GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
On 15 December 2017 appellant filed a disciplinary complaint against a lawyer who previously assisted him in a criminal case. In a letter from 17 September 2018, the president of the local bar shared his position statement on the complaint. On 6 May 2019 appellant submitted a request for rectification under Article 16 of GDPR, because, according to appellant, a specific sentence was missing in the statement. In the decision of 24 May 2019, the president of the bar of Eastern Brabant rejected the appellant’s request to rectification. The president of the bar of Eastern Brabant is of the opinion that his position statement does not constitute personal data of the appellant, which means the right to rectification is not applicable. Appellant believes that the right to rectification must be respected and that the president of the bar interprets the term “rectification” too narrowly, excluding the completion of incomplete data. The Council of State ruled that the rectification request to have the incomplete personal data completed cannot be extended to supplementing documents. The president of the bar was correct: Article 16 GDPR does not allow appellant to add a sentence in the president’s statement.
The case focused on security issues and data retention violations, with no mention of cookies or consent banners.
The Dutch state is legally obliged to assess whether there is a reason to fear that the firearms license applicant will misuse the weapons. The State has developed and rolled out a special digital questionnaire (e-screener) to measure each applicant up against 10 risk factors that paint a picture of the applicant’s psychological state. The Royal Dutch Hunters Society (De Koninklijke Nederlandse Jagers Vereniging) and the Royal Dutch Shooting Sports Association (Koninklijke Nederlandse Schietsport Associatie) challenged the e-screener, claiming that, among other flaws, it infringes the GDPR. The Court was asked to assess whether there was a valid legal basis for the use of the e-screener and re-affirm the plaintiffs’ rights of access, erasure and not to be subject to automated decision making. The judge found that the processing had a valid legal basis under Article 6(1)(c) GDPR (the processing is necessary for the compliance with legal obligation to which the controller is subject). The judge recalled that each data subject is entitled to receive statisfactory responses providing whether the controller is processing his/her personal data and whether they can be accessed, under Article 15 GDPR. However, in the case at hand, the judge ruled that there were no evidence that the data subjects, i.e the hunting and firearms licence applicants, did not receive satisfoactory answers. Thus, Article 15 GDPR was not violated. Furthermore, the judge ruled that the e-screener did not infringed Article 22 GDPR. Indeed, the judge clarified that the meaningful information about the recommendation algorithm behind the e-screener should not be shared with the applicants because they must remain confidential and such disclosure might render the test undermined (for example, it would be possible for the applicants to trick the algorithm into giving favorable scores). In this regard, the Dutch State provided sufficient evidence to demonstrate that the decisions were not taken sole
Contested decision: The complainant's personal data would be processed in the context of a fan page on Facebook bearing her name and first name. The management rights of this fan page are assigned to at least one of the joint controllers (X1 and X2). The Litigation Chamber deems it sufficient to first of all contact the joint controllers in order to warn them to stop any violations against the GDPR and to act on the complainant's request to data portability. Written procedure: In view of the health risks posed by the COVID-19 pandemic and the urge for digitalisation, the Market Court was pioneering the use of the written procedure. However, the DPA made a decision after receiving a complaint through the standard form on its website and without giving the defendant the opportunity to make its point of view known (in writing). DPA's position: The DPA contests the admissibility of the appeal on the grounds that the contested decision is not subject to annulment since the decision was taken in the course of the proceedings preceding the decision on the merits. These decisions are temporary prima facie decisions, without any substantive assessment of the merits. According to the DPA's view there is no legally binding decision at stake and decisions taken at preceding the decision on the merits should be excluded from the right to an effective remedy (read: appeal), according to recital 143 of the preamble of the GDPR. * The court states that a warning (with publication) constitutes a sanction and that it follows from the mere fact of it being a corrective measure that it may be liable to have an adverse effect on the person to whom it is addressed * The court held that, although the litigation chamber may be an administrative body, it has far-reaching power, making it a semi-judicial body. As a consequence, the general principles of sound administration apply on the process * The Court of Appeal cannot use its full jurisdiction when it receives an appeal against
In a domestic violence and child abuse case, the Minister for Legal Protection granted the father’s request to obtain a copy of the correspondence between the mother and the Council for the Protection of Childhood. Since there were several data subjects, the Minister asked the mother, in accordance with Article 4 GDPR, whether she objected to the inspection and surrender of the data and weighed up the interests involved. The mother objected, but the Minister for Legal Protection decided however that the father had the right to inspect or obtain a copy of the files, as the information contained in the files were already largely known to the father. The District Court of The Hague dismissed the mother’s appeal against that decision, considering that the father, having authority over the children, was entitled under Article 15(1) GDPR to inspect the files. In the opinion of the Court, it did not appear that the provision of the documents to the father would adversely affect the rights and freedoms of the mother. The mother’s appeal to the Council of State was declared well-founded. According to the Administrative Jurisdiction Division of the Council of State, • Article 15(1) GDPR only gives a data subject the right to obtain information about the personal data concerning him/her, and therefore does not provide a basis for providing personal data to third parties • Article 15(4) and recital 63 GDPR indicate that the right to obtain a copy must be without prejudice to the rights and freedoms of others. The files covered by the request include documents in which only personal data of the mother are included as well as documents containing both personal data of the mother and the father. As far as his own personal data are concerned, the father can be regarded as a data subject as referred to in Article 15(1) GDPR. But with regard to the mother’s personal data, the mother is the “data subject”. The personal data of the mother cannot therefore be provided to the fathe
The Foundation is an organisation that does health care work on an unnamed continent. Claimant is a professional midwife in an undisclosed country; she followed a three-year training as a midwife with the support of the Foundation. In 2016, Schiphol and the Foundation signed a sponsorship deal, which, among others, allowed the Foundation to place its advertising in the terminals of Schiphol. Foundation shared the ad creatives with Schiphol, who then stored them on its servers and displayed them on the billboards. Picture of the claimant was used for one of those ad creatives and it has been displayed on one of the screens in Schiphol for approximately a year before the claimant informed the Foundation that she didn’t want them to use her portrait for the advertising in Schiphol. Claimant and the Foundation reached a agreement and the Foundation subsequently informed Schiphol that the picture in question could not be used anymore. Schiphol removed the portrait from its billboards. However, some time after this, Schiphol published an article on Platform dedicated to marketing, media and communications for professionals in this area. The article was about the sponsorship agreement between Schiphol and the Foundation and it included the picture of the claimant. On 29th of January the Foundation informed Schiphol that the picture should not have been used. Schiphol immediately requested the Platform to delete the picture and replace it with another picture. The article with the claimant’s picture was seen approximately 73 times and was also shared via Twitter. On 8 May 2019 the claimant’s lawyer wrote to Schiphol requesting a conversation about a compensation from Schiphol to claimant. The parties did not reach an agreement. Schiphol offered claimant a € 1500 compensation twice, claimant rejected the offer. According to the claimant, Schiphol has violated her portrait rights and her right to privacy by publishing her picture and other personal data visible on the pi
The District Court of Amsterdam rejected a request of removal of negative registrations in a credit information system pursuant to Article 17 GDPR, reasoning that the purpose of these registrations provided sufficient legitimate grounds to override personal interests. In 2003, the claimant (data subject) took out an investment mortgage at the cooperative bank Rabobank (the controller). From 2008 onwards, several payment arrears occurred and in 2016, the data subject stopped paying the monthly instalments. In 2020, the house in question was sold and the mortgage plus interest paid to the bank. The data subject also had a checking account with Rabobank. Here overdrafts occurred in 2008 (repaid in 2017) and in 2018 (repaid in 2021). As a consequence, Rabobank registered two code numbers (‘BKR registrations’) at the central credit information system. They regarded both the mortgage and the credit from the checking account, indicating the data subject’s history with payment arrears to potential creditors. In 2022, the data subject submitted a request for removal of the BKR registrations pursuant to Article 17 GDPR, which the bank rejected. He then sought a court order forcing the bank to remove the BKR registrations, basing his request on Article 21(1) GDPR and Article 6(1) GDPR. The data subject argued that he was now in a financially stable situation and that the registrations impacted him unjustifiably, as he could not obtain long-term financing at a market-based interest rate for the companies he is a shareholder of. The bank raised a defence. The court raised the question, whether there are grounds for the removal of the BKR codes. The court held that the registration codes’ aims, namely, to protect both the customer from excessive indebtedness and potential creditors from uncreditworthy borrowers, meet the requirement of compelling legitimate grounds and override the claimant’s interests in accordance with Article 21(1) GDPR, which allow the controller to furt
The plaintiff received a tax assessment from the Dutch Tax and Customs Administration (i.e. a letter in which it tells you how much you have to pay). She didn’t agree with its content, and therefore submitted an objection. The Tax and Customs Administration rejected the objection and maintained the assessment and the tax decision. So the plaintiff filed an appeal. One of the grounds for appeal argued by the plaintiff was that her privacy (as enshrined in the GDPR) has been violated as estbalished in other proceedings. Different stages of the tax levy and objection processes have indeed been assigned to different organisational units established in different locations, which gave the plaintiff an unpleasant feeling that her details were everywhere. As a result, a relatively large number of people were required to gain access to her information. Does the way the tax levy and objection processes of the Dutch Tax and Customs Administration have been designed violate the plaintiff's privacy? The District Court interpreted the plaintiff's argument as an appeal on the basis of the right to privacy as enshrined in Article 8 of the European Convention on Human Rights (rather than the GDPR). In the District Court's opinion, the tax levy and objection processes constitute in itself an interference with an individual's right to privacy by the public authorities. After all, the Tax and Customs Administration collects and stores large amounts of information of a private nature in that context. Such interference is reinforced by the fact that various stages of the tax levy and objection processes were assigned to different organisational units. However, not all interference with an individual's right to privacy constitutes a breach of Article 8 of the ECHR. This is not the case if the interference is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the preven
The President of the Office for Personal Data Protection (PUODO) found that L. Sp. z o.o. ("the Company") infringed the provisions of Article 5(1)(a)GDPR, Article 5(1)(f)GDPR in connection with Article 5(2) GDPR, i.e. the principles of lawfulness, data integrity and confidentiality and accountability in connection with Article 28(1) GDPR, Article 28(3) GDPR, Article 28(10) GDPR and Article 29 GDPR, with regard to the processing of data from video surveillance systems used in the Residential Community without legal basis in the form of an agreement on entrustment of processing. The DPA stated that in the course of the proceedings the indicated shortcomings in the process of personal data processing were eliminated, but nevertheless imposed on the Company an administrative fine in the amount of PLN 8000.00 due to the duration of the violations. The DPA emphasised that, in the absence - in the data processing entrustment agreement of May 2018 concluded by the Housing Community - of entrusting the Company with the processing of data, including the determination of the purposes and means of processing of the data derived from the video surveillance system used at the property, to which the Company actually had access within the framework of the proper performance of the contract for the administration of the common part, pursuant to Article 28(10) GDPR, the Company was deemed to be the controller with regard to this process in the period from May 2018 to September 2019, i.e. until the date of conclusion of Annex No. 1 to the aforementioned contract. The Company appealed against the decision to the Provincial Administrative Court. Was it legitimate to consider that the Company was the controller of personal data in relation to the processing of video surveillance data? The Provincial Administrative Court Warsaw dismissed the appeal and held that on the basis of the factual findings, the PUODO stated correctly that the Company infringed the provisions on the protecti
In April 2019, the data subject sent an request for erasure of data on several payment defaults and some address data to the credit reference agency (CRA) CRIF GmbH because the debts had all been cleared. The CRA refused the erasure, stating that the data was still relevant for the purposes of assessing the data subject's creditworthiness. In June 2019, the data subject lodged a complaint with the Austrian DPA (Datenschutzbehörde - DSB), stating that all debts still stored in the CRA's data base have been cleared and that several debts only concerned insignificant amounts. The DSB rejected the complaint regarding the data on payment defaults but ordered the CRA to delete data on an old address of the data subject. The DSB held that the data on the payment defaults concern a total amount of more than EUR 3,000 and that none of the debts has been cleared more than 5 years ago. Under case law by the BVwG (see BVwG - W211 2225136-1), CRAs are allowed to store data on payment defaults or insolvencies for a five-year period after the clearance of the debt. The data subject filed an appeal against this decision by the DSB. In this appeal he/she also argued (for the first) time, that the CRA had also violated Article 14 GDPR because the data subject had never been informed about the processing of his/her data. Hence, the data must also be deleted under Article 17(1)(d) GDPR. Was the CRA allowed to still store data on payment defaults after the debts have been cleared? If so, for how long? Does the failure to inform the data subject under Article 14 GDPR result in the general unlawfulness of the processing and the obligation for the controller to delete the data under Article 17(1)(d) GDPR? The BVwG rejected the appeal and fully upheld the decision by the DSB. On the issue of storage duration of the data on payment defaults, the BVwG agreed with the DSB's reasoning and held that none of the data must be erased at the time of the decision. All the data stored could still
The defendant had lodged a complaint with the DPA, claiming that the plaintiff, a property management organization, had disclosed their data to a third party without consent or any other legal basis. Originally, the defendant had sent an email from his professional mailbox to the plaintiff about a piece of furniture placed in a common area of a property managed by them. Following this, the plaintiff got in touch with the landlord of the property on the matter, who in turn asked if he could get the contact details of the defendant in order to discuss the matter directly with him. For this purpose, the plaintiff forwarded the email message of the defendant - including his professional email address - to the landlord. The defendant argued in its complaint before the DPA, that he had not been consulted prior to the data disclosure to the landlord and that he had been violated in his right to confidentiality, especially with regard to his professional contact details. The DPA granted the defendant’s complaint and found that the personal data, which was indicative of the defendant’s professional activity, should not have been disclosed by the plaintiff to a third party. The plaintiff appealed this decision arguing that, by forwarding the email and all data of the defendant it contained, they were only fulfilling their legal obligation pursuant to the national housing property law to disclose the contact details of a tenant at the request of a landlord. Does the disclosure of the professional email address of a tenant to a landlord constitute a violation of the tenant’s confidentiality? The Federal Administrative Court of Austria confirmed the Data Protection Authority’s decision by reminding the plaintiff that they could have had established contact between the parties involved in other ways, e.g. by referring to the postal address of the tenant, and that the disclosure of the professional email address could not be reconciled with the principle of data minimisati
On 21 of January 2019 complainant lodged a complaint with Autoriteit Persoonsgegevens against a data broker called Focum. In his view, Focum processed his data unlawfully and wrongly rejected his erasure request. On 21 of February 2020 complainant started a court case against Autoriteit Persoonsgegevens for not deciding on his complaint on time and demanding compensation. Complainant believes that AP is obliged to issue a decision within a reasonable timeline, which is 8 weeks according to the Dutch Administrative law. Autoriteit Persoonsgegevens disagrees: Article 78(2) GDPR defines the applicable time frame in line with Article 4:13(1) of the Dutch Administrative law. AP must inform complainant of the progress or settlement of the complaint within 3 months. The Court ruled against complainant’s arguments for the following reasons: 1) Article 78(2) GDPR defines the applicable time frame in line with Article 4:13(1) of the Dutch Administrative law. The reason for not putting a deadline in the law is because complaints can lead to long and complex investigations and include cross-border data processing, meaning that other supervisory authorities might need to get involved. 2) According to Recital 141 GDPR, AP must update complainant within a reasonable period. In this case, AP sent an email to complainant on 20 march 2019, which counts as a progress report even if it doesn’t explicitly say so in the email itself. Moreover, the email stated that the investigation involved cross-border processing and that the complaint may be handled together with other European supervisory authorities. 3) When assessing whether the decision on the complaint took too long, the Court took the following into account: - AP was conducting their investigation based on several different complaints from different people. - The investigation included an on-site inspection and coordination with other supervisory authorities in the EU. - COVID-19 measures that have slowed the AP down.
The applicant was a property company and a (former) sister company of a hospital operating company. The hospital operating company filed for insolvency in April 2010, and in October of the same year the hospital operations were discontinued. After the clinic ceased to operate, the patient files kept in paper form remained in two basement rooms originally intended to house the files. The hospital building subsequently stood empty and was temporarily looked after by different caretakers. In the end, a security service also carried out external checks on the building. On 10 May 2020, a Youtuber entered the former hospital building, including the two file rooms located in the basement, and came across the patient files that had been left behind. The video uploaded on the video platform "youtube" caused a broad media response as well as complaints from former patients under data protection law. The competent DPA tried to contact responsible persons of the applicant or clinic for clarification and to establish remedial measures, but these attempts have essentially remained fruitless. In the meantime, the local public authorities, in consultation with the DPA, undertook measures to secure the building and, in particular, to prevent unauthorised persons from accessing the file rooms. After further attempts of unauthorised entry by third parties had occurred, the regulatory authorities, following a corresponding request for administrative assistance by the supervisory authority, commissioned a 24-hour surveillance by a private security service. Finally, in June 2020, the DPA issued a decision based on Article 58(2)(d) GDPR. The property company filed an application for interim relief against this order. By decision of 30 July 2020, the Administrative Court granted the application and restored the suspensive effect of the applicant's action. The appeal of the defendant (DPA) is directed against the above Court's decision. Was the mere storage of the files in the clinic b
It follows from the court decision that the applicant rents a property from the defendant company. Most probably (this does not result directly from the decision) there was a dispute between the parties concerning the tenancy contract (probably the tenancy rent) and the defendant wanted to distribute the applicant's personal data related to the tenancy contract by publicly displaying the contract. Due to the urgency of the case and the threat to the claimant's personal data, the claimant filed a demand with the court to issue an injunction prohibiting the defendant from making the contract public. Can a person affected by illegal data processing (outside the journalistic/editorial area) assert claims for data protection by way of a civil law injunction claim? The court found that a person affected by illegal data processing (outside the journalistic/editorial area) may pursue claims for data protection by means of a court injunction. Such claims are not blocked by Article 79 GDPR. Furthermore, the court considered that the lack of correspondence among the parties in the time between the letter of warning and the application in the preliminary injunction procedure does not lead to the rejection of the application, but only to the obligation of the court to examine it.
Appellant has been receiving welfare since 2011. In 2017, the municipality carried out an investigation triggered by an anonymous tip. As a result of this investigation the municipality concluded that the appellant had no right to receive the benefit and was supposed to pay it back. Appellant submitted a series of access and erasure requests to the municipality in 2018. Among other things, he wanted to have his bank details erased and he wanted to obtain access to the name of the reporter whose tip led to the investigation. The municipality refused to provide both and Court of First Instance upheld this part of the municipality's decision. Appellant is challenging the decision. The Council declared the appeal invalid. Appellant cannot access the name of the reporter because: a) the municipality says it doesn't have it and there is no reason to doubt that; b) even if they did have the name, appellant is not entitled to have access to it because it doesn't relate to him; c) the reporter is not the source of information, so Article 15(1)(g) does not apply. Appellant also cannot have his bank details removed because of the Archive act 1995 (Archiefwet 1995): the municipality is under the legal obligation to keep the information about social benefits for 10 years.
The plaintiff points out that in this particular case about the controller's obligations regarding an Access Request, he proposed to submit a preliminary question to the Court of Justice of the European Union. He proposes that the High Administrative Court annul the first-instance judgment, uphold the plaintiff's claim and annul the defendant's decision. He seeks reimbursement of the costs of the appeal proceedings. The plaintiff filed an appeal against the judgment for substantial violation of the rules of court procedure, erroneously and incompletely established facts in the dispute and erroneous application of substantive law. In making such a claim, the first-instance court did not explain and specify on the basis of which it concludes that all credit documentation should be considered personal data, nor did it correlate with the notion of personal data from Art. (4)(1) GDPR on the protection of individuals with regard to the processing of personal data and on the free movement of such data. The erroneous and incompletely established factual situation was committed by the court failing to establish all the circumstances of the case, and in particular failing to establish precisely what is considered personal data and why it considers all credit documentation to be personal data. The court also erred in finding that providing the respondent with a copy of the requested documentation does not adversely affect the rights and freedoms of other individuals, emphasizing that other individuals do not mean the processing manager himself. The first-instance court only states this position in the reasoning of the judgment, without explaining on the basis of which it came to such a conclusion and from which it follows that such an interpretation of the said Article of the General Data Protection Regulation should be considered valid. It also maintains that the substantive law has been erroneously applied accordingly, for all the reasons stated during the administrative
The parties asked the French Supreme Administrative Court (Conseil d’Etat) to suspend the centralisation and data processing of personal data relating to Covid-19 on the health data platform ‘Health Data Hub’ (data controller). The EU subsidiary of the American corporation Microsoft, established in Ireland, has access to personal data on the Hub as it licenses the software necessary to operate it (data processor). The data centre is located in the Netherlands. The parties also asked the Court to request the French DPA (CNIL) to rule on the implication of the invalidation of the Privacy Shield agreement in relation to personal data processed in the Health Data Hub. The parties highlighted that the condition of urgency was met. This is due to the urgent nature of the Covid-19 pandemic, the sensitive nature of the data centralised and processed in the Health Data Hub and the recent CJEU decision (“Schrems II” of the 16th July 2020). Finally, they deemed that there was a serious violation of the right to privacy and to protection of personal data. This is due to the fact that the company in charge of the Health Data Hub’s technical aspects, Microsoft, is subject to US law. The risk that this posed to the above-mentioned rights were outlined in the Schrems II decision. Is the contract between the French Health Data Hub and Microsoft, as a company subject to US surveillance law, in violation of Article 44 to 49 GDPR following the Schrems II decision? With regard to the Schrems II decision: The French Court outlined relevant segments in the the Schrems II CJEU decision. In this case, the CJEU held that Articles 46(1) and 46(2)(c) GDPR must be interpreted as meaning that a data subject, whose personal data is transferred to a third country, benefits from a level of protection essentially equivalent to that guaranteed by the GDPR and the EU Charter of Fundamental Rights. The French Court also highlighted that the CJEU held that the Privacy Shield adequacy decision (
The case involves national regulation on data retention for security purposes, not related to cookies or consent mechanisms.
Privacy international has challenged the lawfulness of the practices of collecting and using the bulk communications data (BCD) by the UK security and intelligence agencies. The Investigatory Powers Tribunal referred to the Court of Justice of the European Union the questions whether the existence of such practices fall within the scope of EU law and of Directive 2002/58 and if yes, does the EU law precludes national legislation enabling State authority to require providers of electronic communications services to carry out the 'general and indiscriminate' transmission of traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security. The referring court asked two questions : firstly, having regard to Article 4 TEU (referring to national security) and Article 1(3) of Directive 2002/58, ("Directive shall not apply to activities ..... which fall to the activities concerning public security, defence, State security") does a requirement in a direction by a Secretary of State to a provider of an electronic communications network that it must provide bulk communications data to the security and intelligence agencies of a Member State fall within the scope of Union law and of Directive. The second question reffered to the court was seeking to ascertain whether Article 15(1) of Directive 2002/58, read in the light of Article 4(2) TEU and Articles 7, 8 and 11 and Article 52(1) of the Charter, is to be interpreted as precluding national legislation enabling a State authority to require providers of electronic communications services to carry out the general and indiscriminate transmission of traffic data and location data to the security and intelligence agencies for the purpose of safeguarding national security. The UK and several EU members states highlighted that the activities of security and intelligence agencies are the sole responsibility of Member States as it guaranteed in the treaty (Article 4(2) TEU)
On 27 December 2018, the claimant requested access to his personal data held by the municipality of The Hague. He requested access to, among others, the information relating to an IP address, serial numbers and details of bicycles towed by the municipality and email communication with the employees of the municipality. The municipality provided claimant with some information but decided against disclosing all requested personal data. The claimant insists that the list of personal data provided by the municipality is incomplete. He argues that IP address, email communication and debit card payment information for the towed bicycle should be included. The Court ruled that, as follows from the case law of the Administrative Division of the Council of State, the person who claims that there should be more personal data, has to make it evident that this is indeed the case if they want to contest the administrative body’s investigation into the matter. The municipality has stated that IP addresses are not stored or linked to persons, it also doesn’t have the means to link IP addresses to a specific person (additional information from an ISP would be necessary here). Lastly, it would take an impossible amount to time and resources for the municipality to trace and identify all people who communicate IP addresses to the municipality. The Court ruled that when a processing requires an excessive effort, resulting in identification being practically impossible, an IP address cannot be considered personal data. Regarding the processing of the debit card payment data, the municipality indicated that that data is anonymized, which means it cannot be traced to the claimant. Regarding the claimant’s email communication with the municipality, the Court found that the claimant already has the emails he sent himself and the municipality’s response. Moreover, the Court ruled that Article 15 GDPR does not entitle the claimant to receive a copy of the physical or digital documents