GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The complainant, an executive at an unnamed large company, had requested the removal of 12 URLs. As Google had refused to remove several of the concerned links, the complainant referred the case to the Belgian DPA. Building on the principles developed by the CJEU in the Google Spain and Google/CNIL cases, the Belgian DPA decided that Google Belgium is an establishment of Google LLC , triggering the applicability of the GDPR under article 3.1. Moreover, the DPA referred to a latter sent on 23 June 2020 by Google LLC to the Irish DPC stating it would no longer object to local (non-lead) supervisory authorities exercising local data protection jurisdiction when it comes to the scope of Google LLC's responsibilities. As a result, despite the designation of the Irish DPC as lead supervisory authority, the Belgian DPA considered it had jurisdiction because the case did not relate to Google Ireland Ltd's processing activities, but to Google LLC. Therefore, the one-stop-shop procedure did not apply. On these grounds, the Belgian DPA: * ordered Google Belgium to de-reference the concerned search results; * imposed an administrative fines of EUR600,000, based on Alphabet's (Google's mother company) annual turnover in the three previous years; and * ordered Google to clarify the ambiguity concerning the roles of the different entities involved, and in particular to clearly and precisely clarify which entity is the data controller for Belgium and for which processing activity. Google Belgium appealed the decisions before the Court of appeal on the grounds that - the order was addressed to Google Belgium which is not the controller in this case * the APD did not sufficiently motivate how it could be established that Google Belgium was linked to the activities of Google LCC as the controller; * Article 58 GDPR does not provide the possibility to impose a corrective measure on another entity than the controller (ie Google LLC); * the APD published the decision without removin
The complaint concerned the alleged assignment of the plaintiff's mobile phone number by his telecom provider to a third party, as a result of which the complainant could no longer use his number. The plaintiff's SIM card was deactivated and the third party was therefore able to view the plaintiff's personal mobile phone traffic and calls, as well as linked accounts (such as Paypal, WhatsApp and Facebook) from 16 to 19 September 2019. The Belgian DPA imposed an administrative fine of 25 000 EUR to a telecom provider in its decision of 22 January 2021 This decision was challenged before the Court of Appeal on 19 February 2021. However, the Belgian DPA withdrew the above decision on 19 May 2021, reopened the proceedings before the litigation chamber and invited the parties to submit new arguments. The telco operator argued that Belgian DPA of process abuse and states that referral to the litigation chamber Chamber is a violation of article 13 of the Constitution and the provision of an effective remedy and the fair administration of justice. On top of that, the telco operator asked the court to grant increased litigation costs to the telco company considering: - the increased attorney's fees; - delay of justice and legal uncertainty; - the situation's apparent unreasonable character: The Belgian DPA waited until the last moment to revoke the decision, where the case for pleadings was fixed on 2 June 2021. The Court ruled that: - the decision of the Belgian DPA retroactively disappears from the legal order; - the complainant's claim is without object and is therefore rejected; - the Belgian DPA is ordered to pay litigation costs and court fees
The Dutch Telecommunications Authority (Agentschap Telecom) fined an unidentified telecommunications provider for failing to make its customer database available to the authorities as required. The provider was fined €5000 and ordered to provide data on its customers to the authorities again. The provider was also threatened with further fines if it failed to comply in the future. According to the [https://wetten.overheid.nl/BWBR0011123/2019-07-18 Dutch Decree on the Provision of Telecommunications Data] (Bvgt) and [https://wetten.overheid.nl/jci1.3:c:BWBR0009950&hoofdstuk=13&artikel=13.4&z=2020-12-21&g=2020-12-21 Article 13.4 of the Telecommunications Act], telecommunications providers must connect to an automated system called CIS, which is operated by the Central Information Point for Investigation of Telecommunications (CIOT). The CIS acts as an automated middleman between telecom and internet providers, who must submit certain information, and government agencies, which can request information from the databases. Every 24 hours, service providers must provide an updated database of their clients via the CIS.https://www.rijksoverheid.nl/binaries/rijksoverheid/documenten/brochures/2010/07/01/factsheet-ciot/Informatieblad+CIOT.pdf Since 2013, the telecom provider had sought to obtain satisfactory answers to its questions and guarantees about the handling of the requested data before submitting the information. The telecommunications provider stopped providing data to CIS in the summer of 2016. The CIOT complained to Dutch Telecommunications Authority in December 2017 that the provider was not cooperative in providing information.
The controller erected an LED billboard on a private car park. As there had been regular vandalism there in the past, the controller set up various cameras that operated around the clock and partially recorded the public traffic area. The DPA ordered, among other things, that the data processing by one of the cameras be stopped and that this camera be dismantled. The controller objected to this order. The court of first instance (VG Mainz - 1 K 584/19.MZ) ruled that the discontinuation order was lawful, but that the dismantling order was unlawful. The controller accepted this decision and, in particular, accepted that he would no longer be allowed to switch on the camera. In contrast, the defendant appealed against the annulment of the dismantling order. The appeal was unsuccessful. The Higher Administrative Court of Rhineland-Palatinate (OVG Rheinland-Pfalz) ruled that, firstly, the scope of application of the GDPR was not opened for the switched-off camera. Secondly, Article 58(2)(f) GDPR does not authorise the ordering of the dismantling of a (decommissioned) camera. = In the court's opinion, the scope of application of the GDPR is not opened. There was no processing within the meaning of Article 4(2) GDPR. Video recordings and their temporary storage are indisputably data processing, but a deactivated camera does not process data (any longer). In the second instance, the operator of the LED board no longer objected to the order of discontinuance. The order has become unappealable. In the absence of any indications of continued operation contrary to the order, the court held that it was to be assumed that the camera was and remained deactivated. = Pursuant to Art. 58(2)(f) GDPR, the supervisory authority has all corrective powers allowing it to impose a temporary or definitive limitation on processing, including a ban. The DPA made use of this power by ordering to deactivate the camera and therefore to stop the processing. Article 58(2)(f) GDPR does not est
The credit reference agency (the defendant) collected past payment data on the data subject (the plaintiff) in order to provide other parties with a credit score reflecting their risk of non-payment. In this regard, the defendant stored data on the plaintiff regarding several unpaid online shopping invoices from 2017 and 2018. While the plaintiff caught up with the payments later on, the data on such invoices are to remain stored as “positively settled” for a ten years’ period in the defendant’s system. The plaintiff requested the defendant to delete all the payment data relating to them. They argued that there was no further necessity to process such data since all entries have been positively settled. Moreover, the invoices amounts were insignificant and the plaintiff’s financial situation has improved considerably. The plaintiff argued therefore, that the incomplete and outdated data would unreasonably hinder their participation in economic life. According to the plaintiff, such impairments cannot be based on data that is up to ten years old. The defendant argued that the processing the data was legitimate. The purpose of the data processing is to grant other companies access to such data, given their need to assess the payment behaviour of potential customers when entering into a credit risk. Deleting such data would distort the accurate representation of the plaintiff's creditworthiness. The interests of the defendant and related third parties would outweigh the plaintiff's interest in deletion. The Austrian Supreme Court (Oberster Gerichtshof - OGH) decided, that the plaintiff's claim for erasure cannot be based on the ten-year storage period, since as part of an individual assessment, it may only examine the storage period in the particular case. Beginning with the first entry on unpaid invoices in 2017, therefore only an period of storage of approximately 3 years can be considered. In this regard, the OGH found that the plaintiff failed to provide convinci
In the proceedings, the plaintiff filed a total of 12 applications. The court ruled on 6 of these applications by partial judgment of 23 June 2021. The proceedings were interrupted with regard to the remaining 5 applications until the CJEU has ruled on the preliminary ruling proceedings initiated by order of 23 June 2021. An overall short summary can be found [https://noyb.eu/en/breaking-austrian-ogh-asks-cjeu-if-facebook-undermines-gdpr-2018 here]. This partial judgment only concerns applications 1 - 4 as well as 11 and 12, so that only the relevant facts are reproduced in abbreviated form below. The facts relevant for the remaining interrupted proceedings, for which the preliminary ruling procedure has been initiated at the CJEU, are presented there. The plaintiff is Max Schrems. The defendant is Facebook Ireland. The court first explains how Facebook works. These findings are only presented in a roughly abbreviated form in the following: Facebook provides a platform on which more than 2.2 billion users worldwide can upload data and respond to data uploaded by other users. This includes text contributions, pictures, videos, events, comments, "likes", markings on photos and much more. In addition, users network with each other in so-called "friendships". Facebook itself does not generate any content itself and only provides the infrastructure (free of charge). Facebook receives the (linked) personal data. The economic model of the defendant is to generate revenue through personalised advertising and commercial content based on preferences and interests of users. The plaintiff has been using his Facebook account for private purposes since 8 June 2008. In doing so, he decides himself with whom he is in contact, whether and to whom he sends messages, what information he enters in his profile, etc. The plaintiff's Facebook friends also regularly save posts by the plaintiff or about the plaintiff. The first four applications dealt with the "division of roles u
In the proceedings, the plaintiff filed a total of 12 applications. The court ruled on 6 of these applications by partial judgment of 23 June 2021. The proceedings were interrupted with regard to the remaining 5 applications until the CJEU has ruled on the preliminary ruling proceedings initiated by order of 23 June 2021. An overall short summary can be found [https://noyb.eu/en/breaking-austrian-ogh-asks-cjeu-if-facebook-undermines-gdpr-2018 here]. This order for preliminary ruling only concerns applications 5 to 9, so that only the relevant facts are presented in a very abbreviated form below. The facts relevant for the proceedings already decided by partial judgment are presented there. The plaintiff is Max Schrems. The defendant is Facebook Ireland. Facebook provides a platform on which more than 2.2 billion users worldwide can upload data and respond to data uploaded by other users. This includes text posts, pictures, videos, events, comments, "likes", tags on photos and much more. The court explains all the functions of the Facebook platform. In particular, it explains that users network with each other in so-called "friendships". Practically all information from all users is linked to each other - especially via the friendship network. This linking allows an evaluation of the individual user beyond the data provided by the user himself. The research into the "preferences" and the "profile" of the users does not only include interests or information provided by the user himself, but all personal data available to the defendant. Facebook does not generate any content itself and only provides the infrastructure (free of charge). Facebook receives the (linked) personal data. The economic model of the defendant is to generate revenue through personalised advertising and commercial content based on the same preferences and interests. For this purpose, Facebook provides so-called business tools, which in turn can be differentiated into three tools described by the
An individual lodged a constitutional complaint reference on the national Law on Road Traffic is consistent with the fundamental right to respect for private life. The individual’s legal interest was grounded to the imposition of penalty points after some road traffic offences. These points were entered in the national register of vehicles and drivers. Moreover, any company and any third person may obtain information relating to penalty points imposed on another person, either by enquiring directly at the CSDD or by using the services provided by commercial re-users. The relative Article 14(1)(2) of national law was stated that “Information relating […] to fines for the commission of road traffic offences which have been imposed on a person […] shall be regarded as information in the public domain”. Latvian Parliament intended to improve road safety through each driver who infringes traffic regulations, particularly those disregarding them systematically, be openly identified. The only requirement for disclosure of the information, which contained in the national register of vehicles and their drivers, was subject to the condition that the information seeker must provide the national identification number of the drivers about whom they wish to enquire. The CSDD handles the National Register, and they insisted that they transfer the legal ownership of the transmitted data under no circumstances. So, the re-users should use these data only to deduce the seriousness and frequency of those offences and ascertain whether a given person has committed road traffic offences. Since penalty points were classified as public data, may be re-used for commercial or non-commercial purposes other than the initial purpose for which the information was collected. However, article 14(1)(2) of the Road Traffic National Act does not impose limits on the re-use of these data relating to penalty points. Under the contracts in which CSDD concludes with commercial re-users, the acquirer af
The data subject lodged a complaint with the the Norwegian DPA (Datatilsynet) stating that they had been subject to an unauthorized credit rating. An employee of the credit rating agency has indeed triggered a credit check on the complainant to contact them in private matter. However, the data was not disclosed to other parties. Therefore, the DPA found it unlikely that data protection legislation had been violated and decided not to investigate the case further. The complainant, however, was neither informed of the closure of the case nor of their right to appeal by the DPA, but only after asking for the status of the investigation and performing own online research. The complainant therefore appealed the DPA's decision to dismiss the case, which was rejected and submitted to the Norwegian Privacy Appeal Board by the DPA. The Appeal Board decided that according to national law a party is granted the right to appeal to an individual decision. The DPAs decision to terminate the case without deciding whether the complainant's personal data has been processed unlawfully must be regarded as a decision that is decisive for the complainants individual rights, granting them the right to appeal according to [https://lovdata.no/dokument/NLE/lov/1967-02-10/KAPITTEL_6#%C2%A728 section 28(1)], [https://lovdata.no/dokument/NLE/lov/1967-02-10/KAPITTEL_1#%C2%A72 2(1)(a)(b)] [https://lovdata.no/dokument/NLE/lov/1967-02-10/ Public Administration Act]. Furthermore, the Board pointed to the data subject’s right to receive information on the outcome of the complaint under Article 77(2) GDPR and Article 57(1)(f) GDPR. The case was therefore returned to the DPA for an assessment on the merits of the case.
After multiple years as a member of a union the data subject decided to quit and sent the union a letter requesting termination of the membership and the deletion of personal data. Among other information the letter contained the membership number and the handwritten signature of the data subject. The union immediately terminated the membership of the data subject. In terms of the erasure request, however, the union asked for a copy of the ID of the data subject in order to progress with the deletion. Although the name and membership number were known to the union, it could not verify that also the signature on the letter was from the data subject. The union argued that although the data subject stated to be known to the union due to their long membership, the size of the union with over 1.2 million members and different administrative responsibilities did not constitute a personal relationship with the data subject. Moreover, the consequences of the data deletion would be severe compared to a resignation given that the data was necessary for a later re-entry in the union to continue the data subject’s membership. Therefore, and in accordance with Article 12(6) GDPR additional measures of identification were required. The data subject refused to provide a copy of the ID seeing a contradiction in providing even more data to achieve its deletion. The data subject argued that sending a copy of the ID does not mean any higher degree of reliability or proof of identity since it could be stolen, forged or used by another person. According to the GDPR additional information may only be requested if there are reasonable doubts about the identity of the natural person which does not allow for routine identity checks in all data subjects' rights. The BVwG ruled that the union unjustifiably requested proof of identity of the data subject and had not dealt with the latter's request for deletion. In this regard, it followed a previous position of the Austrian DPA according to
The claimant's request for access to his personal data was rejected by the Minister of Finance (the defendant), and the claimant appealed this decision. The Minister of Finance considered the request to be too general, comparing it to a 'fishing expedition.' It argued that where a controller processes a large amount of data about a data subject (such as in this case), the data subject must specify to which information or which processing activity the request relates. The defendant draws on case law, as well as Recital 63 GDPR, which at sentence seven states: "Where the controller processes a large quantity of information concerning a data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates." With regard to the statutory tasks of the tax authorities, the defendant argued that the claimant can largely view and change his personal data himself by logging in to 'my tax authority' or 'my benefits' (web portals). The claimant argues that the defendant is wrong to ask him to specify his request, because this would make it impossible for him to verify what personal data is being processed. According to the claimant, there is a possibility that personal data may be processed incorrectly, incompletely and/or unlawfully without the ability to verify and rectify. The Court declared the claimant's appeal well-founded, and annulled the Minister of Finance's decision. It held that, in general, a controller may request clarification from a data subject on an access request if it processes a large amount of data. However, this does not mean that a controller can in all cases demand clarification before performing a search. In the opinion of the Court, even where a controller processes a large amount of data, it is reasonable to expect the data controller to perform a search for the "most common" personal data in the case of a generally fo
A content management company (Mircom) submitted a request for information against Telenet, an internet service provider, to a Belgian Court. The request sought a decision requiring Telenet to produce the identification data of its customers on the basis of IP addresses collected, by a specialised company, on behalf of Mircom. The internet connections of Telenet’s customers had been used to share films in the Mircom catalogue, on a peer-to-peer network, using the BitTorrent protocol. Telenet challenged the request. The Belgian court submitted a request for a preliminary ruling to the CJEU. Although most of the debate is centered around intellectual property law, data protection law is also involved. First, it asked the Court whether the sharing of pieces of a media file containing a protected work on that network constitutes a communication to the public under EU law. Secondly, it sought to ascertain whether the holder of intellectual property rights, such as Mircom, which did not use them, but claimed damages for alleged infringements, could benefit from the measures, procedures and remedies provided for by EU law in order to ensure that those rights are enforced, for example by requesting information. Thirdly, the referring court asked the Court of Justice to clarify the question of the lawfulness, first, of the way in which the customers’ IP addresses have been collected by Mircom and, second, of the communication of the data requested by Mircom from Telenet. (1) (a) Can the downloading of a file via a peer-to-peer network and the simultaneous provision for uploading of parts thereof … (which may be very fragmentary as compared to the whole) (‘seeding’) be regarded as a communication to the public within the meaning of Article 3(1) of Directive 2001/29, even if the individual pieces as such are unusable? If so, (b) is there a de minimis threshold above which the seeding of those pieces would constitute a communication to the public? (c) is the fact that seedi
The Belgian DPA brought an action before Court of First Instance of Brussels, Belgium on 11 September 2015, seeking an injunction against Facebook Ireland, Facebook Inc. and Facebook Belgium. This action aimed to put an end to what the Belgian DPA described as ‘serious and large-scale infringements, by Facebook, of the legislation relating to privacy’. On 16 February 2018, the Court of First Instance held that the Facebook social network did not adequately inform Belgian internet users of the collection and use of the information concerned. Furthermore, the consent given by the internet users to the collection and processing of that data was held to be invalid. Facebook Ireland, Facebook Inc. and Facebook Belgium, however, appealed that judgement before the Brussels Court of Appeal. Before ruling on the substance of the case, the Court of Appeal referred certain questions to the CJEU regarding the ‘one-stop shop’ mechanism provided for by the GDPR. Indeed, Facebook Ireland (established in Ireland) was identified as the controller. The Court of Appeal of Brussel therefore referred six questions to the CJEU: (1) Should Article 55(1), Articles 56 to 58 and Articles 60 to 66 of [Regulation 2016/679], read together with Articles 7, 8 and 47 of the [Charter], be interpreted as meaning that a supervisory authority which, pursuant to national law adopted in implementation of Article 58(5) of that regulation, has the competence to initiate or engage in legal proceedings before a court in its Member State against infringements of that regulation cannot exercise that competence in connection with cross-border data processing if it is not the lead supervisory authority for that cross-border data processing? (2) Does the answer to the first question referred differ if the controller of that cross-border data processing does not have its main establishment in that Member State but does have another establishment there? (3) Does the answer to the first questio
The controller is a life insurance company with which the data subject is insured. Even before the introduction of the GDPR, the data subject asserted a claim for information pursuant to § 34 of the old version of the German Data Protection Act (BDSG). The controller provided some information. However, the data subject was of the opinion that the information provided was incomplete. The claim subsequently asserted in court was dismissed at first instance. In the second instance, the data subject based his request for information on Article 15 GDPR, which has since entered into force. The data subject requested information on all personal data actually held by the defendant, which were subsequently specified in more detail. The court of second instance rejected the right to information, arguing that the claim had already been fully satisfied. The data subject had not specifically shown that the information already provided by the controller was incomplete and what further information he was demanding. Furthermore, the requested items were not subject to the right of access. The data subject appealed this decision to the Federal Court of Justice (Bundesgerichtshof - BGH). The appeal against the denied right of access was successful. The data subject was entitled to information to the extent claimed. The claim was not fulfilled by the controller and insofar still existed to the extent asserted. The BGH refrained from a preliminary ruling since the interpretation of the law is clearly defined by the CJEU ("acte clair"). = The court first explains under which conditions a right of access is fulfilled. This is the case if, according to the controller's declared intention, the information constitutes the information owed in its entirety. If the information is provided in this form, any inaccuracy in its content does not prevent performance. The suspicion that the information provided was incomplete or incorrect could not justify a claim to information to a greater exte
The controller, a transporting company located in Germany, employed the data subject for the delivery and assembly of goods. The company filed criminal charges against the employee for aggravated fraud based on falsely overcharged travel expenses and terminated the employment contract. In order to prove their innocence, the employee requested information pursuant to Article 15 GDPR from the controller, arguing that the information was required for a proper defence within the criminal proceding. The company did not name any interest in secrecy or conflicting interests worthy of protection but refused to provide the information requested. It claimed that the access to confidential data prior to the conclusion of the criminal proceeding resulted in an abuse of rights. In a first instance, the Labour Court of Wiesbaden decided that the defendant was entitled to receive the information requested because the controller did not provide evidence its overriding confidentiality interests. The data subject filed an appeal. The Regional Labour Court of Hesse held that the company's confidentiality interests did not override those of the defendant in effective legal protection recognized by the GDPR. Although the purpose of the right to access is to enable the control of lawfulness of the processing of personal data, the pursuit of further purposes and different motives, such as the exercise of defence rights in a criminal proceeding, does not justify a refusal. At the same time, the data subject is not required to limit his request for information. The individual pieces of information listed in the application correspond to the standardized requirements of Article 15(1) GDPR and represent the right to information embodied therein. In conclusion, the court upheld the previous court's decision as the company failed to sufficiently substantiate their concerns.
A public officer asked for personal data to be removed from his appointment notice as published on the Ministry's website since it mentioned his status as a disabled person. The Ministry however refused to do so, on the ground that French law requires the publication of such information. The French Council of State ('CE') held that, although the data had to be published for compliance with the law, such information was not necessary in relation to the purpose to be achieved, and should therefore be removed from the Ministry's website, in compliance with the principles of purpose limitation and data minimization (Article 5(1)(b) and (c) GDPR). However, the CE held that information about the existence of a disability could not be considered as health data when it didn't mention the type or gravity of the disability, and that Article 9 GDPR therefore did not apply to this type of data.
The plaintiff took his second state law examination in the state of North Rhine-Westphalia, which consists of a (hand-)written part and a later oral part. He successfully completed the exam and did not challenge the assessment of his examination performance. After the examination was completed, i.e. after the oral examination, he requested the defendant, the State Judicial Examination Office (Landesjustizprüfungsamt, “LJPA”) send him the copies of his exams including the examiners’ opinions in electronic form or by post. The LJPA stated that it would only agree to this for a fee of €69.70 to be paid in advance. The claimant then renewed his claim and explicitly invoked Articles 15(3)(1) and 12(5) GDPR. The defendant again rejected this. In particular, he pointed out that the material scope of application of the GDPR did not apply. The plaintiff then filed an action. The court of first instance ruled in accordance with the application. The defendant appealed against this, which is the subject of this summary. The court dismissed the defendant's appeal. The court found that the defendant was obliged to provide the plaintiff with a copy of his exams prepared in the context of the second state law examination together with the examiners' reports in paper form or commonly used electronic form free of charge. The court first ruled that the claim to the provision of a free copy of his examination papers prepared in the second state law examination together with the examiners’ reports follows from Articles 15(3)(1), 12(5)(1) GDPR in conjunction with [http://www.lexsoft.de/cgi-bin/lexsoft/justizportal_nrw.cgi?xid=8080989,6 § 5(8)(1) of the Data Protection Act of North Rhine-Westphalia (DSG NRW)]. = The court first finds that Articles 15(3)(1), 12(5)(1) GDPR apply. However, it leaves open whether the material scope of application of the GDPR is opened or not opened due to Article 2(2)(a) GDPR. In any case, the applicability follows from [http://www.lexsoft.de/cgi-bin/lexso
A parish of the Roman Catholic Church was processing the application of an individual on the right of erasure. The individual requested their personal data to be erased from the Baptismal Register, because they were no longer a member of the church. In their opinion, the collected data were no longer necessary in relation to the purposes for which they were collected. They did not give consent for their baptism or processing of his personal data. The individual also claimed that personal data entered in the register revealed religious beliefs and interfered with their religious freedom. The data collected in the register were: first and last name of individual, date of birth, date of baptism, names of parents and godparents and place of residence. The parish claimed that the legal basis for the processing of data in the register is mainly the Protection of Documents and Archives and Archival Institutions Act, which classifies the registry as archival material of outstanding national importance, therefore it is not allowed to delete any of the data contained. The parish has also made an additional entry in the register stating that the person is no longer a member of the church. The Slovenian DPA assessed if the processing is necessary for archiving purposes in the public interest in accordance with Article 89(1) GDPR and if the erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing (Article 17(3)(d) GDPR). The SA emphasised, that the aforementioned act itself stipulates that church documentary material has the characteristics of archival material. It is also subject to the principles of permanence and integrity and it provides measures which can be considered as appropriate safeguards according to 89(1) GDPR. The DPA decided that the Baptismal Register is an archive document according to the national act and that the individual cannot claim the right of erasure when the processing is needed for archiving
The case concerns a civil dispute between the plaintiffs Central Student Council (CSR) at the University of Amsterdam ('UvA'), the Student Council at the Faculty of Economics and Business (FSR) of the UvA, and an individual student against the defendant, the UvA. The outbreak of Covid19 caused the Dutch government to close the universities on 16 March 2020. Due to the closure, it was not possible for the UvA to hold exams on site. After some research and testing, the UvA decided to use an online proctoring tool, essentially a monitoring software called Proctorio. This software allows the university to monitor student behaviour at home while they are taking the exam to see if the student is attempting to cheat on the exam. Proctorio is installed as a browser plugin. It continuously records the test taker's webcam, microphone, and screen. In addition, the software monitors the student's behaviour to detect unusual behaviour, such as if the student often looks away from the screen, or if there is ambient noise in the room that might indicate that someone else is in the same room with the student, or if the student types more or less than other test takers. The software also monitors the computer's internet traffic, the presence of secondary monitors. The plaintiffs took the university to court by filing a motion for a preliminary injunction with the District Court of Amsterdam. The district court ruled in favour of UVA, finding that the government's COVID-19 measures did not allow for suitable alternatives and that the surveillance had a legal basis in Article 6(1)(e) GDPR. The plaintiffs appealed to the Court of Appeals Amsterdam Court, seeking an ordinary ruling (not a preliminary injunction). Before rolling out the software in a real-world scenario, the UvA conducted three simulated tests in April 2020. In the meantime, the UvA asked its own DPO (Data Protection Officer) for advice and received a positive response. The UvA then conducted a DPIA (Data Protection Imp
The plaintiff issued a complaint against a civil law candidate notary (the defendant) because her home address was stated in the draft of two notarial deeds. The complaint consisted of four parts: # The personal data became public for third parties because the personal data was included in the notary deeds; # the candidate notary checked the information in the Personal Records Database (Basisregistratie Personen) even though he was not authorized to do so; # the candidate notary did not dedicate enough care to correct this and limit the damage; # the candidate notary breached the GDPR. Did the candidate notary breach any laws or regulations by including a personal address in the notary deeds? The chamber held that: # the candidate notary was authorized to include the personal data in the deeds, based on Article 40(2)(c) of the Dutch Civil-law notaries act (Wet op het notarisambt) and Article 18(1)(3) of the Land registry act (Kadasterwet); # the candidate notary was obligated by law to check the identity of the parties and was allowed to use the Personal Record Database (Basisregistratie Personen) to do so; # the candidate notary took multiple actions to (duly) change the address data and limit any further damage; # the candidate notary processed the data based on a legal obligation, which is allowed by the GDPR "in many cases", and thus there was no violation. Further, the plaintiff did not provide any concrete arguments regarding which article of the GDPR was allegedly breached.