GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
A data subject (the complainant) sent an access request to an Austrian credit reference agency (the respondent), requesting (i.a.) a copy of their personal data undergoing processing pursuant to Article 15(3) in a commonly used electronic format. The respondent only provided a table that contained the personal data (name, date of birth, address data business functions of the data subject) in an aggregated form but refused to provide an actual copy of the data undergoing processing, such as database print-outs or email correspondence regarding the complainant. The respondent argued that Article 15(3) GDPR does not entitle a data subject to receive a copy of the data in the sense of a facsimile of the data. Furthermore, the disclosure of a copy would also violate the respondent's business secrets, since a copy of data from a relational database (such as the respondent's identity and creditworthiness database) would inevitably also reproduce the logical-mathematical links of the individual data records. The complainant argued that Article 15(3) GDPR entitles them to a copy of the data in the very form that these data are undergoing processing. A controller has no right to limit the right of access to a modified aggregation of the relevant data. The Austrian Data Protection authority (Datenschutzbehörde - DSB) followed the respondents argument and rejected the complainant's claim. It deemed the data and information provided by the respondent to be sufficient. The complainant consequently filed an appeal with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG stayed the procedure and requested the CJEU's preliminary ruling under Article 267 TFEU on the following questions: 1. Is the term "copy" in Article 15(3) GDPR to be interpreted as meaning a photocopy or facsimile or an electronic copy of (electronic) data, or does the term also cover a "transcript", un "double" ("duplicata") or a "transcript", as understood in German, French an
The plaintiff (the Austrian association Verein für Konsumenten Information) sued the defendant (an online shopping platform operating throughout Austria) over several business practices, terms and conditions they found in violation with consumer protection law and the GDPR. More precisely, the association criticized several non-transparent contractual clauses on interests and creditworthiness checks as well as the defendant making decisions based on classifications by external credit scoring agencies in violation of Article 22 GDPR. The defendant argued that the association had no right to take legal action under applicable data protection law. In this regard, the appealing court already decided that the association lacks the legitimacy to assert data protection violations. The OGH decided that the previous court failed to take into account that the systematic infringement of Article 22 GDPR in connection with consumer credit ratings could in fact allow the association to take legal action under the GDPR. The court decided that the appeal is admissible because the legitimacy of the plaintiffs associations under §§ 28 and 29 of the Austrian Consumer Protection Act (Konsumentenschutzgesetz - KSchG) is not ultimately clarified. The court refers to a parallel case of the plaintiff currently pending at the CJEU as part of an preliminary ruling procedure. In this regard, the CJEU has to decide on whether the GDPR precludes national rules from granting associations the power to take legal action against unfair business practices or violations of consumer protection laws without a mandate and irrespective of the violation of specific rights of individual data subjects (see here). Until this decision is delivered by the CJEU the present procedure is put on hold.
A data subject submitted an an access request to the Municipality of Leeuwaarden concerning information on the collection, processing, and storage of data by the chip card reader attached to the waste container at his home address. The request included the following words: "Yours faithfully but with kind regards,: [appellant name]: I AM Without Prejudice UCC 1-308 Beneficiary, Authorized Agent and Representative for the legal fiction [appellant name]" In response, the Municipality asked the data subject to submit his request online and signed with his DigiD within 14 days, or to identify himself at the town hall with a valid identification document. DigiD is an identity management platform used by government agencies in the Netherlands. The Municipality explained that the request concerns personal data, which must not be provided to the wrong person, and it is therefore important to properly establish the data subject's identity. Indeed, Recital 64 GDPR states that the controller should take all reasonable steps to verify the identity of a data subject requesting access. And, following Article 12(6) GDPR, if there is reason to doubt the identity, additional information may be requested that is necessary to confirm the identity of the data subject. When the data subject did not identify himself in the way it requested, the Municipality issued a decision stating it would not consider his request. The data subject lodged an objection to this decision, which the Municipality declared unfounded. On 2 October 2020, the District Court of Northern Netherlands dismissed an appeal by the data subject regarding the Municipality's decision to reject his request. The data subject ('appellant') then appealed to the Council of State. The appellant argued that the District Court erroneously ruled that the Municipality could reasonably doubt his identity and could therefore ask him to identify himself. In particular, this is because the Municipality had previ
An Austrian based data subject intended to file a lawsuit under Article 79 GDPR due an (alleged) violation of Article 15(3) GDPR. The Austrian law contains no general provision determining which civil court in Austria would be competent to handle such lawsuit - § 29(2) of the Austrian Data Protection Act (Datenschutzgesetz - DSG) only establishes which court is locally competent to handle claims for damages following a violation of the GDPR (see Article 82 GDPR) or the DSG. Hence, the data subject filed a request under § 28 of the Austrian Judicial Jurisdiction Act (Jurisdiktionsnorm - JN) with the Austrian Supreme Court (OGH), asking the OGH to assign the case to the regional court of Feldkich (LG Feldkirch). § 28 JN allows for the OGH to assign a case to an Austrian civil court of its choice when it is unclear under the law, which court is locally competent to handle a case. The OGH rejected the data subject's request and held that § 29(2) DSG does not only apply to claims for damages but for any kind of civil claim under the GDPR or the DSG. In its reasoning the OGH referred to its decision 9Ob91/19d of 23.05.2019. The OGH held, that even if that decision (only) dealt with the question of subject matter competence of Austrian courts regarding claims under the GDPR, its findings can be applied on the question of local jurisdiction as well. Hence, the request under § 28 JN needed to be rejected, as the question of local competence can be answered by applying § 29(2) DSG per analogiam.
The complaining journalist requested information from the Federal Ministry of Finance Austria on the names and sums of all companies that received financial aid in the form of tax deferrals, grants or loan guarantees during the COVID-19 pandemic. The authority rejected the complainants request, arguing that it cannot provide the requested information due to a statutory duty of confidentiality coming from data protection ([https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563 § 1 DSG]) and related tax laws ([https://www.jusline.at/gesetz/bao/paragraf/48a § 48a BAO]). Accordingly, the disclosure of the names of all companies including the concrete amounts of their respective COVID-19 support services would reveal too concrete and detailed information on the businesses earnings situation, profitability and competitiveness. The BVwG held that the authority has to grant the journalist with access to information on the issued financial aid for corporate entities but not on those for individual entrepreneurs. The court argued, that the complainant’s work as a journalist fulfils the social role of a "public watchdog" to prevent financial abuse during the exceptional COVID-19 pandemic. In line with European principles, publications of financial beneficiaries are of great social interest and strengthen both the control and contribution of the public to the appropriate use of funds by the administration. Moreover, the journalist is itself bound by the legal framework of his employment and respective obligations to protect companies affected by the reporting. The court therefore held that the authority has to provide the journalist with access to the information on financial aid issued on corporate companies. On the other hand, as far as individual entrepreneurs are concerned, the court finds a more serious interference with the fundamental rights of the individual. Accordingly, in situations where the information issued refers to an individual entrepreneur, the bala
The claimant primarily requested that the defendant, Rabobank, remove her data from the registers related to money laundering and secondly, if the court decided not to remove the data, to shorten the retention period of the entries in these registers, which by law is 8 years. The claimant's data had been inserted in various registers as a result of suspicious transactions on her Rabobank bank account. There were suspicions that the funds originated from criminal activity. The claimant contests Rabobank's position. The Court was of the opinion that it had been sufficiently established that the claimant was guilty of money laundering, given her contribution to the financial transactions, which took place through her bank account, between two other persons. The Court first examined the national legislation, specifically Art. 5.2.1 of the Protocol on Incident Warning System for Financial Institutions, in order to then verify whether the GDPR legislation has been respected. The national legislation is used to determine when an inclusion in such registers is necessary. Three conditions are relevant: (a) the conduct(s) of the person to be listed pose a threat to (I) the (financial) interests of clients and/or the financial institution itself or (II) the continuity and/or integrity of the financial sector; (b) it has been sufficiently established that the relevant (legal) person is involved in the conduct(s) referred to under (a). This means that criminal offences are in principle reported; (c) the principle of proportionality has been observed in the sense that it is established that the interest of inclusion prevails over the possible adverse effects of inclusion in the register. To conclude, there must be a more serious suspicion of a criminal offence than a reasonable suspicion of guilt. The Court confirmed the correct recording of the data in the registers on the basis of the above-mentioned assessment framework. The principle of proportionality under the GDPR
Following alleged sexual abuse, the appellants requested the Dutch Inspectorate of Education ('the Inspectorate') to allow them to access documents and obtain a copy of all documentation concerning reports, announcements and/or questions made by, through or about the school community and submitted confidentially to inspectors or staff members. The request was made pre-GDPR, under the Dutch Personal Data Protection Act ('Wet bescherming persoonsgegevens'). More specifically, the appellants wished to obtain a copy of all documents known to the Inspectorate regarding the alleged sexual abuse. On 21 November 2016, this request was rejected by the Minister for Primary and Secondary Education and the Media ('the Minister'), since: # it was unclear to whose personal data the request was related; # the national law did not provide the right to obtain a copy but to access; and # the Dutch Education Supervision Act (Wet op het onderwijstoezicht') guarantees full confidentiality. By decision of 8 December 2017, the Minister provided a number of documents containing personal data of appellant A and his son in full and a number of documents in part. Insofar as more personal data of the appellants were held by the Inspectorate, the Minister refused access due to the above-mentioned confidentiality. By decision of 27 November 2018, the Minister dismissed the appellants' objection to the decision of 21 November 2016 as unfounded. The appellant filed an appeal with the Amsterdam District Court. On 29 August 2019, the Amsterdam District Court declared that the appeal lodged by the appellant was unfounded. With regard to the appellants' documents and other data, which are held by the Inspectorate and to which the above-mentioned confidentiality (Section 6(4) of the Education Supervision Act) applies, the District Court ruled that the Minister was entitled to refuse access to these documents, insofar as they are present and contain personal data of the appellants, on the grounds of
The Belgian tax department appealed a decision of the Belgian DPA that was provisionally enforceable, and asked for the immediate suspension of the implementing measures already taken until the Court has ruled on the merits of the case. According to the Court, an appeal against an administrative decision can only be effective if the applicant is not put under pressure to pay a fine or to comply with the contested decision immediately. Article 66 GDPR provides the possibility of an "urgency procedure" where a supervisory authority considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects. By way of derogation the supervisory authority can immediately adopt provisional measures intended to produce legal effects on its own territory with a specified period of validity which shall not exceed three months. Reading this Article (together with article 60 and 62 of the GDPR), it can be deduced that the European legislator did not intend to make decisions of the litigation chamber of a DPA provisionally enforceable. Article 108, § 1, par. 2 WOG, which provides for the provisional enforceability of the decisions of the Belgian DPA, must be interpreted strictly: in order to suspend the measures adopted by the DPA, the applicant must prove and motivate that the immediate enforceability of the measure would violate the right to an effective remedy as set out in Article 47 of the Charter of Fundamental Rights of the EU ('the Charter'). In this case the court rules by interlocutory judgment that: * the Belgian tax department did not put forward any concrete evidence, either in the application or at the hearing, to justify its claim for suspension and, therefore, its application is unfounded; * the Court prepares the case for hearing on the merits on Wednesday 10 November 2021.
The data subject wanted to assert a claim for compensation for immaterial damage against the controller. To this end, the data subject first applied for legal aid. For this purpose, the data subject set out the unlawfulness of a data processing - not described in the decision. Nothing was said about a non-material damage. For this reason, the Regional Court of Bremen dismissed the application. The data subject filed an immediate appeal against this decision. The Bremen Higher Regional Court (OLG Bremen) rejected the application. The requirements for a claim for damages were not fully presented. Article 82 GDPR presupposes damage. The asserted mere breach of the provisions of the GDPR is not sufficient for a claim. Furthermore, the court found that there was no need to refer the case to the ECJ. First, the wording of Article 82 GDPR clearly presupposes a damage. In this respect, the decision differed from the decision of the Federal Constitutional Court of 14 January 2021 (BVerfG - 1 BvR 2853/19). In that decision, the issue was not whether any damage had occurred at all, but whether there was a materiality threshold for this claim. Second, there is no obligation to make a reference under Article 267(3) TFEU for the proceedings here, since a decision on a legal aid application does not bind the court in the subsequent main action. In this respect, the parties are free to have the issue, which was originally decided only provisionally, re-examined by the courts.
The data subject requested the District Court Limburg to order their former bank to hand them all documents that contain their personal data that have been processed. The District Court considered that the dispute mainly focuses on the personal data of the data subject that are or may have been included in the so-called EVA registration (a Dutch fraud prevention system) and in the report of the security affairs department of the bank. The bank stated that it had no longer had these documents, but offered to conduct internal investigation. The District Court gave the bank the opportunity to conduct this investigation and to hand over a report to the data subject which he had not yet received. The district court rejected the data subject's request because it considered that their former bank had fulfilled its obligation to provide information by handing over the report. Furthermore, the court concluded that the data subject no longer objected the bank's position that the internal security report is no longer available. The data subject only requested a copy of their personal data concerning the EVA registration, but the court ruled that the bank had sufficiently substantiated its claim that it no longer has this data. The data subject disagreed with the ruling of the District Court and filed a request with the Court of Appeal. The data subject claimed that the bank had conducted several investigations into them, at least in 2015 and 2018. The data subject also claimed that Article 15 GDPR gives them the right to access complete copies of the entire documentation in which their personal data are or may be contained, such as underlying documents and personal notes made by others. The bank also argued in appeal that they no longer have the data which the data subject is requesting, since the relation between the data subject and the bank ended in 2012 and all data is from the period 2009-2011. The retention period of 7 years has been exceeded already by several years.
The claimant requested Microsoft Ireland to remove a number of URLs (links) from a list of search engine results following a search by the claimant's name in Microsoft's search engine, Bing. The claimant based his request on Articles 17(1)(a) and (c) GDPR and Articles 10 and 21 GDPR. The Court first examined its competence to rule on the request. The request is of an international nature as the applicant is domiciled in the UK and Microsoft is domiciled in Ireland. It noted that the dispute falls within the scope of the Brussels I bis Regulation in substantive, formal and temporal terms. Recital 147 GDPR states that the general rules of jurisdiction of the Brussels I bis Regulation should not prejudice the application of the specific rules of jurisdiction contained in the GDPR. This means that in a situation where both the Brussels I bis Regulation and the AVG are applicable, the Brussels I bis Regulation cannot take away the competence designated by the GDPR. The Court referred to the case law of the CJEU (see [https://curia.europa.eu/juris/document/document.jsf?text=&docid=111742&pageIndex=0&doclang=en&mode=req&dir=&occ=first&part=1&cid=2540581 CJEU 25 November 2011, ECLI:EU:C:2011:685, eDate Advertising GMBH/Martinez]), from which it follows that Article 7(2) Brussels I bis Regulation, in the event of an alleged infringement of personal rights by content placed on the internet, must be interpreted as meaning that the victim may also lodge the claim with the court where he has his 'centre of interests'. The CJEU defines the centre of interests as follows: "That place is usually the victim's habitual residence, but it may also be a Member State in which the victim does not habitually reside, provided that other evidence, such as the pursuit of a professional activity, may show that there is a particularly close connection with that State." Whilst the claimant considered that he has the centre of interests in the Netherlands since he conducts his professional ac
The Polish DPA issued a decision ordering a health care institution to delete the personal data of a former employee stored on the hard drive of the company computer which he used during his employment. The DPA concluded that, in the present case, none of the prerequisites of Article 6(1) and Article 9(2) GDPR authorising the health care institution to process the complainant's personal data after termination existed. The health care institution argued that it needed to process the personal data of former employees in order to defend itself against possible civil claims, but the DPA explained that such a reason does not have legal justification as a basis for processing under the GDPR. Personal data cannot be processed 'as a back-up' with the assumption that the data may be useful in the future, and stored up until the statute of limitations for civil law claims. The DPA held that there were no grounds entitling the employer to process the data to defend itself from hypothetical claims in the future. This decision was appealed by the health institution to the Voivodship Administrative Court in Warsaw, which dismissed the complaint. The appellant further appealed against the judgment to the Supreme Administrative Court and requested that the contested decision be suspended. The appellant claimed that it was necessary to suspend the execution of the contested decision, since its execution would produce effects for the applicant which are impossible to reverse (via the destruction of potential evidence). The Polish Supreme Administrative Court sided with the Polish DPA, and held that the appellant did not prove premises justifying the suspension of the execution order of the appealed decision issued by the DPA. It held that reference to the processing of the complainant's personal data in order to defend against any claims is not legally justified and does not constitute a premise entitling to the processing of personal data. In the opinion of the Court, the risk of
The plaintiff made a request for the erasure of her medical data from her file in 2014 and another request in 2017. Both were denied by the defendant. In 2018 however, the defendant revoked this decision and deleted the data. The plaintiff claimed to be entitled to compensation for immaterial and material damages of at least €25,000 based on the GDPR. The Court held that the plaintiff is entitled to compensation for immaterial damages because the defendant breached the right to respect for private and family life of the plaintiff by storing and processing the data. The Court deemed such a breach a harm in person as stated in Article 6:106 (1)(b) Dutch Civil Code which is a legal ground for compensation of immaterial damages. To determine the compensation sum, the Court took into account that the records were stored for about ten years and that the plaintiff had made several request for erasure of the data. The Court found it sufficiently plausible that during these ten years, several people and authorities could have taken note of the data without being entitled to do so. Therefore, the plaintiff suffered immaterial damages. Considering in another Dutch case (ECLI:NL:RVS:2020:898), a sum of 500 euros was granted for unlawful processing of data for a short period of time, the Court held that a sum of €2500 euros should be granted to the plaintiff. The Court held that the plaintiff was not harmed in her career or suffered a loss of income due to the processing of the records. Therefore, the Court rejected the plaintiff's request for compensation of material damages.
The dispute is between the data subject and the Board of the Eindhoven University of Technology (the controller). In December 2017, the data subject requested access to his personal data pursuant to Article 35 of the Personal Data Protection Act, the predecessor of the GDPR. The controller provided an overview of all personal data concerning the data subject that it had processed. According to the data subject, however, this overview was not complete. After objecting to the decision, the case ultimately ended up in Court. However, the case was suspended to provide the controller the opportunity to carry out a further search for the data subject’s personal data. On 7 January 2021, the controller submitted an additional list containing 101 emails. According to the data subject, however, this list was provided too late, and was not sorted in a way to provide a coherent overview. Moreover, the data subject claimed that a mere overview of the emails was not enough, since it was plausible that the content of these emails contained more personal data, especially considering that opinions regarding the data subject by the authors of these emails must also be regarded as personal data. In order to be able to exercise his other rights (such as rectification, erasure, or restriction of processing) he wanted copies of these emails. First, the Court considered the data subject's claim that the overview was too vague and provided too late. It stated that the formulation of the access request determines the scope of the search to be performed by the administrative body: if the request is (very) general (and not too specific), the administrative body can facilitate the request by searching for the most commonly used personal data (such as name and address details). Because the data subject formulated his request very generally and did not specify it during the objection procedure but waited until the procedure in Court, the Court concluded that the controller’s initial search fo
On 27 January 2021 the Belgian DPA imposed an administrative fine of 50.000 EUR on plaintiff (a company that offers gift boxes to (expectant) mothers) for not complying with the core data protection principles of processing personal data in a fair, lawful and transaparent manner. The plaintiff appealed the decision and claimed that several procedural principles have been violated in the decision of the Belgian DPA. Both parties referred to former decisions of the litigation chamber or the Court of Appeal to support their positions. However, according to the Court of Appeal, unlike the Anglo-saxon system, the Belgian legal system does not assign any binding precedent value to decisions. The most important aspects are shortly described hereafter: * Violation of rights of defence Although the litigation chamber admits that the file was not fully complete when the case was initiated, the Court stated that plaintiff did not report during the proceedings that documents were still missing afterwards, and therefore that plaintiff did not sufficiently demonstrate that its rights on this point were violated. * Violation of duty to state reasons (facts/violations) Plaintiff argues that the Belgian DPA can only base its decision on reasons whose factual existence has been duly proven. The court reminds the parties that it is not up to the court to re-examine the facts and substitute its views to the ones of the Belgian DPA. It can only verify whether the facts on which the decision is based are accurate. * Violation of duty to state reasons (legal basis) Plaintiff complained about the content and motivation of the contested decision with regard to 'consent' or 'legitmate interest' as a legal basis, but the court clearly states that the plaintiff could not sufficiently demonstrate that the consent met all the requirements (free, specific, unambiguous, informed). The Court also points to the absence of a 'balancing test' in which plaintiff had objectively considered beforeha
In its decision AEPD - PS/00451/2019, the Spanish DPA (AEPD) fined Equifax, a credit agency, €75,000 for unlawful processing of data. Equifax appealed this decision with the Spanish National High Court (Audiencia Nacional, "AN"). The court declared that the decision issued by the AEPD, since the DPA had carried out a correct interpretation of the GDPR and the [https://www.boe.es/buscar/act.php?id=BOE-A-2018-16673 Spanish Data Protection Act]. Since the controller had failed to block the data included in the credit file for 30 days, as the Data Protection Act requires, the controller was processing the data unlawfully, and could therefore not rely on any legal basis. Additionally, the court noted that the controller had alleged that, since the Data Protection Act had entered recently into force, they had not been able to implement a proper blocking system, and they did not have the means at the time to block the data; so the controller had acknowledged that they had not carried out the blockage. The court also remarked that the fine was proportional, since the DPA had taken into account the circumstances of the case and had imposed a proportionate and justified fine, in accordance with Article 83(5) GDPR.
The controller is the Schufa Holding AG, a German credit rating agency. The data subject went into private insolvency after a failed business start-up. The insolvency proceedings were concluded and he was discharged from residual debt. This was published - as provided for under national law - on the online insolvency notice portal (www.insolvenzbekanntmachungen.de). § 3(1) of the German Insolvency Notification Regulation (InsoBekV) provides that such publications must be deleted no later than six months after the discontinuation of the insolvency proceedings has become unappealable. The respective entry on the data subject was deleted during this period. The controller included the information on the discharge of residual debt in its database at the time of its publication on www.insolvenzbekanntmachungen.de. However, it continued to store the information in its database after it was deleted from the aforementioned register and processed it for credit assessment purposes. The controller is a member of an association of German credit agencies. This association has given itself rules of conduct according to which the information about the discharge of residual debt is to be deleted after 3 years. The data subject received (after deletion on www.insolvenzbekanntmachungen.de) a rejection for a flat enquiry because of his bad credit rating. An action by the data subject for deletion of the entry on residual debt discharge was dismissed at first instance. The data subject appealed against this decision to the Schleswig-Holstein Higher Regional Court (OLG Schleswig-Holstein). The court ruled that the data subject was entitled to erasure under Article 17(1)(d) GDPR, as the data processing was not lawful. In any case, the requirements of Article 6 GDPR were no longer met 6 months after the discharge of residual debt had become unappealable. = The court first states that the processing cannot be based on Article 6(1)(e) GDPR. For this to be the case, the processing must be
An asylum seeker (X), born in Moldavia but having lived his entire childhood in Syria, applied for international protection in Luxembourg in November 2019. At the time of entry, X was still a minor and was accompanied by his mother. During the interrogation conducted by the police, X fainted and the police searched his phone without his consent, including pictures. In February and April 2021, whilst X had reached the legal age of majority, he was heard by an agent of the Ministry of Immigration regarding his situation and the reasons behind his request for international protection. On 1 June 2021, the Ministry rejected his request, on the ground that X had a connection with Moldavia, where he could return, in application of Article 28(2)(c) of the Luxembourg law of 18 December 2015 regarding international protection. X appealed that decision before the Administrative Tribunal of Luxembourg, arguing among others that the police force had illegally processed his personal data, including sensitive personal data, because they did not have any valid legal basis under Article 6 GDPR and/or Article 9 GDPR. Regarding the processing of personal data in general, the Tribunal first recalled that processing of personal data is allowed when such processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e) GDPR), as long as this is laid down in national law (Article 6(3)(b) GDPR). The Tribunal then looked into Article 12(5) of the Luxembourg law on Internal Protection, which states that: "The [police] may, if necessary, carry out a body search of the applicant and a search of the objects he is transporting. (...) [T]he body search of the applicant's shall be carried out by a person of the same sex, with full respect for the principles of human dignity and physical and psychological integrity. Any object useful for examining the request may be retained (...)." Having r
The Dutch DPA (the Autoriteit Persoonsgegevens, or 'AP') imposed an order subject to a periodic penalty payment on the municipality of Arnhem ('the Municipality'). The Municipality had infringed the then applicable Personal Data Protection Act (Wet bescherming persoonsgegevens or 'Wbp') by storing and retaining the personal data of individuals who disposed their waste in underground containers on the card readers attached to the containers. The order required the Municipality to open all underground containers without the use of a card, and to delete all personal data already stored and retained no later than 1 October 2017. On 14 March 2019, the AP decided to lift the order subject to penalty payments imposed on the Municipality at the request of the Municipality. The Municipality wanted the underground containers to be accessible only to residents and businesses of the Municipality, and therefore wanted to open a new waste card system. With the new system, residents are given a card with an internal chip code which is linked to their residential address. When the card is held in front of the card reader, the chip code is processed and compared to a whitelist of chip codes. To do this, the chip code is stored on the card reader's volatile memory. It is then converted almost instantly into a generic 9999 number, and removed from the whitelist when the container is closed. The AP could not foresee any violation of the GDPR by this new system, namely because data may be processed on the basis of Article 6(1)(e) GDPR, which states that a controller may process personal data which is lawful and necessary for the performance of a task carried out in the public interest. In a decision of 16 July 2019, the AP dismissed an objection made by an appellant against the decision to lift the order as unfounded as unfounded. In a judgment of 5 September 2019, the District Court of Gelderland ('the District Court') declared an appeal lodged by the appellant against the decision
The main legal question in this case was whether a data controller is obliged to grant data subjects access to certain official documents, including environmental information in connection with an approved geothermal probe, in light of the applicable Bavarian Environmental Information Act (BayUIG). In order to balance the interests of the controller (i.e. confidentiality) with the public interest (i.e. access to information), the national legislator should pay attention to the recitals of the GDPR and to Article 86 GDPR which concerns public access to official documents, as well as Article 6(2) GDPR and Article 6(3) GDPR which provides Member States with the possibility to adopt specific provisions allowing for certain types of processing activities. In light of Recital 154 and Article 86 GDPR, it appears that the GDPR requires the principle of public access to official documents to be taken into account when it is applied. Public access to official documents can be viewed as a public interest. The ruling court has no concerns that the national provisions of the BayUIG in question, an information access law in accordance with Article 6, Paragraph 2, last half-sentence, Paragraph 3, Clause 3, last half-sentence, Article 86 GDPR, are compatible with the provisions of the GDPR (for the conformity of the VIG with the GDPR see BayVGH, Bv 15.4.2020 - 5 CS 19.2087 - juris Rn. 25; for the conformity of the IFG, UIG and VIG with the GDPR see Schnabel in Simitis / Hornung / Spiecker gen.Döhmann, Datenschutzrecht, 1st edition 2019, Rn. 41 ff.) And therefore the information access granted here according to the BayUIG does not contradict the GDPR. The Administrative court of Munich points out the relevant facts about the relation of the GDPR to European and National Information Access Claims. There are no provisions of the EU GDPR to conflict with the right to information according to the BayUIG. Like all EU regulations, the GDPR enjoys direct validity and priority over natio