GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
The case arose from LinkedIn’s appeal against a decision of the Irish Data Protection Commission, the DPA, dated 22 October 2024. In that decision, the DPA found that LinkedIn had infringed GDPR Articles 5(1)(a), 6(1), 13(1)(c) and 14(1)(c). The DPA imposed a reprimand, an order requiring LinkedIn to bring processing into compliance, and three administrative fines totalling €310 million. The underlying DPA inquiry followed a complaint lodged by La Quadrature du Net with the French supervisory authority, CNIL, on behalf of 8,540 LinkedIn users in France. The complaint concerned LinkedIn’s processing of personal data for behavioural analysis and targeted advertising. CNIL referred the matter to the DPA because LinkedIn Ireland was subject to the Irish supervisory authority in the context of cross-border processing. The DPA investigation lasted more than six years. The DPA first notified LinkedIn of the inquiry on 20 August 2018. After several requests for information, submissions, a preliminary draft decision, a draft decision under Article 60 GDPR and comments from concerned supervisory authorities, the DPA adopted its final decision on 22 October 2024. LinkedIn then brought a statutory appeal under [https://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/print sections 142 and 150 of the Data Protection Act 2018]. It also issued judicial review proceedings challenging aspects of the statutory scheme under the Constitution, the Charter and the ECHR. The High Court judgment did not decide the merits of the DPA’s GDPR findings. Instead, it dealt with four preliminary issues about the structure and standard of appeal. The key dispute was whether LinkedIn could challenge the entire DPA decision under section 142, because that decision included a fine, or whether section 142 was limited to the fine only. LinkedIn argued for a broader, unitary appeal. The DPA and the State argued that section 142 applied only to the administrative fine, while infringement findings and no
A data subject made an access request to a law firm (the controller), regarding the data it had processed in connection to their bankruptcy proceedings. The controller responded by stating it could not find any information related to the data subject, as it later realised the data subject was not a former client but the opposing party. The controller argued that Article 15 GDPR does not oblige it to collect data from the attorney of an opposing party. Finally, the controller argued that it could limit the access request on grounds of attorney-client confidentiality and to protect the rights and freedoms of others. The data subject filed a complaint with the DPA, arguing that the controller had not properly handled their access request. The DPA considered that the controller had not violated the GDPR, and dismissed the case. The data subject appealed the decision to the court, arguing that the DPA had misinterpreted Article 15 GDPR. According to the data subject, the DPA had claimed the case fell out of the scope of Article 15 GDPR, because the data subject could obtain court documents through the court. In addition, the data subject argued that the controller could not refuse the access request completely on duty of confidentiality grounds. The court first noted that the data subject was involved in a public bankruptcy proceeding, meaning the data subject needed to know the other parties involved. The court then stated that the DPA should have investigated which rights and freedoms were protected by the restriction on the data subject’s right to access. The rights and freedoms of others are not a valid ground to deny the access request in its entirety.See the ruling of the Administrative Law Division of the Council of State dated November 5, 2025, ECLI:NL:RVS:2025:5323, margin. 5.4. The court considered that the DPA had not sufficiently investigated the case, as it had not carried out the balancing exercise of the interests involved. This was supported by the fac
A company (the controller) commissioned a law firm to conduct a compliance investigation into alleged misconduct of a manager (the data subject) in August 2023. The investigation resulted in two compliance reports containing the allegations against the data subject, the names of whistleblowers and witnesses, and a summary of the findings of the investigation. The data subject claimed that she had the right to receive copies of the final compliance reports pursuant to Articles 15(1) and 15(3) GDPR. She requested access to these documents in order to verify what statements had been made about her, whether those statements were accurate, and how they had been determined. The controller refused to grant the data subject access to copies of the entire documents – it considered that its interest in maintaining the confidentiality of the compliance reports as trade secrets outweighed the plaintiff’s interest in obtaining information. The court of first instance ordered the controller to provide the data subject a copy of the earlier version of the compliance report. The appellate court dismissed the data subject’s claims. Following this, the data subject appealed before the Federal Labour Court and also requested access to an interim report related to the same investigation for the first time. The court dismissed the data subject’s appeal and held that she did not have the right to receive a copy of the final compliance reports under Articles 15(1) and 15(3) GDPR. The court held that requesting access to an interim report constituted an impermissible expansion of the claim in the appeal proceedings. Furthermore, the court held that the final compliance reports did not exclusively contain personal data within the meaning of Article 4(1) GDPR. For instance, the documents also contained legal analysis, which merely constitutes information about how the controller assesses the legal situation. Consequently, the court argued that the data subject did not need copies of the r
The data subject asked the county court (Harju County Court) to disclose several documents held by the court. The request covered three different categories of information. First, the data subject wanted to inspect and copy the file of a closed criminal case. Second, requested the applications submitted by third parties who had asked to access another criminal case file. Third, requested the employment contract and job description of the court’s press officer. He also asked whether the press officer had received any disciplinary sanctions. The court answered only part of the request. It stated that no disciplinary sanctions had been imposed on the press officer. However, it refused the remaining parts. It considered that the request required legal assessment and could therefore be treated as a request for clarification rather than as an access-to-information request. It also argued that the criminal case file and the third-party access applications contained personal data and restricted information. The employment contract was also refused on the basis that it contained information subject to access restrictions. The complainant challenged the refusal before the administrative court, which dismissed the complaint and upheld the county court refusal. He then appealed to the second instance court (Tallinn Circuit Court), which also dismissed the appeal. The data subject later appealed to the Supreme Court, which had to decide whether county court had correctly handled the request as a public information request and how access to court-held documents should be reconciled with the protection of personal data. The case raised issues under Article 6 GDPR, since disclosure of personal data by a public authority requires a legal basis; Article 9 GDPR, since archived criminal case files may contain special categories of personal data; and Article 86 GDPR, since the dispute concerned public access to official documents held by a public authority. The Supreme Court partially
In 2025, the Luxembourgish Tax Authority (the controller) requested a Luxembourgish company to provide it with tax related information from several Swedish data subjects, following a request for assistance from the Swedish Tax Authority. The controller requested information related to one specific data subject, but also requested a complete list of data subjects who held a specific type of loan with the company (including Swedish residents). The purpose was to verify data subjects’ tax situation. The company filed a case with the Administrative Court in September 2025, seeking to appeal the request. The court dismissed this decision, and the company provided the controller with the information. The company anonymised the data that was not related to the specific data subject and Swedish residents in order to comply with data minimisation requirements under the GDPR (Article 5(1)(c) GDPR). The controller requested the complete information, and fined the company €79,000 for refusing to provide it. The company filed a claim with the Administrative Court, who dismissed it and upheld the fine. The decision was then appealed by the company to the court, seeking to overturn the fine. The company argued that it had complied with the controller’s request while complying with the GDPR, and that information of data subjects that were not tax residents in Sweden would likely not be relevant for the controller. The controller argued that the request was justified under national law. The court dismissed the company’s appeal regarding data minimisation, but partly upheld the appeal regarding the fine. The court considered that the company did not comply with the controller’s decision, as it did not provide a complete list of data subjects holding a specific loan type with the company. The court dismissed the company’s data minimisation argument; according to the court, the company did not substantiate its argument as it did not refer to specific articles of the GDPR. Finally, t
The data subject, an Austrian citizen residing in Vienna, was enrolled in a distance-learning programme at a German university (the controller). When the data subject enrolled, the controller registered them under the official name shown on their identity document. The data subject experienced gender dysphoria and had chosen a gender-neutral name for themselves which was a different to their legal name. They requested the controller to rectify and replace their official name with their chosen name. They stated that the chosen name reflected better their gender identity. The controller refused the change because the data subject had not provided either an official document proving a legal name change or a dgti supplementary ID card. This is a German supplementary identity document issued by Deutsche Gesellschaft für Trans*- und Inter*geschlechtlichkeit e.V. (dgti e.V.), a German association supporting trans and intersex persons, which may certify, among other things, a chosen first name, pronouns, gender and a current photo. The controller claimed that such a document would allow it to record changes concerning pronouns and first name in its administrative system. On 6 May 2024 the data subject lodged a complaint with the Austrian DPA. They argued that the controller failed to comply with their rectification request under Article 16 GDPR. The data subject also relied on the CJEU’s judgement in [https://infocuria.curia.europa.eu/tabs/affair?lang=en&sort=AFF_NUM-DESC&searchTerm=%22C-247%2F23%22&publishedId=C-247%2F23 Deldits case(C-247/23)], which concerned the rectification of gender identity data under Article 16 GDPR. As the controller was established in Germany, the Austrian DPA considered that the Thuringian DPA was the lead supervisory authority for the cross-border processing. The Thuringian DPA held that the controller had not violated Article 16 GDPR. Because the complaint had been lodged with the Austrian DPA and the outcome was a dismissal of the complain
The parent company operated a customer loyalty programme through its subsidiary, the controller, starting 2 May 2019. The controller managed the operational business and processed personal data of registered customers, including profiling activities based on customer data. The controller designed the profiling consent forms, determined the data processing activities, prepared the privacy documentation, implemented technical and organisational measures, and established GDPR compliance processes. The parent company only financed the controller. On 12 October 2021, the Austrian DPA fined the parent company €8,000,000. The DPA considered the parent company and the subsidiary to be joint controllers under Article 26 GDPR. It held that the consent forms used for profiling did not meet the requirements for valid consent under Article 4(11) and Article 7 GDPR. It further held that the profiling lacked a valid legal basis under Article 6(1) GDPR because the consent was invalid. The parent company appealed. The Federal Administrative Court annulled the fine and terminated the proceedings. The DPA then appealed to the Austrian Supreme Administrative Court. First, the court referred to the case law of the Court of Justice of the European Union on the concept of controller under Article 4(7) GDPR and joint controllership under Article 26 GDPR. The court noted that a party qualifies as a controller only if it actually influences the purposes and means of the relevant processing operations. Merely establishing and financing a subsidiary did not automatically create joint controllership, as the parent company didn't exercise actual influence over the specific processing activities. As a result, the parent company was not a joint controller under Article 26 GDPR. Second, the court also rejected the DPA’s reliance on CJEU judgments such as Jehovan todistajat, Fashion ID and others, as those cases involved direct influence over concrete processing operations, which was absent here.
X International Unlimited Company (Formerly Twitter International Unlimited Company) (the controller), formerly Twitter, imposed a temporary restriction on a user’s (the data subject’s) account due to the controller’s automated detection system flagging the post as potentially violating the controller’s policy against child abuse after the data subject used the words “child pornography” in a post about the European plan to combat child abuse imagery. The controller did not notify the data subject of the restriction. The data subject submitted an access request to the controller to determine, among other things, the scope and reasons for imposing the restriction. The controller lifted the restriction without informing the data subject and later on responded to the access request referring to its privacy policy. However, the data subject filed a petition in court arguing that the controller failed to respond adequately to his access request. The controller provided the data subject with information regarding the imposed restriction through a letter in January 2024 and in September 2024 provided additional access to documents and information, including to a partially redacted printout from one of its systems. In front of the first instance court, the data subject requested an order to the controller to respond to the access request under Article 15 GDPR and the request for information regarding automated decision-making under Article 22 GDPR. The court concluded that the controller must respond to the requests and provide specific information regarding “reputation scores”, labels and one of its systems. The controller appealed the first court’s judgement. The appellate court upheld the contested decision but allowed the controller to redact the names of its employees and the exact timestamps of when automated decision-making occurred in the document it was ordered to provide concerning one of its systems. In this sense, the data subject declared that he
The father (the data subject) and the mother (controller) shared a minor child. On 18 May 2024, the data subject brought the child to the retail branch where the controller worked and left the child there. A video surveillance system by the branch recorded the handover. The controller obtained access to the footage and on 1 July 2024, she submitted it to the family court to raise concerns about the child's welfare. During the proceedings, a court-appointed expert assessed the incident and concluded that the father's conduct did not amount to a child welfare risk. On 12 July 2024, the data subject filed a complaint with the DPA. He argued that the use of the retail camera footage for private purposes breached the purpose limitation principle and lacked a legal basis. He also claimed that the retail branch had inadequate security measures because the mother had been able to access the footage. The DPA rejected the complaint. It found that the retail branch was not the controller for the video surveillance processing and that the mother's processing was lawful under Article 6(1)(f) GDPR. The father appealed to the court. First, the court held that the complaint against the retail branch failed because the branch was not the controller for the CCTV system, as another company within the corporate group had decided the purposes and means of the surveillance. Second, the court held that the mother was also a controller for the separate processing, purposes, and for submitting it to the family court. Third, the court assessed the lawfulness of the mother's processing under Article 6(1)(f) GDPR. The court found that the mother had a legitimate interest in asserting her rights in the child contact proceedings and in addressing a potentially problematic handover situation. The court also considered the child's interest in avoiding harmful or conflict-laden handovers to be a relevant third-party legitimate interest. It noted that behaviour and interactions during child hando
The data subject had his personal data restricted in the population register due to risks to life and safety based on his work. On 20 January 2022, a bus driver employed by the controller, a bus company, caused a minor traffic accident involving the data subject. The data subject later shared his name and address with the driver, requesting written communication only. On 2 March 2022, the data subject’s legal representatives informed the controller that heightened protection measures were necessary if his data were processed electronically. The controller reported the accident and forwarded related correspondence to its insurance company via email. On 12 April 2022, the data subject submitted an access request under Article 15 GDPR limited to the accident-related processing. The controller did not respond within one month. On 28 June 2022, the data subject filed a complaint with the DPA, arguing unlawful email transmission, insufficient security measures, lack of breach notification, and failure to respond to the access request. On 16 November 2022, the DPA rejected the complaint. It found that the email transmission was lawful and sufficiently secure, and that the controller could not identify the data subject based on the request. The data subject challenged this decision before the court, seeking corrective measures and a fine. First, the court held that the controller lawfully processed the data under Article 6(1)(f) GDPR. Reporting the accident to the insurer constituted a legitimate interest, and the data subject’s interests did not override this. Second, the court found no violation of Article 32 GDPR or Article 5(1)(f) GDPR. It considered transport encryption (e.g. TLS) sufficient given the low risk. The transmitted data consisted only of the data subject’s last name, which was not sensitive and did not increase the risk to his safety, despite the register restriction. End-to-end encryption was therefore not required. Third, the court held that no obligat
An individual (the data subject) intended to conclude an energy supply contract online with Go Green Energy GmbH (the energy provider). After initially receiving an email accepting the data subject as a customer the data subject's contract was automatically rejected due to an insufficient credit score provided to the energy provider by KSV1870 Information GmbH (the credit information agency or "KSV"). Therefore, the credit information agency's credit score led to the automated rejection of the data subject's application for the energy supply contract. The data subject eventually submitted a request to the energy provider requesting information under GDPR, in particular regarding the data exchanged with KSV. Furthermore, he submitted an access request with KSV under Article 15 GDPR. The data subject considered KSV’s response to his access request to be incomplete and filed a lawsuit claiming damages from KSV as well as the energy provider. The data subject claimed that he never consented to automated decision-making, but that the two controllers subjected him to such decision-making unlawfully in violation of Article 22 GDPR. Moreover, the data subject claim that the controllers relied on inaccurate information to calculate his credit rating, thus breaching the principle of accuracy under Article 5(1)(d) GDPR. The data subject argued that the refusal caused him worry, annoyance and stress, thereby resulting in non-pecuniary damage. He claimed €1,500 from both controllers under Article 82 GDPR in court. KSV claimed that it processed personal data under Article 6(1)(f) GDPR (i.e. legitimate interest) and that all data subjects have the right to request correction of their personal data used for the purpose of credit rating. Moreover, KSV argued that it only provided the energy provider with a credit rating, which was not a sufficient reason for a refusal to enter into a contract, and that it had no control over the energy provider's reasons for refusal. Therefore,
A disciplinary superior ordered a soldier (the data subject) to provide proof of her COVID-19 vaccination by presenting her vaccination certificate to the disciplinary superior in March 2023. She refused and lodged a complaint against the order in May 2023. The complaint was rejected in a decision in June 2023. The data subject appealed this decision. A military court rejected the data subject’s appeal and held that the order to provide proof of coronavirus vaccination was lawful and binding. The data subject appealed the case further to the Federal Administrative Court and contested the lawfulness of the order. The Federal Administrative Court held that there was no legal basis for the order to present the vaccination certificate in national law. In addition, the order was unlawful under the GDPR. The court considered the inspection of a vaccination certificate and its evaluation for the decision on a vaccination order to be processing of personal data. According to the court, a vaccination certificate contains information on the vaccination status of an individual and other health data that can only be processed if one of the narrowly defined exceptions in Article 9(2) GDPR is applicable. The court pointed out that German national law allows the personnel of the the medical service of the German Armed Forces to process health data of soldiers for the purposes of preventive medicine within the meaning of Article 9(2)(h) GDPR. However, the disciplinary superior was not part of the medical service and therefore not authorised to process health data. The exceptions in Articles 9(2)(b), (g) and (i) were not applicable to the present case either as the necessity requirement was not fulfilled. The court held that the data subject’s vaccination status could have been verified in a procedure less intrusive to the rights and freedoms of the data subject.
Secretaría General de Instituciones Penitenciarias (the controller) is an organ under the Spanish Ministry of Inner Affairs. The controller is responsible for coordinating and monitoring penitentiary institutions in Spain. In 2019, an employee of a penitentiary center (the data subject) brought a complaint to the DPA. The data subject provided a medical note to justify three days of sick leave, however the controller also demanded them to provide the diagnosis or medical treatment in order to justify the sick leave. The controller later reduced the data subject’s pay in relation to the three days for refusing to provide this information, as it considered that the sick leave was not justified. In 2021, the DPA issued a reprimand for the controller, stating that it had violated the principle of data minimisation (Article 5(1)(c) GDPR). The DPA noted that the controller did not have a legal basis to demand this information under Articles 6(1) and 9 GDPR.See decision number PS/00088/2020, https://www.aepd.es/documento/ps-00088-2020.pdf The DPA also dismissed the internal appeal filed by the controller, on the grounds that it had not provided any new facts or legal arguments.See appeal number RR/00103/2021 (same decision number), https://www.aepd.es/documento/reposicion-ps-00088-2020.pdf The controller appealed the DPA’s decision to the High Court in 2021. According to the controller, the data subject did not inform anyone before taking the sick leave, and did not respond to calls attempting to contact them. The controller argued that demanding additional documentation was justified under suspicions of false illness, as unplanned absences from employees can pose a security risk in the context of managing penitentiary centres. The court stated that the controller did not process personal data, because it had simply requested it from the data subject and not collected it. Therefore, the court upheld the appeal and overturned the decision of the DPA. The DPA appealed the de
X is a social media platform. X.AI LLC (a US company) is the provider of the generative AI chatbot Grok. X Internet Unlimited Company (XIUC) is the Irish entity that operates the platform in the European Economic Area and the UK (outside of these regions it is provided by X Corp, a US corporation). For GDPR purposes, XIUC is the controller in this case. One of the tasks that Grok does is generating visual content, where users can request the LLM to generate and/or edit images. Stichting Offlimits (a non profit organisation) estimated that Grok had generated approximately 3 million sexualised images between December 29 2025 and January 9 2026, of which approximately 23,000 depicted children. The controller later restricted the feature to paid members, and announced measures to prevent the Grok account on X from editing images of real people. In January 2026 the EU Commission announced that it was launching an investigation on whether the controller met its obligations under the Digital Services Act (DSA) relating to the dissemination of illegal content in the EU. In February 2026 Stichting Offlimits filed preliminary injunction before the court, requesting that the court prohibit the controller from generating and/or distributing sexual imagery through the image generating functionality. This was the case for non consensual imagery and imagery classified as child pornography under national law. In addition, the organisation requested the court to prohibit the controller from offering Grok’s functionality as part of its platform as long as it allows users to generate these images. The organisation brought claims based on tort and violations of the GDPR; specifically it argued that creating and distributing non consensual nude images was unlawful processing of personal data under the GDPR. The controller argued that it was impossible to generate these images, and that it implemented technical safeguards to prevent users from circumventing the restrictions on generati
The controller was an Austrian advertising company. The data subjects were persons whose conversation was recorded during a meeting with a representative of the controller. On 24 April 2024, a representative of the controller visited the office during business hours to offer advertising services. According to the findings of the court, when scheduling and conducting the meeting, the representative gave the impression that he was acting in connection with the municipality and that the purpose of the meeting was to update data. During the meeting, the representative made an audio recording. The recording captured the conversation with the data subjects and also included information such as an email address, names, social media account names, information about education, and conversations involving other persons nearby. The meeting took place without physical separation from the rest of the office. The representative presented contractual documents during the meeting and one of the data subjects signed the documents. These documents contained a clause stating that, for quality improvement purposes, the client consented to the recording of all conversations and to the taking of photographs when placing an order. The data subjects were informed about the recording clause only during the meeting. They stated that they had not been aware at the beginning that the ongoing conversation was being recorded. The data subjects filed a complaint with the Austrian DPA. The DPA first found that the controller had violated their right to confidentiality by recording the conversation without prior consent, nor overriding legitimate interest. The DPA then opened administrative criminal proceedings and imposed a fine of €6,300, plus procedural costs of €630. The controller appealed. It argued that the processing hadn’t begun when its representative entered the office, but only when the audio file was saved, that one of the data subjects had consented by signing the documents, that no p
A data subject filed a complaint with the DPA concerning the processing of personal data in a research project linked to an American researcher, the American association Prostitution Research and Education (PRE), and a Swedish association (the controller). The DPA opened supervision against the controller. It intended to assess compliance with the GDPR provisions on the basic principles, legal basis, special category data, criminal offence data and transparency obligations. The DPA later closed the case. It considered that the Swedish association was not the controller for the processing of the complainant’s personal data. In particular, the DPA relied on the ethical review application, where the association was not identified as responsible for the research project. The DPA considered that it's involvement, including participant selection, provision of premises, storage facilities and an email address, indicated processor status rather than controller status. The complainant appealed. They argued that the Swedish association had exercised influence over both the purposes and means of the processing, had its own interest in the research project, and could not avoid responsibility merely because PRE or another actor may also have been a controller. The Court upheld the appeal. First, the court held that the Swedish association was a joint controller. It recalled that controller status must be assessed objectively and interpreted broadly. What matters is whether an entity, for its own purposes, actually exercised influence over the purposes and means of the processing. A formal designation in project documents is not decisive. The court found that the Swedish association had a significant role in the project. It had initially identified itself as controller, was listed as a co-founder, had a representative involved in data collection, processing, analysis and report writing, had published research based on the project data, had used the project to pursue its own kno
The data subject requested access from a credit information agency (the controller). On 23 February 2019, the controller provided information under Article 15 GDPR, including personal data and three credit scores (Risk Indicator, Economic Index, and KKE score). The data subject argued that the response was incomplete, particularly regarding the origin of the data and the logic behind the credit scoring. The controller maintained that it had provided sufficient information, including data sources. It also argued that further details on scoring logic were protected as trade secrets and that the scores had not been disclosed to third parties. The DPA partially upheld the complaint. It found that the access response was incomplete and ordered the controller to provide more detailed information on the logic of the credit scoring. The controller appealed and assured that the scores had neither been shared with third parties nor had any effect on the data subject. The data subject could not substantiate any actual impact of the scores. First, the court assessed the scope of Article 15(1)(h) GDPR. It clarified that the obligation to provide meaningful information about the logic of processing applies at least where Article 22 GDPR is triggered. Second, the court relied on case law of the Court of Justice of the European Union to determine that Article 22 GDPR requires three elements: a decision, based solely on automated processing, that produces legal effects or similarly significant effects for the data subject. Third, the court held that while the credit scoring constituted automated processing and could qualify as a “decision”, it did not meet the third requirement. The controller had not disclosed the scores to third parties, and the scores had no impact on the data subject. Therefore, the court concluded that Article 22 GDPR did not apply. As a result, the additional transparency obligations under Article 15(1)(h) GDPR were not triggered. Finally, the court held tha
In 2020, law enforcement officers arrested several people from a climate protest. One of the individuals detained (the data subject) provided their identity, but refused to be fingerprinted and photographed, as well as to provide the code to their phone (or unlock it themselves). The data subject was later accused before the Paris Criminal Court of unlawfully organising a protest, as well as refusing to provide their data for identification and investigation purposes in accordance with national lawArticle 55-1 of the Code of Criminal Procedure. The court found them guilty of not providing their biometric data and fined the data subject €300. Both the data subject and Public Prosecutor appealed the decision to the Paris Court of Appeal. The court requested a preliminary ruling from the CJEU, regarding the compatibility of national law with provisions of the Law Enforcement Directive (LED), taking into consideration previous case lawSee Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C‑205/21, EU:C:2023:49, paragraph 135). Specifically, the court had questions regarding the systematic processing of biometric data of a data subject reasonably suspected of having committed or attempted to commit an offense in the context of an investigation, when the data subject has not necessarily been accused of committing an offense. The court referred the following questions: 1. Does the Law Enforcement Directive 2016/680 preclude national legislation from systematically processing identification data from data subjects who are suspected of having committed or attempted to commit an offense? 2. Does the Law Enforcement Directive 2016/680 require national legislation to oblige a competent authority to sufficiently explain why it is strictly necessary to process this data on an individual basis? 3. Does the Law Enforcement Directive 2016/680 preclude national legislation from allowing data subjects to be prosecuted on the basis of refusing
In 2020, law enforcement officers arrested several people from a climate protest. One of the individuals detained (the data subject) provided their identity, but refused to be fingerprinted and photographed, as well as to provide the code to their phone (or unlock it themselves). The data subject was later accused before the Paris Criminal Court of unlawfully organising a protest, as well as refusing to provide their data for identification and investigation purposes in accordance with national lawArticle 55-1 of the Code of Criminal Procedure. The court found them guilty of not providing their biometric data and fined the data subject €300. Both the data subject and Public Prosecutor appealed the decision to the Paris Court of Appeal. The court requested a preliminary ruling from the CJEU, regarding the compatibility of national law with provisions of the Law Enforcement Directive (LED), taking into consideration previous case lawSee Ministerstvo na vatreshnite raboti (Recording of biometric and genetic data by the police) (C‑205/21, EU:C:2023:49, paragraph 135). Specifically, the court had questions regarding the systematic processing of biometric data of a data subject reasonably suspected of having committed or attempted to commit an offense in the context of an investigation, when the data subject has not necessarily been accused of committing an offense. The court referred the following questions: 1. Does the LED preclude national legislation from systematically processing identification data from data subjects who are suspected of having committed or attempted to commit an offense? 2. Does the LED require national legislation to oblige a competent authority to sufficiently explain why it is strictly necessary to process this data on an individual basis? 3. Does the LED preclude national legislation from allowing data subjects to be prosecuted on the basis of refusing to provide identification data, even if they are not prosecuted for or convicted of the offen
A member of the Estonian Parliament (Riigikogu), the controller, published on his Facebook account a recording of a telephone conversation with an official of the Ministry of Social Affairs, the data subject. The recording disclosed personal data relating to the data subject, including special category data concerning the data subject’s health. The data subject lodged a complaint with the Estonian DPA (AKI), requesting that publication of the video recording be discontinued and that the recording be deleted. The DPA initiated supervisory proceedings and ordered the controller to cease disclosing the data subject’s personal data by removing the video from his Facebook account. The DPA subsequently closed the supervisory proceedings, issuing the controller with a reprimand and a notice terminating the proceedings. The controller then brought an action before the Tallinn Administrative court (Tallinna Halduskohus), seeking annulment of the DPA’s reprimand and notice terminating the proceedings, as well as a declaration that the DPA’s handling of the matter had been unlawful arguing that the conversation was an official exchange, that there was heightened public interest and that publication was part of his parliamentary mandate and covered by Article 6(1)(e) GDPR. The Administrative court dismissed the action. The controller subsequently appealed the Administrative court’s judgment before the Tallinn Circuit Court (Tallinna Ringkonnakohus), seeking annulment of the DPA’s decision and reconsideration of the matter. The court found that the publication of the phone recording on Facebook constituted processing of personal data under Articles 4(1) and (2) of the GDPR. The data subject was identifiable from the recording, including through their voice and the context of the call. The court also fund that the statement “I feel unwell” constituted health data, as it provided information about the person’s health status at a specific moment. The court rejected the argument t