GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
An individual had a credit history with the bank, at the term of which he could pay his debts due to reasons for which he cannot be held responsible. the bank registered his name under several codes at the BKR. The individual asks for the removing his data from the BKR. the bank refuses to send this request. the balance of interest was to be assessed, between the interests of the users not to be registered, and the interest of the society (banks and credit agencies) to assess the profile of their customers. The tribunal confirmed that the data could be processed under the legitimate interest basis (ARTICLE 6(1)(f) GDPR). The tribunal weighted the different interests at stake and decided in favor of the complainant since he could prove that his bad credit scoring was due to unfortunate circumstances. The tribunal order the bank to request the BKR to remove several codes under which the plaintiff as registered.
A regional supervisory authority requested access to an association’s board meeting minutes as well as an external auditor’s report in the context of an investigation into the association’s managing director’s conduct. The association refused to submit the requested information entirely and unredacted, partially relying on privacy rights. The supervisory authority acknowledged the potential legitimacy of redactions where merely personal data was concerned, but claimed that redactions went far beyond this, and included information on employment contracts and pay crucial to the performance of their rights and duties as supervisory authority. The documents had also been requested by the regional audit office (Landesrechnungshof). Could the association refuse to submit information to their supervisory authority based on data protection laws? The regional court found, inter alia, that the association could not rely on privacy regulations as an objection to submitting the documents requested by their supervisory authority. The court confirmed applicability of § 2 (1) 1 BbgDSG (Brandenburgisches Datenschutzgesetz – regional privacy law Land Brandenburg), corresponding to § 3 BDSG (Bundesdatenschutzgesetz – Federal Data Protection Act) and implementing Art 6 (1) e) GDPR, as a basis for access to personal data by a supervisory authority. It further concluded that the element of necessity, as required by the applicable provisions, was met for the specific case.
By separate decisions dated 15 October 2018, the Amsterdam Legal Aid Board rejected appellant's requests for additional legal support. Appellant requested a copy of his and his stepdaughter’s personal data under Article 15(3) of the GDPR from Zilveren Kruis, Stichting Philadelphia Zorg, Stichting Cordaan and another party. On 30 August 2018 and 28 September 2018, appellant submitted six applications for additional legal assistance in proceedings against these parties under Article 35 of the GDPR Implementation act, on the grounds that, in his opinion, insufficient personal data had been provided. The Amsterdam Court of First Instance rejected the appellant's complaint on the ground that this problem did not need a lawyer. Appellant disputes this decision in the Council of State. According to the appellant, he only received an overview of the personal data in response to his data subject request, although he needed more information for a successful damage compensation procedure. He also argues that the GDPR case law demonstrates that this is a complex legal area. Appellant also pointed out that his data subject requests were, in essence, rejected, and his opponents hired large law firms to handle the case, which makes it emotionally distressing for him and his stepdaughter. Finally, he also has a pending appeal against the FOI request to Philadelphia before the Council of State. All of this proves, in the appellant's view, that the case is legally and factually complex. Appellant also questioned the fairness of the policy of the Amsterdam Legal Aid Board and claimed the violation of the right to effective remedy and fair trial. The Council rejected the appeal based on the following: * The policy of the Legal Aid Board does not in general provide for legal support for data subject requests under Article 35 of the GDPR Implementation action, but exception can be made where cases are considered complex enough. * The arguments paid down by the appellant did not pro
The controller operates a social network in Europe. The data subject has had a private account on this network since 2008. In September 2022 an unknown third party distributed child pornography - violating the controller's terms and conditions - using the data subject's account without authorisation. On 11 September 2022 the data subject's account was temporarily deactivated. The controller had not previously heard the data subject and initially did not give a reason for blocking . Due to the deactivation, the data subject was unable to use the network's functions. The data subject contacted the controller on 28 September 2022 and requested - inter alia - to restore the user account and remove the deletion and blocking notes from the data subject's user data record. On 1 October 2022, the account was reactivated. The blocking of the account and the deletion of the posts created by third parties are still recorded in the controller's data set. = The data subject claimed in the first instance that the deactivation of her account was unlawful but the regional court mostly rejected the action and the data subject appealed this decision requesting - inter alia - that # It is determined that the deactivation of the data subject's profile was in breach of contract. # The controller is ordered to correct the data subject's data stored by it so that all deletion and blocking notes are deleted from the user data record # The controller is ordered to refrain from blocking the data subject because of the publication of contributions or from deactivating her account for this reason without informing her in advance of the intended blocking/account deactivation and granting the opportunity to respond with a subsequent new decision. Alternatively, in the event that the court considers the above application to be too far-reaching: The controller is ordered to refrain from blocking the data subject on www.xxx.com without informing her in advance of the intended blocking/account dea
Maximillian Schrems, an Austrian citizen, had been a Facebook user since 2008. As is the case with users residing in the European Union, some of the data belonging to Mr. Schrems had been transferred by Facebook Ireland to its servers belonging to Facebook Inc., located in the United States. In 2013, Mr. Schrems complained to the Irish Data Protection Commissioner (DPC) seeking to prohibit these transfers. When this complaint was rejected, he brought an action against the decision before the Irish High Court, which in turn referred a number of questions to the CJEU, the most prominent of which was whether the EU-US adequacy decision, the so-called “Safe Harbor", was valid. In its judgment on October 6th 2015 (Case C-362/14, “Schrems I”), the CJEU invalidated the Safe Harbor and stated that, in order to be "adequate", the level of data protection offered by the third country should be “essentially equivalent” to that being offered in the EU. As a result, the High Court annulled the decision rejecting Mr. Schrems’ complaint, and referred the case back to the DPC. In the remittal “judgment” before the DPC, Facebook Ireland explained that the invalidated adequacy decision was not relevant as a large part of personal data was transferred to Facebook Inc. pursuant to Standard Contractual Clauses (SCCs). On this basis, the DPC asked Mr. Schrems to reformulate his complaint. In his reformulated complaint lodged on December 1st 2015, Mr. Schrems alleged that US law required Facebook Inc. to disclose his personal data to certain United States authorities in the context of various monitoring programs (in particular, the FISA 702 and the Executive Order 12.333). In Mr Schrems’ view, these programs contravened different data protection principles as well as Articles 7, 8, and 47 of the Charter. After investigating the allegations made by Mr. Schrems, the DPC argued that it could not adjudicate on them until the CJEU had examined the validity of the SCCs, and so it brought pro
A special code (“A”) registration was made at the Central Credit Information System (CKI) on 21 March 2018 in connection with the balance deficit on an ING payment account of the complainant that took place in 2016. On 19 November 2018 code A was changed to code H, which remains visible for the period of five years from that date. The Court considered four complaints behind the appeal. Complaint 4 is challenging the proportionality of the registration in the Central Credit Information System (CKI), claiming that it should be deleted because it disproportionately affects his business. For example, the complaint was denied a business loan necessary to continue his business operations. The Court must assess necessity and proportionality of the processing the complainant has objected to and decide whether the interests, rights and freedoms of the complainant prevailed in this case. The Court considered that ING’s interest in this processing was to prevent a debt problem and to inform lender about possible risks. ING was able to show evidence that the complainant’s financial situation was not stable. The Court has agreed with the complainant that the code registration at the CKI may indeed constitute an obstacle to receiving credit. However, it has also considered that it was not possible to ascertain from the letters of loan refusal that this registration was among of the reasons of the credit denial. Complainant’s financial situation may as well have been considered insufficient by the potential lender. In the view of the above, the Court ruled that there are compelling legitimate interests in maintaining the registration; the processing was necessary and proportionate.
The Claimant in the case is a 16-year-old boy. In December 2015, when he was 11 years old, an online tutor raised certain concerns about his alleged behaviour with the Department for Education. More specifically, on 22 February 2016, the Department for Education's Due Diligence and Counter Extremism Group raised a concern with Counter Terrorism Command of the Metropolitan Police regarding a "radicalisation risk to a pupil" at a school in East London ("the Claimant's former school"). This was a referral pursuant to the Government's "Prevent Strategy", the aim of which is to stop people becoming terrorists or supporting terrorism. In the briefing note, the boy's tutor raised concerns because of the boy's statements about America being evil, obsession with killing the PM, and liking Game of Thrones because of the beheadings. The risk was assessed as being low, and "no concerns or potential concerns were identified". The authorities further noted that "the concerns expressed by the source appear to be a misunderstanding". Despite deletion requests from the Claimant and his mother, the boy's personal data was still retained on ten databases of the authorities. Was the personal data retention by the Metropolitan Police lawful under the ECHR and the 2018 UK Data Protection Act? The UK High Court held that the continued retention of the Claimant's personal data is in breach of Article 8 of the ECHR, as well as Sections 35 and 39 of the Data Protection Act.
Complainant has submitted a data subject access request to the executive board of the municipality of Haarlem on 24th of July 2019. On 26th of October 2019 complainant lodged an appeal in connection with a failure to take action on his request. On 20th of December 2019 the municipality made a decision on the request. On 7th of February 2020 the District Court of the Northern Netherlands declared the appeal well founded and ordered the municipality to pay a penalty of EUR 1 442 to the complainant and cover the court fee of EUR 174. The municipality has opposed to this judgement. The Court must decide whether the appeal of the complainant can be considered well-founded without a reasonable doubt. The municipality is of the opinion that the judgement of the 7th of February 2020 did not take into account the argument that the claimant was abusing his rights in order to get paid for the delayed decision on the right of access. Complainant completely ignored requests to provide additional information necessary to action the access request, such as a request for a copy of an ID. Furthermore, the complainant's letter sent to the municipality on 24th of August 2019 cannot be viewed as a penalty payment notice under Article 6:2 of the Dutch Administrative Law Act because the content of that letter doesn't make it clear what request it refers to, the municipality is not requested to make a decision within a certain period of time and the letter does not clearly state that a penalty payment will be required in the absence of such decision. The claimant is of the opinion that there was no abuse of rights; the letter constitutes a valid penalty payment notice of because the municipality hasn't disputed its validity in the previous proceedings and because penalty payment notices were allowed to be submitted in free form. The Court established that the parties were not disputing the fact that the decision on the complainant's access request under GDPR should have been take
The data subject went through a debt assistance process at young age, due to medical costs and costs of her studies. However, she did her utmost to get rid of her debts. Now she has a stable job and would like to purchase a house. The registration in the credit registry was decisive in the refusal to grant a mortgage and the documents do show that in any event Rabobank and ING do not grant a mortgage if there is such a registration. The applicant cannot obtain a mortgage with the current registration, or it is very difficult and on much less favourable conditions. Does an entry in a credit registry that precludes somebody from obtaining a credit has to be deleted if the interests of the data subject outweigh the responsible granting of mortgages. The applicant cannot obtain a mortgage with the current registration, or it is very difficult and on much less favourable conditions. The applicant therefore has a substantial interest in deleting this registration in light of the actual reason for the debt assistance programme and her development.
Constantin Film Verleih, a film distributor established in Germany, had exclusive exploitation rights of the works ‘Parker’ and *‘Scary Movie 5’. In 2013 and 2014, these respective works were uploaded onto a platform, operated by YouTube LLC and its parent company Google Inc., which allows users to publish, watch, and share videos. As a result, these works have been viewed tens of thousands of times. Constantin Film Verleih requested that YouTube and Google provide it with the information pertaining to each user who uploaded the works in question, claiming that they had infringed upon its intellectual property rights. In particular, Constantin Film Verleih demanded the email address, telephone number and IP address of the users who uploaded the respective files. YouTube and Google refused to provide this information. Constantin Film Verleih started proceedings to obtain the information it sought. On 03 May 2016, the Landgericht Frankfurt am Main (Regional Court, Frankfurt am Main) dismissed the request. Constrain Film Verleih appealed the decision before the Oberlandesgericht Frankfurt am Main (Higher Regional Court, Frankfurt am Main). The Court partially granted the request and ordered YouTube and Google to provide the appellant with the email addresses of the users in question. However, it dismissed all other points. Constantin Film Verleih subsequently appealed this decision before the Bundesgerichtshof (Federal Court of Justice). The Court halted the proceedings and referred the matter to the Court for a preliminary ruling. In particular, it sought a clarification of the interpretation of Article 8(2)(a) of Directive 2004/48 to determine whether the information sought by Constantin Film Verleih fell within the term ‘addresses’ contained in the provision. The Court held that the term ‘addresses’ contained in Article 8(2)(a) of Directive 2004/48 must be interpreted as excluding the email address, telephone number, and IP address of a user who uploaded files tha
VQ submitted a petition to the Petitions Committee of the Parliament of Land Hessen, in Germany. After that, he made an access request, pursuant to Article 15 GDPR. In particular, he asked to have access personal data concerning him, recorded by that Committee when dealing with his petition. However, the President of the Parliament of Land Hessen rejected the request, arguing that the GDPR was not applicable as the petition procedure constituted a function of the parliament, activity that would fall outside of its scope. Dissatisfied, VQ brought an action before the Verwaltungsgericht Wiesbaden (Administrative Court of Wiesbaden, Germany) challenging this decision. While considering that German law did not grant the right to access in this context, the Court was uncertain whether: a) the Committee could be categorised as a ‘public authority’, within the meaning of Article 4(7) GDPR; and b) it could be considered as the ‘controller’ of VQ’s personal data. Besides that, that Court was also uncertain whether it itself could be considered as a ‘court or tribunal’, within the meaning of Article 267 TFEU, read together with the second paragraph of Article 47 of the Charter. In those circumstances, it decided to stay the proceedings and to refer the following questions to the CJEU for a preliminary ruling: (1) Is Article 15 GDPR applicable to the committee of a parliament of a Federated State of a Member State that is responsible for dealing with the petitions of citizens and is that committee to be regarded as a public authority within the meaning of Article 4(7) GDPR? (2) Is the referring court an independent and impartial court or tribunal within the meaning of Article 267 TFEU read in conjunction with the second paragraph of Article 47 of the Charter? The CJEU considered that, by its second question, the Verwaltungsgericht Wiesbaden asked for a clarification on the admissibility of its request for a preliminary ruling, given that being a ‘court or tribunal
Appellant is a customer of ING who had his personal data registered in ING's Internal Referral Register ("IVR") in 2013 for the period of 8 years. In 2017 appellant's credit card request was rejected by ING because of the record in IVR. Before 2013 the appellant had opened and closed 15 business accounts on behalf of different companies, two of which were closed with a negative balance. Appellant claims that ING has no legal basis for registering his personal data in the IVR. The Court upheld the decision of the Court of First instance: 1) registering appellant's personal data in the IVR was necessary to protect legitimate interest of ING and to protect integrity and security of the bank sector. The Court took into account ING's adherence to the Code of Conduct for the Processing of Personal Data by Financial Institutions ("Gedragscode Verwerking Persoonsgegevens Financiële Instellingen"); 2) IVR is an internal register of ING, appellant failed to demonstrate that the record in the IVR has prevented him from getting financial services at other institutions; 3) the fact that appellant was added to the register in 2013, but noticed this only in 2017 was quite significant, according to the Court. ING has added appellant's personal data to its internal register on good grounds and in compliance with the Code of Conduct and the GDPR.
The plaintiff would like to inspect the defendant's hunting register, a hunting cooperative. The plaintiff is a member of the defendant. The plaintiff based his claim on the necessity of being able to verify compliance with the corresponding distribution key in view of his claim to payment of the share of the income from the hunting lease to which he was entitled. Furthermore, he stated that he could only meaningfully exercise his membership rights in knowledge of the other members of the Hunting Cooperative. Finally, the plaintiff referred to the Freedom of Information Act of Mecklenburg-Vorpommern. The defendant refused the requested access in order to protect the personal data of the other members of the hunting cooperative, who would refise to have their addresses published. Nor could it be seen why the plaintiff needed the data in order to be able to assert its claim for a pro rata payment of the defendant's earnings. A member of a hunting cooperative has a claim against the hunting cooperative to inspect the current hunting cadastre of the hunting cooperative, insofar as this contains the names, addresses and size of the areas of the individual hunting companions If these claims cannot be excluded obviously and unambiguously, the Hunting Cooperative owes the hunting companion disclosure of its books and other documents. The type and scope of the documents to which this disclosure extends in detail depends largely on the data required for the effective verification of the respective claim prerequisite The plaintiff is therefore entitled to inspect the hunting cadastre of the defendant, as far as the names of the other hunting companions contained therein, their addresses as well as the information on the size of the respective property areas of the individual owners are concerned. Only on the basis of this information can he effectively exercise his rights as a member of the Hunting Cooperative and thus as part of the General Meeting. It must be possible f
The plaintiff, an interest grouping for gambling machines production companies, had noticed that on several occasions the defendant, a gambling hall operator, had not verified the identity of players at their entries. As a result, there was no alignement with the Hessian system OASIS listing of all banned players. Among other things, the defendant argued that it would be contrary to the GDPR to verify the identity of all players, especially if they turned out not to be banned, making the processing of data unlawful. Is it contrary to the provisions of the GDPR for gambling hall operators to verify the identity of non-banned players at their entries? The Higher Regional Court of Frankfurt points out that, according to Article 6(1)(e) GDPR, a data processing is to be considered lawful if it is necessary for the performance of a task carried out in the public interest. As articles 6(2) and 6(3) GDPR allow the Member States to introduce more specific provisions to adapt the application of the rules of Article 6(1)(e) GDPR, the Hessian legislator made use of this possibility through § 6(1) of the Hessian gambling law. As such, the processing of data for protection of players and combating gambling addiction is lawful because it is carried out in public interest. Beyond that, a gambling hall operator can and even must verify all identities at their entries, not only those of the banned players, in order to fulfill the primary purpose of the data processing.
A student, his/her parents and the school authority communicated a lot, this communication was requested to be deleted from the student´s file, as well as a copy of one report card. The school and authority refused to take out these documents, although the claimant claimed that they do not correspond with the reality. An obligation to remove that document, which formed the basis for the written reprimand issued on 11 October 2018, cannot be required in a claim for interim injuction. In any event, there is no need for legal remedy in this regard in view of the appeals brought against the school regulation measure, which also open a review of the decision taken in the class conference. The argument that pages 51 to 54 contain clearly incomplete copies of notices of opposition is not comprehensible. Insofar as the applicants request the removal of the copy of the report card dated 1 February 2019 (page 2), a serious and unreasonable disadvantage, which could no longer be remedied by a decision in the main proceedings, is in any event not recognisable, in view of the undisputed failure to assess the individual subjects and the fact that an assessment of the applicant's conduct in the second place for the first half of the school year 2018/2019 can no longer be inferred from the school record.
The plaintiff considers that he is eligible to be qualified as a 3rd Degree Administrator and 2nd Class Administrator, as verified under the terms of Law-Decree 101/80, of 8 May, namely because the defendant is remunerating other workers with a higher remuneration when the work provided by them is equal in nature, quality and quantity to that provided by the author, and the constitutional and universal principle of equality of “for equal work, equal wages” (Article 59 of the Portuguese Constitution) is being violated. After the pleadings were closed, the Plaintiff requested from the Court access to personal data of other workers. The request was issued, of which the following stands out: “(…) The Plaintiff requires (...) the Defendant be notified to join the Work Contracts of other workers that he identifies, as well as the respective salary receipts." Now, in the case of people who are not even part of the present case and having in mind the Data Protection Law, the claim was rejected by the lower Court. As for the joining of salary receipts of workers who are not part of these records, and in view of the Data Protection Law, the lower Court ordered that those receipts be removed and returned. Not complying with what was decided by the Tribunal Judicial de Coimbra (lower Court), the plaintiff appealed to the Tribunal da Relação de Coimbra (Coimbra Court of Appeal). The Portuguese Deputy Attorney General requested that the appeal be dismissed. Considering the conclusions of the allegations that, as is known, the Court of Appeal had to decide whether: #The order under appeal is null and void. #The addition of employment contracts and salary receipts to other workers who are not part of the process violates data protection laws. The content or contents of the salary receipts is framed in the definition of personal data contained in Article 4(1) of the GDPR because they contain “information relating to an identified or identifiable natural person (“data subject”)…”
The NGO « Ligue des droits de l’Homme » brought an action for interim measures under L 521-2 of the code of Administrative justice (“CAJ”), before the administrative judge of first instance of Versailles to remove fixe and portable thermal cameras installed in Lisses’ municipal offices and used in the entrance of schools to monitor the body temperature of agents and citizens. The NGO also required to suspend the execution of the decision allowing the installation of both kinds (fixed and portable cameras). After confirming that the GDPR applied, the judge of first instance issued an order rejecting the request. Thus, the NGO appealed the order before the Council of State (Conseil d’Etat) and requested mainly to annul the order, grant its request at first instance and enjoin the city of Lisses to adopt any appropriate measure to indicate that the processing of body temperature remains optional, under Art. L 521-2 CAJ. By virtue of Art. 521-2 CAJ, the interim relief judge may order any measures necessary to safeguard a fundame The supreme Court had to assess whether the right to the protection of personal data included in the right to privacy, constitute a fundamental freedom within the meaning of L 521-1 CAJ. Thus, if the judge could enjoin the city of Lisses to suspend the execution of its decision and remove the thermal cameras. Although the portable thermal cameras do not record personal data, the judge clarified that the decision based on the information captured by the thermal cameras must be regarded as a processing, within the meaning of Art. 4 GDPR. Indeed, the city report to the teachers and pupils the need to leave the school depending on the highness of the body temperatures captured. Furthermore, the judge held that the body temperature was accurate enough to identify individuals and must be regarded as a sensitive personal data under the GDPR. Regarding the lawfulness, the judge rejected all the legal bases claimed by the city and hold that the
Due to the Corona pandemic, the Land Baden-Württemberg issued a regulation with measures to contain the Corona virus as well as a special regulation for restaurants and alike. According to these regulations, one has among others, the obligation to leave contact details when visiting a restaurant. A data subject complaint about the obligation of these regulations to provide contact details when visiting a restaurant, stasting that the purpose to process special categories of data according to Article 9 (1) GDPR is not proportional and necessary, as there are less restrictive measures like shorter opening hours and restrictions on how many people can be in a restaurant at the same time and the voluntarily provision of data for contract tracing. Moreover, it has been claimed that there is not enough protection for the personal data as personnel is not trained and changes a lot. Additionally, the data retention period of four weeks is too long. The obligation to provide contact details when visiting restaurants, as regulated in § 2 (3) CoronaVO Gaststätten, is likely to be constitutional and compatible with the provisions of the basic data protection regulation.
The controller is Google and the data subject is a plastic surgeon. One of data subject's patients filed a complaint against data subject in 2014 for a lack of aftercare after an operation. This led, ultimately, to a procedure before the Central Disciplinary Tribunal for Health Care, of which the result was that data subject was conditionally suspended for a period of four months, with a probationary period of two years. Now, when googling the data subject's name, links to certain websites (www.zwartelijstartsen.nl and www.drimble.nl) appeared between the search results. These links referred to articles that mentioned the data subject's name, their BIG number (unique identifier for health care personnel), their speciality, and the ruling of the Disciplinary Tribunal which led to the data subject's suspension. In 2017, the data subject requested Google to remove the links. Google rejected this request and stated that the URLs in the search results were justified by the essential interest of the general public to have access to them. The data subject then brought the issue to Court, [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBAMS:2018:8606&showbutton=true&keyword=C%2f13%2f636885%2fHA+RK+17-301 and the Court of First Instance upheld their claim.] Google then filed for appeal. The Court of Appeal conducted a balancing test pursuant to Article 21 GDPR, and found that Google's interests and that of third parties, outweighed the data subject's interest. Hence, the right to freedom of information of Google and third parties outweighed the right to privacy and protection of personal data of the respondent. In this regard, the Court considered that established case law (GC and others, and CJEU Costeja), in which it is stated that, in principle, the public's right to freedom of information must give way to the right to privacy and protection of personal data. However, according to the Court, in this case there were special circumstances, because of whi
An applicant asked to erase all data on him to the municipality. After having investigated, it appeared that a conversation between two municipal agents could reveal the identity of the applicant. The applicant considered the processing was illegal and therefore claimed for damages to the city. Are the data where the name of the data subject still personal data ? is the processing in line with the GDPR ? The Court decided that the discussion made it possible to identity the applicant and therefore the GDPR was applicable. However, the processing was compliant with the GDPR since the aim was to prevent abuse of the law by applicants, which is the legitimate interest of the municipalities. No damages were granted.