GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The data subject is an employee of the controller. The controller terminated the employment contract because of allegations against the data subject which had been made in a specially set up platform of the controller to uncover mismanagement within its business. The data subject filed a lawsuit against the termination of the contract in which he, among the others, requested access to his data under Article 15 GDPR. The data subject won the lawsuit with regard to the termination of the contract. The part relating to Article 15 GDPR was separated from the rest of the lawsuit. The data subject limited its application under Article 15(1), (3) GDPR to data on his "personal performance and conduct" which is "not stored in his personal file". The Regional Labor Court Baden-Württemberg (Landesarbeitsgericht Baden-Württemberg - LAG Baden-Württemberg) upheld the claim. The Federal Labor Court decided that the claim was inadmissible according to § 253(2)(Nr. 2) ZPO (Code of Civil Procedure) since the request to access was not specific enough. The court affirmed that a claim must be so specific that it can be enforced later on, otherwise uncertainty would be created for the defendant and the enforcement authorities. The court further reasoned that the use of terms which are subject to interpretation is only allowed if, on the one hand, further specification is not possible or reasonable for the plaintiff, and, on the other hand, there is no doubt for the parties as to their meaning, so that the scope of the application and the judgment is certain. The court found that it was possible for the data subject to specify its request because his submissions showed that he actually knew which data he wanted access to. Furthermore, it found that "personal performance and conduct" and "not stored in his personnel file" are not sufficient specific terms as they are not defined by law or jurisprudence and don't have a definite common meaning.
The controller operates a doctor search and evaluation platform. The data subject is a doctor for skin and venous diseases. In December 2019, the data subject used the reporting function of the platform to request the deletion of a user's review pursuant to Article 17(1) GDPR. The controller did not remove the disputed review from the platform, but instead published the controller's request for deletion on the platform, arguing that there is a legitimate interest for the publication of this information under Article 6(1)(f) GDPR. The data subject objected to the publication and lodged a complaint with the Austrian Data Protection Authority (DSB). The Austrian Data Protection Authority (DSB) disagreed with the controller's view. It stated that, generally, such evaluation platforms and the associated processing of personal data are covered by the right to freedom of expression in accordance with Article 10 ECHR and Article 11 CFR. It further reasoned that, usually, the added social value created by the evaluation platform or the interests of the broader public outweigh the interests of the data subject, so that the publication of comments by users of this platform can in principle be based on Article 6(1)(f) GDPR. The DSB, however, concluded that, since the data subject used the report function and not the comment function of the page, the use of the data was intended exclusively for the purpose of reporting and, therefore, the data subject did not reasonably have to expect the publication of the data. Consequently, the DSB found that the legitimate interests of the controller or the platform users (i.e. the patients) did not outweigh the legitimate interests of the controller and, therefore, the controller violated the data subject's right to deletion. The controller appealed this decision. The Federal Administrative Court of Austria (Bundesverwaltungsgericht - BVwG) agreed with the position of the DSB. In particular, it confirmed the balancing of interests perfo
The controller is Nauta Dutilh, a law firm. The data subject is a former advisor of a government institution, the “House for Whistleblowers” (the House), which is a public organisation where whistleblowers can report “societal abuses” and which investigates the treatment of whistleblowers. Between September 2018 and May 2019, the data subject reported several suspicions of wrongdoings, concerning the general functioning of the House, and the appointment procedure of their chairman. On 2 May 2019, the data subject reported internal (confidential) suspicions of wrongdoings to two newly appointed board members of the House. On 21 May 2019, the data subject was suspended, after which he was formally fired on 26 July 2019. The data subject suspected that the chairman and two board members which he contacted, had been advised by the law firm Nauta Dutilh, the controller in this case. On 25 July 2019, the data subject made an access request with the controller, and requested a copy of his personal data pursuant to Article 15 GDPR. The controller confirmed that they processed his personal data (name, last name, address, email-address, and picture), but also stated that they cannot provide all information due to professional confidentiality. The data subject brought the case before Court, requesting the Court to order the controller to provide him and the Dutch DPA with a copy of all personal data relating to him and all processing thereof processed by Nauta, and all information listed in Articles 13, 14, and 15 GDPR. However, the Court considered that the controller’s professional confidentiality limits the data subject’s right of access pursuant to Article 23 GDPR, and did not find any violations. The data subject then filed an appeal. The Court of Appeal rejected the appeal. First, it confirmed the argumentation of the Court of first instance. The Court of first instance stated that the right of access can be restricted by a legislative measure pursuant to Article 2
In this case, the first controller is a collection agency which obtained an enforcement order from a court against a person with the same name as the data subject. During the enforcement procedure the debtor could not be found at the address which was originally stored with this first controller. As a result, the first controller asked a second controller to find out where the debtor lived. After its research, the second controller gave the first controller the personal information belonging to the data subject, thinking it was the actual debtor's data. This information included the data subject's name, date of birth and address. It turned out that the data subject and the debtor were father and son, and had the same first name and surname. The data subject (the father) requested and erasure of his data to both controllers since he was not the actual debtor they were searching for. He also requested injunctive relief to stop the controllers from processing his data in the future. Furthermore, he filed a complaint with Regional Court of Hannover (Landgericht Hannover - LG Hannover) claiming damages in the amount of €10,000 for potentially being registered as a debtor in Schufa's database, which is Germany's biggest credit agency. The controllers argued that they were allowed to process the data and obliged to retain it according to German tax law. Furthermore, they stated that the storage of the data was justified in order to avoid future confusions, which was not only in their own interest, but in the data subject's interest as well. Additionally, one of the controllers noted that the data subject was sufficiently protected from being held liable for his son's debt, since the data is marked as invalid in their database. The LG Hannover rejected the data subject's claim, who in turn appealed this decision with the Higher Regional Court of Dresden (Oberlandesgericht Dresden - OLG Dresden). The OLG Dresden overturned this decision, and ordered the deletion of the d
The SVB (controller), a social security administrator in the Netherlands, structurally send personal data of newly born children to the Tax Administration. The controller has this data, as it is responsible for paying out the general child allowance. The tax office is responsible for paying out the child-related budget (an extra allowance for low-income families). The data subject's father believed that the controller wrongfully shared his daughter's information with the Tax Administration in connection with the child-related budget. He never submitted an application for this allowance and, in view of his income, he was not eligible for it. Complaint 1: on 4 January 2017, the data subject's father submitted a complaint with the Dutch DPA. He argued that the controller failed to carry out a proportionality test, which was a breach of the Wpb.'Wet bescherming persoonsgegevens,' the implementation of Directive (EU) 2016/680 (the GDPR predecessor) He requested the DPA to order the controller to immediately cease the structural provision of data on all children to the Tax Authorities. Complaint 2: on 17 May 2019, the data subject filed another complaint with the DPA against the controller and the Tax Authority (now based on the GDPR). He argued that the controller violated the principle of proportionality and subsidiarity contained in the GDPR. He requested the DPA to order the controller and the Tax Authority to remove his daughter's personal data from their systems. (He has now limited this complaint to the controller). On 19 November 2020, the DPA rejected the complaint. The data subject's father also started legal proceedings against the controller. This resulted in a [https://gdprhub.eu/index.php?title=Rb._Midden-Nederland_-_AWB_-_20_3811 Court ruling on 4 May 2021], where the Court held that the controller had indeed unlawfully invaded the privacy of the data subject by providing her personal data to the Tax Administration. The controller appealed this decision t
Controller is Coolblue B.V., a company that sells (electronic) products. Data subject was employed at Coolblue between 8 August 2017 and 7 August 2020. During that time, with data the subject’s permission, Coolblue took photographs of the data subject in the context of promotion/marketing. Pictures of data subject were seen on approximately hundred Coolblue-vans, and they also featured in a promotional video on Coolbue’s YouTube channel. After the termination of the contract, data subject, among other things, claimed that Coolbue should (again) have requested data subject’s consent for the use of the promotional material, since it contained their personal data. According to the data subject, Coolblue had no legal basis to process their personal data, since data subject revoked their consent on the 20th of November 2020, pursuant to Article 7(3) GDPR. The Rotterdam Court of First Instance rejected data subject’s claim that Coolblue had no legal basis to process their personal data. First, it considered that the use of data subject’s pictures and video’s falls within the material scope of the GDPR, since personal data is being processed. It noted that data subject revoked their consent pursuant to Article 7(3) GDPR, and Coolblue could therefore not rely on Article 6(1)(a) GDPR as a legal basis for the processing of data subject’s personal data. However, the Court stated that, although Coolblue could not rely on the data subject’s consent, it could rely on Article 6(1)(f) GDPR, if their legitimate interest to process the personal data override the data subject’s fundamental rights and freedoms do not override the legitimate interest of Coolbue. In that regard, the Court noted that Coolblue had a commercial interest, that this interest is legitimate, and that the costs for Coolblue would be unreasonably high, and the impact on their business enormous, if the photograph of data subject could no longer be used. Moreover, Coolblue also accommodated data subject’s inte
The data subject filed in a complaint at the Austrian DPA, in which he claimed that such processing could be misleading users and distorting competition, because only the one who would pay, would be in a better position and it also would not be indicated that the position is upon payment. There was no option for comments and ratings from users or any other way to get a possible better position on a List, than buying one - paying the additional fee. A new database and with it connected processing was also not necessary, since there already was a database made by the federal ministry. Also, the commercial interests of the data processor did not override the fundamental rights of the data subject and the data subject also could not expect that his data will be processed like that. The data subject did not give his consent to this kind of data processing and demanded that the data processing stops. Furthermore, he claimed that the services of the data processor did not have any additional value or advantage – so that his potential customers could reach him better or have any informative advantage in comparison with the database of the federal Ministry where the data was primarily stored. There were also no legitimate interests of the data processor, which would allow the processing on the ground of Article 6(1)(f) GDPR or any other legitimate reason for the processing of personal data. The data subject also claimed a violation of Article 14 GDPR, since the information about the processing came after the processing has already started and was also poor in content. The data processor has upon notice complemented the privacy statement. The data controller claimed that his undertaking did not pursue solely commercial interests, but was also in the interest of the general public since it was a specialized search machine and made it possible to search for a therapist. This fact would give the undertaking of the data processor an additional value, which would override the int
On 1 February 2010, the data subjects obtained credit of €28,500 from the credit lending company "Hoist Finance” (the controller). Soon after the agreement, first arrears in payment occurred in September 2010. Since these payment arrears still existed in 2014, the controller notified the data subjects that this could lead them to register these arrears with the Bureau Credit Registration (BKR), and subsequently did so. The debt further increased and the data subjects and controller set up a debt repayment scheme. In 2019, the controller exonerated the data subjects from paying a part of the controller's interest. Ultimately, in 2020, the debt was completely settled. However, the payment arrears, and the notification of exoneration of a part of the controller's interest, were still registered with the BKR. Moreover, these registrations would not be deleted from the BKR's database before October 2025. The data subjects requested the controller to explain the proportionality and subsidiarity of the BKR registration, and to have the registration deleted. The controller, however, argued that the registration sufficed these requirements and rejected the erasure request. Because the data subjects experienced financial issues from the registration, i.e. because they had troubles getting a mortgage, they brought the issue before Court. The District Court Amsterdam upheld the claim. First, the Court noted that, currently, there is debate in the judiciary about the legal basis registering payment arrears with the BKR: either Article 6(1)(c) GDPR or Article 6(1)(f) GDPR. The Court referred to the [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:PHR:2021:831&showbutton=true&keyword=ECLI%3aNL%3aPHR%3a2021%3a831 conclusion of Advocate General] in a similar case that ended up before the Dutch Supreme Court, in which the AG concluded that Article 6(1)(f) GDPR is the correct legal basis. The District Court followed the reasoning of the AG and noted that, therefore, the
Controller is Scalable Capital, a financial services company via which customers can invest in shares etc. Data subject is a customer of this company. Upon registration, they provided numerous personal data to the controller inter alia a photo of their ID-card. On 19.10.2020, the controller informed the data subject of a data breach. Unauthorised third parties had acquired access to the following personal data of data subject: first- and last name, title, address, e-mail address, mobile phone number, place of birth, place and country of birth, nationality, marital status, tax residence and tax ID, IBAN, copy of identity card, portrait photo, which was taken in the Post-Ident procedure. Moreover, this data was accessed by these third parties on three separate instances in the period from April to October 2020. In total, these third parties had copied and stolen 389,000 records of 33,200 affected persons. The attackers were able to access the whole IT system of controller because they had acquired the access information via controller’s former IT Service provider, CodeShip Inc. Although this service provider no longer provided IT services to controller since late 2015, the access data to controller’s system had never been changed. The stolen personal information was used to obtain loans, and was offered for sale on the Darknet. Because data subject feared for identity theft and other fraud, they brought the action before Court and claimed compensation pursuant to Article 82(1) GDPR, because controller violated Article 32(1) GDPR. The Court upheld the appeal and ordered the controller to pay € 2,500, - as non-material damages to the data subject. First, the Court considered that the controller violated Article 32(1) and Article 5(1)(f) GDPR because it failed to implement sufficient organisational measures to ensure an appropriate level of data protection. In this regard, the Court considered Article 82(4) GDPR and noted that it is irrelevant whether the security d
The controller is the managing board of the Regional Public Health Service (RDOG) Hollands Midden. The data subject is a person who was reported anonymously to the Care and Nuisance Reporting Centre of the Municipal Health Service (GGD) Hollands Midden. This Reporting Centre discussed the report in their meeting, and decided that this was not a task for them, so they closed the file. However, controller also received a notification of this report, and registered this notification in their system by mistake. Moreover, the controller did not inform data subject about this notification. After the data subject became aware of the existence of the notification at the beginning of 2020, they wanted to find out who reported them. Hence, they filed an access request pursuant to Article 15 GDPR, after which they received a copy of the report that was made. However, because the report was anonymous, a passage containing personal data of the person who reported them, was omitted. Data subject wanted to know the identity of this person, so they could pursue further legal claims against them, and brought the action before court. The Court rejected the appeal. First, it stated that the controller wrongfully did not inform the data subject regarding the notification, violating Article 13(1) GDPR. The controller, however, had already acknowledged this, apologised to the data subject and adjusted the work process to avoid a similar situation in the future. Second, the Court considered data subject’s claim to know the identity of the person who reported them. It stipulated that the GDPR is not intended for this purpose, since the purpose of the right to access is to enable the data subject to inform themselves of the processing of their personal data and to check the lawfulness thereof. According to the Court, it is not the controller’s task to enable the data subject to improve their legal claim against another entity, via the GDPR. Moreover, the Court stated that, pursuant to
In 2012, a company "Legelisten.no AS" launched a website where people could submit anonymous reviews of healthcare personnel. From the same year, the Norwegian DPA Datatilsynet received multiple complaints from affected individuals. In one case in 2015, the DPA held that Legelisten did not have a legal basis for processing personal data related to the website reviews and, further, that Legelisten had to offer an opt-out arrangement for healthcare personnel not wanting their personal data published on the website. The decision was appealed to the Norwegian Privacy Appeals Board, who overturned parts of the DPA's decision, importantly relating to the (lack of) legal basis and the opt-out arrangement. Following this, the Norwegian Medical Association brought an action to the Norwegian courts, claiming that the website had no legal basis as per Article 6(1)(f) GDPR for registering and publishing subjective user reviews of healthcare personnel. After a balancing of the legitimate interests safeguarded by the website operator Legelisten against the interests of the healthcare personnel, the Supreme Court agreed with the Privacy Appeal Board's decision and found that Legelisten had a legal basis for the processing as per Article 6(1)(f) GDPR. The Court emphasised that Legelisten.no is an important source for the general public to acquire information about healthcare providers. The measures taken to limit privacy concerns also satisfied what could reasonably be expected. Thus, the DPA's initial decision was overturned and the appeal appeal against the Privacy Appeals Board's decision was rejected.
The two data subjects of this case are minors. They are visiting a private kindergarten. The private kindergarten gave – with the consent of the legal guardians of the data subjects – a list to the municipality of its seat (the controller) which consisted of the name, date of birth and date of admission of all kids attending the kindergarten. Because the municipality did not want to bear the costs for children having their residence in another municipality, it sent a letter to all parents requesting them to take the letter to the municipality of their residence and ask for their financial support. This letter consisted of the already mentioned list as well as another list which additionally contained the days of absence, overall days and the calculated share of costs of each child. The controller did not ask the legal guardians of the data subjects for their consent before sending the letter out to all parents. The data subjects – represented by their legal guardians – filed a complaint with the DPA. The DPA sustained the complaint. The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision of the DSB. The court concluded that the head of the kindergarten was a third party according to Article 4(10) GDPR with respect to the sending of the letters. The consent given to the head of the kindergarten did not extend to the municipality and did not encompass the disclosure of the data to the other legal guardians.
The data subject had been convicted of accessing, possessing and publishing images and videos containing sexual assaults on children. The criminal offences had taken place over a period of 20 years. During this time, the data subject worked as a psychiatrist and as an expert witness in cases relating to family and children welfare. After having served their prison sentence, the data subject contacted Google and asked to have five search results removed from the search engine. The data subject argued that the search results had a severe negative impact on them and their children. Google denied the request, stating that the search results were a matter of public interest. The data subject brought the case before Datatilsynet (The Norwegian Data Protection Office). Datatilsynet concluded that Google had to delete the search results. Google filed an appeal, and the case was brought before the Privacy Appeals Board (PVN). The PVN had to consider only two of the five search results, as the rest had been deleted before the start of the proceedings. The PVN first remarked that Google as a controller had a legal basis for their processing in article 6(1)(f) GDPR. However, according to article 17(1)(c) and article 21(1) GDPR, upon receiving an erasure request from the data subject, the search engine company would have had to delete the search results unless there were overriding legitimate grounds for not doing so. The PVN highlighted that the controller had the burden of proof when it came to such legitimate grounds. The PVN then noted that when a person working closely with children as a public figure is convicted for sexual offences relating to children, there is an obvious legitimate interest in making this information accessible to a wider audience. Although the legitimate interest is reduced over time, the PVN considered the time passed in this case (almost 4 years) to be rather short. On the other hand, the PVN argued that the search results contained information on
Both data subject and (alleged) controller are natural persons using Facebook. The controller is the admin of several Facebook groups and the data subject had joined one of these groups that dealt with "stress coping". The data subject and the controller engaged in a chat on Facebook, which the controller took screenshots of and disclosed them to the ex-boyfriend of the data subject. For these reasons, the data subject filed a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB) which, in turns, argued that the GDPR did not apply because the relevant online-activities have not been publicly visible. The DSB interrogated the ex-boyfriend as a witness and then upheld the complaint. It held that the data disclosure violated the right to secrecy under § 1 Austrian Data Protection Act (Datenschutzgesetz - DSG). However, the DSB did not assess the case under the GDPR. The controller filed an appeal against this decision with the Federal Administrative Court. (Bundesverwaltungsgericht - BVwG). The BVwG did not issue a decision on the merits of the case but remitted it to the DSB, ordering it to properly establish the facts of the case by pointing out a variety of omissions and errors. For example, the BVwG held that the DSB failed to assess which personal data of the data subject have actually been disclosed to the witness (ex-boyfriend of the data subject alleged data recipient) and if the witness already had been in possession of these data before. Furthermore, the DSB had failed to address several relevant questions to the witness, ignored several statements of the controller and ambiguities in the data subject's submissions, failed to interrogate the data subject and did not explain its consideration of evidence. On a legal level, the BVwG held that the DSB failed to assess whether the household exemption under Article 2(2)(c) GDPR applied on the case, since the controller is a natural person and the data disclosed stems from a private cha
This case concerns an interlocutory judgment in the case [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBAMS:2021:174&showbutton=true&keyword=C%2f13%2f694440%2fKG C/13/694440/KG ZA-20-1118 MvW/JE dated 21 January 2021], in which the interim relief judge of the District Court of Amsterdam referred questions to the Dutch Supreme Court for a preliminary ruling pursuant to Section 392 RV. Controller is Hoist Finance. The data subject had taken out a loan with the controller. The controller claimed this credit after payment arrears had occurred. Because payment arrears had occurred, the data subject was registered in the Central Credit Information System (CKI) of the Credit Registration Office (BKR) with a special code "A". This special code was then adjusted in the following months do display that the claim had been claimed, and that the amount exceeded a certain threshold. After the debt had been settled, and the processor notified the controller of this, the controller ensured the data subject that it would have the entry removed from the BKR registration, which indicated that the amount of the claim exceeded a certain threshold. Because the controller did not comply with the request, the data subject submitted another request, which was rejected by the controller. The District Court of Amsterdam referred the following preliminary questions were put to the Supreme Court: 1. Must the processing of specific personal data by a credit institution, by means of an individual registration in the system of BKR, be assessed in accordance with the provisions of Article 6(1)(c), Article 6(1)(f) GDPR, or both provisions? 2. Does the answer to Question 1 mean: a) that the person whose personal data have been recorded is not entitled to invoke the right to erasure provided for in Article 17 GDPR? b) that person is not entitled to a right of objection as referred to in Article 21 GDPR? 3. If the answer to Question 2b means that, in the case
Google LLC (the controller) had asked the Administrative Court of Helsinki to overturn [https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_(Finland)_-_918/154/2019 the Finnish DPA's decision], according to which the controller had been ordered to remove outdated search result links from Google Search. The controller filed the appeal claiming that the search results were necessary for exercising the right of freedom of expression and information within the meaning of Article 17(3)(a) GDPR. The controller also stated that there were compelling legitimate grounds to keep the search result links available to the public under Article 21(1) GDPR, as the data subject acted in a public role. The DPA argued that the date indicated in the news articles to which the search result links led did not guarantee that the reader understood the information as describing past events. Thus, a reader who ignored the date of the news article could think that the police was still seeking information about the data subject's whereabouts. The Court found that the controller processed the personal data for the purposes of its legitimate interests in accordance with Article 6(1)(f) GDPR. Therefore, the data subject must be considered to have objected to the processing of their personal data on grounds relating to their particular situation in accordance with Article 21(1) GDPR. In this respect, the Court considered that the data subject could be considered to have a public role in terms of balancing the interests between the right to privacy and freedom of expression due to the commission of a serious crime. The data subject could also be considered to have a public role as CEO and board member of a real estate agency. The Court noted that the news articles to which the search result links led indicated the date on which the news had been published. Thus, the fact that the general public might mistakenly believe that the arrest warrant against the data subject was still valid
Controller is the RhineMain University of Applied Sciences. On its website (https://www.hs-rm.de), it used the consent manager “Cookiebot” to obtain users' consent to the use of cookies, and the "Google Tag Manager". Data subject regularly visits the website to look for specialist literature in their online catalogue, and found that their IP address is automatically transmitted to Google’s server each time they visit the website, without having given consent. In addition to their IP address, all kinds of information on the hardware and software of the user’s terminal device is sent, i.e., the accessed’ website, their operating system and its version, the browser and its version, the screen resolution etc. Moreover, Cookiebot is a service offered by the Danish provider Cybot. Although the company is established in Denmark, the target domain “consent.cookiebot.com” refers to a server with an IP address registered with the US-based cloud company Akamai Technologies Inc. (hereafter: Akamai). Although the server might be located in the EU, the cloud company has access to the data on this server. Therefore, the US Cloud Act applies, which means that US governmental agencies can request access to this data, without a court order or mutual legal assistance agreement. After the data subject had written three warning letters to the controller, the latter responded on 7 June 2021 that it no longer used the Google Tag Manager, but refused to submit the obligation to cease and desist regarding Cookiebot. Hence, on 8 June 2021, the data subject applied for interim relief. The Court upheld the appeal and ordered controller to terminate the integration of Cookiebot for the purpose of obtaining consent on its website, since the transmission of personal data is unlawful. First, it noted that the data subject could invoke the right to effective judicial remedy, pursuant to Article 79 GDPR, and that this provision does not have a blocking effect for further judicial remedies. Sec
In their complaint to the DSB (Austria) the data subjects, both police officers, together with other colleagues, alleged a violation of the right to secrecy. The complainants carried out an identity check. In its course they had been filmed with several smartphones by the persons checked (controllers). The first complainant had repeatedly informed the controllers that it was a criminal offense to publish the video material. However, this was ignored and the material was published on social media (Facebook and Instagram) without making the data subjects unidentifiable. The controllers wanted to draw attention to ethnic profiling or accuse the complainants of such a procedure, as they felt discriminated by the identification, which in their opinion was only based on the colour of their skin. In the videos the controllers did not only make remarks to the effect that the identification of the complainants was done on racist grounds, but also used insulting words towards the complainants. The complaint was partially upheld by the DSB and it was found that the respondent had violated the second complainant's right to secrecy by publishing a picture of the complainant’s on his Instagram profile and thereby violated the complainant's right to secrecy by at least publishing a picture of the first complainant on his Instagram profile. For the rest, the complaint was dismissed. The Federal Administrative Court (Bundesverwatungsgericht – BVwG) stated that the image recordings were in any case personal data of the complainants pursuant to Article 4(1)GDPR, as the identification of the data subjects was possible. Through the publication, the respondents had also processed the personal data of the complainants within the meaning of Article 4(2) GDPR and, as the operators of their Instagram and Facebook profiles, were also to be qualified as data controllers under data protection law pursuant to Article 4(7) GDPR for their respective profiles. Furthermore, the posting of the
Controller is the municipality of Zundert. Data subject requested access to the personal data that was being processed by the municipality pursuant to Article 15 GDPR. In particular, they requested to provide them with a list of all data carriers, whether available in paper or other form, and by additionally providing them with copies or extracts of those data carriers. The controller provided the data subject with an overview of the personal data relating to them processed during the period from 3 October 2017. However, the controller refused to provide copies and extracts of documents. Data subject was not content with the summary of their processed personal data, and objected to the decision. This objection, however, was declared unfounded by the controller. Hence, the data subject appealed to the District Court and argued, inter alia, that providing merely a summary of the processed data was an insufficient reply to his request. The controller argued that data subject should have given a copy of the underlying files on which the summary was based. The Court rejected the appeal. First, it considered that, although it became clear (also from data subjects' explanation at the hearing) that the data subject used the access request to gain access to documents, which the municipality had refused to disclose on the grounds of the Government Information (Public Access) Act (Wob), the municipality did not take this data subjects' intention in the decision. Second, the Court held, referring to the judgement of 3 March 2021 of the Council of State (RvS), that Article 15(3) GDPR is not intended to ensure the data subject access to administrative documents containing personal data. Although an administrative body can decide to provide a copy of these documents, it is under no obligation to do so. The Court affirmed that an the municipality has sufficed by providing an overview.
The German Football Association (DFB) (controller) has issued a regulation for player agents. Player agents are consultants for professional footballers, e.g. for the arrangement of club transfers. The player agent regulation contains a provision according to which players or football clubs are obliged to disclose details of the remuneration of player agent services to the DFB or similar bodies. A director of a player agency (data subject) claimed injunctive relief against this disclosure requirement under [https://www.gesetze-im-internet.de/bgb/__1004.html §§ 1004,] [https://www.gesetze-im-internet.de/bgb/__823.html 823 German Civil Code] (BGB) in conjunction with Article 6(1)(f) GDPR. In their opinion, the disclosure requirement violates Article 6 GDPR. The Higher Regional Court of Frankfurt am Main (OLG Frankfurt) balanced the interests of the parties pursuant to Article 6(1)(f) GDPR. It found that, within the framework of the balancing of interests of Article 6(1)(f) GDPR, the data subject's interests lie in the confidentiality of the requested data. On the side of the controller, who issues the regulations, the legitimate interest of transparency and traceability of arrangements of player transfers is pursued in order to exclude that sports operations are not dominated by unjustified financial interests of third parties. The OLG Frankfurt concluded that the interests of the defendant prevail.