GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The applicant claimed to have personal data stored on the French National Schengen Information System (“N-SIS II database”). Under [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32018R1862 Regulation (EU) 2018/1862], the Schengen Information System is composed of, on one hand, a central system (“C-SIS”), and, on the other hand, national systems (“N-SIS”) that communicate with the central system. The system as a whole allows Member States to share alerts on persons, which include personal data, for several purposes in relation with police and judicial cooperation. The applicant exercised his rights of access and erasure against the Ministry of the Interior (“Ministère de l’intérieur”), without success. She then petitioned the French DPA (“CNIL”), with the same outcome. In this context, she seeks the annulment of the Ministry’s decision before the French Administrative Supreme Court (“Conseil d’Etat”). As it appeared during the proceedings, her demand was processed in accordance with the procedure applicable to personal data processed for national security purposes. The applicant demands that the Court reviews the lawfulness of this procedure and the decision of the Ministry. Is French procedural law applicable to the exercise of the right of access and the right to erasure of personal data processed for national safety purposes compliant with Article 15 and 23 GDPR? The Court found that the applicant’s petition had been lawfully processed and must be rejected. According to [https://www.legifrance.gouv.fr/codes/section_lc/LEGITEXT000006070933/LEGISCTA000006136462/#LEGISCTA000006136462 Article L773-1 to 773-8 of the Administrative Justice Code] (“Code de la Justice administrative”), a specific panel of judges reviews the application. The defendant has limited access to the file. If the alleged data do not exist or are lawfully processed, the application is rejected without further indication. However, if the processing is found unlawful, the app
The claimant was hospitalised in a hospital for which the defendant was responsible. After being discharged from hospital, the claimant asked the hospital to send his entire medical history to his email address free of charge, citing the GDPR. The hospital responded that the transfer of the medical history was subject to the payment of a fee. The claimant did not pay the fee and the defendant did not provide the claimant with the medical history until the conclusion of the oral proceedings at first instance. The complainant sued the hospital operator for €7,000. The court of first instance upheld the claim, holding that the GDPR regulations overrode national law on the provision of medical records. The claimant was entitled to a free initial copy of the medical history under Article 15(3) GDPR in conjunction with Article 12(3) GDPR. The Court of Appeal amended the judgment to dismiss the claim. It valued the subject matter of the decision at €5,000, but no more than €30,000, and allowed the ordinary appeal because there was no supreme court case law on a patient's right to receive a free initial copy of his medical history under the Data Protection Act. The plaintiff has appealed. Is the right to receive a first copy of medical history free of charge limited by national legislation in a way that is permissible under Article 23 GDPR, or must the principle of chargeability remain inapplicable as a national law contrary to Article 23 GDPR? The Supreme Court repealed the judgments of the lower courts and referred the case back to the court of first instance for re-examination and determination.
In 2011 Rabobank loaned 70K EUR to the appellants with a monthly payment of 700 EUR. At that time one of the appellants had a well-paid job, which he lost in 2013 and he hadn't been able to find another job after that. Financial problem followed, and the appellants ended up selling their house and taking an additional loan from their son to settle the debt payment scheme with the mortgage company and Rabobank. As a result of the above, Rabobank made a record about the appellants' situation in the CKI in 2018; the registration is schedules to be removed in 2023. In 2019 the appellants sent a letter to Rabobank requesting it to remove the registration, based on GDPR Articles 16 and 17 in combination with articles 21 and 6. Rabobank rejected the request and this decision was upheld by the Court. Appellants are challenging this decision of the Court. Should Rabobank remove the appellants' credit registrations from the CKI register? Regarding the legal basis of processing, the Court ruled that the applicable legal basis in this case is legal obligation under articles 4:32(1) and 4:34 of the Financial Supervision Act (Wet op het financieel toezicht). The Court pointed to the extensive considerations given to this matter by the Court of Appeal of 's-Hertogenbosch in a similar case. This means that the appellants cannot exercise their rights to erasure (Article 17 GDPR) and objection to processing (Article 21 GDPR), so appeal based on these articles was dismissed. When deciding on the necessity and proportionality of keeping the CKI record, the Court considered the following: 1) The appellants themselves admitted that they were hindered by the registration, they were not in a distressing situation as a result of the registration; 2) One of the appellants has enjoyed good income for a long time, but that income did not protect him from a difficult financial situation; 3) The appellants have not sufficiently demonstrated that they have done everything in their power to
D.-H.T acting as the insolvency administrator of J & S Service (‘data subject’) requested certain tax information about the data subject from the German local tax authorities (‘data controller’). The German Abgabenordnung (‘Tax Code’) extends the application of the GDPR to legal persons, not just natural persons. However, the data controller refused D.-H.T’s request for information, relying on Article 23(1)(e)&(j) GDPR and Paragraph 32 German Tax Code. D.-H.T successfully challenged this refusal at the German Administrative Court. The data controller lodged an appeal to the Higher Administrative Court which affirmed the judgment of the court of first instance, holding that because D.-H.T (a company) was the insolvency administrator of the data subject (another company), it could therefore exercise all access rights of the data subject. It also reasoned that the data subject's right to access information was not limited by any specific legislation on tax secrecy. The dissatisfied data controller lodged a further appeal against this decision to the German Federal Administrative Court which then requested a preliminary ruling from the CJEU on interpretation of Article 23(1)(j) GDPR. The Advocate General found that the CJEU lacked jurisdiction to give a preliminary ruling because the scope of the relevant provision of the German Tax Code which sought to protect information of legal persons was materially different from the scope of the GDPR which protects the personal data of natural persons. On the merits, he found that the limitation in Article 23(1)(j) GDPR applies to the enforcement of civil law claims pursued by both private persons and public bodies. He also found that this limitation in Article 23(1)(j) GDPR includes the defence against civil law claims and does not depend on the condition that a civil law claim must first be established. The CJEU emphasized that the GDPR’s main aim is to protect the fundamental right of natural persons with respect to the
On 6 September 2018, the CNIL issued a Recommendation on the processing of credit card data in the context of online purchase of goods and services. The recommendation provides that: (1) Credit card data can only be processed in order to complete a transaction in connection with the performance of a contract; (2) The storage of such data in order to facilitate subsequent payments is only possible if: *(a) The data subject has expressed prior and explicit consent; or *(b) Has taken a subscription offering access to additional services, thus intending to enter in a regular commercial relationship. Cdiscount, a marketplace website, requested the CNIL to modify those rules. It argued that websites should also be able to store credit card data of customers who can reasonably foresee their data will be stored, on the basis of their purchasing frequency. The CNIL did not meet the demand. Cdiscount is thus seeking the annulment of the decision before the French Administrative Supreme Court. Did the CNIL exceed its remit when interpreting Article 6 GDPR in its Recommendation? Did the CNIL, by requiring prior and explicit consent, wrongly considered credit card data as a special category of personal data (Article 9 GDPR)? Does the data controller have a legitimate interest to process credit card data of recurring purchasers under Article 6(1)(f)? Can the recommendation be annulled on the ground that it creates a distortion of competition with foreign economic operators that are not subject to similar legislation? The Supreme Administrative Court dismisses the appeal, on the following grounds. = The Court holds that the CNIL acted within its power when interpreting Article 6 GDPR. This power is derived from (Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés). These provisions designate the CNIL as Supervisory authority for France under Article 51 GDPR. They also expressly grant the CNIL power to issue guidelines and recommendations
The requester has submitted an access request to the Municipal Executive of Zundert. He wanted to know if the Municipal Executive was processing his data by posting messages on the Forum of the Association of Municipalities of the Netherlands (VNG) and have the content of those messages. The Municipal Executive has rejected this request because, among other reasons, the requester’s signature didn’t match the signature on the FOI request submitted by the person with the same name living at the same address as the requester. The Municipal Executive invited the requester to visit the town hall. Instead, the requester sent a letter with an explanation of why the signatures were not matching together with the copies of an ID card and a bank card. The Municipality did not accept the letter and refused to proceed with the access request. The requester sent a written objection and included a copy of his passport. The Municipal Executive rejected the objection on the basis that the requester was misusing his rights. The requester took the Municipal Executive to court which agreed with the requester and ruled that a copy of passport was enough to establish the identity of the requester. The Municipality Executive is appealing this decision. 1. Can the requester’s access requested be rejected on the basis that the requester is abusing the law? 2. Under these circumstances, is a copy of passport enough to establish the identity of the requester? On the first question, the Council has no reason to rule that the requester is misusing his right of access. Finding out what information was posted on the VNG forum is in line with the purpose of the Personal Data Protection Act and, subsequently, the GDPR. Request for compensation in case his data is processed unlawfully is also in line with the GDPR. The facts that this may be the reason for the access request and that requests like this were submitted to other municipalities, do not mean that the purpose of the request is not
The Council of Mayor and Aldermen of Heemskerk (which exercises the executive power of the municipal government) declined the request of the appellant to access his personal data. The data subject attached a copy of an expired passport to this request, but the Council of Mayor and Aldermen of Heemskerk announced that it was unable to establish the applicant's identity properly with an expired passport. It therefore requested the appellant to send a certified copy of a valid identity document (i.e. copy of an original document that has been authorised or stamped as being a true copy of the original, by a qualified individual) or to visit the town hall in person. The appellant then sent a copy of a valid passport, without further explanations. The Council however decided not to consider the request. It took the view that it was not possible to properly establish the identity of the applicant with the information at its disposal. Although a copy of a valid passport had been submitted, it had emerged from the administration that the signature on the request and on the passport did not match the signature on previously submitted requests by a person with the same name who lives at the same address. According to the Council, it was therefore necessary to establish the identity of the applicant by means of one of the two options offered (certified copy or visit at the town hall). Is a data controller entitled to request the data subject to send a certified copy of an identity document or to visit its building in person to establish its identity, or are these two options so impeding that it affects the right of the data subject to freely request access to his data? On appeal, the Council of Mayor and Aldermen took the view that the appellant misused his rights because he made the access request with a view not to take cognisance of the personal data processed concerning him, but merely to collect penalty payments and obtaining reimbursement of legal costs from the publ
The Council of Mayor and Aldermen of Uithoorn (which exercises the executive power of the municipal government) rejected the request of appellant to erase his personal data. He attached a certified copy of his passport to this request, but it was deemed insufficient to establish the applicant's identity properly and irrefutably. The Council of Mayor and Aldermen of Uithoorn requested the appellant to visit the town hall in person. Subsequently, the appellant requested that a DigiD link be e-mailed to enable him to identify himself, but such identification via DigiD was not yet possible at the municipality. By decision of 10 February 2020, the District Court of Amsterdam dismissed the appellant’s appeal against that decision as unfounded. The Court ruled that the Council of Mayor and Aldermen of Uithoorn could reasonably request the appellant to come and identify himself personally at the town hall, in order to prevent fraud. Such requirement was not deemed disproportionate, considering the irreversibility of the erasure of data and the importance of proper identification in this respect. The appellant lodged an appeal against this decision. Does the presentation of a copy of a passport provide sufficient information to verify the data subject's identity? Recital 64 of the GDPR states that the data controller should take all reasonable steps to verify the identity of a data subject requesting access. If there is reason to doubt the identity, additional information may be requested, as follows from Article 12(6) of the GDPR. In this case, the Council of State as of the opinion that there were other possibilities for establishing identity, which raised a lower threshold. The presentation of a copy of a passport, for example, is in principle considered a reasonable measure to verify identity. The fact that it is possible to falsify the copy of a passport and that it is impossible to check whether the document that has been scanned is authentic, as argued by the C
Plaintiff regularly represents others in Open Government Act (Wet openbaarheid van bestuur) procedures against the Dutch Food and Consumer Product Safety Authority (hereafter: NVWA). Plaintiff requested access to the personal data processed by the NVWA with regards to these procedures, basing their claim on article 15(1) GDPR. The NVWA partially granted the request and gave plaintiff an overview of the data processed by them with regards to the aforementioned procedures and who has access to this information. Plaintiff objected to the primary decision because - among other things - the overview was incomplete. Defendant ruled that the objection justified, revoked the primary decision gave a more complete overview. Plaintiff appealed to the decision, and argues that an overview of the processed personal data is not enough. They argue that they need a copy of the specific documents in which their personal data is processed to assess the accuracy of the data in context of these documents. The court held that to comply with an article 15(1) GDPR request, it is sufficient to provide an overview of what data is processed and in which documents, if the data in question is mostly name, address and contact information. A copy of the documents itself does not need to be provided.
The plaintiff's was a user account on the Facebook platform. She created her user account under a pseudonym. Facebook blocked her user account after the plaintiff had not complied with the defendant's request to change her profile name for a clear name. The plaintiff asserted claims against the defendant for the activation of her user account created under the pseudonym, as well as claims for damages and pre-judicial lawyer's fees. The Regional Court in Ingolstadt granted the action only with regard to the activation of the plaintiff's user account plus pro rata pre-judicial lawyer's fees and otherwise dismissed the action. Both parties filed an appeal against this judgement. Was it legitimate for the operator of the social network platform to ask for the user's clear name? On appeal by the defendant, the Higher Regional Court amended the final judgment of the Regional Court of Ingolstadt of 13 September 2019, Case No. 31 O 227/18, to the effect that the action was dismissed in its entirety. The Higher Regional Court dismissed the plaintiff's appeal. The Higher Regional Court in Munich held that the operator of a social network is entitled, in order to prevent unlawful conduct by its users, to require the use of clear names and to block the user account in the event of violations of this obligation.
The defendant's parent company with its registered office in California operates the social network "www.f...com. For users in Europe, the defendant is the provider and contractual partner. The plaintiff maintains a private user account with the defendant. According to the defendant's current terms of use: "When people stand behind their opinions and actions, our community is safer and more accountable. For this reason, you must do the following: - Use the same name you use in your daily life." The plaintiff had originally given himself the profile name using a pseudonym. In March 2018, the defendant asked the plaintiff to verify his name within the next seven days. The plaintiff was told that after this period, he could not log back in until he updated his name. He was asked the question, "Is ... the name you also use in everyday life?" Under "Your answer", the following alternative was given: "Yes, confirm the name" or "No, change the name". On 23.03.2018, the plaintiff was blocked by the defendant. After he changed his profile name to "...", the block was lifted on the same day. The plaintiff requested the defendant to declare that its terms of use in the scope of the obligation to use a clear name did not apply to the plaintiff. Moreover the plaintoff requested to allow the profile name to be changed to his pseudonym. The defendant did not comply with these requests. The plaintiff has taken the case to court. In its final judgment of 2 May 2019, the Regional Court dismissed the action in its entirety. The plaintiff has appealed. Has the defendant's General Terms and Conditions violated section 13(6) of the German Telemedia Act (TMG) or Article 4(7) GDPR and Artcicle 25(1) GDPR? The Higher Regional Court Munich dismissed the appeal and found that the plaintiff cannot derive a claim to the use of a pseudonym in the context of his own profile from the nature of the contract of use concluded with the defendant. The Court held that the defendant's policy on cl
The data subject is a lawyer and the controller is a website named Beratungsflat. The lawyer received an email from Beratungsflat and the email said that Beratungsflat offered legal advice by lawyers by telephone via its website, www.beratungsflat.de. The email also stated that Beratungsflat cooperated with lawyers, and they were remunerated by it for this telephonic advice. At the end of the e-mail, Beratungsflat asked whether the lawyer would be interested in offering legal advice by telephone via Beratungsflat's website and invited them to contact Beratungsflat if they were interested. Beratungsflat had obtained the email address of the lawyer from the contact page of their law-firm's website. The contact page of the law firm's website also contained a marked notice that the processing or use of data for purposes of advertising or market or opinion research by any means of communication is objected to and that no advertising mailings or calls are desired. In normal text, the law firm's website further stated that the use of contact data published in the imprint or comparable information, including e-mail addresses, by third parties for the purpose of sending information not expressly requested is not permitted, and legal action is reserved. On the day the email in question was received, the lawyer sent a cease and desist notice to Beratungsflat and claimed damages of €500. Subsequently, Beratungsflat refused to issue the cease-and-desist declaration and to make the payment. Accordingly, the lawyer approached the Local Court Hamburg-Bergedorf seeking a direction prohibiting Beratungsflat from contacting and/or having contact made with them by email for advertising purposes without their express consent, on pain of an orderly fine of up to €250,000 for each case of culpable infringement, or alternatively up to six months' imprisonment, with the orderly imprisonment to be carried out for the Beratungsflat on the Beratungsflat's managing directors. The lawyer also s
The complainant is the Municipality of the City of Vienna (Wiener Wohnen) and the respondent is a tenant of the complainant. On 31 August 2019, the tenant informed the police that children had broken a window. In addition, he informed the complainant about the damage to the general parts of the property (window in the staircase). On the phone, the complainant stated that they would commission an emergency service and have the damage repaired. Shortly afterwards, an "electrician" called the respondent, saying he had been commissioned to repair the damage. Since the respondent generally had a secret number and had changed it for security reasons he never allowed to pass on his telephone number to third parties (electricians). He had not been asked about this, nor had he been informed of the transfer, so that he could have objected to it. When the respondent complained via telephone, he was told that the complainant usually compared the data and passed it on to technicians so that they could contact the detector. The tenant then submitted a complaint to the Data Protection Authority (DSB) which found that the respondent's right to secrecy had been violated by unlawfully transmitting personal data of him to a commissioned company and disclosing it to the latter. The complainant then appealed against this decision at the Federal Administrative Court claiming that it followed from the obligations arising from sections 1096 and 1097 of the General Civil Code that the landlord may use vicarious agents to remedy the reported defects "and may therefore also provide them with the telephone number of the tenant who has reported a defect". Therefore, the justification of Article 6(1)(b) of the GDPR would be given. Was the transmission of personal data (mobile number) to the commissioned company considered to be necessary for the performance of a contract and did it comply with the conditions laid down in Articles 5 and 6 GDPR? The Federal Administrative Court held that th
The complainant lodged a complaint pursuant to Article 77 of the GDPR on the grounds of infringement of the right to erasure of data pursuant to Article 17 of the GDPR and the right to object to data processing pursuant to Article 21 of the GDPR against one of Austria's leading doctor search platforms. This platform is intended to enable patients and doctors to find each other. For this purpose, it listed doctors on its website - including the complainant- with their title, name, address, speciality, telephone number and surgery hours. Directly below the presentation of this data, the platform allows anonymous third parties to rate the respective doctors according to a school grading system in various categories as well as to write a "field report" in free text. In order to be able to submit such an evaluation, it was necessary to register on the website with a freely selected user name and to provide an e-mail address and date of birth. The entry of further data was not required. The complainant claimed that the allegations in some evaluations were untrue and likely to damage his reputation and standing. The Data Protection Authority rejected the complaint on the grounds of inadmissibility. In its opinion, the recourse to the data protection authority was inadmissible because an ordinary court was already dealing with the same matter. Does the online platform violate the rights of the data subject under the GDPR? In addition, is there an obligation for the platform to delete all data which use does not comply with the provisions of the GDPR, in particular the complainant's entire doctor profile including all evaluations, and is the platform obliged to refrain from any further processing of the data? In its decision, the Administrative Court agrees with the reasoning of the Supreme Court, according to which the parallelism of legal protection options is permissible under the GDPR, which is directly applicable in Austria, and the circumstance of parallel recour
The data subject had a bank account at a Dutch bank, ING Bank N.V. (the controller). The account had a credit limit of €250. The data subject used internet banking to check their account and make transactions. The data subject also downloaded the controller’s mobile app. The website and the mobile app of the controller have an electronic message box that the controller uses to communicate with account holders. The controller sent multiple messages to the electronic message box of the data subject stating that the account exceeded the €250 credit limit. The controller also stated that if the balance is not replenished to a positive amount within the given deadline, the controller was obligated to report the outstanding amount to the Central Credit Registration Office (“Bureau Krediet Registratie – BKR”) in their Central Credit Information System (“Centraal Krediet Informatiesysteem – CKI”) under Article 13 of the Dutch General Regulations CKI (“Algemeen Reglement CKI – AR”). Two months later, on 10 January 2019, the controller reported the outstanding payment to the BKR. The data subject's BKR statement showed a so-called 2-code in the CKI. This special code entailed that the controller demanded payment of balance. On 18 February 2019, the data subject settled the credit limit. The data subject initiated proceedings by application at the District Court Midden-Nederland (“Rechtbank Midden-Nederland”). The data subject requested the court to rule that the controller did not notify the data subject about the the registration at the BKR, as stipulated in the GDPR. He was therefore unable to prevent the registration of his balance deficit in the CKI. The data subject argued it had never seen the messages in the electronic message box as he had not logged in for a while, and he also did not receive push notifications on the app that there were new messages. The data subject argued that the controller should have notified him by different means. The data subject there
In December 2016 the director of the school of the complainant's son filed a report with the child protective service. In December 2017 the report was investigated and closed after the consultation with the parents of the minor. In March 2020 the complainant filed a request with Samen Veilig, asking to provide her with copies of all complete log overviews, including all names of persons who have had access to the file of her son. Samen Veilig responded that it would provide the job titles of the employees, but not their names. Must Samen Veilig provide the names of the employees who have had access to the file of the complainant's son? The Court ruled that Samen Veilig did not strike the right balance in their assessment of interests. Samen Veilig has a valid interest of restricting access to the employee information to protect their privacy, when it's necessary for the exercise of their tasks or to investigate or end a (suspected) child abuse. However, these exceptions apply only in individual cases. In this specific case, it has not been asserted that there is any reason to believe that the complainant might misuse the information that will be provided to her. The mere mentioning of job title does not suffice and limits the complainant in the possibility to check whether the access to the file was lawful. Samen Veilig must provide complainant with the requested log files, including names of employees and access time stamps.
The applicant asked Google to remove search results for his name, under the "right to be forgotten". Google decided not to take action on certain URLs. Two months later, the applicant submitted a new (repeated) request, which was rejected by Google for the same reasons. The applicant then lodged a complaint in front of the Dutch civil courts. In Netherlands, the instigation of legal proceedings against a data controller on the basis of the GDPR has been further regulated by the "GDPR Implementation Act". According to Article 35(2) of this local law, data subjects who wish to challenge a data controller' decision on a request made on the basis of Articles 15 to 22 of the GDPR, shall lodge their petition in front of the civil courts within six weeks of receipt of the decision. According to the Dutch case law, exceeding this six-week period leads, in principle, to inadmissibility. Consequently, Google was of the opinion that the applicant's petition was inadmissible as it was submitted later than six weeks after Google's first reply, and therefore not within the period prescribed by Article 35(2) of the GDPR Implementation Act. On the contrary, the applicant was of the opinion that his second (repeated) request started a new time-limit. According to the applicant, neither the GDPR nor its Implementation Act limits the number of applications which may be submitted. In that regard, the applicant refers to the text of Article 21(1) of the GDPR, which states that requets for removal can be made "at any time". Should the applicant's complaint be declared inadmissible for not respecting the time limits as set out to in Article 12(5) of the GDPR and Article 35(2) of the Dutch GDPR Implementation Act? According to the court, the exercise of the rights granted to the data subjects by the GDPR is not unlimited. In order to protect the legitimate interests of the data controller (not to have to decide continuously on repeated requests and be subjected to lengthy litigation,
The facts and cirumstances that lead to the fine can be read in the summary of BVwG - W258 2217446-1, another decision of the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG) dealing with different legal issues of the same case. Based on the unlawful processing of data on the "affinity for a political party", the DSB imposed a 18 Mio Euro fine on the Austrian Postal Service. In detail, the DSB held the Austrian Postal Service responsible for violating *Article 5(1) GDPR *Article 6 (1) GDPR *Article 6(4) GDPR *Article 9 GDPR *Article 14 GDPR *Article 30 GDPR *Article 35 GDPR and *Article 36 GDPR. The fine was issued directly against the Austrian Postal Service as controller under Article 4(7) GDPR without establishing culpable conduct of natural persons acting on behalf of the Austrian Postal Service. Based on this omission, the Austrian Postal service appealed against the fine. Can the DSB impose a fine under Article 83 GDPR directly on a legal person, without having to investigate and establish culpable conduct of natural persons acting on behalf of the legal person? Are the national rules of administrative penal law of any relevance to this question or is it to be answered solely under the rules of the GDPR? The BVwG held that the provisions of the Austrian Administrative Penal Act (Verwaltungsstrafgesetz - VStG) and the Austrian Data Protection Act (Datenschutzgesetz - DSG) apply on fines imposed by the DSB under Article 83 GDPR: Pursuant to Article 83(8) GDPR, the exercise by the supervisory authority of its powers under Article 83 GDPR shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process. In light of this provision, the BVwG held, that national procedural rules are in fact to be applied when imposing a fine for a GDPR violation. According to the BVwG, the DSB had violated § 44a and § 45 VStG and § 30 DSG by not establishing culpable con
= The Austrian Postal Service (Österreichische Post AG) had been selling data on natural person's party "affinity for a political party" to their customers. In light of broad media coverage on this topic the Austrian Data Protection Authority (Datenschutzbehörde - DSB) started an ex-officio investigation against the Austrian Postal Service. The DSB investigated i.a the records of processing activities and the data protection impact assessment of the Austrian Postal Service. Further, it investigated records that must be maintained under § 151 Trade Regulations Act (Gewerbeordnung 1994 - GewO). = With its decision dated 22.01.2019, the DSB #held that the Austrian Postal Service had processed personal data on the "affinity for a political party" without a legal basis, as these data qualify as special categories of personal data under Article 9(1) GDPR. Their processing would require the data subjects' explicit consent under Article 9(2)(a) GDPR and § 151(4) GewO, #ordered the Austrian Postal Service to stop the processing of these data effective immediately and to erase such data within a period of two weeks (unless a derogation under Article 17(3) GDPR was applicable), #held that the Austrian Postal Service had failed to carry out a data protection impact assessment prior to 25.05.2018, #held that this data protection impact assessment was incorrect because it did not take into account that data on the "affinity for a political party" qualify as special categories of personal data, #held that the records of processing activities maintained by the Austrian Postal Service was incorrect, because it did not take into account that data on the"affinity for a political party" qualify as special categories of personal data #ordered the Austrian Postal Service to carry out a new, correct data protection impact assessment regarding the processing on data on the "affinity for a political party". = On 11.03.2019 the Austrian Postal Service filed an appeal against the DSB's d
[https://gdprhub.eu/index.php?title=Article_9_GDPR Article 9(3) GDPR] provides that health data may be processed for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services, when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies. Under the terms of [https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000037090304/ Article L. 6113-7 of the French Public Health Code], health establishments, whether public or private, shall analyse their activity. In compliance with medical confidentiality and patients' rights, they implement information systems that take into account pathologies and treatment methods in order to improve knowledge and evaluation of their activity and costs and to promote the optimisation of the range of care offered. Practitioners practising in public and private healthcare institutions transmit the personal medical data required to analyse the activity and bill for it to the doctor responsible for medical information for the institution under conditions determined by regulation after consultation with the National Council of Physicians (Conseil national de l'ordre des Médecins). The practitioner responsible for medical information is a doctor appointed by the director of a public health establishment or the deliberative body of a private health establishment if there is one, following the opinion of the medical commission or medical conference. The conditions of this designation and the methods of organisation of the medical information function, in particular the conditions under which staff placed under the authority of the practitioner in charge or the statutory auditors acti