GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
In an appeal against the interim decision of the Administratif court of Paris, la Quadrature du Net and La Ligue des droits de l’homme seized the interim relief judge (référé liberté) to stop police forces to capture and process images of public using drones hovering over Paris streets in respect of sanitary measures justified by the exceptional circumstance of the COVID-19 pandemic. What are the conditions for the use of drones capable of collecting personal data in public spaces for administrative police measures? == Appeal was formed against a first instance Administratif court that considered the drones did not collect personal data since the police guidelines did not authorise it. The CE, for its part, recalled the definition of personal data and relevant laws. The 27 April 2016 directive is applicable in that case, since it concerns « the rules relating to the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security » (Article 1). Relying on the -wide - definition of personal data outlined in Article 3(1) of the directive, the CE considered that drones were, in fact, capable of collecting such type of data. Indeed, as they are equipped with zoom and can fly at close distance, they are apt to collect personally identifiable information. Moreover, such collection, transmission of video data to the police force and the video recording, constitute a processing of personal data as outlined in Article 3(2). Thus, the French Loi informatique et Libertés of the 6th January 1978 is applicable. == As processing of personal data by public bodies is at stake, article 31 of the French Loi informatique et Libertés of the 6th January 1978 is applicable. It « requires authorisation by order of the competent
Fraudulent ads using names and pictures of Dutch celebrities are shown on Facebook and Instagram since October 2018. The Claimant, who is a presenter of the news and current affairs programme broadcasted by AVROTROS, is one of the celebrities affected. In November 2019 a similar lawsuit was won by another celebrity, forcing Facebook to implement strict controls and take down fraudulent bitcoin ads. However, in March and April 2020 the Claimant saw similar fraudulent ads with his picture and name: this time the ads referred to the Corona crisis. The Claimant and AVROTROS asked the Court to order Facebook to: 1. To find and take down fraudulent ads within 5 days from this judgement; 2. Share information, identifying the advertisers behind these ads within 7 days from the judgement. Information should include name, email, phone number, date and time of registration, IP addresses and other user and payment data Facebook has in its possession. Facebook claims that the measures they already have in place are good enough and that it is not possible to filter out all fraudulent ads. On the second point, Facebook did not have specific objections, however the company believed that only Facebook Ireland could share this data and only on a Court’s order. The Court ruled that the measures Facebook has put in place to detect and remove fake/fraudulent ads were enough. On the second point, the Court considered the existing case law in the Netherlands. In 2004 the Amsterdam Court of Appeal ruled that an obligation for the service provider to provide data to a third party may be justified if the following conditions are met: a. the possibility that the information is unlawful and harmful to the third party is sufficiently established; b. the third party has a real interest in obtaining the data; c. there is no less drastic way to retrieve the data; d. the balance of the interests of the third party and the internet service provider is in favor of the third party. The Court r
A mother of three underage children (plaintiff) filed a claim in the Court to cease the posting of her children’s photos by their grandmother (defendant) on social media. The plaintiff argued that the defendant had not obtained a consent from her or her ex-partner – the legal representatives of one of the children concerned. Despite several letters requesting the defendant to remove photos from her Facebook page, the defendant did not comply with the request. The defendant’s child (child 1), whom the current proceedings concern, is under 16 years old. The Dutch GDPR Implementation Act (Uitvoeringswet Algemene Verordening gegevensbescherming) (“UAVG”) stipulates that the posting of photos of minors who have not yet reached the age of 16 requires their legal representative(s)’ consent. The plaintiff, as a legal representative, had not given permission to post photos of her children on social media. In the case of child 1, his father also had not granted permission to the defendant. The Dutch GDPR Implementation Act (Uitvoeringswet Algemene Verordening gegevensbescherming) (“UAVG”) stipulates that the posting of photos of minors who have not yet reached the age of 16 requires the permission of their legal representative(s). The Court ruled that it was impossible to establish with certainty that the posting of photos on social media fell under the “household exemption” Article 2(2)(c) GDPR. Therefore, such processing of plaintiff’s photos falls within the scope of the GDPR. Given the lack of consent, the Court ordered the defendant to remove the photo of child 1 from her Facebook page as well as to remove the photo of the plaintiff from the Pinterest account. In addition, the defendant is prohibited from posting without permission photos of plaintiff’s minor children on social media.
The Austrian Data Protection Authority (DSB) had issued a fine of EUR 4,800 under Article 83 GDPR against a legal person based in Austria ("the company"). The reason for this fine were four violations of the GDPR and the DSG (Austrian Data Protection Act) in connection with a CCTV (closed circuit television). The company filed an appeal against this fine with the BVwG (Austrian Federal Administrative Court). On 19 August 2019 the BVwG repealed the fine and suspended the administrative penal procedure. It held that the DSB had failed to make an accusation pursuant to § 30(1) and (2) DSG (Austrian Data Protection Act) against specific persons who have a decisive influence on the accused company's business (managers) and whose own culpable actions (own actions, own omissions or lack of supervision of subordinate employees) can be attributed to the accused company. In its reasoning, the BVwG also referred to a VwGH (Austrian Supreme Administrative Court) decison regarding violations of the BWG (Austrian Banking Act). This is because § 30 DSG, that establishes rules for data protection liability of legal persons, has a very similar wording to § 99d BWG. The DSB filed an appeal against this decision with the VwGH requesting it to repeal the BVwG's decision and to reinstate the decision of the DSB. A) Is the VwGH case law on § 99d BWG relevant with regard to § 30 DSG and Article 83 GDPR? (§ 99d BWG requires culpable conduct on the part of a natural person who is entitled to decision-making or asserting control within the legal person.) B) Or rather, is the CJEU case law on fines under competition law relevant with regard to § 30 DSG and Article 83 GDPR? (EU competition law allows the European Commission to impose a fine against a legal person without having to specifically accuse a natural person of culpable conduct.) C) Is § 30 DSG even applicable or is there a lack of a corresponding opening-clause in the GDPR? (§ 30 DSG requires the same culpable conduct of a natural
Rabobank granted the plaintiffs two mortgage loans. There were arrears about which Rabobank sent letters to the plaintiffs. In these letters, Rabobank stated that if a backlog of three months or more were to arise, this would be reported to the Credit Registration Office (BKR). The plaintiffs failed to pay the arrears. They tried to refinance the house through an intermediate but this was not possible due to the BKR registration. They asked the removal of this registration claiming that Rabobank did it wrongly. Rabobank informed them that the request was rejected. The plaintiffs claimed that on the basis of a balancing of interests, the registration should be deleted because the purpose of the registration no longer outweighs the interests of the plaintiffs upon its removal. They also claimed urgent interest in the removal. The Court found that the GDPR applies to the request for removal. The request shall be based on Article 21 in conjunction with Article 79 of the GDPR and Article 35(2) of the GDPR Implementation Act. If this request is rejected, a petition must be submitted to the court according to the mentioned Article 35(2). The Court also found that there was no urgent interest for the removal. The Court put forward a balancing test as required by Articles 21(1) and 6(1)(e) GDPR and Recital 69 GDPR. It found that the BKR registration was made correctly and the balancing of interest was at the disadvantage of the plaintiffs.
On 8 January 2019 DPA agreed to pay a penalty to the claimant for delaying the decision on her case. The decision was due on 30 November 2018. According to the DPA, the penalty was supposed to be 60 EUR for the delay until 3 December 2018. Claimant objected because the registered letter with the decision was delivered to her on 8 January 2019 instead of 3 December 2018. On 8 May 2019 DPA declared the claimant’s objection not valid. Claimant launched an appeal. The Court must assess whether the DPA was responsible for the delay in delivering the decision caused by a mistake at the postal service. The Court agreed with the claimant. Article 4:17(1) of the Dutch administrative law says that an administrative body must pay penalties for not handling complaints in a timely manner. Article 4:17(2) of the same law defines the size of the penalty: 23 EUR per day for the first 14 days of delay, 35 EUR per day for the subsequent 14 days and 45 EUR per day after that. The Court ruled that a decision can be considered finalized when the applicant is made aware of it. In the present case the decision was sent to the complaint by registered mail, but it arrived with a delay because of a mistake at the postal service. According to the Court, this fact did not relieve the DPA of its responsibility: Autoriteit Persoonsgegevens should have considered the risks of sending the decision by post when choosing method of communication.
On 5 October 2018 the executive board refused to erase personal data of the claimant processed by the municipality of Helmond and refused to compensate damages to the claimant. On 8 March 2020 the board declared the claimant’s objection unfounded. The claimant has launched an appeal against this decision. The Court had to decide whether the board’s rejection of 8 March 2020 was in line with the administrative law and rule on the GDPR-based right of erasure and right to compensation requests. The Court found that the request to erase personal data of the claimant was invalid because this processing had been carried out in line with Article 6(1)(e) of the GDPR and couldn’t have been done in a less intrusive way. Therefore, the processing was not unlawful. So, on this point, the Court has upheld the previous decision of the board. The Court rejected the claim for compensation because his personal data was processed in accordance with the GDPR and local administrative law.
In order to obtain a loan, the data subject provided false document to the bank. Once the bank realized the fraud, it cancelled the contract and inserted the data subject's details into two registries (the Incident Register and the External Change Register) meant to protect and preserve the integrity of the financial system, for a maximum duration of 8 years. Before the Court of First Instance, the data subject asked the deletion of her personal data from the registries or alternatively to limit the duration of the registrations to one year, or a period to be determined by the Court. The Court of First Instance rejected the requests and the data subject challenged the decision before the Arnhem-Leeuwarden Court of Appeal. Under Article 21(1) GDPR, the Court balanced the interests at stake between the bank and the data subject. The data subject argued that her interests should prevail because as an accountant in the financial sector, this information would damage her reputation and work life. In addition, the registrations would make it impossible for her to obtain another mortgage and buy a new house. The Court of Appeal rejected these arguments. The incident was serious, especially for an accountant. This therefore justified the adverse consequences that the data subject may experience in her work. Furthermore, she had not proved the necessity of a new house, since she had been living in a (different) home that she owned. The interests and circumstances alleged by the data subject were therefore insufficient for the Court to reform the first decision. In view of the above, the interest of the bank in maintaining the registrations outweighs the interests of the data subject. As per the alternative request, the Court of Appeal did not consider the 8-years limit to be disproportionate due to the seriousness of the incident. The alternative request is therefore also rejected and the first decision entirely upheld.
The housing department of Groningen has a policy according to which the renting agreement can be terminated where the tenants were found to cultivate cannabis in the place allocated to them. They are then put on a list where they are banned from applying to a new housing during 3 years. The Appellant was evicted from her rental home because of her cannabis plants, a record of which was made by the housing corporation, followed by a 5-year prohibition for the Appellant to rent homes. Her personal data along with the reason for the contract termination (cannabis cultivation) was supposed to be shared with other local organizations and housing corporations according to the agreement against home cultivation of cannabis. On 17 November 2015 the Court of First Instance ruled, among others, in favor of the Appellant’s objection against the sharing of her data according to the agreement and reduced the 5-year prohibition to 2 years. Both Appellant and the Huismeersters Foundation appealed this decision in the Court of Appeals on several points. One tenant was expelled from his house on this basis and considered that the processing of his data was not compliant with the GDPR. The controller put forward Article 6(1)(b), (c) and (f) GDPR as potential legal bases. Main questions from data protection perspective were: • Is the Huismeestes Foundation allowed to share (personal) data of Appellant with other participants of the agreement because Apellant has been evicted from her social rental home due to a hemp farm? • Does a record of the reason of eviction (cannabis) constitute data relating to criminal convictions and offences according to Article 10 GDPR? The Court ruled that the record of the reason of eviction does not constitute data relating to criminal convictions and offences. In this case the record was made by assigning code 2 (2=cannabis) in the field “reason of registration”. According to the Court, this simply marks cannabis being grown in the rental home
The plaintiff's request for free delivery of the copy of the examination papers was rejected by the defendant based on the argumentation that the GDPR would not apply since the personal data contained in the examination papers were neither fully nor partially processed automatically, nor did they constitute data which are or are to be stored in a file system. Whether copies of exams fall under the scope of the GDPR with the consequence that respective individuals can make use of their rights under the GDPR. The court decided that the carrying out of professional examinations to acquire the basic qualification to practise a profession in one EU Member State, which entitles him/her to practise his/her profession, and the resulting processing of personal data, are likely to constitute an activity falling within the scope of Union law solely because of their abstract relevance to fundamental freedoms and the internal market. Therefore, pursuant to Section 5 (8) sentence 1 of the Data Protection Act of North Rhine-Westphalia (DSG NRW) in conjunction with Art. 15 (3) and Art. 12 (5) sentence 1 of the General Data Protection Regulation, an examinee is entitled to a free copy of the supervisory work he/she has done in connection with the Second State Examination in Law in North Rhine-Westphalia, together with the examiner's report, on paper or in a standard electronic format.
An internet platform ("Frag den Staat") requested the respondent (a public authority responsible for food quality control) to disclose the results of food regulatory audits regarding one of the complainant's butcher shops. This information would also contain personal data. After hearing the complainant, the respondent issued a decision, that it would disclose this information to the internet platform within ten days. The complainant filed a lawsuit against that decision with the Administrative Court München, requesting i.a. a temporary injunction to prevent the disclosure of the audit results. The Administrative Court München waived this lawsuit. Subsequently the complainant appealed with the VG München, requesting to prohibit the respondent from publishing the information. Does the German Consumer Information Act (Verbraucherinformationsgesetz - VIG), which grants consumers access to certain information in connection with quality checks of consumer goods comply with the opening clause in Article 86 GDPR if the disclosure involves personal data? The court held that the VIG complies with Article 86 GDPR: The provisions of this opening clause are taken into account by the Consumer Information Act with its graduated regulatory model which considers mutual interests of both the consumer requesting access and the data subject concerned. Insofar as the complainant fears that the internet platform will breach data protection laws in the event of subsequent further use of the information disclosed, such a breach would not be attributable to the respondent. In addition, the court held that Article 8(5) of the Regulation (EU) 2017/625 (Official Controls Regulation) only constitutes minimum requirements for allowing the disclosure of the results of official controls. It does not apply where there is a legal obligation to publish or disclose such information ("without prejudice to situations where disclosure is required by Union or national legislation"). Hence, the cou
The applicant in question is a candidate for election to the defendant's chamber (chamber of dentists) meeting in 2020. The order from the High Administrative Court was directed against the order of the Verwaltungsgericht Stade (Administrative Court Stade), which had ordered the defendant to provide the applicant without delay with the surnames, first names and postal address of the applicant's constituency in question for the purposes of election advertising. As the postal addresses that the members of the Chamber had deposited with the defendant for the purpose of postal correspondence were to be transmitted, the defendant directed its complaint precisely against this. In the present case, the Court had to assess whether the applicant was entitled to a claim of injunction for the transmission of the data in question. The Court found that the applicant was not entitled to receive the surnames, first names and postal addresses of the members of the Chamber eligible to vote for his constituency from the electoral roll. Neither the relevant electoral regulations nor the principles of free and equal suffrage allow such a claim to be derived. Moreover, there is no other norm of entitlement in the context of which the applicant's interest in the promotion of his election advertising could be affected. The latter applies in particular to the data protection provisions governing the transfer of personal data by the defendant. These are not intended, according to the court, to serve the interests of the claimant, not even in the sense of a claim for error-free exercise of discretion. The regulations legitimise encroachments on the right to informational self-determination and are intended to provide the public administration with a legal basis for data processing activities and to grant the data subjects subjective rights of defence. The function as a legal basis includes cases in which the public administration decides to satisfy a legitimate interest in informati
In the context of a claim for damages after a surgery at the hospital, the patient refused to sign a document drafted by the insurer of the hospital according to which (s)he would agree to the communication of his/her personal data. The insurance company argued that such communication was necessary for the analysis of the liability of the hospital before any litigation. The Court had to assess whether there was a legal ground under the GDPR to make the communication of the medical data to the insurance company of the hospital compliant with Article 9 GDPR. The court considered that the exception under article 9.2 (f) GDPR could not justify the communication of medical data to the insurer. Indeed, the insurance company did not need the data for ‘the establishment, exercise or defense of a legal claim’ since both parties were only at the negotiation stage. The fact that the hospital chose its insurer as a third party to assess the liability of the hospital cannot also be a ground for such communication. Nor can article 6 ECHR apply to this situation since this article refers to the judicial procedure and does not provide any guarantees for the extrajudicial process.
A minor has been placed under supervision of the Amsterdam Centre for Youth and Family (Stichting Jeugdbescherming regio Amsterdam; the defendant). The mother (plaintiff) requests a copy of the complete file from the defendant containing her personal data. The defendant provides the requested data, but removes some phrases and didn’t provide internal notes. Are internal notes and correspondence containing personal data subject to article 15 GDPR? The court ruled that the plaintiff did not provide enough indications to contradict the statement of the defendant that the removed phrases did not contain personal data. The request to provide the removed phrases is denied. The court rules that the internal notes and correspondence must be qualified as personal thoughts from employees which are only intended for internal consultation and deliberation and therefore can’t be qualified as personal data in the sense of the GDPR. Besides, the purpose of the request is not consistent with the purpose of Article 15 GDPR. The request was made in relation to a family dispute, while the purpose of Article 15 GDPR is to enable data subjects to verify whether their personal data is correct and to verify whether their personal data is processed lawfully. The request is denied.
Different local authorities were exchanging per email the contact details of an applicant asking to access document under the freedom of information act. This processing of personal data was done in order to prevent abuse of the system of access to documents. The plaintiffs asked for damages for violation of the GDPR after he objected to the use of his/her data in this context. The Court had to decide whether the processing was compliant with the GDPR: proportionate, compliant with the data minimization principle, and had a valid ground. The Court held that the processing of personal data in this context was appropriate, proportionate and compliant with the GDPR since there was no other less intrusive way for the local authorities to prevent abuse of the freedom of information act.
The Advocate General Saugmandsgaard Øe issued his opinion on the Bundesgerichtshof’s (Federal Court of Justice, Germany) request for a preliminary ruling on the interpretation of "addresses" in the context of Youtube's & Google's obligation to disclose the email address, the telephone number and the IP addresses used to upload files in breach of intellectual property rights to the holder of these rights.
Data subject and their spouse applied for membership of the Nederlands Israëlitische Hoofdsynagoge (the Dutch Israeli Main Synagogue), the controller, in 2014. On 22 March 2019 data subject requested that the membership of him and his family be terminated immediately and that all personal data be destroyed as soon as possible. They repeated this request 31 October 2019 after having received no substantive reply of the data controller. On the same day, the data controller replied that they did not store the data subject's personal data any longer than required, but that it is necessary to retain their personal data indefinitely, even after termination of the membership, because this personal data is required to verify "halachic status of [data subject's] descendants". Data subject replied that this had no effect to his request. In response the controller said that they would not be granted. On 17 November 2019, data subject filed a complaint with the AP (Dutch DPA). The complaint was still under consideration at the time of this court case. On 19 December, data subject filed a case and requested the District Court to order the data controller to delete their personal data, and pay claimant €1,500 in damages on the basis of Article 82 GDPR. Data subject argued to have had €250 in material damages for the costs of the trial, €500 in immaterial damages because of "loss of control of their personal data", and €750 in immaterial damages because of stress and uncertainty relating to the trial. The District Court rejected all claims. First, the Court held that data subject no longer had any interest in the erasure request, because the controller deleted the personal data before the Court gave its verdict. Furthermore, the Court ruled that the claimed €250 in material damages were legal costs, and, therefore, do not qualify for damage compensation. Moreover, it held that the claim of €750 in immaterial damages is inherent to filing a court case and finds no basis for comp
The applicant requested to delete a previous court decision from the website "rechtspraak.nl" according to Article 17 (1) GDPR, because the applicant claims that he/she could be identified by it and therefore creates a reason to deport him/her. The issue in this case is whether the State is obliged to remove, in whole or in part, the judment of 28 June 2019 of the District Court of The Hague, published in accordance with the anonymisation guidelines, from www.rechtspraak.nl. The court hold that to the extent that the applicant is reasonably identifiable person the applicant cannot obtain the deletion of the data referred to in Article 17 GDPR, because Article 17 (3) (b) GDPR precludes this. By publishing the decision, the District Court of The Hague fulfils its constitutional obligation that judicial decisions must be taken publicly (Article 6 (1) ECHR, Article 14(1) International Covenant on Civil and Political Rights, Article 21 Dutch Basic Law and Article 5(1) of the Law on the Organisation of the Judiciary). Consequently, the applicant does not have the right to incorrect information under Article 17(1) GDPR.
The Appellant filed several Freedom of Information Act requests with the municipality of Borsele; he also filed an access request under the previous data protection law. On 16 August 2016 the municipality responded that they processed the Appellant’s name and address for the purpose of registering his FOA requests and creating, registering and sending FOA-related letters. The municipality also shared his details on the closed forum of the Association of the Municipalities of the Netherlands, but the municipality of Borsele would not let him know the specifics. The State Council heard this dispute on 5 March 2019. The municipality clarified that two messages relating to the Appellant’s request were posted on the forum: one contained the Appellant’s name; another one only mentioned the name of his legal consultancy firm. The Appellant claimed non-material damages resulting from loss of control over his personal data and delays in providing him with the information about the forum messages. The State Council had to assess this claim. The State Council decided that breach of GDPR does not automatically imply an impairment of the integrity of a person which would lead to compensation of damages. The facts that an infringement of GDPR can result in non-material damage and that a data subject must receive full and effective compensation of the damages under GDPR, do not mean that violation of the law always results in damages. The damage caused must be real and certain. The State Council also pointed out that the Appellant has failed to demonstrate that the failure to provide complete information about his personal data processing in a timely manner had caused damages. The claim for compensation was rejected.
The Dutch Council of State ruled on a claim for damages filed by a citizen whose data (name, address and residence) were processed on a forum accessed by the local authorities. This Internet forum was intended to exchange data between municipalities to prevent abuse of the Public Administration Act. The applicant involved, who filed several request to access documents, had not given his/her consent to the processing of her/his personal data on the forum and received information on the processing of these data only at a late stage of the procedure. The Council of State had to determine whether the processing of information on the internet forum access by the local authorities had a legal ground under Article 6 of the GDPR, and whether the lack of information before such processing was in line with the transparency obligations of the controller (the municipal executive of Harderwijk). The Council of State also had to rule as to whether it is competent to grant a compensation for the damage suffered by the individual and under which circumstances. The Council of State ruled that the mention the name of the applicants on the internet forum at the request of another municipality (to ensure the proper implementation of the access to document legislation and to prevent abuse of such legislation) was legitimate and allowed under Article 6 (1) (e) of the GDPR. However, the Council of State (CoS) rules that the municipality did not inform the data subject in good time, which is a violation of the GDPR. As to the claim for damages, the CoS notes that though Article 82(1) of the GDPR states that full compensation for actual non-material damage resulting from breaches of the GDPR must take place in a manner that does justice to the objectives of the Regulation, the GDPR does not specify how the non-material damage is to be determined and calculated. However, the Court of Justice has consistently held that the damage to be compensated must be real and certain.