controller could not refuse, as a matter of principle, to disclose information constituting personal data because it cannot first inform or obtain the opinion of the data subjects. The controller brought an appeal on a point of law against the decision before the Czech Supreme Administrative Court, which is the referring court. In that context, the that court stayed the proceedings referred in essence the following questions to the Court of Justice for a preliminary ruling: # Must Article 4(1) and (2) GDPR be interpreted as meaning that the disclosure
Court case I ZR 223/19
A pharmacist sold non-prescription but pharmacy-only medicine through Amazon requiring customers to enter their name, delivery address and the information necessary for the individualization of the medicines. On the basis of the German Act against Unfair Competition ([https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html Gesetz gegen den unlauteren Wettbewerb – UWG]), a competitor sought an injunction prohibiting the controller from selling pharmacy-only but non-prescription medication through Amazon unless customers could express their consent to the data processing in advance. The competitor alleged that the sale through Amazon was unlawful under the GDPR as it did not ask for the prior consent of the customer’s as required under Article 9(2) GDPR for the processing of sensitive data. The Regional Court granted the claim. The first Court of Appeal dismissed the defendant's appeal. The defendant pursued its motion to dismiss the action with the appeal granted by the Court of Appeal. The BGH stayed the proceedings and referred the case to the CJEU for a preliminary ruling. The CJEU on 4 October 2024 held in C-21/23, Lindenapotheke that information entered by customers when ordering pharmacy-only medical products constitutes health data, even when the products are prescription-free. The Court further found that the GDPR does not preclude national law enabling a controller’s competitors to challenge GDPR infringements in court as prohibited unfair commercial practices. The court implemented the CJEU's decision. Thus, it held, that if a customer orders prescription-only medications via a pharmacist's account on Amazon, health data is collected and processed within the meaning of of the Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG) and Article 9 GDPR. Additionally, the court held, that the processing of order data without express consent pursuant to Article 9(2)(a) GDPR constitutes a violation of a market conduct regulation pursuant to the
Google Ireland Ltd
The plaintiff is a nationwide umbrella organisation of consumer centres in Germany. It is a qualified organisation to bring collective redress actions according to german law. The contoller is Google Ireland Ltd, the provider of Google services in the EEA. To use some of the services provided by the defendant, a ‘Google account’ is required. At the sign up process, after users have first entered personal data to create an account, they must choose between 2 "personalisation settings”, “express personalisation" or "manual personalisation". “Express personalisation" consists of a 1 step page that permits personalised advertising while the "manual personalisation" consist of 5 steps that allow the user to select the personal data they want to share. When users log in to their Google account, after completing the registration process, they have the possibility to modify the duration of data storage and reduce it to 3 months. In June 2022 the plaintiff sent the controller an unsuccessful warning letter, arguing that with this sign up process for a Google account, the controller violated Article 5(1)(a) and Article 6(1)(a) GDPR since there is a lack of a voluntary, transparent and informed consent for a specific purpose. More specifically; a. The user does not have the option to refuse giving consent in the case of "express personalisation" and that the user is also unaware that they have the option of not giving consent if they return to "manual personalisation". b. In the context of "manual personalisation", the use of personal data in the "personalised advertising" area cannot be completely deselected, as the controller processes the user's "general location" for advertising purposes. c. There is no transparent list of the defendant's services for which consent is given and therefore lack of a specific purpose. d. The design of the consent process is confusing and unclear, in particular the use of "personalisation" instead of "consent" to the use of data. The controller claimed that the design of its personalisation settings constitutes voluntary and informed consent. In January 2023 the plaintiff brought an injunctive relief case before the Regional Court of Berlin II (LG Berlin II). The Hamburg Commissioner for Data Protection and Freedom of Information (Hamburg DPA) was heard in the procedure and stated that the consent in not voluntary or informed, highlighting that the "personalisation" does not make it sufficiently clear that it is a consent to data processing, which is a so-called deceptive design pattern. First, the court established that the plaintiff is authorised to conduct the proceedings under german law, (Section 8(3)(3) of the German Unfair Competition Act (UWG) and Section 3(1) of the German Injunctive Relive Act (UKIaG)) and Article 80(2) GDPR. The court held that it is not necessary to prove a specific violation or damage to an individual person. In this respect, it is sufficient that the rights of identifiable persons are potentially affected by the processing. Contrary to the defendant’s opinion, it stated that the power to bring proceedings pursuant to Article 80(2) GDPR for non-mandated non-profit organisations also extends to cross-border data processing and is not limited to national matters, enabling the organisations to assert the rights of natural persons on their behalf in accordance with Article 77 GDPR et seqq. Second, the court ruled that there is no voluntary and informed consent within the meaning of Article 6(1)(a) GDPR. There is a lack of voluntariness due to the lack of possibility to completely refuse consent to data processing in both "personalisation settings” options. An unlawful consent exists because the "express personalisation" only provides the options "confirm" and "return" and it is not possible to reject the consent directly while in "manual personalisation" the controller still uses the user's location in Germany despite of the lack of consent to personalised advertising. Also, the controller does not give users clear and comprehensible information about the scope and purpose of the data processing, violating the principle of transparency (Article 5(1)(a) GDPR). Third, the court found a violation of Article 25(2) GDPR because the controller set a default setting to store personal data for more than three months. The fact that the user can set the data to be deleted after three months means that the controller indicates that such storage period is generally sufficient for the processing carried out and the storage period of more than three months was not necessary. Therefore the retention period is not limited to the absolute minimum necessary. The fact that the storage period can be shortened after consent has been given is irrelevant since Article 25(2) GDPR requires that users do not have to make any changes to the settings in order to achieve the most "data minimising" processing possible. Lastly, the court ordered the controller to pay the plaintiff €242,99 and to cease and desist from any further offenses, subject to a fine of up to €250,000 for each case of infringement, or imprisonment for up to six months.
GPDP
The controller for the case is Azienda Sanitaria Friuli Centrale (ASUFC), a local health authority. In 2020 the local government of Friuli Venezia Giulia issued a resolution that required the controller to carry out a large-scale analysis of Covid-related health risks for the resident population of the region of Friuli (the data subjects). During this analysis, individuals from vulnerable populations (such as the elderly) were assigned a score representing their vulnerability to covid. The results were disclosed to medical practitioners for the purpose of preventive intervention- especially with regards to vaccination priority. The processing was based on health data, including information in the data subjects’ electronic health file. The local government gave precise instructions to the health authority, including the instruction to appoint specific processors. The DPA investigated the processing and held that it was unlawful. Additionally, the DPA held that the controller violated its transparency obligations and failed to carry out a DPIA. On these grounds, the DPA fined the controller €50,000. The decision was later annulled by the civil courtCivil courts are competent to review the DPA’s decisions (see Art. 152 d. lgs. 196/2003). This is an exception to the general rule that administrative decisions are reviewed by administrative courts. (Tribunale di Udine). Contrary to the DPA’s findings, the Court held that the processing was lawful and that a DPIA was not required under the GDPR. The GPDP challenged the civil court’s decision with Italy’s Supreme court (Cassazione). Contrary to the lower court’s findings, the Cassazione held that the controller unlawfully processed sensitive data. In this regard, the Court first noted that Italian law lists different purposes for the processing of health data within the electronic health file. Among those, only the purposes related to individual treatment (i.e.: “prevention, diagnosis, health care, and rehabilitation”) are covered by the data subject’s consent. The Court held that the processing of personal data for the purpose of preventive medicine, did not fall among these purposes and was not covered by consent. Furthermore, such processing was not carried out with a compatible purpose under Article 5(1)(b) GDPR because Italian law requires the pseudonymization of any data from health files when such data are used for research. The controller did not pseudonymized the data in the case at hand. Additionally, the Court held that due to intricacies of Italian administrative lawIn particular, Italy’s so-called “privacy code” (specifically, Articles 2-ter and sexies) specifies the scope of Articles 6 and 9 GDPR by listing the domestic legal sources that controllers can invoke when claiming that they are carrying out a task in the public interest (6(1)(e)) or that their processing of personal data is necessary for reasons of substantial public interest (9(2)(g)). The code was amended in 2021 to include “general administrative acts” (such as the local government’s deliberation in the case at hand) among the legal sources relevant to Articles 6(1)(e) and 9(2)(g) GDPR. The Court concluded, a contrario, that such administrative acts were not covered by Articles 2-ter and sexies in 2020, when the data were processed., the controller could not rely on Articles 6(1)(e) and 9(2)(h) GDPR. Finally, the Court held that Italian law did not sufficiently clarify the safeguards for data subjects, as required by Article 9(2) GDPR under letters (g), (h), and (i). For the reasons above, the Cassazione annulled the civil court's ruling and ordered the court to rule again. The civil court is now bound to the Cassazione's findings on the law.
Panoptes Sweden AB
Panoptes Sweden AB ("Panoptes") is a news agency, which engages engages in the collection, processing, analysis and presentation of information, including personal data. Panoptes sells the personal data to its customers (e.g. newspapers, magazines and broadcasters). In the course of its business, Panoptes requested the Swedish Court of Appeal to disclose to them a large number of documents related to different people's criminal convictions, to then use them in their capacity as a news agency. In response to this request, the Court of Appeal required Panoptes to guarantee that the requested documents would will be used for journalistic purposes and that the personal identity numbers, names and addresses of individuals will not be made available to the public or paying customers. Panoptes filed an appeal against that response of the Court of Appeal to the Supreme Court. The Court established that the question to be answered was whether the information requested by Panoptes was confidential and, if so, whether its disclosure could be subject to reservation. This matter concerns the relationship between [https://www.government.se/contentassets/2ca7601373824c8395fc1f38516e6e03/public-access-to-information-and-secrecy.pdf Chapter 21.7 of the Swedish Public Access to Information and Secrecy Act] (hereinafter: the Act) and the GDPR. Background considerations [https://www.government.se/contentassets/467ef1335aac404c8840c29f9d02305a/act-containing-supplementary-provisions-to-the-eu-general-data-protection-regulation-sfs-2018218/ Section 7(1) of Chapter 1 of the Swedish Data Protection Act] provides that, in data disclosures covered by the Act, there is no need to comply with the GDPR. In fact, requiring GDPR compliance would restrict the authorities' obligations to disclose personal data. The Court however recognizes that, when applying national law, EU law must be respected. Such an obligation stems from Article 85 GDPR and Article 86 GDPR, requiring to balance freedom o
Court case 24/02161
The data subject applied for a credit card in 2008 and was granted it. In July 2020, the bank (controller) requested that the data subject identify themselves online by providing a copy of their ID and a digital selfie. A bank employee would then compare the two images and approve it. The data subject was informed that this was necessary to comply with the provisions of the Fourth Anti-Money Laundering Directive (AMLD) and failure to do this would result in their card being terminated. In late July and early August, the controller contacted the data subject, again requesting that they verify their identity through the online portal. On 17 August 2020, the data subject was informed that their credit card agreement would be cancelled in November 2020, unless they verified their identity before then. In September 2020, the data subject sued the controller in the Subdistrict Court of Amsterdam, which declared some of her claims as inadmissible and dismissed others. In August 2021, the data subject appealed to the Amsterdam Court of Appeal. The data subject sought, inter alia, the restoration of their credit card, the payment of compensation, and a declaration that the bank’s proposed method of identification is unlawful. In March 2024, the Amsterdam Court of Appeal upheld the decision of the lower Court. The data subject then appealed to the Supreme Court. The data subject argued that the processing of biometric data in the identity verification procedure is unlawful under Article 9(1) GDPR and that the appellate court had erred in finding that the controller could retain copies of their ID after the verification had been performed. The Parket opined that the verification of the data subject’s identity in this method did not constitute biometric processing, falling under Article 9 GDPR. The Parket reasoned that the identification of the individual in this process is performed by an employee of the controller, not by software. The processing operation was therefor
The data subject is a user of the platform www.facebook.com provided by Facebook (now Meta), the controller. Facebook uses personalised advertising that is tailored to the online behaviour of network users. When the GDPR came into force, Facebook initially processed personal data for the placement of personalised advertising under the legal basis of Article 6(1)(b) GDPR, performance of a contract. From April 2023, Facebook changed the legal basis to Article 6(1)(f) GDPR, legitimate interest. Since November 2023, Facebook started implementing the pay or ok model, where users could choose to either consent to the use of their data for personalised advertising on its platforms or pay a subscription fee to prevent the processing. The data subject consented to the processing of his personal data for targeted advertising. In January 2024, the data subject demanded out-of-court compensation and deletion or restriction of his personal data due to unlawful processing of his personal data but he received no answer. The data subject filed a case before the Munich District Court (Amtsgericht München - AG München) claiming that Facebook processed his personal data unlawfully, in violation of Article 5(1)(a) GDPR because the processing was not necessary for the performance of the contract or to protect legitimate interests and he did not consent to the processing before November 2023. The data subject claimed that he was entitled to immaterial damages in the amount of €1,000 because receiving targeted advertising was unpleasant and frightening to him. He further demanded that Facebook would provide him with his personal data regarding his online behaviour collected before he consented to the processing in 2023, delete the data if it is processed exclusively for advertising purposes and restrict processing to purposes other than advertising, insofar as the data are necessary for platform use. First, the court held that the data subject had no claim against Facebook for non-material damages under Article 82(1) GDPR because he did not present and prove concrete damage. It stated that the mere infringement of the provisions of the GDPR is not sufficient to justify a claim for damages. The court held that the impairments presented by the data subject were not sufficient to justify a claim for damages for pain and suffering. Second, insofar as the data subject requests Facebook to delete the data that is processed exclusively for advertising purposes, this is precluded by the fact that the Facebook can and does process the personal data that it has used for the placement of personalised advertising for other permissible purposes. Data that is processed solely for advertising purposes therefore does not remain with Facebook. Third, the requested restriction of the use of personal data to processing purposes other than advertising purposes is precluded by the data subject’s consent to further use, as the data subject has thus also consented to the continued use of the information from his account. Consequently, the court ruled that the case was unfounded.
Court case 13 U 11/24
The case concerns the transmission of a data subject's personal data by Barclays bank (the controller) to a credit rating agency (Schufa). The controller had wrongly notified Schufa about a financial claim of €4,405 existing against the data subject which in fact did not exist. After that, a different bank cancelled the data subject’s private overdraft facility forcing it to refinance €18,000 at short notice. The court of first instance had granted material damages for the additional interest the data subject had to pay for the refinancing credit, however the main subject of the appeal was non-material damages. The court found, that the controller had violated its obligations under Articles 5 and 6 GDPR by notifying Schufa about a claim that does not actually exist against the data subject. It also found, that in line with BGH, VI ZR 10/24 the notification constituted a loss of control which put the data subject into a bad light in itself constituting a non-material damage. Moreover, the court held, that the transmission inflicted an organisational burden by forcing the data subject to quickly refinance a substantial amount of money after the cancellation of the overdraft facility based on the negative entry and to pursue the clearing of such entry. The court found the amount of €2,500 appropriate to compensate those damages pursuant to Article 82 GDPR, taking account in particular the sensitive nature of wrong debt notifications. Those, the court held, could seriously damage the economic capacity of the data subject and forced the data subject to disclose its financial situation to new potential creditors.
Court case 3 U 145/24
The data subject is seeking compensation for a so-called scraping incident on the "F." platform operated by the controller. The scraping incident referred to the collection of personal data from the contact import tool by a third party. The controller does not rely on the data subject's valid consent in accordance with Article 6(1)(a) GDPR but claims that its specified setting of searchability to "all" is justified under Article 6(1)(b) GDPR because it was necessary to enable users to contact and network with each other. The data subject requested - inter alia - non-material damages and injunctions prohibiting further disclosure of personal data to third parties and processing of its phone number. For a more detailed account of the facts see BGH VI ZR 10/24. = The court found that by setting the default setting for the findability of a user profile based on the telephone number to "all", the controller violated its obligation under Article 5(1)(c) GDPR and 25(2) GDPR to take appropriate technical and organizational measures that ensure that personal data is not made accessible to an indefinite number of persons by default without the data subject's intervention. The court found that the default setting was not necessary under Article 6(1)(b) GDPR as it could be changed without significant impairment of the service's usability. In line with BGH VI ZR 10/24 the court found the loss of control following directly from the scraping incident in itself constituted compensable damage caused by the controller's GDPR violations, without it being necessary to prove additional noticeable negative consequences. The court positioned itself in an ongoing debate about the degree of control that the data subject had to have before a GDPR violation as for that to constitute a "loss" of control (cf. OLG Hamm - I-25 U 25/24). The court argued, that even if the data subject had previously disclosed its phone number to third parties and was unable to guarantee that it will always b
EDPB
In 2018 three data subjects, from Belgium, Germany and Austria respectively filed complaints with the DPAs in their home countries. The data subjects were represented by noyb - European Center for Digital Rights. The complaints were filed against Facebook Ireland Ltd and WhatsApp Ireland Ltd (the controllers, both now Meta) regarding alleged illegal processing of data, including special categories of data. The alleged infringements pertained to the processing activities on the services Facebook, Instagram and WhatsApp. Given the cross-border nature of the processing and the establishment of Meta in Ireland, the Irish DPA (DPC) was the lead DPA responsible for handling those complaints, Article 56(1) GDPR. Following the DPC's three investigations, it submitted to the other concerned DPAs three draft decisions pursuant to Article 60(3) GDPR. In these draft decisions, the DPC considered, inter alia, that the data subjects had failed to demonstrate that the controllers could not rely on Article 6(1)(b) GDPR. Several of the other concerned DPAs objected to the DPC’s assessments and after failing to reach a consensus between the DPAs, the DPC submitted the matter to the EDPB according to the consistency mechanism established in Article 60(4) GDPR. The EDPB adopted Binding Decisions 3/2022, 4/2022 and 5/2022 on 5 December 2022 under Article 65(1)(a) GDPR. Finding most of the objections to the DPC’s draft decisions were relevant and reasoned, within the meaning of Article 4(24) GDPR the EDPB did not follow the DPC's analysis that the controllers could, a priori, rely on Article 6(1)(b) GDPR. Therefore, it demanded that the DPC exclude from its final decisions the finding that it was not necessary to have the users’ consent for the data processing carried out. By contrast the EDPB required the DPC to find in its three final decisions certain infringements GDPR, in particular of Article 6(1) GDPR, and to adopt corrective measures in respect of the controllers. Furthermore the EDPB found the scope of the investigation and analyses by the DPC excessively narrow. Thus, the EDPB instructed the DPC firstly to carry out a new investigation in order to determine, whether the processing operations carried out by the controllers in the context of its Facebook, Instagram and WhatsApp sevices relate to special categories of personal data, within the meaning of Article 9 GDPR. The DPC must also assess whether the processing is used for targeted advertising, marketing or otherwise for the purpose of improving the service, and if WhatsApp complies in that regard with the GDPR obligations. Secondly the EDPB ordered the DPC to issue a new draft decision under Article 60(3) GDPR. The DPC disputed the EDPB’s power to impose such measures, alleging that the EDPB exceeded the competence conferred on it by Article 65(1)(a) GDPR because primarily this provision cannot be interpreted to permit Binding Decisions regarding the scope of a lead DPA's investigation and decision. = The court found the DPC's challenge admissable, arguing that the DPC could just seek the annulment of the binding decisions. It therefore dismissed the EDPB's argument, that because the DPC only disputed the EDPB's instructions not the DPAs objections as being relevant and reasoned within the meaning of Article 4(24) GDPR its competence could not be questioned following Article 65(1)(a) GDPR. The court held, that the classification of the objections only constitutes the grounds of a legal act and are not in themselves capable of forming the subject of an action for annulment, as they do not produce legal effects. Therefore it was sufficient, the court held, that the DPC expressly disputes the EDPB’s interpretation of Article 4(24) GDPR concerning the concept of ‘relevant and reasoned objection’ without formally seeking their "annulment". The court also affirmed the DPC's interest in having the contested instructions annulled. Although the DPC did not dispute its obligation to reassess whether Meta needs the consent of users and reexamine the case, the court held, that this does not in itself imply the EDPB's power to impose such measures by binding decision = The court held, that the wording of Article 65(1)(a) GDPR, Article 65(6) GDPR and Article 4(24) GDPR and Recitals 126 and 136 GDPR does not limit the scope of an EDPB binding decision regarding objections to the considerations set out in the draft decision. Consequently, if it appears that the case file is insufficient for the purpose of carrying out the required analysis in full, the EDPB must be able to require the lead DPA to undertake further investigation. The court held, that Article 65(6) GDPR - which requires final decisions to refer to the lead DPA's decision - does not defines the the scope or the legal effect of a binding decision on the basis of Article 65(1)(a) GDPR; this provision only specifies the rules for the adoption of final decisions of the competent DPAs where those decisions may be adopted immediately on the basis of an EDPB binding decision. This, the court stated cannot be invalidated by the wording of Recitals 126 and 136 GDPR as they relate purely to procedural matters. The court held, that the scope of the investigation is not a procedural matter as it relates to the substance of the case, since it determines what must be examined in order to assess whether the processing at issue complies with the GDPR. The court also dismissed the DPC's argument that this interpretation enables the EDPB to completely direct the lead DPA whenever a question raised by a DPA concerned is classified as a relevant and reasoned objection. The court stated, that such objections may only relate to questions of substantial GDPR compliance not to the conduct of the investigation itself (as opposed to the scope of the investigation). The court held, that contrary to the DPC's contextual argument, that the short deadlines provided in Article 60(5) and (6) GDPR suggest that a revised draft decision cannot include major amendments. The court found, that these Articles cannot be applied where a new investigation is needed but only where the draft decision can immediately be amended. Additionally, the court stated, that the cooperation procedure between DPAs, described in Article 60 GDPR cannot be seen as a ‘one-way’ procedure in which the stages always follow in the order of the provisions providing for them. The court also dismissed the DPC's argument that read in the light of Recital 141 GDPR, Article 57(1)(f) GDPR demonstrates that the scope of the investigation following a complaint is within the discretion of the national DPA subject only to national judicial review. The court held, that the EDPB's review powers do not undermine the DPA's task to handle complaints and the possibility of judicial review of interim DPA decision by national courts does not prevent the draft decision of the lead DPA from itself being subject to review by the EDPB. The DPC submits that recognising the EDPB's power to direct a lead DPA to issue a new draft decision and broaden the scope of its investigation beforehand is not consistent with the purpose of the ‘one-stop-shop’ mechanism. However, the court rebuts this argument, by holding that procedural simplification cannot take precedence over the essential objective of the GDPR to ensure the protection of personal data. Furthermore, the negative effects of more complicated procedures for the persons concerned could be avoided if the lead DPA carries out an appropriate investigation and analysis from the outset. Insofar as the DPC argues referring to Article 58(4) and Recital 141 GDPR that disagreement between DPAs is to be resolved through judicial review in the national courts, the court held, that this cannot mean that persistent disagreements between the DPAs cannot be resolved within the EDPB, as the GDPR establishes the framework of the cooperation mechanism between DPAs exactly for that purpose. = The court held that the EDPB's power is exercised only in the event of a clearly identified shortcoming by the lead DPA and that that power results from the collective assessment of the DPAs comprising the EDPB. The court held that following the above analysis of Article 65 GDPR there is no doubt that the EDPB has the contested competence and therefore that it is expressly provided for by the legislature. While the court agreed, with the DPC that the exercise of the EDPB’s power is subject to judicial review it maintained its own ability to examine the legality of the very substance of the binding decisions giving instructions to the DPAs based on the EU legislature's decision that persistent disagreements between DPAs should be arbitrated in the context of the consistency mechanism within the EDPB. The court also stated, that an EDPB binding decision does not call into question a DPA's ability to prioritise the performance of its various tasks as an independent authority - which is for the national court alone to review - as it only provides binding decisions in exceptional cases. Therefore, the court found, that contrary to the DPC's assesment, the EDPB's powers are in line with the ‘Meroni doctrine’, stating that the principles of EU law require powers to be precisely delineated and amenable to judicial review.