GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The data subject is a user of the social media platform F (controller). The controller was of the opinion that two comments posted by the data subject violated the terms and conditions ("F's Community Standards"). As a consequence, the controller deleted the two comments and restricted the abilities of the data subject's profile temporarily. It also made a note of haven taken these measures against the data subject in case of future violations. The data subject filed a law suit against the controller. In this law suit the data subject requested, among others: 1. that the controller will be ordered to restore the two comments, 2. that the measures of the controller will be declared illegal, 3. that injunctive relief will be granted, 4. that the controller will be ordered to rectify the data so that the existence of a breach of the terms is deleted from the record and the counter recording the number of breaches is reset and 5. that damages will be awarded. The Regional Court Hannover dismissed the claim of the data subject entirely. The data subject appealed this decision. The appellate court - the Higher Regional Court Celle (Oberlandesgericht Celle - OLG Celle) - amended the judgement and granted the requests 1-3, but still denied the requests for rectification (4) and damages (5). After establishing that the data subject did not violate the terms and conditions, the court focused primarily on the application for rectification. The court concluded that the note of the controller about the deletion of the comments and the restriction of the account is not "inaccurate" data according to Article 16 GDPR, because the deletion and restriction of the account have indeed taken place. Furthermore, the court found that there is no indication that the controller actually stores a note in which it deems its measures to "have been proven lawful"[explicitly phrased this way by the court - see Comments on this]. The court further reasoned that even if the controller would ha
The data subject is a private person who visited the website of the controller. The controller used Google Fonts in a way that the dynamic IP address of the data subject was automatically transferred to Google's server in the USA. Google Fonts is a library which includes over 1300 different fonts and can be embedded in a website by its operator. The Regional Court of Munich (Landgericht München - LG München) held that the transfer to Google via Google Fonts violated the GDPR and, therefore, the data subject's right to constitutional right to informational self-determination. As a consequence, it granted injunctive relief according to § 823(1) BGB in conjunction with § 1004 BGB (analogously) and awarded damages in the amount of €100. At first, the LG München determined that injunctive relief requires a violation of rights and a risk that this violation may occur in the future again (risk of repetition). The court found the transfer of the IP address to Google without the consent of the data subject (Article 6(1)(a) GDPR) is an infringement of the data subject's constitutional right to informational self-determination. It came to the conclusion that a dynamic IP address is to be considered as personal data (Article 4(1) GDPR), as the controller has an abstract opportunity to determine the data subject. It also held that the processing is not justified under Article 6(1)(f) GDPR since Google Fonts could be used without having a connection to Google's servers. It rejected the arguments of the controller that the data subject should have masked their IP address, because this would run contrary to the objective of data protection law to protect data subjects by imposing obligations on the entities which are processing data, and not make data subjects responsible for their own protection. The court further affirmed that the risk of repetition is factually presumed, when a violation of rights has been established. It found that this presumption was not rebutted by t
The data subject is a lawyer that is employed by the company A. In August 2018, he suffered a severe stroke due to which he has continuously been on sick leave since then. In a labour court case against his employer in 2019, the employer hired a lawyer who disclosed information about the data subject's health during the proceedings. The data subject classified this as a violation of the GDPR because it was a special category of personal data (Article 9(1) GDPR) that should not have been processed. The data subject requested the Hessian data protection authority to intervene against the alleged data protection violations. The data protection authority refused to take action. The Administrative Court of Wiesbaden dismissed the data subject's claim. It held that, in the context of a labour court dispute, both the employer and the lawyer instructed by it are entitled to name and explain any health data of the employee. This applies all the more if the employee is the plaintiff and has brought the relevant circumstances into the proceedings himself. First, it clarified that the lawfulness of the data processing of health data in legal proceedings is assessed according to Article 6(1)(f) GDPR and Article 9 GDPR. Second, lawyers are data controllers within the meaning of Article 4(7) GDPR with regard to their presentation in court proceedings. As independent organs of the administration of justice in their capacity as advisors and representatives, they themselves bear the responsibility for the content of the pleadings in terms of liability and design. Third, according to the court, in their pleadings, attorneys pursue the legitimate interest of fulfilling their contractual obligation with the client (cf. § 3(3) Federal Lawyer's Act [Bundesrechtsanwaltsordnung - BRAO]). The activity of a lawyer would be impossible if he were not basically allowed to present what the client informs him of. They would even expose themselves to the risk of attorney liability if, contrary
The controller is Zakelijk Energie Beheer B.V., a company that (claims to) offer(s) customers to find the right energy provider. On 19 March 2021, the data subject was called by controller with an offer to join an “energy collective”, which he refused. On the same day, he requested the controller access to his personal information pursuant to Article 15, and to restrict the processing of his personal data pursuant to Article 18 GDPR. On 29 July 2021, the data subject received a reply to his access request. However, he received this reply from a third party, namely Regionaal Energie Beheer, which stated that it “obtained the personal data of [data subject] from marketing partners, through market research, surveys, etc.” and that, “in order to be able to offer its products and services, it needs the personal data of [data subject], for example in order to establish and maintain a relationship with him or to comply with legal obligations.” Moreover, this third party explained they share his personal data with (other) third parties and that they collected his personal data from the website https://www.enqueteloket.nl on 28 January 2021. The data subject then brought the issue before Court, and, among other things, requested the Court to order the controller to comply with the access request, to fulfil their information obligations under Article 14 GDPR, to erase his personal data, and to notify which recipients have received a notification pursuant to Article 19 GDPR. Moreover, he requested € 10,000 as compensation for his damages and the Court to refer preliminary questions to the CJEU regarding the notion of ‘damage’ in Article 82 GDPR. The District Court partially acknowledged the data subject’s claims. First, the Court considered that the data subject filed an access request with the controller, but got a response from a third party (Regionaal Energie Beheer), and not from the controller. Hence, the Court granted the data subject’s request to order the controlle
In 2016, the data subject entered Germany and applied for asylum. The asylum application was made on grounds that the data subject had converted from the Muslim to the Christian faith and feared being arrested for reasons of faith in the home country. In the application, the data subject credibly demonstrated that, due to the conversion, he would face state persecution if returned to the home country and refugee status was subsequently granted. In 2021, the German Federal Office for Migration and Refugees (FOMR) reassessed the data subject's refugee status. In a request for information with a deadline subject to a €500 fine, the FOMR asked the data subject to explain, how his interest in the Christian religion had been developing since refugee status was granted or whether the data subject had tried to convince other people of the Christian faith. In addition, the data subject was asked to provide evidence of a conversion to Christianity and of any involvement in a church congregation. The data subject filed a suit against this course of action. The Administrative Court had to decide, inter alia, whether the FOMR’s request for participation was incompatible with Article 9 GDPR. The administrative court decided that the request for information was compatible with GDPR requirements under EU law. The court did not find a breach of the processing of special categories of personal data under Article 9 GDPR. Article 9(1) GDPR prohibits the processing of special categories of personal data, such as religious or philosophical beliefs, unless the processing is, inter alia, necessary under Article 9(2)(g) GDPR for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The court held that under § 73(1) German Asylum Act (AsylG),
The data subject alleged a violation of Article 5 GDPR by the complainant and brought his complaint to the Data Protection Authority (Datenschutzbehörde - DSB). They claimed that the president of the complainant had discussed his person in confidential telephone calls with various offices. According to him, the information discussed was suitable to portray him negatively. The complainant argued that the oral discussion at a general meeting was not subject to the material scope of Article 2 GDPR. Furthermore, it argued, that even in case of the application of the GDPR, Article 5 hat not been violated. The DSB decided in favour of the data subject. The court did not decide on the subject matter. Instead, it repealed the contested decision and referred it back to the DSB in accordance with § 28(3) VwGVG. It concluded that the reasoning of the DSB's decision had been too superficial. According to the court, the decision showed a lack of investigation since the DSB had not even presented what type of personal data had been processed.
The controller is Stichting Bureau Kredietregistratie (BKR), which manages the credit registration register (CKI). This register provides an overview of creditworthiness of people. Data subject has autism and has several registrations in the CKI, because of numerous payment arrears and neglected payment obligations, with several credit providers. These registrations make it impossible for them to find investors for their company, because investors find data subject not to be creditworthy enough. On 3 May 2021, data subject requested the BKR to remove all registrations relating to them from the CKI. The BKR rejected this request because it is only responsible for correct processing of the personal data it receives from the credit providers, and data subject had to submit their request to the providers. Data subject brought the action before Court, claiming that personal data were processed unlawfully. In particular, (1) the BKR processes their personal data without a legal basis, (2) the retention period of the registrations is too long, (3) the manner of registration of special codes referring to the registration is inadequate, (4) the accessibility of their personal data is insufficiently verifiable, and (5) the CKI does not meet the necessity requirement. Moreover, they requested the Court to order the BKR to remove all registrations relating to them from the CKI, because their interests overrode the interests of the BKR. Lastly, they claimed the BKR cannot simply refer them to the credit providers because the BKR is also a controller. Regarding the first claim that personal data is processed unlawfully First, the Court stated that, referring to a recent judgement of the Dutch Supreme Court, it is clear that the BKR has a legitimate interest to process data subject’s personal data, pursuant to Article 6(1)(f) GDPR. Second, the Court found that, although it is not laid down in law, the retention period of 5 years does not violate Article 5(1)(c) GDPR, because
The proceedings started with a complaint made to the Polish DPA (UODO) in which a data subject claimed that the processing of their personal data by a non-standardised securitisation fund (fund) was not justified and lacked legal basis on the grounds that the debt being collected by the fund was non-existent. The plaintiff therefore requested that all of their personal data be removed from the fund’s database in accordance with Article 17(1) GDPR. The personal data obtained by the fund included: name, surname, date of birth, gender, national identification number, correspondence addresses, telephone number, e-mail address, as well as information on the claim broken down to financial components, including principal amount, interest and bank account number dedicated to debt repayment, the date of the contract and the date of termination of the contract. The UODO decided that the processing of personal data by the fund was lawful, since the fund acquired the debt from an original creditor in the performance of a contract under Article 28 GDPR. The UODO stated that as a debtor, the data subject must consider that their right to privacy may be limited in connection with the recovery of debts. The UODO emphasized, however, that it had not examined the factual elements regarding the existence of the debt or its amount, which are issues that should be determined by civil courts. The claimant, which disputed the existence of the debt, specifically complained about receiving importunate telephone calls by the fund. With regards to these allegations, the UODO explained that this issue must be considered in the context of established practices applied by debt collection agencies. The UODO, therefore, decided that the fund was not obligated to grant the data subject's erasure request, since it had a legitimate interest and legal basis for processing the data. The data subject appealed this decision to the Voivodship Administrative Court in Warsaw, on the basis that the UODO inco
Controller is Stichting Veilig Thuis, a public organisation that deals with cases or suspicions of (suspected) domestic violence or child abuse. The data subject is a 11-year-old child that had been missing school several times. After Veilig Thuis received reports from the data subject’s school regarding truancy, it sent the mother an email, in which it stated (among other things) that “Veilig Thuis has made the agreement with the obligatory education officer that she will contact Veilig Thuis if the safety of the child is jeopardised again or continues to be so (e.g. when you do not accept the help that is offered)”. The mother did not agree with the wording and requested to rectify the dossier, pursuant to Article 16 GDPR, by removing the word “again”. Moreover, she requested to have the whole dossier erased, pursuant to Article 17 GDPR. Veilig Thuis rejected both requests, which led the mother to [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBZWB:2021:1970&showbutton=true&keyword=C%2f02%2f381362+%2f+HA+RK+21-16 bring the matter before court]. The District Court of Zeeland-West-Brabant, however, rejected the appeal. Regarding the deletion request, it decided that it cannot be assumed that the interests of the child’s legal representative (the mother) and the child will always coincide. Moreover, it noted that Veilig Thuis had been involved with the family for some time, had concerns about the child’s school negligence. Thus, it found that Veilig Thuis had a reasonable chance to judge that the substantial interest of the child required that Veilig Thuis saved the data, and that this substantial interest of saving the data outweighed the interest of the mother to erase the data. Regarding the rectification request, the Court considered that the right to rectification is not meant to correct or remove impressions, opinions, research results and conclusions with which the person concerned does not agree. The District Court, however, did not order the
eprimo, a German electricity supplier, distributed advertisements consisting of displaying banners in the email inboxes of the T-Online free email service. When users opened their inbox, those advertisements were shown to them at random, indistinguishable from the list of emails in the users' inbox except for the fact that the date was replaced by the word ‘Anzeige’ (advertisement), no sender was mentioned and the text appeared against a grey background. When clicking on what looked like an email at first glance, the users were shown that advertisement. This procedure is known as inbox advertising. Städtische Werke Lauf a.d Pegnitz GmbH (‘StWL’) is a competitor of eprimo and considered eprimo's inbox advertising unlawful under the rules of unfair competition because there was no prior consent by the users. StWL, after at first succeeding with an action before the Regional Court of Nuremberg-Fürth, lost the case in the second instance before the Higher Regional Court of Nuremberg. When it appealed at the BGH, it referred the subject to the CJEU. In particular, it asked whether inbox advertising was compatible with the ePrivacy Directive and the Unfair Commercial Practices Directive which require consent for electronic mail that is sent to users for the purposes of direct marketing, prohibiting unsolicited communications. The CJEU decided that inbox advertisements require prior consent. The BGH agreed with the StWL and overturned the Regional Court's decision, taking into consideration the CJEU's ruling. It held that eprimo had violated competition law and had to compensate StWL. According to the court, pursuant to § 7(2)(3) Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb - UWG), any direct marketing using the email inbox of the user requires prior consent. Such consent had not been obtained by eprimo. It assumed that it is irrelevant whether potential users of the free email service had been made aware of the use of parts of the internet pa
The controller is Holland Car Company, a company which deals in exclusive cars. It fired one of their employees (data subject) for urgent reasons. It had recorded a telephone call of the data subject with a client. In this call, the data subject discussed selling one of their own cars to the client, which their employment contract does not allow. The data subject had no knowledge of their calls being (potentially) recorded, nor did the client. The data subject felt that this was a breach of their privacy because it had not consented to the recording of their calls. The controller, however, stated that this recording was allowed as it suspected the data subject of breaking its employment contract and using the Company contacts to plan its own business. On top of that, it had informed their employees that calls could possibly be recorded. The data subject brought the action before court. First, the District Court considered that the controller could only record the employees conversations if it had a legitimate interest pursuant to and if this is necessary and proportional. Hence, it appeared the Court referred to Article 6(1)(f) GDPR. Moreover, it must also be clear, for both the employee and the client, that the conversation is recorded (including start and end moment), as well as the reason for the recording, retention period and that the recording is adequately secured. Moreover, the Court noted that secret recordings can only be done in exceptional circumstances, such as the suspicion of criminal facts or abuses within the organisation. If there are no such circumstances, the controller must obtain consent for these recordings. Hence, it appears the Court referred to Article 6(1)(a) GDPR. The Court stipulated that the fact that employees were informed that calls could be recorded, does not constitute as consent. After considering the controller's arguments, the Court assessed that the controller's arguments did not justify the exceptional circumstances, and
DataJust is an AI-based technology aiming at evaluating compensation harmonisation in the judicial system as well as establishing indicative references for compensation. It thus collects several type of information on case-law regarding compensation between January 1st 2017 and 31st December 2019. Data collected and processed includes name of individuals, except the parties, identifying elements, information on damages, and personal information on professional and financial situation. Right to opposition does not apply as stated in Article 6 of the decree. In order to set up the system, the government adopted a decree on March 27 2020 laying out DataJust functioning. Several complainants, including NGOs, challenged the legality of DataJust on several grounds including lawfulness of processing, unauthorized use of sensitive data, violation of the data minimisation principle as well as inadmissible restriction of data subjects' rights. The CE approved DataJust decree on several grounds. First, the decree explains explicitly the legitimate interest to process the data as required in Article 4 of the loi du 6 janvier 1978. Ends of the data processing are fully vindicated and legitimate as it is only on a short period of time (2 years), it has an all-encompassing approach (both amicably and judicial dispute resolutions are taken into account) and it facilitates access to case-law. Complainants also put forward that DataJust was using data collected for other purposes which would be incompatible with Article 5(1)(b) GDPR and Article 6(4) GDPR. The CE dismissed that claimed by recalling that both DataJust and first data collection involve dispute settlement purposes. Second, for what concerns the use of health data and other very sensitive data, the CE pointed out that the processing is based on Article 9(2)(g) GDPR and Article 6 of the loi du 6 janvier 1978 and that there was a substantial public interest in simplifying access to jurisprudence through an algorithm. T
The data subject is a client of a law firm, acting as a controller. The controller sued the data subject for payment of attorney's fees. The data subject counterclaims for their right of access pursuant to Article 15 GDPR, in particular to provide a copy of the personal data pursuant to Article 15(3) GDPR, as well as their right to receive compensation for damages suffered pursuant to Article 82 GDPR. The controller is of the opinion that it already provided the data subject with a copy of personal data as all incoming and outgoing documents were sent to the data subject without undue delay. Furthermore, it claimed that there is only a right to copies of those data that contain concrete information about the data subject. The controller also believes that the claim is time-barred. According to the data subject, the controller did not provide a copy of all personal data. The right to a copy of the personal data also includes a copy of the manual files of the controller. The data subject claims that they are entitled to the payment of damages suffering for the delayed and still incomplete provision of the personal data. The court held that the data subject is entitled to claim for the controller to receive a copy of all personal data including a copy of personal data contained in the manual files. Since the counterclaim was served to the controller on 4 February 2021 and thus before the expiry of a standard limitation period of three years, calculated from the entry into force of the GDPR, the claim cannot be time-barred. The court further held that the data subject is not entitled to claim compensation for the delayed right of access. The violation of the GDPR alone is not sufficient to trigger a claim for damages. Rather, the data subject affected by a data protection violation must have suffered a noticeable disadvantage. There must be an objectively comprehensible impairment of personal interests that carries a certain weight and of a certain significance. It
The data subject has requested access to their personal data under Article 15 GDPR. The controller (Arbeitsmarktservice Österreich) did not fulfill the request at first. Later – during the administrative proceeding – the controller, however, did. Thereupon, the DSB (Austria) informally closed the proceeding. The data subject objected to the termination of the proceedings on the grounds that the answer to their request was too late and was insufficient. The DSB maintained its decision arguing that the data subject has no right to have a past violation of the GDPR determined and that the assertion of insufficiency is be regarded as a new submission under § 13(8) AVG since it changes the substance of the matter. The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision and reasoning of the DSB. First, the court elaborated on Article 15 GDPR though these statements were not necessary for the decision of the case. It held that a data subject has no general duty to cooperate, but at most an obligation to specify if the controller processes a large amount of data and the data subject makes a very general request or is only interested in specific information or data processing. In these cases, the controller can request clarification from the data subject, but has no right to do so. The data subject may nevertheless insist that all data be disclosed. This means that the two-stage information procedures that occur in practice, in which the data controller initially only provides information on master data and only provides comprehensive information at the express request of the applicant, are perfectly permissible, provided that the applicant is made aware of this fact. Second, the court determined that the DSB was not allowed to close the proceedings informally but should have issued a formal notice according to § 24(6) BDSG because the data subject had objected with reasons against the termination of the proceedings. Third, the court stipula
On 26 November 2018, the Consumentenbond (a Dutch non-profit organisation which promotes consumer protection), on behalf of consumer [A], filed [https://www.consumentenbond.nl/nieuws/2018/gezamenlijke-actie-europese-consumentenorganisaties-tegen-google a complaint with the Dutch DPA], the Autoriteit Persoonsgegevens (AP), against Google LLC. The complaint was part of a joint action with other European consumer organisations, such as the umbrella organisation BEUC and the Norwegian, Swedish and Czech consumer associations. The complaint concerned the unlawful tracking of the consumer’s location by the consumer’s Samsung galaxy A3 smartphone, which runs the operating system Android (by Google). According to the complaint, crucial information was hidden and users were guided by dark patterns to consent to share their location, in violation of Article 5 GDPR, Article 6 GDPR, Article 7 GDPR, Article 13 GDPR, and Article 25 GDPR. The DPA, however, claimed that the Irish DPA (the DPC), is the leading supervisory authority pursuant to Article 56(1) GDPR, because the complaint concerns cross-border processing and Google’s European headquarters is located in Ireland. On 5 June 2019 and 2 September 2019, the DPA notified the Consumentenbond and the consumer that the Irish DPA was investigating the complaint and further information would follow. On 26 November 2019, the Consumentenbond and consumer served the DPA with a notice of default for failing to make a timely decision, but the DPA replied on 2 December 2019 that the notice was premature since they had until 2 December 2019 to reply. Moreover, they informed the Consumentenbond and consumer that Google had made changes related to the complaint and additional evidence in relation to the consumer had to be filed before 6 January 2020. The DPA kept informing the Consumentenbond and consumer every three months, on 27 Febryary 2020 and 27 May 2020, of the “progress” by the DPC, stating that an update would follow in three mon
The data subject had requested access under Article 15 GDPR from the controller (a credit reference agency). The controller replied on the request but provided only very superficial information about the processing logic involved and the significance and the envisaged consequences for the data subject (Article 15(1)(h) GDPR). In particular, it remained unclear to the data subject as to how the controller had calculated certain credit scores. Consequently, the data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB). The DSB upheld the complaint and ordered the controller inter alia to provide the data subject with meaningful information about the logic involved in the creation of the credit scores, as well as the significance and the envisaged consequences of these scores for the data subject. The controller filed an appeal against this decision with the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG did not decide on the appeal but suspended the procedure. It held that of the main questions of the procedure was, whether the calculation and disclosure of a credit score by a credit reference agency as such qualifies as a "decision, which produces legal effects concerning the data subject or similarly significantly affects the data subject" within the meaning of Article 22 GDPR. As the Verwaltungsgericht Wiesbaden had already requested the CJEU's preliminary ruling under Article 267 on that matter, the BVwG decided to wait for the CJEU's ruling before further trying the case.
Note: A range of claims were made in this case, but only the facts relevant to the data protection claim are considered here. This case is an appeal by the claimant in [https://www.bailii.org/ew/cases/EWHC/QB/2021/56.html Soriano v Forensic News LLC & Ors [2021] EWHC 56 (QB),] who brought claims against the defendants under libel, misuse of private information, data protection, malicious falsehood, and harassment. The judge in this case allowed the claimant to pursue his claims in libel and some of the claims in misuse of private information, but he did not allow the bulk of the claims in misuse of private information, and any claim in data protection, malicious falsehood, or harassment. The defendants appealed the claims the judge allowed. The claimant cross-appealed, "arguing that he should also have been allowed to pursue the claims in data protection and malicious falsehood." The appellant in this case is Walter Soriano, a businessman with ties to several governments. He was the subject of a series of 8 publications by the respondents, namely the owners of and contributors to Forensic News, which owns and operates an investigate journalism publication, and a blogger. The company's work is freely available and it is funded through "a mix of sources, including subscriptions, donations, merchandise sales and advertising revenue." Interestingly, all of the defendants were established or lived in the US. The claimant originally alleged that the defendants acted as data controllers of his personal data and violated Articles 5(1)(a), 10, and 44 GDPR. For example, he alleged that one of the publications by Forensic News "bore the defamatory imputation that the claimant was 'guilty of receiving illegal kickbacks and other corrupt payments from the Russian state under the façade of security consultancy work for Sochi Airport during the Olympic Games held in 2014'." A further claim under Article 5(1)(d) GDPR alleged that this publication "was inaccurate because he 'did
The data subjects and the controller are neighbours. The controller has its business located at the beginning of the street section whereas the data subjects’ business is at the end of the section which is a dead end. They are entrenched in a neighbourly dispute for years. The controller installed two self-triggering cameras on its premises pointing towards the data subjects’ business and capturing the street. The camera took pictures of the data subjects without their consent. The reasons given by the controller for installing the cameras were as follows: * constant loitering of one of the data subjects around the premises of the controller * taking pictures of the premises * numerous (about 300) complaints to the trade authorities concerning the business of the controller * throwing of rubbish bags over the fence (which the court did not see as proven) The court confirmed its view that special national provisions on video surveillance and image processing are inapplicable since the GDPR lacks an opening clause for them (cmp. BVwG W211 2210458-1/10 https://gdprhub.eu/index.php?title=BVwG_-_W211_2210458-1/10). The court held that the surveillance is not justified under Article 6(1)(f) GDPR. To the court it was not clear how image recordings could deter people from filing unjustified reports because people are in principle free to be in public traffic areas, even if it amounts to loitering, and free to file reports with the authorities on the basis of observations made in public traffic areas. Furthermore, the court reasoned that installing cameras could also not be an effective and therefore not an appropriate measure against the taking of photos by means of personally-held cameras, because they could in no way prevent such behavior. Furthermore, the court mentioned that even if “the throwing of rubbish bags over the fence” were proven, the processing would not have been justified under Article 6(1)(f) GDPR since the captured space is exceeding the general recomme
The data subjects notified the competent local authority (controller) about three public assemblies they were organising on the 4th, 11th and 18th of December 2021 to protest against the COVID-19 policies. On December 14th a press representative sent an email to the authority asking for the names of the data subjects. The authority, however, refused to provide the information on the grounds of the data subject's right to privacy. As a consequence, the press representative filed for interim relief in court on the same day to learn the names and full addresses of the data subjects. The Administrative Court of Osnabrück (Verwaltungsgericht Osnabrück - VG Osnabrück) granted interim relief regarding the names and the residential areas, which the data subjects live in, but not regarding their full addresses. The court held that the plaintiff has a right to information according to [https://www.nds-voris.de/jportal/?quelle=jlink&query=PresseG+ND+%C2%A7+4&psml=bsvorisprod.psml&max=true § 4 NPresseG] (Press Law of the state of Lower Saxony) and that the GDPR does not preclude this right. § 4(1) NPresseG obliges authorities to provide representatives of the press with the information which they need to fulfill their task. § 4(2)(no. 3) NPresseG lays down that access can be denied by the authority if it would infringe a private interest which deserves protection. The court concluded that the interest of the public to information outweighs the interest of the data subjects to privacy, including the their right to informational self-determination, because the topic of COVID-19 is of paramount public interest right now and the data subjects have placed themselves in the public eye by organising the assemblies. The court further reasoned that the GDPR does not preclude the plaintiff's right to information because § 4 NPresseG is to be seen as a legal basis for the processing under Article 6(3),(1)(c) or (e) GDPR and because the GDPR and the processing for journalistic purposes
The complainant is the parent of a minor who was a patient at a child and adolescent psychiatry center. They claimed that the family, including their underage children, had been filmed in the patient's room during a visit. In 2021, they filed a complaint with the Austrian Data Protection Authority (DSB) regarding the lawfulness of these recordings. The DSB rejected the handling of the complaint based on Articles 57(4) and 77 (1) GDPR, arguing that the complainant had made excessive use of the right to lodge a complaint. Between August and 2018 and August 2021, the complainant had indeed brought a total of 29 similar proceedings to the DSB pertaining to their underage daughter's personal data. The complainant appealed this decision with the Austrian Federal Administrative Court (BVwG). The BVwG decided in favour of the complainant. It repealed the contested decision and instructed the DSB to resume the procedure. According to the BVwG, the DSB did not meet the threshold set out in Article 57(4) GDPR for demonstrating the manifestly unfounded or excessive character of these requests. The minimum requirements would have entailed an overview of the content of the proceedings pending at the DBS, as well as assessing their similarity. Furthermore, the court held that the DSB did not specifically explain the excessive nature of the inquiries, but rather made legally irrelevant speculations about the complainant's motivations, instead of assessing the merit of the complaint.