GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The data subject applied for membership in an association. On instruction of the association’s managing director, a background search was carried out on the data subject. The investigation revealed information on previous criminal convictions of the data subject. The association's executive board was informed of these findings and the association subsequently refused the membership application. The data subject considered that the controller violated Article 10 GDPR since the personal data regarding their criminal convictions was not processed under official supervision. Hence, they requested payment of damages for pain and suffering totalling €21,000. The Regional Court of Dresden confirmed this violation but only awarded damages in the amount of €5,000. The Higher Regional Court of Dresden had to decide whether the amount of damages for pain and suffering was appropriate. The Court upheld the decision of the trial court on the unlawfulness of the processing of personal data. Because the controller could have asked the data subject to provide self-disclosure or a police clearance certificate, there was a less intrusive alternative of data processing. Hence, the processing was not necessary and the controller could not rely on Article 6(1)(f) GDPR. Moreover, the Court confirmed that, in addition to the company, its managing directors are also to be regarded as "controllers" within the meaning of Article 4(7) GDPR. On the award of damages, the Court pointed out that, under Article 82 GDPR, any assessment of harm must include the nature, gravity, duration of the breach, degree of fault, measures taken to mitigate the harm caused, previous breaches and the categories of personal data concerned. According to Recital 146, the concept of harm is to be interpreted in the light of the ECJ’s case law "in a manner fully consistent with the objectives of this Regulation". The Court stipulated that the principle of effectiveness does not exclude exemplary damages, and that
The controller is a foundation that makes personal data obtained via the National Court Register available on its website for the purpose of supporting the development of democracy by strengthening the citizens' rights of access to public information and re-use of public sector information. The data subject is an individual whose personal data had been processed by the foundation. This personal data included their name, surname, date of birth, gender, PESEL registration number, information on functions the data subject had in several (private) entities, and information on the value of their shares in such entities. The controller provided a free and a paid version of its website. The free version displayed only personal data that were linked to current ongoing activity of the data subject in several entities, and the shares they held in those entities. The paid version displayed also past activities of the data subject. In this case, the data subject's personal data was only accessible via the paid version of the website. The data subject submitted an erasure request pursuant to Article 17(1)(d) GDPR but the foundation rejected this request. The data subject then filed a complaint with the Polish DPA (UODO). The DPA rejected this complaint since it found that the controller had a legitimate interest to process the personal data under Article 6(1)(f) GDPR, and the data subject's interests or fundamental rights and freedoms did not override the controller's interest. The data subject did not accept this outcome and brought the action before court claiming inter alia that the controller had no legal basis to process the data. Hence, they did not object to the processing pursuant to Article 21 GDPR, but purely questioned its lawfulness. After the Court dismissed the appeal, the data subject brought the action before the Supreme Administrative Court. The Supreme Administrative Court dismissed the appeal, since it held that the processing was lawful. Consequently, th
In March 2020, the Swedish DPA Integritetsskyddsmyndigheten (IMY) fined Google €7,200,000 (SEK 75 million) for violating Article 17 GDPR (the right to erasure). In particular, the IMY considered that Google had violated the right to erasure in connection with two complaints from data subjects (Complaint No. 2 and Complaint No. 8 in the supervisory case), as well as because of its general practice of regularly informing webmasters when search results are being removed. Google appealed that decision before the Stockholm Administrative Court (FiS). In December 2020, the FiS upheld that Google had breached the right to erasure with respect to Complaint No. 2, but found no such breach with respect to Complaint No. 8. In both cases, however, the FiS concluded that Google had acted contrary to data protection law because of its practice of notifying webmasters of deleted search results. The FiS further justified a reduction of the overall fine calculated by IMY for the breaches that were upheld. Google further appealed the FiS decision before the Court of Appeal in Gothenburg. In the context of these appeal proceedings, IMY argued that Google had breached the right to erasure with respect to both Complaint No. 2 and Complaint No. 8, and had also acted contrary to data protection law because of its practice of notifying webmasters of removed search results. IMY wanted the overall fine to be set at €6,300,000 (SEK 66 million). In particular, the proposed fine of €6,300,000 included: * a fine of €96,639 (SEK 1 million) for not respecting the right to erasure with respect to Complaint No. 2; * a fine of €1,448,547 (SEK 15 million) for not respecting the right to erasure with respect to Complaint No. 8; and * a fine of € 4,800,000 (SEK 50 million) for the practice of regularly informing webmasters of deleted search results. = The Gothenburg Court of Appeals partly reversed the findings of the the FiS and found that Google had complied with Article 17 GDPR on the right to
The claimant, Mr. Farhadbahman through Damavand Media Ltd, entered into an employment agreement with the defendants, IITV. Throughout the existence of the contract the claimant made various publications on social media which were not in line with IITV’s editorial guidelines. The claimant alleged that he was not subject to these editorial guidelines due to the nature and scope of his employment and the contractual terms related thereto. Approximately one year after the conclusion of said contract the defendant terminated the contract on the grounds of a material breach having been committed by the claimant for not following the editorial guidelines on approximately six occasions. A third party who is a prominent voice on social media published internal correspondence (a “welcome email” exchange including various employees within IITV and undersigned by the claimant as the “creative director”) which showed the claimant’s involvement with the defendant. A leak was internally investigated but the investigation was inconclusive. The claimant alleged that this constituted a data breach as he had a reasonable expectation of privacy and that IITV could and should have prevented the leak. He relied on Article 5(1)(f) of the GDPR to support his argument that “his contact details and the content of the welcome note constituted personal data and IITV did not take appropriate technical and organisational measures to protect it against unauthorised leaks.” The High Court was referred to Various Claimants v Wm Morrison Supermarkets plc for guidelines on the application of ‘ensures, appropriate security... using appropriate technical or organisational measures’ to test a leak. However, it found that “[t]he mere fact of disclosure or loss of information is not sufficient for there to be a breach. An organisation is not vicariously liable for deliberate leakage. So it is a question of ‘appropriate’ risk management in all the circumstances of the case.” The High Court dismissed the
A Facebook user, the data subject, posted content that violated Facebook´s policy about mobbing and bullying. As a result, the post was erased and the user was set into a "Readonly"-Mode which banned him from actively using his Facebook profile. Information about the ban became part of the dataset about the data subject. In previous proceedings at the Regional Court of Ellwagen, the legal dispute between the parties were the questions concerning the context in which the content was posted, whether the policy was valid, whether the ban constituted a violation of the freedom of expression, and whether the consequence of the "Readonly" mode was permissible. The Regional Court of Ellwangen dismissed the case. In its decision, the Regional Court of Ellwagen held that the policy was valid and that the data subject violated Facebook's policy with his bullying and harassment. The information about the erasure and "Readonly" mode of the data subject is being processed by the data controller. Since the data subject was appealing the decision of the first court on the false use of law and on the grounds that there was no violation of the Facebook's policy, the data subject argued that the controller is obliged to correct the stored dataset on the data subject and erase the information of the violation of the policy pursuant to Article 16 GDPR. In its decision, the court held that Facebook's policy was binding and that the content posted by the data subject violated the policy. The data controller had the right to erase the data subject's content and to ban the data subject from actively using its services. Therefore, the personal data that was processed was correct and no right for rectification of the data pursuant to Article 16 GDPR could be exercised.
Facts pending decision. Questions referred: 1. In the light of recital 85 and the third sentence of recital 146 of the GDPR, is the concept of ‘non-material damage’ in Article 82(1) of the GDPR to be understood as covering any impairment of the protected legal position, irrespective of the other effects and materiality of that impairment? 2. Is liability for compensation under Article 82(3) of the GDPR excluded by the fact that the infringement is attributed to human error in the individual case on the part of a person acting under the authority of the processor or controller within the meaning of Article 29 of the GDPR? 3. Is it permissible or necessary to base the assessment of compensation for non-material damage on the criteria for determining fines set out in Article 83 of the GDPR, in particular in Article 83(2) and 83(5) of the GDPR? 4. Must the compensation be determined for each individual infringement, or are several infringements – or at least several infringements of the same nature – penalised by means of an overall amount of compensation, which is not determined by adding up individual amounts but is based on an evaluative overall assessment?
Controller is Defam, a credit provider. Data subject took out a credit of €10,000 for their friend, because the friend wanted to open a liquor store and did not have enough money. Data subject had to start paying off the loan from February 2014 onwards, but they did not pay the installments. After multiple payment arrears and broken payment arrangements, in December 2015, controller terminated the agreement, claimed the credit early, and registered the debt in the credit registration database (CKI) with the code “A2” (relating to data subject’s creditworthiness). After multiple payment arrangements, the debt was finally payed off on 30 January 2019. The registration of the codes relating to data subject’s creditworthiness will be deleted in January 2024. On 22 June 2020, Coderingsvrij B.V., on behalf of the data subject, objected to the registration in the CKI and requested removal, pursuant to Article 21 GDPR and Article 17 GDPR. Data subject claimed that he is now financially stable, and want to move out of the house of the parents of their partner, which is hard because of the registration of the “A2” code in the CKI. Controller refused to do so on 8 July 2020. After data subject requested again on 15 February 2021 to have the registration removed based because data subject’s interests overrode those of the controller, controller refused again on 25 February 2021. Then, the data subject brought the case before Court. First, the Court considered the admissibility of data subject’s appeal. The controller argued that the appeal was inadmissible because data subject did not appeal to their rejection on 8 July 2020, within 6 weeks, pursuant to Article 35 of the General Data Protection Implementing Act (UAVG). Moreover, the controller claimed that the request of 15 February 2021 was a repeated request, based on the same grounds, and could not be considered a new request. The Court rejected the argument because controller dealt with the request of 15 February 2021 in
The case concerns a customer of Saturn whose appliance and purchase documents, while in the shop, were mistakenly given to another customer. The first customer seeks compensation for this error. The District Court of Hagen referred the following questions to the CJEU for a preliminary ruling: 1. As no automatic legal effects are specified, is the compensation rule enacted in Article 82 GDPR invalid in the case of non-material damage? 2. Is it necessary, for the purposes of the right to compensation, to establish the occurrence of non-material damage, to be demonstrated by the claimant, in addition to the unauthorised disclosure of the protected data to an unauthorised third party? 3. Does the accidental disclosure of the personal data of the data subject (name, address, occupation, income, employer) to a third party in a paper document (printout), as the result of a mistake by employees of the processing undertaking, suffice in order to establish infringement of the GDPR? 4. Where the undertaking accidentally discloses, through its employees, data entered in an automated data processing system to an unauthorised third party in the form of a printout, does that accidental disclosure to a third party qualify as unlawful further processing (Article 2(1), Article 5(1)(f), Article 6(1) and Article 24 GDPR)? 5. Is non-material damage within the meaning of Article 82 GDPR incurred even where the third party who received the document containing the personal data did not read the data before returning the document containing the information, or does the discomfort of the person whose personal data were unlawfully disclosed suffice for the purpose of establishing non-material damage within the meaning of Article 82 GDPR, given that every unauthorised disclosure of personal data entails the risk, which cannot be eliminated, that the data might nevertheless have been passed on to any number of people or even misused? 6. Where accidental disclosure to third parties is preventabl
The defendant is a provider of social housing, the claimant is one of its tenants. A third party requested a rent statement from the defendant. In response to the request, the defendant sent a compilation of 6,941 pages unrelated rent statements by e-mail to the third party. The e-mail also included two pages of the claimant's rent statement with name, email address, and recent rent payments made to the defendant. The inadvertent disclosure was to a single person who immediately notified the defendant of the error and was asked by the defendant to delete the e-mail. Subsequently, the defendant informed the claimant of the error and the fact that the recipient had deleted the information. The matter was also reported to the Information Commissioner's Office, who confirmed that no action was required or would be taken as a result of the inadvertent data breach. At the time of the disclosure the claimant moved home to escape an abusive relationship and was concerned that the address would somehow become known to the claimant’s former partner. The claimant brought the case to the High Court and claimed “damages for Misuse of Private Information, Breach of Confidence and Negligence, together with damages for breach of Article 8 ECHR rights as incorportated in the HRA 1998 as well as damages pursuant to Article 82 GDPR and damages pursuant to section 169 of the Data Protection Act 2018. (…) Further, the Claimant claims injunctive relief to prevent the recurrence of this type of breach and declaratory relief stating that the Defendant has breached the principles enshrined in the abovementioned legislation." In support for issuing the case in High Court, the claimant argued that the matter concerned an evolving area of law which required elaborate and complex legal reasoning. The defendant denied that the claimant is entitled to any damages at all or any other relief because the claimant suffered no loss or damage above the de minimis threshold. The defendant applied to st
Google secretly tracked Apple iPhone users between late 2011 and early 2012 and using their data collected in that way for commercial purposes. Google bypassed privacy settings on Apple iPhones and the default blocking of third party cookies on Safari with its “DoubleClick Ad” cookie by relying on an exception devised by Apple. Google placed this cookie without the user’s knowledge or consent. This cookie was enabled if users visited a website that included DoubleClick Ad content (advertising content). The cookie identified visits by a specific device on websites using this advertising content, including data and time of visit; time spent by the user on the website; what advertisement was viewed for how long; and using IP address, the user’s geographical location. As a result, Google could infer the user’s internet surfing habits, location, as well as interests, race or ethnicity, social class, political or religious beliefs, health, sexual interests, age, gender and financial situation. Google then used this aggregated information to give them labels (eg “football lovers”) and eventually offering these group labels to advertising organisations looking to target specific groups when using Google’s DoubleClick service. This allegation was brought in the US and Google settled a charge of $22.5 million with the US Federal Trade Commission and $17 million to settle consumer based actions in the US. Three individuals in the UK sued Google in 2013 for the same allegation and their claim was settled by Google (Vidal-Hall v Google Inc). Lloyd has filed a claim before the UK courts on behalf of everyone that resides in England and Wales and owned an Apple iPhone at the time of the secret tracking. Lloyd filed this class action with the intention of recovering damages for more than 4 million people affected. He claimed that compensation (£750 suggested) should be awarded under the Data Protection Act 1998 for loss of control of personal data without having to demonstrate
The Job Centre of Diepholz (controller) dismissed its Data Protection Officer (DPO). The German Federal Data Protection Authority (BfDI - Bundesbeauftragter für den Datenschutz und die Informationsfreiheit) issued an immediately enforceable order against the Job Centre under Article 58(2)(d) GDPR to bring its processing into compliance with the GDPR and re-designate the dismissed DPO. The controller applied for interim relief before the Administrative Court of Köln (VG Köln - Verwaltungsgericht Köln) against this order. The VG Köln held that there was no necessity for the BfDI to make the order immediately enforceable because the controller had already designated a new DPO. Furthermore, the court concluded that Article 58(2)(d) GDPR does not empower the DPA to order the controller to re-designate its dismissed DPO, because neither designating nor dismissing a DPO constitutes processing according to Article 4(2) GDPR
A district authority had issued a decision allowing for hawks to be shot in a certain rural area. This decision contained certain personal data of the claimant. The respondent(a natural person) published this decision on their private website. The claimant asked the respondent to redact/anonymise the claimant's personal data on their website but the respondent refused. Consequently, the claimant filded a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB), represented by an attorney. The DSB upheld the complaint, held that the respondent had violated the claimant's data protection rights (remark: the exact GDPR violations are not specified in the judgment) and ordered the respondent to remove the claimant's personal data from their website. The respondent filed an appeal to the Federal Administrative Court (Bundesverwaltungsgericht - BVwG) which dismissed the appeal. The claimant filed a lawsuit, claiming the costs of their attorney under Article 82 GDPR. The claimant argued that the respondent had acted unlawfully and culpably, as they refused to redact/remove the personal data despite the claimant's explicit request. The first instance court upheld the claim and the respondent filed an appeal with the Higher Regional Court Linz (Oberlandesgericht Linz - OLG Linz). The OLG Linz dismissed the appeal. It noted that Article 57(3) GDPR only states that the performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer. Hence Article 57(3) GDPR does not forbid that a controller can be put under the obligation to pay/refund legal costs in connection with a complaint procedure under Article 77 GDPR. Furthermore, the EFTA Court in E-11/19 and E-12/19 only held that a data subject cannot incur costs in a proceeding where they have become a party to the case by virtue of a controller appealing against a supervisory authority’s decision. However it did no
This matter concerns an appeal to the Administrative Jurisdiction Division of the Council of State in which the data subject stated that his right to privacy was violated by the fact that he could only purchase a bus ticket by card (as opposed to cash payment). He previously raised a request to the AP (the DPA) to take action against Connexxion Openbaar Vervoer N.V. for the decision to abolish cash payments, through application of the GDPR. This request was denied and underlies the current appeal. On appeal, the data subject argued that “the court erred in finding that the processing of personal data is necessary for the performance of a contract” in that: 1. The data subject did not enter into an agreement with Connexxion “of his own free will” and that consent for the processing of his personal data was not given freely and unambiguously as Connexxion has a monopoly on which public transport users depend. He argued that the General Conditions for City and Regional Transport 2015 are insufficient to serve as a legal basis within the meaning of Article 6(1)(b) GDPR. 2. The purpose of the data processing is not well-defined, explicit and justified. 3. The effect on safety of banning cash payments is not clear as this measure is one of a group consisting of 23 measures. In establishing which data is being processed, the Court took note of the fact that Connexxion uses a Payment Service Provider (PSP) to process its financial transactions and applies the PAN Masking technique to secure these transactions. This technique only provides the last four digits of the bank account number to be stored at Connexxion while the preceding digits are anonymized. The Court further noted that a contract is established when the passenger boards the bus and the mere fact that the passenger has no choice as to whom he concludes this contract with does not negate the existence of said contract. It went on to consider whether there is an agreement in place and held that “there is no ev
The data subject owns an apartment in an apartment complex. The Association of (home) Owners (hereafter: VvE), of which the data subject is a member, decided to replace the old surveillance cameras with new ones. According to the data subject, the new surveillance system led to an invasion of her privacy. She also stated that the new cameras could process biometrical data (which is sensitive data, Article 9(1) GDPR). The VvE argued that the purpose of the camera surveillance is to protect the property of the common parts as well as the flats. They added that incidents of burglary and damage had occurred in the past, and that these new cameras are an appropriate security measure. Then, the VvE stated that this measure is not disproportionate since the cameras do not show the public road and do not process more data than is necessary. Moreover, the VvE claimed that protecting the property of the VvE and its residents cannot be achieved in any other way. Lastly, the VvE argued that their legitimate interest (Article 6(1)(f) GDPR) outweighed the data subject's interest of privacy since data subject is only filmed when she is in common areas, the VvE has built in sufficient safeguards (technical and organisational), and people passing by are notified of the surveillance via a sign. The data subject filed a complaint with the AP (Dutch DPA) and, after the DPA rejected the complaint, brought the action before court. First, the Court considered whether the measure was necessary by assessing the proportionality and subsidiarity of the measure. It held that the requirement of proportionality was met since the cameras do not allow the processing of biometrical data, and clear images of filmed people are justified by the fact that, in cases of damage, it needs to be clear against whom the charges are to be made. The requirement of subsidiarity was also met since the objective of the surveillance could be achieved in a less intrusive manner. Second, the Court conducted
The controller operates an online pharmacy located in Germany. The pharmacy allowed customers to order medical products with or without a customer account. For any order without an account, however, customers were required to enter their title (Ms./Mr.) and their date of birth in the online form. After receiving a complaint from a data subject, the LfD (DPA of Lower Saxony) investigated the case. The controller argued that information on the date of birth was required to ensure the full legal capacity of the customer and was therefore necessary to perform the contract. Furthermore, obtaining the birth date was required to comply with legal obligations. Since medications were generally associated with health risks and side effects and they must be dosed appropriately for the customer’s age. In terms of the title, the controller argued that collecting such data would allow for a more customer-friendly communication and therefore serve an overriding legitimate interest. The DPA found that the blanket collection of such data irrespective of a gender or age specific application of the ordered medication violates the principles of lawfulness and data minimization. Accordingly, the corresponding query must be omitted if it is not necessary for a gender- or age-appropriate dosing. Furthermore, the controller lacked to mention the purpose of collecting gender data to pursue legitimate interests which violates the principle of transparency. Consequently, the DPA ordered the controller to refrain from the collection of such information in the online ordering process where the necessity of such information is not indicated by the type of the medication ordered. The Administrative Court of Hanover held that the DPA’s order against the online pharmacy is lawful and does not violate the controller’s rights. While the controller has special contractual duties to provide information on their products and proper use, including an age-appropriate dosage, this does not justify the co
On 22 May 2018, complainant, who is a writer, requested Google via a to remove ten search-results that appeared when someone would type in complainant's name via Google Search. The search-results refer to webpages that display a conflict between complainant and a literary critic, since the latter accused complainant of plagiarism and (the accompanying) unjustified use of academic titles. After Google rejected the request, complainant asked the District Court Midden-Nederland to order google to remove the references to the ten internet addresses on pain of a penalty payment. This Court decided that complainant insufficiently refuted Google's argument that the contested search results are correct, relevant and not excessive, and also because it has not been established that the processing takes longer than necessary. The Court furthermore ruled that the interest of Google and of internet users who may want to gain access to the search results prevails over the interest of complainant. Complainant appealed against this judgement. Before the Court decided on the legitimacy of the deletion request, it assessed whether the applicable legislative instrument is the GDPR, or the (Dutch) Personal Data Protection Act (Wbp). It asserted that the legal proceedings started on 25 May 2018, and Article 48(10) of the General Data Protection Implementing Act (UAVG) states that the Wbp continuous to apply to proceedings that were pending before 25 May 2018 (the date the GDPR entered into force). However, it concluded that the GDPR is the applicable legislative instrument in this case, since the request concerns a request for removal, in respect of which it must be assessed ex nunc whether the processing is (currently) in accordance with the applicable rules. Then, the Court stated that the request for deletion must be regarded as an appeal to Article 21(1) GDPR, and the Court must therefore conduct the balancing test. In this regard, it acknowledged that complainant had an inte
The data subject is a retired employee of the municipality of Innsbruck. According to the data subject, the municipality had unlawfully disclosed the data subject's data in the course of a court procedure, inter alia by sharing them with an attorney which represented the municipality. The data subject lodged a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB). The municipality argued before the DSB that the disclosure of the data subject's data to the attorney had been necessary for the exercise of legal claims and therefore for the purposes of the legitimate interests under Article 6(1)(f) GDPR. The data subject was heard on this statement and filed a submission, arguing that Article 6(1)(f) GDPR does not apply on the municipality as it qualifies as a public authority. The DSB invited the municipality to submit a statement on this reply. The municipality filed a statement (mostly repeating their previous arguments) which was in turn again provided to the data subject who issued yet another submission (also mostly repeating their arguments). In September 2019, the DSB issued its decision, rejecting the complaint. In essence, the DSB (for unknown reasons) did not assess the case under Article 6 and 9 GDPR but held that the disclosure of data under § 1 Austrian Data Protection Act (DSG) was lawful. In particular, Austrian law allowed for parties to be represented by an attorney, which included the sharing of personal data. The data subject filed an appeal with the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG did not issue a decision on the merits of the case but remitted it to the DSB, ordering it to establish the facts of the case properly. It held that the DSB failed to assess which personal data of the data subject had actually been shared with the attorney. Furthermore, the Court pointed out that the DSB had also failed to establish when and how the respective data were shared with the attorney. In parti
A student applied to the Higher Administrative Court of Bavaria (Bayerischer Verwaltungsgerichtshof - BayVGH) seeking a suspension of the laws mandating verification of the Covid-19 vaccine and testing certificates in schools. The student claimed that she did not consent to the processing of her personal health data, and as only unvaccinated persons are tested, her vaccination status gets known to students as well as teachers. She claimed that considerable social pressure is being put on unvaccinated persons and in such circumstances, voluntary consent as per Article 9(2)(a) and 7 GDPR, does not remain meaningful. On the basis of low incidence and hospitalization risks, the student claimed that there was no cross-border health risk, and Article 9(2)(i) GDPR could not be applied in the present case. Rejecting the application, the Higher Administrative Court of Bavaria held that Art. 9(2)(i) GDPR applies. For the definition of “serious cross border threats” the court referred to Art. 168 TFEU and Decision No 1082/2013/EU of the European Parliament and of the Council. Art. 3(g) Decision No 1082/2013/EU defines “serious cross-border threat to health” as a life-threatening or otherwise serious hazard to health of biological, chemical, environmental or unknown origin which spreads or entails a significant risk of spreading across the national borders of Member States, and which may necessitate coordination at Union level in order to ensure a high level of human health protection. Due to the latest developments of the pandemic the requirements of this definition are fulfilled. With regard to the argument of social pressure on unvaccinated students the court was of the opinion that the burdens imposed by the processing of personal data are not disproportionate to the benefits accruing to the general public. The risk of stigmatisation may be countered with educational measures.
The data subject requested information on all data processed by the tax office, invoking Article 15 GDPR, in particular a complete colour copy of the tax files including all side files and the internal comments on all data processed by the tax office. The data subject accused the tax office of file manipulation as well as "recording false data". The tax office provided the data subject with copies of all current tax assessments, a printout of the tax collection account, as well as a basic data overview and an overview of the electronic record. It refused to provide further information. At the hearing, the tax office submitted extensive further printouts from its databases, but still refused to provide information on any assessment-related data, tax audits and risk management system data and, in particular, a copy of the tax files. The court had to decide whether tax offices are obliged to grant full access to tax files under Article 15(1) GDPR. The Tax Court of Munich (Finanzgericht München - FG München) held that by handing over the additional copies of its databases at the court hearing, the tax office fulfilled its duty under Article 15(1) GDPR. The data subject was not entitled to further disclosure. On the applicability of the GDPR: The court determined that the GDPR and the data protection provisions of the German General Tax Code (AO) are applicable to the processing of personal data by tax offices. By referring to its previous decision (FG München 15 K 81/20) the court confirmed that the area of direct taxation is not excluded from the scope of the GDPR under Article 2(2)(a) GDPR. Furthermore, the court extensively discussed the material scope of application according to Article 2(1) GDPR. At first, it referred to the decisions of the CJEU in C-434/16 and C-141/12+C-372/12 to establish that only legal evaluations do not constitute personal data but all other content referring to the fiscal situation of the data subjects does. This includes all assessm
In May 2018, an employee at a restaurant lodged a complaint against camera surveillance at the work place. One year later, the Norwegian DPA (Datatilsynet) requested additional information from the company running that restaurant (the Company). Even though the Company replied within a few weeks, the DPA did not follow up again until March 2020. After receiving more information from the Company, it took another five months before the DPA managed to issue a preliminary decision, which included an injunction to end the camera surveillance due to the lack of a valid legal basis as per Article 6(1)(f) GDPR and a fine of €30,382 (NOK 300,000) for breaching Article 6(1)(f), 13 and 24. After the Company shared its comments and objections to the preliminary decision, the DPA issued a final decision where the fine was reduced to €20,255 (NOK 200,000) due to the company's financial situation under the COVID-19 pandemic. The Company argued that the administrative fine was too high and therefore appealed the decision before the Norwegian Privacy Appeals Board. After reviewing the case, the DPA decided to uphold its decision, and the case was submitted to the Privacy Appeals Board (Personvernnemnda, PVN) for consideration. The PVN agreed with the DPA that the the Company had infringed Article 6(1)(f) GDPR because of the absence of a valid legal basis for the processing of personal data through the installation of surveillance cameras. However, the PVN considered that the breach of Article 6 GDPR as not as serious as the DPA had found. In the opinion of the PVN, the breaches of Article 13 and 24 GDPR were more serious. After an overall assessment, the PVN concluded that the amount of the administrative fine for such violations should be limited to €10,127 (NOK 100,000). After considering the length of the procedure, however, the PVN decided to annul the fine altogether due to the DPA's long case processing time (i.e. in total, almost three years).