GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The plaintiff asked the minister of justice to access personal data on his detention. The minister did not answered within the deadline. The court instructs the Minister, within four weeks of the date of dispatch of the decision, to take a decision of the complainant and order the payment of € 100 for each day without taking such a decision. The court also decides on a penalty of 1442 euros for failure to decide on the objection in good time.
CNIL issued a fine of € 50 million against Google in CNIL - SAN-2019-001 after two complaints filed by noyb and La Quadrature du Net on the basis of lack of transparency of the privacy policy and the lack of valid legal basis to process the data. Google appealed the decision of the CNIL on several grounds, including the lack of competence of the CNIL since Google would have its main establishment in Ireland. The Conseil d'Etat confirmed the decision of the CNIL in all points and considered that the CNIL was competent to deal with the case since Google did not have a main establishment in the EU at the time of the decision of the CNIL. The Conseil d'Etat also confirmed that Google's privacy policy was not sufficiently transparent since the information was disseminated throughout several documents and was not easily accessible. The Conseil d'Etat also confirmed that the consent obtained by Google was not valid since it was not sufficiently informed and specific (the users had to accept all processing operations without the possibility to refuse specific processing operations in the first layer of information). Finally, the Conseil d'Etat confirmed that the fine was not disproportionate considering inter alia the seriousness of the violation, the financial capacity of Google, the impact of people and the duration of the violation.
The controller is accused of violating the provision of Article 8 of ZVOP-1 because the responsible person obtained personal data of vehicle owners or users in contravention of Article 10 of ZOdv. Is Slovenian law still applicable if it is more detailed than the GDPR or does the GDPR prevail anyway. The Court of Appeal agrees with the Court of First Instance's finding that the direct application of the GDPR does not constitute a violation of Article 6 (1) (c) as a misdemeanor, with the result that the GDPR from the point of view of misdemeanor law, as part of criminal law, is more lenient for the perpetrator and the court is justified in applying the principle of legality from the second paragraph of Article 2 of ZP-1 on the basis of point 1 of the first paragraph of Article 136.
A representative of a company obtained the personal data, including the names, surnames and addresses, of 51 owners of motor vehicles registered in Slovenia, and forwarded the obtained data to the company. He forwarded this information on the basis of Article 10 of the Slovenian Law on Advocacy (ZOdv). The authority found that the forwarding of the data was in breach of this law, because the representative did not acquire the data for reasons permitted in the ZOdv, i.e. for performing an act of the legal profession for an individual case where the data was required. The decision of the authority was appealed to the Ljubljana District Court. As the court of first instance, it considered that Article 6(1)(c) GDPR (processing on the basis of complying with a legal obligation) did not apply to this case. The Slovenian DPA (Informacijski pooblaščenec) disagreed with the court's assessment. Does Article 6(1)(c) apply here? The VSL agreed with the finding of the court of first instance and dismissed the appeal as unfounded. In its reasoning, the VSL noted that while Article 6(2) GDPR permits Member States to maintain or introduce more detailed provisions in order to adapt the application of GDPR rules for processing done under Article 6(1)(c), this does not permit Member States to regulate Article 6(1)(c) in such a way "indefinitely".
This sentence is the result of a cassation appeal submitted by the defendant against another sentence of the Spanish TS (ECLI: ES:AN:2018:4709, dated November 29, 2018) which, in turn, is the result of an administrative appeal submitted by the defendant against a decision of the Spanish Data Protection Agency (AEPD) dated November 3rd, 2017 imposing a fine of 7,500 € on the defendant due to the breach of Article 6(1) of the LOPD (the decision in Spanish can be downloaded [https://www.aepd.es/es/documento/ps-00559-2016.pdf here]). In order to use the Juasapp app, it was necessary that a natural person entered the telephone number of another natural person in the app; then this last one received a pre-recorded voice call with different kind of jokes (some of then even referring to possible events happened to his/her family); the only data protection information the affected by such jokes received was at the end of the joke, when the voice message specified that "his/her telephone had been provided by a friend or acquaintance" of him/her and that, "unless he/she communicates his/her opposition, his/her personal data will be processed by the defendant". The AEPD received different complaints from natural persons affected by such jokes, and clearly understood that the defendant had not obtained the consent to process personal data belonging to such people. In the cassation appeal submitted before the Spanish TS, the defendant considered that: (i) its commercial activity only provides leisure services to natural persons under their domestic or personal activity; (ii) the data processed by the defendant cannot be considered as personal, so the data protection obligations would not be applicable, and (iii) even if this activity is considered under the data protection obligations, the legal basis for its processing would be the legitimate interest of the defendant. The Spanish TS understood that: (i) the data processing activity carried out by a company in the framework
An applicant requested a city to access his file but also the ones of two other parties. The city conditioned access to these files to the presence of the two other persons concerned. The Court ruled that the access to document was not made under Article 15 GDPR but under another national provision granting access to file in the context of a procedure challenging the decision. Therefore, the decision of the city to grand access under condition was unlawful.
L’association des agences de communication and others contested the legality of several recommendations and principles enshrined in the [https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ 4th of July 2019 CNIL deliberation] on Article 82 of the Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés. Could the CNIL decide a prohibition of “cookie walls” based on the EDPB 'soft law'? The Conseil d’Etat considered that the CNIL outpaced its powers when considering cookie walls as illegal in a soft law measure (Article 2 of its 4th of July 2019 deliberation). Cookie walls are "the practice of blocking access to a website or mobile application for those who do not consent to be tracked ("cookie walls")" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). The CNIL based its position on the EDPB (European Data Protection Board), stating that cookie walls should be forbidden because the cost of consent refusal is too high and thus the consent is not freely given ([https://edpb.europa.eu/our-work-tools/our-documents/otros/statement-edpb-revision-eprivacy-regulation-and-its-impact_en 25 May 2018, on ePrivacy]): "The EDPB considers that, in such a case, users are not in a position to refuse the use of tracers without suffering negative consequences (in this case, the ban from accessing the website)" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). CNIL concluded "that consent can only be valid if the person concerned is able to validly exercise his or her choice and does not suffer major inconvenience in the event of the absence or withdrawal of consent" ([https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000038783337/ CNIL deliberation, article 2]). Nonetheless, the Court still considered the CNIL had overpassed its power: "By deducting such a general and absolute prohibition from the sole requirement of a free consent, laid down by the regula
Several private companies challenges the guidelines of the CNIL on cookies on several grounds, including excess of powers. The Council of State validated most of the interpretations or recommendations provided in the guidelines: - Individuals should be able to decline to give consent as easily as to give consent; Individuals must be able to withdraw their consent as easily as they gave it; - User consent should be given for each purpose, which implies specific information; - Individuals must be informed of the identity of the controllers depositing cookies; the list containing the identity of the controllers must be made available to them at the time consent is obtained and must be regularly updated; - Data controllers must be able to demonstrate that they have obtained valid consent to the CNIL. However, in its decision of 19 June 2020, the Council of State suppressed a paragraph in which the CNIL considered that the Internet user should not suffer major inconvenience in the event of the absence or withdrawal of consent. The CNIL considered in particular that access to a website could never be subject to the acceptance of cookies ("cookie walls"). The Council of State considered that by deducting this general prohibition from the GDPR, the CNIL had gone beyond what is legally possible with guidelines, which are an instrument of "soft law".
On 12 November 2018 Autoriteit Persoonsgegevens (Dutch DPA) rejected the applicant’s request for enforcement. On 12 June 2019 the DPA declared applicant’s objection invalid. On 4 February 2020 the court dismissed the applicant’s appeal. Applicant is now appealing this Court decision before the preliminary relief judge of the Council of State. Applicant is asking the preliminary relief judge to urgently order DPA to: a) Notify relevant transportation companies in the European Union that they can start an investigation into the decommissioning of the ATB system and request these companies to continue supporting the system; b) Investigate the historical and current facts behind the decommissioning; c) Prevent further decommissioning if the investigation shows that the ATB system is being dismantled; d) Report the outcome of the investigation for the Court to use in the main proceedings. Dutch DPA is of the opinion that NS (Dutch public transportation company the applicant complained about) did not violate GDPR, so the enforcement is rejected. Moreover, according to the DPA, the applicant’s enforcement request only concerns cases where NS acts as a controller, which means it only applies to situations where NS sells its own tickets and not international tickets of other companies. The preliminary relief judge cannot order DPA to investigate the decommissioning of the ATB system because the judge cannot be sure that the DPA will get the same order as the result of the main proceedings. The judge founds it important that the ATB system stayed in use until the end of 2019, so it was possible to buy such ticket at the time of the applicant’s objection to the DPA. Also, Dutch DPA’s enforcement powers regarding foreign transportation companies would need to be considered separately as NS is indeed acting as a processor to those companies. Lastly, the preliminary relief judge did not agree that the dissemination of the ATB system would be irreversible. If at any point NS i
Google (the controller), offers the services Google Maps and Google Earth to its users. Both services enable users to see the satellite images of the data subject's property which was photographed by Google. When searching by entering the address of the property, the red location pin is not directly on the property but on the street. However, when entering the GPS coordinates, the red location pin is directly on the property. The aerial photograph shows the location and size of the residential building, as well as various facets of the property (green areas, roof area, terrace, garden). The data subject had requested Google to pixelate or make unrecognizable his property in both services. The data subject claimed that the satellite images were his personal data. Furthermore, he argued that the controller could not rely on the fact that they were using data that could be obtained from commercial and public sources, as he had not authorised either Google Maps or third parties to take or publish the photographs of his property. The Regional Court of Itzhoe (LG Itzehoe) rejected the data subject's claim. It held that the interest of the controller in continuing to use the image outweighs the interest of the data subject in making the property unrecognisable. First, the court recognized the need of the general public to look at the world from the above through the controller's services. The individual reasons for which the users do this are irrelevant in the present case, since mere access to any kind of information source is already protected. If many data subjects' properties were made unrecognizable, the information content of the images would decrease significantly. Second, the court established that the interest of the controller outweighs the interest of the data subject in this case due to the lack of a concrete connection between the image of the residential property including the address entry and the data subject as a person. It is undisputed that the
A STIB user was fined because he did not validate his ticket before entering the bus, although he had a valid transportation ticket. He was sued by the STIB before the local judge (Juge de paix). Is the processing of data of the users compliant with the GDPR ? The judge considered that the processing of the data of the users including the data on their journeys, even if stored in two separate databases, was not in line with the GDPR, because the explicit purposes were not determined in advance, and because the legal basis for doing so was not clear. As a consequence, the judge decided that the fine should not be paid.
GRAYDON wrongly associated Mrs. KAHN’s name with the EGAR company. Consequently, on 31 July 2019, Mrs. KAHN was requested by a bailiff to pay the amount of 537.02 euros on behalf of EGAR as part of the mandatory annual contribution. Mrs. KAHN claimed the existence of a misidentification and challenged the lawfulness of the processing of her personal data. She requested the deletion of all her personal data appearing in GRAYDON’s file. Does a misidentification of a data subject in connection with a specific company in a register and a request for deletion arising from this data subject necessarily imply that any processing of his/her personal data in this register is unlawful under article 6 GDPR? The Tribunal declared the action admissible and observed that GRAYDON spontaneously deleted Mrs. KAHN's personal data in connection with EGAR. However, the Tribunal stated that the processing of her personal data by GRAYDON in relation to other legal persons is not automatically unlawful. Despite the withdrawal of consent by Mrs. KAHN, GRAYDON may base the processing of personal data on a legitimate interest (Article 6(1) GDPR).
The employer runs a radiology practice and until 1 August 2018 had been using printed time sheets to keep track of how many hours the employees had worked. The employee who is a party to the case has refused to use the new fingerprint time-tracking system, and continued to manually write down the worked hours on the old time sheets. The employer then issued several warnings to the employee, urging him to use the new system. On 5 October 2018, the employee received a first written warning from his employer, urging him to start using the fingerprint system. Despite the warning, he refused to do so and continued using the printed time sheets. On 26 March 2019, the employee received a second warning which threatened with the possibility of immediately terminating his employment if he continues to refuse using the fingerprint system. Were the employer's warnings rightfully issued, and the processing of the fingerprint data lawful in accordance with Article 9(2)(b) GDPR? Both courts decided that the employer had to remove the warnings issued towards the employee, and that the employee was not obliged to use the fingerprint system and therefore did not violate his duties. The courts first stated that the only possible legal grounds for the processing operation could be Articles 9(2)(a) or (b). As the employee clearly did not give his consent, the courts did not elaborate further on Article 9(2)(a). With regards, to article 9(2)(b), the first instance court (ArbG Berlin) carried out a three-step assessment, based on: - the suitability of the biometric procedure for the purposes of the employment relationship - whether there were less intrusive means of attaining the purpose - a comprehensive weighing of interests The court concluded that an employer's interest in biometric access control systems to areas with sensitive business, production, and development secrets would be more likely to prevail than in the context of a time-tracking system. Therefore, in this case th
In two similar cases, complainants requested Dutch Data Protection Authority to take enforcement action against the Administrative Jurisdiction Division of the Council of State. According to the complainants, the Division violates GDPR by providing journalists with access to physical copies of procedural documents on the day of hearing. Complainants point to the violation of Articles 5, 6, 9, 12, 13, 14, 15, 32, 33 and 34. The Dutch DPA is of the opinion that, pursuant to Article 55(3) GDPR, it is not authorized to supervise this processing. There is an inextricable link between the public nature of justice and the judicial task; transparency and openness in individual cases is an important part of judicial task. On 29 May 2020 the Court of First Instance of the Central Netherlands decided to submit the following questions to the Court of Justice of the European Union: 1. Should Article 55(3) of the GDPR be interpreted as meaning that “processing operations of courts acting in their judicial capacity” includes the provision by a judicial authority of access to the procedural documents containing personal data to a journalist, as described in this order for reference? 1a. In answering this question, is it important whether, in specific cases, the exercise of the supervision powers by the national supervisory authority over this form of data processing affects the independence of judgement? 1b. In answering this question, is it important that the nature and the purpose of data processing, according to the judicial authority, is to inform a journalist to allow for better reporting on public hearings and legal proceedings, which supports the openness and transparency of justice? 1c. In answering this question, is it important that data processing is explicitly provided for by national legislation? The Council finds that a preliminary ruling from the Court of Justice as referred to in Article 267 of the TFEU is needed, since the concept of “judicial task” is an EU l
The plaintiff complained about factual inaccuracies in reports on his medical situation and possibilities for performing work in the context of granting a work benefit. He requested rectification of data in these reports. The defendant claimed it corrected the inaccuracies by issuing a new report but the plaintiff found this not sufficient since the inaccuracies remain in the initial reports and alleged violation of his right to rectification. The Court had to assess the way in which the rectification should be carried out by the defendant considering also its technical capacity. The District Court invoked Article 24 and Recital 78 GDPR and concluded that data controllers must take appropriate technical and organisational measures that are necessary to ensure that the requirements of GDPR are met. It found that an additional report cannot be considered sufficient to fulfill the right to rectification. The controller must use its best efforts to ensure that policies and systems are in line with the GDPR including transparent and clearly recognisable rectification of inaccuracies other than merely adding a document in a medical file. The Court ordered the controller to investigate the possibilities of complying with the right to rectification within six weeks and notify the Court if it will make use of this opportunity within two weeks.
See facts at the GDPRhub entry to the "Planet 49 case" (C-637/1/). The second checkbox containing a preselected tick used by the defendant (Planet 49) read as follows: {| class="wikitable" !English translation !German original |- |‘I agree to the web analytics service Remintrex being used for me. This has the consequence that, following registration for the lottery, the lottery organiser, [Planet49], sets cookies, which enables Planet49 to evaluate my surfing and use behaviour on websites of advertising partners and thus enables advertising by Remintrex that is based on my interests. I can delete the cookies at any time. You can read more about this here.’ |"Ich bin einverstanden, dass der Webanalysedienst Remintrex bei mir eingesetzt wird. Das hat zur Folge, dass der Gewinnspielveranstalter, [Planet49], nach Registrierung für das Gewinnspiel Cookies setzt, welches Planet49 eine Auswertung meines Surf- und Nutzungsverhaltens auf Websites von Werbepartnern und damit interessengerichtete Werbung durch Remintrex ermöglicht. Die Cookies kann ich jederzeit wieder löschen. Lesen Sie Näheres hier." |} In the explanation linked to the word "here", it was pointed out that the cookies would receive a specific, randomly generated number (ID) associated with the registration data of the user who entered his/her name and address in the web form provided. If the user with the stored ID would visit the website of an advertising partner registered for Remintrex, this visit should be recorded, as well as which product the user is interested in and whether a contract is concluded. Following the CJEU's reasoning in its preliminary ruling, the BGH dismissed the defendants' appeal and, on the plaintiff's appeal, overturned the appellate judgment regarding cookie consent and restored the first instance conviction of the defendant: *The declaration of consent by the preselected tick box does not constitute an "informed indication of the data subject's wishes" within the meaning of Arti
On 19.02.2019, the data subject sent an access request under Article 15 GDPR to a controller (an Austrian municipality). The request was signed using an electronic signature. The controller did not consider the electronic signature a sufficient form of identification and required the data subject to produce an ID card under Article 12(6) GDPR. As the data subject did not do so, the controller refused to handle the access request under Article 11(2) GDPR. The data subject filed a complaint with the DSB, which shared the data subject's view and held that the electronic signature was a sufficient form of identification for an access request. The controller filed an complaint with the BVwG against the decision of the DSB. Is an electronic signature under § 4(1) SVG and Article 3(10) eIDAS Regulation sufficient to identify a data subject regarding an access request? The BVwG upheld the decision of the DSB. It ruled that the controller had never stated the reasons for its doubts concerning the identity of the data subject. The full name, address and e-mail address of the data subject were known to the controller and also used in the correspondence with the data subject. In addition, the data subject had put a qualified electronic signature on its access request. Hence, it was unclear, why the controller should have any doubts on the data subjects identity. Moreover, the BVwG shared the view of the data subject and the DSB that an electronic signature under § 4(1) SVG and Article 3(10) eIDAS Regulation a sufficient form of identification. The provision of an ID card is not the only mean of verifying a data subject's identity. Lastly, the BVWG held that § 24 Abs. 5 DSG which would bar the DSB (and BVwG/VwGH) from ordering a public entity to comply with the data subject's requests does not apply due to the primacy of application of Article 58(2)(c) GDPR. Consequently, the BVwG ordered the controller to comply with the data subject's request under Article 15 GDPR.
The plaintiff, an Austrian resident, had asked the Austrian social security administration to inform him about the status of his son's insurance, a boy living under the care of his mother in Italy. After a survey of both the mother and child's social security administrations, the Austrian administration informed the plaintiff that his son was not entitled to Austrian social security, since the place of residence of the child was not Austria. Following this, the plaintiff lodged a complaint with the Austrian DPA (Datenschutzbehörde Österreichs), claiming that the confidentiality of both his and his son's personal data had been breached by the illicit transfer of said data from the Austrian to the Italian social security administration. However, the Austrian DPA dismissed the complaint, arguing, regarding the alleged breach of his son's personal data, that the plaintiff was not authorized to act on behalf of the child and, regarding the alleged breach of the plaintiff's own personal data, that the Austrian social security administration had to share the data with third parties, especially with the Italian social security, as part of the inquiry into the entitlement of the Austrian social security of the plaintiff's son. 1) Can a parent lodge a complaint with a DPA on behalf of their child when the other parent has not given their consent for that purpose? 2) Does the transfer of data from one European social security administration to another constitute a breach of confidentiality? The Federal Administrative Court started by confirming that the Austrian DPA was right to dismiss the part of the complaint lodged by the plaintiff on behalf of his son. Indeed, the plaintiff lacked power of representation in this regard and could not produce evidence of the mother's consent for a joint complaint. Beyond that, it was also shown that the mother alone - contrary to the sayings of the plaintiff - had the right of custody of the child. The Court then pointed out that dat
Two individuals, plus approx. 6000 formally joining, brought constitutional complaints (Verfassungsbeschwerde) to the court, claiming that the challenged provisions of national law were violating their basic rights of informational self-determination and their right to privacy of telecommunications as guaranteed by the German constitution. Whether the challenged provisions regulating transfer and access of specific types of customer data (Bestandsdaten) to and by federal authorities are constitutional or too far reaching and hence violating basic rights. The court held that § 113 of the telecommunications act (Telekommunikationsgesetz – TKG) regulating the transfer of customer data from telecommunication and internet service providers as well as several other provisions governing authorities’ access rights are incompatible with Art 2 (1) in conjunction with Art 1 (1) and Art 10 (1) of the German constitution (Basic Law – Grundgesetz – GG) for lack of consideration of the principle of proportionality. In particular, the bases for requiring transfer and access are not sufficiently specific and must be proportionate in relation to the type of data requested, including purpose limitation. The data in question is primarily so-called subscriber data (Bestandsdaten), referring to data linked to the conclusion or performance of a contract, as opposed to traffic and content data.
An Irish provider of an online vacation rental marketplace was asked by a Bavarian authority to transfer data of its users who are renting out their appartments for vacation purposes. The purpose was to fight the misappropriation of property in a tight housing market. The request was restricted to uses of an appartment for the purpose of providing accommodation for a period of more than 8 weeks in a calendar year. Is a request - not limited to the individual case - for the provision of information on all users of an online vacation rental marketplace who rent out their appartment for more than 8 weeks a calender year in order to fight shortage of living space by misappropriation of property possible and on what legal basis can a data transfer between the company and the requesting authority be based. The service provider must and may only provide information on the basis of Section 14 (2) of the German Telemedia Act if this provision entitles the service provider to provide information itself and if the requesting authority can also provide a corresponding, precisely tailored authorisation under special law for the right to information, transmission and receipt of data. If these conditions are not cumulatively fulfilled, the service provider cannot provide information. The "data protection opening clause" of Section 14 (2) of the German Telemedia Act (TMG) expressly permits the service provider to provide information only "in individual cases" and not based on broad screening criteria which would lead to the disclosure of uninvolved persons who may already have a permission granted by an authority to rent out their appartment. However, this would in each case presuppose a concrete initial suspicion relating to persons or accommodation. The fact of occasional, perhaps even multiple, short term or long term rentals, will typically not be sufficient to assume misuse without further indications of illegal activity. This is regardless of whether the rental is list