GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The parties are related to each other. Defendant 1 believes that the takeover of the family business by her siblings was done to her disadvantage and that she is entitled to compensation. Defendant 2 (the husband of Defendant 1) sent emails to friends, family and business contacts of the business in question. That email described the Defendants’ side of the conflict, as well as also mentioned the names of all other involved family members, including the names of the wives of the siblings of Defendant 1, and the phone number of one of them. Can Defendants be ordered to refrain from processing of personal data relating to other family members with an order to pay a penalty of € 10.000,00 for each violation, to be increased by € 1.000,00 for each day that the violation continues? The Defendants argue that this prohibition is formulated too broadly and cannot be allowed. The Court ruled that in this case the sharing of the personal data via email or posting them on public websites/social media constitutes personal data processing under GDPR and that it was done without a legal basis. Given that it’s a family matter, the Court did not order the Defendants to pay a penalty. The Court ordered the Defendants to refrain from sharing personal data of plaintiffs, including via emails, website or social media posts, SMS or by any other means.
In its Joined Cases C-511/18, C-512/18 and C-520/18 and Case C‑623/17, the CJEU found that EU law precludes national legislation from requiring a provider of electronic communications services to carry out a general and indiscriminate transmission or retention of traffic and location data for the purpose of combating crime in general or safeguarding national security. However, the Court said, when combating serious crime and preventing serious threats to public security, a Member State may also provide for the targeted retention of that data as well as its expedited retention, given that such an interference with fundamental rights is accompanied by effective safeguards and is reviewed by a court or by an independent administrative authority. Following these cases, several French organizations lodged complaints with the Conseil d'Etat to declare invalid the French legal framework on access to and retention of connection data (identity data, traffic data, and location data) for the purposes of combating crime and safeguarding national security, that requires telecommunications operators to retain all user connection data for one year for the purposes of intelligence and criminal investigations. Firstly, the CE assessed the compatibility of EU law and case law with the French Constitution. According to the Court, European norms and case law (specifically the CJEU rulings) should not be able to jeopardize the ultimate French norm. Therefore, the CE needs to be consequent with that. Secondly, the CE remarked that the generalized obligation to retain data for purposes other than those of national security, notably the prosecution of criminal offences, is unlawful (with the exception of less sensitive data, such as civil status, IP address, accounts and payments). However, the Court also concluded that the general retention of data currently imposed on operators by French law is actually justified by a threat to national security. The Court also concluded that, even
The Company V. obtained from potential customers (i.e. persons applying for a loan) and customers the following consent: "I consent to the processing of my personal data by V. Sp. z o.o. for the purpose of direct marketing relating to the products and services of entities belonging to the "[...]" capital group, carried out by using telecommunications terminal equipment and automatic calling systems in accordance with Article 172 of the Telecommunications Law (Journal of Laws of 2014, item 234, as amended), and for this purpose I make available the data provided by me in this application with regard to: e-mail address and telephone number.". In relation to persons who gave the above consent, the Company conducted marketing activities by making telephone calls, sending text messages and emails. The General Inspector for Personal Data Protection issued a decision against the Company, which was appealed to the Provincial Administrative Court in Warsaw. In its judgment of 26 February 2018, ref. II SA/Wa 943/17, it dismissed the complaint of the company V. The Company appealed from the above judgment. The dispute concerned whether, on the grounds of the Act of 29 August 1997 on personal data protection, it is permissible to express a single consent to processing personal data for the purpose of direct marketing of the Company's products and using telecommunications terminal equipment for the purpose of such marketing, referred to in Article 172 of the Act of 16 July 2004 Telecommunications Law. The Supreme Administrative Court has dismissed the cassation appeal. The court held that the expression of consent to the processing of data for marketing purposes is a prerequisite for the lawfulness of processing of personal data by the data controller, and the consent is independent of the means by which the marketing is directed and should be separated from the means of direct marketing. The person giving consent must understand the essence of the consent, its purpose and
The plaintiff sought access to the files of the defendant's Youth Welfare Office concerning his daughters. In December 2017, the plaintiff's ex-wife asked the plaintiff for his consent to the immediate admission of the younger daughter to a psychotherapeutic clinic. In the same month, the plaintiff gave his consent, but at the same time demanded comprehensive information about the daughter's situation and the content of the planned treatment. The mother refused this. In March 2018, the plaintiff then applied to the defendant to be granted access to all files kept there in order to "assert legal interests". The divorced wife refused to allow the plaintiff to inspect the files, stating that the younger daughter did not wish to do so. By letter dated 26.3.2018 to the plaintiff, the defendant refused to grant access to the files. The plaintiff lodged an objection against this refusal. The plaintiff's objection was rejected. The plaintiff claimed that the documentation contained individual details on his person as well as on his divorced wife and on their common daughters. In the plaintiff's view, there was a well-founded assumption that these data on his person were highly relevant in terms of personality and fundamental rights and data protection law. He had no knowledge, or at least no precise knowledge, of this data, nor of the nature and content of the conclusions that the defendant had drawn from it, possibly to his disadvantage and over several years. Additionally, the plaintiff wanted to receive information about the condition of his daughter, which he could not have obtained in another way, especially from his ex-wife. The Court held that the protection of social data collected and "entrusted" to the youth welfare office in the context of child and youth welfare procedures generally supersedes the general provisions on the inspection of files and the protection or disclosure of social data. It is compatible with the requirements of the GDPR, because it c
The defendant conducts (i.a.) business as an address publisher under § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) and sells personal data for third-party marketing purposes. Starting in 2017, the defendant had created information on the presumed "affinities for political parties" of the entire Austrian population. This was done by gathering and combining information from anonymized polls and statistics on election results via an algorithm. As a result, individuals were assigned to one or more marketing groups and classifications regarding political affinity depending on their place of residence, age, gender, etc. The defendant had (i.a.) assessed that the claimant was likely to be interested in the far-right Austrian Freedom Party (FPÖ). After the claimant had learned this (following an access request under Article 15 GDPR), he filed a lawsuit against the defendant. He requested (i) an injunction that the defendant had to refrain from processing data on his presumed political opinions and (ii) € 1,000 in damages since he considered the alleged affinity to the FPÖ an insult, shameful and highly damaging to credit. The defendant had not disclosed the claimant's data to third parties. By 04.06.2019, the defendant had erased all data on "affinities for political parties", including those of the claimant. Throughout all court instances, the defendant argued that data on the "affinity for a political party" do not qualify as personal data, let alone special categories of personal data. The first-instance court (Landesgerichts für Zivilrechtssachen Wien) upheld the request for an injunction but rejected the request for damages, stating that the threshold for compensable immaterial damage had not been reached. The second-instance court (Oberlandesgericht Wien) confirmed this judgment. Both claimant and defendant appealed against this decision: the claimant appealed against the rejection of his request for damages, the defendant against the injunction to
In February 2020 the French minister of the interior enacted the [https://www.legifrance.gouv.fr/loda/id/JORFTEXT000041615919/ Decree No. 2020-151 of 20 February 2020 authorising the automated processing of personal data known as "mobile note-taking application"] (Décret n° 2020-151 du 20 février 2020 portant autorisation d'un traitement automatisé de données à caractère personnel dénommé «application mobile de prise de notes» (GendNotes)). The app should be used on the occasion of preventive actions, investigations or interventions necessary for the exercise of judicial or administrative police missions. Among the data that can be collected is information relating to alleged racial or ethnic origin, political, philosophical or religious opinions, trade union membership, health or sexual activities or orientation. A group of human rights organisations filed a complaint with the French Constitutional Court. Is the "GendNotes" App of the French national police force (Gendarmerie nationale) unlawfully processing special category personal data? The French Highest Administrative Court held that the decree infringed Article 4 of the [https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460/ Law of 6 January 1978], implementing GDPR in France, the Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data and Article 8 CFR, as it excessively infringed upon the right to respect for private life and the correlative right to protection of personal data, without providing appropriate safeguards for their protection in terms of the purpose of the processing and the nature of the data collected, as well as excessive data retention period, data sharing and data security. The Court discussed whether the decree violated Article 4 (a) GDPR, Article 4 (b) GDPR, Article 4 (c) GDPR, and Article 4 (e) GDPR and Article 9 GDPR. According to the Court, the processing of data did not comply with the principle of purp
In May 2019, a hacker obtained unauthorised access to the webserver and website of Nederwoon.nl and exported personal data of users of the website to his personal computer. The hacker was found guilty for unauthorised intrusion in a different case. The plaintiff argued that NederWoon is in breach of Article 5 GDPR because the plaintiff's personal data should have been deleted because it was no longer necessary in relation to the purposes it was processed for, and because there were no appropriate technical and organisational measures in place to protect the data. The plaintiff therefore requested a compensation for the damages due to a breach of the GDPR. NederWoon claimed that there was no breach of the GDPR and that there was no damage on the plaintiff's side. The court held that the plaintiff must prove why Article 5 GDPR was breached. The simple fact that a hacker obtained access to personal data does not mean that NederWoon was acting in breach of Article 5 GDPR. Furthermore, the plaintiff must prove that he in fact has (immaterial) damages on his side. A breach of the GDPR does not automatically lead to damages. (Also see: [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:HR:2019:376 Dutch Supreme Court (Hoge Raad) ECLI:NL:HR:2019:376]). The simple statement that the plaintiff experienced distress is insufficient without further elaborating on why this bothered him or how the distress expressed itself. Because the damage was not substantiated, the claims cannot be upheld. Therefore, the breach of the GDPR is not further discussed.
The defendant has posted content of the plaintiff’s child on social media. The plaintiff has not given her consent. The plaintiff has asked the defendant to remove the content. The defendant did not remove the content. The defendant states that she could post the content considering she is attached to the child and because her child is his halfsister. Does the defendant have to remove the content of the minor from social media because the plaintiff (the minor's mother) did not give her consent? The court holds that based on the GDPR and the Dutch GDPR Implementation Act the legal guardian of a minor under the age of sixteen has to give consent for posting content (photos or videos) of the minor.
The claimant submitted data subject access requests to the municipal executives of Roerdalen, Valkenburg aan de Geul, Vaals and Brunssum in 2020. The municipal executives responded within one month asking the claimant to identify himself and informing him that his requests cannot be processed until this is done. The claimant sent requests to expedite the decision on his requests taking the view that decisions on his requests were not taken in a timely manner. In their responses, the municipalities have referred to their earlier letters and asked the claimant once again to identify himself. The claimant filed appeals regarding the failure to make timely decisions on his GDPR access request. Has the claimant abused his rights? Should his requests be rejected by the municipalities? The Court considered that the claimant had not used his access request to exercise his rights in line with the GDPR, but rather to initiate proceedings against the municipalities in question and collect penalty payments for the delayed decisions. The claimant failed to mention the GDPR in his access request, which had caused ambiguity and delay. Furthermore, he did not identify himself and failed to respond to the several identification requests sent by the municipalities, although he was aware that this would prevent the municipalities from deciding on his request. When sending his notices of expiration, the claimant was aware that his request could not have been decided upon. Moreover, these notices were worded in such a way that they could have and have indeed caused further confusion. The claimant showed bad faith and has therefore abused his power. The appeals for the failure to make a timely decision are declared inadmissible on account of abuse of rights.
The District Court of The Hague reduced a fine imposed on a private hospital by the Dutch DPA from €460,000 to €350,000 after the hospital improved its technical and organizational measures during the appeal phase. The Court also noted that the Dutch DPA has the power to interpret and give substance to Article 32 GDPR.
The plaintiff, a member of Mastercard’s loyalty program, sought compensation after her personal data got hacked from the Mastercard network and then published online. The claim was based on two cases of apparent non-compliance with GDPR: (1) the defendant not granting right of access Article 15 GDPR; (2) not implementing appropriate technical and organizational measures to prevent a data breach (Article 32 GDPR). Does the plaintiff have a right to compensation according to Article 82(1) GDPR and does Article 82(3) GDPR stipulate a reversal of the burden of proof so that the onus is on the controller to show that it has not acted wrongly? The Higher Regional Court dismissed the claim as it considered the appeal to be without merit. The Higher Regional Court maintained that every individual that has suffered material or non-material damages is entitled to receive compensation from the controller for the damage suffered Article 82(1) GDPR. However, for the controller to be held liable a breach of duty by the controller must have occurred. Furthermore, it is imperative that the damage suffered, is not merely attributable to a processing of personal data during which a violation of the GDPR has occurred. Yet, the Court did not identify the aforementioned breach of duty by the controller. That is for the reason that the defendant neither violated Article 15 GDPR by not responding within the set limits nor did the plaintiff show that the defendant did not implement appropriate technical and organizational measures as provided for by Article 32 GDPR. The Court held that the GDPR does not change the fact that the burden of proof to show that a breach of duty has occurred must be borne by the plaintiff. Citing the Austrian Supreme Court the Higher Regional Court Stuttgart maintained that EU law does not contain any specific rules on the burden of proof. Hence, the onus is on the claimant to show and prove the prerequisites for the claim. Only when it has been shown by the
The applicant was the subject of a decision by the district governor to stop his driving licence on the ground that he had exceeded the speed limit by more than 50 km/h. That decision was upheld by the Local Government Appeal Court. The applicant appealed to the Provincial Administrative Court in Kielce. In his appeal, he argued, inter alia, that in the case there had been a breach of the provisions on the protection of the applicant's personal data on the part of the District Office and a failure on the part of the District Office and the Self-Governmental Appeals Board to take steps to inform the persons named in the decision and the President of the Office for Personal Data Protection of this breach (the leak of sensitive data). The Provincial Administrative Court in Kielce dismissed the appeal.
The controller is a credit scoring agency with a trade license according to § 152 of the Austrian Trade Regulation Act (GewO). It used, inter alia, two receivables against the data subject and various former addresses (8 moves in 11 years) in its file on the basis of which his creditworthiness was assessed. The receivables amounted to mid-double-digit amounts. They arose between 2016 and 2017. The data subject was in a so-called continued qualified default of payment with regard to both receivables. This means that there was a delay in payment, the first two reminders by the creditor and also a third reminder by a collection agency had been unsuccessful. In 2018, the data subject paid the receivables. The controller then entered a "positively settled" note for each of the receivables in its data system. The controller rejected the data subject’s request to delete the two receivables as well as all his former addresses. Subsequently, the data subject filed a complaint before the Austrian DPA (DSB). The DSB decided that the right to be forgotten was infringed since the controller did not follow the request. The controller has filed an administrative appeal against this decision. The Austrian Federal Administrative Court (BVwG) ruled that the data subject was not entitled to deletion. Such a right does not arise from Article 17(1)(a), (c) or (d) GDPR. In particular, this was justified by the fact that the processing operations at issue were in compliance with the principles of Article 5 GDPR and that they could be based on the legal basis of Article 6(1)(f) GDPR. = == The BVwG ruled that the principle of process limitation was respected. The assessment of creditworthiness by credit agencies is a defined and clear purpose recognised by the legal system. This can be derived from § 152 GewO. The data were also accurate and complete because the controller entered a “positively settled” remark after the two claims have been paid. They were also fundamentally necessary
In April 2020 a data subject lodged with the Office for Personal Data Protection a complaint against unlawful processing of his personal data by Poczta Polska S.A. (Polish Post). In his complaint, the complainant referred to reports that the Polish Post had submitted an electronic request to the Ministry of Digitalisation to transfer his personal data. The complainant indicated that, to the best of his knowledge, in responding to the above request the Ministry issued the data covered by the request to the operator. In these circumstances, the complainant requested the President of the Office for Personal Data Protection to require from the controller to cease the processing and delete his personal data by the Polish Post. The complainant also mentioned that Poczta Polska S.A., as a postal operator, may receive personal data on condition that they are necessary for the performance of tasks connected with the organisation of the election of the President of the Republic of Poland or performance of other duties imposed by government authorities. However, as the complainant pointed out, none of the above prerequisites had been fulfilled because the Act introducing the obligation of voting by post was still not a binding law due to the unfinished legislative process. The President of the Office for Personal Data Protection refused to initiate proceedings. The data subject filed a complaint with the Provincial Administrative Court. Was the acquisition of personal data by Poczta Polska S.A. legal? The Court revoked the appealed decision of the President of the Office for Personal Data Protection and found that the supervisory authority, by issuing the disputed decision, committed a breach of administrative procedure, which had a significant impact on the outcome of the case. The Court pointed out that the DPA incorrectly decided that there were grounds to refuse to initiate administrative proceedings on account of the alleged lack of subject-matter of the proceedings.
NWO-I (Netherlands Foundation of Scientific Research Institutes) rejected the applicant’s subject access request. More specifically, the applicant wanted to see what personal data was sent to his former employer by email and examine the related documents. NWO-I is of the opinion that the access request is formulated too broadly and must be rejected. Moreover, NMO-I claims that it has checked its personnel files and that these do not contain any personal data of the applicant. The initial request of the applicant was indeed very broadly formulated. However, the applicant has subsequently explained that he was looking for specific emails between NWO-I and his former employer. Moreover, the applicant was able to demonstrate an email chain where he was mentioned. The Court noted that the right of access does not extend to (parts of) internal notes that contain the personal thoughts of employees of the data controller and that are exclusively intended for internal consideration. However, this exception does not apply in this case because the personal data were shared with third parties outside of NMO-I. NMO-I must provide the applicant with the complete overview of all personal data it processed via emails with third parties concerning the applicant and his former employer. NMO-I must also provide copies of underlying documents, but it can edit out the names of the senders and recipients.
The data subject filed a complaint with the supervisory authority about the unlawful processing of her personal data, in particular her image, by a sole proprietor (the controller). The complainant stated that she had been invited by the controller to take part in a music video which he was to produce. The complainant gave her written consent to the free processing of her personal data, including the use of her image by the controller. The unpaid consent to data processing in question covered the use of the complainant's personal data, i.e. her image, in connection with the production of a music video by the band [...], made for the song "[...]", which was subsequently published on the [...] portal. The complainant emphasised that she did not enter into a contract with the Controller covering her participation in the clip, nor did she receive any remuneration for appearing in the clip or for the use of her image. The complainant explained that, after her performance, she received the sum of PLN 150 as reimbursement of costs associated with the preparation for the music video and travel to the shooting set. This amount was also compensation for the time spent by the complainant on, among other things, studying the script of the music video. The Controller published the abovementioned music video on his recording studio's profile on the website [...], also making available there the complainant's personal data in the form of her first and last name. The Controller also published on the [...] and Instagram portals a photographic material with the image of the complainant, making available there also her personal data in the form of her first and last name, as well as another film material using the image of the complainant ([...]). The photographic material using the image of the applicant and her name and surname data was also made available by the applicant to other commercial portals. In January 2019 the complainant withdrew her consent to the processing of her pe
On 28 March 2019, the complainant submitted a DSAR to the Directorate of Legal Affairs of the Ministry of Foreign Affairs (The Directorate). The complainant has previously received an email from the Repatriation and Departure Service (DT&V), containing data about the claimant. According the DT&V, that data originated from the Directorate. On 29 April 2019, the Directorate rejected the complainant’s request of access to his personal data. On 17 September 2019, complainant’s objection to this decision was rejected as unfounded. The complainant appeals against this decision. The Directorate claims that the complainant’s DSAR cannot be granted because the Ministry is not controller of the affected personal data: the identity investigation in question was ordered by the Repatriation and Departure Service (DT&V). In addition, after rejecting the complainant’s objection, the Directorate claimed that the complainant was abusing his rights. The Directorate pointed out that complainant has submitted access requests to both DT&V and the Directorate, and that he wanted to use this data in other process, so access to personal data was not the end goal of the request. The Court considered that it was not obvious that the complainant’s wish to access his data was contrary to the purpose of the GDPR. The fact that these data could be used in another procedure also did not not lead the Court to believe that there was an abuse of rights. The Court also pointed to the case law, from which it follows that the access request where another procedure is concerned only constitutes an abuse of rights in special circumstances. For example, if rights or powers have been used so manifestly without reasonable purpose or for a purpose other than that for which they were granted. The Court saw no reason to rule that there had been an abuse of rights by the complainant. When deciding whether the Directorate was a controller or a processor, the Court considered the following. The Director
The plaintiff requested access to his personal data processed by The Repatriation and Departure Service (Dienst Terugkeer & Vertrek) on the basis Article 12 GDPR and 15 GDPR. The State Secretary of Justice, on behalf of The Repatriation and Departure Service, provided the plaintiff with an overview. The plaintiff argues not all available, underlying information was provided. He argues that the State Secretary is in therefore in breach of the GDPR. The State Secretary claims he is not in possession of the underlying information the plaintiff is refering to. Should information about people other than the data subject be included in an access request based on Article 15 GDPR? Does Article 15 GDPR require that (copies of) the original documents are provided? The District Court Rotterdam holds that the right of access is limited to personal data concerning the data subject. Furthermore, an overview of the requested data suffices. The original documents (or a copy) don't have to be provided.
The controller engaged DEX Online Services to automate its membership administration, which contained personal data of the plaintiff. He also offered its members the opportunity to use the Yogibit app to gain access to their own data, so that they can, for example, deregister and register for lessons. On January 30, 2019, the plaintiff filed a complaint with the Dutch DPA against the controller. The DPA rejected the complaint by decision of 27 February 2019, because it found no obvious violation of the GDPR . Plaintiff has objected to this rejection. According to the DPA, both the controller and DEX Online Services have complied with the claimant's request for removal within the meaning of Article 17 of the GDPR. The controller has a valid basis for the processing of the plaintiff's personal data and it has not been shown that his personal data has been processed in the YogiBit app. In appeal, the plaintiff argues that the controller should have first explicitly requested permission from him before his personal data would be provided to DEX Online Services. According to the plaintiff, the defendant has forgotten to look at the definition of 'consent', as set out in Article 4 (11) of the GDPR . Additionally, it was not necessary for the controller to enable DEX Online Services for its student administration. According to the plaintiff, the controller could also have chosen to hire a secretary. In addition, the plaintiff stated that as a free EU citizen he has the right to choose whether he wants to go along with the choice of the controller for that third party. Plaintiff argued that it was up to DEX Online Services to ascertain that the controller complied with the conditions set out in Article 6 of the GDPR . In his view, on the basis of Article 5(2) GDPR the controller has an accountability obligation and must be able to demonstrate compliance with Article 5, first paragraph, of the GDPR . The plaintiff argued that the decision did not provide evidence of such com
= Article 30 Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for money laundering or terrorist financing (AMLD4) obliged Member States to include information about the ultimate beneficial owners (hereinafter: 'UBOs') of companies and other legal entities in a central (trade) register, a company register or a public register. Information about UBOs should in all cases be accessible to the competent authorities, the Financial Intelligence Unit (FIU) and the obliged entities in the context of their customer due diligence. In addition, all persons or organizations that could demonstrate a legitimate interest had access to the name, month and year of birth, nationality and state of residence of the UBO, as well as to the nature and scope of the economic interest held by the UBO. On July 9, 2018 Directive (EU) 2018/843 of the European Parliament and of the Council of May 30, 2018 amending AMLD4 entered into force (AMLD5). The amended article 30 paragraph 5 stipulates that information about UBOs must be publicly accessible. In all cases, competent authorities, the FIU, the obliged entities in the context of their customer due diligence and every member of the public must be able to consult the UBO information. This includes at least the name, month and year of birth, state of residence, nationality and the nature and size of the economic interest held by the UBO. AMLD5 also states that protection of publicly accessible UBO information can be requested, this on the understanding that this exception cannot be invoked against the competent authorities, the FIU, credit institutions, financial institutions and obliged entities that are public officials. It has been added that a request for foreclosure should be decided on a case-by-case basis, based on a detailed assessment of the exceptional nature of the circumstances. AMLD4 and AMLD5 have been implemented in the Netherlands by amending