GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
In the Saarland, Art. 2 § 3 CP-VO regulated contact tracing. This tracing serves to interrupt chains of infection. The aim is to find out who may have had close contact with an infected person so that he/she can be placed in (self-)quarantine and tested in order to avoid infecting other people unintentionally. Those responsible for catering, cultural facilities and events, indoor playgrounds, church services and funerals, sports and other related events according to Art. 2 § 6 CP-VO, hotels and other accommodation providers as well as prostitution businesses are obliged to do to keep the information: - First name and surname, - Place of residence - Accessibility and - the arrival time of one representative of each household present They must be handed over to the health authorities on request. It is also provided that these data are to be deleted within one month. The standard does not lay down any requirements for the organisation of the collection of contact data. In the field of gastronomy, in particular, this often leads to the fact that subsequent guests can recognise and remember who has visited the company before them and how they can be reached via telephone number, e-mail address or postal address. This is a significant interference in the right to data protection. By recording, storing and possibly also passing on address and contact data, citizens - holders of fundamental rights - could be indirectly deterred from attending certain events or places. Indeed, the idea can be frightening if it is precisely documented and, if necessary, the state is informed from when to when one has visited which restaurant, political, religious or cultural event. According to the Constitutional Court of the Saarland, such a far-reaching, serious interference with the fundamental right to data protection cannot be decided by government decree. A parliamentary law is also necessary, because it is not (any longer) a short-term emergency situation, but a regulation which i
In 2010, the data subject had been subject to insolvency proceedings. In 2012, he was ordered to repay 70% of his open debts and managed to fulfil this payment plan by mid-March 2018. The competent court consequently accepted his request to remove information on the insolvency from the public insolvency register ([https://edikte.justiz.gv.at/edikte/id/idedi8.nsf/suche!OpenForm&subf=e Insolvenzdatei]). This publicly available information of the data subject's insolvency had also been stored in the database of the credit reference agency KSV 1870 Information GmbH. The data subject is also the sole managing director of a limited company. The database entry on his insolvency has also been linked with the data stored on this company. The data subject requested the erasure of the data on his insolvency under Article 17 and 21 GDPR, stating that he has paid back his debts in line with the payment plan and that data on his insolvency are no longer published in the insolvency register. After KSV 1870 Information GmbH refused to delete the data, the data subject lodged a complaint with the Austrian DPA (Datenschutzbehörde - DSB). The DSB rejected the complaint and the data subject filed an appeal with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). Is a credit reference agency such as KSV 1870 Information GmbH allowed to store data on the insoleveny of an individual beyond the availability of that data in the official insolveny register? If so, for how long? The BVwG held, that KSV 1870 Information GmbH is allowed to store the data on the data subject's insolvency, even though that data is no longer available in the official insolvency register. Both the amount of a debt and the time that has passed since its incurrence and its payment are relevant to assess an indivuidual's creditworthiness. Neither EU law nor the national Austrian law contain provisions on the allowed storage period of creditworthiness data (such as information on insolvenc
On 18.10.2019 the Polish DPA - UODO imposed a fine of PLN 40,000 on the Mayor of Aleksandrów Kujawski. UODO found that the Mayor violated: 1. Article 5(1)(a) and Article 5(1)(f) in connection with Article 5(2) by making personal data available to certain entities without a legal basis (without agreements on entrusting personal data); 2. Article 5(1)(e) in connection with Article 5(2), i.e. the principle of storage limitation and Article 24 GDPR through the lack of appropriate policies concerning the processing of personal data in the BIP (Biuletyn Informacji Publicznej); 3. Article 5(1)(f) in conjunction with Article 5(2), i.e. the principles of integrity and confidentiality, the principle of accountability, and Article 24 GDPR by failing to carry out a risk analysis of the Mayor's use of the YouTube channel for the transmission of the recordings of the deliberations of City Council; 4. [Article 5 GDPR#1f|Article 5(1)(f)]] in conjunction with Article 5(2), i.e. the principles of integrity and confidentiality, and Article 32 GDPR by failing to implement appropriate technical and organisational measures to safeguard the data of natural persons in connection with the storage of the recordings of the sessions of the City Council exclusively on the YouTube servers, without making and backing up those recordings in the own resources of the City Council; 5. Article 5(2), i.e. the principle of accountability and Article 30(1)(d) and Article 30(1)(f) by not indicating in the register of personal data processing activities, for activities related to the publication of information on the BIP website of the Municipal Council , all recipients of data and not indicating for these processing activities the planned date of data deletion in a manner ensuring data processing in accordance with the principle of limited storage. Apart from imposing a fine, UODO ordered the Mayor to: 1. stop providing personal data without a legal basis, 2. implement policies defining data processing p
Between 2010 and 2015 Lloyds and Mr Lees, the data subject, entered into buy-to-let mortgages with respect to three properties which in 2019 became subject to orders for possession. Over the period of two years (2017-2019), during the court proceedings for possession, Mr Lees made a few Data Subject Access Requests (DSARs) to which Lloyds responded. In the current case, one of the allegations made by Mr Lees was that Lloyds is in breach of the Data Protection Act 2018 ("DPA 2018) and the GDPR because it failed to answer Mr Lees DSARs. Did Lloyds fail to provide personal data contrary to the GDPR and DPA 2018? The DPA 1998 is the applicable legislation in the current case since the DSARs were submitted before the DPA 2018 and GDPR came into effect. The court held that Lloyds provided Mr Lees with an adequate answer to each of the DSARs. As a result, Lloyds complied with the DPA 1998 and GDPR. Further, Chief Master Marsh stated even if Lloyds failed to respond to DSARs, the court has the discretion whether or not to issue an order to make Lloyds comply and confirmed that the court would not have exercised the discretion in favor of Mr Lees due to the following factors: 1. The numerous and repetitive DSARs were abusive; 2. The real purpose of the DSAR was to obtain the documents rather than personal data; 3. There being a collateral purpose that lay behind the requests which was to obtain assistance in preventing Lloyds bringing claims for possession; 4. The fact that data sought would be of no benefit to Mr Lees; 5. The claims for possession have been the subject of final determinations in the County Court from which all available avenues of appeal have been exhausted; The court held the claim is without merit and dismissed it.
The Parole Office processed personal data of the plaintiff while he was on probation between 2014 and 2020. On 13 august 2018 plaintiff submitted the right of access request to the Parole Office. On 9 November 2018 the Parole Office provided plaintiff with the overview of the documents, notes and emails that contain his personal data. The overview included the number, date, and a short explanation of each document. For example: “24. 1-12-2014 Email with client regarding the appointment”. The Parole Office excluded the following categories of documents from the overview and did not provide them to the plaintiff: 1) Internal notes and communication between the employees of the Parole Office about the rehabilitation process; 2) The correspondence and communication between the Parole Office and the Public Prosecutor’s Office about the rehabilitation process; 3) The correspondence and communication between the Parole Office and the Custodial Institutions Agency about the rehabilitation process. The plaintiff requests the Parole Office to provide him with a full overview of the documents containing his personal data, he also requests to be allowed to access to these documents, should he want to. The Parole Office explained to the plaintiff that the excluded documents fall under statutory exceptions for two reasons: a) this will help its employees and the employees of the concerned agencies to perform their tasks and freely exchange opinions, which is necessary for the execution of their duties; b) These documents cannot be shared with the plaintiff to protect privacy and personal data of the employees of the concerned agencies. The Parole Office also argued that its own internal reports are not personal data, but rather the impressions of the Parole Office employees. The Parole Office refers to a judgment of the Court of Justice of the European Union of June 17, 2014 (joined cases C-141/12 and C-372/12), in which it was ruled that a legal analysis based on personal d
Regarding administrative procedure for investment proposals, a data subject was provided with a protocol for granting access to information in accordance with RIEW Montana internal documentation. The protocol contained personal data the data subject did not consent to, and he saw that there are other protocols signed by other people. RIEW Montana presented internal documents in regards to processing of personal data. Was the principle of data minimisation violated by RIEW Montana? The Supreme Administrative Court decided that there was a violation of the principle of data minimization.
As a freelance editor of the daily newspaper "Main-Post", the applicant asserts a right to information under press law by way of interim relief. The defendant challenges that decision by lodging an appeal. He submits that the cumulative total of COVID-19 cases in the individual administrative district communities since the outbreak of the infection in Germany, as requested by the applicant, does not justify a far-reaching public interest in information, nor does it allow a conclusion to be drawn on health risks which could justify a particular urgency in providing information. The decision does not provide any information on the public interest in information to be weighed up. A journalist of the "MainPost" requested the cumulative total of COVID 19 cases in county municipalities of county N. in Bavaria since the outbreak of the pandemic in Germany. The district of N. consisted of 38 municipalities, some of which had fewer than 1,000 inhabitants. The defendant argues that due to the small-scale and village character alone, it can be expected that a reconstruction of personal references is easily possible. He makes a reference to the statements of the Bavarian State Commissioner for Data Protection in his Current Information 31 "Statistical data on COVID-19 diseases accurate to the community? (as of 1.7.2020), that only in municipalities with at least 10,000 inhabitants do not generally raise any data protection-related objections to the disclosure of daily total numbers of diseases since the beginning of the SARS Cov-2 pandemic. Article 11 BayPrG is not applicable. This rule applies to situations of further processing of data by press companies. However, it cannot be inferred from the statements made by the Bavarian Commissioner for Data Protection that the information requested by the applicant, relating to those municipalities in the district of N. in which fewer than 10 000 people live, makes it possible to draw conclusions about persons specifically affecte
On 4 June 2020 the plaintiff lodged a complaint against the tax officer’s failure to decide on his objection to the result of the access request. Under the Dutch Administrative law, public authorities are obliged to issue decisions within specific timelines, otherwise they should pay a penalty. The Court found that the tax officer has indeed failed to decide on the plaintiff’s objection.The case is mostly based on the Dutch Administrative law. GDPR-wise, the Court considered that pursuant to Article 12(3) of the GDPR, data controller must provide data subject with the information on Article 15 to 22 requests without delay and in any case within one month of receipt. Article 34 of the GDPR Implementation Act states that a written decision on the request should be deemed as a decision within the meaning of the Dutch Administrative law.
The appellant requested TU Delft to provide him with more personal data in response to the subject access request under Personal Data Protection Act. TU Delft refused to give more information and rejected the request under the Dutch Administrative Law Act. In its earlier ruling, this Court has decided that the restriction of access was justified. According to TU Delft, the appellant has not made it plausible that the overview of personal data was incomplete; the appellant has also been given sufficient opportunity to take notice of his personal data processed by TU Delft. More specifically, cording to the TU Delft, a copy of the study advisers' work records should be excluded from the scope of subject access request because these records contain personal thoughts that are used for mutual consultation. Lastly, TU Delft states that it has started using a different data storage system from 2010, and not all data has been migrated from the old system. The appellant contests the fact that he has received sufficient access to the personal data in question and points out that he has good reasons to suspect that more personal data is processed. Based on the existing jurisdiction on the matter, the Court ruled that a person who states that there must be more personal data than what he received from an administrative body in response to a DSAR, must make it plausible that there is indeed more personal data. Complainant did not make it evident that more data is proceed by TU Delft. Appeal was rejected.
The applicant runs an inn with a hotel in the urban area of the respondent (a public authority responsible for food quality control). In March 2019, the initiative "TopfSecret" requested via an internet platform ("Frag den Staat") the respondent to disclose information on the last two food regulatory audits of the applicant’s business. After hearing the complainant, the respondent issued a decision, that it would disclose this information within ten days. The applicant filed an action against the decision, requesting i.a. a temporary injunction to prevent the disclosure of the audit results. The Administrative Court Regensburg ordered the temporary injunction of the action. Subsequently the respondent lodged an appeal with the VGH München, requesting to set aside the order of the Administrative Court Regensburg and reject the applicant's request for a temporary injunction. Does the respondent’s decision to grant the initiative "TopfSecret" access to information on the Applicant’s food regulatory audits comply with the German Consumer Information Act (Verbraucherinformationsgesetz - VIG)? Does this decision or the subsequent private use of the information violate the Applicant’s right to data protection under the GDPR and/or other fundamental rights? The VGH München held that as far as the disclosure of information by the respondent constitutes processing of personal data within the meaning of Article 4 (1) and (2) GDPR, this would be justified under Article 6 (1)(c) and (3). The court also found that the VIG complies with Article 86 GDPR: The provisions of this opening clause are taken into account by the Consumer Information Act with its graduated regulatory model which considers mutual interests of both the consumer requesting access and the data subject concerned. Insofar as the complainant fears that the third party or the internet platform will breach data protection laws in the event of subsequent use of the information disclosed, such a breach would no
The parties were involved in social initiatives aimed at supporting or questioning the need for certain investments in the vicinity of the housing estate where they live. The defendants accused the claimant that, as a result of her interventions in the housing estate, the city carried out no investments. The defendants publicly criticised the claimant's attitude and they also expressed their opinions in social media. The applicant claimed that the defendants had thereby infringed her personal rights. The Regional Court held that there was no infringement, as the defendants exercised their right to freedom of expression. In the Regional Court's opinion the defendants cannot be held responsible for the form of statements made by other people, including Internet users. The claimant has appealed against the judgment. The claimant complained that the court omitted her request for evidence to oblige the domain registrar and the Internet access service provider to disclose the names and addresses of subscribers to the service using pseudonyms (nicknames), who published entries about the claimant on an Internet forum. The Court of Appeal identified the subscriber of the domain and obtained from him information about e-mail addresses to the accounts with logins indicated by the claimant and lists of posts written from those addresses. Next, it called the Internet provider for the established IP addresses to indicate the subscribers of the Internet access service. The Internet provider refused to provide information, citing telecommunication secrecy. Additionally, it indicated that the deadline within which it is obliged to store, among others, the data requested by the Court, has already passed. The Court of Appeal has addressed the Supreme Court with a legal issue. Is an entity providing Internet access services, i.e. an entity bound by telecommunication secrecy, entitled to refuse to provide personal data of the subscriber of this service in a case of infringement of per
The applicant seeks an order that the City of P. refrain from video surveillance of the "P.er K.-garten" and from recording it. In a letter dated 23 November 2017, the Police Inspectorate P. provided the defendant with information on the "P.er K.-garten" as a basis for possible political initiatives for municipal video surveillance. In this letter it is stated that the K.-garten has been a police focus for years, especially during the warm months (April to October). On 14 May 2018, the defendant's city council decided to install video surveillance. Signs were missing at other entrances to the K.-garten and in some places they were installed in an area that was already covered by the cameras. Because of its open design, the K.-garten could be entered without being able to see the signs. A detailed note on the modalities of the video surveillance was only attached to the surveillance house. The operating hours of the video surveillance were between 6:00 and 1:00 am. The claimant argued that the installed video surveillance in a park is not necessary to prevent a.o. drug-related crimes. Moreover, the surveillance should not only be turned off entirely on market days, but also during other events which he would like to initiate. 1. Article 79 GDPR precludes further judicial remedies against controllers and processors, so that a general action for performance in the form of an action for an injunction pursuant to §§ 1004 (1) and 823 (2) of the German Civil Code is not permissible within the scope of the GDPR. 2. A distinction must be made between data processing that is (merely) contrary to the Regulation and a possible infringement of a person's rights with regard to the personal data relating exclusively to that person. 3. In the case of a mere unlawful data processing without any infringement of rights, the data subject has the right of appeal under Article 77(1) GDPR and subsequently the right of judicial remedy against the supervisory authority under Article 78(
The appellant has a complicated financial history with several debts and a record of payment delays, including a mortgage at Achmea bank and a private loan from ABN AMRO bank. Because of these debts he was registered in the Central Credit Information System (CKI) of the Credit Registration Office (BKR). Over the years, the appellant has tried to improve his financial situation and succeeded in some areas. He wanted to take an additional loan to support his business, lease a working car and move to a bigger house. The CKI registration prevented all of this from happening, which led to a (rejected) right to erasure request and a lawsuit before the Court of First Instance of Zeeland-West-Brabant which he lost. The appeal is based on essentially two claims: 1) banks cannot use compliance with a legal obligation as a lawful basis for processing when it comes to credit register maintenance (a position seemingly shared by the Dutch DPA) and 2) in his particular case, such registration was disproportionate and thus was not compliant with the principles of necessity and proportionality. The banks are of the opinion that compliance with a legal obligation is the correct legal basis, that the appellant's financial situation is far from perfect and that the CKI record is therefore justified and necessary to protect the financial system and the appellant himself. The Court did not agree with a rather narrow interpretation of the scope of compliance with a legal obligation as a legal basis in this case. According to the Court, not every individual personal data processing operation requires specific legislation tailored to its purpose, a legislation can serve as a legal basis for several data processing operations. According the the Court, the appellant also failed to demonstrate exactly how the credit registration breached the principles of necessity and proportionality. Although his financial situation has seemingly improved, the Court ruled that the interests of ABN AMR
The data subject was the owner of the vehicle which was involved in the road collision. On the date of collision the vehicle was insured in terms of civil liability of motor vehicle holders. After the collision, the insurer handled the loss adjustment. The injured party in the subject traffic collision approached the insurer to send documentation regarding the loss. The insurer's employee sent to the injured party scans of the loss documentation, which were not anonymized, i.e. including the name of the data subject, her residence address, PESEL number, telephone number, and vehicle data. Later on, the insurer notified the data subject of the above incident, as a result of which personal data may have fallen into the wrong hands. Upon receipt of the above information, the data subject changed her cell phone number and stipulated to the bank that withdrawals from her bank account could only be made on her personal instruction. She was afraid of the negative consequences of having her personal data disclosed by the insurer, i.e. that someone would call her and that her data would be passed on. The injured party in the traffic collision did not contact the data subject or file a claim in court against her. The insurance company paid the injured party compensation under the data subject's insurance contract. The representative of the data subject requested the insurance company to pay the amount of PLN 10,000 as compensation due to the violation of the protection of the claimant's personal data by unauthorised disclosure to third parties. In its reply, the insurance company refused to accept the data subject's claim, arguing that the transfer of the claimant's personal data to the injured party was based on provisions of law. Whether there has been an unlawful transfer of personal data to a third party? Did the scope of personal data provided to the third party comply with the data minimization principle? The District Court in Warsaw held that under specific regula
A natural person filed a complaint under the Data Protection Act (Datenschutzgesetz, DSG), in which it was summarised that the Company (appellant in this case - a real estate trustee and developer) had already sent letters to this natural person on several occasions, to his/her private address, in which the Company had expressed interest in acquiring the other party's property. Given the repeated sending of such letters, it had to be assumed that the Company had been processing the personal data of the involved party permanently for a long time. Therefore, on XXXX 2018, the natural person involved had asked the Company for information on the processing of personal data under Article 15 GDPR and, as it believed that any data processing that had been carried out was unlawful, he/she had requested that the data be deleted according to Article 17 GDPR. The complainant had not reacted to this request. The Company claimed in the proceedings initiated by the DPA that unfortunately, due to internal misconduct, the letter had remained unanswered. The opinion was accompanied by a letter from the Company addressed to the other party on the same day, in which the request for information under Article 15 GDPR was complied with and the other party was informed that its personal data had been deleted. It must be added that the complainant searched the land register for the property of the co-participating party and in this way obtained the contact details of the party. Subsequently, the complainant used the data obtained from the land register (extract from the land register) to contact the party three times by post with a view to a possible purchase of the said property. The contact details of the co-interested party were not used for any other purpose. However, the Company had not informed the party concerned about the personal data not collected directly from the party, under Article 14 of the GDPR. The data protection authority informally discontinued the proceedings regardi
In 2019, the data subject submitted an access request under Article 15 to the Austrian Post. The Austrian Post replied to the data subject stating that due to the high number of inquiries in connection of media coverage that they have, complainant within three months as opposed to one month. The data subject replied stating that their request was not complicated, and that they would like to have an answer within one month. No answer was provided to the data subject within the one-month time frame. The data subject then submitted a complaint to the Austrian Data Protection Authority (DSB), in which he stated that (1) he had not received an answer to his Article 15 request from the Post within a one-month, and (2) the information received from his Article 13 request was partially incorrect. The DSB replied stating that they could not yet ascertain whether a subjective right had been violated, given that the three-month period had not expired yet. The DSB told the complainant that they could informally withdraw the complaint within two weeks, or expect a rejection. The complainant replied to the DSB stating that their complaint should remain valid because the information provided by the Post had also been incorrect (Article 13 GDPR). However, the DSB rejected this reasoning, stating that the suggested infringement of Article 13 was to be treated separately in scope to the suggested infringement of Article 15, and that a new complaint should therefore be submitted. Moreover, the DSB stated that The data subject complained about the DSB’s legal assessment, stating that their legal assessment was incorrect and that they had violated essential procedural rules. The data subject claimed that the three-month deadline should only be used in exceptional cases, and that the DSB had erred in assessing that this instance was one such case. The data subject claimed that the DSB had infringed his rights by causing a delay in his ability to exercise his rights. The data protectio
The plaintiff was the managing director of a regional association of a charitable organisation. In 2011, this regional association had a financial deficit of almost one million euros. At the time, both of these events were reported in the regional daily press, mentioning the plaintiff's full name. The plaintiff now requests the defendant, as the person responsible for the internet search engine "Google", to refrain from including these press articles in a search for his name in the results list. The Regional Court dismissed the action. The plaintiff's appeal was unsuccessful. The question was whether Google has to delist press articles of the plaintiff according to Article 17 GDPR. The court hold that the basic rights of the plaintiff does not outweigh the interests of the search engine and the interest of its users, the public and the press organs for the linked newspaper articles, also taking into account the time that has passed by, this is why he cannot base his claim on Art. 17 GDPR.
The applicant was an authorised officer of one of those companies. In 2015, several articles appeared on the website of a US-American company, whose objective, according to its own statements, is "to make a lasting contribution to fraud prevention in the economy and society through active education and transparency", by critically examining these companies. One of these articles was illustrated with photos of the plaintiffs. The business model of the website's operator was in turn critically reported, among other things with the accusation that she was trying to blackmail companies by first publishing negative reports and then offering to delete the reports or prevent negative reporting for a so-called protection fee. Google was asked to delete the thumbnails. The German Federal Court of Justice (Bundesgerichtshof - BGH) stayed proceedings and referred two questions to the Court of Justice of the European Union for a preliminary ruling: - Is it compatible with the rights of the data subject in Article 7,8 CFR to weigh up the possibility to file an interim injunction as legal protection and receive a preliminary clarification on the right to get delisted as a decisive factor in the decision on conflicting rights and interests arising from Article 17(3)(a) GDPR? - Can the BGH oblige the defendant to pay the costs if third parties placed photos which are shown as a thumbnail in the search engine of the defendant, even if the third party's website is linked but not specifically named when the thumbnail is displayed by the search engine and the resulting context is not displayed by the internet search service?
The applicant is the owner of a company [handling prohibited substances] and of two vehicles for which the defendant ordered transmission blocks in accordance with § 41(2) of the Straßenverkehrsgesetz - StVG (Law on Road Traffic) - in the register of vehicles. With regard to restrictions in those orders, the plaintiff brought proceedings before the Verwaltungsgericht (Administrative Court). The defendant confirmed that it complies with the current data protection regulations and does not carry out an unencrypted transmission of his personal data by electronic means. In the context of the proceedings, the defendant sent to its lawyer, by fax the decision ordering the blocking of transmission of the applicant's vehicle. That decision contains, inter alia, the name and address of the applicant, the vehicle identification number and the registration number of the vehicle. The notice was sent unencrypted without anonymisation of the personal data. It is disputed 1) Whether the transmission by the authority by fax of a decision containing personal data was unlawful 2) Whether personal data are transmitted by fax, the authority must take precautionary measures to guarantee the fundamental right to informational self-determination of the person concerned and which level of protection needs to be complied with. The court held that the transmission by the authority by fax of a decision containing personal data was unlawful. The level of protection needs to be complied with depends on the sensitivity and importance of the data to be transmitted, the potential risks involved in fax transmission, the degree to which the data subject is in need of protection and the effort required for the security measures. It is also irrelevant that the decision was not sent by fax to any third party but to the defendant's representative, who, like his employees, is subject to the obligation of confidentiality. There is a risk of abuse by unauthorised third parties, which may occur at any
The claimant brought action against the termination of an investigation by the regional DPA (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz – LFDI). He had made requests under Art 15 GDPR to a number of regional public authorities - several courts, attorney general’s offices, a ministry and a parliamentary body – but didn’t see his rights under GDPR met, except in one case. In particular, he didn’t feel informed about which information could be deleted. The claimant referred to a lack of consistency between the regional authorities in the application of Article 15 and a generally too narrow interpretation compared to its application on the national level. The DPA terminated the investigation with reference to a lack of provision of information by the claimant. Was the termination of the investigation by the regional DPA lawful and, in this context, did the regional public authorities respond adequately to the requests under Article 15 GDPR? The court denies admissibility of the claim and dismisses it. It was not possible to investigate the claims and hence confirm the necessary possible infringement of claimants’ rights since he did not provide sufficient information. Subsequently, the court explains that, had the claim been admissible, it could not have been successful. It confirms that the regional DPA met its obligation to request missing information from the claimant and that the claimant had not responded to this. In particular, the court explains, - although no legal expertise or analysis could be expected from him - had the claimant failed to specify which acts or omissions he felt were in breach of which right granted to him under GDPR, in particular Article 15. Not even if or why he was expecting the respective authorities to hold personal data on him, which of his requests had been responded to or not, and why those replies received were in his opinion not satisfactory. This lack of information also inhibited con