GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The applicant is an official for the Supreme State Prosecutor's Office. From March and June 2017, the applicant disclosed the personal data of thirty-two data subjects without a legal basis in Slovenian law and without the consent of these data subjects. The Slovenian DPA (Information Commissioner or IP) defined the applicant's disclosures as a repeated violation of the first paragraph of Article 8 of the Slovenian Personal Data Protection Act (ZVOP-1). The IP further determined that the applicant had committed thirty-two offenses under Article 91 of the ZVOP-1. As a result, the Slovenian IP invoked domestic criminal regulating misdemeanor offenses (called the Minor Offenses Act or ZP-1) to impose on the applicant a fine of EUR 830 for each offense, as well as an additional EUR 2,380 sanction. Slovenia remains the only EU country which has not passed a national act implementing the GDPR. The Slovenian legal system does not allow for the issuing of administrative fines by agencies such as a DPA, which means that even courts cannot initiate proceedings. This should not be a barrier to the implementation of the GDPR because Article 83(9) creates an exception for such countries that do not provide administrative fines, allowing them to impose fines through competent national courts. Slovenia negligently failed to invoke this exception at the time of adoption of the GDPR, and instead continues to rely on ZVOP-1 for data protection. In summary, in Slovenia there is no entity that can impose administrative fines as prescribed by the GDPR, but the DPA can at least impose at least misdemeanor fines under ZVOP-1. ZVOP-1 gives the Slovenian DPA the power to directly issue misdemeanor fines through the procedural rules defined by the Minor Offenses Act (ZP-1). ZVOP-1 also sets maximum limits on the fines that the DPA can impose: €1 million for large companies, €300,000 for smaller companies, and €20,000 for individuals. These maximum fines are significantly lower than
The plaintiff and the participant in this case had previously been involved in another proceeding in which the applicant challenged a building permit issued to the participant. In this case the participant's representative introduced documents into the proceedings - a notarial contract with City A, to which the applicant, among others, was a party. Immediately following the conclusion of the above case, the complainant requested information from the participant on what personal data he was processing about the applicant. He set a deadline within which he expected a reply (less than one month). He did not receive an answer within the specified time limit and therefore asked the defendant (the supervisory authority) to intervene. The authority indicated that it could only take action one month after the request was made to the participant. The authority asked to be informed if the request was not complied with within one month. The applicant received the information about processing his data by the participant two weeks late. The complainant turned to the supervisory authority again, claiming that the information was incomplete. By letter of 6 January 2020, the participant's representative informed that full information had been provided to the plaintiff. Besides, only the participant's representative had access to the documents containing applicant's personal data. It had not been revealed to the participant. In June 2020, the DPA informed the claimant of its final decision. In the DPA's view, there was no infringement and therefore no further action was needed. The supervisory authority stated that the notarial contracts, to which the plaintiff was a party, had not been available to the participant at any time. They had been made available by the city of A-City exclusively to the law firm of the participant's legal representative. The plaintiff claimed that the above mentioned contracts were made available to the participant's legal representative by A-City viola
The applicant operates a sales outlet for the display and sale of barbecues, barbecue accessories and products relating to barbecuing. In line with the special regulations associated with the coronavirus pandemic, restrictions had been imposed on him in his shop in relation to the need to use certain hygiene measures. The applicant considered that he remained in a worse situation than garden, biulding and DYI markets to which customers would have barrier-free acces. The applicant's activity was subject to the restriction that the customer had to make a prior appointment in the shop and provide personal data for this purpose: name, address and telephone number. The trader was obliged to record personal data for the purposes of tracing infections. The outlet was obliged to store this personal data for a period of one month after the appointment of the individual customer, secure it against access by third parties, for the competent authorities and to transmit the data upon request of these authorities, as well as to delete or destroy it immediately after the expiry of the above period in a secure manner and in accordance with data protection legislation. A specific provision of the regulation issued in connection with the coronavirus pandemic has excluded the application of Article 13 GDPR, Article 15 GDPR Article 18 GDPR and Article 20 GDPR concerning the obligation to inform and the right of access to personal data. Customers were to be informed of these restrictions. Therefore, the applicant applied to the Administrative Court Frankfurt am Main for a temporary injunction to regulate the operation of its sales outlet so that it would not be subject to any special restrictions. Is the contested provision in Paragraph 3a(1), second sentence, No 22 of the CoKoBeV lawful? The Court found that the exemption to provide information if and to the extent that the data subject already has the information (Article 13 (4) GDPR), it does not provide for the power of a publi
In the emergency context of COVID-19 vaccination, the Ministry of Solidarity and Health entrusted the management of vaccine appointments on the Internet to various service providers, including the company Doctolib. Several associations including Interhop asked the interim relief judge to suspend the partnership with the Doctolib company insofar as the data collected was stored on an American company (Amazon Web Services or AWS), transfering data outside the EU non compliant with the GDPR. *Does Doctolib provide an adequate level of data protection when using Amazon Web Services? *Has the state sufficiently fulfilled its duty of care for the health data of the data subjects? It was held that no health data was provided other than certifying being eligible for priority vaccination. Additionally, it was considered by the Court the fact that Doctolib using the hosting services of AWS Luxembourg, whose data centres are based in France and in Germany. Considering the existence of legal safeguards, an addendum to AWS Ireland contract that no data would be transferred to the US and requests of access would be denied, and a technical safeguards entailing encryption of the data with a key held by a trusted third party in France, so that AWS does not have access to the data and the data being deleted after three months or at any time at the request of individuals, the Court considered that the level of protection in this context could not be regarded as manifestly inadequate. The Court therefore considered that in this specific context, data are not being transferred to the US. The application is therefore rejected by the Conseil d'État.
An individual lodged a complaint with the supervisory authority against the company, claiming that the company had unlawfully processed his personal data in connection with a car rental contract (including by means of a copy/scan of his identity card and driving licence). The company stated that it obtained the complainant's personal data from the complainant himself in connection with the conclusion of the car rental agreement, including his first name, surname, address, identity card number, driving licence number and telephone number, which it currently processes in its IT system designed for comprehensive servicing of car rental companies. The company submitted that it currently processed the complainant's personal data solely for the purpose of possibly establishing, investigating or defending against claims related to the car rental, on the basis of Article 6(1)(f) GDPR. Following an administrative investigation, the supervisory authority ordered the company to delete the complainant's personal data in terms of name, surname, address, identity card number, driving licence number. The DPA questioned the basis indicated by the Company for processing the complainant's personal data, as it did not appear from the evidence that the complainant had filed a claim against the Company or that the Company had asserted any claims against the complainant in court that would justify the Company's right to retain and process the complainant's personal data in connection with its safeguarding and assertion by the complainant or the Company. The Company appealed to the court. The court dismissed the controller's appeal against the supervisory authority's decision. The court pointed out that the legal basis for the processing of personal data listed in the provision of Article 6(1)(f) GDPR applies when the controller does not have the consent of the data subject, there is no provision which could constitute a basis for the processing of personal data, and when the controller
The case was brought by 'private hire drivers' in the United Kingdom. They use the services of Ola through the Ola Driver App. The passengers they transport use the Ola Cabs App. The applicants are affiliated with the App Drivers & Couriers Union (ADCU). In the application, they requested to be allowed to inspect the following in a commonly used electronic form: all personal data relating to them that Ola processes, including the personal data as mentioned in the privacy statement and the accompanying documentation, the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations and the retention period for these data, the existence of automated decision making, including those referred to in Article 22, paragraph 1 and 4 GDPR provided for profiling, and at least in those cases, useful information on the underlying logic, as well as the importance of and the anticipated effects of such processing, in the event of a transfer to a third country or an international organization, the appropriate safeguards in accordance with Article 46 GDPR that Ola has in place regarding this transfer. Additionally, the applicants requested Ola to provide personal data in a structured, commonly used and machine-readable form, namely as a CSV file, or by means of an Application Programming Interface ( API), in such a way that this data can be directly transmitted to another controller. The requests were based on Article 15 paragraph 1 GDPR 1. According to the applicants, Ola did not provide full access to their personal data in response to their access requests. The privacy statement and accompanying documents show that Ola processes a large number of categories of personal data, but the applicants have not obtained access to many of these categories. Furthermore, the datasets received by them consist o
The challenge was brought by four Uber drivers, each of whom had received a separate message from Uber stating that their Uber Driver account had been deactivated because Uber had determined that they had violated the applicable contractual terms and conditions of Uber by being guilty of fraud. According to the applicants, Uber's decision was taken completely automatically without meaningful human intervention. The decision led to the immediate termination of the agreement between Uber and the applicants and to loss of income. Additionally, according to the applicants Uber violated the principle of transparency by not informing them about the underlying logic, the importance and the expected consequences of the processing for them, not informing them of the type of fraud they are accused of and by not informing them that their accounts would be blocked in the event of fraud. In addition, Uber failed to explain the grounds for the decision in intelligible words. Uber argued that it did not deactivate the accounts of the drivers solely on the basis of automated decision-making. The controller demonstrated that the decision to deactivate the account of one of the applicants was a result of an investigation which included actions taken by an Uber employee such as carrying out a personal conversation with the driver about consequences of the fraud, followed by a written confirmation. According to Uber, after a fraud signal the driver's access to the Driver app is automatically temporarily blocked until the driver has contacted an Uber employee. Access to the Driver app is reactivated as soon as the driver has made contact. Does automated termination of contract by Uber fulfil scope of automated decision making under Artcle 22 GDPR? Did Uber violate the transparency principle by failing to inform the applicants about the consequences of the procedure? The Court found that Uber's contract termination procedure does not constitute automated decision making under Articl
The 10 plaintiffs are or were engaged to drive with the app of the defendant, Uber, in the United Kingdom. The plaintiffs are part of the App for Drivers and Couriers Union (ADCU) which protects their interests as private drivers and couriers in the UK. ADCU is itself a member of International Alliance of App Transport Workers (IAATW). ADCU and IAATW want to create a database of the personal information of drivers at Uber. The plaintiffs have made requests by email or via the Uber Driver App to access the data processed by Uber concerning them. Uber provided digital files in response to these requests. The plaintiffs asked the court to review the digital files provided and to order Uber to provide explanation on a series of questions relating to the files given. The plaintiffs claimed that the files given were not complete as the data given did not contain the full information that they were entitled to. The plaintiffs also claimed that the decision was automated within the scope of Article 22 and therefore Article 15(1)(h) applies. They also claimed to have a right to data portability under Article 20(1) GDPR and that information should be provided in a structured, commonly used and machine-readable format. They claim that Uber only provided a small part of the data in the required format. The plaintiffs asked the court to order Uber to: I. a) provide, within one month of notification and in a standard electronic form, access to: (i) personal data which Uber processes, such as the "Driver’s Profile" including the records of Uber employees, "Tags", and "Report", (ii) the purposes for processing, the categories of personal data, recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations and the storage period (iii) in the event of transfer to a third country or to an international organisation; the appropriate safeguards applied by Uber pursuant to art
The Amsterdam District Court upheld a decision by the Dutch DPA to deny Booking.com's request for prior consultation. The court ruled that the Spanish DPA is the competent supervisory authority, as the personal data would be collected to comply with a Spanish tax law.
On December, 7 2020, the French DPA imposed a financial penalty of 60 Million euros fine against Google LLC and a 40 million euros against Google Ireland Limited in accordance with the General Data Protection Regulation (GDPR) and ePrivacy Directive 2002/58/EC, for lack of transparency, inadequate information and lack of valid consent regarding for violating the regulation on cookies while operating the website [https://google.fr google.fr]. The sanction was accompanied by an order to comply with [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 article 82 of the French Law on data protection] (Law Informatique et Libertés), under three months on penalty of a €100,000 fine per day of delay. The companies appealed to the Conseil d’État in interim procedure against the CNIL's decision, arguing that the French DPA was not the competent authority because it was not the lead supervisory authority for Google LLC or Google Ireland Limited. Is the CNIL territorially competent to investigate and sanction a company for violating the information principle when depositing cookies if it is not the lead supervisory authority of the company? The CNIL considered that Google does have EU headquarters in Ireland, but that this Irish entity ‘did not have a decision making power’ in relation to the relevant cross-border data processing activities to which the complaints related. For that reason the CNIL decided that the One Stop Shop mechanism did not apply and that the CNIL, like any other European supervisory authority, was therefore competent to make a decision. The Conseil d’État rejected the request made by Google and ruled that the French DPA was territorially competent on this matter even though it is not the lead supervisory authority. The court stated that Article 82 of the Law Informatique et Libertés was a transposition of Article 5(3) ePrivacy Directive 2002/58/EC into French Law when dealing with cookies and that the CNIL is charged with enforcing th
Controller is the municipality of Venlo. Data subject worked for the municipality as administrative assistant until March 2017, on a temporary basis via an employment agency. During this period, the data subject made several reports of suspected wrongdoing, one of which was investigated externally by Ernst and Young, on request of the municipality executive. The data subject was reprimanded two times in 2016, for certain remarks they had made. As of 1 April 2017, the hiring of data subject was prematurely terminated. On 10 July 2018, data subject made two requests. One access request pursuant to Article 15 GDPR, and one for the disclosure of documents under the Government Information (Public Access) Act (hereafter: Wob-request). On 3 September 2018, the data subject filed another access request. In the Wob-request, the data subject asked to provide him with copies of, or to allow him to inspect, documents that directly or indirectly refer to reports he made of suspected wrongdoing, to the whistleblower process that followed two of these reports, to the two warnings he received and to the termination of his contract of employment as of 1 April 2017. In both access requests, data subject asked to provide him with copies of all documents containing personal data relating to him, or to provide him with an overview listing all documents containing his personal data and to allow him to inspect these documents. By decision of 9 October 2018, controller dismissed both access requests, but granted the Wob-request. After data subject objected to the rejection, and this objection was dismissed, the data subject brought the action before court. In their judgment of 13 February 2020, the District Court considered that an access request pursuant to Article 15 GDPR does not provide a claim to a copy of the document in which personal data are contained, insofar as the purpose of this right can be fully satisfied in another way. Moreover, it held that this provision does not giv
The Swedish DPA carried out an investigation of the Upper Secondary School Board in Skellefteåmunicipality and its pilot project at a high school that used facial recognition to record student attendance. The cameras installed with this technology use biometric personal data to uniquely identify natural persons. Such biometric personal data qualifies as particularly sensitive personal data (under Article 9 GDPR) concerning children. According to Article 9(1), the processing of such data shall be prohibited. The prohibition does not apply if the data subject consents to the processing of personal data for a specific purpose (Article 9 (2). For a consent to be valid, it must have been given voluntarily. Following an initial decision by the Swedish DPA, holding that the Board had violated the GDPR, the Upper Secondary School Board contended that students and their guardians provided valid consent to use of the facial recognition technology and appealed to the Court of Appeal. Following the appeal, the Court of Appeal in Stockholm upheld the decision of the Swedish DPA. The Upper Secondary School Board appealed the decision to the administrative court but the administrative court dismissed the appeal, finally rendering the decision of the Swedish DPA final. The Swedish DPA (IMY) held that the use of facial recognition technology to register student attendance is in violation with Articles 5, 9, 35 and 36 GDPR. It explained that students cannot provide meaningful consent to such data processing because of their dependence on school services. While there is a legal basis for administering the attendance of students at school, there is no legal basis to perform the task through the processing of sensitive data. The technology amounts to an intrusion of student integrity and is thus disproportionate to the task of measuring attendance. Furthermore, the DPA considered that the risk assessment reported by the Upper Secondary School Board did not meet the requirements o
Plaintiff was removed from the National Interpreters Registry after claims of fraud. The Tolk- en Vertaalcentrum Nederland (Dutch Interpreters and Translation centre), a intermediary company where plaintiff had an account, claims that plaintiff fraudulently put out, accepted, and then cancelled interpreting assignments, inducing the centre to pay him cancellation fees. As a result hereof, plaintiff was removed from both the centre and the national registry, and lost income. Plaintiff disputes that he put out the cancelled assignments, and claims that the Court should order KPN, an Internet Service Provider ('ISP'), to hand over information on the users of the IP addresses from which the assignments were created. This would allow plaintiff to prove that others put out the assignments, and claim damages from them. The Court considers that (in line with Dutch jurisprudence, see [http://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:HR:2005:AU4019 HR 25 november 2005, ECLI:NL:HR:2005:AU4019 (Lycos/Pessers)]) under certain circumstances ISPs can be forced to hand over subscriber information to injured parties. This allows them to bring actions before civil courts. This is in line with Article 6(1)f GDPR, as it necessary for the purposes of protecting the legitimate interests of a third party. However, in the present case, claimant fails to demonstrate that the 37 IP addresses logged by the intermediary company belong to one or more data subjects which have indeed fraudulently put out assignments. First of all, KPN only holds on to IP information for six months whereas all the assignments were put out in the period between 2017 and 2019. Secondly, the claimant received at least €3000. It is not credible that the claimant simply did not notice these charges before he was removed from both the intermediary and the national registry. Therefore, it seems unlikely that receiving the subscriber information will help claimant in his disputes with both organisations. As the con
Futura Internationale appealed against the French DPA's decision to impose a fine of 500,000 EUR on Futura Internationale for sending unsolicited marketing communications. Did the French DPA breach the constitutional principle of non-retroactivity of the law by applying the GDPR? Was the fine of € 500,000 imposed by the French DPA proportionate? The highest administrative court of France (Conseil d'Etat) dismissed the claim that even if the investigation by the (French DPA) CNIL started in March 2018, the infringement continued after the GDPR entered into force. Futura Internationale was notified of its administrative fine in October 2018. Therefore, the Court held that the French DPA (CNIL) applied the relevant law by applying the GDPR. There was no breach of the constitutional principle of non-retroactivity of the law by the CNIL. The French Court then assessed Article 83 GDPR and agreed that Futura Internationale failed to comply with several GDPR obligations, including the principle of data minimisation, the obligation to inform data subjects, the obligation to respect the right to object, the obligation to cooperate with the DPA and the obligation to safeguard data transferred internationally. It held that the violations were particularly important and persistent. Therefore, the Court concluded that the French DPA had not imposed a disproportionate fine. 500 000 EUR fine was 2.5% of Futura Internationale's annual global turnover. Therefore, the French Court rejected Futura Internationale's appeal against the French DPA's decision.
In the appealed AEPD's decision, [https://www.aepd.es/es/documento/ps-00385-2018.pdf PS/00385/2018], two customers had the same name, what caused a failure when verifying customer details, what caused Canary Islands Cars, a rental car company, to incorrectly use the information of customer A to create a car rental contract for customer B, who then committed a traffic offence. Subsequently, the details of customer A were incorrectly passed on to the Directorate General for Traffic (DGT). Once the DGT contacted the complainant, she/he realised that the contract that Canary Island Cars provided to the DGT for the purposes of issuing the fine was dissimilar to the one she/he had initially signed. Based on the mismatch of information, the complainant appealed the fine upon receiving it. The AEPD noted the following in decision [https://www.aepd.es/es/documento/ps-00385-2018.pdf PS/00385/2018]: "Knowing that there may be different names and surnames, the defendant has elements to verify identity by the national ID number (DNI), number that matches that of the driving licence, customer number or printing of the copy of the contract, among others. Although these verifications are normally carried out by the employees, it should be noted that in this case they were not carried out. If any of the three elements had been verified, the defect could have been detected in its origin. In other words, the identification document must be required at the right time to make the procedure effective”. The car rental company decided to appeal the case before the Spanish National High Court (Audiencia Nacional). In their appeal to this resolution, Canary Islands Cars argued that the accuracy principle had not been breached because the associated name was correct. The car rental company alleged that this was a human error and a fortuitous event. It also argued that the sanction imposed was disproportionate. Was the resolution of the AEPD decided in error? Should the appeal of Canary Is
The Plaintiff worked as the defendant's employee. Employees' data are been processed for billing purposes. For that reason plaintiff's personal data were stored by the employer. The plaintiff by his request, asked for a copy of his data stored by the employer. The request was followed by a lawsuit, from the investigation of which it emerged that the data were transferred to the US' headquarters. The transfer took place before the starting date of the regulation. Does the mere threat of a potential data misuse suffice to claim damages under Article 82 GDPR? The court held that neither §26(1) BDSG nor Article 6(1)f GDPR legitimize the processing of employee data for software testing purposes. This is due to the fact that for these two legal basis to apply, the element of necessity is lacking. Instead of actual personal data it would have sufficed to use fictitious data to test the software. In this matter the Regional Labour Court acknowledged a violation of the GDPR as well as the BDSG. Furthermore, the mere potential threat of loss of control over a data subject’s own data does not does not constitute damage under Article 82 GDPR, consequently, the plaintiff is not entitled to damages under Article 82 GDPR. That is for the reason that an individual is only entitled to compensation for damages they have „suffered“, hence, the damage must have in fact occurred and not merely been anticipated. It has been also maintained that the defendant did not violate the GDPR by continuing the processing by the parent company in a third country when the GDPR entered into force on 25 May 2018. This is for the reason that the defendant had concluded the EU Commission’s standard contractual clauses (SCC) before transferring the personal data to the parent company and amended the SCC in ways that is sufficient to comply with Article 28 GDPR.
In this case Proximus had failed to grant a woman's right of erasure of her personal data and had passed the data on to other telephone directories and directory enquiry services even after receiving several complaints and correspondence from the data subject. On request of the data subject, Proximus had changed the code linked to the data subject's data from 'visible' to 'confidential'. After adjusting the code regarding publication, Proximus received new contact details of the person concerned from her operator, as a result of which the data in the underlying database was automatically overwritten with the new data from the operator. The Belgian DPA imposed a fine of €20,000 on the defendant defendant for infringement of Articles 6, 7 and 12 of the GDPR. In the contested decision, the Belgian DPA found the infringement of Article 6, 7, 12, 13 and 24 GDPR sufficiently proven. In addition, the DPA ordered the defendant to cease any further disclosure of personal data of subscribers to third parties of telephone directory or inquiry services when Proximus acquired these data only as a provider of telephone directories and directory enquiry services, taking into account a transition period in order to give Proximus (and the telecommunications sector in a broader context) the opportunity to develop a new privacy compliant system. With regard to the question of whether consent is required to be included in telephone directories or not and what scope of this consent is, the Court of Appeal also considered that: 1° In situations where the e-Privacy Directive specifies the rules laid down in the GDPR, these specific provisions of the e-Privacy Directive as lex specialis prevail over the more general provisions of the GDPR. (principle of Lex specialis derogate legi generali) 2° Article 12(1) and recital 38 of the ePrivacy Directive refer to the requirement of informed consent within the meaning of Directive 95/46/EG of subscribers for being included in public directorie
Five Uber drivers from the United Kingdom, and one from the Netherlands, argued that they had been wrongfully accused of fraudulent activity and consequently dismissed by Uber by solely algorithmic means in the sense of Article 22 GDPR. The Uber drivers were represented by the App Drivers & Couriers Union ('ADCU') and Workers Info Exchange ('WIE'). The Court issued a default judgment as Uber was not present at the hearing. It: * considered Uber's decisions regarding the finding of fraudulent activity, the violation of its terms and conditions, and the employees' consequent dismissal, unlawful; * ordered Uber to reinstate the drivers' accounts within one week of the service of the judgment; * ordered Uber to pay the drivers a penalty of €5,000 for each day or part thereof that it does not comply with the main order, up to a maximum of €50,000; * ordered Uber to pay each driver damages, totalling €100,474.
The DPA of Berlin fined Deutsche Wohnen SE for violating Article 5(1)(c) and Article 5(1)(e) GDPR, because the DPA found that the company did not delete old data of tenants in a sufficient way. Deutsche Wohnen SE processed personal data like proof of identity, work, salary and creditworthiness, as well as data about health insurance, social insurance and tax within the framework of business activities. The Deutsche Wohnen SE did not agree with the DPA's decision and brought the action before court. The Court held that the fine notice was not valid. The fine notice was enacted against the Deutsche Wohnen SE as a legal entity under private law which is represented by its management. The Court, however, found that a legal entity can't be the subject of a fine procedure. According to the Court, only a natural person could commit an administrative offence in a reproachable way, while the legal entity just could be a secondary party, to which the actions of its representatives or board members are attributable. The DPA, on the contrary, held the opinion that a legal entity and a natural person can be treated in the same way in Administrative Offences Law. Furthermore, the fine notice did not mention the board member who committed or omitted the relevant action by name, nor contained it information about time and scene of the administrative offence or on what the reproach is supported. Therefore, the fine notice also cannot be reinterpreted into a separate decision according to § 30 (4) OWiG without having to adjust the fine procedure.
On the 29th of November 2018, following a complaint filed by three consumer associations, the Italian Competition Authority (Autorità Garante della Concorrenza e del Mercato – AGCM) adopted a decision against Facebook Inc. and Facebook Ireland. The Authority found that Facebook engaged in an unfair commercial practice towards its users by failing to inform them adequately and immediately about the commercial nature of the processing of their personal data, while emphasizing that registering to the platform was free of charge. For this reason, Facebook Inc. received a fine of € 5,000,000. The AGCM also found that Facebook engaged in an aggressive commercial practice towards its users by unduly influencing its users’ preference concerning the processing of data for commercial purposes. This was done by pre-selecting the option to consent to sharing data with third parties, while presenting them with the prospect of significant limitations in case they de-select such options. For this reason, Facebook Ireland received a fine of € 5,000,000. On the 18th of December 2019, the Regional Administrative Tribunal (Tribunale Amministrativo Regionale – TAR) of Lazio partially upheld two separate appeals brought by Facebook Inc. and Facebook Ireland. On the one hand, the TAR agreed with AGCM findings that Facebook misled its users into registering to the Facebook platform “for free”, without providing adequate and timely information about the commercial use of their personal data. On the other hand, the Tribunal found that the pre-selected options provided to Facebook’s users during their registration does not actually gather their consent to the transfer of data to third parties. This actually occurs at a later stage and on a granular level. Moreover, the TAR found that the AGCM failed in properly demonstrating the aggressive nature of such practice, and how it influenced the choices of the users. Both Facebook and the AGCM appealed against the TAR decision. Among others, Fa