GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Minister of Health, Welfare, and Sport
In 2021, two data subjects requested the deletion of their personal data related to their Covid-19 vaccination records and Covid-19 personal data held at the National Institute of Public Health and the Environment. The controller, the Minister of Public Health, Welfare and Sport, provided them with two options to confirm their identity: by sending either a scan of their passport or by physically identifying themselves before the Ministry. The data subjects did not use either option and the controller subsequently rejected their requests. The data subjects filed a complaint before the court of first instance. The court ruled that the minister was justified in dismissing the objections as unfounded. It ruled that the minister was entitled to disregard the requests on the ground that the identity of the persons concerned could not be established. Plus, while the Covid-19 measures were still in effect, deletion of the vaccination data would make it impossible for an individual to prove that they where vaccinated via the government application for Covid-19. The data subjects appeal the decision of the court of first instance before the Council of State. The data subjects argued that the identification options given by the minister were unreasonable since by sharing a copy of their passports they incurred many risks. Second, physical identification at the Ministry unreasonably burdens the data subject. Third, they proposed the alternative to be identified with the last three digits of their BSN, combined with telephone verification. First, the court stated that the controller should take all reasonable measures to verify the identity of a data subject who is making a request referred to in Articles 15 to 21 GDPR and can request further information regardless of whether he has doubts about the identity (Article 12(6) GDPR and https://gdpr-info.eu/recitals/no-64/ Recital 64). Furthermore, the court ruled that the minister had discretion to the manner in which it es
Google France
A dentist (the data subject) found a listing of her on Google My Business (GMB) in 2017, which included personal data, reviews and ratings related to her professional activity. The data subject requested Google France to delete the reviews and remove the reviews function from her listing. After a refusal from Google France and Google LLC, the data subject brought a case to the Chambéry regional court. This court ordered in 2019 Google France, Google LLC and Google Ireland to disclose the authors of the negative reviews. After being unable to remove half of the negative reviews, the data subject brought a request for interim relief to the Paris Regional Court in order to delete the listing. This was refused, and the data subject brought the request to delete to the Court of Chambéry. In 2022 this Court stated that the Google companies did not have a legitimate interest in processing the data subject’s data without her consent. Google had also not complied with the principles of fairness and transparency. Finally, the Court ordered the Google companies to delete the data subject’s listing on GMB. The Google companies were also jointly liable for non-material and procedural damages. The Google companies appealed the case the same year. The Google companies argued that the processing was justified by the legitimate interest of providing users with the means to evaluate professionals and receive information about their work. Furthermore, Google France argued that the case was inadmissible, as it was not involved in the Google services in question. The data subject argued that Google France operates the services based on case law Google Spain, and requested the Court of appeal to uphold the reasoning of the previous Court. The Court first stated that Google France did not have standing in this case, as it was not the operator of the search engine or the owner of the www.google.fr domain. According to the Court, the terms of service refer to Google Ireland, and the corre
Ex-employee (data subject)
The data subject was an employee, the controller was the employer. On 14 January 2022, the data subject requested access to personal data from the controller under Article 15 GDPR. They did not respond. On 28 January 2022, the controller terminated the employment. On 17 February 2022, the data subject lodged a complaint with the Data Protection Authority (DPA) under Article 77 GDPR. The data subject alleged that the controller had failed to answer the access request, had taken unauthorised photographs, and had a copy of their vaccination certificate. On 24 February 2022, the employment relationship ended by a court settlement before the Labour Court. The settlement stated that all claims arising from the employment relationship and its termination, whether known or unknown and regardless of their legal basis, were settled, except for employment documents. By entering the settlement, the data subject agreed to not pursue further claims. After the settlement, the controller informed the DPA that it had not received an access request from the data subject, had not taken photographs, and had destroyed the vaccination certificate after the employee left. The data subject continued to raise issues with the DPA, including access to time-tracking data and alleged inaccuracies in the controller’s provided documents. The controller later provided partially redacted time-tracking data. On 26 July 2022, the DPA closed the administrative procedure, as it considered that the data subject no longer had a right of access under Article 15 GDPR because the settlement didn't allow for this claim. The data subject challenged the DPA’s decision before the Administrative Court. On 10 July 2024, the court dismissed the action. The data subject appealed. First, the court held that the right of access under Article 15 GDPR was, in principle, waivable. Although Article 8(2) of the Charter of Fundamental Rights protects the right of access, the court noted that data protection law is base
Data Subject versus The State Secretary for Justice and Security, on behalf of the Child Protection Council
On 24 January 2023, the data subject made a rectification request to the State Secretary for Justice and Security (controller), regarding a report drafted by the Dutch Child Protection Board (Raad voor de Kinderbescherming, RvdK). The report contained the results of a professional assessment of the data subject’s parenting capacity, contributing to the subsequent placement of the child under the supervision of child protection services and out of the data subject’s custody. The data subject argued that the report contained factual inaccuracies, misleading terminology (such as “psychiatric issues”, “substance use”), and painted an incorrect picture of her due to the absence of important events in the timeline of the report. In 16 November 2023, the controller rejected the rectification request. It claimed that the contested data did not qualify as personal data under the GDPR because they were impressions and opinions that had been received in connection with the RvdK's investigation. The data subject made an objection to the decision of the controller. After the reassessment of the request, some terms were adjusted, e.g. “psychiatric issues” was replaced with “psychological issues”. However, the controller rejected the request in part, maintaining that much of the content reflected professional impressions or third-party statements, mainly the opinion of the father of the child, not subject to rectification under Article 16 GDPR. The data subject filed an appeal before the court of first instance (District Court of Midden-Nederland) against the controller regarding the partial rejection of his request. The court found that the disputed data did not meet the threshold for rectification. It held that, from settled case law by the highest administrative court, it follows that not all inaccuracies are eligible for correction under Article 16 GDPR. The inaccuracies must be easy and objective to determine to qualify for rectification. The court held that the controller was not obliged to amend the report to include certain events mentioned by the data subject or make adjustments to the timeline of the report, because part of the data did not constitute personal data (whether letters/emails have been sent) or others were personal data of third parties (the father's). For the rest, the court found that the desired adjustments regarded impressions, opinions, research results and conclusions of the father, the RvdK and other professionals, which are not eligible for rectification under Article 16 GDPR. The court also found that the term “substance use” is not incorrect, even though the data subject claimed that it was a one-time use and there has been no addiction at this time, because the inaccuracy of this third-party statement is not easy and objective to determine. The court dismissed the appeal as unfounded and found the controller’s refusal to correct other parts of the report lawful, under Article 16 GDPR.
Court case 30087 C 102/24
The data subject booked a train ticket from the controller for travel on 16 October 2022. During the journey, their ticket was scanned during routine inspection. On 19 October 2022, the data subject filed an access request under Article 15 GDPR, seeking a full copy of all personal data related to the ticket, including how, when, and on which trains the ticket was used, and whether it had been validated. The controller responded by providing booking data but did not include details from the ticket inspection ("inspection data"). According to the controller, inspection data are generated when staff scan tickets. These records contain the ticket order number, time of inspection, train number, and scanner ID. They are used in a background system for plausibility checks (e.g. reuse or use of cancelled tickets) but are not linked to a name or passenger by default. Only in case of anomalies are inspection data connected to booking records (which include names). No such anomalies occurred in the data subject's case, and therefore no linkage between the inspection and booking datasets was established. The datasets are deliberately stored separately for privacy reasons. Despite this, the data subject insisted that the information about the ticket inspection and any validation constituted personal data, and filed a lawsuit seeking full access, including any data revealing actual ticket usage. They also demanded a sworn statement of completeness and proposed referring questions about the German Civil Code to the CJEU. The court held that the access right under Article 15 GDPR did not extend to the inspection data in this case. These records could not be considered personal data of the data subject because no identifiable linkage to them had actually occurred. Although the order number can technically be used to identify a person, such linkage only happens in case of anomalies (e.g. suspected fraud). Since none were present, the data remained unlinked and, in the court’s view, not personal data under the GDPR. The court emphasised that the GDPR does not oblige controllers to retrospectively merge separate datasets just to fulfil access requests. Specifically, the controller was not required to combine the inspection and booking datasets to identify the individual and disclose additional data. Such merging would expand the scope of access beyond what is legally required, and the existing separation serves privacy protection.
Data Subject verus Finanzamt (FA)
In September 2019, the data subject submitted an access request to the controller, the German Tax Authority (Finanzamt – FA), under Article 15(1) GDPR and Article 15(3) GDPR. The controller responded by providing him with his personal data. The data subject deemed the information incomplete and repeated the request asking for copies of enforcement measures. In December 2019, the controller rejected the request for copies of enforcement related data with a formal decision, which did not include any information on legal remedies. On 25 February 2021, the data subject filed an action against the decision of the controller with the Fiscal Court (Finanzgericht Nürnberg), requesting that the controller be ordered to provide information on his personal data within the meaning of Article 15(1) and 15(3) GDPR and claiming that restrictions under national procedural rules conflicted with EU law. The Fiscal Court dismissed the action as inadmissible for exceeding the statutory time limit. The data subject appealed to the Federal Fiscal Court (Bundesfinanzhof – BFH), claiming that the GDPR does not set a deadline for bringing an action and could be brought at any time as in civil proceedings. He further claimed that no prior administrative proceedings were required since it is an action for performance. In any case the action for the provision of information pursuant to Article 15 GDPR may not be restricted by the requirements for bringing an action in the Fiscal Court Code (FGO). The Court dismissed the appeal and upheld the lower court’s finding that the claim was time-barred and procedurally inadmissible. It held that the response of a public body to an access request under Article 15 GDPR constitutes an administrative act. Therefore the action to compel a public body to provide a response is subject to the FGO. According to the FGO, when a data subject receives a negative decision from an administrative body with no legal remedy instruction provided, such as the rejec
Court case W287 2271595-1
A data subject brought a complaint to the DPA in April 2022. The data subject requested an address publisher and direct marketing company (the controller) to delete all their personal data and no longer process it in the future, referring to both Article 17 GDPR and Article 21 GDPR. The controller deleted data at the request of the data subject, however later notified them that the data had been re-collected in an response to an information request by the data subject. The data was also transferred to direct marketing companies and address publishers. The DPA upheld the complaint in March 2023, and stated that the controller processed the data unlawfully by reusing it for direct marketing purposes. According to the DPA, the data subject made a clear wish of wanting to prevent their data being processed for marketing purposes, and therefore the controller had violated Article 5(1)(a) GDPR and 5(2) GDPR in conjunction with Article 21(2) GDPR. The DPA saw no need to determine whether the data subject had carried out a request for erasure or a request for erasure and objection; according to the DPA, the request clearly showed the will of the data subject. The controller appealed the decision to the Federal Administrative Court in April 2023. It argued that it had complied with the data subject’s deletion request; by completely deleting the data, it also deleted the data subject’s request to delete it. Therefore, re-collecting the data was a possibility. According to the controller, if the data subject had not requested to completely delete the data, it would have simply “blocked” the data from future processing. Furthermore, the data subject’s data was re-collected due to research performed by the controller. It is important to note here that the controller did not inform the data subject of the distinction between blocking the use of data for future marketing purposes and deleting the data (and potentially re-collecting it). The Court first stated that in order for
Apple Distribution International Ltd.
On December 7 2021, the data subject initiated court proceedings against Apple Distribution International Ltd. (controller) on the grounds that they failed to comply with their access request. The data subject requested, in particular, access to the specific recipients of their data, the contents of any disclosures or transmissions of their data, the storage period for their or criteria for determining it, and specific information under Article 15(2) GDPR. In response to the access request, the controller included some files which were incomplete and incomprehensible to the data subject. Furthermore, information about advertising placements were not provided and the data subject was not informed about which of the data subject’s data was fed into the advertising algorithm. Finally, the data subject was given complex data structures and records containing links which could not be decrypted. The controller denied the claim and argued that they had fully complied with the data subject’s access request. The controller argued that they do not keep detailed records documenting which specific personal data was disclosed to different recipients or processors and stated that their retention periods are determined with reference to the purposes for each processing activity. The controller also acknowledged that they make third country transfers via standard contractual clauses, despite the data subject not having been given any information on these in response to their access request. An expert witness attested to the fact that some of the data provided was incomplete, that the controller had further data relating to the data subject, and noted that some of the structures of the data provided were so convoluted that he himself could not decipher them. The Court accepted the evidence provided by the expert witness and ruled that the controller had violated the data subject’s right of access. The Court regarded the violation as “serious” in nature. The court ordered the con
Court case W176 2259543-1
In March 2021, a data subject (represented by noyb) filed a complaint to the DPA against an address publisher and direct marketing company (referred to as the address publisher or the controller) and a credit information agency. The data subject submitted a request for information (Article 15 GDPR) to the address publisher and several credit information agencies in Austria. The address publisher was named as the source of the data; it had collected it for the purposes of exercising the trade of address publisher, however, it also transferred data as part of a contractual agreement with the credit information agency. This agency processed data (name, date of birth and (partially historical) addresses) for the purpose of assessing the data subject’s creditworthiness. The credit information agency has an additional business license for address publishing and direct marketing. In the complaint the data subject argued that this processing violated the principle of purpose limitation (Article 5(1)(b) GDPR in conjunction with Article 6(4) GDPR). The data subject had not provided data to the controller and was not informed of the changes in the purpose of data processing. Furthermore, the way in which the credit score was calculated was unclear to the data subject. The address publisher argued that its business license allowed it to process personal data and disclose it to third parties. In its decision, the DPA stated the controller had violated the principle of purpose limitation because it collected data for marketing purposes, but transferred data to the credit information agency for the purposes of credit rating. The DPA also stated that the data subject had no subjective right for the DPA to impose a processing ban. The data subject appealed the second point of the decision, arguing that a processing ban is the only way to effectively prevent future unlawful data processing. The controller appealed the first point of the decision, arguing that it amended the agreem
Court case W292 2301229-1
In 2024, a data subject filed a complaint to the DPA regarding the right to erasure of stored payment history data. The controller, a credit reporting agency, updated the data subject’s credit score following an out of court proceedings in 2019. The data subject’s request for a loan was rejected on the basis that banks received the information “Score value 0 - no calculation possible” when requesting information about the data subject. This value was an error as a result of the controller not being able to correctly assign a numerical value to the out of court proceedings. The entries analysed by the DPA and Court were the ones on the completion of out of court settlement and “Score value 0: No calculation possible”. In its decision, the DPA applied the reasoning of CJEU case law (the SCHUFA case) to conclude that the processing of payment history also constitutes a serious interference with the fundamental right to privacy and data protection ([https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12012P/TXT Article 7 CFR and Article 8 CFR]). The DPA then applied national law on time limits in processing of data related to insolvency procedures, arguing that the controller should have deleted the data relating to the out of court settlement. By not deleting this information the controller was violating the data subject's right to erasure under Article 17 GDPR. The controller disputed the DPA's reasoning and brought an appeal to the Federal Administrative Court. The controller argued that the SCHUFA case did not apply, because it related to publicly accessible data. It also claimed that the data processing was not a serious interference with the data subject's fundamental rights. The Court upheld the decision on the DPA regarding automated processing, but dismissed the reasoning on processing of payment history. The Court upheld the arguments of the controller, and stated that the facts of the current case differ in essential elements to SCHUFA. The Court concluded that the processing was valid under Article 6(1)(f) GDPR because the controller makes this information available to a limited number of lending insurance companies. The Court also considered that the effect of this processing was not detrimental to the data subject, because they were able to conclude two leasing agreements following the out of court proceedings. In its analysis of the zero-score value, the Court considered that it played a decisive role in the decision to grant a credit. This is supported by the fact that the bank refused the loan specifically because of the error message. Therefore, this would be considered a legal or similar effect in accordance with Article 22(1) GDPR. The Court also stated that the processing carried out by the controller falls under the scope of profiling based on SCHUFA and Article 4(4) GDPR. Furthermore, there was a risk of circumventing Article 22 and data subject rights if it were to be interpreted narrowly, and only apply to the third party making the decision. An example is right to request under Article 15(1)(h) GDPR because the third party making that decision would not be able to explain how the credit agency reached that conclusion. Finally, the Court analysed whether the exceptions allowing processing (Article 22(2) GDPR) apply. In this case, none of the exceptions apply. In addition, the Court stated that the controller had not processed the data lawfully, and did not act in good faith. It is important to note that according to the Court, the calculation of a credit score by a credit reporting agency is still allowed. However, it must have a supportive and not decisive role in determining creditworthiness as seen in SCHUFA. The Court ordered the controller to delete the error message entry in accordance with Article 17(1) GDPR.
Court case I ZR 186/17
The Federal Union of Consumer Organisations and Associations (Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband eV), a German consumer association, brought an action before the Regional Court of Berlin (Landesgericht Berlin – LG Berlin), claiming that Meta Platforms Ireland Ltd (the controller) failed to comply with the legal requirements to obtain valid consent from the users of its app centre under the GDPR because the controller had not fulfilled its information obligations. The action was brought independently of a specific infringement of a data subject’s GDPR rights and without a mandate from a specific data subject. The LG Berlin upheld the action; the controller appealed this decision before the Higher Regional Court of Berlin (Kammergericht Berlin – KG Berlin). This appeal was dismissed and the controller further appealed the judgement of KG Berlin before the Federal Court of Justice (Bundesgerichtshof – BGH). The BGH had doubts as to the admissibility of the action brought by the Federal Union. Therefore, it referred a question to the CJEU for a preliminary ruling on the interpretation of Article 80(1), 80(2) and 84(1) GDPR. The CJEU ruled on 11 July 2024 in C‑757/22, Meta Platforms Ireland (Representative action) that a violation of the controller’s information obligation can be subject to a representative action under Article 80(2) GDPR. The BGH ruled - implementing the CJEU's decision -, that qualified entities are authorized, pursuant to the [https://www.gesetze-im-internet.de/englisch_uwg/englisch_uwg.html German Unfair Competition Act (Gesetz gegen den unlauteren Wettbewerb - UWG)] and the [https://www.gesetze-im-internet.de/uklag/ German Injunctive Relief Act (Unterlassungsklagegesetz - UKlaG]), to bring legal action before the civil courts for violations of information obligations pursuant to Article 12(1) GDPR in conjunction with Article 13(1)(c) and (e) GDPR, regardless of the specific violation
Court case IV ZR 204/23
The parties are disputing the validity of insurance premium increases in a private health insurance policy. The data subject holds a health insurance policy with the controller, who made premium adjustments. To the extent still relevant for the appeal, the data subject requested information regarding all premium adjustments made by the controller to the insurance contract between 2014 and 2019. The Regional Court dismissed the action. The Higher Regional Court, dismissing the data subject's further appeal, ordered the controller to provide access by partial judgment. The appeal court held that the access request is justified both with regard to the requested information and the related documents in the form of insurance policies and corresponding supplements; the basis for the claim is Article 15(1) GDPR in conjunction with Article 15(3) GDPR. With the appeal the controller continues to pursue its motion to dismiss the action. The court held, that a right to copies of the information submitted for the purpose of premium adjustment in the form of insurance policies and supplements to the insurance policy, does not follow from Article 15(1) and (3) GDPR. The court confirmed it's conclusion of BGH - IV ZR 177/22, that the supplements to the insurance policy, as a whole, do not constitute personal data of the policyholder. The court had previously held, that while letters from the data subject to the controller are to be classified as personal data in their entirety, since the personal information already consists of the fact that the data subject has made a statement in accordance with the letter, conversely - as is relevant here - letters from the controller to the data subject are personal data only insofar as they contain information about the data subject. Accordingly, only the personal data of an insurance policy is not categorically excluded from the scope of application of Article 15(1) GDPR. However, as the data subject did not limit his asserted claim and
an Amazon subsidiary (AA)
Amazon processed personal data for interest-based advertising without proper consent and failed to provide clear information or an easy opt-out mechanism.
Országos Idegenrendészeti Főigazgatóság
The data subject is a trans person who was granted refugee status in Hungary. When applying for this status, they pointed out that they identified as male and relied on their transsexuality as the ground for their recognition as a refugee. However, the Hungarian National Directorate-General for Immigration Policing (Országos Idegenrendészeti Főigazgatóság, the controller) recorded them in the register as female. In 2022, the data subject, pursuant to Article 16 GDPR, submitted a request to the controller to rectify the asylum register in two particulars: a change of the name under which they had been registered and a change of gender from female to male. On 11 October 2022, the controller rejected the request, arguing that the documents provided by the data subject did not prove that they had undergone gender reassignment surgery and that the applicant’s gender had changed. Therefore, the data subject brought proceedings before the Budapest High Court (Fővárosi Törvényszék). This court, having doubts regarding the interpretation of Article 16 GDPR, stayed the proceedings and referred the following questions to the CJEU: # Must Article 16 of the GDPR be interpreted as meaning that, in connection with the exercise of the rights of the data subject, the authority responsible for keeping registers under national law is required to rectify the personal data relating to the gender of that data subject recorded by that authority, where those data have changed after they were entered in the register and therefore do not comply with the principle of accuracy established in Article 5(1)(d) of the GDPR? # If the answer to the first question referred is in the affirmative, must Article 16 of the GDPR be interpreted as meaning that it requires the person requesting rectification of the data relating to his or her gender to provide evidence in support of the request for rectification? # If the answer to the second question referred is in the affirmative, must Article 16 of the GD
Court case C 310/23
A data subject applied for a loan with a Polish credit institution, the controller. After reviewing the loan conditions, they decided not to proceed and requested the cancellation of their application. Despite this cancellation, the data subject continued to receive marketing communications and alerts from the controller and related entities. The data subject objected to the processing of their personal data on multiple occasions and submitted requests under Article 15 GDPR to obtain information about which entities received their data, the purpose of sharing it, and the legal basis for processing. They also requested the deletion of their personal data. The controller did not respond adequately, providing unclear information or referring the data subject to third parties. As a result, the data subject lodged a complaint with the DPA. The DPA issued a final decision warning the controller for violating Article 6(1), Article 5(1)(b) and Article 5(1)(e) GDPR. The DPA also found that the controller failed to meet the obligations under Article 15(1) and Article 15(3) GDPR by providing incorrect information and failing to supply a copy of the personal data. Following the DPA’s decision, the data subject requested that the controller pay PLN3,000 (€709,95) in compensation and issue a written apology for violating their personal rights, including the right to privacy and protection of personal data. The court upheld the claim in its entirety, finding that the controller unlawfully violated the data subject’s personal right to privacy under Articles 23 and 24 of the Polish Civil Code, rather than directly under the GDPR. The court clarified that personal data, as defined under Article 4(1) GDPR, is not in itself a personal right, but the improper handling of specific personal data can constitute a violation of the right to privacy. The court explained that the burden of proof of the absence of unlawfulness lies with the defendant and proceed to assess whether the contro
Dun & Bradstreet Austria GmbH
A mobile phone operator refused to enter into a contract with the data subject. The reason for that was alleged lack of sufficient creditworthiness. The phone operator verified the data subject creditworthiness using services of Dun & Bradstreet Austria GmbH (previously: Bisnode Austria GmbH). The data subject requested the Austrian DPAto obtain the information on the logic involved in automated decision-making performed by Dun & Bradstreet. The DPA ordered Dun & Bradstreet to disclose that information. Dun & Bradstreet appealed the DPA decision with Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The court partially upheld the DPA decision. Dun & Bradstreet violated Article 15(1)(h) GDPR because they didn’t disclose neither the information requested by the data subject, nor sufficient reasons justifying the request rejection. Within the enforcement proceedings the City Council of Vienna, acting as an enforcing authority, rejected the case, claiming Dun & Bradstreet already provided the data subject with the information. The data subject challenged the City Council decision before Viennese Administrative Court (Verwaltungsgericht Wien - VGW). Due to doubts regarding interpretation of Article 15(1)(h) GDPR this court ourt decided to stay the proceedings and refer the following questions to the CJEU for a preliminary ruling: # What requirements as to content does information provided need to satisfy in order to be regarded as sufficiently “meaningful” within the meaning of Article 15(1)(h) GDPR? # Is the right of access granted by Article 15(1)(h) GDPR related to the rights guaranteed by Article 22(3) GDPR to express one’s point of view and to challenge an automated decision taken within the meaning of Article 22 GDPR in so far as the scope of the information to be provided on the basis of an access request within the meaning of Article 15(1)(h) GDPR is only sufficiently “meaningful” if the party requesting access and the data subject for the purpos
Court case W298 2296144-1
The controller is a credit information agency that collects information from different sources to calculate an individual’s creditworthiness. This information is accessed by third parties. The controller contractually obliges its contractual partners (such as debt collection agencies) to inform it (as a credit information agency) about payment defaults of data subjects. The debt collection agency informed the data subject of the transfer of their data to the controller in 2020, and since then, the controller stored entries on the payment history data of the data subject. The payments were later settled and the entries reflected this. However, the controller refused to delete them when the data subject requested their erasure. The data subject argued that their economic progress was impaired as a result, and brought a complaint to the DPA. The controller argued that the processed data was still necessary for credit checking purposes. The DPA upheld the complaint in June 2024, and stated that the controller had violated the data subject’s right to erasure. Furthermore, the controller was not permitted to store payment history data beyond its settlement, and was required to delete the entries. According to the DPA, further processing of the data was unnecessary, because the claims had already been settled in full. The controller appealed the decision to the Federal Administrative Court, arguing that this payment history was necessary to calculate reliable information about an individual’s creditworthiness. The Court first stated that the controller could only rely on legitimate interests (Article 6(1)(f) GDPR) as a valid legal basis for processing, meaning national law (such as Section 152 of the Industrial Code) or other legal bases under Article 6(1) GDPR were not valid. The Court then examined the case law on balancing the legal interests of data subjects and credit information agencies. Jurisprudence of the Court and the Administrative Court have consistent
AZOP
A data subject submitted an access request under Article 15 GDPR to a social services authority (the Croatian Institute for Social Work, the controller), seeking full information about the processing of his personal data. The controller did not respond or provide the requested data. The data subject filed a complaint with DPA on 13 June 2024. The data subject initiated an administrative court procedure on 21 August 2024 against the DPA for a failure to act. The DPA eventually issued a decision upholding the complaint and ordering the controller to comply on 29 August 2024. The Court held that if a controller fails to provide full access to personal data in response to an Article 15 GDPR request, this constitutes a violation, and the DPA must issue a decision within the legal deadline or face judicial review for "administrative silence" (inactivity). Additionally, the court held that when the DPA issues a decision during litigation that fully satisfies the claimant’s request, the administrative dispute must be dismissed under national law and the claimant is entitled to reimbursement of legal costs — in this case, €1,250.
Meta
The data subject maintains a Facebook account. The controller (Meta) offers third-party companies so-called Meta Business Tools, to integrate them into their websites and/or apps to make it's ad-based business model more effective. If a third-party company integrates such tools data obtained from customer interactions ("events") is collected and forwarded to the controller (off-site data). This data is forwarded to the controller regardless of whether a person has a Facebook account. If the person in question is registered with a Facebook account, their off-site data is automatically linked to it's Facebook account, whereby the data subject can generally be recognised based on the digital fingerprint. The linking of the off-site data with the personal data resulting from Facebook use (on-site data) is used by the controller to personalise ads. By configuring their Facebook account settings, the respective data subject can refuse their consent to this link with the result that the off-site data is not used to display personalised advertising. However, the controller does not offer a configuration of the Facebook account that leads to the deletion of off-site data. The controller stores the off-site data transmitted to it, even if a Facebook user has not consented to its use for the display of personalised advertising. The data subject has not given his consent to the linking of off-site data with their Facebook account. The data subject visited the websites bild.de, PayPal.com, jameda.de, shop-apotheke.de, eventim.de, ikea.de, zalando.de and netflix.com which use Meta Business Tools. The data subject asserts that the controller unlawfully processed their data and demands - inter alia - the deletion or anonymisation of specific personal data and damages upon request and until that request to leave the personal data unchanged. The controller submits that the responsibility to obtain consent for the transfer of off-site data lies with the operator of the third-party
a private individual (plaintiff)
The data subject, a private individual, objected to the controller’s processing of their personal data. The controller, a commercial entity, had collected and processed the data subject’s personal data for marketing and profiling purposes. The data subject sent an email to the controller objecting to such a “processing or use” of his data to which the controller failed to respond The data subject claimed that the processing was unlawful and requested its cessation under Article 17(1)(d) GDPR. The data subject claimed that, when he receives messages of this nature, it gives rise to an uneasy feeling that personal data has been disclosed to unauthorized persons, precisely because the data was unlawfully used. The data subject had to deal with unwanted advertising and the origin of the data, creating a quite stressful impression of loss of control. Moreover, the controller initially did not respond after the infringement, which, from the data subject’s perspective, constituted yet another disregard of him. The controller argued that its processing was justified under Article 6(1)(f) GDPR as a legitimate interest. The lower courts had differing views on whether the processing met GDPR standards. The court stated, that a claim for non-material damages cannot be denied on the grounds that the harm does not exceed a certain severity threshold. However the court found, that the data subject did not sufficiently demonstrate that he suffered non-material damage at all. The court stated that the CJEU had clarified in several judgements that a mere infringement of the provisions of the GDPR is not sufficient to establish a claim for damages; rather, as an independent prerequisite, actual damage (caused by the infringement) must also be demonstrated by the data subject. The court elaborated that once the loss of control is established this itself constitutes the non-material damage, and there is no need for further distinct or additional concerns or anxieties on the part of the data subject. The court held, that in the current case a loss of control could at most be presumed if the controller had made the data subject’s data accessible to third parties when sending the advertising email which the controller did not. The court also held, that where loss of control cannot be established, it suffices for a damages claim that the individual affected demonstrates a well-founded fear that his personal data would be misused by unauthorized third parties as a result of the GDPR infringement. However, the court held that a mere assertion of fear without any proven negative consequences is insufficient, as is a purely hypothetical risk of misuse by an unauthorized third party. The court considered that the data subject had submitted that he fears the controller might also disclose his email address to third parties because the controller has already used it without authorization (vis-à-vis the data subject). However the court held that only those further infringements could, if they occur, give rise to independent claims for damages. Regarding the the controller’s failure to respond to the data subject’s email objecting to the sending of the emails, the court held, that this might at most exacerbate any existing non-material damage, but it does not establish it in the first place.