GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The two claimants are The Open Rights Group and The3million, who are respectively a UK-based digital campaigning organisation working to protect the rights to privacy and free speech online and an organisation campaigning for EU citizens in the UK. In August 2018, they brought a judicial review claim against the lawfulness of the immigration exemption in paragraph 4, Schedule 2, of the Data Protection Act 2018 ('DPA 2018'), which was brought into force on 25 May 2018 ('Immigration Exemption'). They argued that the Immigration Exemption is contrary to Article 23 GDPR and incompatible with the rights guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the EU. [https://www.bailii.org/ew/cases/EWHC/Admin/2019/2562.html The High Court (Admin) judge dismissed these claims]. The claimants appealed this decision, which [https://www.bailii.org/ew/cases/EWCA/Civ/2021/800.html the EWCA allowed in May 2020]. At this stage of the appeal, it held the “Immigration Exemption” was indeed contrary to Article 23 GDPR. It nonetheless did not decide what form of relief should be granted at that stage, because this issue raised legal issues that needed to be carefully assessed in separate proceedings. As such, the decision on relief was deferred to this case. To decide what form of relief it should grant the claimants, the EWCA first analysed whether it (1) had jurisdiction to suspend relief for a period of time and, if so (2) whether/to what extent/for how long it should exercise it. = The EWCA first stated that the UK GDPR is retained EU law and therefore has supremacy over domestic primary legislation. It nonetheless explained that this does not entitle the court "to make a quashing order in respect of primary legislation", as this would be constitutionally improper, but only to "make a declaratory judgment or order". It summarised the test to be followed, which essentially mirrors the provisions in [https://www.legislation.gov.uk/ukpga/2018/16/section/6 sectio
The controller is a tax authority. In October 2020, the data subject requested to be provided with copies of files containing his personal data pursuant to Article 15(3) GDPR. The controller refused, arguing that the right to access of Article 15 GDPR does not entail all internal processes of the controller or the right to have all exchanged correspondence, which is already known to the data subject, printed out and sent again. The Finance Court Berlin-Brandenburg (Finanzgericht Berlin-Brandenburg - FG Berlin-Brandenburg) fully rejected the data subject's claim. The court began with clarifying that - contrary to the controller's position - the GDPR is applicable to the administration of direct taxes in the area of tax administration. Furthermore, all information contained in a tax file is generally personal data. Then, the court held that the data subject rights enshrined in Article 15(3) GDPR do not entitle the data subject to be provided with copies of personal data in the form of (electronic) duplicates of entire files by the controller. According to the court, Article 15(3) GDPR only contains a right to the catalogue information pursuant to Article 15(1)(a)-(h) GDPR. The FG Berlin-Brandenburg based that decision on a narrow interpretation of the provision, arguing that Article 15(1) and 15(3) GDPR do not contain two independent rights but rather a single right. First, the court argued that it was sufficient for the data subject to receive a complete overview of the data reproduced in the draft document - i.e. including personal data contained in the legal analysis - in an intelligible form instead of a copy of the document or the original file containing that data. This had been decided by the [https://curia.europa.eu/juris/document/document.jsf?text=&docid=152065&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=8085503 CJEU] in the context of the previous Data Protection Directive and had to be applied for the purpose of the interpretation of
Controller is a tax office. Data subject is an individual whose income from self-employment was audited. Data subject found that their personal data was processed unlawfully, and requested the Financial Court Berlin-Brandenburg to order the controller to pay (effective punitive) damages pursuant to Article 82 GDPR. The chairman on the Court informed the parties on 21.04.2021 that the claim for damages possibly needed to be brought before the ordinary courts, rather than the financial courts, since this could be regarded a claim for official liability (Article 34 GG and Article 40(2) VwGO). Data subject found that Article 82 GDPR constitutes a separate basis for a claim, and found that the financial court was compatible to rule. The Court held the claim is inadmissible. The Court stated that a claim, pursuant to Article 82 GDPR, directed at state authorities, must be asserted in accordance with the procedural rules of the respective Member State for the enforcement of claims in the event of breaches of official duties, in Germany therefore before the ordinary courts (Article 34 GG, Article 40(2) VwGO). Moreover, the Court considered the reference to Article 79(2) GDPR from Article 82(6) GDPR, and the fact that one could argue that Article 82(6) GDPR overrides Member State procedural law. The Court, however, noted that Article 79(2) GDPR only regulates international jurisdiction. This means that this provision only regulates which courts of which state have jurisdiction in a claim for damages, and does not regulate which court within a Member State is compatible to handle such a claim. The Court claimed that this interpretation is supported by recital 145 because this recital only addresses cross-border situations, and the fact that the European Parliament and the Council of the European Union already have no regulatory competence for the procedural enforcement of claims within the Member States.
The defendant is an auto-mobile manufacturer, the claimant was employed by the defendant and responsible for the development of diesel engines. After anomalies in connection with the diesel engines became known, the defendant began to start internal enquiries to investigate the diesel gate. In the course of the investigations, the defendant repeatedly asked the claimant to give consent for the transfer of personal data, private correspondence and personnel files to investigative authorities in the USA. However, the claimant only partially consented to the transfers. In this context, the claimant made an initial data subject access request to the defendant in 2016 for information about the data to be transferred to the USA and the results of the investigations. Ultimately, the claimant was given a warning in connection with the investigations and the defendant terminated the employment relationship. At the termination hearing, the claimant made a further data subject access request against the defendant in August/September 2018. The defendant responded to this second request and sent copies of 938 documents which originated from the claimant's account and business equipment. The documents provided were partially anonymised and redacted. In December 2018, the claimant then requested the defendant to provide more information. At trial, the claimant claimed damages from the defendant under Article 82 GDPR for unlawful processing of the claimant's personal data. The claimant claimed that the processing was unlawful due to a lack of transparency, the unlawful transfer of personal data to US authorities and the improper handling of the data subject access request. According to the claimant, the defendant had not provided all relevant personal data when answering the data subject access request. The data submitted was unusable, as some of it had been redacted on 96% of its pages or consisted only of publicly accessible documents such as press releases. The information had
The data subject called the helpline of the Österreichsiche Post AG (Austrian Postal PLC). He gave his phone number to the employee with the request for a callback, thereby stating that he did not want the phone number be given to a third party. Afterwards the data subject was called twice by a market research institute – the processor. The controller and the processor had concluded a processing-contract under Article 28 GDPR. The data subject filed a complaint with the DSB (Austria) arguing that the transmission of his data (name and phone number) to the processor was illegitimate since he had already denied consent to any form of data sharing with a third party. During these proceedings the data subject amended their submission by also tackling the use of cookies by the controller. The DSB dismissed the complaint. The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision of the DSB. The court determined that the processor is to be seen as a dependent extension of the controller (“verlängerter Arm”) (cmp. Article 29 GDPR). If the processing of data is in accordance with Article 6 GDPR, the controller is free to deploy a processor. As a result, the transmission of data from the controller to the processor itself does not need to be justified under Article 6 GDPR. In the case at hand, the court came to the conclusion that the processing of data by the controller - and therefore also the transmission to the processor - is justified under Article 6(1)(c) GDPR. The controller in this case - the Österreichsiche Post AG - is obliged under national law (§§ 6(8), 32(3) PMG) to provide for a complaint management system to improve their services. According to § 6(8) PMG a postal service must further develop its service in accordance with the needs of users and to contribute to securing the provision of postal services and to the further development of them by means of appropriate measures and proposals. Pursuant to § 32(3) PMG postal servic
The complainant, a teacher working in the profession for 20 years, appeared in a smartphone-app on which both schools and teachers are evaluated by students. The app lists the personal information of the teachers, including their name, academic degree, office title, profession and the associated school. The teacher filed a complaint with the Austrian supervisory authority, alleging a violation of their right to confidentiality and requesting a pseudonymisation of the name. The operator of the app stated that evaluations only refer to the professional and not the private activities of the complainant. In this regard, the processing activities had been approved for legality and admissibility by the supervisory authority in an official procedure. Moreover, the personal data of the complainant was publicly available on the school’s website anyway. The supervisory authority dismissed the complaint, arguing that the interests of the general public and students were to be valued higher than those of the teachers concerned. In this regard, the processing also serves the exercise of their right to freedom of expression and information under [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12012P/TXT&from=EN Articles 10, 11 ECFR]. The complainant appealed the decision. The court upheld the position of the authority that the interest of the public in greater transparency in education and in improving the quality of education and teaching outweighs the confidentiality interests of the teacher. A pseudonymisation of the teacher’s names would limit these purposes. The appeal of the complainant was therefore dismissed. The court argued that the design and safeguards established by the app are sufficient to deal with the teacher’s concerns. The App relates exclusively to the professional sphere of the teacher’s life and evaluations are made only via predefined criteria that do not allow for free text or personal attacks. Furthermore, the evaluations are only displ
The data subject worked as a cook for over 20 years for the controller. In 2019, the data subject requested detailed information in accordance with Article 15 GDPR after he had received a warning from the controller and was transferred. The request concerned these two processes. The controller did not comply with the request. The defendant claimed before the Labour Court of Berlin that, since he had remained in the dark about essential factors of the data processing, he was entitled to damages pursuant to Article 82 GDPR. He argued that a claim for damages in the amount of €250 per month per infringement was appropriate because the infringement had lasted for more than 16 months. As a result of the months-long delay in providing information, he had been prevented from assessing whether and how the defendant had been processing his personal data. The Labour Court of Berlin dismissed the action insofar as it was relevant to the appeal. It held that it was unclear what the exact aim of the data subject's access request had been. With his appeal, the data subject pursued a claim of damages in the amount of at least €8,000 by the controller. The Regional Labour Court of Berlin-Brandenburg partly upheld the claim. It granted the data subject damages in the amount of €2,000. It held that information was not given correctly as requested and that the controller should have regarded Article 15 GDPR in full. Contrary to the first instance court's opinion, the data subject had sufficiently specified his access request. The controller had neither indicated whether and, if so, to which persons or bodies it had disclosed or would disclose the transfer process, nor when or according to which criteria the data would be deleted. Nor did the controller indicate the existence of the data subject's rights pursuant to Articles 12 et seqq. GDPR. The court concluded that it was indeed so obvious that this information was missing that the controller could have ascertained what the data
The applicant complained to the DPA of the State of North Rhine-Westphalia (the LDI) about the actions of the District Court of C. He worked for several decades as a civilian employee for the police authorities and intelligence services. In 2016, he was charged with tax evasion by the District Court of C. and eventually was sentenced to a suspended sentence of imprisonment. Following an appeal, the case was referred back to this Court. The proceedings there are still ongoing and are currently suspended. The complainant argued that apparently the investigation file, which had been received by the Court, together with the indictment, had been copied in full or at least a substantial part and distributed to third parties. These parties included journalists of the T. Zeitung (Z), who had reported on the allegations against the applicant in their articles before the case was known to the public. Moreover, the day before the opening of the main hearing, the newspaper again carried an extensive report using personal data from the indictment. Further letters also showed that Z had knowledge of the contents of the criminal case file. The complainant, by letter dated 15 December 2017, requested the DPA, to take measures against the District Court of C., i.e., to prohibit the Court from transferring the judicial files concerning him in whole or in part to the press authorities or to reconstruct the criminal file for that purpose. In response, in early 2018, the DPA replied that courts are largely exempt from scrutiny by the DPA. The inadmissible disclosure of court records falls within the field of jurisdiction or justice, not administrative action. Consequently, the DPA was unable to provide assistance within the scope of its competence. The authority in its letter did not indicate to the claimant how he could appeal against this position. One and a half years later - in September 2019 - the complainant filed a lawsuit requesting the enforcement of the GDPR by the LDI, namel
A shop owner tied admission to a loyalty scheme to the presentation of an eID (i.e. a Belgian electronic identity card). A data subject refused to provide his eID, considering that such data processing was excessive and not proportionate when taking into account the purpose of the processing. The data subject further filed a complaint before the Belgian DPA (APD/GBA) for being deprived of the advantages conferred by the loyalty scheme. On 17 September 2019, the Belgian DPA fined the shop owner for requiring customers to present their eID in order to obtain a loyalty card and imposed a fine of €10,000. The shop owner appealed that decision. The imposed fine of €10,000 was later annulled by the Court of Appeal of Brussels, because (i) the new eID legislation could not be applied retroactively ; (ii) the fine was not sufficiently justified and (iii) the data linked to the eID of the Complainant had actually not been processed by the shop owner, since the data subject had refused to provide such eID. The Belgian DPA contested the legality of such a decision before the Supreme Court of Belgium. The Supreme Court annulled the decision of the Court of Appeal of Brussels because it considered that the Court of Appeal did not correctly apply the law. The Supreme Court considered in particular that the Court of Appeal of Brussels erred in law by not properly considering whether the compulsory reading of an identity card as the only mean of creating a customer loyalty card is contrary to the principle of data minimisation under Article 5(1)(c) GDPR, and contrary to the obligation to obtain the freely given consent of the data subject under Article 6(1)(a) GDPR, when refusal to provide such data results into a disadvantage for the data subject (such as not being able to obtain discounts). The Supreme Court stated that the Court of Appeal should have considered the loss of an advantage in assessing whether consent is freely given under GDPR. It also confirmed that the Belgi
The controller is a health insurance company. The data subject entered into a contract for private healthcare insurance with the controller. During the term of the contract, the controller repeatedly increased the premiums and informed the data subject accordingly. The data subject initially paid the increased premiums without reservation, but subsequently suspected unlawful premium adjustments. To obtain a refund of premiums, the data subject used a request for information in connection with a staged action pursuant to section 254 ZPO, and requested the controller to submit the supplements to the insurance policy, justifications for the adjustments, as well as further information sheets. The controller, however, claimed that the requested documents were no longer available and refused to send them. Moreover, they also stated that the request for information was inadmissible, as the information requested by the data subject did not serve to quantify the claim. The data subject then brought the action before court. The Court had to decide, inter alia, whether the data subject's request, if interpreted as a an access request under Article 15 GDPR, was admissible from a data protection perspective. The Court held that the access request was vexatious and declared the action partially inadmissible and unfounded. The claim was dismissed. According to the Court, the data subject's request was unfounded under both civil law and data protection law. The Court held that the request for information could not be regarded as an access request under Article 15(1) GDPR. According to Recital 63 GDPR, the right of access under Article 15 GDPR serves data subjects to be informed about the processing of their personal data and to verify the lawfulness of the processing. By making such requests, data subjects should be empowered to assess the scope and content of the data processed in order to be able to assert further rights under the GDPR. In the present case, the data subject
The claimant requested the defendant to remove certain special codes, that link to their creditworthiness, from the Central Credit Information System (CKI) of the Bureau for Credit Registration. The registration of these special codes had resulted from the claimant's inability to repay their mortgage debt to the defendant. The registration was dated September 2018 and remained in effect for a period of five years. Hence, the claimant would not be removed from the BKI until September 2023. Since the registration had the effect of preventing the claimant from taking out a new loan, the claimant requested the defendant to remove their personal data from the CKI. However, the claimant made some procedural mistakes. They first requested their personal data to be removed on 22 August 2019. The defendant rejected to this request on 10 September 2019. Afterwards, the claimant lodged an appeal to this decision, but erroneously brought the defendant's sister company to Court. The claimant submitted their second request for deletion, which was identical to the first one, on 28 April 2020. After the defendant rejected the request again, the claimant submitted appeal to the decision. However, this time, they brought the right party to Court. In the first instance, the claimant demanded the removal of the registration accompanied by a daily penalty payment. The Court ordered the defendant to remove the registration on 1 January 2023 instead of September 2023. However the demanded penalty payment was rejected. The applicant did not agree with the ruling and brought the case for appeal. The claimant put forward three grounds of appeal against the contested decision. First of all, the claimant points to the wrongful absence of relevant facts. Secondly, the claimant argued that the Court should have first assessed whether the registration was still necessary before weighing up the interests. Finally, the claimant challenges the Court's finding that the registration should no
The controller is a credit reference agency. The data subject is a private person over whose assets, insolvency proceedings were opened. In the course of the insolvency proceedings the data subject was granted a discharge of residual debt, which the controller added to the data subject’s credit report as a negative entry. The data subject unsuccessfully requested the controller to remove the entry and the subsequent applications for an injunction were rejected for lack of merit at trial. The data subject argued that the negative entry was to his detriment as it restricted his ability to participate in economic life. In particular, he could not obtain overdrafts, finance property or car, or place internet orders on account. He argued that the processing of the data on the discharge of residual debt by the controller was unlawful. The data subject requested, inter alia, to order the controller to remove the entry. The controller instead justified the processing with the necessity to provide its contract partners with facts to assess the data subject's creditworthiness. Deleting the entry would deceive potential lenders and possibly induce them to grant a loan without having sufficient information on the data subject's actual creditworthiness. The court had to decide whether the data subject was entitled to have the negative entry deleted and whether the data subject was entitled to injunctive relief against the controller’s data processing in connection with the discharge of residual debt. The appellate court dismissed the claim. It held that the requirements for a claim for erasure pursuant to Article 17(1) GDPR were not met, and the processing is lawful pursuant to Article 6(1)(f) GDPR. Pursuant to Article 17(1), data subjects have the right to demand from the controller that their personal data be deleted without undue delay, provided that one of the grounds specified in the provision, applies. This is in particular the case if there are no overriding legitimate
In accordance with Article 15(3) GDPR the claimant, as the data subject, demanded in a pre-action measure that the defendants provide them with copies of all of the claimant’s personal data held by the defendants. In particular, the claimant requested copies of telephone notes, memos, protocols, e-mails, letters and underwriting documents for capital investments. The defendants subsequently provided information on the claimant’s personal data in accordance with Article 15(1) GDPR. However, they did not provide the claimant with copies of the documents. The refusal to provide the copies was based on the defendants' argument that Article 15(3) GDPR only governs the method in which information is provided, but does not confer an entitlement on the data subject to be provided with copies. In the subsequent trial, the claimant widened their claim and demanded that the defendants be ordered to provide them with copies of all personal data, including the requested notes, memos and documents. At trial, the court found that the data in question was in fact personal data and ordered the defendants to provide the claimant with copies of all her personal data. The defendants appealed to the OLG Munich to revoke the decision of the trial court. The OLG Munich had to decide on the question if a claim under Article 15 GDPR entitles the data subject to be provided with copies of their personal data and whether Article 15(3) GDPR contains an independent entitlement to have a copy of the personal data handed over to the data subject. The appellate court dismissed the defendants' application and upheld the trial court's decision to order the defendants to provide the claimant with copies of all her personal data. The Court found that an individual who is entitled to information under Article 15(1) GDPR is also, independently, entitled to receive copies pursuant to Article 15(3) GDPR. Both paragraphs concern the same subject matter – personal data – but are different entitlements
Controller is a private landlord, the data subject is their tenant. During an eviction dispute, the data subject filed an access request pursuant to Article 15 GDPR. The controller, however, rejected to comply with the request because it did not store any personal data as a private landlord. Hence, in their opinion, the GDPR did not apply. The data subject was of the opinion that the controller did process data, since their mobile phone number was used for the purpose of communication. Moreover, the controller commissioned an external company to prepare the utility bill. [https://www.lareda.hessenrecht.hessen.de/bshe/document/LARE210000903 The District Court of Wiesbaden acknowledged the data subject’s claim]. It held that the data subject’s personal data was clearly processed, and that none of the exceptions of Article 2(2) GDPR applied. Hence, it concluded the landlord violated Article 15 GDPR. The landlord filed appeal against this decision. The Regional Court of Wiesbaden rejected the appeal. It stated that the controller does process personal data. It noted that the personal data from the rental agreement is processed further by the external company in preparation for the utility bill. According to the Court, at that moment, "computer-aided processing takes place", which results in the company being a processor in accordance with Article 4(8) GDPR and Article 28 GDPR. Moreover, the Court notes that the controller processed data subject's personal data because they communicated via WhatsApp. Lastly, the Court stated that it is obvious that there is no abuse of the right to access, since the data subject's access request, and decided that the controller had to comply with the access request pursuant to Article 15 GDPR.
A data subject (the Complainant) filed a complaint with the French DPA (CNIL) against the decision of an insurance company (CNP Assurances) to interrupt the reimbursement of his loan following a health control, on the ground that such control would not be compliant with the GDPR. As a first measure, the CNIL requested CNP Assurances to provide explanations with respect to the health control. The Complainant considered that the CNIL did not take sufficient measures against the infringements. The CE considered that the fact that the CNIL initially asked CNP Assurances to explain itself does not preclude the CNIL from adopting additional measures once a final decision is taken in the light of the response from CNP Assurances. In particular, the CE considered that asking the controller for explanations was merely a preparatory act in view of adopting an administrative decision. Therefore, the CE concluded that the CNIL had not committed any mistake by not yet issuing a formal notice or a sanction against CNP Assurances.
Applicant is the President of the Polish DPA (UODO) and defendant is a school (hereafter: controller). This appeal resulted from a decision by the DPA, in which it ordered the controller to remove certain processed' personal data of the complainant. The complainant is a teacher whose contract got terminated by the controller (her employer). She had received a notice of termination of her employment together with a statement of reasons, the content of which contained processed' personal data concerning her and her husband. She considered that she had never provided this personal data to the employer, and that this was not in line with the GDPR. Hence, she filed a complaint with the Polish DPA (UODO). In the justification for the termination of employment, the controller presented personal data obtained from public registers concerning the assets and income from complainant's business activity and agricultural activity, as one of the reasons for the termination. Furthermore, it stated that the processing of the this data resulted from the obligation to comply with all the orders imposed by law in terms of justifying the termination of the employment relationship for reasons beyond the employer's control (collective redundancies). In its decision, the DPA referred to the position of the Supreme Court in their judgement of 19 April 2019 (I PK 20/18), in which it held that the criteria for assessing the reasonableness of termination, such as family, personal or financial situation, do not fall within the concept of the reason for termination. They only constitute criteria for assessing the decision's legitimacy. In the light of the above, the DPA stated that the controller had no legal basis to process complainant's personal data obtained from publicly available public registers in the text of the termination notice, and thus violated Article 6 GDPR. Hence, the DPA ordered the controller to delete complainant's personal data concerning her assets and income from her bus
Controller (company B) is a company that collects debts. The data subject had a contractual relationship with a bank (company A), since they had a credit card account at this bank. The data subject experienced payment difficulties in 2017, which resulted in debt. Ultimately, this led company A to commission company B with the collection of the accumulated debt. Although it remained disputed between the parties whether the data subject and company B concluded a payment arrangement to pay off the debt, the data subject then paid instalment fees to company B to resolve the whole debt. However, company B still registered a claim for €1,546 with SCHUFA Holding AG. This is a credit reference agency that registers debt so that other companies can assess a customer's creditworthiness. The data subject then brought the action before the Regional Court of Lüneburg (Case number 3 O 143/20), in which the data subject and company A concluded a settlement, in which company A promised to have the registered claim of €1,546 removed from the database of SCHUFA Holding AG, pursuant to Article 17(1)(a) GDPR. Company B then contacted the SCHUFA Holding AG to have the claim removed, but the latter did not fulfil the request for deletion. On 10 February 2021, the data subject filed a complaint with the Hessian DPA. The DPA, however, rejected the complaint because it did not see a violation of the GDPR. Consequently, it held that there was no possibility of obliging SCHUFA Holding AG to delete the entry. It was assumed that an agreement on payment in instalments had not been concluded, even if the data subject had behaved in this way. The data subject appealed against this decision before the Administrative Court of Wiesbaden. The Administrative Court of Wiesbaden upheld the appeal. First, the Court considered that the Hessian DPA is the competent supervisory authority pursuant to Article 64(1)(a) GDPR, and that the Court is competent to hear the disputes pursuant to Section 20(1) a
A credit reference agency had processed payment experience data on a total of over EUR 1,300 on a data subject. Some of the debts underlying these data had already been repaid, some were still unpaid. In autumn 2019, the data subject requested erasure of all payment experience data under Article 17 GDPR. The credit reference agency refused, arguing a legitimate interest under Article 6(1)(f) GDPR. After the erasure request, the credit reference agency obtained further data on additional debts that the data subjects had failed to pay. The data subject filed a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB), arguing that the payment experience entries were old and therefore not suitable for assessing their creditworthiness. The data subject further claimed that the data were inaccurate. The DSB partially upheld the complaint and ordered the credit reference agency to erase the four oldest payment experience entries from their database. These entries concerned debts over EUR 66 (fully repaid in December 2014), EUR 60 (never repaid but collection ceased in August 2015), EUR 177 (fully repaid in October 2015) and EUR 84 (never repaid but collection ceased in December 2015). The credit reference filed an appeal against this decision with the federal administrative court (Bundesverwaltungsgericht - BVwG) The BVwG partially upheld the decision. It held that the credit reference agency must indeed erase the database entry on the EUR 60 debt (never repaid but collection ceased in August 2015) but may continue to process the remaining entries. It referred to existing BVwG case law, according to which the [https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX:32013R0575 CRR Regulation] (which obliges banks to assess creditworthiness based on information that reaches at least back five years in the past) can be used as a tool of interpretation to assess the legitimate storage period for payment experience data. The BVwG held that this five
The data subject is a French resident with a dual French and US nationality. They consider themselves as a French national rather than an American national because they have no link with the US, except for the fact that they were born there. In May 2020, they were informed by a banking institution in Luxembourg that they would be considered as an American national under the Foreign Account Tax Compliance Act ("FATCA"), and that the Luxembourg tax authorities would therefore share data relating to their bank account with the competent US authorities. The data subject objected to such processing and asked for the erasure of their personal data, but the Luxembourg authorities rejected this request by decision of 22 March 2021. They argued, among others, that the processing of the complainant's personal data was necessary for compliance with the Luxembourg Law of 24 July 2015 relating to FATCA. The data subject filed an appeal against the decision of 22 march 2021 with the Administrative Court of Luxembourg, and asked for urgent interim measures. The Administrative Court of Luxembourg rejected this appeal on the ground that the conditions for granting interim measures were not fulfilled. In particular, the Court found that none of the alleged breaches of the GDPR were serious or significant enough.
The data subject and his wife applied to the controller for real estate financing. For this purpose, they provided the controller with documents in various ways, including by e-mail and via a file transfer link. Also, they were given (an unencrypted) USB stick which they dropped into the controller's letterbox. This USB stick contained copies of identity documents, tax documents, data on existing properties, the advised property as well as other documents which were supposed to prove the financial capacity of the data subject and his wife. In the end, no contract was concluded. The controller returned the USB stick to the couple per letter. However, the USB stick never arrived. Hence, the data subject's wife contacted the controller because of the alleged loss of the USB stick. The controller initiated a "lost and found order", but this was unsuccessful. The data subject asserted non-material claims for damages against the controller in connection with the alleged loss of a USB stick containing his, and his wife's personal data. Hence, he requested the controller to pay damages in the amount of €25,000 on the basis of Article 82 GDPR. The controller refused payment. Subsequently, a claim for payment of €30,000 was brought before the court. The Court dismissed the action as unfounded and held that the data subject is not entitled to the asserted non-material claim for damages against the controller, although it was undisputed that the controller had not notified the DPA about the loss of the USB stick. The Court held that the data subject did not sufficiently substantiate that he and his wife suffered concrete non-material damage. The Court found that the defendant violated Article 34(2) GDPR, because he only informed the data subject of the alleged data loss. However, the information obligations of Article 34 GDPR provide, beyond the mere information about the data loss itself, that the information and measures mentioned in Article 33(1)(b) to Article 33(1)(d) GDP