GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
Prolegia Research AB
A company Prolegia Research AB has request to take part in records in a criminal case by the constitutional right to access public records in sweden. The company is sericeprovider in are like background checks and consultancy in recruitment. The company has during the process to get access applied for a voluntary certificate of publication that give the entity the same constituinal cover as pappers and TV by the constutition. The company has calmes that the by the voluntary certificate of publication is useing the data in the records for prupes of journalism and by that not is obligated to enforce the GDPR. The question in the case are if the EU-law by GDPR are to be enforced before the swedish constition and if the the company are processing with the records are for journalism purpes or more for a bussiness purpes. The DPA has in a memorandum, IMYRS 2022:2 sayed following as a summery. According to Article 85 of the Data Protection Regulation, Member States are obliged to national legislation the right to protection of personal integrity and the right to freedom of expression and information. In Sweden, this has taken place through the regulation in ch. 1. Section 7 of the law (2018:218) with provisions adapting to the EU's data protection regulation (data protection act). The first paragraph of the section states that personal data processing that is covered by the constitutional protection in the Freedom of the Press Ordinance (TF) and the freedom of expression fundamental law (YGL) are exempted from the requirements and the data protection regulation if the application of the regulation would come into conflict with the constitutions. In c h. 1 Section 7, second paragraph, exceptions are made with regard to opinion and freedom of information. The exception covers treatments that take place for journalistic purposes purposes or for academic, artistic or literary creation. If the exception is applicable, most provisions of the data protection regulation do no
OC
This is an appeal of the earlier case [https://gdprhub.eu/index.php?title=CJEU_-_T%E2%80%91384/20_-_OC_v_European_Commission T‑384/20 - OC v European Commission.] The claimant (OC) appealed the general court’s decision on three grounds. That the General Court had legally misinterpreted the definition of personal data and had failed to observe proper administrative procedures when making its judgement (right to a presumption of innocence and the right to good administration under the Charter of Fundamental Rights). On the concept of personal data, the claimant argued that the general court had legally misinterpreted the concept of an ‘identifiable natural person’. They used two points to make this argument: 1) Identifiability is not tied to whether an “average reader” can identify you. The case law states that identifiability depends on whether an individual holds ‘additional factors...necessary for identification... [these factors] can be available to a person other than the controller’ (see C-582/14 at para 39 and 41). The General Court’s use of an average reader does not analyse the factors that the specific reader in the case holds. Thus, contrary to the case law, it does not test whether a person has the additional factors needed for identification. The General Court’s novel use of this test was therefore erroneous. 2) The General Court had erred in arguing that the ‘means reasonably likely’ to be used to identify a data subject (recital 26 GDPR and recital 16 EUDPR) was limited. Rather, the court should have looked at the costs and time required for the identification of the claimant to determine whether the claimant could be identified using ‘reasonable means’. This would be in line with what recital 25 GDPR actually states. The Court held that the General Court had made several errors of law and that the first ground of appeal must be upheld. First, the Court noted that the EUDPR (Regulation 2018/1725) - the piece of legislation applicable at the case at issue - and the GDPR share the same definition of personal data. Given that the legislator (at recital 4 and 5 of 2018/1725) intended to establish an equivalent law to the GDPR, both regimes must be read in the same way. Second, identifiability is defined by Article 3(1) 2018/1725 (Article 4(1) GDPR). The use of the word ‘indirectly’ in these Articles means that it is not necessary for information alone to be the factor that identifies someone. It is not required that all the information enabling the identification be in the hand of one person. The fact that additional information is necessary to identify a data subject does not mean that the data cannot be classified a personal. Third, it is ‘reasonably likely’ that combining OLAF’s press report with additional information would be used as a way to identify the claimant. The General Court had been wrong to limit this ‘reasonable means’ test by confusing it with liability. Article 3(1) 2018/1725 states that only acts attributable to an EU Institution can give rise to liability on part of the European Union. However, the court took this to mean that the identification of the claimant must only have resulted from the press release alone. The Court made clear that liability and identification are separate. The fact that additional information is needed and that it comes from a source other than the controller does not rule out the identifiable nature of the claimant and thus, the personal nature of the data. This is supported by the fact that recital 16 (recital 26 GDPR) makes specific that identification can come from ‘any other person’. Fourth, the Court rejected the General Court’s invention of an ‘average reader’. The General Court had invented this test and used it for the first time in [https://gdprhub.eu/index.php?title=CJEU_-_T%E2%80%91384/20_-_OC_v_European_Commission T‑384/20 - OC v European Commission]. The fact that the reader of the press release is a journalist, cannot lead to the conclusion that data is not personal. Last, the Court looked at the facts of the case and determined that the fact that the press release contained the claimant’s gender, nationality, father’s occupation, grant amount for a scientific project and the geographical location of the entity hosting that project, would together allow the Claimant to be identifiable. Furthermore, the Court applied the ‘reasonable means’ test and determined that identification could occur without a disproportionate effort in terms of time, cost and labour. There is no obligation on the claimant to prove that they had actually been identified by the time of the case as no such condition is contained in Article 3(1) 2018/1725 (Article 4(1) GDPR). It follows that the General Court erred in finding that the claimant was not identifiable and that therefore, the data was not personal. The court also upheld the second ground of appeal (presumption of innocence) and partially upheld the third ground of appeal (right to good administration). The Court sent the case back to the General Court to be decided again.
Court case 473254
A data subject lodged a complaint to the French DPA (“CNIL”) regarding workplace video surveillance on the controller’s premises. The CNIL led an investigation on 21 June 2022. During said investigation, the person in charge of the premises did not object to the investigation, however the manager then instructed the person in charge of the premises not to sign the inspection report, and did not respond to phone calls and messages sent to him by the agents of the CNIL. The controller did not reply to requests for information and documents, nor to reminders sent by the DPA. On 2 December 2022, the CNIL sent a report proposing to impose an administrative fine and an injunction to provide the information requested, to which no response was received. In a letter dated 22 December 2022, the controller’s lawyer submitted observations and communicated only part of the information and documents requested. The CNIL imposed a €10,000 fine on 8 February 2023 for not cooperating with the DPA. The CNIL also asked that the controller provide the documents requested and provide detailed answers to the questions asked, subject to a penalty of €50 per day of delay at the end of the period of one month following the notification of this decision. The controller asked the French Supreme Administrative Court (“Conseil d’Etat”) to annul this decision. Firstly, pursuant to Article 58(1)(a) GDPR, a supervisory authority may order the controller to provide it with any information and personal data it requires to do its duties. Furthermore, Article 31 GDPR states that the controller must cooperate with the supervisory authority. The Conseil d’Etat considered that the controller did not provide the CNIL with the documents and information requested on the video surveillance systems installed on its business premises, thereby depriving the CNIL of the means necessary to verify the controller’s compliance with the GDPR. Secondly, the Conseil d’Etat also considered that the documents the controller produced were insufficient to enable compliance of their video surveillance system with the GDPR. Therefore, the plea alleging insufficient reasons were given for the penalty was rejected by the Conseil d’Etat. Lastly, the Conseil d’Etat noted that to impose a €10,000 fine, the CNIL took into consideration the controller’s failure to cooperate, its deliberate nature and the fact that they prevented the CNIL from verifying that the video surveillance system installed complied with the GDPR. Therefore, the Conseil d’Etat indicated that the CNIL did not impose a disproportionate fine on the company. The application for annulment was thus dismissed by the Conseil d’Etat.
CJEU case C-33/22 Österreichische Datenschutzbehörde
A data subject served as a witness during a committeee hearing held by the Austrian national parliament. Against his wishes a publication of the minutes of the hearing, which included his full name, were published on the website of the Austrian Parliament. The data subject complained to the DPA and requested an erasure of his data under Article 17 GDPR, stating that he was working as an undercover investigator and that a publication exposing his identity would affect his ability to do his job. The DPA rejected the complaint. It stated that the DPA is a body of the executive. Therefore, it does not have competence to oversee the activities of the committee under national law. This is because it considered the committee (the controller) to be a part of the legislative body. Under the principle of the separation of powersThe system of separation of powers divides the tasks of the state into three branches: legislative, executive and judicial. These tasks are assigned to different institutions in such a way that each of them can check the other. As a result, no one institution can become so powerful in a democracy as to destroy this system. in Austria, the executive cannot oversee the legislature. The data subject appealed this decision. The Federal Administrative Court anulled the DPA's decision. It held that the GDPR applies to acts done by the legislature because the GDPR concerns all data processing, irrespective of who carries it out. Therefore, the DPA was competent to review the decision. Moreover, it held that the legislature cannot rely on the exemption outlined in Article 2(2)(a) GDPR. The DPA appealed this decision. The Supreme Administrative Court referred three questions to the CJEU: 1) Does the GDPR apply to the activities of a Parliamentary committee of a Member State? 2) If question 1 is answered in the positive, do the activities of this committee fall under national security as defined by Recital 16 GDPR, therefore, making Article 2(2)(a) GDPR app
Court case W292 2267784-1
In May 2018, a data subject, respresented by noyb - European Centre for Digital Rights, filed a complaint with the Austrian DPA. The latter referred the case to the Irish DPC as lead supervisory authority under Article 56 GDPR and a cooperation procedure under Article 60 GDPR was initiated. On 11 January 2023, the DSB transmitted to the data subject the final decision by the DPC in accordance with Article 60(7) GDPR and informed her that the EDPB’s binding decision under Article 65(1)(a) GDPR would be published thereafter. Two days later, on 13 January 2023, the DSB transmitted the binding decision of the EDPB of 5 December 2022 to the data subject. The DSB informed the data subject that the parts of the original complaint that were not addressed by the DPC's decision are still pending before the DPC. On 7 February 2023, the data subject filed an appeal with the BVwG, claiming that the transmission of the DPC’s decision by the DSB should be considered a partially dismissing or rejection decision within the meaning of Article 60(9) GDPR. Since the DPC and the EDPB failed to address some of the points raised in the complaint, the communications of the DSB, together with the decision of the DPC could not be interpreted as a positive decision in accordance with Article 60(7). In the complainant's view, the communication by the DSB therefore constitutes an official decisions within the meaning of [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10005768&FassungVom=2019-05-09&Artikel=&Paragraf=58&Anlage=&Uebergangsrecht= section 58 et seqq. of the Austrian General Law on Administrative Procedures (Allgemeines Verwaltungsverfahrensgesetz, AVG)]. In its submissions, the DSB argued that Article 60(7) GDPR applied in this case and the DPC would still be handling the case. The BVwG first of all assessed whether the pronouncement of the DSB constituted a decision within the meaning of [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Ge
Court case 15 U 108/23
The Higher Regional Court of Cologne (Oberlandesgericht Köln, OLG Köln) decided on appeal on case 28 O 138/22 by the Regional Court of Cologne (Landgericht Köln, LG Köln). In the appealed judgment, the LG Köln ruled that, in order for a claim for damages under Article 82 GDPR to arise, the mere annoyance and suffering of emotional discomfort do not suffice. The data subject in that case, was a Facebook user whose personal data were disclosed as a consequence of a major data breach in 2019. The data subject appealed the decision by the LG Köln, restating his initial arguments and seeking again damages for loss of control over his personal data and emotional discomfort as a consequence thereof. On 07 December 2023 the OLG Köln pronounced its judgment. The OLG declared the appeal admissible. The court ascertained that there had indeed been several GDPR violations by the controller, and went on to assess whether they could give rise to the award of immaterial damages under Article 82 GDPR also in light of [https://gdprhub.eu/index.php?title=CJEU_-_C-300/21_-_%C3%96sterreichische_Post_AG CJEU in C-300/21.] The court held that even if the plaintiff did lose control over his data as they had been published in the darknet, in connection with his name and against his will, this, in turn, does not suffice to constitute an immaterial damage. Citing [https://gdprhub.eu/index.php?title=CJEU_-_C-300/21_-_%C3%96sterreichische_Post_AG CJEU C-300/21], the OLG ruled that the fact that there is no threshold that defines the existence of a damage, still does not mean that the person affected by a GDPR infringement is exempted from proving the negative consequences of the damage. In the present case, the OLG held that the plaintiff only proved the “negative consequence” suffered but not the immaterial damage itself. Hence, the plaintiff failed to prove that the loss of control over his personal data constitutes an immaterial damage and thus remains a merely abstract loss of control. The OLG also considered that Recitals 75 and 85 merely state that a loss of control over one’s personal data may potentially result in a non-material damage but they do not provide a specific definition of what constitutes an immaterial damage. Further, as regards the claim of the plaintiff that he suffered from anxiety, fear and discomfort following the data breach, the OLG also held that the plaintiff failed to credibly prove that he was actually physically and psychically suffering. The OLG reiterated that this does not mean that it is introducing a minimum threshold for damages, against the wording of [https://gdprhub.eu/index.php?title=CJEU_-_C-300/21_-_%C3%96sterreichische_Post_AG CJEU C-300/21], but that damage must at least be objectively determined. Similarly, the court held that the plaintiff failed to show how he suffered damages from the spam emails and SMS he received or how he employed time and effort he put in dealing with the loss of control over his data. Further, the court declared all other claims brought by the plaintiff either inadmissible or unfounded, thus confirming the decision of the LG Köln of 31 May 2023.
CJEU case C-807/21 Deutsche Wohnen
DW is a listed real estate company and indirectly holds around 163,000 housing units and 3,000 commercial units. The owners of these units are subsidiaries (holding companies) of DW and lease the units to other companies in the group (service companies). DW is only in charge or the central management. DW and the group of companies which it manages process the personal data of the tenants of said units. In 2017, the Berlin DPA informed DW during an on-the-spot inspection that companies within its group were storing personal data in a potentially infringent filing system. The DPA could not tell if it the storage was necessary nor if there were safeguards to ensure the erasure of data which was no longer required. DW told the DPA that it would move data to a more compliant database but this never materialised in practice. In 2019, the DPA fined DW €14,385,000 for intentional infringement of Article 5(1)(a), (c) and (e) and of Article 25(1) GDPR. The DPA found that DW intentionally failed to take the measures needed to allow personal data relating to tenants to be regularly erased or to check whether they had erroneously been stored. It also stated that DW had continued to store the personal data of at least 15 named tenants where such storage was not necessary. DW appealed this decision to Berlin's Regional Court. The court stated that the imposition of a fine on a legal person is regulated by national law (Paragraph 30 of the OWiG).The Act on Regulatory Offences: https://www.gesetze-im-internet.de/englisch_owig/index.html As a requirement for the imposition of the administrative fine against a legal person, German law requires that the original infringement shall be attributed to a natural person that is responsible for the legal person's compliance with the law. The Public Prosecutor's Office in Berlin filed an appeal with Berlin's Higher Regional Court. The Court observed that the limited liability regime of legal persons under national law is incompatible with
Lithuanian National Public Health Centre for the Ministry of Health
On 24 March 2020, the Lithuanian Minister of Health approved the development and implementation of an IT system for the purposes of recording and monitoring the data of persons exposed to the COVID-19 Virus, for epidemiological monitoring purposes. On 27 March 2020, a representative of the Lithuanian National Public Health Centre for the Ministry of Health (‘CNSP’) informed the IT company ‘IT sprendimai sėkmei’ (‘ITSS’) that the CNSP had selected it to create a mobile application for the above purpose. Once the mobile application was created, a privacy policy was developed in which the CNSP and ITSS were designated as joint-controllers. The application was available for download and functional between early April and the end of May 2020, during which it was used by 3802 persons. The application collected the following personal data from data subjects: their national identity number, geographical location, residential address, name and telephone number. On 10 April 2020, the Minister of Health entrusted the Director of the CNSP with the task of organising the acquisition of the mobile application in question from ITSS. Consideration was given to ITSS for the acquisition under domestic law, but no public contract for the formal acquisition of the application was concluded between the CNSP and ITSS. On 18 May 2020, the Lithuanian DPA opened an investigation into the mobile application and the data collected by it. By letter of 4 June 2020, the CNSP informed ITSS that due to lack of funding for the acquisition, the procurement process was terminated. On 24 February 2021, the Lithuanian DPA issued a decision which found that the application violated Articles 5, 13, 32 and 35 GDPR. As a result, the DPA imposed an administrative fine of €12,000 on the CNSP and €3,000 on ITSS as joint-controller, under Article 83 GDPR. The CNSP challenged the decision before the Vilnius Regional Administrative Court, arguing that ITSS must be regarded as the sole controller for the pur
Court case 48964C
A data subject having found that an American company had collected his personal data in order to publish it on its website, contacted it requesting for more information on the matter. On the same day, the data subject received an e-mail with a copy of the data, informing him that the company had deleted his personal data from its databases. Thus, the data subject filed a complaint with the Luxembourgish DPA requesting it to intervene and ask the controller responds to his request in accordance with the GDPR. Although the company had informed the data subject that it had deleted his profile from its website, it had at no time indicated whether, how, for how long and for what purposes it had stored the data subject’s personal data in its own databases or to which companies it had communicated that data. Thus, on 18 July 2019, the DPA wrote to the company requesting information on the contact information of the company’s representative in the EU designated under Article 27 GDPR. To which the company replied to not consider itself the controller of the data since their users are the controller and are responsible for ensuring that they individually adhere to data protection laws and regulations such as GDPR. In light of this reply, the DPA informed the data subject that because of this, it would not have the power to impose sanctions on the controller. By e-mail dated 29 May 2020, the data subject asked the DPA to send him a signed decision stating it could not, in accordance with Articles 12 and 13 of its internal rules of procedure, issue a decision. To which the DPA replied by e-mail on 8 July 2020. And on 18 September 2020 it reiterated to be unable to pursue the claim. Thus, on 1 March 2021, the data subject filed a complaint with the Administrative Tribunal. The Tribunal noted that the personal data in question had been deleted from the company's website and that the complainant’s lawyer failed to prove that his data had been processed by the company both at the t
IMY
The data subject complained to the Swedish DPA that his neighbors were conducting camera surveillance with cameras aimed at other’s plots and a common access road. The DPA investigated and concluded that the neighbours were not processing personal data. The GDPR was therefore not applicable and the case was closed. This decision was appealed by the data subject to Stockholm’s Administrative Court who dismissed the case. It reasoned that that the appealed decision did not affect the data subject in such a way that it is appealable. The data subject appealed the rejection to the Stockholm Court of Appeal. The Court of Appeal referred the case back to the Administrative Court. It stated that the Swedish DPA ruled on the substance of the data subject's complaint by rejecting it. The data subject should have an effective remedy under the GDPR. This decision by the Court of Appeal was appealed by the Swedish DPA to Stockholm’s Supreme Administrative Court. They argued that while data subjects have the right to an effective legal remedy, the decision to not open a case or close a case do not have any legal effects or significant consequences. The question for the Supreme Administrative Court was whether the Swedish DPA’s decision to close a supervisory case without action is appealable. The court decided that the data subject had the right to appeal. The right to an effective judicial remedy before the competent national court when a decision has legal consequences is outlined in Article 78(1) GDPR. To have legal consequences the complaint must be a legally binding decision and this includes decisions where the authority has dismissed a complaint. The same situation will arise as if the complaint case was directly closed without hearing the complaint. To ensure the right to an effective remedy, such a decision must also be considered as a legally binding decision within the meaning of Article 78(1) GDPR. Therefore, the appeal of the Swedish DPA is dismissed and the
The Swedish DPA IMY
A data subject filed a complaint against a bank with the Swedish DPA IMY, claiming he was denied access to his personal data. The DPA chose to close the case, explaining that they had informed the bank about the complaint to allow them to evaluate their own processing and rectify any shortcomings. The data subject appealed to the Administrative Court (Förvaltningsrätten) in Stockholm, but the appeal was dismissed. The court stated that the DPA's decision not to act on his complaint doesn't impact him in a way that qualifies for an appeal. Subsequently, the data subject took his appeal to the Administrative Court of Appeal (Kammarrätten), which also rejected it. The court argued that the decision did not significantly affect the data subject and was, therefore, not eligible for an appeal under the relevant legal criteria. Ultimately, the case reached the Supreme Administrative Court (SAC). The Supreme Administrative Court (SAC) overturned the decisions of the Administrative Court of Appeal and the Administrative Court, and referred the case back to the Administrative Court for reconsideration. In their ruling, the SAC cited Article 78(1) GDPR, which pertains to the right to an effective remedy against legally binding decisions made by a DPA. They referred to [https://gdpr.fan/r141 Recitals 141] and [https://gdpr.fan/r143 143], highlighting that a data subject should have access to effective legal remedy at the competent national court against a DPA's decision that legally impacts them. The SAC noted an example from Recital 141, including cases where the DPA dismisses or rejects a complaint, either wholly or partially. The SAC determined that a decision indicating the DPA's refusal to take the action requested in a complaint should be viewed as a legally binding decision, which is appealable under Article 78(1) GDPR. Therefore, since the data subject's complaint did not result in the desired actions, he is entitled to appeal.
Court case 2023-14 (21/01067)
A data subject lodged a complaint with the Norwegian DPA, who decided to merely inform the controller of their GDPR obligations and closed the case without further investigation. Dissatisfied, the data subject contested the closure. After some back and forth, the DPA revisited but ultimately upheld their initial decision. Consequently, as per national procedures, the case was escalated to the Privacy Appeals Board. They were tasked with determining whether the DPA could close a case by simply issuing an informational letter to the controller, without assessing any GDPR breaches, or if the data subject could require the DPA to examine their case and decide on the legality of their personal data processing. The Privacy Appeals Board overruled the DPA's decision and instructed them to reassess the case. Their reasoning was based on the data subject's right to lodge a complaint as per Article 77 GDPR, in conjunction with Recital 141, and Article 57(1)(f) GDPR. The Board referenced an earlier decision (PVN-2017-09), acknowledging the DPA's discretion in determining the scope of their investigations. However, they emphasised that this discretion does not extend to selectively processing complaints. In instances like this, where facts are clear but legal interpretation is in question, the DPA is obliged to decide on the lawfulness of the processing. The Board believed that failing to do so would conflict with Article 77 GDPR. Consequently, the DPA is required to assess the case and determine whether the controller unlawfully processed the data subject's personal data. If a violation is found, they must then consider the need for corrective actions in line with Article 58(2) GDPR.
CJEU case C-659/22 Ministerstvo zdravotnictví (COVID19 mobile application)
During the COVID-19 pandemic, the Czech Ministry of Health made access to premises and events dependent on certain conditions, such as vaccination or a negative test. The operators of several commercial activities were required to check the fulfilment of these conditions with regard to their clients by means of a specific app developed by the government. Operators were requested to scan the COVID certificate of clients and verify with the app that the certificate was valid. An action for annulment against the decree setting these rules was brought before an administrative court. The court referred some preliminary questions to the CJEU. In particular, the court aimed to know whether the conversion of personal data from a machine-readable form (the QR code on the COVID certificate) to a human-readable one (the information displayed on the app) could be considered processing of personal data pursuant to Article 4(2) GDPR. The CJEU stressed in the first place that the concept of ‘processing’ pursuant to Article 4(2) GDPR has a very broad meaning, which is necessary to guarantee the effectiveness of the right to data protection. The verification process in the case at issue fell within such a broad scope, as it requires the use of personal data. In addition, the CJEU noted how Regulation 2021/953 – as the piece of legislation establishing common rules about the ‘EU Digital COVID Certificate’ – explicitly provides a legal basis of the verification process under Articles 6(1)(c) and 9(2)(g) GDPR. Therefore. the scanning of COVID certificates by means of an app constitutes ‘processing’ of personal data pursuant to Article 4(2) GDPR.
Datatilsynets
During an ongoing dispute at a Norwegian Court of Appeal regarding the award of occupational injury insurance between a complainant and an insurance company (the data controller), the latter forwarded some of the complainant's health information to an external psychiatrist as a private expert. However, in its judgment of 7 January 2022, the Court of Appeal did not find it necessary to give decisive weight to the private expert's assessment and disregarded it. On 22 November 2021, the Norwegian DPA received an enquiry from the complainant who argued that the data controller's disclosure to the private expert resulted in a breach of the GDPR. However, on 5 September 2022, the DPA dismissed the complaint because it concerned the processing of personal data that falls outside the scope of the Norwegian Personal Data Act under section 2, second paragraph, letter b, meaning that the DPA did not have any authority on the process, pursuant to Article 55 GDPR and [https://lovdata.no/dokument/NLE/lov/2018-06-15-38 section 20 of the Personal Data Act]. On 26 September 2022, the complainant filed a timely complaint against this decision and on 30 January 2023, the case was submitted to the Norwegian Privacy Appeals Board, which, on 15 September 2023, considered whether the insurance company's transmission of the case documents containing the complainant's health information to a privately engaged expert, in connection with the processing of a civil case before the Court of Appeal, falls outside the scope of the Norwegian Personal Data Act. The Norwegian Privacy Appeals Board noted that the present case fell within an exception of the Norwegian Personal Data Act. Accordingly, the Act shall not apply to cases decided pursuant to Norwegian Administration of Justice laws, such as the Dispute Act, as they provide sufficient safeguards for privacy. Regarding the complaint, the Norwegian Privacy Appeals Board observed that the processing of the complainant's personal data during the
Court case W252 2249734-1
On 15 June 2020, a USB-stick containing a set of documents, including internal information of a company, was anonymoulsy sent to the Austrian DPA (Datenschutzbehörde - DSB) . The DPA thus started an ex officio investigation and concluded, by decision of 6 November 2021, that the controller, as head of the company, failed to meet security requirements as it saved personal data on a private and unsafe device. Upon learning about the decision, the controller appealed the latter to the Austrian Federal Administrative Court (BVwG), stating, amongst other things, that the DPA was not allowed to start such a procedure against the controller and the decision lacked a reasonable motivation. The controller also submitted that the DPA failed to take into account the fact that the USB-stick had actually been stolen by an employee of the controller. On its part, the DPA claimed that the appeal should be rejected by the Court. The Court considered the appeal to be admissible and held that it cannot be inferred from Article 58 GDPR that competent supervisory authorities may adopt declaratory statements on the unlawfulness of processing activities on the basis of an ex officio investigation. In its decision, the Court referred to the a judgment by the Supreme Administrative Court of Austria (Verwaltungsgerichtshof – VwGH) in case Ro 2020/04/0032-8, and held that Article 58 GDPR does not contain an explicit legal basis for such decisions to be issued. In particular, the Court stressed the fact that according to [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 Article 24 of the Austrian Data Protection Law (Datenschutzgesetz - DSG]), the DPA is only specifically allowed to issue declaratory statements on the infringement of a data protection provision on the basis of a complaint. Consequently, this is not possible in the case of an ex officio investigation by the DPA. In light of this, the Court held that the appeal should be upheld since the decision by the DPA lacked a legal basis and shall thus be repealed.
Court case W252 2247092-1
The data subject filed a complaint against the controller for the unnecessary storage of payment data. The data subject claimed that data were outdated and no longer useful to check their creditworthiness. The Austrian DPA held that storage was excessive and contrary to the GDPR. The controller appealed the decision, pointing out to have meanwhile erased data. This was, according to the controller, not on the basis of a legal obligation, but as a spontaneous gesture of good will. The Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG) upheld the controller’s appeal. According to the court, in lack of a law stating the contrary, a judge should assess the existence of a violation with regard to the time of the adoption of their decision. The court pointed out that § 24(6) of the Austrian Data Protection Law (Datenschutzgesetz – DSG) enables controllers to remedy to violations during proceedings before the DPA. The court stressed that such a national provision is not contrary to the GDPR. As matter of fact, Article 58 GDPR does not provide the DPAs with any power to adopt declaratory binding decisions about the existence of certain violations. What Article 58(6) GDPR does is exclusively to enable Member States to confer additional powers to the DPAs under national law. Austria decided to implement this provision by giving its DPA the power to ascertain the existence of ongoing violations, not violations that occurred in the past. In light of the above, the court invalidated the DPA’s decision.
Facebook Inc.
The data subject was a Facebook user. According to the privacy settings selected at the moment of the facts, their phone number could be used by a third person to find the data subject’s profile on Facebook, even if the phone number itself was not public. Accordingly, information relating to the data subject could be linked to their phone number by anyone in possession of such a number. In 2021, unknown “third parties” automatically combined telephone numbers and matched them with Facebook profiles thanks to the above-mentioned function. In this way, telephone numbers could be assigned to identified users. This resulted in a data breach concerning 533 million people in 106 different countries. The data subject lamented that since the data breach they received phishing emails and calls. In light of the loss of control over their personal data, the data subject claimed damages under Article 82 GDPR. The Court of first instance rejected the data subject’s claim. The data subject appealed the decision before the Higher Regional Court of Hamm (Oberlandesgericht Hamm – OLG Hamm). The court upheld the first instance judgement. The court clarified that a claim under Article 82 GDPR requires the existence of three necessary elements: the violation of a GDPR provision, an actual damage affecting the data subject, and a causal link between violation and damage. Concerning the first element, the court preliminary pointed out the fact that the burden of proof concerning the non-existence of a violation is on the controller. This conclusion can be drawn on the basis of Article 5(2) GDPR, which imposes on the controller the obligation to prove compliance with GDPR. The court also ruled out that the controller could rely on any valid legal basis for the processing. The linking function provided by Facebook was neither necessary for the performance of the contract (Article 6(1)(b) GDPR), nor could be based on legitimate interest of the controller (Article 6(1)(f) GDPR). Conse
Court case AN 14 K 19.01313
The data subject lodged a complaint against a controller with the Bavarian DPA via email. The DPA never reacted to such an email. Therefore, the data subject brought an action against the DPA, lamenting that the latter did not take into consideration their original complaint within the legally established term of three months. Eventually, the DPA took action, examined the data subject’s complaint and rejected it for lack of any GDPR violation. The data subject accepted the merit of the decision and withdrew its principal legal action but also asked the DPA to bear the costs of the procedure. In the data subject’s view, the DPA’s lack of response still amounted to a failure to act for which the DPA was liable. The DPA refused to pay the costs arguing that the data subject’s email was not a complaint within the meaning of Articles 77 or 78 GDPR, as no GDPR violation by the controller was argued. Thus, the procedure continued exclusively with regard to the costs. The Administrative Court of Ansbach (Verwaltungsgericht Ansbach – VG Ansbach) upheld the data subject’s view. According to the court, the email sent to the DPA amounted to a complaint pursuant to Article 77 GDPR. The right to an effective remedy implies that the procedural requirements to file a complaint with a supervisory authority shall not be interpreted too strictly. The lack of response within the legally established term of three months in turn entailed a liability pursuant to Article 78(2) GDPR. The DPA did not show any compelling reason for which the decision was delayed. According to the court, informing a data subject pursuant to Article 78(2) GDPR is not a particularly high standard to meet. The court completely disregarded the outcome of the complaint on the merits. As the data subject had withdrawn its action, the main procedure was discontinued. However, the court ordered the DPA to bear the costs, applying a provision of German national law (§ 161(3) VwGO) by analogy.
Court case W211 2268942-1
The data subject made a complaint against the respondent, as organ's of the respondent searched through the data subject's office in 2020 and took seven pictures on a private cell phone of the complainants office, the contents of a box and handwritten notes on files. The complaint is focused on the data processing that took place in the secret search and how the respondent violated the complainants fundamental right to privacy under the GDPR. The complaint was made in a timely manner because the complainant only found out after the oral hearing the data processing that occurred during the search of the office.The complaint was filed within the one year complaint period from the time the matter became know in connection with section 85 (4) GOG. The searched violated article 8 of the ECHR, the complainants right to a private life. It is clear the data processing was carried out, outside disciplinary or criminal proceedings exclusively on behalf of the respondent which makes it clear this was not processed out by an impartial disciplinary court. This in turn affected the judicial independence of the judge. According to section 85 (1) GOG, a prerequisite to admit a complaint is that it must violate a fundamental right to data protection by an organ that exercises judicial activity, which is not the case here as there is no connection with court or legal proceedings, it was an issue that took place in the company. The processing of data was necessary for official supervision and therefore, had no corresponding legal basis. The respondent requested the complaint to be rejected and if necessary dismissed. Initially, there was confusion over which court department this complaint needed to be assigned too, in the beginning it was not assigned to a court department as the authority in charge assumed there would be a decision-complaint procedure, eventually the court departments were assigned once the files attached were examined in the legal department and the contents w
Court case 2023/AR/801
On 24 May 2023, the Belgian DPA issued a decision in which it ordered a ban on the transfer of tax data of accidental US citizens residing in Belgium to the US. Despite the fact that Article 96 GDPR provides that agreements concluded prior to GDPR which comply with the EU legislation at the time of their conclusion are still valid under GDPR, the DPA considered the FATCA agreement as not in line with the GDPR (see GDPRhub summary). The controller filed an appeal with the Appeal Court requesting that the decision be suspended and annulled. The Court indeed has jurisdiction to suspend a decision if, prima facie, it appears that the decision could be annulled and if the immediate execution of the decision is likely to cause serious harm that would be difficult to repair. The controller argued that the decision violated Article 96 GDPR by holding that the FATCA agreement was invalid and that its execution caused serious harm to Belgium's international reputation and relations. The Court considered that, contrary to the interpretation of the DPA, Article 96 GDPR does not provide for a time limit on the validity of international agreements concluded prior to the GDPR. In addition, the Court held that if the decision was not suspended, the Belgian State would not be able to meet its commitments to the USA, i.e. to transfer the data before 30 September. The contested decision placed the Belgian State at odds with its international commitments, whereas Article 27 of the Vienna Convention on the Law of Treaties states that a party may not invoke the provisions of its domestic law to justify its failure to perform a treaty. The Court then carried out a balance of interests and considered that although the transfer of the data potentially infringed the provisions of the GDPR, the objective was to prevent tax fraud, i.e. an objective of general interest. This objective outweighed the interests of the data subjects. As a result, the Court decided to suspend the DPA's decision pending a ruling on the merits.