GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The Verein für Konsumenten Information (VKI) is an Austrian consumer rights organisation and entiteld to bring collective redress lawsuits and class actions in the interest of consumers pursuant to §§ 28 and 29 of the Austrian Consumer Protection Act (Konsumentenschutzgesetz - KSchG). The VKI brought a lawsuit against two car rental companies due to their allegedly unlawful general terms and conditions, which contained clauses that are (accordning to the VKI) violating Article 25(2) GDPR. The decisions of the first and second court were appealed, the case is currently (January 2021) still pending at the Austrian Supreme Court (Oberster Gerichtshof - OGH), which referred to following question to the CJEU under Article 267 TFEU: Does the GDPR preclude national regulations which, among other things, grant associations the power to take action for violations of the GDPR by way of an action before the civil courts, irrespective of the violation of specific rights of individual data subjects, inter alia from the point of view of the prohibition of the use of ineffective general terms and conditions? The OGH will take its decision in the merits of the case once the CJEU has decided on the requested preliminary ruling. This page will be adapted accordingly then and linked to the CJEU decision which will also be published on GDPRhub.eu.
VoetbalTV, an initiative of the Royal Dutch Football Association (KNVB) and broadcasting company Talpa Network, is recording and broadcasting amateur football. The Dutch DPA fined VoetbalTV for processing personal data without a valid lawful basis. The Dutch DPA published guidance in which it states that a legitimate interest is only legitimate if it stems from a legal provision. Also, a purely commercial interest can never be a legitimate interest, according to the Dutch DPA. VoetbalTV appealed the decision. Does a legitimate interest (Article 6(1)(f) GDPR) need to stem from a legal provision and can a purely commercial interest result in a legitimate interest? The court does not agree with the restrictive interpretation of legitimate interest by the Dutch DPA. Any interest can be a legitimate interest as long as it is not against the law (negative test). The Dutch DPA should have performed a balancing test in order to balance the interests pursued by VoetbalTV against the interests or fundamental rights and freedoms of the data subjects. Because the DPA did not perform such a balancing test, the court annulled the decision and the imposed fine. The court annulled the decision and decided to judge the case itself (Article 8:72a Dutch General Administrative Law Act). Then the court decided to not take a new decision in order to replace the annulled decision, noting that the fine is now completely off the table.
The data subject is a member of the police unit called task force for combating street crime (Einsatzgruppe für die Bekämpfung der Straßenkriminalität - EGS) and operates as an undercover agent. After being summoned to a hearing by an parliamentary committee of inquiry, his full name was disclosed in the minutes of this hearing which were published online. The data subject requested the removal of his full name from the minutes since revealing his identity this would jeapordize his work as an undercover agent. After the parliamentary committee rejected his request, he filed a complaint with the Austrian DPA (Datenschutzbehörde -DSB). The DSB rejected the complaint because it did not consider itself competent. The European legal system forsees a separation of state powers. As a parliamentary committee of inquiry is part of the legislative state power, the DSB - as part of the administrative state power - could not exert control over it. Furthermore, § 35 Austrian Data Protection Act (Datenschutzgesetz - DSG) only allows for the DSB to exert its investigative and corrective powers over certain supreme administrative organs (such as the Federal Ministers), but not over a parliamentary committee. The data subject filed an appeal against this decision with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG), which now issued its judgment. Is the DSB competent to exert its investigative and corrective powers over a parliamentary committee of inquiry and handle a data subject's complaint regarding the violation of his GDPR rights by the parliamentary committee? The BVwG initially held that the exemption under Article 2(2)(a) GDPR (processing of personal data in the course of an activity which falls outside the scope of Union law) does not apply on the case at hand. According to the BVwG, the substantive provisions of the GDPR and the DSG are also applicable to acts which, like those of a parliamentary committee of inquiry, are attributable to th
In September 2020, a mother requested copies of the youth files of three of her children from a private foundation that provides assistance under the Dutch Youth Act (Jeuwgdwet). About six weeks later, in October, she sent the foundation a letter stating that it had failed to respond to her request within the statutory time limit and demanding financial compensation. In early November 2020, the mother filed an administrative appeal regarding the foundation's failure to respond to her request. In the request, she referred to the Dutch General Administrative Law Act (Algemene wet bestuursrecht, AwB), the European Convention on Human Rights (ECHR), the Dutch Youth Act (Juegdwet), the GDPR and the former Dutch Data Protection Act (Wbp), which was in force before the GDPR. The court first considered the provisions on which the claim was based. The court found that the application was an access request based on Article 15 GDPR in conjunction with [https://wetten.overheid.nl/BWBR0034925/2020-07-01/#Hoofdstuk7_Paragraaf7.3_Artikel7.3.10 7.3.10 of the Youth Act]. Secondly, the court considered whether it had jurisdiction to determine the matter. The court looked at the provisions of the General Administrative Law Act (AwB). [https://wetten.overheid.nl/jci1.3:c:BWBR0005537&hoofdstuk=1&titeldeel=1.1&artikel=1:3&z=2021-07-10&g=2021-07-10 Article 1:3(1) of the AwB] defines what an administrative decision is under Dutch administrative law: a written decision on an administrative body acting on the basis of a public law. Furthermore, [https://wetten.overheid.nl/jci1.3:c:BWBR0005537&hoofdstuk=6&afdeling=6.1&artikel=6:2&z=2021-07-10&g=2021-07-10 Article 6:2(b) of the AwB] stipulates that if an administrative body fails to respond to an individual's request in a timely manner, the request is deemed to be rejected so that the applicant can file an administrative appeal. The court noted that [https://wetten.overheid.nl/jci1.3:c:BWBR0034925&hoofdstuk=7¶graaf=7.3&artikel=7.3
The complainant is an officer of the court guard. The co-participant was in prison and had contact with the complainant there. After his release from prison, the co-participant made public statements in the media and mentioned, inter alia, the complainant's details. In particular, in a Facebook post he mentioned the name and function of the complainant in connection with his trade union affiliation, which revealed the political views of the complainant. It is not known how the co-participant had information about the complainant's trade union affiliation. The complainant lodged a complaint with the supervisory authority. The co-participant requested that it be dismissed, pointing out that his statements related to journalistic activities, which fall under the exceptions for the protection of personal data. The DPA concluded that it was not possible to establish a link between the Facebook post and the co-participant's journalistic activity, but the authority did not grant protection to the complainant's rights. It pointed out that the interests of the co-participant stood above the interests of the complainant, since the Facebook post concerned prison misconduct and the co-participant had acted within the framework of freedom of expression. In addition, the complainant's personal data had been published on a publicly accessible website, so the co-participant had not gained access to them unlawfully. The applicant appealed to the court. The Court upheld the appeal and held that the content published by the co-participant on Facebook infringed the complainant's right to protection of personal data. The court ordered that the content be removed from Facebook.
The complainant was a doctor listed on the defendant's evaluation website. In February 2020, the defendant informed the claimant that he had discovered that positive assessments, so-called false assessments, had been published on his profile and asked him to clarify this situation. The sanction for the lack of explanation was supposed to be information for users of the portal in the form of a warning on the doctor's profile that reviews had been purchased. In the correspondence exchanged, the doctor denied that there were false assessments on his profile, but the defendant found it not sufficient. The defendant then posted a warning notice on the applicant's profile. The plaintiff sought a temporary injunction to prohibit the marking of his profile with a warning sign and the display of the text of the warning. The Regional Court dismissed the application. The applicant challenged that decision and filed an immediate appelation. The Regional Court did not remedy the complaint and referred the matter to the Higher Regional Court for a decision. Does the public interest invoked by the defendant in connection with the publication of the warning outweigh the interests of the applicant? Has the defendant infringed the provisions of the GermanCivil Code in conjunction with the Article 6(1)(f) GDPR, and could not invoke the press exception for the publication of the warning? The Higher Regional Court declared the appeal to be unsuccessful. It held that the plaintiff has no right against the defendant to stop the labelling of his profile with a warning sign and the display of the warning sign.
This decision is an appeal of decision 24/2020, where a customer (the data subject) of an insureance company (the controller) claimed that its health data was used for a purpose to which he did not explicitly agree by the controller. The DPA upheld the complaint and stated that there was a lack of transparancy in the controller's privacy policy as it did not demontrate any legitimate interest. Therefore the controller violated Article 5(1)(a) and (2), Article 6(1), Article 12(1), Article 13(1)(b) and (c) GDPR. The DPA imposed a fine of €50.000. The controller appealed the decision of the DPA at the Court of Appeal of Brussels and raised the following pleas: # The decision was void because of a lack of reasoning regarding the legal basis for #* the processing of personal data with regard to the purposes set out in Article 4.3 of its Privacy Statement, and #* the transfers to third parties set out in Article 6 of its Privacy Statement. # It should have been able to rely on its legitimate interests for the processing of personal data for certain purposes and for transfers to third parties. # When it could not rely on its legitimate interests, it should have been able to rely on legal grounds other than the consent. # The decision violates its freedom of enterprise. # The fine was disproportionate. In response the DPA requested the Court to declare the appeal unfounded, as: # the contested decision was properly reasoned in law and in fact. It was based the information available, in view of the active duty of responsibility of the controller. The balancing of interests provided by te controller did not change this. (regarding the controllers's 1st to 4th plea) # the decision did not unlawfully restrict the controller's ability to stop the violations found. The fact that the GBA, based on the information at its disposal, presumed that it was possible to use consent as a legal basis does not affect the lawfulness of the decision. (regarding the controller's 2th and 3th p
To prove his claims in a litigation against Hotel Gaming, the plaintiff wishes to have witnesses heard. Those witnesses were former employees of the defendant. The plaintiff however does not have the necessary address details and dates of birth for the witness calls, and Hotel Gaming refuses to provide these details to the plaintiff. In an incidental claim, the plaintiff therefore requests the District Court to order Hotel Gaming to inspect and copy the salary specifications of its former workers or to otherwise provide their address details and dates of birth. Hotel Gaming disputes the plaintiff's claim that he has a "legitimate interest" under article 6(1)f of the GDPR and that this legitimate interest outweighs the data subjects' (former employees called as witnesses) interest in privacy protection. Hotel Gaming argues in this respect that the security of its former workers is at stake, because the plaintiff might try to intimidate them after obtaining their personal data. Is the processing of the requested personal data lawful on the basis of Article 6(1)f of the GDPR or should the data subjects' interests or fundamental rights take precedence? In other words, must the importance of finding the truth give way to the importance of confidentiality? Pursuant to the Dutch Code of Civil Procedure, the plaintiff has a right of inspection and a copy of documents vis-à-vis the person who has them at his disposal, except if there are compelling reasons not to do so. The District Court is of the opinion that, although providing the requested data constitutes an invasion of the privacy of the defendant's former workers, this invasion is not sufficiently serious to be regarded as a compelling reason within the meaning of the Dutch Code of Civil Procedure or to be judged contrary to Article 6(1)f of the GDPR. The District Court considers that a "legitimate interest" should be considered present if the requested data are relevant to the plaintiff's determination of his
The appellant, in connection with a dispute with her son's former school, has requested the Dutch Minister of Education, Culture and Science to inspect her and her son's file. The Minister has partially granted the request for access, but wrongly did not grant access to the personal policy views of civil servants. Following a decision of the Council of State, the Minister amended its order and granted the appellant access to more documents, including to the personal policy views of civil servants, subject to the removal of the personal data of third parties. The appellant appealed, arguing that the Minister has not provided all the documents covered by her request and has therefore failed to comply adequately with the Council of State’s first ruling. Also, according to the appellant, the Minister has glossed over more than just personal data in the documents submitted. Has the Minister provided all personal data covered by the access request of the data subject? The appeal is unfounded. The Council of State ruled that the appellant did not make it plausible that the Minister did not provide all the documents covered by her request. Also, in view of Article 15(1) of the GDPR, the appellant has no right to personal data of third parties. This includes information by which a third party can be directly or indirectly identified. The Minister has therefore rightly omitted/deleted the litigated passages.
The CJEU ruled that consent is not valid if a contract contains a clause stating that the data subject has been informed of, and has consented to, the collection and storage of a copy of his or her ID for identification purposes, when the contract could be misleading as to the possibility of concluding the contract if the customer refuses to consent to the storage of the ID. Consent is also not valid if data subjects must complete an additional form setting out that refusal.
The fined company belongs to a group of companies which together form one of the five largest telecommunications service providers in Germany. Since the entry into force of the GDPR on 25.05.2018 and until 08.05.2019, the party concerned operated call centres for the group of companies. The call centre agents worked with a user interface based on the customer database of the company K. This provided the call centre agent with the information (personal data) necessary for processing customer enquiries. Callers usually reached a first-level support service agent first in the call centre. This agent first had to identify the caller. If the call was made under a telephone number assigned by the company, the respective record of the telephone number was directly displayed to the service agent. If, on the other hand, the call was from a foreign or suppressed telephone number, the customer was identified by the service agent on the basis of his name and date of birth or - alternatively - by stating the customer/contract or order number. The respective service agent was required to authenticate the caller as an authorised person. For this purpose, the date of birth was requested - insofar as this was not already necessary for calling up the correct data record in the context of identification. After authentication, the call centre agents were authorised to provide the caller with information and to accept change requests. For certain topics, the call centre agents of the first-level support forwarded the callers to other employees on the basis of an authorisation concept. For example, only the billing office could enter new bank details. A repeated or stricter authentication was not carried out towards these other employees after the authentication by the first-level support. In case the call centre agent could recognise that someone other than the customer was calling the call centre, the person concerned had not made any comprehensive arrangements. There were only special
With effect from 2 November 2020, the State Ministry of Social Affairs and Social Cohesion has ordered the defendant to adopt the Saxon Corona Protection Regulation. According to this regulation, it is prohibited to open and operate, with the exception of permitted online offers of, among others, establishments providing body-care services, with the exception of medically necessary treatment and hairdressers. The applicant runs a nail studio and cosmetics company, trades in cosmetic products and holds seminars. The applicant considered that the defendant's legislation was discriminatory, violated the Constitution and personal data protection regulations. Therefore, she lodged a complaint with the Court. Did the defendant have the power to pass the legislation in question, which interferes with the economic life and privacy of citizens? Has the regulation violated the rules of the GDPR, especially the principle of proportionality? The complaint was rejected.
An online newspaper article from 2012 mentioned the complainant's resignation as the head of an educational institution. The article states that the complainant resigned after three months, after the employees sent a letter to the board demanding the resignation of the manager. According to the article, the employees felt that the data subject did not have the right background for the position. The then chairman of the board and acting director confirms in the article that they received such a letter, but does not comment on its content or the relationship in general. It appears from the article that the online newspaper has tried to contact A several times, but that they have not succeeded in getting a comment from her. When the educational institution went bankrupt in the spring of 2014, a different party bought the bankruptcy estate and continued the operation of the educational institution in a new company. In 2017, the data subject asked Google to delete the search term for her name which led to the newspaper article in question. One year later, Google informed the complainant that it refuses to delete the search result. Despite appeals from the complainant, Google continued to refuse moving forward with the erasure request. The complainant also contacted the editor of the online newspaper online newspaper and the media company Amedia, which owns the newspaper, and requested that the article be deleted. The editor rejected the delete request, referring to the fact that the newspaper does not in principle delete articles from its website. Amedia stated that they do not interfere with the newspaper's editorial content. Consequently. the data subject complained to the Datatilsynet and requested assistance in having the search result deleted by searching for her name in Google. The DPA made a balance of interests between the consideration of freedom of information and the public's interest in having access to the search match by name search and the complainant's r
The claimant is a citizen who made an Article 17 GDPR request to the Municipal Executive of the municipality of Utrechtse Heuvelrug to delete his personal data processed on a forum used by different municipalities to cooperate and in emails to other administrative bodies. He also requested €3,000 in damages under Article 82 GDPR. The Executive rejected the request for deletion because the claimant's personal data had already been removed from the forum and because no personal data of his had been processed by e-mail. He also rejected the claim for damages on the grounds that the application was insufficiently substantiated. The claimant disagreed, arguing his data was still on a back-up of the forum. The defendant responded by stating the forum was responsible for data operations on the platform, and that the citizen should make his erasure request. First, the District Court of Midden-Nederland assessed whether the Municipal Executive should considered a controller in this case. It considered a previous case by the Administrative Jurisdiction Division of the Council of State (ECLI:NL:RVS:2019:181) and held that because municipal officials placed messages about the claimant containing his personal data on the forum, their actions must be attributed to the municipal executive for which they work and he must be regarded as a controller. However, it found he complied with his obligations after receiving the erasure request. Indeed, he contacted the forum which deleted the claimant's personal data from its platform. Second, it evaluated whether the claim for damages should be upheld. It started by citing a previous court decision which confirmed the mention of the claimant's name on the forum was lawful in accordance with Article 6(1)(e) GDPR. It found that such processing was necessary and proportionate to the invasion of the plaintiff's privacy to prevent fraudulent claims for penalty payments from different municipalities. Thus, the court rejected the claim for
The appellant asked Hoist, the defendant, to remove data concerning him from the Stichting Bureau Kredietregistratie (BKR register). The appellant had taken a loan out in 1998 for his house, which was increased various times. The appellant got divorced in 2009, he was the one that paid the interest charge on the loan and mortgage charge for the house. The appellant then sold the house with a residual debt which was eventually waived in 2016. The appellant was then admitted on a municipal debt relief program for 10 months. There was a backlog in the appellant's payment of credit (loan) recorded in the Central Credit Information System (CKI) of the Stichting Bureau Kredietregistratie (BKR). The appellant was admitted to the debt scheduling scheme for natural persons (WSNP) where Hoist was one of the listed creditors (debt of € 38244.74). The debt rescheduling scheme ended with a clean slate in February 2018. Hoist reported in the CKI that the credit ended in January 2018. CKI stated that the registration with regard to the credit will be removed in January 2023. The appellant asked for Hoist to remove data concerning him from the Stichting Bureau Kredietregistratie (BKR) by July 2018, which Hoist refused to do. Hoist refused again after another request from the appellant in March 2019. The appellant went to court to request that Hoist be ordered to remove the BKR registration in his name so that he would be able to buy his current rental home and replace his old car. Hoist refused. The appellant lodged an appeal against a decision of 13 December 2019 from the District Court of The Hague (Rb. Den Haag). The District Court's judgement rejected the appellant's request to order Hoist to remove the appellant's name from the BKR. This was on the basis that there was a legitimate interest for processing the appellant's personal data in the BKR. The processing was necessary for BKR and its business customers, such as Hoist, and was therefore lawful under Article 6(1)(
The complainant, as a private individual, took part in a citizens' movement in his city which, among other things, demands an immediate end to all coronavirus-related activities. The complainant was a speaker at the meetings of the citizens' movement. In addition, he made numerous contributions to the citizens' movement's chat group. The chat group itself was critical of the topics of masks, vaccination, 5G radiation, and the detection and threat of the Sars-CoV2 virus. The applicant also took part in a demonstration on 1 August 2020 in Berlin under the slogan 'End of the pandemic - Freedom Day'. In this context, he appeared on the same day as a guest on a talk show broadcast on YouTube, mentioning his employer (the university). As an answer to the above activities of the complainant, the General Students' Committee (AStA) published on its webpage an article criticising the behaivour and opinion of the complainant (an employee of the university) to the coronavirus pandemic. The article points out, among other things, that there is no place at the university for a person who is hostile to science and publicly speaks out against all scientific knowledge about the existing pandemic and denies its threat, and thus, at least indirectly and by association, supports certain nationalistic and rightwing views and political parties, including the denial of the Holocaust. The complainant demanded that the publication of the above statements be removed and not published again. He said he had never claimed to support nationalistic and rightwing views and political parties, including the denial of the Holocaust. The General Students' Committee (AStA) did not act in accordance with the above request, so the applicant filed a complaint with the administrative court. Before considering the complaint, the defendant slightly changed the content of the information provided in the article. The Administrative Court Osnabrück dismissed the complaint and found that there was no unlawful i
The plaintiff was the owner of a flat in a residential complex, where the first defendant was the property manager in charge until 31 December 2019. The second defendant was the external DPO appointed by the property manager. There was a legionella infestation in the residential complex, which also affected the plaintiff's flat. In June 2019, all 97 flat owners were invited to an owner's meeting to discuss, amongst other things, the legionella infestation. The invitation included details on which flats were affected by the infestation, with the plaintiff's name and flat. The plaintiff asked the property manager to redact or remove this information. Although this was not done before the meeting, the meeting notes themselves did not mention either. Consequently, the plaintiff sued the defendants and claimed that he had suffered non-material and material damages, like damage to his reputation. In addition, a potential buyer of his flat had cancelled the purchase due to the information about the legionella infestation he had received from the informed owners. The plaintiff further submitted that the second defendant (the DPO) had admitted the infringement in his email and was therefore also liable on the basis of this admission of guilt. The plaintiff also claimed the the parties had violated the GDPR when passing on his e-mail address to their legal representative without his consent. Furthermore, the plaintiff's email address was visible in the transparent field of a letter sent by the defendant's representative to the plaintiff. The first defendant claimed that the listing of the plaintiff's flat and his name as owner was permissible under data protection law. The disclosure of the email address was also permissible under GDPR. The second defendant argued that as a DPO he was not a controller within the meaning of Article 4(7) GDPR. The Regional Court dismissed the action. The Court decided that the plaintiff was not entitled to claim damages, beacuse there was
The national government has decided to suspend regular education activities at universities, including exams, as a measure to contain the covid-19 pandemic. Defendant has decided to use an online proctoring application, Proctorio, that monitors students while they take their exam from their home. The software records the user's webcam, microphone, internet traffic and inputs. The court had to give a preliminary decision on whether the processing is legal. Defendant has a public task of organizing education and administering exams, provided by law. Because of restrictions by the national government, the use of online proctoring is the only suitable option of administering exams. The processing is therefore necessary for the exercise of an official authority vested in the controller. Recording the webcam of students in a personal environment and requiring them to 'scan' their room does not constitute personal data of a special category as laid down in article 9, because the controller does not track the user's eyes, respiration, stress or biometrics. The processing also does not violate the principles laid down in [Article 5 GDPR|article 5]].
Claimants 1 and 2 are entrepreneurs who are or have been active in the real estate market. They are married. Claimant 1 still operates at least one company that does development and sales of new buildings. Claimant 2 used to run a house rental agency, but not anymore. When the names of claimant 1 and claimant 2 are entered in Google search, the search results show links to sites and TV shows featuring both claimants and their way of running business in the negative light. In July 2019, during the preliminary relief proceedings the producer of one of the shows was ordered by the Court to add a rectification notice because some statements in the show did not have enough factual support. The Court, however, did not agree with the claimants that the removal of the show was justified. Similarly, the Netherlands Press Council also partially agreed with the claimants, finding that the reporting published on one of the sites did contain unsubstantiated accusations, hurtful language and insufficient consideration of the claimants’ side of the story. However, the Council found that careless journalistic conduct did not take place. Claimants submitted several “right to be forgotten” requests to Google to have specific links removed from the search results. Google rejected those requests. Claimants brought two cases before the Court. According to claimant 1, 18 URLs must be forgotten in case 19-64 and 24 URLs in case 20-22. Claimant 2 is asking to de-list 21 URLs in case 20-22. The Court considers both cases jointly. Claimants are of the opinion that a data subject in principle has a right to have his or her personal data deleted from search engine. It is then up to the search engine provider to prove that there are valid reasons for not deleting the information. According to the claimants, the balance of interests is in their favor in this case as the links they would like to have de-listed contain a lot of inaccuracies. Moreover, the information published on those pa
On May 13th, 2019 the French government adopted a decree 2019-452 allowing the creation of a common biometric authentication system for several government and public service websites applicationshttps://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038475477/. This system is part of the FranceConnect project which allows to login public service websites using your login and password of another public service websitehttps://franceconnect.gouv.fr/. The french organization La Quadrature du Net (LQDN) which promotes digital rights and defends freedom of citizens challenged the legality of the decree. The organization argued that the decree is not based on a lawful consent as described in article 4(11) and article 7(4) GDPR and required in article article 9(2)(a) when dealing with sensitive data. LQDN also argued that the data collection was disproportionate to the purpose of the processing. On this topic, LQDN asked the Conseil d'Etat to refer two preliminary questions to the CJEU: *Should the assessment of the validity of the consent be made at the level of each service subject to personal data processing, independently of the existence of another "equivalent" service or at the level of all "equivalent services"? *Are the biometric data collected and processed by a mobile application using facial recognition technology for authentication purposes from certain public services and their partners adequate, relevant and not excessive in relation to the purposes for which they are collected and processed? Lastly, LQDN claimed that the decree was adopted in violation of the procedure required in the then [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037090141/2019-05-12 section 27] of the law n° 78-17 Informatique & Libertés (since replaced by [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037822860 article 31(II)]) and [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000006527486/2019-07-01 section 22] of the French 1958 Constitution. Does the