GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
Court case 33 O 461/22
The data subject was a Facebook user. According to the privacy settings selected at the moment of the facts, their phone number could be used by a third person to find the data subject’s profile on Facebook, even if the phone number itself was not public. Accordingly, information relating to the data subject could be linked to their phone number by anyone in possession of such a number. In 2019, unknown third parties automatically combined telephone numbers and matched them with Facebook profiles thanks to the above-mentioned function. In this way, telephone numbers could be assigned to identified users. This resulted in a data breach concerning 533 million people in 106 different countries. The data subject lamented that since the data breach they received phishing emails and calls. In light of the loss of control over their personal data, the data subject claimed damages for €1,000 under Article 82 GDPR. According to the District Court of Deggendorf (Landgericht Deggendorf), the controller did not violate its duty of transparency pursuant to Article 5(1)(a) GDPR, as it provided a multi-layered explanation of what data were processed and how. It was up to the data subject to read this data protection policy and change the relevant settings. To the contrary, the data subject willingly provided their phone number, even if such piece of information was not necessary to use the social network. In the view of the court, the controller did not contravene its obligations pursuant to Article 32 and 33 GDPR either, since the data subject consciously made public their private details, with consequences that were transparently explained by the controller in its privacy policy. Therefore, no obligation concerning security measures and data breaches came into play in the case at issue. In a long obiter dictum, the court also concerned itself with the problem of Article 82 GDPR and the compensability of non-material damages. The court stressed that following the CJEU judgeme
Court case 10 O 126/22
The data subject used the service provided by Facebook, the controller. The controller's service allowed users to select whether they wanted to be seen publicly, among others their phone number. If this function was set to be visible to everyone then the phone number could be linked with the person's profile and such profile could be found by everyone using in possession of the phone number. This function was the default setting. A data breach in 2019 had as a consequence that unauthorised third-parties could link phone numbers and profiles because of the above-mentioned function. 533 million Facebook users were affected. Consequently, the data subject claimed in court non-material damages pursuant to Article 82. They alleged a series of unsolicited calls and phishing emails following the breach. The court rejected the data subject's claim. The court held that the controller did not breach the GDPR because the processing was lawfully based on consent. The data subject voluntarily agreed to the privacy policy when registering. According to the court, the privacy policy was also presented in a transparent manner in accordance with Article 5(1)(a) GDPR. Moreover, the obligations under Article 25(2) GDPR, according to which the protection of personal data has to be ensured by design and by default, were also not infringed because the controller's service explicitly gave the data subject the option to customize the settings in privacy-friendly terms. Furthermore, the controller did not infringe its confidentiality obligation under Article 5(1)(f) GDPR, as the data subject did not change the above mentioned function after the data breach occurred. An infringement pursuant to Article 33 and 34 GDPR was also excluded by the court because legally speaking there was no data breach to begin with. Not only the data subject willingly made public their personal data, but also did not change the settings after scraping event, as stated above. Thus, the controller was obliged
Court case W252 2246883-1
The data subject was an employee of the controller. The data subject claimed that a manager addressed them through their official email address, even if the communication concerned personal issues unrelated to work. Thus, the data subject filed a complaint with the Austrian DPA. The Austrian DPA dismissed the complaint because it was lodged after more than 1 year after the data subject became aware of the alleged infringement. The data subject appealed this decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG) for violation of Article 77 GDPR. The court clarified that Article 77 GDPR, providing for the right to lodge a complaint with the competent DPA, does not establish any deadline for the exercise of such a right. However, the activity of the DPAs is regulated by national procedural law within the limits of Article 58(4) GDPR. In lack of a regulation addressing the matter, specific rules governing procedures before the DPAs are subject to the principle of procedural autonomy of the Member States. The only limits to such a broad discretion of the Member States are the principle of equivalence – according to which procedural guarantees concerning European rights cannot be lower than guarantees set forth in the context of merely national rights – and the principle of effectiveness, which states that the exercise of European rights shall not be made impossible or excessively difficult in practice. In the present case, the court pointed out how that the 1-year limitation period applied both to GDPR-related complaints and complaints which were exclusively based on national law. Therefore, the protection offered by the Austrian legislator respected the principle of equivalence. Moreover, the introduction of such a deadline was considered necessary by the legislator, as the assessment of excessively old data protection violations would be in practice very difficult, if not impossible. In light of the above, the court rejected the
Autoriteit Persoonsgegevens
The data subject requested the Dutch DPA enforce the GDPR against the Council of State. In particular, the data subject asked the DPA to review whether giving journalists access to procedural documents was in accordance with the GDPR. The DPA declared itself not competent to decide on the processing operations undertaken by a court in its "judicial capacity". The data subject appealed this decision before the District Court Midden-Nederland. Among others, the data subject argued that if the DPA lacked competence to decide on their enforcement request, it should have forwarded it to an independent supervisory authority. The GDPR committee of the Council of State, mentioned by the DPA, did not qualify as independent. The court referred preliminary questions to the CJEU on the interpretation of 'judicial capacity' in the sense of Article 55(3) GDPR. The CJEU decided on 24 March 2022 (C-245/20) that it is part of a court's exercise of its "judicial tasks" within the meaning of Artilce 55(3) GDPR to temporarily provide journalists with documents containing personal data that originate from a judicial procedure, in order to enable them to report more effectively on the progress of that procedure. The Court implemented the CJEU decision and held that the DPA was right in declaring itself not competent. As a matter of fact, under Article 55(3) GDPR a DPA does not have the competence to oversee processings such as the ones at issue in the present case. The Court mentioned Recital 20 GDPR, which allows to specific bodies within the judicial organisation of each Member State to supervise data processing by courts and other judicial authorities. The Dutch legislator intentionally left the organisation of judicial supervision to the judiciary itself. The Council of State created a specific GDPR committee to handle such supervision. The committee is competent to overview processing operations undertaken within the Council of State's judicial tasks, according to GDPR in Article 55(3). Thus, the court declared that the DPA dealt with the competence matter appropriately by forwarding the data subject's complaint to the GDPR committee. The data subject's argument that the internal Committee was not indipendent was rejected.
Court case 13 O 126/22
The data subject was a Facebook user. According to the privacy settings selected at the moment of the facts, their phone number could be used by a third person to find the data subject’s profile on Facebook, even if the phone number itself was not public. Accordingly, information relating to the data subject could be linked to their phone number by anyone in possession of such a number. In 2019, unknown “third parties” automatically combined telephone numbers and matched them with Facebook profiles thanks to the above-mentioned function. In this way, telephone numbers could be assigned to identified users. This resulted in a data breach concerning 533 million people in 106 different countries. The data subject lamented that since the data breach they received phishing emails and calls. In light of the loss of control over their personal data, the data subject claimed damages for €1,000 under Article 82 GDPR. According to the court, the controller contravened to its obligation to guarantee integrity and confidentiality of data pursuant to Article 5(1)(f) GDPR and violated the principle of privacy by default and by design (Article 24 GDPR). The controller was aware of the risks that web scraping entails and still did not adopt appropriate security measures pursuant to Article 32 GDPR, such as removing the matching function described above. Concerning the existence of non-material damages pursuant to Article 82 GDPR, the court found that combining telephone numbers with other personal data potentially exposes users to several risks, including identity theft and targeted criminal activities. Therefore, an “abstract damage” could be compensated in the present case. To the contrary, no concrete negative consequence was actually proved by the data subject. In particular, the alleged phishing emails and calls could not be causally linked to the data breach, as other causal explanations were possible. In light of the above and considering that the data subject suffered
Court case W298 2269087-1
A medical doctor, the controller, used the national health care portal to access information about the vaccination status of a data subject who had applied for a job. The DPA opened an investigation against the controller who, in turn, acknowledged a violation of Article 9 GDPR, as they unlawfully processed health data of the data subject. The DPA imposed a €3,500 fine for the violation of Article 9 GDPR. The fact that the controller was a doctor, that they processed special categories of data and that they did it intentionally were considered aggravating factors in the quantification of the fine. The controller appealed the decision, claiming that the fine was disproportionate. In assessing the proportionality of the fine, the Federal Administrative Court examined how the DPA applied Article 83(2) GDPR at the facts at issue. Concerning Article 83(2)(a) GDPR, it is true that the controller position as a doctor should be considered an aggravating factor. However, the court also found that these data should have been disclosed in any case to the controller during the job interview, according to Austrian law. In this context, the court found particularly relevant that the controller processed only vaccination data and no other special categories of personal data pursuant to Article 9 GDPR. The court also regarded the fact that the processing occurred during highly stressful times of the pandemic as a mitigating factor pursuant to Article 83(2)(k) GDPR. Finally, the court disregarded the intentional character of the violation (Article 83(2)(b) GDPR) as an element to determine the amount of the fine. In light of the above, the court reduced the amount of the fine to €2,000.
Court case 28 O 138/22
The data subject was a Facebook user. According to the privacy settings selected at the moment of the facts, their phone number could be used by a third person to find the data subject’s profile on Facebook, even if the phone number itself was not public. Accordingly, information relating to the data subject could be linked to their phone number by anyone in possession of such a number. In 2019, unknown “third parties” automatically combined telephone numbers and matched them with Facebook profiles thanks to the above-mentioned function. In this way, telephone numbers could be assigned to identified users. This resulted in a data breach concerning 533 million people in 106 different countries. The data subject lamented that since the data breach they received phishing emails and calls. In light of the loss of control over their personal data, the data subject claimed damages for €1,000 under Article 82 GDPR. The court rejected the data subject’s claim. The court referred to the CJEU judgement in case C-300/21, stressing that a mere infringement of the GDPR cannot give rise to damages in itself. At the same time, the court acknowledged that no minimum threshold as a requirement of the right to compensation was admissible under EU law. The court also held that mere annoyance or emotional discomfort could not be used as a basis to substantiate the existence of a damage. In the present case, the data subject was not able to prove more than such a mere annoyance. In particular, further distress originating from the alleged phishing emails and calls could not be causally linked to the data breach. Therefore, the court concluded that the case fell within the category of mere GDPR infringement that could not be compensated as such, as European law does not accept the idea of “punitive damages”.
Court case W176 2255954-1
A company filed a complaint against an individual – the controller – that unlawfully processed personal data of its employees and shareholders. The Austrian DPA dismissed the complaint claiming that the company waited more than 1 year since the time it became aware of the unlawful processing before filing. Therefore, its right to lodge a complaint expired. The company appealed the decision before the Austrian Federal Administrative Court. According to the company, by refusing to examine the case in the merits the Austrian DPA violated Article 77 GDPR. The Austrian DPA argued that a legal person does not fall within the personal scope of the GDPR pursuant to Article 1(1) and (2) GDPR. Therefore, no discussion on the applicability of Article 77 GDPR was relevant in the case at issue. The court clarified that only data subjects within the meaning of Article 4(1) GDPR have a right to lodge a complaint with the competent supervisory authority pursuant to Article 77 GDPR. Legal persons are not included in the category of "data subjects", as the GDPR mentions only “an identified or identifiable natural person”. As a legal person does not fall within the scope of protection of the GDPR, but (potentially) only of national data protection law, the national legislator can establish time limitations in the exercise of the right to lodge a complaint. This was the case with Austrian law, which enables the DPA to reject a complaint when the latter was filed after one year since the relevant facts became known to the affected legal person. Therefore, the court upheld the DPA’s view and dismissed the appeal.
Court case 15 O 74/22
The data subject was a Facebook user. According to the privacy settings selected at the moment of the facts, their phone number could be used by a third person to find the data subject’s profile on Facebook, even if the phone number itself was not public. Accordingly, information relating to the data subject could be linked to their phone number by anyone in possession of such a number. In 2019, unknown “third parties” automatically combined telephone numbers and matched them with Facebook profiles thanks to the above-mentioned function. In this way, telephone numbers could be assigned to identified users. This resulted in a data breach concerning 533 million people in 106 different countries. According to the data subject, Facebook violated the principles of “privacy by design” and “privacy by default”. They lamented that the settings just described were Facebook default settings and they could be changed only through a complex procedure. These default settings, alongside wiht the total lack of security measures by Facebook, made data scraping possible. The data subject lamented that since the data breach they received phishing emails and calls. In light of the loss of control over their personal data, the data subject claimed damages for €1,000 under Article 82 GDPR. Facebook replied that it was up to the data subject to change their privacy settings. Moreover, and despite Facebook’s subsequent attempts to prevent and mitigate risks, no measure could entirely protect users from scraping. The Regional Court of Lübeck (Landgericht Lübeck) upheld the data subject claim for damages and granted €500 of compensation. According to the court, the processing was neither based on consent (Article 6(1)(a) GDPR), nor contract (Article 6(1)(b) GDPR), nor legitimate interest of the controller (Article 6(1)(f) GDPR). With specific regard to consent, the court found that it was not informed informed within the meaning of Article 4(11) GDPR. Indeed, finding information about the possibility to connect a phone number with other personal data as a default option was very hard. The court found that Facebook contravened to its duty to adopt technical and organizational measures under Article 32 GDPR and did not take precautions to make scraping by third parties more difficult. In assessing the existence of non-material damages, the court referred to [https://curia.europa.eu/juris/liste.jsf?nat=or&mat=or&pcs=Oor&jur=C%2CT%2CF&num=C-300%252F21&for=&jge=&dates=&language=en&pro=&cit=none%252CC%252CCJ%252CR%252C2008E%252C%252C%252C%252C%252C%252C%252C%252C%252C%252Ctrue%252Cfalse%252Cfalse&oqp=&td=%3BALL&avg=&lg=&page=1&cid=20574739 C-300/21], where the CJEU held that no minimum threshold is necessary to grant compensation pursuant to Article 82 GDPR. Importantly, the court also found that in the present case an evaluation of the data subject's psychological state was not necessary for the claim to be successful. As a matter of fact, after the data breach, the data subject’s personal information was traded on the internet by third parties. This entailed an actual – and not merely potential – infringement of the data subject’s personality rights, in particular their fundamental right to informational self-determination. In light of the above, the court ordered Facebook to compensate the data subject €500,00.
Österreichische Post AG
The Austrian Postal Service (Österreichische Post) (the controller) collected information on the political affinities of the Austrian population according to certain socio-demographic criteria. The controller generated statistics and had drawn a conclusion that a natural person (the claimant) had a high degree of affinity with a specific Austrian political party. The claimant had not consented to the processing, and felt offended by such attribution. The claimant said that the controller caused him great upset, a loss of confidence, and a feeling of exposure by storing data of such assumed political opinions of him. Therefore, the claimant brought an action for non-material damages before the Regional Court for Civil Law Matters in Vienna (Landesgericht für Zivilrechtssachen Wien) pursuant to Article 82 GDPR. The first-instance court rejected the claim for compensation. The Higher Regional Court of Vienna (Oberlandesgericht Wien), as the appeals court, upheld the judgment because it viewed a threshold was not reached as Austrian law requires damages to reach a certain ‘threshold of seriousnessness’. The decision was appealed to the Supreme Court in Austria (Oberster Gerichtshof), which referred to the CJEU for a preliminary ruling on the following matters: * 1) If the mere infringement of GDPR provisions in itself is sufficient for the right to receive compensation under Article 82 GDPR or is it required that an applicant must have suffered harm. * 2) If the assessment of the compensation depends on further EU law requirements in addition to the principles of effectiveness and equivalence. * 3) If a threshold exists for the damage caused by a GDPR infringement that goes beyond upset caused by the infringement to have a right to receive compensation under Article 82 GDPR. With regard to the first (1) question, it was established by the CJEU that Article 82 GDPR includes three cumulative conditions to give rise for the right to compensation. Those three conditions are: 1) existence of an infringement of the GDPR, 2) existence of damage suffered, and 3) a causal link between that infringement and that damage. The CJEU held that Article 82(1) GDPR must be interpreted as meaning that a mere ‘infringement’ of the GDPR itself is not sufficient to give rise to the right to compensation. With regard to the third (3) question, it was confirmed that the concept of ‘damage’ should be interpreted broadly and in a manner that fully reflects the objectives of the GDPR. The CJEU viewed that limiting 'damages' under Article 82 GDPR to a certain degree of seriousness would be contrary to the broad interpretation. Additionally, it would risk the uniform interpretation of the GDPR. In addition, the CJEU highlighted that Article 82 GDPR does not include any reference to a treshold of seriousness. Therefore, the CJEU held that Article 82(1) GDPR precludes national legislation or practice which makes compensation for non-material damage subject to the condition that the damage suffered by the data subject has reached a certain degree of seriousness. With regard to the second (2) question, the CJEU considered that, as the GDPR does not contain any provisions on defining the rules on the assessment of the damages to which a data subject may be entitled under Article 82 GDPR, it is for the legal system of each member state to prescribe those rules, in particular, those determining the extent of the compensation payable. Therefore, the CJEU held that national rules apply to the extent of financial compensation for the purposes of determining the amount of damages payable under Article 82 GDPR, provided that the principles of equivalence and effectiveness of EU law are complied with. The CJEU stressed the fact that compensation received under Article 82 GDPR must be regarded as ‘full and effective’, if it allows the damage to be compensated in its entirety, without there being any need to require the payment of punitive damages.
Court case 12 Sa 18/23
The controller, an employer, hired a private detective to monitor the data subject, an employee, during a sick leave. Surveillance measures were due to the fact the controller had reasons to doubt that the data subject was actually sick. As a matter of fact, eventually the controller used the information collected in this way to fire the data subject. The latter appealed the decision before a labour court, claiming that the decision was unlawful. They also claimed non-material damages in violation of their personality right due to the surveillance. The court of first instance upheld the data subject’s claims and considered that damages had to be compensated pursuant to Article 82 GDPR. The controller appealed the first instance decision. The court rejected the controller’s appeal and confirmed that the data subject should be compensated for the damage suffered. At the outset, the court confirmed the unlawfulness of the surveillance measure. According to the court, regardless of whether the controlled tried to base the processing on contract (Article 6(1)(b) GDPR) or legitimate interest (Article 6(1)(f) GDPR), the requirement of necessity was not met in the present case. By choosing to monitor the data subject by means of a private detective, the controller did not adopt the less intrusive measure and also violated the principle of data minimisation. Concerning Article 82 GDPR, the court referred to the CJEU judgement in case [https://gdprhub.eu/index.php?title=CJEU_-_C-300/21_-_%C3%96sterreichische_Post_AG C-300/21], where the latter clarified that non-material damages under the GDPR cannot be granted in case of a mere violation of the Regulation. As a matter of fact, a negative consequence stemming from the violation must be proved. At the same time, it is not necessary that such a consequence reaches a certain threshold of seriousness to be compensated. The court found that the surveillance of the data subject by means of a private detective necessarily entaile
Court case 45716
A data subject found that an American company (controller) had collected personal data about him and was marketing it on its website. On 5 April 2019, he contacted the controller, who replied the same day with a copy of his personal data and informed the data subject that it had deleted his personal data. Still on 5 April 2019, the data subject lodged a complaint with the Luxembourg DPA to have the controller act on his request in accordance with the GDPR. After requesting the data subject to provide its correspondence with the controller, on 6 March 2020, the DPA informed the data subject that the controller was US based and that it would therefore be impossible to pursue his complaint. The data subject replied several times and asked among other things for clarification on the administrative procedure and in particular of the rules on investigations. The DPA finally replied by letter that the opening of an investigation was not systematic whenever a controller is subject to a complaint. In this case, the DPA considered that it was not relevant to open an investigation since it had no means of action against a US based company. On 1 March 2021, the data subject, represented by noyb, lodged an appeal with the administrative Court (hereafter the Court) requesting the reversal or cancellation of the DPA's letter. On the basis of Article 78 GDPR, the data subject considered that he had a standing in bringing the action. The Court considered that both at the time of his complaint of 5 April 2019 and the lodging of the appeal, the data subject's data had already been deleted from the controller's website. Consequently, the court considered that the data subject did not prove that data processing was taking place when he lodged his appeal. The Court also held that under Article 51 GDPR, the DPA is responsible for monitoring the application of the RGPD by controllers, "so that it is no longer called upon to intervene from the moment that any possible disregard of the RGPD by a controller has ceased". It considered that in this case, the data subject could therefore not rely on the GDPR to sanction a controller, except for an action for damages resulting from the violation of its rights. The Court also noted that in order to obtain compensation for the damage resulting from the violation of the right to data protection, in accordance with Article 79 GDPR, it was not necessary to refer the matter to the DPA. In conclusion, the appeal was declared inadmissible for lack of standing.
Court case 13073/23
A court of first instance ordered a municipality – the controller – to compensate one of its employees – the data subject – for non-material damages suffered as a consequence of an unlawful processing of personal data. In particular, the accidental publication of certain data unnecessarily affected the data subject’s reputation. The controller appealed the decision arguing that the court of first instance granted compensation for a GDPR violation without considering whether such a violation actually harmed the data subject. The Court of Cassation rejected the controller’s appeal. According to the court, the right to compensation for non-material damages directly stems not only from Article 82 GDPR, but also from Article 8 ECHR and Articles 2 and 21 of the Italian Constitution. In the first place, the court held that the right to compensation for non-material damages is not excluded by the fact that the controller subsequently brought processing operations into compliance with the GDPR. Second, the court stressed that not every violation necessarily leads to liability under Article 82 GDPR. As a matter of fact, the violation must have entailed actual harmful consequences on the data subject. That said, it is not necessary that the harm suffered meets a minimum threshold, being subject to compensation also a “marginal” damage. In this case, the Court of Cassation upheld the judgement of the court of first instance, as the latter considered the violation in its context and determined that type of data and factual circumstances objectively gave rise to non-material damages.
Blauw Research B.V.
In this decision, Blauw Research B.V., a market research agency (controller) had a processing agreement with NEBU B.V., a software provider (processor). On 10-11 March 2023, the processor suffered a cyber attack by which third parties gained unauthorized access to its servers and data was extracted. The processor informed the controller about it two days after the attack took place. The controller requested more information and the processor confirmed that data (passwords) had been stolen and personal data (stored in cloud databases and surveys) were leaked. After repeatedly requesting information, unsatisfied with the processor's replies, the controller brought the case to the Court of Rotterdam. During the proceeding, the controller explained that it considered that, based on the processing agreement, the processor must provide information regarding security incidents and data breaches at all times. It also argued that the information provided following the cyber attack was not sufficient to meet the requirements set out in the agreement. The processor objected to such claim. As a result, the controller claimed to order the processor to: # provide information about (i) the details of the cyber attack; (ii) how and with what methods the system was recovered after the attack; (iii) an overview of which customers' personal data were leaked; (iv) the perpetrators of the attack; (v) which preventive and reactive technical and organisational measures were taken; (vi) internal reporting within the organization of the processor about the cyber attack that has taken place; # in the future, within 4 hours after new information is available, transfer this information to the controller and send an update on the state of affairs twice a day (at 14:00 and 19:00); # appoint a forensic investigator to find out the root-cause analysis; and # provide all necessary assistance and to answer all controller's questions. In the event of non compliance, the controller claimed a penalty of €25,000 per day with a maximum of €500,000. The processor considered this amount as unreasonable. The preliminary relief judge upheld the claim, but in a watered-down form. The Court ruled that the processor must provide all the requested information in order to enable controller to investigate the cyber incident in a proper manner. With regards to the claim to inform the controller of new information within four hours the Court stated that this will only apply when (i) a new cyberattack occurs (ii) new information shows that personal data of controller were compromised or (iii) information about the perpetrators is known. In all other cases an update twice a day seemed exagerated and the Court held that a daily update at 18:00 would be sufficient. Concerning the appointment of an external forensic researcher the Court confirmed that within the framework of the instruction right of the controller, it can appoint an external researcher/auditor to check whether personal data is processed securely. Finally, the Court considered the amount of €25,000 per day was not unreasonable and added it to the judgement.
CJEU case C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer
During the Covid-19 pandemic, the Minister for Education and Culture of the Land Hessen established a legal framework to enable remote education through video-calls. According to this framework, pupils (or pupils’ parents) should give their consent to the processing of personal data. However, no similar provision applied to teachers. A Committee of teachers brought an action before the Wiesbaden Administrative Court. According to the defendant, the provision that enabled the regional government to process data without teachers’ consent was § 23 of the Hessisches Datenschutz- und Informationsfreiheitsgesetz (Law on data protection and freedom of information of the Land Hessen). This provision would set “more specific rules” concerning workers’ data protection rights in accordance with Article 88 GDPR and in derogation to GDPR itself. However, the Administrative Court suspected that the controller did not comply with Article 88(2) GDPR, as the latter provision requires “suitable and specific legislative provisions” to be adopted in order to protect data subjects’ rights. The German court wondered whether a national provision that does not meet this requirement, such as § 23 of the German data protection law, could be seen as a legitimate implementation of Article 88 GDPR. Moreover, the court was not certain about the faith of such a provision, in case a national judge found it in contrast with Article 88(2) GDPR. In order to better clarify the relationship between paragraphs (1) and (2) of Article 88 GDPR, the German court issued a preliminary reference to the CJEU. In the first place, the CJEU clarified that Article 88 GDPR covered the facts at issue in the main proceeding and more in general public employment, as this provision is not specific to the private sector. According to the CJEU, it is the existence of a relationship of subordination between the employee and the employer and not the legal nature of this relationship that justifies the open clause provid
Court case 4 O 13063/22
The controller embedded Google Fonts on its website. When a user visited the website, their personal data were transferred to Google Inc. in the US. Considering that the controller violated Chapter V of the GDPR, a data protection association deployed an automated system – a so-called “web crawler” – to detect data transfers through Google Fonts tools. Then, the association representing the data subjects contacted the controller and asked for non-material damages under Article 82 GDPR. Meanwhile, the controller had updated its website and removed the Google Fonts. The controller argued that the claim for damages was part of a broader initiative affecting hundreds of thousands of controllers in Germany. The controller stressed that the individual data subjects represented by the data protection association never manually and directly visited its website. Thus, the controller brought action against the association and asked the Regional Court of Munich (LG Münich) to declare the association’s claims unlawful. The German Court upheld the controller’s arguments. The court did not consider whether the controller violated the GDPR by undertaking data transfers to the US, nor whether the data subjects implicitly consented to such transfers by accepting to visit the websites. Instead, the court focused on the fact that a person that did not directly and manually visited a website could not feel any annoyance or uncertainty with regard to the transfer of their personal data to a third country. From this perspective, the use of web crawlers played a major role in ruling out an actual infringement of data subjects’ rights. The court also stated that, even imaging that the use of web crawlers was compatible with a violation of the data subject’s informational self-determination, the data subject provoked the situation against which they complained. In light of the above, the Court adopted a decision declaring the lack of legal basis for any claim for damages under Article 82 GDPR.
Court case L 16 SF 5/21 DS
This case started in the context of a litigation between the data subject and their insurance company – the controller. While pending this civil proceeding, the controller contacted the data subject’s dentist to ascertain whether the requirements to cover the data subject’s medical expenses were fulfilled. The controller disclosed to the dentist personal information concerning the litigation between controller and data subject. Immediately afterwards the controller contacted the data subject, acknowledging that the disclosure was a mistake and informing them that the company already asked the dentist not to use those data. The data subject lodged a complaint with the competent supervisory authority, claiming that personal information disclosed by the controller to the dentist was false and damaged the data subject’s reputation. Moreover, the controller did not take action to rectify the content of the communication. The supervisory authority pointed out that disclosure was unlawful because not necessary. However, it also considered not to have the authority to ascertain whether data were also false or inaccurate, as the civil proceeding was still pending. Since the controller already took steps to limit the adverse consequences of its unlawful processing, the DPA decided not to adopt further measures. The data subject brought an action against the supervisory authority under Article 78 GDPR, but the court found that the DPA did not violate its duties. The data subject appealed the decision. In the court of appeal’s view, Article 77 GDPR cannot be interpreted as imposing on the DPA a mere duty to examine the complaint, investigate on the matter and inform the data subject within a reasonable term. This conclusion was supported by the structure of Article 78 GDPR, which is strictly intertwined with Article 77 GDPR. Indeed, Article 78(2) GDPR provides the data subject with the right to an effective judicial remedy whenever the DPA does not handle a complaint or d
The data subject was a Facebook user. While using the service, the data subject provided different personal information, including their city of residence, “relationship status” (both publicly visible on their Facebook profile) and phone number (not immediately visible on the platform). However, according to the privacy settings selected at the moment of the facts, the phone number could be used by a third person to find the data subject’s profile on Facebook. Accordingly, information relating to the data subject could be linked to their phone number by anyone in possession of such a number. In 2021, unknown “third parties” automatically combined telephone numbers and matched them with Facebook profiles thanks to the above-mentioned function. In this way, telephone numbers could be assigned to identified users. This resulted in a data breach concerning 533 million people in 106 different countries. The data subject lamented that since then they received anonymous calls and a huge amount of spam. This entailed negative psychological consequences for them. Thus, the data subject asked for €1,000 in non-material damages under Article 82 GDPR. The controller replied that data scraping - which is not hacking - does not entail a violation of the GDPR by the controller, as no mandatory security measures where circumvented. In Facebook’s view, third parties merely had access to publicly available information. The court rejected the request for damages under Article 82 GDPR. Pursuant to this provision, any data subject has the right to receive compensation for material or non-material damages whenever their rights under the GDPR were infringed by a controller or processor. In assessing the oral declarations of the data subject, the court held that the data breach, despite annoying, did not seriously harm the data subject. As a matter of fact, the data subject was only concerned about the possibility that their data could be misused in the future. According to the court, such a concern was too general to give rise to non-material damages. In the words of the judges, the data subject did not spend any “sleepless night” because of the data breach. As further evidence of the limited impact of the data breach on the data subject’s life, the court pointed out to the fact that the user did not change their Facebook setting after the events. In addition, the court argued that the causal link between controller’s conduct and damage could not be proved. As the data subject was active on other social networks, the court held that that the spam and the anonymous calls may originate from facts other than the Facebook’s data breach.
Court case 11 U 88/22
During the Covid-19 pandemic, a vaccination hub accidentally disclosed by email personal data of several hundred people, including their choice to adhere to the mass vaccination. One of the data subjects involved in this data breach asked the controller for non-material damages. They claimed that the violation posed significant risks to their fundamental rights. In particular, they stated to have received a phishing email from an alleged "European Consumer Protection Agency" aiming to steal their and other data subjects’ data from the vaccination hub’s previous email. The data subject also claimed that data could end up in the hands of violent anti-vaccination militants. Therefore, the data subject held to be entitled to non-material damages for an amount of €10,000 pursuant to Article 82 GDPR. In the first instance judgement, the controller stressed that the data subject made their own vaccination data publicly available on Facebook. Thus, no violation occurred with regards to their health data. Moreover, the controller claimed that Article 82 GDPR requires fault, whereas in the present case there was only slight negligence by an employee of the controller. In addition, the controller denied that the data subject suffered any negative consequence: the fundamental rights violations lamented were in fact just abstract and unlikely to happen. In any case, no causal link between such negative consequences and the controller’s conduct could be found. The controller also stressed that the definition of non-material damages under GDPR was unclear and several questions concerning the interpretation of Article 82 GDPR were currently pending before the CJEU. The Court of first instance found that Article 82 GDPR applied in the case at issue. The controller unlawfully processed personal data, including health data, and violated Articles 5(1)(f), 9 and 32 GDPR. A “loss of control” over personal data is sufficient to substantiate non-material damages in accordance with Articl
Nemzeti Adatvédelmi és Információszabadság Hatóság
On 26 April 2019, a shareholder of a Hungarian public limited company attended its general meeting. The meeting was recorded and the shareholder, as a data subject, asked the company, as the controller, to send him the recording. The controller only provided him with the excerpts which reproduced his contributions, excluding those of the other persons attending the general meeting. The data subject filed a complaint with the Hungarian DPA asking it to order the controller to provide the complete recording, which the DPA refused in its decision of 29 November 2019. After this, the data subject started two proceedings at the same time, one against the controller and one against the Hungarian DPA. The first proceeding was filed with the Budapest Regional Court based on Article 79(1) GDPR. In this proceeding, the data subject asked the Court to order the controller to provide him the entire recording. The Regional Court found that the controller had violated the data subject's right of access and upheld his request. This decision became final. The second proceeding was filed with the Budapest High Court pursuant to Article 78(1) GPDR. In this proceeding, the data subject asked the High Court to anull the DPA's decision. This Court would later ask the preliminary questions to the CJEU which resulted in this ruling. As the decision of the Regional Court had already become final, the High Court was faced with a problem when it had to decide the request for annulment of the DPA decision. This is because both procedures referred to the same facts, which could lead to contradictory decisions and, consequently, to legal uncertainty. According to the High Court, the DPA's independence would be compromised if it were bound by the decision of the Regional Court. In those circumstances, the High Court decided to stay the proceedings and to refer the following questions to the CJEU for a preliminary ruling: ‘(1) Must Articles 77(1) and 79(1) GDPR be interpreted as meaning that the administrative appeal provided for in Article 77 GDPR constitutes an instrument for the exercise of public rights, whereas the legal action provided for in Article 79 GDPR constitutes an instrument for the exercise of private rights? If so, does this support the inference that the supervisory authority, which is responsible for hearing and determining administrative appeals, has priority competence to determine the existence of an infringement? (2) In the event that the data subject – in whose opinion the processing of personal data relating to him has infringed the GDPR – simultaneously exercises his right to lodge a complaint under Article 77(1) of that regulation and his right to bring a legal action under Article 79(1) of the same regulation, may an interpretation in accordance with Article 47 of the Charter of Fundamental Rights be regarded as meaning: (a) that the supervisory authority and the court have an obligation to examine the existence of an infringement independently and may therefore even arrive at different outcomes; or (b) that the supervisory authority’s decision takes priority when it comes to the assessment as to whether an infringement has been committed, regard being had to the powers provided for in Article 51(1) GDPR and those conferred by Article 58(2)(b) and (d) of that regulation? (3) Must the independence of the supervisory authority, ensured by Articles 51(1) and 52(1) GDPR, be interpreted as meaning that that authority, when conducting and adjudicating upon complaint proceedings under Article 77, is independent of whatever ruling may be given by final judgment by the court having jurisdiction under Article 79, with the result that it may even adopt a different decision in respect of the same alleged infringement?’ This ruling is mainly about the relationship between Articles 77(1), 78(1) and 79(1) GDPR. After the CJEU determined that the preliminary questions were admissible, the CJEU started by interpreting the wording of these GDPR articles and verified that they did not provide for any type of priority or exclusion rule in case both a Court and a DPA are deciding on a possible violation regarding the same facts. The CJEU continued by stating that the relationship between Articles 77 and 79 GDPR was not extensively regulated by EU law. Also, tthe GDPR does not establish rules for the case in which a claim before a DPA and an action filed before a Court in the same Member State refer to the same facts. According to the CJEU, Article 78(1) GDPR, in light of Recital 143, enables courts to exercise their full jurisdiction, which should include competence to examine all relevant facts and relevant law. With this in mind, the CJEU stated that the decision of the EU legislature to leave it up to data subjects to decide which remedy they wanted to use was indeed consistent with the objective of the GDPR, namely, to ensure a high level of protection of personal data and to strengthen rights of data subjects (Recitals 10 and 11). Due to the absence of EU rules regarding the relationship between these GDPR articles, the CJEU determined that it was up to the Member States to provide detailed administrative and judicial procedures in order to ensure a high level of data protection rights, including rules on how to deal with the present situation. It was therefore for the referring court to determine how the GDPR remedies should be implemented in the present situation, according to national law. However, the CJEU emphasised that certain safeguards needed to be applied while implementing these rules. For instance, these rules had to be compliant with the principles of equivalence (they must not be less favourable than rules governing similar domestic actions) and effectiveness (they must not render it impossible or excessively difficult the exercise rights). According to Article 4(3) TEU, it is the task of national courts to ensure judicial protections of a data subjects under EU law. Article 19(1) TEU requires Member States to make sure that the remedies provided are sufficient to ensure effective judicial protection covered by EU law. Member States also have to ensure that Article 47 of the Charter is safeguarded (principle of effective judicial protection). Therefore, Member States have to ensure that the new practical arrangements do not disproportionately affect a data subjects right to an effective remedy before a court or tribunal. In the present case, the CJEU found that Hungarian law was designed in such a way that the remedies of Articles 78(1) and 79(1) GDPR were independent of each other. Therefore, it could not be ruled out that the rulings of both courts in the present case might lead to different results. Two contradictory decisions could be in contrast with the objective of the GDPR to provide a consistent and homogeneous application. These contradictory decisions could therefore lead to legal uncertainty and inconsistency. Based on the above, the CJEU concluded that the judicial and administrative remedies provided for by the GDPR can be exercised concurrently with and independently of each other. It was the task of the Member States, in accordance with the principle of procedural autonomy, to determine detailed rules for the relationship between those remedies in order to ensure the effective protection of the rights guaranteed by the GDPR and the consistent and homogeneous application of its provisions. Member states also had to ensure the right to an effective remedy before a court or tribunal (Article 47 of the Charter).