GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The data subject is a French resident with a dual French and US nationality. They consider themselves as a French national rather than an American national because they have no link with the US, except for the fact that they were born there. In May 2020, they were informed by a banking institution in Luxembourg that they would be considered as an American national under the Foreign Account Tax Compliance Act ("FATCA"), and that the Luxembourg tax authorities would therefore share data relating to their bank account with the competent US authorities. The data subject objected to such processing and asked for the erasure of their personal data, but the Luxembourg authorities rejected this request by decision of 22 March 2021. They argued, among others, that the processing of the complainant's personal data was necessary for compliance with the Luxembourg Law of 24 July 2015 relating to FATCA. The data subject filed an appeal against the decision of 22 march 2021 with the Administrative Court of Luxembourg, and asked for urgent interim measures. The Administrative Court of Luxembourg rejected this appeal on the ground that the conditions for granting interim measures were not fulfilled. In particular, the Court found that none of the alleged breaches of the GDPR were serious or significant enough.
The data subject and his wife applied to the controller for real estate financing. For this purpose, they provided the controller with documents in various ways, including by e-mail and via a file transfer link. Also, they were given (an unencrypted) USB stick which they dropped into the controller's letterbox. This USB stick contained copies of identity documents, tax documents, data on existing properties, the advised property as well as other documents which were supposed to prove the financial capacity of the data subject and his wife. In the end, no contract was concluded. The controller returned the USB stick to the couple per letter. However, the USB stick never arrived. Hence, the data subject's wife contacted the controller because of the alleged loss of the USB stick. The controller initiated a "lost and found order", but this was unsuccessful. The data subject asserted non-material claims for damages against the controller in connection with the alleged loss of a USB stick containing his, and his wife's personal data. Hence, he requested the controller to pay damages in the amount of €25,000 on the basis of Article 82 GDPR. The controller refused payment. Subsequently, a claim for payment of €30,000 was brought before the court. The Court dismissed the action as unfounded and held that the data subject is not entitled to the asserted non-material claim for damages against the controller, although it was undisputed that the controller had not notified the DPA about the loss of the USB stick. The Court held that the data subject did not sufficiently substantiate that he and his wife suffered concrete non-material damage. The Court found that the defendant violated Article 34(2) GDPR, because he only informed the data subject of the alleged data loss. However, the information obligations of Article 34 GDPR provide, beyond the mere information about the data loss itself, that the information and measures mentioned in Article 33(1)(b) to Article 33(1)(d) GDP
The data subject is in a dispute with their former lawyer about the lawyer's fee claim. The attorney represented the data subject in proceedings concerning a traffic accident but terminated the mandate. A lawsuit over the lawyer's fee claim ensued. To proof his claim, the lawyer submitted the correspondence with the data subject to the court. The correspondence contained personal data such as car plate number, names, attending doctor, and the data subjects injuries from the traffic accident. The data subject takes the view that the personal data should have been masked before the documents were submitted to the court. In a letter to the lawyer, dated March 2016, the data subject complained about a breach of secrecy. The Bavarian Data Protection Authority (DPA) received a complaint from data subject in January 2019. In May 2019 the DPA replied that it considered the course of action by the lawyer not an infringement of data protection guidelines. Masking of personal data was therefore not necessary. The data transfer was a data processing under Article 4(2) GDPR. Legal basis was Article 6(1)(f) GDPR and the data processing was necessary to pursue a legitimate interest. The pursuit of a fee claim is considered such a legitimate interest. Article 9(1) GDPR specified that health data, such as injuries from an accident, are special categories of data. The DPA holds, that the requirement in Article 9(2)(f) GDPR for processing special categories, was fulfilled. The processing was necessary to exercise a legal claim. While masking of the personal data was technically possible, the data processing (without masking) was necessary to reinforce the fee claim with authentic evidence. Generally, it must be possible to submit unaltered evidence in a law suit. Otherwise any evidence would bear the risk of potential data law infringement. Courts and attorneys are subject to the professional duty of confidentiality, which the DPA considered a sufficient data protection measure for
In December 2018, the data subject filed with the DPA (the defendant in this case), a complaint under Article 77 GDPR against a lawyer who had represented the data subject in a traffic accident, before he terminated the mandate. In court proceedings after this termination, in which the lawyer's fee claim was at issue, the lawyer had submitted to the court a volume of documents containing extracts of all correspondence with the opposing insurance company, in which personal data and business secrets had not been blacked out. Since data subject had not released the lawyer from data protection and confidentiality, the data subject perceived this to be a breach of confidentiality. By letter dated 30 March 2016, the data subject contacted the lawyer regarding this breach. The data subject also complained to the Court about the lawyer's conduct, but this did not lead to any action undertaken by the Court. DPA acknowledged receipt of the complaint by letter dated 7 January 2019. In response to this complaint dated 31 May 2019, the DPA informed the data subject that it did not see any breach of data protection law in the conduct complained of and that there was therefore no reason for further supervisory measures pursuant to Article 58 GDPR. The lawyer was under no obligation to make the data subject's data unidentifiable when forwarding it to the court. According to the DPA, this processing was legitimised under Article 6(1)(f) GDPR since the pursuit of fee claims undoubtedly constitutes a legitimate interest of the lawyer. Moreover, the DPA held that, insofar as the personal data transferred were data belonging to special categories of data within the meaning of Article 9(1) GDPR (such as information on the consequences of the accident/injuries suffered by the data subject in the accident), the additional requirements of Article 9(2) GDPR were also met, as the transfer had been necessary for the assertion of legal claims. The data subject then brought the action to the Co
The plaintiff requested the defendant, the Board of Directors of the Uitvoeringsinstituut werknemersverzekeringen (UWV, Employee Insurance Agency), to provide access to phone notes and the deletion of these notes. The plaintiff was granted access to the phone notes pursuant Article 15 of the GDPR, but the defendant did not delete them. The defendant argued that the GDPR and the Archive Act must be seen in relation to each other. The phone notes were part of the file that was kept by the defendant in order to carry out their official authority (Article 6(1)(e) GDPR) and had to be saved for the required retention periods according to the Archive Act, which is an exemption from the Article 17 GDPR right to erasure. The plaintiff argued that the processing of the phone notes was not necessary, but the court agreed with the position of the defendant: because the plaintiff made an application for unemployment benefits, initial processing of the phone notes was lawful. Pursuant to Article 30 of the Wet structuur uitvoeringsorganisatie werk en inkomen (Work and Income Implementation organisation Structure Act) the defendant had a duty in the public interest and could therefore base the processing of personal data on Article 6(1)(e) GDPR. The court held that pursuant to Article 17(3) GDPR there is no obligation for a government body to erase personal data if it is subject to a statutory processing obligation. The court also held that there was no obligation to delete plaintiff's personal data from the phone notes pursuant to Article 5(1)(e) GDPR, because Article 3 of the Archives Act precludes the later modification of archival documents.
The appellant is the owner of an arable farm ('the partnership'). The defendant is the Minister of Agriculture, Nature and Food Quality. The Minister informed the partnership that its name, address details and so-called Chamber of Commerce number will be passed on to the Sector Organisation for Arable Farming and that the partnership can object to this on the basis of the GDPR. The Minister wished to provide this information from the partnership to the Sector Organisation for Arable Farming so that it could implement a 'Joint Research and Innovation Programme', as part of which agricultural companies are required to register and make financial contributions. The partnership requested that its data not be passed on. They believed that the transfer of her data was contrary to the GDPR, because she did not consent to it. The information had originally been collected as part of an annual report about agricultural and technical data that is mandatory for the appellant's company. As part of that report, it explicitly denied permission to transfer data to "trade associations". The court in this appeal had to determine whether the Minister may pass on this information about the partnership to the Sector Organisation for Arable Farming. The court in turn assessed the lawfulness of (1) the original processing and (2) all further processing. (1) The original processing consisted of the Minister obtaining the agricultural and technical data of the partnership per Article 24 of the Agriculture Act in order to carry out a task of public interest as referred to in Article 6(1)(e) GDPR. The purpose of collecting this agricultural and technical data is the agricultural census, which describes the structure of the Dutch agricultural sector for the purpose of research and the development of policy. Of the data obtained for this purpose, the minister only wants to pass on the name, address and so-called Chamber of Commerce number of the partnership to the Sector Organisation for A
The data subject did an apprenticeship from 1978 to 1983. The pension notice mentioned her apprenticeship with 31 months. This was the period which the defendant acknowleged as being eligible for the data subject's pension. The data subject did not contest this notion of the defendant. However, with her claim before the Social Court of Hamburg (Sozialgericht Hamburg - SG Hamburg) she requested clarification that her apprenticeship did not only take 31 months but 5 years. She was afraid of drawbacks on account of an official document mentioning only 31 months. The Social Court of Hamburg denied her request. The Regional Social Court (Landessozialgericht Hamburg - LSG Hamburg) upheld the decision of the Social Court on the basis of the Social Court's reasoning. In its not published decision, the Social Court of Hamburg referrered to the beginning of the second sentence of Article 16 GDPR which states that the pruposes of the processing have to be taken into account. As a consequence, it reasoned that the concept of completeness in Article 16 GDPR is to be understood relatively and not absolutely. Personal data is therefore only incomplete in the sense of Article 16 GDPR if it is so incomplete that the purpose of the processing can no longer be achieved. Insofar as the data satisfies the (possibly very specific) purpose determined by the controller, the data subject cannot demand the inclusion of additional data which, from his point of view, is supposedly useful in the respective context but is not necessary to achieve the purpose. The purpose of listing the periods in the contested notice of the defendant was to justify the amount of the pension granted. This was already apparent from the fact that the insurance history was preceded by the explanatory statement that the list contained data that is relevant for determining the amount of pension. The insurance history did not serve the purpose of presenting a complete curriculum vitae of the plaintiff.
The Regional Government of Åland had appointed Mr A as head of the regional Ålandic DPA for a probationary period of one year. Pursuant to section 10(2) of the Act on Public Officials in the Region of Åland, the Government of Åland stated that they would not propose the appointment of A to a permanent post and that A's term of office would therefore automatically come to and end after the one-year probationary period. At the end of the probationary period, the Government of Åland issued a notice confirming that Mr A's term of office had ended. Mr A however applied to the Supreme Administrative Court of Finland for the annulment of this decision, which he considered contrary to the GDPR. The Supreme Administrative Court considered that the notice issued by the Government of Åland constituted an administrative decision terminating Mr A's mandate. The Supreme Administrative Court found that, in addition to national legislation, A's role as head of the data protection authority is also regulated by EU law, and in particular by the GDPR. Although the GDPR does not contain explicit provisions regarding probationary period, the minimum length of the term of any member of any data protection authority is "no less than four years", as set in Article 54(1)(d) GDPR. As a consequence, the termination of A's mandate at the end of the probationary period could not be considered in line with the GDPR. The Supreme Administrative Court further noted that leaving Mr A without any possibility of appeal against that decision would be contrary to the right to a fair trial as protected under the Finnish Constitution, Article 19 TFEU and Article 47 CFR. As Mr A's mandate and termination had not been assessed in the light of the provisions of the GDPR, the Supreme Administrative Court concluded that the decision to terminate Mr A's mandate had to be annulled and the matter referred back to the Government of Åland for reconsideration.
The case focused on unauthorized marketing emails and lack of consent, unrelated to cookie or consent banner issues.
The data subject filed a complaint with the Austrian Data Protection Authority (DSB) against the controller, requesting to be provided with recipients to whom the personal data had been shared under Article 15(1)(c) GDPR, rather than mere categories of recipients. The controller refused, arguing that a controller has a right to choose whether to provide a data subject with information on actual data recipients or rather just categories thereof. Further, the controller argued that the disclosure of actual data recipients would reveal its trade secrets. The DSB upheld the data subject's complaint and ordered the controller to provide the data subject with information on the actual data recipients. The controller filed an appeal against that decision with the Austrian Federal Administrative Court (BVwG), repeating its arguments brought forward before the DSB. The BVwG did not (yet) take a decision on the merit of the case but stalled the procedure because the Austrian Supreme Court (OGH) had already filed a request for preliminary ruling on the question the interpretation of Article 15(1)(c) GDPR in February 2021. Once the CJEU has passed its judgment on the matter, the BVwG will reopen the case.
In the opinion of AG Bobek, data such as phone number and car chassis number must be considered as personal data in the sense of Article 4(1) GDPR when relating to identified or identifiable individuals selling their cars via a specialized website. AG Bobek is also of the opinion that Article 6(1)(c) GDPR and Article 6(3) GDPR do not preclude national rules from laying down, without any limit in time, an obligation for Internet advertising service providers to communicate certain personal data to a tax authority, as long as there is a clear legal basis in national law for such a type of data transfer and the data requested are suitable and necessary for the tax authority to complete its official tasks. SIA ‘SS’ (‘the applicant’) is a company specialized in online advertising services. Private individuals may post and advertise various products on the applicant's website ([https://www.ss.com www.ss.com]) with a view of selling them. These products may include vehicles such as second-hand cars or motorbikes. On 28 August 2018, the director of the Latvian Tax Inspection Office (‘the defendant’) sent to the applicant request for information on the basis of Article 15(6) of the Law on taxes and duties. In that request, the defendant asked the applicant to renew the defendant's access to information, and in particular information on (1) the telephone numbers of advertisers ; (2) the chassis numbers of vehicles featured in advertisements published on the applicant’s website, and (3) information on advertisements published in the ‘Motor Vehicles’ section of the website during the period from 14 July to 31 August 2018. The applicant was asked to send the information electronically, in a format that would allow the data to be filtered and selected. The applicant was also asked to include the following information in the data file: a link to the advertisement, advertisement text, make of vehicle, model, chassis number, price, vendor’s telephone numbers. The applicant lodg
The controller operates a social network and an online platform. The data subject created a customer account there using his law firm e-mail address. In July 2020, the data subject demanded damages from the controller because of an alleged data protection incident from January 2019 on the website to his e-mail address. The controller replied, telling the data subject that it did not own the website. Therefore, it informed the data subject how and via which URL he could view and download a complete copy of the data stored about him within his user account. The data subject claimed that the URL links sent by the controller were useless because they showed “page not found” when called. The data subject sought damages for an alleged data breach. He claimed that the defendant did not answer his request for information. The data subject had initially claimed that his data was stolen from his account as part of a hack in February 2019. In 2021, the data subject submitted that a data protection incident regarding his e-mail address was no longer at stake, but rather his account on the platform. He alleged that he lost control of his data as a result of the breach of his right to information and the data leak made possible by system errors. According to him, this amounted to an immaterial damage to be valued at least € 4,500 due to the seriousness of the data protection violation. Before the court, the data subject requested to order the controller to pay him € 6,650 plus interest. The controller submitted that it fulfilled its information obligations under the GDPR. It argued that its information system was customary in the market. Furthermore, the data subject no longer responded to the notification of the links. In addition, the controller denied a data protection incident concerning the plaintiff's e-mail address. The Regional Court of Munich rejected the data subject's claim. It held that the mere allegation that damage has occurred due to the loss of control over dat
This case is an appeal of the decision DT-20/01790 by the Norwegian DPA (Datatilsynet), in which it fined a store approximately €40,340 (NOK 400,000) for the unlawful disclosure of personal data from a surveillance footage, thus breaching Article 5(1)(a) GDPR and Article 6. The complainant argued that the size of the administrative fine imposed, was too high and therefore appealed the DPA's decision. After reviewing the complaint, the DPA decided to uphold it, and the case was therefore was submitted to the Privacy Appeals Board (Personvernnemnda) for consideration. Personvernnemnda (PVN) agreed with the DPA that the infringement in question was correctly defined as a breach of Article 5(1)(a) GDPR and Article 6(1)(f). However, the PVN did not agree that the infringement was as serious as interpreted by the DPA, quoting specifically the short duration of the footage (3 seconds), that it did not show any faces or the theft itself, did not concern any personal data as per Article 9 GDPR or Article 10 and was deleted after a few days. The PVN noted that forwarding the footage and the fact that it involves children, are aggravating circumstances, however there was no evidence that the data subjects were harmed in any way. After an overall assessment, the PVN concluded (under doubt) that an administrative fine for such a violation should be around €5042 (NOK 50,000), however they also removed the fine entirely due to the DPA's long case processing time (over two years). Following the PVN's decision, the complainant submitted a claim for coverage of their legal costs related to this case. The PVN agreed and awarded the complainant €6959 (NOK 69,000), cf. [https://www.pvn.no/pvn-2021-15 PVN-2021-15].
The appellant is a company which ran a loyalty programme for which it collected and processed data subjects’ personal data. More precisely, it “combined and [analysed their] participation data and purchase data in order to send [them] individualised information on [the] programme that is relevant to me and tailored to my interests (…) in order to send [out] advertising with personalised offers about products and services of the operator and [its] partners.” It claimed this data would be deleted if individuals revoked their consent to such processing. The Austrian DPA, following an ex officio investigation into the company's data practices, found that it unlawfully processed the programme’s participants’ personal data because it failed to obtain their valid consent. In particular, the information on profiling was neither available in an easily accessible form nor formulated in clear and simple language, and could therefore not be used as a legal basis under Article 6(1)(a) GDPR. It is noteworthy that the company "had at no time relied on legitimate interests within the meaning of Article 6(1)(f) GDPR as a legal basis for processing for the purpose of profiling", and the DPA originally found that such a balancing of interests would in any case turn out against it. The company filed a first appeal against this decision. The DPA therefore had to issue a preliminary ruling on its original decision, which it ultimately upheld. The company then appealed this ruling to the Austrian Federal Administrative Court. (Please note: The Federal Administrative Court can only consider an appeal of this preliminary ruling). The appeal was deemed permissible because “[there was] no case law of the highest courts on the question of whether, in order to assess the lawfulness of data processing in the case of invalid consent pursuant to Article 6(1)(a) GDPR, it is permissible to have recourse to other permissible elements of Article 6 GDPR.” As such, this was the key issue in this case. I
The parties concluded a contract for the purchase of a laptop. Due to a hard disk defect, the claimant arranged for a repair with the defendant. Before returning the hard disk to the defendant, the defendant informed the claimant that they did not offer data backup- and data recovery services, that customers were "responsible for the security of their data" and that it could happen that "the hard disk may need to be deleted or replaced in the course of the repair". With this information, the claimant sent the hard disk to the defendant for repair. The hard disk contained the claimant’s personal data. Upon completion, the defendant returned a different hard disk to the claimant. This new hard disk did not contain the claimant's personal data. At trial, the claimant demanded compensation for unlawful processing of his personal data and information about its disclosure. He also claimed the surrender of the hard disk and applied for an injunction against the storage, disclosure or publication of the data on this hard drive. All claims were dismissed at trial. The appellate court had to decide whether, inter alia: # the implied consent to the deletion of the personal data is effective, # the claimant is entitled to further information under Article 15 GDPR even though the defendant had already communicated the non-existence of personal data, # the claimant has a valid claim for pecuniary damages under Article 1, in conjunction with Article 2(1) Grundgesetz or for non-pecuniary damages under Article 82 GDPR because of the loss of personal data. The appellate court dismissed all of the claimant's applications and upheld the decision of the trial court. The court held that personal data is processed when a hard disk containing personal data is physically destroyed under a contractual warranty. Regarding the effectiveness of consent to the deletion of personal data in the context of a repair, the court found that valid consent can be given through conduct implying intent.
A data subject requested erasure of a negative database entry from the database of an Austrian credit reference agency under Article 17 GDPR. The debt underlying the entry was EUR 38,83 and had been paid back in full only 17 days after a debt collection agency started to collect it from the data subject. Nevertheless, the credit reference agency refused to erase the data and the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde - DSB). The DSB upheld the data subject's complaint and ordered the credit reference agency to erase the data within two weeks. It held, that the data subject's interests outweigh those of the controller the in light of the insignificant amount of the debt and it's relatively quick payback. The credit reference agency filed an appeal against the DSB's decision with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG rejected the appeal and upheld the DSB's decision. In its reasoning it followed the DSB's assessment regarding legitimate interests. It further held, that the BVwG's case law on a five year storage period of payment experience data (in light of Regulation (EU) 575/2013) cannot be applied on the case at hand: these BVwG decisions dealt with data processing regarding significantly higher debt amounts and/or cases where there were multiple negative payment experience data in the credit reference agency's database.
The Flemish Authorities granted a tender to an EU based-entity of a US company using the AWS cloud services. A Dutch company which was not chosen by the Flemish Authorities in the tender process challenged this decision before the Council of State on the basis of the: * violation of the provisions of the GDPR on transfers, since no adequate protection of the data could be afforded in the US. The Dutch company relied in particular on an [https://overheid.vlaanderen.be/sites/default/files/media/VTC/VTC_A_2020_05_advies.pdf opinion] from the Flemish Supervisory Commission ('Vlaamse Toezichtcommissie voor de verwerking van persoonsgegevens) according to which the use of AWS could not be compliant with the Schrems II ruling and the GDPR; * breach of Article 28 GDPR (the choice of a the processor does not provide sufficient guarantees); * breach of Article 32 GDPR (lack of appropriate technical and organisational measures) * lack of motivation of the decision to grant the tender The Council of State held that: * the EDPB and the Flemish Supervisory Commission were not opposed to the use of encryption as such, and such use could be an adequate supplementary measure to the SCCs in some circumstances; * the choice of the processor was not violating Article 28 - the claimant could not demonstrate that the controller and processor did not implement the necessary technical and organisation measures; * the decision was sufficiently motivated.
A defendant appealed a first instance decision by the Regional Court of Potsdam. In that case, they made an unsuccessful counterclaim for set-off of damages they owed on account of the unauthorized further use of their photograph and name in connection with the plaintiff's Internet presence. The Higher Regional Court of Brandenburg held that a claim for damages can only arise from Article 82 GDPR if concrete damage has been sufficiently presented by the claimant. It rejected the appeal and stated that such a claim had no material prospect of success in this case. It justified its approach by reference to a decision by the Higher Regional Court of Bremen, which followed the same legal approach regarding an Article 82 GDPR claim.
In June 2019, the defendant, the Dutch Tax Office (Gemeenschappelijke belastingkantoor Lococensus-Tricijn', 'GBLT'), addressed a letter to the claimant. However, the destination of the letter was the claimant's old residential address. The claimant sent an email to the defendant, drawing attention to this error and emphasising that, as a result, his personal data had reached a third party. In its response, the defendant apologised, and proposed that the appropriate action would be to ask the third party to delete the relevant data and confirm this. The claimant indicated they were unable to respond to this proposal until certain ambiguities were resolved regarding the content of the leaked data. In August 2019, the claimant sent another email to the defendant, in which he asked a number of questions regarding the provision of his email address by the defendant to a company called 'KCM Survey BV', as well as other third parties for customer research purposes. Among other things, the complainant stated that he had not given his consent for this transfer, and asked what the legal basis was for sharing his data with third parties, and which third parties his data was shared with. The defendant responded stating that it considered processing for customer research purposes to be part of its statutory duties - more specifically, evaluating and ensuring the quality of the implementation of the Tax Act ('belastingwet') - and that therefore it does not consider it necessary to rely on the consent of data subjects. It did add, however, that it considered the claimant's communication as an objection to the processing of his email address for customer research purposes, and that it would no longer process the email for this purpose. Several months later, on 16 February 2020, the claimant asked for more information about the initial data breach involving the letter, as it was still not clear to him which documents were leaked. On 28 February 2020, by primary
In 2018, the complainant requested access to their personal data from the CRIF (the ‘respondent’), a credit reference agency operating in Austria. After receiving the response of the agency, the complainant stated a violation of their right to access due to its insufficiency. According to the complainant, the agency failed to precisely name data sources, purposes and the storage period for the personal data. In this regard, the complainant has not been informed on new recipients of their personal data as well. Furthermore, the agency did not provide a full copy of the personal data processed on the complainant. Accordingly, it also breached the principles of data minimization and confidentiality, processing incorrect addresses and insufficiently encrypted data. The respondent indicated certain companies as their data sources and stated that the data is stored as long as there was an interest by the respondent. Moreover, the data made available by the agency presented all the data held on the complainant and a copy would not add any value. At the same time, providing more information would reveal business secrets which therefore cannot be made available. Consequently, there was no violation and therefore no right to appeal by the complainant. The Austrian DPA dismissed the complaint, arguing that the disclosure of data sources, recipients and as well as criteria for determining the storage period has fulfilled the access request of the complainant. The provided data was sufficient and a copy of the personal data does not include entire documents, exact copies or a facsimile of such, but it is in the choice of the controller on what and how exactly data is delivered. Moreover, Article 77 GDPR is standardized in administrative proceedings as part of the Austrian national law and therefore bound to its requirements. The Federal Administrative Court of Austria limited its judgement to the objections regarding the provision of information on the origin, storage period a