GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Court case VI ZR 183/22
On 25 September 2018, the data subject signed a mobile phone contract with the controller (telecom provider), which allowed an early renewal with a new 24-month term at a lower rate. On 27 December 2018, the data subject renewed the contract under the early renewal option. The data subject later revoked the renewal, claiming withdrawal rights. The controller kept on billing the data subject for contract-related charges, which remained unpaid. On 16 September 2019, the controller reported the alleged unpaid debt to a credit rating agency (SCHUFA), although the debt was disputed and not legally confirmed, meaning that the disclosure should not have been made. Subsequently, on 27 September 2019, the controller requested SCHUFA to delete the entry of the disputed debt. However, the entry remained for nearly two years, negatively impacting the data subject's creditworthiness. As a result, the data subject was even denied a bank loan. The data subject sued the controller, claiming €6,000 in non-material damages under Article 82 GDPR for reputational harm. The Regional Court (Landgericht Koblenz - LG Koblenz) denied the GDPR-based damages, ruling in favor of the controller. On first appeal the Higher Regional Court (Oberlandesgericht Koblenz - OLG Koblenz) overturned the first ruling and awarded €500 in non-material damages for reputational harm referring to a punitive function of Article 82 GDPR. That court found that the controller violated Articles 5 and 6 GDPR by arranging the SCHUFA entry and that the data subject had suffered non-material damages as a consequence. In a further appeal by the controller disputed the amount of the non-material damages. The BGH held, that GDPR damages serve only a compensatory, not a punitive function. Thus it ruled that neither the gravity of the GDPR violation nor the question of fault can be taken into account when setting the amount of the damage. Therefore it found a legal error in the OLG Koblenz's decision, however th
Court case 15 O 262/23
The data subject took a case against a telecommunications provider, here the controller, for unlawfully disclosing their data. The controller transmitted the following data to a credit rating agency, namely SCHUFA Holding AG: name, address, date of birth, start and end date of the contract, contract number and a SCHUFA ID. Upon the data subject’s request, SCHUFA informed him that information on the contract conclusion had been supplied to SCHUFA and that this information will be stored until the end of the contract. The data subject called on the controller to cease the data transfer and to pay damages, which the controller rejected. The data subject stated that he didn’t know that the controller would share this information and that this transfer brought upon him feelings of loss of control and worry. The data subject claimed for a minimum of €5,000 in damages and a declaration on claims regarding damages for future loss. The controller brought forward that with the formation of the contract, the data subject was supplied with an informational which included a notice on the transfer of data to SCHUFA. It therefore concluded that the data subject was informed about the transfer, which nevertheless was necessary for fraud prevention No legal basis The court found that the controller could not rely on any legal basis under Article 6(1) GDPR for the data transfer. The court rejected the argument that the processing could be based on the legitimate interest of fraud prevention. The court explained that prevention of fraud committed by the data subject cannot be a legitimate interest in this case as the contract has already been concluded. The controller therefore doesn’t directly benefit from transferring the data subject’s contract information but instead can benefit from an informed and detailed credit rating system in order to assess future customers to prevent fraud. The court highlighted that telecommunication providers, including the controller, have ceased
Data Controller (entity responsible for reporting to SCHUFA)
The controller, a major private bank, failed to properly report a data subject's loan settlement to SCHUFA. Despite the data subject making regular payments, the controller’s automated system did not record them correctly, resulting in inaccurate reports being sent to SCHUFA. Following a complaint, the DPA issued a reprimand against the controller for violating Article 5(1)(d) GDPR, which mandates accurate data processing. The controller argued that the violation occurred before the GDPR came into effect, thus it should not apply. Even if the GDPR were to be applicable, the controller contended that it had taken appropriate corrective actions and that it should not be held accountable for the errors in the automated system. The controller seeks to have the warning lifted by the Administrative Court of Düsseldorf (VG Dusseldorf). The DPA maintains that the controller’s failure to ensure accurate reporting violates the GDPR. The court held that the DPA’s reprimand against the controller was justified. It found that the controller failed to ensure the accuracy of the personal data transmitted to SCHUFA, as required by the GDPR. The court emphasized that under Article 5(1)(d) GDPR, personal data must be accurate and kept up to date. The controller continued to report inaccurate balance information to SCHUFA after the debt was settled in February 2018, violating the principle of data accuracy also after the GDPR came into effect. The court noted that while the controller may have processed the data with a legitimate interest, the failure to correct inaccuracies in the data subject’s data within a reasonable time violated the principle of data accuracy. The controller did not demonstrate sufficient efforts to correct or delete the incorrect data after the debt was settled, which violated the accountability principle as laid out in Article 5(2) GDPR as well. While the DPA could have imposed a fine under Article 83 GDPR, the court found that the DPA’s decision to issue a
Association Mousse
Association Mousse lodged a complaint with the French DPA (CNIL) after a data subject purchased rail travel documents from SNCF Connect (the controller). The controller required customers to enter their title (Madame / Monsieur) when they purchased travel documents. The complaint argued that the controller should not collect this data or that, at the very least, it should offer customers additional options such as ‘neutral’ or ‘other.’ The controller argued that knowing the sex of the data subject permitted it to personalise communications in accordance with commonly accepted practices in commercial communications. It also stated that the processing permitted it to adapt the services it provided (such as providing access to women-only carriages on night trains). On 23 March 2021, the CNIL found that the controller’s processing did not violate the GDPR. It found the processing lawful under Article 6(1)(b) GDPR, viewing it as necessary for the performance of the contract to supply transport services, and considered the processing consistent with the principle of data minimisation. Association Mousse brought an action for annulment of the CNIL’s decision before the Conseil d’État. In addition to reiterating its legal basis and data minimisation challenges, it pointed out that the processing infringed the right to travel without disclosing one’s title, the right to respect for private life and freedom to freely define one’s gender expression. It also noted that in countries who recognize nonbinary civil statuses, the indication does not correspond to reality and may prove contrary to the principle of accuracy. The Conseil d’État stayed the proceedings and referred two questions to the CJEU. # In assessing whether data collection is consistent with Article 5(1(c) GDPR and Articles 6(1)(b) and (f) GDPR, may account be taken of commonly accepted practices in civil, commercial and administrative communications (here, the collection of data relating to consumers’ titles)? #
Court case 22-3460
An individual, the controller, broadcasted a live stream with a video footage, installed on their initiative, of their village on their website. This livestream was taken with two cameras and broadcasted on the controller´s website. Multiple data subjects advanced complaints before the DPA due to the filming of private houses in the controller´s livestream. Consequently, the DPA started an investigation and, eventually, imposed a fine of €500 to the controller due to the lack of a legal basis for the processing as per Article 5(1)(a) and 6 GDPR. The DPA upheld the decision after the controller´s objection. Thus, the controller appealed the decision in front of the Rechtbank Noord-Nederland (hereinafter: District Court) and argued that the processing activity could be based on an legitimate interest in accordance with Article 6(1)(f) GDPR. The District Court admitted the appeal to the DPA decision. Data processing under Article 6(1)(f) GDPR The District Court started its analysis by stating that it is undisputed that personal data was processed. The controller claimed that the processing was based on a legitimate interest as per Article 6(1)(f) GDPR. The controller listed different legitimate interests at stake in the case at hand: - The controller ´s own interest to promote the old village, national monuments and iconic buildings; - Different local authorities´ interest to attract tourists for economic gains, - The interest of the Municipality of De Fryske Marren as the municipality´s bridge operator uses the live stream when operating bridges; - The neighborhood police officer´s interest in using the live stream to determine the duty rooster; - The social interest of sick, elderly and interested people at home to watch the activity in the centre from home. To support this claim, the controller brought a petition of 941 people asking to keep the live streaming going. - Third parties´ interest to maintain public order and safety through the processing. On
Court case III OSK 4868/21
A husband and a wife (data subjects) opened a personal bank account with a bank (the controller). The controller processed inter alia their name, surname, personal identification number (PESEL), address, phone number, martial status. After changing the account type, the data subjects requested the controller, in writing, to stop sending advertising material and bank statements on their address; also, they withdrew the consent for data processing. The consent had covered data processing, including archiving personal data by the controller. The controller refused to comply with the request, claiming they were unable to identify the senders of the request. The data subjects were asked to use an online service, the helpline or file the request in person. The controller explained the bank statements referred to data subjects’ account. The data subjects refused to use one of communication channels suggested by the controller. Again, data subjects upheld their request and consent withdrawal. Although the controller closed the data subjects' account and claimed to cease processing of their data, the data subjects received another mail with bank statements and information about new deposit accounts. In one of the letters sent to data subjects, the controller informed them, that the processing was based on controller’s legitimate interest to establish, exercise or defend legal claims i.e. Article 6(1)(f) GDPR. The data subject filed a complaint with the Polish DPA (UODO). The DPA found the controller didn’t comply with the data subjects’ request (treated by the DPA as objection under Article 21 GDPR) and unlawfully processed their data for marketing purposes. Hence, the DPA issued a warning to the controller for violation of Article 6(1) GDPR, Article 12(2) GDPR, Article 12(3) GDPR, Article 21(3) GDPR. Moreover, the DPA ordered deletion of data subjects’ data. The controller brought an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyj
Court case W258 2227269-1/39E
On the 8 January 2019, the Austrian DPA (Datenschutzbehörde – DSB) launched an investigation into the actions of the Austrian postal service as it also had a business license for address publishing and direct marketing. Media reports had claimed that the postal service (the controller) sold data concerning the political affinities of data subjects to third parties. The controller ran a platform entitled “Adress Shop” on which it sold personal data to legal entities. The datasets included names and addresses but more importantly it included data subjects’ affinities to certain things such as an affinity to moving house, an affinity to organic products or how frequently a data subject receives packages. The purpose of the data processing was to sell this data to third parties who would use it for marketing purposes and therefore could avoid scattering losses. In order to create this database, the controller abused its position as postal service provider. In the postal service contract provided to data subjects the controller had included a notice stating that data subject are agreeing to their personal data being processed for marketing purposes. The contract however also included a box which could be ticked in order to refuse the data processing for marketing purposes. One of these affinities was concluded through an affinity score concerning the main political parties in Austria. For example, data subjects would be assessed with either a “very low”, “low”, “high” or “very high” affinity towards the SPÖ (the Socialist Party of Austria), the ÖVP (the Conservative Party of Austria) or any other major political party. The controller calculated this score through combing anonymous survey results, socio-demographic data (e.g., age or level of income and education) and voting results of particular region. On the 20 Febuary 2019, the DSB alleged that the controller had unlawfully processed sensitive data under Article 9 GDPR. The DSB found that the controller could no
Court case 62 O 194/23
The data subject is a customer of a telecommunications service provider (the controller). The data protection information on the telecommunications contract does state that the controller reports the conclusion of the contract to a credit rating agency. In October 2023, the data subject received a letter of information from the credit rating agency, about the personal data stored, including - among other things - the fact of the conclusion of a telecommunications contract with the controller in January 2021, the account number and the statement, that this information will be stored as long as the business relationship exists. The data subject claims the transmission of data caused distress and existential concern, particularly regarding potential impacts on creditworthiness. The data subject asserts that the transfer of data was unlawful because it did not fulfill the conditions of legitimate interest under Article 6(1)(f) GDPR. The data subject contends that the controller could have used other available systems for fraud prevention and that the data transfer was unnecessary for maintaining credit system functionality or calculating default risks. The data subject claimed - inter alia - non-material damages of at least €5,000. The controller asserts that the transmission of positive data was lawful under the GDPR, justified by the need to prevent fraud and to protect consumers from excessive indebtedness. The controller disputes that any damage occurred, claiming the data subject’s fears were unfounded and that there was no deterioration in the data subject’s credit score due to the data transfer. The court held, that though the notification of the credit rating agency about the conclusion of the contract constitutes processing (of so called 'postive data') within the meaning of Article 6 GDPR the data subject is not entitled to non-material damages under Article 82(1) GDPR or any other basis against the controller. The court denied Article 6(1)(a) GDPR as a
Court case W137 2292450-1/4E
The data subject filed a complaint against a gym operator with the Austrian DPA (Datenschutzbehörde – DSB) alleging that the gym operator had unlawfully disclosed her personal data. When the data subject signed-up to the gym membership, she had ticked a box which meant that she did not consent to the further processing of her data. Civil dispute The data subject had brought a civil claim against the gym operator as it alleged that the controller had increased the membership fees without the members agreement. In the course of the court proceedings email communication between the data subject and the gym operator were used as evidence. Through providing the email communication as evidence, the data subject alleged that the gym operator had unlawfully disclosed the name, e-mail address and the fact that the data subject had a gym membership. The gym operator argued that they had merely provided the data subject’s lawyer with the email correspondence as it was relevant to the civil claim. The e-mail communications had been sent by the gym operator's lawyer to the data subject's lawyer. Later, the gym operator added that the data subject’s details were necessary for the contractual relationship and further that the use of this data fell under the gym operator’s legitimate interest. DSB decision The DSB held that gym operator had violated that data subject’s right to privacy by disclosing data beyond what was necessary. It found that the data subject had rejected the transfer of her personal data when signing up with the gym. The DSB determined that Article 6(1)(b) GDPR did not apply to the processing and therefore analysed the gym operator’s legitimate interest and found that the evidence would have been equally powerful if the data subject’s details had been redacted. Appeal The gym operator appealed this decision to the Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG) stating that the change in purpose for the processing was legitimised through the fact that in this civil proceeding, redacted documents would prove insufficient as evidence. The gym operator explained that it had to prove, in court, that individual negotiations were carried out which meant that the personal details had to be disclosed. The gym operator therefore requested the BVwG to annul the decision of the DSB. The DSB requested for the claim of the gym operator to be rejected. The BVwG highlighted that the gym operator’s lawyer and not the gym operator himself had disclosed the personal data. It assessed that the DSB had erred in its decision, which stated that the gym operator had disclosed the personal data. The BVwG held that the gym operator’s lawyer was the true controller as per Article 4(7) GDPR in this case and that the data subject had therefore filed the complaint against the wrong person. Paragraph 24(2) of the Austrian Data Protection Act ([https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&tid=121166093 §24 Abs 2 Datenschutzgesetz - DSG]) provides that the person bringing a complaint must identify the controller as far as this is reasonably clear. The data subject had been informed by their lawyer that the gym operator had supplied the email communication. It could not have been expected of the data subject to deduct from the stamp of the lawyer’s law firm that the lawyer was the true controller. The BVwG therefore ordered the DSB to reevaluate its decision. The BVwG lastly added that the data subject’s refusal of data processing had only been related to marketing purposes and therefore could not pose any opposition to the processing in court.
Court case W176 2295345-1
On the 20 April 2024, the Austrian DPA (Datenschutzbehörde – DSB) received a complaint filed against the operator of a tobacco shop (the controller). The controller had installed CCTV cameras in front of their shop but did not put up an appropriate notice. Additionally, the controller had screenshotted a woman who hadn’t cleaned up after her dog, printed out the screenshot and stuck it to the window next to the entrance of his tobacco shop. The DSB found that the cameras did not just monitor the entrance to the tobacco shop but also the entrance to an apartment building, the footpath the leading up to it and partly the nearby tram stop. The controller argued that tobacco shops are subject to higher risk of danger. Further, the CCTVs use had already been justified through enabling a vandal to be identified. The monitored public area had been kept to a minimum and the recordings were only stored for a maximum of 24 hours. In response to the printed out picture of the woman, the controller stated that he had put a sticker over her face and that the woman herself had most likely removed the sticker. The controller also brought forward that based on training given by the Office of Criminal Investigation of Lower Austria (Landeskriminalamt Niederösterreich - LKA), he genuinely believed that the pictograms sufficed as an information notice. The DSB held that the controller had violated Article 5(1) (a)(b)&(c) GDPR, Article 6(1)(f) GDPR and Article 13 GDPR and issued a €1,500 fine. The controller appealed the decision to the Federal Administrative Court of Austria (Bundesverwaltungsgericht – BVwG). He stated that thieves and criminals constantly threatened his shop and that he had to fear for his life. He disclosed that roughly a month before the appeal a bomb attack on his shop had been carried out, causing five-digit damage. The DSB requested the controller’s claim to be rejected. The BVwG held that the controller did have a legitimate interest in installing the C
Nemzeti Adatvédelmi és Információszabadság Hatóság
The data subject had obtained an immunity certificate confirming the vaccination against COVID-19, issued by the respective authority (the controller). This certificate included data that was generated by the controller itself, especially an ID number and a QR code. In April 2021, the data subject filed a complaint with the Hungarian DPA alleging that the controller had not published any data protection statement concerning the issuing of vaccination certificates. During the subsequent procedure the controller declared that Article 6(1)(e) GDPR and Article 9(2)(i) GDPR were the respective legal bases for the processing. Furthermore, they stated that they obtained the personal data that it processed from another body, in accordance with the provisions of Decree No 60/2021. On that basis, it asserted that, pursuant to Article 14(5)(c) of the GDPR, it was not required to provide information on the processing of those data. It nonetheless drew up the requested statement concerning the protection of personal data and published it on its website. The Hungarian DPA dismissed the complaint and found that the processing fell under Article 14(5)(c) GDPR and the domestic law included appropriate safeguards for the legitimate interests of the data subject. The data subject challenged the decision in court. The first instance court considered that the exception laid down in Article 14(5)(c) GDPR was not applicable because certain personal data produced in relation to the immunity certificates were not collected from another body by the controller, but were generated by that controller itself in the performance of its tasks. In that court’s view, only personal data obtained from another body could be covered by the exception laid down in Article 14(5)(c) GDPR. This decision was appealed by the DPA. The court of appeals then stayed the proceedings and forwarded three questions to the CJEU for a preliminary ruling: # Does the exception laid down in Article 14(5)(c) also apply to da
Court case Ra 2024/04/0408
The data subject advanced an appeal to a DPA decision concerning an alleged violation of her fundamental right to privacy, as laid out in [https://www.jusline.at/gesetz/dsg/paragraf/artikel1zu1 Article 1(1) of the Austrian Data Protection Act (Datenschutzgesetz – DSG)]. The initial complaint advanced by the data subject related to the sharing of the data subject´s MRI scans without the data subject´s consent, in the context of a treatment procedure at a rehabilitation centre following a hip operation. At the time of the follow-up treatment, the appellant was seventy-seven years old and suffered from dementia and significant cognitive impairment due to two brain operations in 2018. Therefore, the data subject was unable to provide any information about her medication and previous findings and thus had an authorized representative. A few days after the data subject´s admission to the hospital, the data subject´s authorized representative, a doctor, submitted a bundle of radiological images. One of the MRI scan's radiological images was missing so the medical team of the rehabilitation centre asked the data subject´s authorized representative to send a duplicate. The requested MRI was faxed to the rehabilitation centre by the data subject´s authorized representative on the same day without the consent of the data subject, who only learned of this disclosure verbally from doctors at the rehabilitation center. The data subject advanced a complaint, claiming that, in the case at hand, [https://www.jusline.at/gesetz/dsg/paragraf/artikel1zu1 Article 1(1) of the Austrian Data Protection Act (Datenschutzgesetz – DSG)] was violated. The Administrative Court Holding The Administrative Court dismissed the complaint as unfounded due to the following reasons. First, the Administrative Court found that the data subject´s authorized representative was the controller under Article 4(7) GDPR. Then, it proceeded by considering that, while [https://www.jusline.at/gesetz/dsg/paragra
Bulgarian Data Protection Authority
Toplofikacia Sofia EAD, the controller, is a Bulgarian company that provides heating services to its customers, both individuals and companies, in the Sofia metropolitan area. The controller submitted a request to the Ministry of Regional Development for access to several registers of personal data of the Bulgarian population. The reasoning for the request was that the access will facilitate the execution of the contracts between the controller and its customers. The Ministry of Regional Development refused to provide access to the registers that keep significant amount of personal data, including inheritance information, and advised the controller for the optional procedure under Article 125(3) of local Energy Act to seek permission from the Bulgarian Data Protection Authority. In May 2022 the controller submitted a request to the DPA asking for revocation of the Ministry's decision. In its request the company referred to the legal bases of (i) the performance of contract (Articles 6(1)(b) GDPR), (ii) the compliance with a legal obligation (Article 6(1)(c) GDPR), and (iii) a task carried out in the public interest (Article 6(1)(e) GDPR) for the requested access to the registers. The DPA carried out a corresponding analysis for each of these legal bases and decided that none of them is applicable for the controller. The DPA refused to grant permanent access to the registers and instructed the company to provide a solid justification for any future request to the Ministry. In July 2022, the controller appealed the decision of the DPA before the Administrative Court of Sofia. The Administrative Court of Sofia upheld the decision confirming the analysis of the DPA and on top of it pointing out that the registers provide information for the entire population of Bulgaria, while the company operates only in the Sofia region. Subsequently, the controller appealed the decision to the Supreme Administrative Court. The Supreme Administrative Court of Bulgaria upheld the decision by the lower court in its entirety. The Court repeated the justification of the DPA and the lower court about why the controller cannot rely on the specified legal basis, respectively: * Article 6(1)(b) GDPR is not applicable because Article 125(3) of the local Energy Act specifies the data needed for conclusion of contract; * Article 6(1)(c) GDPR is not available as a legal basis because the processing is not necessary to comply with a legal obligation under a law; * Article 6(1)(d) GDPR is not applicable because the collection of receivables of a company is not a public interest.
Court case 17 U 2/24
The data subject had an electricity contract with an electricity provider. The electricity provider’s terms and conditions included the following paragraph: “For the purpose of credit checks, the energy supplier may obtain information from credit agencies and pass on personal customer data relating to the energy supply contract to them under the conditions of § 28a BDSG.” The contract started in April 2014 and was cancelled by A due to outstanding bills in September 2014. In October 2014, the electricity provider sent an invoice to the data subject which listed a due amount of €529.16. According to the invoice, this amount included, inter alia, electricity costs, reminder charges, damages caused by delay, and a bank transfer fee. In November 2014, the debt collecting agency (the controller) reminded the data subject of the payment and added a fee for their services. In 2019, the electricity company conveyed the claim to the controller. In 2020, the controller warned the data subject about a possible transfer of their payment data to a credit rating agency. In 2021 and 2022, the controller informed the credit rating agency Schufa about the fact that the data subject had not paid. The data subject refused to pay and invoked the statute of limitations. The controller accepted this and Schufa noted it as well. Following this, the data subject was refused several contracts by different companies such as a mobile phone contract, a credit, and an insurance. The controller refused to remove the information from Schufa. Following a lawsuit filed at the Regional Court of Kiel (Landgericht Kiel – LG Kiel) the LG Kiel decided that the controller had to withdraw their information from Schufa because there was no legal basis for the processing of personal data. Furthermore, the LG Kiel held that the data subject was entitled to €500 in non-material damages under Article 82(1) GDPR. Both the controller and the data subject appealed the decision to the Higher Regional Court Schleswig (Oberlandesgericht Schleswig – OLG Schleswig). The OLG Schleswig held that the data subject had no right to non-material damages but upheld the LG Kiel judgement insofar as it had ordered the controller to withdraw the information from Schufa. = The unlawfulness of the notification by the controller to Schufa followed from the fact that the interest of the data subject outweighed the legitimate interest of the controller. The only possible legal basis for the processing was Article 6(1)(f) GDPR. Generally, there was a legitimate interest of Schufa users and the public for the transfer of data about missed payments. The special provision for scoring agencies in § 31 of the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) could only indirectly provide criteria for the balancing under Article 6(1)(f) GDPR. Thus, the fact that one of the alternative criteria for the lawfulness of scoring is fulfilled cannot in itself constitute a prevailing legitimate interest. On the other hand, it cannot be necessarily argued that there was a strict limitation to the criteria from § 31 BDSG. Hence, the court left the possibility for cases other than § 31 BDSG that could constitute a prevailing legitimate interest for a notification to the credit rating agency. However, in this case, the court stuck to the criteria of § 31 BDSG and found that none of these were matched. The court already doubted the legitimacy of some of the claims. Concerning § 31(2)(5) BDSG that provides that data about unpaid claims may be used for scoring if they allow the claimant to terminate the contract without a deadline, the court held, that this would only apply to the original claim itself, not to alleged further damages. Furthermore, the court found that it could not properly tell both apart in this case due to the opaque information provided by the controller. Thus, the court found that the transfer to Schufa could not even be partially based on § 31(2)(5) BDSG. Furthermore, it referred to sentence 3 of Recital 47 which provides that at any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. Because the claims of the controller objectively fell under the statute of limitations already when the controller forwarded them to Schufa for the first time the court held that the data subject did not need to reasonably expect a transfer of data concerning these claims, even though the data subject had not yet invoked the statute of limitations. Therefore, the court held, there was no legitimate interest in this case. = While explicitly not deciding if an injunctive relief (Unterlassungsanspruch) could be based on the GDPR directly, the court argued that the GDPR does not prohibit to use other legal basis for an injunctive relief from national law because the GDPR did not have a blocking effect on domestic law due to its aim of broad protection of personal data. Only the complementary application of domestic law ensured that this aim was reached. In this case, the right to obtain an injunctive relief followed from an analogy of [https://www.gesetze-im-internet.de/bgb/__1004.html § 1004(1)] and [https://www.gesetze-im-internet.de/bgb/__823.html § 823(1)] of the German Civil Code (Bürgerliches Gesetzbuch – BGB) in conjunction with Article 6(1) GDPR. = However, there was no right for non-material damages under Article 82(1) GDPR because, despite the GDPR infringement, the data subject was not able to show a concrete non-material damage apart from the mere loss of control. The court allowed an appeal to the German Federal Court of Justice (Bundesgerichtshof – BGH).
Court case 5 Ca 663/24
The data subject maintained an "on/off relationship" with a subordinate. After disputes arose, this subordinate sent excerpts of the WhatsApp-Chat traffic with the data subject to the works council chairman of the company they worked for. The chairman than forwarded this chat history containing highly intimate data to the human resources department (HR) which ultimately led to the termination of the data subject's employment. The data subject argued, among other things, that there was no legal basis under Article 6 GDPR for this disclosure and that the forwarding was both a violation of data protection law and of his general personal rights therefore entitling him to €5,000 plus interest in non-material damages from the works council's chairman pursuant to Article 82(1) GDPR. # The labor court dismissed the data subject's claim, holding that the data transfer was lawful under Article 6(1)(b) and (f) GDPR and [https://www.gesetze-im-internet.de/bdsg_2018/__26.html § 26(1) BDSG] (Federal Data Protection Act) in order to provide the employer with the most meaningful basis for examining the complaint of the data subject's subordinate. The court argued, that the scope of Article 6(b) GDPR also includes the transfer of data for the execution and termination of the employment contract of the data subject and his subordinate for the examination of possible measures by the employer. The data subject had not provided evidence the transferred personal data was irrelevant for the examination of the subordinate's complaint. # Furthermore the court argued, that the data subject has not provided evidence that the works council chairman did not act in his capacity as a works council member when forwarding the data to the human resources department, meaning that he would not have been personally liable to the plaintiff for compliance with data protection law in any case. According to [https://www.gesetze-im-internet.de/betrvg/__79.html § 79a BetrVG] (Works Constitution Act), the
Vodafone
The controller is a telecommunications company. In 2018, the data subject and the controller entered into a phone contract. The form for the contract included a paragraph which stated that the data subject consents to data exchange between Vodafone and Schufa and other credit rating agencies according to the respective terms and conditions. He also signed these terms and conditions including the controller's data protection information. The data subject claimed that he had not read this information sheet. However, he argued that without signing these documents he was not able to conclude the contract. Subsequently, the controller transferred data about the conclusion of the telecommunications contract to Schufa. In a [https://www.schufa.de/newsroom/schufa/daten-loeschung-telekommunikationskonten/ press release made public on 19 October 2023], Schufa informed the public that it was going to delete information transferred by telecommunication companies by the 20 October 2023. Schufa noted that the Conference of the German Data Protection Agencies (Datenschutzkonferenz der Länder) [https://www.datenschutzkonferenz-online.de/media/dskb/20210929_top_07_beschluss_positivdaten.pdf was of the opinion] that transferal and processing of personal data stemming from the field of telecommunication required a consent of the data subject. The data subject then requested access to their personal data from Schufa and was granted access. With his lawsuit, the data subject claimed, inter alia, €4,000 in non-material damages. The court dismissed the data subject’s action. It held that there was no GDPR infringement and also the claim fell under the statute of limitations. By signing the contract form the data subject had validly consented to the processing of personal data. The fact that it was not possible to form the contract without consenting was not relevant for the court. The statute of limitations applied because the data subject was informed about the transfer of data to Schu
Court case 20 U 51/24
The controller, a telecommunication company, informed its customers (data subjects) through various privacy notices that so called “positive data” could be transferred to the credit ranking agency SCHUFA and CRIF. SCHUFA and CRIF process the data received from the controller and also use it for the purpose of profiling (scoring) in order to provide their contractual partners with information, among other things, for assessing the creditworthiness of natural persons ("credit scoring"). Independently of credit scoring, SCHUFA supports its contractual partners by creating profiles to identify conspicuous facts. For postpaid mobile phone contracts, the controller transmitted “positive data” from data subjects to SCHUFA until October 2023 and continues to transmit it to CRIF. This includes at least the master data required for identity verification (e.g. name) as well information on whether a contractual relationship was established with the consumer and if an existing contractual relationship with the consumer has been terminated. The plaintiff, a consumer association, alleged that the controller lacked a legal basis for transmitting "positive data" to credit scoring agencies and therefore violating Article 6 GDPR. Additionally the consumer association held that the controller privacy notices constituted unfair terms and conditions subject to special consumer protection and competition regulation. It demanded a cease-and-desist declaration along with reimbursement of associated costs. The controller claimed a legitimate interest according to Article 6(1)(f) GDPR in mitigating payment defaults and preventing fraud. The Regional Court Munich (Landgericht München – LG München) dismissed the action in the first instance. It stated the following reasons: # The claim related to "positive data" was inadmissible due to the lack of specificity, as the term is undefined by local law and unclear in its application. # The contested data protection notices were not general terms a
Court case 16 U 45/23
The data subject has used an account in a social network operated by the controller. Upon registration, the data subject voluntarily entered his mobile phone number. As a default setting, a user profile could be found through the search function by entering the user's phone number, even if the number was not made visible for the person searching for the number. Furthermore, the social network included a contact import function that allowed users to import contacts from their smartphone and thus find other users among his phone contacts. To avoid being searchable for other users through one’s phone number, the user had to open and change the settings of the social network. The described functions made it possible to search for automatically generated phone numbers on the platform. If a generated number matched a user’s profile, the profile was shown. Thus, the scrapers knew that the number was really existing and in use and could link this number to the other data the data subject made public on the platform. Starting from January 2018, unknown persons obtained large amounts of account data and matching phone numbers, including the account data of the data subject. In 2021, these data could be found on the internet. The controller confirmed to the data subject in September 2021 that according to their information personal data of the data subject (the user ID, first and last name, and gender) were scraped from the platform. With his lawsuit, the data subject claimed, inter alia, non-material damages from the controller. The court held that, in the case at hand, despite an infringement of the GDPR there was no damage. The possibility of scraping user data from the platform amounted to processing of personal data under Article 4(2) GDPR. The court held, that the availability of the phone numbers for scraping does not fall under Article 6(1)(b) GDPR since this data processing is not strictly necessary for the performance of the contract between the parties. The data p
Court case 3 C 112/24
The data subject used the social network operated by the controller. Until 07 November 2023 it’s service was free of cost. After that, the controller explicitly demanded a consent for personalised advertisement in order to continue the social network for free. The data subject consented and did not opt for the payment model that would have allowed using the platform without consenting to the advertisement (“pay or okay”). For the time before his consent, the data subject claimed €1,500 in non-material damages alleging that, without consent, the processing of his personal data for advertisement purposes had been illegal. He alternatively based his claim on what the court refers to as a reversed licence analogy: Before consenting to personalised advertisement, the data subject had used the social network for 66 months. Referring to the post 2023 payment model’s monthly cost of €20, the data subject claimed 66 * €20 = €1,320 in unjust enrichment. The court held that the claim based on two different legal bases was too vague and therefore inadmissible under [https://www.gesetze-im-internet.de/zpo/__253.html § 253(2)(2) German Civil Process Order] (Zivilprozessordnung – ZPO). This is due to the fact that if the court decides by, e.g., granting the claim on the basis of unjust enrichment, there would be no decision on the non-material damages. Therefore, the controller couldn’t determine if the data subject would sue again. This happens, when one claim is based on two matters of dispute rather than two legal bases for the same claim. The court held that non-material damages and unjust enrichment claims were two matters in dispute since the claimed damage is non-material while the claimed unjust enrichment is about a material amount of money that allegedly is still within the assets of the controller. Both are two different things: A damage of the data subject does not necessarily correspond with a material enrichment of the controller and, vice versa, an unjust enrichme
BF (data subject)
The data subject had a heating supply contract with a private energy company, the controller. On 17 October 2019, the controller installed a smart heat meter in the data subject’s apartment. The device recorded various consumption and technical data, including energy usage, flow rates, and temperatures. It also stored historical operational data for error detection. The controller read the meter once per year on-site. Although the device technically supported remote reading via a radio module, the controller did not use this function. On 21 September 2020, the data subject filed a complaint with the DPA, arguing that the device unlawfully processed personal data and that the controller required a specific legal basis as a public authority. The DPA rejected the complaint on 11 October 2021. The data subject appealed to the court. First, the court held that the controller was not a public authority. It acted as a private company under a contractual relationship and had no statutory powers to exercise authority. Therefore, Article 6(1)(f) GDPR could apply. Second, the court held that the processing of consumption data (such as energy use, flow, and temperatures) complied with Article 6(1)(c) GDPR. National law required the collection and storage of such data for billing, energy efficiency, and system operation. This law satisfied the requirements of Article 6(3) GDPR by defining the purpose, scope, and retention periods. Third, the court held that the processing of additional technical and historical data (such as error logs and operational records) complied with Article 6(1)(f) GDPR. The controller had a legitimate interest in ensuring the proper functioning and maintenance of the device. The processing was necessary for detecting faults and maintaining system reliability. Finally, the court found that the data subject’s interests did not override the controller’s interests. Access to detailed historical data required specialised tools, and the data was only used in limited circumstances. The storage periods were also limited and aligned with legal requirements. The court therefore upheld the DPA’s decision and rejected the appeal.