GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
On the 29th of November 2018, following a complaint filed by three consumer associations, the Italian Competition Authority (Autorità Garante della Concorrenza e del Mercato – AGCM) adopted a decision against Facebook Inc. and Facebook Ireland. The Authority found that Facebook engaged in an unfair commercial practice towards its users by failing to inform them adequately and immediately about the commercial nature of the processing of their personal data, while emphasizing that registering to the platform was free of charge. For this reason, Facebook Inc. received a fine of € 5,000,000. The AGCM also found that Facebook engaged in an aggressive commercial practice towards its users by unduly influencing its users’ preference concerning the processing of data for commercial purposes. This was done by pre-selecting the option to consent to sharing data with third parties, while presenting them with the prospect of significant limitations in case they de-select such options. For this reason, Facebook Ireland received a fine of € 5,000,000. On the 18th of December 2019, the Regional Administrative Tribunal (Tribunale Amministrativo Regionale – TAR) of Lazio partially upheld two separate appeals brought by Facebook Inc. and Facebook Ireland. On the one hand, the TAR agreed with AGCM findings that Facebook misled its users into registering to the Facebook platform “for free”, without providing adequate and timely information about the commercial use of their personal data. On the other hand, the Tribunal found that the pre-selected options provided to Facebook’s users during their registration does not actually gather their consent to the transfer of data to third parties. This actually occurs at a later stage and on a granular level. Moreover, the TAR found that the AGCM failed in properly demonstrating the aggressive nature of such practice, and how it influenced the choices of the users. Both Facebook and the AGCM appealed against the TAR decision. Among others, Fa
The controller (defendant) is the biggest logistics and postal service provider in Austria. Its main business activities include the transport of letters, advertising mail, print media, and parcels. Furthermore, the defendant also conducts business as an address publisher under § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) and sells personal data for third-party marketing purposes. On 14.01.2019 the data subject (claimant) sent an access request under Article 15 GDPR to the controller on which the controller replied to on 14.02.2019. Besides data such as name and phone number the controller stated to process certain "marketing classifications" under § 151(6) GewO. These "marketing classifications" are calculated based on a a variety of socio-demographic circumstances (e.g. age, place of residence, level of education) and express a statistic probability of the data subject belonging to a certain demographic group (e.g. "do-it-yourselfer", "night owl", "person with affinity for investments"). The data subject was not content with the controller's reply and filed a lawsuit for the provision of access under Article 15 and erasure under Article 17 GDPR in connection with Article 21 GDPR. Furthermore, the data subject requested a declaratory judgment that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject. The first instance court (Regional Court Wels - LG Wels) rejected the lawsuit, holding that the controller had already fulfilled the data subject's requests. Following an appeal by the data subject, the second instance court (Higher Regional Court Linz - OLG Linz) partially overturned this decision and held that the data subject had indeed a legal interest in the claimed declaratory judgment. Consequently, it held that the controller is under the legal obligation to provide access to the data su
The complainants, Johnny Ryan, Pierre Dewitte, Jeff Ausloos, Bruno Bidon, Panoptykon (NGO), Bits of Freedom (NGO) and La Ligue des Droits de l'Homme, filed several complaints against the Interactive Advertising Bureau Europe (IAB Europe) for various GDPR violations (including the principles of legality, transparency and fairness, minimisation and security among others). In total, 4 complaints were filed before the ADP and 5 before other data protection authorities through the IMI (Internal Market Information) system. These complaints were therefore joint into one investigation. An interlocutory decision, changing the language of the proceedings to French was made on 08/01/2021. Some parties did not agree with this and asked the Market Court to change the language to Dutch and to use full French text (some words where not in French). The parties reached an agreement before the Court of Appeal of Brussels (commercial section) had to render a judgement. The parties reached an agreement which made any interference from the Market Court obsolete.
A citizen requested that the Tax Office provided her/him with the National Tax Number (NIF) of the owner of a neighbouring building and land, so as to request a check on the exact boundaries of the lands owned by both. The Tax Office, alleging Article 68 of the National Tax Law and the Data Protection Act, refused the request. The petitioner considered that the NIF of the owner of a building does not fall under the definition of what constitutes data that is protected by tax secrecy, as such data should be publicly available. Does the tax number of the owner of a building constitute personal data or data that should be publicly available? The appeal concerns the decision of the Administrative Court of Leiria, which dismissed the request for information made to the Portuguese Tax Office to provide the Portuguese National Tax Number (NIF) of an alleged neighbour, in order to contact this third party for purposes of checking the boundaries of an allegedly adjacent land. Before, it had been solidly anchored in the Portuguese jurisprudence a flexible approach to the duty of confidentiality and the protection of taxpayer data, with the Courts generally accepting that the NIF was not part of the sphere of intimacy in private life, and so, not personal data, but considered as publicly available data on taxpayers. In fact, it was the general understanding that publicly available personal data could be revealed, which encompassed public data or personal data contained in an official public document, as is the case, for example, with the NIF, as well as fiscal data that does not reflect or denounce the tax status of taxpayers. However, with Decree-Law no. 14/2013, of 28 January, the legislator started to adopt a much more rigid position regarding this information, with the new Law reflecting an increasing concern with the protection and treatment of individual data. This Decree modified the Portuguese General Tax Law (Lei Geral Tributária, or LGT) and added a new excepti
On 2019, the Spanish DPA (AEPD) [https://www.aepd.es/es/documento/ps-00336-2018.pdf fined a supermarket chain €100,000] for not implementing adequate measures to prevent the leakage of one of their security videos, that involved images from a well-known politician. This AEPD decision was appealed before the Spanish National High Court (AN). The AN concluded that the sanctioning proceeding carried out by the AEPD had not respected the procedural law for sanctioning proceedings nor the ethos of the right to effective judicial protection enshrined in the Spanish Constitution. According to the general principles of the procedural law for sanctioning proceedings, any defendant has the right to a trial period, a draft resolution, and a period for allegations, that the AEPD did not grant to the controller, as they did not respond to the initial notification. Additionally, the AEPD, in their initial assessment, only contemplated the violation of Article 9 (security of the data) of the [https://www.boe.es/buscar/act.php?id=BOE-A-1999-23750 former Spanish Data Protection Act], while in their resolution they also found a violation of Article 4 (quality of the data), but did not inform the controller about the allegations against them pursuant to the latter Article. Furthermore, the DPA conducted an on-site investigation on different premises than where the problem had originated - in order to assess and verify the security protocol of the controller - but did not inform the controller that they could assess other infringements in those other premises. According to Article 24 of the Spanish Constitution, defendants shall have the right to legal defence, to be informed about the allegations made against them, and to have the opportunity to prove themselves innocent, with whatever means of evidence. Also, according to Article 122(1) [https://www.boe.es/buscar/act.php?id=BOE-A-2008-979 Spanish DPA Bylaw], the DPA should carry out investigation activities that allow them t
Following the complaint of two petitioners claiming that the plaintiff had contacted them for direct marketing purposes, even though they had not consented to the processing of their personal data to this effect, the supervisory authority for data protection in Saarland, the defendant, ordered a limitation of the processing and an erasure of the unlawfully processed personal data of the petitioners by the plaintiff pursuant to Article 58(2)(f) and Article 58(2)(g) GDPR. The plaintiff had not been able to prove that the consent of the petitioners had been obtained in accordance with the requirements of Article 7(1) GDPR. The argument presented by the company, alleging that the petitioners' consent had been collected at the time of their participation in a lottery and confirmed via e-mail as part of a so called "double opt-in process", were not considered sufficient by the supervisory authority. The authority pointed out that the plaintiff should have been able to prove that the consent actually originated from the person contacted for direct marketing purposes, which had not been the case in the present matter. Furthermore, the authority underlined that the plaintiff could not justify a legitimate interest pursuant to Article 6(1)(f) GDPR, which would allow them to process the petitioners' data without their consent, the petitioners not having any business relationship with the plaintiff and therefore no reasonable expectation to be contacted by the plaintiff's company. In this context, contacting the petitioners for direct marketing purposes without their prior consent even qualified as unreasonable harassment under § 7(2)(2) of the national competition law (UWG). The plaintiff appealed the decision of the supervisory authority before the administrative court of Saarland (VG Saarlouis), arguing amongst other things that the orders could only be considered contradictory because of the reference to requirements from data protection as well as competition laws which
Two persons were sentenced to prison by a Criminal Court of Barcelona for violent robbery in a Mercadona supermarket. The were also prohibited from entering the supermarket for two years. Mercadona asked the court to allow them to use a system processing biometric data to monitor the entrance of the supermarket and stop them from accessing, as doing it with traditional means (i.e. instructing the security personnel to do it) would be too burdensome and virtually impossible. In order to justify this, they alleged a public interest based on the [https://www.boe.es/buscar/act.php?id=BOE-A-2014-3649 Spanish Private Security Act] and on a legitimate interest to ensure compliance with the judgment of the criminal court. The criminal court rejected the petition, against which the supermarket chain filed an appeal before the Barcelona Court of Appeal (Audiencia Provincial de Barcelona). They argued that: * Even if the category of biometric data is recognized in the GDPR as specially protected data, it does not exclude its use, provided that it is carried out with all the relevant security measures. The controller understands that the proposed security measures do not harm the rights of the data subjects, since, although the biometric data of all users entering one of the establishments are processed, the system instantly (within 0.3 seconds) detects the convicted individuals; while no biometric data of any person who has not been prohibited from entering the place will remain in the system, that will be immediately erased and will never be used. * The purpose of the legislator in the development of the GDPR is not only to protect the rights of natural persons but also the free circulation of data, taking into account the progress of technology. That is why it would be completely ineffective to try to solve a problem such as the control of those individuals with an entry ban by just showing the image of these individuals to dozens of employees of establishments so that they
In June 2019, the Danish Data Protection Agency (DPA) expressed severe criticism of IDdesign A/S for the violation of the Article 5(1)(e) of the GDPR, namely, the failure to delete personal information of approx. 350,000 customers in its old IT-system. The personal data included the customers´ names, addresses, telephone numbers, email addresses and order history. The company was reported to the police. The Prosecution Service decided to pursue the case further in a court. The DPA and the Prosecution Service recommended a fine of DKK 1.5 million, which was calculated based on the entire group turnover and by taking into consideration the company´s intentional failure to delete the data. The court considered whether the company violated the Article 5(1)(e) of the GDPR (storage limitation principle) and determined the amount of fine for the violation. The court found that the company, in breach of the Article 5(1)(e) of the GDPR, kept the data of around 350,000 customers for longer than is necessary for the purposes for which it was collected. According to the Danish Consolidated Bookkeeping Act (in Danish - Bogføringsloven) the data must be deleted after 5 years. However, the court concluded that the violation has been committed through negligence. With respect to the calculation of the fine, the court disagreed with the proposed charges and concluded that amount should be calculated based on the company´s own turnover, and not on the entire group. Moreover, while calculating the fine amount, the mitigating circumstances under the Article 83(2) should be taken into consideration, such as: *the company has not breached the GDPR before, *the breach involved only general personal information, *any data subjects suffered damage as a result of the infringement, *negligent character of the infringement, *the company has taken considerable steps to ensure compliance with the GDPR. The court imposed a fine of DKK 100,000.
The President of the Office for Personal Data Protection, after conducting administrative proceedings on the processing of personal data by ClickQuickNow, issued a decision finding that the entity had violated the principle of lawfulness, fairness and transparency of personal data processing. In addition, he found that the company violated Article 7 (3) GDPR, Article 12 (2) GDPR, Article 17 (1)(b)GDPR and Article 24 (1) GDPR, by failing to implement appropriate technical and organisational measures to enable the data subject to easily and effectively withdraw consent to the processing of his personal data and to exercise his right to request the immediate erasure of his personal data (right to be forgotten). In addition, the supervisory authority found that the company processed without legal basis the data of persons who are not its customers, from whom it received requests to cease processing personal data. A fine of €47,000 was imposed on the company. The company appealed against this decision to the Provincial Administrative Court. The court dismissed the complaint and held that the controller is obliged to provide the data subject with the possibility to withdraw consent as easily as to give consent. While the controller may provide for an easier way to withdraw consent than to give consent, it may not limit this right by adopting solutions that would make it more difficult to provide a statement of withdrawal of consent than to provide a statement of consent. Asking the data subject about the reasons for withdrawing consent has no legal basis and is a deliberate action aimed at obstructing or even preventing the exercise of data subjects' rights. Such action constitutes at the same time an infringement of the principle of lawfulness, transparency and fairness of data processing. In the Court's view, the procedure applied by the company in the process of revoking consent to the processing of personal data previously obtained by the company does not meet the c
A window cleaning company (Plaintiff) sold its customer database to the Defendant. The Plaintiff requested a fee for the database. The Defendant paid a third of the fee to the Plaintiff and did not want to pay the rest of the fee, as it argued that the transfer of the customer database did not comply with the GDPR. It claimed that the Plaintiff failed to ask for the customers’ consent and provided inaccurate and incomplete personal data - customers’ emails were missing. As a result, the Defendant argued that the Plaintiff did not comply with the acquisition agreement. Can the Defendant’s claim based on the GDPR invalidate an acquisition contract? The court held that the Plaintiff complied with the acquisition agreement and decided that the lack of consent does not constitute a breach of contract. The Plaintiff did not commit to obtain costumer’ consent and, the compliance with the GDPR was not part of the contractual obligations negotiated. Therefore, the parties did not agree that the Plaintiff would ask for consent and that the failure to do so should constitute a defect. The Court further explained that a GDPR infringement may be sanctioned with an administrative fine, which the Dutch DPA may impose on the parties involved. This does not mean that an acquisition agreement, in which data of third parties are 'traded', must be considered as invalid. Nor does it provide a ground for termination. Thus, the Defendant must pay the agreed purchase price, plus interests and the cost of the proceedings.
This case is an appeal by Leave.EU and Eldon Insurance Services of 3 different fines imposed on them by the ICO in 2019. For detailed background information on the case see here. The appellants' were given permission by the FTT to appeal to the Upper Tribunal (UKUT) on nine grounds, namely that the FTT erred in law by finding that: # the Commissioner’s failure to comply with her published Regulatory Action Policy ('RAP') was not a basis for overturning the notices # the relevant Leave.EU newsletters were an unsolicited communication for the purpose of direct marketing; # the consent given by Leave.EU subscribers did not comprise freely given, informed and specific consent to the inclusion of the GoSkippy promotion in the newsletters; # Eldon had instigated the transmission of the relevant newsletters; # Leave.EU and Eldon ought to have known that the inclusion of the GoSkippy promotion in the Leave.EU newsletters risked contravening PECR; # the relevant newsletters were a serious contravention of PECR; # the notices were proportionate and consistent with the ICO’s general approach; # the test for apparent bias was not satisfied; # the decision to issue the assessment notices was lawful. These were grouped into four broad headings by the court, which in turn assessed each of the following matters. # whether sending the newsletters fell within the scope of regulation 22 of PECR (Grounds 2, 3 and 4); # whether the criteria for issuing a MPN were met (Grounds 5 and 6); # whether the various notices complied with the Commissioner’s RAP, the requirements of proportionality and the statutory basis for an assessment notice (Grounds 1, 7 and 9); and # whether the notices were vitiated by procedural unfairness (Ground 8). = The tribunal first considered ground 2. The appellants argued that "finding that the relevant Leave.EU newsletters were unsolicited communications for the purposes of direct marketing" would go against the purpose of the directive implemented by t
On 1 September 2020, the Belgium DPA imposed a fine of €5,000 on a controller for sending unsolicited emails for electoral message and disclosure of emails (via CC). The controller did not agree with the fine and filed for appeal. Proportionality of the administrative fee The Court of Appeal overruled the DPA's decision for lack of justification as required by Article 83 GDPR, and lack of proportionality. The decision was sent back to the authority who is additionally required to pay back legal cost for €1,400, since the Court could not itself reform, or amend the decision.
The Public Employment Service (AMS) is a service provider under public law with its own legal personality. It is responsible for implementing the labour market policy of the federal government. In order to support workers in their (re-)integration into the labour market, it offers various services which are implemented by its counsellors. In the course of a counselling interview, counsellors have to discuss the client's wishes/expectations, their previous life history and the reasons for their unemployment. The jobseeker's chances on the labour market should also be addressed and discussed. In order to support counsellors in assessing the labour market opportunities of jobseekers, the AMS has developed a concept for calculating the labour market opportunities of jobseekers (AMAS) In concrete terms, AMS uses an algorithm to automatically calculate the probability of currently registered customers being employed for a certain number of days within a certain period in the future. For this purpose, a so called IC is calculated from the following data: age group, gender, group of States, education, health impairment, caring duties, professional group, pre-career regional labour market performance, duration of the business case at the AMS Based on the calculated IC, a classification is made into the following groups: Service clients with high labour market opportunities, care clients with low labour market opportunities, counselling clients with medium labour market opportunities. In order to ensure that the counsellors do not adopt AMAS unquestioningly, the AMS has issued guidelines and corresponding instructions as well as conducted training courses. The Data Protection Authority (DSB) initiated an ex officio investigation into the matter and concluded that the AMS was prohibited from processing data with the help of the AMAS with effect from 1 January 2021, unless there is a suitable legal basis for the data processing. This decision was then repealed by the Federal A
The appellant is a civil servant at the municipality of Leiden. He does not want the municipality to share his personal data with third parties because he fears he would lose control over his data. The municipality of Leiden outsources its HR administration to Service71; Service71 uses YouForce as the HRM tool which is offered by RAET B.V. On 15 January 2018 the municipality denied appellant’s request to delete his performance reports and assessments from YouForce. Appellant has also objected to the processing of his data by the company Mindtree in India. In the appealed decision the Court of First Instance of the Hague considered that the municipality had compelling and legitimate grounds for the data processing, which override the interests of the appellant. The Court found no evidence that the appellant’s personal data was processed in India by the employees of Mindtree. The appellant argues that: 1. The Court failed to recognize that his request should also be considered as an access request because it was not possible for him to make sure that the data processing in question was lawful. 2. The municipality has no legal basis for sharing his data with Service71 and RAET B.V. and that the data processing itself is excessive. 3. Personal data of employees, including the appellant, can be accessed by the company Mindtree in India. On the first point, the Council ruled that the appellant had already had direct access to his data via the YouForce personnel file, which means his request should not have been considered as access request. On the second point, the Council established that the appellant did not object to the performance reports and assessments as such. He also did not object to having these reports digitalized, provided that the storage would take place on the premises of the municipality, for example on the computer of his supervisor. However, appellant did not want the reports to be stored by third parties, such as Servicepunt71 and RAET B.V. It
Complainant’s debt at the predecessor of Hoist Finance was claimed by Hoist on 5 July 2006 because payment arrears. On 8 May 2006 a record of the payment irregularities was made in the Stichting Bureau Kredietregistratie (BKR register): code “A” was added to complainant’s name. On 28 June 2006 an additional code 2 was added to the registration, which mark the existence of a claimed debt. After the decision of the District Court of Groningen, the complainant agreed on a payment arrangement to pay the debt. On 1 June 2017 a code 3 was added to the complainant’s BKR registration to signify the payment agreement. The entire debt was paid on 27 June 2017. On 17 July 2020 Hoist Finance notified the complainant that it would have the 3-code removed from his BKR registration in response to the complainant’s request. On 10 September 2020 another BKR registration deletion request was submitted, but Hoist Finance rejected it on 21 September 2020. Complainant claims that codes “A” and “2” must be removed from his registration because he is disproportionately affected by it. He is in the process of buying a house and he cannot get his mortgage approved. Complainant also points out that he hasn’t had any debts for 3 years. Hoist Finance disagrees: the complainant did not submit his objection to the rejection to Court within the legal term of 6 weeks (under Article 35(2) UAVG), which makes his request inadmissible. Heist Finance also argues that the complainant does not have an urgent interest, his A2 registration should remain for the term of 5 years and that the deletion request is not sufficiently substantiated. In particular, the reason for maintaining the registration is that the complainant has had financial problems for a long time, which means that lenders still require protection in this case. The Court considered that there is doubt about whether Hoist Finance as a participant in the credit registration system makes credit registrations under Article 6(1)(c) or Arti
The High Court of England and Wales examined a claim against the news website Forensic News LLC and several journalists contributing to its articles. Both the news website and the journalists are based in the US. The claim concerned different news articles containing allegations on the claimant’s connection with an Israeli intelligence company, which the claimant asserted represented a breach of the GDPR and several other laws. As preliminary point of law, the court considered the question whether GDPR is applicable to the situation at hand. Concretely, the court examined whether the matter could fall under any of the three criteria for the extraterritorial application of the GDPR, as prescribed by Articles 3(1), 3(2) and 79(2) of the GDPR. The criteria considered were – whether Forensic News LLC had an establishment in the EU, whether it offered goods and services to individuals in the EU, and whether it monitored the behavior of individuals in the EU. On the first point, the court found that Forensic News LLC did not have any stable arrangements in the UK, and the “establishment” criteria was therefore not met. For this conclusion, it was decisive that the news website had no employees or representatives in the UK. On the other hand, the fact that Forensic News LLC had a readership in the UK and a “handful” of UK subscriptions was not sufficient to prove establishment. On the second point, the court’s position was that Forensic News LLC did not directly target UK consumers with its goods and services. The fact that the UK is a shipping destination for the website’s merchandise was disregarded due to lack of actual purchases – the court found that, in the UK, only one baseball cap was purchased from the website. Finally, on the third point, the court considered that the monitoring undertaken by Forensic News LLC was not sufficient to justify extraterritorial application of the GDPR. Namely, the news website used cookies for the purpose of behavioral profili
A data subject filed constitutional complaint because the AG Goslar (Goslar Local Court) denied his claims under Article 82 GDPR because of an unsolicited email. Because he only claimed 500 EUR as compensation, the Goslar Local Court was the regular last instance under German law. The Goslar Local Court denied the preliminary ruling from the CJEU. Was the Goslar Local Court obliged to hear the CJEU for a prelimary ruling? The judgment of the Goslar Local Court of 27 September 2019 - 28 C 7/19 - violates the complainant's fundamental right under Article 101(1) sentence 2 of the Basic Law. The judgment is set aside. The matter is referred back to the Goslar Local Court for a new hearing and decision. This renders the order of the Goslar Local Court of 11 November 2019 - 28 C 7/19 - irrelevant.
Individuals have complained to the Polish supervisory authority about the processing of their personal data by their bank without a legal basis and for marketing purposes. The applicants were customers of the bank and held personal and savings accounts with it. After some time, the customers requested the bank in writing to stop sending advertising material and bank statements to their address and withdrew their consent to the processing of their personal data by the bank, which withdrawal of consent included the quote: "the use, processing and archiving of all our personal data by the Bank". The bank informed the applicants that it would not comply with the request due to the impossibility of confirming the identity of the applicants, and also indicated the possibility of submitting the request in person at any bank office or by sending a request to that effect via the bank's helpline or Internet channel. The applicants have refused to use the communication channels indicated to them by the bank and have renewed their statement withdrawing their consent to the processing of their personal data by the bank. The bank eventually closed the customers' bank accounts and at the end sent them a monthly bank statement and later a combined bank statement, which contained information about the bank's subscription to a new structured deposit. By letter from November 2018 the bank stated that it currently processes the applicants' data in terms of first names, surnames, type of identity document, identity document number, expiry date of identity document, country of issue of identity document, PESEL identification number, date of birth, place of birth, country of birth, residence status, nationality, parents' first names, marital status, mother's maiden name, gender, residential address, correspondence address, mobile phone number, home phone number, form of employment and preferred language of contact, data on the bank's products held, CIF number (identification number assign
This matter concerns a claimant’s access request which was only partially addressed. The data subject objected to the controller’s decision and argued that his request should have included information linked to his name, his alias, and internal correspondence between the defendant and its organisational unit (TOELT) relating to the processing of his asylum application. On the one side, the complainant relied on Article 12 GDPR and Article 15(1) GDPR, and referred to a judgment of [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:GHDHA:2019:2398 the Court of Appeal in The Hague] and the Nowak judgment by the CJEU in support of his interpretation of the notion of personal data. The controller, on the other side, maintained that the definition of personal data does not include internal correspondence nor the claimant’s alias. The court turned to the definition contained in Article 4 GDPR to determine whether an alias forms part of one’s personal data and declared the controller’s understanding as incorrect. The court held that “[t]his alias was used by the claimant... and can therefore be directly linked to the claimant himself.” Hence, the scope of personal data includes someone's alias. In its assessment of whether this was also the case for internal correspondence between the controller and TOELT, the court distinguished the present matter from the case law referred to by the complainant. It further noted that a CJEU judgment relied on by the controller predates the GDPR but maintains its relevance to the interpretation of the right of access and rectification. The court considered the CJEU’s reasoning, that if the applicant’s right of access were to be extended to the legal analysis of the residence permit process, it would no longer serve the purpose of the GDPR and would ensure the applicant access to administrative documents, which the GDPR does not provide for. Thus, the internal correspondence between the controller and TOELT was excluded fr
On 1 July 2016 the municipality put a piece of land with an unused shooting range up for sale for a symbolic amount of 1 EUR. The claimant was interested in buying it. To reuse the old shooting range, claimant was required to get an environmental permit from the municipality. The online form available on the sites of the Dutch municipalities, has two options for such permit applications: the complete form, which is available to competent authorities only, and the publicly available version of this form. The information that an applicant wants to keep private is removed from the publicly available version. More specifically, the publicly available version doesn’t contain the applicant’s social security number (BSN) and phone number. When submitting the digital application, an applicant is presented with the following choice: Do you give permission to make publicly available personal and address details of the applicant/notifier and, if applicable, the authorised representative? The claimant submitted his environmental permit application on 9 December 2016. He filled in his social security number, last name, initials, address, phone number and email. He consented to making his data publicly available. On 7 October 2017 and 7 December 2017 the municipality published a draft statement and draft decision, making them available on its site, on the Government Gazette (Staatscourant) and on www.ruimtelijkeplannen.nl. On 2 December 2018 a local journalist twitted about the fact that the municipality has published claimant’s data on its website, including the social security number and phone number. On the same day the claimant reported the data breach to the municipality under GDPR, telling the municipality to remove his data and mentioning non-material and material damages (for the costs involving increased house security). On 3 December 2018 the municipality has included the claimant’s environmental permission application as an agenda item in the council’s meeting and publ