GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Appellant's personal data was shared in a document that was available to several Dutch animal protection authorities in the context of a nation-wide action day against rogue dog trafficking. The authorities of Bladel rejected her request for erasure. The Appellant went to court, arguing, among other, that the authorities had no legal basis for processing her data. The Court of First Instance of Eastern Brabant ruled that the local authority of Bladel was allowed to keep processing appellant's data under Article 17(3)(e) GDPR because of the ongoing legal proceedings. According to the Court, it was irrelevant whether it could be regarded that data was processed unlawfully. Apellant argues that her personal data is processed by the local authorities unlawfully. The authority of Bladel asserts that it had used the data for compatible purposes under Article 6(4) GDPR, which means the appellant's appeal must be rejected. The Council ruled that the Court of First Instance was entitled to assess whether the exception of Article 17(3)(e) GDPR took place without having to first assess the lawfulness of the processing. However, the Council noted that the authority of Bladen has changed their reason for rejected the appellant's request from Article 17(3)(e) to Article 6(4) GDPR without properly documenting or demonstrating how purpose compatibility criteria in GDPR are met. The nation-wide enforcement day for which the data had initially been collected, took place n 2016; the fact that appellant initiated legal proceedings against the municipality in connection with that event does not mean that the purposes of processing are compatible.
In 2013, as part of the integrated approach to rogue dog trafficking by the Police National Unit Animal Welfare Expertise Centre, a so-called pre-weighing document has been drawn up. This document contains data from dog handlers with sufficient indicators to justify further investigation. The dog handlers listed in the pre-road document are included in the general roadmap 'Canitas project' (hereafter: the roadmap) that has been drawn up for a national enforcement action day, and which in section 1.4 contains a diagram with data from dog handlers. The data of applicant and appellant are included in this diagram. The project involved cooperation with, among others, the National Animal Protection Inspectorate and the Dutch Food and Consumer Product Safety Authority. Within the framework of integral enforcement, the roadmap was shared with the administrative bodies affiliated to the Regional Information and Expertise Centre East Brabant. The applicant and the appellant have requested the deletion of their data from the pre-weighing document and the schedule according to the GDPR. The Minister takes the view that data in the roadmap will not be processed unlawfully. In addition, the right to be forgotten of Article 17 GDPR is not intended to correct or delete opinions with which the applicants disagree. Moreover, in connection with the processing of their data, the applicant and the appellant also brought civil proceedings for damages against the Minister. In that context, the data are necessary for the substantiation of a legal action, so that the exception in Article 17(3) GDPR applies, according to the Minister. The central question in the civil proceedings is whether the decision of the Minister not to delete the personal is well founded. The court noted that the last decision of the Minister is no longer based on Article 17(3) GDPR. Instead the decision is based on Article 6(4) GDPR. However the Minister did not explain well enough why the defence of legal clai
A student, the defendant, had allegedly told her teacher, the plaintiff, that she did not want her examination grades to be published or otherwise communicated to third parties other than herself. Nonetheless, the plaintiff had released the grades of all his students, the defendant's included, to their class representatives in order for them to communicate the results to their classmates in a common WhatsApp group. As a result, the defendant lodged a complaint before the Austrian data protection authority, claiming that the disclosing of her grades constituted a violation of confidentiality, to which she considered her teacher to be subject to. The data protection authority sustained the defendant's - plaintiff before them - complaint and held that the teacher - defendant before them - had violated his student's right to confidentiality, arguing that a grade constitutes a personal data such as defined in Article 4(1) GDPR and had to be protected according to the applicable principles of the law, such as confidentiality. The disclosing of grades from the teacher to the class representatives had in view thereof to be considered a breach of confidentiality of the data. This decision was appealed by the teacher before the Federal Administrative Court of Austria, primarily arguing that it should not be him as teacher but the competent authority he was acting on behalf of, the Ministry of education, that should be held responsible as data controller. Can a teacher be considered data controller as defined in Article 4(7) GDPR and therefore be held liable in case of a breach of the applicable data protection principles? The Federal Administrative Court of Austria amended the data protection authority's decision by holding that the plaintiff could not be considered data controller since he was only teaching as part of the school's organisation and under official and professional supervision of the headmaster (§ 56 of the national school teaching law). This would also
AVROTROS (defendant) is a Dutch radio and television broadcaster that is part of the Dutch public broadcasting system. It broadcasts a weekly program called ‘Opgelicht ?!’, which is a program about fraud. In one of the episodes AVROTROS plans to broadcast an item in which plaintiff is recognizably portrayed and accused of committing fraud. Plaintiff tries to prevent AVROTROS from broadcasting this item. The judge has to balance the interests of AVROTROS against the interests of the plaintiff. With regards to the GDPR, the judge holds that the processing of personal data is a processing for journalistic purposes as specified in Article 85 GDPR, Article 32 of the Dutch GDPR Implementation Act (UAVG) and Article 7 of the Constitution of the Netherlands. The legal basis for the processing is Article 6(1)(f) GDPR. Plaintiff's request was denied.
The complainant was the beneficiary of a property on which there was an apartment building with numerous tenants. The alleged controller was the tenant of one of the flats and, in the course of installing a security door in the public corridor area of the property in question, had also had a functioning surveillance camera installed. According to the complainant, only the alleged controller had access to the recorded images and the possibility to use them, and this behaviour drastically interfered with the rights to respect for the private and family life of the other tenants, in particular to the confidentiality of the data concerned, as no one other than the alleged controller had access to this data and no one knew what happened to the images. The other tenants and the owner of the house had not given their consent, which was why the recordings were, in the applicant's opinion, inadmissible under section 12(4)(1) of the Data Protection Act. Therefore, she filed a complaint with the DPA, asserting a violation of the right to confidentiality. After an investigation, the authority dismissed the complaint on the grounds of violation of the right to secrecy and the right to deletion as unfounded and rejected the applications for uninstallation of the camera, for an order to refrain from future interventions and for the initiation of administrative penal proceedings. The authority found that there had been a burglary at the address mentioned, which was why the co-participant, in agreement with his son, had installed the video camera in question in 2010. The video camera was located on the first floor and was directed at the entrance to the flats XXXX and XXXX. The camera was non-functional and served as a deterrent against burglars. The other party had not used the video camera to take any pictures showing the complainant. In its assessment of the evidence, the DPA summarised that the statements of the co-participant were credible and that there was also no apparent r
The plaintiff owns a LED billboard on his private property next to a shopping mall. The billboard is monitored by four CCTV cameras to protect it against vandalism. The DPA (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz) ordered to remove camera 1 that filmed a public street and to shut down camera 2 during opening hours of the shopping mall because it filmed the parking lot. Cameras 3 and 4 had to be repositioned so they do not capture the public street, the parking lot and adjacent residential building. The correct defendant is the DPA itself according to § 20(5)(2) and § 20(4) BDSG. The Court held that even if it is possible that a camera records personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership the requirements of Art. 9 GDPR do not apply because the plaintiff did not seek to process that kind of data. The legality is thus determined by Art. 6 GDPR. In the absence of consent under Art. 6(1)(a) GDPR, a balance of interests according to Art. 6(1)(f) GDPR is required. The legitimate interests pursued by the plaintiff (protection of his property) are overridden by the fundamental rights and freedoms of the data subjects who are filmed by camera 1 on a public street. The DPA was allowed to issue a reprimand, Art. 58(2)(b) GDPR. On the basis of Art. 58(2)(f) GDPR, the DPA was not entitled to order the removal of camera 1 but only the shutdown. According to Art. 58(2)(d) GDPR the DPA was entitled to order the shutdown camera 2 during the opening hours of the shopping mall and to reposition cameras 3 and 4.
The Swedish Labor Court ruled that a collective bargaining agreement requiring an employer to provide unredacted copies of employment certificates to a trade union did not conflict with the GDPR. The employer had to pay the union €4936 (SEK 50 000) for breaching the agreement.
Proximus appeals the provisionally enforceable aspect of its appealed decision of the Belgian DPA. Is the decision of the Belgian DPA provisionally enforceable even though it is under appeal? The Court of Appeal decided the following: Article 66 GDPR gives the possibility for a procedure of urgency and from this article (and Article 66 and Article 62 GDPR), the European lawmaker did not intend to make decision of a DPA provisionally enforceable. The Court continues to explain that decisions are provisionally enforceable during an appeal when the appealing courts entirely reviews the case (rules regarding independency and impartiality of judges are the same). The DPA however, is a body created by an administrative body of the government and its judges are appoint by vote of the Chamber of Representatives and thus the same rules regarding judges do not apply. The Court of Appeal does not entirely review the administrative decision, but only its merits regarding applicable law and good governance. In cases of urgency and when requested, the provisional enforceable aspect of the decision can be suspended. The appeal against an administrative decision can only be effective if there is no pressure o the appealing party to immediately pay a fine or to align itself with the appealed decision. The Court of Appeal states that the DPA failed to adequately motivate its decision and thus the provisionally enforceability cannot be granted automatically. When the DPA sends a document to a defending party, principles of good governance must allow for a reply by the party and the DPA must take the reply into consideration in its decision. The name of the 'document' of the reply does not matter, as the procedure for administrative bodies are not as stringent as those for courts. If the DPA only considers the 'formal conclusion' when motivating its decision (and not the aforementioned 'document'), the duty of motivation is breached. If the DPA would be able to 'chose' to which
The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit against advocado GmbH (advocado, the defendant), a German-based company that runs an online platform where attorneys can offer their services. The defendant's website had used a cookie banner with pre-ticked boxes for the use of marketing and analytics cookies. This included the use of tools such as Google Analytics that entail a data transfer to third countries. The claimant argued that the data processing in connection with the placed cookies was unlawful under Article 6(1) GDPR: A user's consent under Article 6(1)(a) GDPR could not be considered valid under Articles 4(11) and 7 GDPR, especially since the boxes were pre-ticked. Moreover, the claimant claimed that the defendant had violated Articles 5(1)(a), 13/14, 26 and 44 et seqq. GDPR as it had failed to properly inform users of the scope of intended processing activities, joint controllers and international data transfers in connection with the use of cookies. The defendant stated that it had based the use of cookies on legitimate interests under Article 6(1)(f) GDPR until the CJEU issued its decision C-673/17 on 01.10.2019 ("Planet 49"). Afterwards, the defandent argued that they changed the legal basis for processing to consent under Article 6(1)(a) GDPR, which it considered valid under Articles 4(11) and 7 GDPR. The defendant also stated that it was the sole controller for the processing activities - there were no joint controllers involved, only processors. (Furthermore, the claimant had also argued that some provisions in the defendant's general terms and conditions were unlawful from a civil law / consumer protection law perspective. This will not be discussed further in this summary.) *Was it necessary to ask for the users' consent under Article 6(1)(a) GDPR or could the processing activities in connection with the use of marketin
The data subject's complaint concerned irregularities in the process of processing of his personal data by the company. They consisted in making his personal data available to unauthorised persons. It was alleged that the company's employees - in the presence of third parties located in the MP's office (public place) - read, using the applicant's personal data, the content of the statement on termination of the employment contract. The applicant indicated that - after refusing to accept the termination - representatives of the company left an unsecured letter containing the termination in the presence of persons in the MP's office; therefore, the applicant requested that all actions be taken to rectify the violations indicated. President of the Personal Data Protection Office has decided that the provision of personal data to the applicant in the above mentioned way was done in violation of the provisions of personal data protection Article 5 (1) (c) and (f) of the GDPR. Both parties filed a complaint against the President of the Personal Data Protection Office decision with the Provincial Administrative Court for Warsaw. The court considered whether the Polish DPA correctly applied Article 5(1)(c) and (f) of the GDPR and whether the GDPR provisions would be applied at all in the given situation. The Provincial Administrative Court for Warsaw revoked the decision of the President of the Personal Data Protection Office. In its reasoning, the Court states that Article 2 (1) of the GDPR shall apply only "to the processing of personal data wholly or partly by automatic means and to the processing, other than by automatic means, of personal data which form part of a filing system or are intended to form part of a filing system". The Court stressed that under Article 4(6) of the GDPR, a data filing system is a structured set of personal data accessible according to specific criteria, whether that set is centralised, decentralised or dispersed on a functional or geo
= On 30.10.2015, the data subject (user) sent an access request under § 26 DSG 2000 to Google Inc. (now Google LLC) via registered letter, including a copy of his passport. The user requested access to all his data processed by Google Inc. (Note: § 26 DSG 2000 used to be the Austrian provision for access requests prior to 25.05.2018.) On 22.12.2015, Google Inc. replied, asking the user to log into his Google-Account to access all data processed in the account and additional information on the processing. The user refused to log into his account For data that could not be accessed from the user's account, Google asked him to use an online form accessible from the Google account, to make sure that the user would only receive personal data that are truly relating to him (and not some other natural person). The user refused to do so. = On 01.02.2016, the user filed a complaint against Google Inc. with the Austrian Data Protection Authority (DSB) claiming that Google had violated his right to access under § 26 DSG 2000 (now Article 15 GDPR) - inter alia by requesting him to log into his Google account and to use an online form in order to gain access to his data. On 24.02.2020, in the course of the pending DSB-procedure, Google Inc. communicated again with the user, asking him to log into his Google account for authentication. On 15.06.2016, that DSB issued its decision that consisted of three rulings: I) The DSB held, that Google Inc. violated Article 15 GDPR by not providing *access to the user's data that has been processed outside the user's Google account; *certain information on data recipients and data sources as far as those information cannot be accessed in the user's Google account; *information on automated decision making; *information on the purpose and the legal basis of the processing and *information on data processors. II) The DSB ordered Google Inc. to provide this missing data/information within 4 weeks. III) Lastly, the DSB rejected parts of the user
The employer used the location system of the company to match the location data with information contained in the time-sheets of the employee. Since this information showed that the encoded times did not match, the employee was dismissed. The Court refused to grant compensation to the employer or to reinstate the employer for the violation of his data protection rights under the GDPR.
The appellant has a complicated credit history with the ING bank, which resulted in debts and outstanding payments. At some point her name was added to the Central Credit Information System of the Dutch Credit Registration Office. In 2017 the appellant paid all her debts, but the registration with the Credit Registration Office is to remain for the period of 5 years until 2022. In 2019 the appellant submitted the request for erasure which was rejected by ING. Subsequent Judgement of the Court of First Instance upheld this decision, which is now being contested by the appellant. The appellant requests the Court, among others, to order ING to remove the registration with the Credit Registration Office, limit its duration period or remove the registration temporarily until she gets another loan. The appellant claims that the necessity and proportionality balance assessment done by the Court of First Instance was wrong: for example, she can not get the mortgage she needs to improve her life. Her objection to processing follows from Article 21(1) GDPR. ING argues that Article 21(1) GDPR cannot be relied on in this case because it applies only to personal data processed under legitimate interest or public interest, but not under a legal obligation which is the case here. The Court agreed with the appellant: legal basis of the processing of her personal data by ING is legitimate interest and not the legal obligation under the Dutch Financial Supervision Act (Wet op het financieel toezicht). This means, that she has the right to object to her personal data processing based on Article 21(1). However, the Court rejects the appeal as such because the principles of necessity and proportionality are respected in this case. The appellant could not demonstrate that maintaining the registration would disproportionately affect her. The fact that she is financial reliable (even though challenged by ING) does not mean that she does not need protection from excessive loans. The m
The claimant was registered in the Central Credit Information System (hereinafter CKI) of the BKR (Credit Registration Office) because of two instances on which he had defaulted on repaying an overdraft. BKR then issued the claimant with a revolving credit, set to begin in 2012 and end in 2019, and visible until 2024. The registration of the revolving credit contained an arrears code (signalling that money is owed and should have been paid earlier) which would remain visible on his account until 2021. When the claimant paid back the full amount in 2020, he asked to have the arrear code removed from his file. Rabobank refused to remove the code, which led to the complainant filing a complaint. Pursuant to Article 21(1) of the GDPR, persons such as [the claimant] can object to the processing of their personal data on the basis of Article 6(1)(e) or (f) GDPR due to their specific situation . The controller, in this case Rabobank, must honor the objection, unless it submits compelling legitimate grounds for the processing that outweigh the interests, rights and freedoms of the persons concerned. If the objection is granted, the controller must delete the personal data without unreasonable delay. If the controller does not honor the objection, the data subject may, if necessary, ask the court for an effective remedy (Article 79 GDPR and Article 35 UAVG). The court assesses whether the controller has demonstrated that its compelling legitimate interests (in this case the dual purpose of the credit registration: to protect the consumer against excessive credit and to warn other credit institutions) in this specific case outweigh the interests or the fundamental rights and freedoms of the data subject (recital 69 GDPR). Whether it was proportionate for the BKR registration to be maintained, given the fact that the claimant had paid back her arrear and the current registration was preventing her from taking out housing credit? After weighing up the interests involved, R
The defendant blocked the plaintiff's contribution on 25.12.2018 (p. 776 of the annex) with the statement that his contribution did not comply with the F-Community standards. The plaintiff filed an appeal against the decision and tried to persuade the defendant to lift the block. On 27.12.2018 the defendant reactivated the contribution - after a re-evaluation of the disputed mail - with the following words: "We are sorry that we misunderstood this. We have re-examined your contribution and confirmed that it meets our Community standards...". However, the blocking of the plaintiff's profile continued. The plaintiff asks whether the defendant's terms of use for deleting so-called hate messages are invalid. Furthermore, it is questioned whether the Community standards of spring 2018 had become part of the contract. In this respect, the defendant might rely on the amendment clause in clause 13 of the previous terms and conditions, as it violates § 307 (1) sentence 1 BGB or § 308 no. 5 BGB if the forced consent to the amendment of the terms of use was immoral. The court held that if the operator of a social network deletes a contribution and blocks the user, but restores the contribution in response to the user's complaint, the risk of recurrence is not immediately absent. The operator cannot invoke a "free shot". Instead, the principles developed in the case law on rectification are to be applied to such a constellation. If the operator restores the contribution in response to the complaint, it must provide sufficiently serious evidence that its (unlawful) conduct will not be repeated. This is not sufficient if the user's block is not also lifted. It could remain open here whether in such a case the operator is at all entitled to block the user immediately after deletion of the contribution.
The defendant operates social media website (the Platform). According to the terms and conditions of the defendant, the use of the Platform is based on a one-time registration with valid identification. The plaintiff registered as a user of the Platform. The defendant transferred the plaintiff's account to account verification proceedings and requested the plaintiff to confirm the authenticity of his account by presenting a copy of his ID or picture, or by entering a confirmation code from one of his devices. The plaintiff did not answer the defendant's request. This is why the defendant blocked and deleted the account without giving any further reasons. Thereafter, the plaintiff tried to contact the defendant to restore his account, but did not succeed. Can the plaintiff claim to be able to enter into a contract with the defendant without verification of his identity according to the defendant's terms of use? Can the plaintiff maintain anonymity on the Internet according to section 13 (6) TMG, which provides for the anonymous use of telemedia services? Is section 13 (6) of the German Telemedia Act (Telemediengesetz - TMG) inapplicable now that the GDPR has become applicable? The court found that the defendant had a right to extraordinary termination because the plaintiff violated his obligations according to the terms of user conditions of the Platform. Specifically, the defendant does not know the plaintiff personally and concludes contracts with him only via the Internet. This is why the defendants may obtain knowledge of the identity of its contractual partner. However, the plaintiff is also free to not use the defendant´s service. The court concluded that the plaintiff has the right to register under a different name or to register in accordance with section 13 (6) of the German Telemedia Act under a pseudonym, and the defendant did not require the plaintiff to designate his profile with his own name, but only to disclose it to the defendant. Section
In November 2018, the company reported to the supervisory authority two violations related to obtaining by an unauthorised person access to the database, and consequently - to personal data of customers of the company's online shops. After the inspection, the DPA concluded that the company had breached the rules on personal data protection. The deficiencies consisted in the violation by the company of the principle of data confidentiality, consisting in the failure to ensure the security and confidentiality of the processed personal data, which resulted in unauthorised persons gaining access to the personal data of the company's customers, and in the violation of the principle of legality, reliability and accountability by not showing that personal data from instalment applications collected before 25 May 2018 were processed by Morele.net Sp. z o.o. on the basis of the consent of the person to whom the data referred. In September 2019 UODO imposed a fine on the shop Morele.net in the amount of 2,830,410 PLN (660,000 EUR). The company appealed against this decision to the Provincial Administrative Court in Warsaw. Did the technical and organisational measures applied by the company comply with the standards of security measures in the business activity of entrepreneurs in the area of e-commerce of a scale and nature similar to the scale and nature of the company's activity in 2018? Were the technical and organisational measures applied by the company appropriate taking into account the state of technical knowledge, the cost of implementation and the nature, scope, context and objectives of the processing, as well as the risk of infringement of the rights or freedoms of natural persons of different probability and seriousness of the threat? The Provincial Administrative Court in Warsaw dismissed the appeal. The Court agreed with UODO and found that the fine imposed was justified.
After ceasing her notary activity, the applicant engaged in a liquidation dispute with her former business partner and their accounting office. This dispute arose as the accounting office (1) failed to fulfill several ethical obligations and (2) transferred files containing personal data about the applicant to the former partner (without the applicant’s consent). The Litigation Chamber of the Data Protection Authority declared the applicant’s complaint admissible, but dismissed it for the following opportunity reasons: * the complaint did not contain any grievances that a have a “broad social impact”; * another complaint was pending with the competent authority with regard to the ethical and professional mistakes ; * taking into account the resources available, the DPA should make choices regarding the type of files it will follow up on grants. The applicant subsequently appealed to the Market Court of the Brussels Court of Appeal against the aforementioned dismissal decision of the DPA. Should Article 57.1, f) GDPR be read as such that supervisory authorities may not dismiss complaints but should instead review the full substance of the allegations in each complaint? In other words, does the data subjects' right to lodge a complaint under Article 77 GDPR equals the right to claim a full substantive investigation and a full substantive assessment by the supervisory authority? Article 57 GDPR provides that the supervisory authority must "examine the content of the complaint" only "to the extent that is appropriate". There is therefore no absolute obligation but a discretionary power for the supervisory authority to make a full substantive investigation and a full substantive assessment of the complaint. If the supervisory authority considers that a treatment of the case on substantive merits is not appropriate (due to policy considerations, for example), it is authorized to dismiss the complaint. The option to dismiss is indeed one of the consequences that can
The plaintiff requested written information about the personal data stored by the Local Court of Tiergarten (“Amtsgericht Tiergarten”) concerning his person (including information about the origin and recipients of this data). The Court then dismissed the application on the grounds that the plaintiff had failed to prove his identity in the required form and further demanded the submission of a copy of the plaintiff's identity card. In the subsequent action the plaintiff essentially argued that he was sufficiently identified on the basis of the available postal correspondence with the President of the Amtsgericht Tiergarten. Was there any "reasonable doubt" as to the applicant’s identity? And was it therefore necessary, to request additional information to confirm his identity as laid down in § 59 (4) BDSG? The right to information constitutes an unconditional right. The legal basis for the procedure of the provision of information is § 59 BDSG. According to this, the authority obliged to provide information may only request additional information to confirm the identity of an applicant if there is "reasonable doubt" as to his or her identity. Without any particular reason, the authority obliged to provide information may thus not demand proof of identity from an applicant. Particular reasons or special circumstances are neither presented here nor otherwise apparent. The address of the plaintiff has been known to the defendant for some time. The Amtsgericht Tiergarten has already sent various decisions to the plaintiff at his present address in the past. Furthermore, there is no indication that a third party might have an interest in the requested information and could therefore use a false identity to obtain the information by fraud. Finally, the defendant can prevent the misdirection of the information by formally serving the letter of information.
The plaintiff was a former Candidate for a position as a Judge at the European Court of Human Rights in 2014. During this process the defendant (a national media house) published articles on its website stating that the plaintiff had been sentenced to one year and six months imprisonment for domestic violence. The plaintiff (applicant) alleged a violation of the right to privacy for maintaining sensitive personal data on the defendant's website even after the call for judges of the European Court of Human Rights had been closed and the articles were no longer relevant. The Court of first Instance has balanced in it´s decision the collision of protected rights - the plaintiff´s personality rights and the right to privacy on the one side, and the defendant´s freedom of expression, on the other. The Court of Appeal (Višje sodišče v Mariboru) upheld the findings of the Court of First Instance. Therefore, the plaintiff filed a revision (partial renewal of a res judicata judgement) in the part of the decision of the court of appeals regarding the question if a person which was in the past a “relative public figure” loses its status as a “relative public figure” after certain time passes and there is no more interest of the public for that person. The Court held, that a former Candidate for the position of a Judge at the European Court of Human Rights (ECHR) is a “relative public person” or “relative public figure”. When someone becomes a “relative public person”, his field of expected privacy, becomes smaller - in inverse proportion, the more public the function, the more restrictive its privacy rights. The person will be forever in a way a person of public interest regarding the event which made the public interest about him increase. Another question is whether he is entitled to general anonymity and protection of personal data after the event. The answer to this question is not straightforward and depends on the circumstances of each case, in particular the import