GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 15 October 2026 · Updated daily
The NGOs, Circle for reflection and proposal of actions on psychiatry (CRPA), The Human Rights League (LDH) and the French organism fight for social welfare (MGEN ASS) brought action for annulment before the Supreme Administrative Court (the Council of State ‘CE’). The complainants requested, inter alia, the annulment of the decree n°2019-412 of 6 May 2019 modifying decree n°2018-383 of 23 May 2018 authorizing the processing of personal data of persons in psychiatric care without consent for monitoring purposes, for misuse of authority. The decree from 2018 (without modification) allows the processing of personal data of persons in psychiatric care without their consent for monitoring purposes. The amending decree adds a further processing which is to inform State representatives of new admissions of persons in psychiatric care without their consent. The same decree states that this other processing is the prevention of terrorist radicalization, within the meaning of the French criminal law. The Complainants argued that that new processing infringed Articles 9, 12, 13, 14, 16 and 17 GDPR. The Court had to assess which legal was applicable and whether the further processing is lawful. The Supreme Administrative Court decided First, on the link between the two processing aforementioned, the Court ruled that the two processing operations constitute themselves one and only operation. It issued that the legal framework applicable to such processing depends on the purpose thus pursued. Secondly, the Court issues that the purpose of such processing to prevent radicalised persons with psychiatric disorders from committing terrorist acts. Thus, the processing is in the field of State Security and Defence and falls outside the scope of Union law, as foreseen in Article 2(2)(a) GDPR. More precisely, the processing is subject to the specific provisions for processing carried out on behalf of the State and relating to State security or defence in the French Data Protection
In 2016, the CNIL fined Google Inc. 100,000 € for failing to comply with de-referencing request on all national versions of its search engine Google Search. Google challenged the decision before the Council of State. The CNIL claimed that the deletion of personal data has to be performed worldwide to provide effective protection of the rights of individuals. Google Inc. claimed that their measures adopted in March 2016 were sufficient. They implemented a mechanism which automatically redirects to the national version used by the data subject and which blocks the access, to delete the content for any Internet user identified as being located in the same territory. First, the Council of State recalled that the alleged breach of Google Inc. must be judged in accordance with the applicable law, back in 2016. Then, in the lights of the preliminary ruling, [http://curia.europa.eu/juris/document/document.jsf;jsessionid=16464B0169F79B4108F764FA1F804123?text=&docid=218105&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=3004072 C-507/17], the Council of Stated issued that Google Inc. took sufficient and appropriate measures, and that the de-referencing obligation has to be implemented at the European level. C-507/17 ruling : "where a search engine operator grants a request for de-referencing pursuant to those provisions, that operator is not required to carry out that de-referencing on all versions of its search engine, but on the versions of that search engine corresponding to all the Member States, using, where necessary, measures which, while meeting the legal requirements, effectively prevent or, at the very least, seriously discourage an internet user conducting a search from one of the Member States on the basis of a data subject’s name from gaining access, via the list of results displayed following that search, to the links which are the subject of that request", Finally, the Court pointed out that the French government did not adopted any special p
It was announced to the complainant that he will be placed on the Top-X list. This is a list compiled by the Safety House, a partnership between municipalities, the police, the Public Prosecution Service, the Custodial Institutions Service and a large number of civil society organizations, including names of persons or groups that cause nuisance or crime. In response to this, the complainant requested the mayor to remove him from the list and to give him access to all personal data relating to him under the Security House. The mayor has explained how the personal data of the complainant has been processed by the Safety House and has given access to his personal data from the Probation Service, Public Prosecution Service and the digital recording thereof by the Safety House for the Top-X registration. The mayor has also given partial access to his personal data in the Safety House Registration Form. The mayor has refused the access to what the mayor designates as him concerning police data and consultation reports from the Security House. The question was whether the mayor should have given the complainant access to the personal data concerning him from the police. The Council of State confirmed that the mayor should not have given the complainant access to the personal data concerning him from the police. According to the Dutch Police Data Act, data protection rules do not apply to the processing of personal data for the purpose of performing the police task. The fact that the police have shared the personal data with the mayor in the context of the Security House does not mean that there is no longer any police data. It follows from the Police Data Act (Article 1 (a)) that any personal data processed in the context of the performance of the police task must be regarded as police data.
In October 2017, a citizen, the Applicant, submitted applications for a legal aid aimed at lodging an appeal against a municipality. To support its application, the Applicant submitted additional judgements which include personal data about him. One of the document was the first instance judgement. In May 2018, the Applicant asked to the Board of the Legal Aid Council, the Defendant, the deletion of the judgements attached to the applications. The Defendant claimed that they needed those judgments to assess whether they could grant the legal aid. They claimed that the processing was necessary for the performance of a task carried out in the public interest. They argued that the applicant should submit judgements linked to the proceeding concerned by the legal aid application, to have a satisfactory understanding of facts. The Applicant claimed that the judgements have been attached to the application for attachment without his consent and there were unlawfully processed. He also claimed that information about the mental health status was included in those judgements and that it was not necessary for the Defendant to store them for ten years. Τhe Court had to assess whether the legal aid council was required to delete the information about the mental health status of the plaintiff according to Article 17(1)(d) GDPR. The Court recalled that deletion request under Article 17(1)(d) must be granted if the personal data have been unlawfully processed. In the present situation, the Court issued that the personal data were processed for the performance of a task carrier out in the public interest, under Article 6(1)(e) GDPR. It stressed out that Article 6(1)(e), read in conjunction with 6(3), in the lights of Recital 41, the basis for the processing does not necessarily have to be laid down in a legislative act, but it must be” clear and precise and its application should be foreseeable to persons subject to it”. In this regard, the Court hold that the application for
The defendant offers a medical service, in which - as in the case of the plaintiff - social data in the form of health data can be processed on the basis of the request from his/her health insurance company. Since the plaintiff´s colleagues and the plaintiff are working for the IT department, his colleagues received knowledge of the plaintiff´s health data. Whether the defendant has taken appropriate and specific measures in accordance with the German Federal Data Protection Law and Art. 9 GDPR to protect health data from unauthorized access from employees. The court emphasized that the physical examination of an employee represents a significantly more serious intervention in the personality sphere of the employee than an assessment based on the file. This differentiation meets the requirements of Section 22 (2) of the German Federal Data Protection Law (“BDSG”). In the context of Art. 9 Para. 2, 3 GDPR in conjunction with Section 22 Para. 2 BDSG, there are appropriate and specific measures required. One is that only professional personnel who are subject to professional secrecy may process the health data. This is the case here due to medical and social secrecy. This is not sufficient within the meaning of Section 22 (2) BDSG, but this must be included in the assessment, whether the defendant has taken appropriate and specific measures. The access within the defendant is restricted through technical and organizational measures (Section 22 (2) No. 5 BDSG). The personal data is only accessible to people who need it to perform their tasks. The access rights are determined by assigning rights and roles related to the occupational groups. The access authorization is again divided according to the occupational group-specific role for the 36 employees of the area the plaintiff is belonging to. The court decided that the IT department is uniform and indisputable for the responsibility for the entire protected area. Further protection is granted since the access
The plaintiff was born in the Republic of Turkey. His birth was first recorded in the civil status register in the district of Kayseri as 01.01.1956 and later corrected to 01.01.1958 (following a ruling of the District Court Sarız in 1971). When moving to Germany in 1971, the plaintiff stated 01.01.1958 as his date of birth. This date was entererd into defendant's register of residents. In 2015, after the discovery of new documents by the plaintiff the District Court of Kayseri ruled that the plaintiff's date of birth in the civil status register in the district of Kayseri would be corrected to 01.01.1953. The plaintiff also received a new Turkish passport showing that date. Subsequently, the plaintiff requested the defendant to change his date of birth to 01.01.1953, which was rejected due to lack of certainty on the plaintiff's actual date of birth. After the plaintiff's objections to this rejection were dismissed by the Karlsruhe Regional Council, the plaintiff filed a complaint with the Administrative Court of Karlsruhe, which ordered the defendant to correct the plaintiff's date of birth recorded in the register of residents from 01.01.1958 to 01.01.1953. The defendant appealed againts that decision. Two disputes werde adressed from a data protection perspective: 1) What is the legal basis for a request for rectification of an entry in the register of residents if the request has been submitted before the GDPR entered into force but has not yet been decided on as valid or legally binding? 2) What are the consequences if the plaintiff requests the rectification of an entry in the register of residents and it is not possible to clarify when the plaintiff was actually born ("non liquet")? Does this entitle the plaintiff to (i) restriction of processing pursuant to or analogous to Article 18 (1)(a) GDPR, (ii) the entry of the date of birth claimed by the plaintiff or (iii) the replacement of his year of birth by the sequence of numbers "0000"? The Court held
In September 2018, a traffic offence was committed with the vehicle registered to the applicant. A witness questionnaire sent to him remained unanswered, and during a telephone interview in November 2019, the plaintiff stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons. In a later hearing, the plaintiff informed the police that an electronic driver's logbook existed, but that the consent of the data subject had to be obtained in each case for the data to be passed on, even in administrative offence proceedings. With regards to former employees, this proved to be difficult. The District Office of Freyung-Grafenau then obliged him by notice to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after expiry of the period for which it must be kept. The plaintiff challenged this decision before the Regensburg Administrative Court, but the challenge was unsuccessful because the court was of the opinion that the decision did not violate the GDPR and was also not disproportionate. In September 2018, a traffic offence was committed with the vehicle registered to the applicant. A witness questionnaire sent to him remained unanswered, and during a telephone interview in November 2019, the plaintiff stated that he recognized a former employee, but refused to disclose her personal data for data protection reasons. In a later hearing, the plaintiff informed the police that an electronic driver's logbook existed, but that the consent of the data subject had to be obtained in each case for the data to be passed on, even in administrative offence proceedings. With regards to former employees, this proved to be difficult. The District Office of Freyung-Grafenau then obliged him by notice to hand over the logbook to the District Office for inspection at any time upon request and to keep it for six months after expiry of the period for which it must be kept
The parties argue about data protection information and information, the issuing of copies and compensation. # on the conditions and fulfilment of the right to information under Article 15 (1), (2) of the DS-GVO in the employment relationship # the right to be granted a data copy under Art. 15 (3) DS-GVO can be objected to on the basis of the principle of good faith that the effort and expense of the person responsible is grossly disproportionate to the claimant's interest in performance. # the conditions and assessment of a claim for compensation for non-material damage under Art. 82(1) DS-GVO, here in the case of a breach of the right to information under Art. 15(1) DS-GVO # Order the defendant to provide the applicant with information on the following questions: :# the purposes for which the personal data of the plaintiff have been processed since 07.06.2018 and :# the categories of personal data processed # order the defendant to pay the applicant EUR 5 000 plus interest at 5 percentage points above the base rate since 9 October 2019 # for the rest, the action is dismissed. # the plaintiff is ordered to pay the costs of the lawsuit. # the amount in dispute in the decision: € 152,982.81 # the appeal is allowed for both parties.
In the context of a litigation with his brother, the applicant requested access to a series of banking information to ABN AMRO, which refused to grant access to these data. Court of Appeal is of the opinion that the documents as such could not be qualified as personal data within the meaning of the Wbp and the AVG: the requested data mainly relate to information regarding persons working at ABN AMRO, the question as to which persons had access to certain data and the question as to why, when and by whom the acts referred to by [Appellant 1] were performed. He also requested a large number of reports of telephone conversations and e-mail correspondence. On the basis of the CJEU case-law in Y vs MS and the Supreme Court, it cannot be said that such data can be regarded as personal data, since these (internal) documents relating to certain acts of ABN AMRO are not in themselves data about [Appellant 1], and these documents as such cannot be checked or corrected by [Appellant 1]. Therefore, ABN AMRO cannot be obliged to grant access to or a copy of these documents by invoking the Wbp and the AVG.
The plaintiff visited a school in Berlin where a record with notes from teachers about his behavior was created. The school record contains his insulting statements to classmates and teachers and notes because of disrupted teaching. The student changes the school recently. Were the requirements of Article 17 GDPR fulfilled and would the defendant require to delete the school record? Article 17 (1) (a) GDPR grants a right to delete personal data, if the purpose for which the personal data was collected no longer exists and further storage is no longer necessary. The court did not see such a loss of purpose in this case. The VG held the applicable school regulation against the student and his parents. It stipulates that a change of school does not justify a loss of purpose. According to the school regulation the processing of personal data relating to pupils and legal guardians is necessary for the school to perform its tasks. This applies in particular to students' breaches of duty in order to be able to take the appropriate pedagogical measures and compare them with their effects in the past. The concerned school record shall be kept during the mandatory school period according to the school regulation. Since the student is still obliged to go to school, it can be assumed that the documents collected will continue to serve their purpose. Furthermore, the applicants have not made it credible that the personal data within the meaning of Article 17 (1) (d) GDPR were processed illegally.
The defendant had offered tires for instant purchase on the website eBay where he had not provided potential buyers with information about the processing of their personal data in case of a purchase according to Article 13 GDPR. Therefore, the plaintiff, as representative trade-association of those potential buyers, lodged a complaint with the competent jurisdiction, demanding that the defendant be summoned to provide the missing information since the sell was otherwise to be considered inadmissible. Is the absence of information, such as required by Article 13 GDPR, to be considered as an unfair trade-base action, making the offer inadmissible in accordance with § 3 UWG (national law against unfair competition)? After admitting the right of action of the plaintiff as representative association of consumers’ rights, the Court points out that the absence of information of Article 13 GDPR constitutes a violation of the law and, as such, an unfair trade-base action as understood by § 3 of the national law against unfair competition (UWG). As long as the defendant does not provide the missing information, the offer is therefore to be considered as inadmissible.
The applicant brought an action against the defendant in the Ljubljana District Court, requesting that the defendant, a Bank, provide him with all identifying information about the recipients of transfers made against a particular transaction account held by the claimant's debtor. The District Court ruled that it had no material jurisdiction and remitted the case to the Administrative Court by referring to the Data Protection Act (ZVOP-1) and stating that the applicant acts as data subject and the defendant (bank) as a data controller. The claimant modified its claim. The Administrative Court dismissed the action. The dispute regarded the competence of the Administrative and District Court. The question was whether it is a private-law dispute between two civil persons, or a dispute which the administrative court is competent to decide as a specialized court. The Supreme Court found that the District Court of Ljubljana is competent to decide the case. As to what is important to us ZVOP is not applicable because both the plaintiff and the defendant are companies.
The plaintiff is a veterinarian and has concluded a billing contract and a contract processing agreement (under Article 28 GDPR) with the clearing house for veterinarians (VTX). In case of default of payment, the VTX becomes owner of the claim (assignment of claim) in order to enforce it. The pet owner's data are transmitted to VTX for accounting purposes and the possible enforcement of claims before VTX declares its acceptance of an assignment of claims. This is done without the (explicit) consent of the pet owner. After a pet owner failed to pay a ~EUR 1.000 treatment invoice of the plaintiff, the claim was assigned to the VTX without the pet owner's consent. The pet owner filed a complaint with the competent supervisory authority (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz – LfDI) which issued a warning under Article 58(2)(b) GDPR, holding that the data transmission from the plaintiff to the VTX did not meet the requirements under the GDPR. Moreover, the LfDI asked the plaintiff to confirm that in the future, he would transfer data of pet owners to VTX only with their prior consent. The plaintiff filed an action against that decision, stating in essence that the transmission of accounting data to the VTX was based on Article 6(1)(b) and (f) and Article 6(4) GDPR. Since the assignment was only completed upon acceptance by VTX, data transfers which - as here - took place before the declaration of acceptance were to be regarded as data processing on behalf of the plaintiff. Further, the plaintiff argued that the data transferred constituted health data under Article 9(1) and Article 4(15) GDPR but the transfer was nevertheless admissible pursuant to Article 9 GDPR, as the strict requirements of Art 7 DSGVO could not generally be observed in treatment contracts with doctors and were therefore systematically inappropriate. Three disputes werde adressed from a data protection perspective: #Does the transmission of a pet owner'
The parties are lawyers; they are engaged in expedited proceedings for injunctive relief under unfair competition law. On 29 October 2019, the defendant addressed a letter to the Board of Directors of the Bar Association of city 1 , enclosing copies of several writs of the applicant and pointing out the suspected unethical conduct. In order to defend himself against this action, the applicant has now submitted a motion to refrain from submitting his personal data to the Bar Association. In January 2020, the regional court did not grant the application, also on the grounds that there could be no violation of the GDPR for the simple reason that the members of the bar association are bound to secrecy. This circumstance is now the subject of the present appeal. The court ruled that the appeal was unsuccessful. On the one hand, courts are authorised and, also obliged to communicate personal data ex officio to public bodies for purposes other than those of the proceedings for which the data were collected; Section 25 German Data Protection Act forms the legal basis for this. This also includes requests for arrest as well as - on an equal footing with them - also requests for injunctions as a duty to notify the competent bar association. Article 6(1)(f) GDPR does not permit such transmissions pursuant to Article 6(4) conjunction with Article 23(1) GDPR. Furthermore, the court ruled that request for an injunction is also unfounded, as there is no right to an injunction. The Regional Court had rightly rejected a claim for injunction under Section 3a of the Unfair Competition Act in conjunction with Article 79(1) GDPR. It remains to be seen whether infringements of the GDPR can be asserted by competitors at all, or whether the GDPR does not, rather, conclusively regulate the legal consequences of infringements. In any case, there is no business act within the meaning of § 2 I No. 1 Unfair Competition Act. A claim for injunction by the applicant as a competitor directl
In August 2018, the DPA received a complaint from a customer (the data subject) regarding a liquor store (the controller). According to the complaint, the store had required this person to let them scan their electronic ID in order to issue a customer card. After an investigation, the DPA concluded that the controller had breached the GDPR. More specifically, according to the DPA the controller: 1. Did not have a valid legal basis for processing. Consent was not freely given because no alternative was offered to the complainant, in violation of Article 6(1) GDPR; 2. Did not provide the complainant with enough information prior to the processing, in violation of Article 13 GDPR; 3. Processed more personal data than necessary, including national ID number, date of birth and gender, in violation of Article 5(1)(c) GDPR. The appeal against the DPA's decision was based on 9 points, among which was the claim that the DPA violated Article 52(1), Article 54(2) and Article 82(2) GDPR. Most importantly, the controller challenged two of the three findings of the DPA, which had led to the fine: the absence of a valid legal basis for personal data processing and the breach of the data minimization principle. They did not contest the lack of information. The Court annulled the DPA’s decision as it was insufficiently reasoned and based on a legislation that was not applicable at the time of the complaint. The Court did not have the power to order the DPA to pay back the fine, as that falls outside of its jurisdiction, but it did quash the decision imposing the fine. The Court held that, first, the DPA had no evidence to support the finding that the controller was actually processing the national ID number of the data subject. Second, the controller was not obliged to give the data subject an alternative way of creating a discount card because the relevant provision of the e-ID law was not applicable at the time. Thirdly, the Court found that no personal data processing took
The plaintiff, data subject, argued that the defendant, data controller, had violated their rights by processing information about their political opinions, a special category of personal data prohibited from processing in accordance with article 9 GDPR, thus causing non-material damage to them. Therefore, the plaintiff exercised their right to receive compensation resulting from article 82(1) GDPR, asking for the data controller to be held liable for the damage caused to them by the data processing which infringed the GDPR. Should a breach of GDPR provisions by a data controller be automatically considered to have caused a damage for the data subject whose data was processed unlawfully, thus granting them the right to compensation as set out in article 82(1) GDPR? = The plaintiff argued incorrect legal assessment of the case by the by the LG Feldkirch. Also, he argued that substantial facts of the case had not been established by the LG Feldkirch and that he should have been awarded the whole amount that he sued for (€ 2.500). = The defendant also argued incorrect legal assessment of the case, as - in its point of view - there had been no processing of special categories of personal data and no actual (emotional) damage occured. It argued that the plaintiff had failed to state, why and in what regard he had actually sufferd emotional damages. Consequently, the LG Feldkirch had only found, that certain GDPR provisions have been violated, but had not establised what acutal emotional damage the plaintiff had suffered. The OLG of Innsbruck rejected the claim and gave reason to the data controller, holding that the data subject had not sufficiently proved that they had suffered of a non-material damage caused by the infringement of the GDPR. The data subject should have been able to cumulatively prove the disadvantage in life and the impairment of personality rights that the breach of the law by the data controller caused for them. Only then could it have been con
The digital tool called System Risk Indication (SyRI) is used by central and local Dutch authorities to prevent and combat fraud in the areas of tax and social security. It carries out different processing operations on personal data. SyRI gathers large-scale data and generates risk notification about people likely to commit fraud, which is called “risk report”. These risk reports have significant consequences on citizens' life; they indicate s that a specific person is worthy of investigation related to fraud. A number of civil society organisations and citizens sued the State claiming that SyRI violates fundamental rights. The Sate argued that SyRI provides sufficient guarantees for protecting the human right to privacy. The litigation raised numerous issues related to International and European Law, mainly the violation of Article 8(2) ECHR which allows interferences with the exercise of the right to respect for private and family life by a public authority under three conditions: it must be provided by law, be necessary in a democratic society and pursue interests such as the prevention of disorder or the economic well-being of the country. Nevertheless, this summary will focus on the protection of personal data and the interplay between the new technologies and the ECHR. The Court had to pronounce itself on whether the processing of personal data by the digital tool SyRI falls within the scope of Article 8(2) ECHR. It assessed whether SyRI was prescribed by law and under which conditions to know if it was necessary for the pursue of the prevention of fraud within a democratic society. Thus, it addressed importantly the interplay between Article 8 ECHR and EU law, including the Charter and the GDPR for the purpose of the assessment of the interference in private life under the ECHR. Focusing on data protection, the Court focused on the processing operations in the context of the deployment of the SyRI and the technical safeguards contained in the tool. It r
The complainant wanted the Dutch DPA to open an investigation concerning (1) identification issues when handing in an anonymous chip card and being reimbursed the sum; (2) a perceived attempt to mislead the complainant as a customer that identification would be mandatory when purchasing tickets at the station counter for all international train journeys within the EU; and (3) charging service costs when topping up an anonymous public transport chip card using cash. The dispute in front of the court was whether the decision to reject the investigation for the three issues was sufficiently grounded. The court assessed each of the three issues seperately. The first issue was whether the DPA sufficiently investigated whether the costumer was identified on reimbursement of the balance of a non-registered OV chip card. The court highlighted that the Dutch DPA showed in the investigation that it was not a policy of the Dutch Railways to record personal data, and that the issue of privacy was brought to the attention of employees during courses and training. In addition, Dutch Railways explained that their computer system did not allow personal data to be recorded when a non-registered public transport chip card was returned. Based on this, the Dutch DPA was able to conclude that the Dutch Railways acted sufficiently adequate with their policy and did not record any personal details of the identification shown. As such, the Court found the issue to be sufficiently investigated. The second issue was whether the DPA sufficiently investigated the procedure for purchasing an international train ticket. The court highlighted that according to the employee handbook, a customer buying an international ticket is not required to give up personal data. The complainant highlighted that the employee in fact asked for personal data when the complainant bought a ticket. However, as noted by the DPA, a deviation from the handbook by one of the employees was not sufficient to lau
The claimants requested the disclosure of specific "Norwich Pharmacal" Court Orders as foreseen in the civil procedure law, the court law and other national provisions. The defendant raised an objection based on the Data Protection Act 125(I)/2018 and other national provisions, claiming that the requested disclosure would include personal data and that the claimant didn't prove any public interest which would override the bank confidentiality binding the defendant. As to what is relevant from a data protection point of view, the District Court of Nicosia found that there is public interest in the disclosure of personal data when this is needed for justice to be dispensed by the courts. Therefore, the Court approved the request for disclosure.
Ιn the course of disciplinary proceedings, it had become known that information about the applicant, had been queried in the database. Among other things, the police officer had requested information about which data had been queried by which police officer and for what reason within the last two years. This request was last rejected on 15.03.2019 on the grounds of the protection of personal data and the alleged pursuit of private interests. Thereupon, the police officer filed a complaint with the Administrative Court of Berlin. The Court considered the action to be admissible and well founded: The defendant's contested decision was unlawful and infringed the applicant's information rights. The legal basis for this is § 3 paragraph 1 of the Gesetz zur Förderung der Informationsfreiheit im Land Berlin (Freedom of Information Act for the State of Berlin - IFG Berlin). According to this law, every person has the right to inspect the content of the files kept by a public body mentioned in § 2 IFG Berlin or to obtain information about their content. The Court ruled that the policemen, as a natural person, belongs to the group of entitled persons and that the police commissioner, as an authority of the Land of Berlin, is to be regarded as a public body obliged to provide information under § 2 IFG Berlin. In addition, the evaluation of the data protocol “in written or electronically recorded records” constitutes a file within the meaning of §3 paragraph IFG Berlin. The Court also did not see the reason for exclusion under §6 IFG Berlin, according to which there is no right to inspect or obtain information about files if personal data are published and there are factual indications that the inspection or obtainment of information predominantly pursues private interests. Although § 6 of the IFG Berlin gives priority to the protection of personal data over the interest in information, the Court considers that, in view of the disciplinary proceedings conducted against t