GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
EasyJet Airlines Spain (the controller) is an airline company. In 2024, Unión Sindical Obrera-Sector de Transporte Aéreo (USO-STA, a trade union in the aviation sector) brought a case against the controller to the High Court. The controller published a seniority list on its intranet, as an obligation from its collective bargaining agreement with SITCPLA (Sindicato Independiente de Tripulantes de Cabina de Pasajeros, also a trade union). This list was made for the purpose of regulating access and organising promotions and changes of contract. The controller pseudonymised the identities of the data subjects, replacing their names with a number. The USO-STA requested the court to order the controller to publish the full names of the data subjects, as it considered that the controller did not fully comply with the collective bargaining agreement. According to USO-STA, this obligation complied with the GDPR, because the controller processed data under the legal basis of legal obligation (Article 6(1)(c) GDPR). The High Court dismissed the case on procedural grounds. According to the court, there was no current and real litigious interest, as the controller fulfilled its obligation in relation to the collective bargaining agreement. The court considered the manner in which the controller did this (pseudonymising the data) irrelevant. The trade union appealed the case to the court. The controller argued that it complied with the collective bargaining agreement, and that it pseudonymised the data to comply with the principle of data minimisation (Article 5(1)(c) GDPR) and CJEU case lawSee case C-65/2023 (MK v K GmbH), https://infocuria.curia.europa.eu/tabs/jurisprudence?lang=en&sort=DOC_DATE-DESC&searchTerm=%22c-65%2F23%22&publishedId=c-65%2F23. In addition, the controller argued that the pseudonymised data allowed data subjects to see their relative position within the company. The court first clarified that the case was admissible, as there was a potential conflict bet
In 2018, the French non-profit organisation La Quadrature du Net filed a complaint against Amazon (the controller). The organisation claimed that Amazon could not rely on the legal basis of legitimate interest for processing personal data for targeted advertising. It also claimed that Amazon failed to respect several rights of the data subjects. On 15 April 2019, the Luxembourg Data Protection Authority (CNPD) opened an investigation as the lead DPA under the cooperation mechanism. The CNPD examined whether Amazon had a valid legal basis under Article 6 GDPR and whether it complied with transparency obligations and data subject rights under Articles 12 to 17 GDPR and Article 21 GDPR. On 15 July 2021, the CNPD adopted a decision finding multiple infringements of the GDPR. It held that Amazon did not have a valid legal basis for behavioural advertising under Article 6(1) GDPR at the time of the investigation. The CNPD also found breaches of transparency obligations and failures to respect the rights of data subjects, including the right of access, the right to erasure, and the right to object. The CNPD imposed an administrative fine of €746,000,000. It also ordered Amazon to bring its processing operations into compliance within six months and imposed a periodic penalty payment in case of non-compliance. Amazon challenged the decision before the Administrative Court (Luxembourg), arguing that the CNPD violated procedural rules, including the right to a fair procedure, the right of defence, and the principle of impartiality. Amazon also argued that the CNPD exceeded the scope of its investigation and denied access to parts of the file. On the merits, Amazon claimed that it could rely on Article 6(1)(f) GDPR (legitimate interests) and that it had complied with transparency and data subject rights obligations. The Administrative Court rejected Amazon’s action and upheld the CNPD’s decision. Amazon appealed to the higher Administrative Court. In its judgment of 12 March
An insured person (the data subject) lodged a complaint with a DPA in March 2019 against a mutual health insurance association (the controller) that offered screening and preventive programs for i.e. diabetes, asthma and back problems. The data subject stated the controller had violated Articles 5(1)(a), 6(1) and 9(1) GDPR by analysing invoices containing health data of its insured persons for reimbursement in connection with offering individualised preventive programs without first obtaining consent. The DPA issued the controller a reprimand in February 2022 and ordered it to only carry out such processing operations based on consent. The administrative court revoked the DPA decision in March 2023 in response to the appeal brought against it. The higher administrative court dismissed the DPA’s subsequent appeal in June 2024. It considered the challenged DPA decision to be materially unlawful: the court held that the processing was necessary for the purposes of preventive medicine and thus fell under the exception to the prohibition of the processing of sensitive categories of personal data in Article 9(2)(h) GDPR. The DPA appealed the court’s decision to the German Federal Administrative Court. The dispute before it concerned whether the processing operations carried out by the controller were covered by exception in Article 9(2)(h) GDPR and whether there was a legal basis for the processing operations under Article 6(1)(f) GDPR. The German Federal Administrative Court held that the exception in Article 9(2)(h) GDPR was applicable to the processing operations in connection with the screening and preventive programs offered by the controller. The court amended the judgments of the lower courts and dismissed the controller’s claims. The DPA’s appeal was justified. First, the court found that Article 9(2)(h) GDPR was applicable to the present case despite the fact that the controller did not directly provide the health-related services itself, but only arranged the
In September 2023, the Bulgarian Public Prosecutor’s Office brought a criminal case against a data subject to the Sofia City Court. According to the Prosecutor’s Office, the data subject bribed police officers, and worked as a taxi driver without the necessary license. During the proceedings, the court requested personal data from the data subject in order to verify their identity. While a data subject can be identified with their identity card, national law requires national courts to ask further questions to further verify the data subject’s identity.Article 272(1) of the Bulgarian Code of Criminal Procedure (NPK). See [https://www.dato.bg/docs/Criminal_Procedure_Code-%D0%9D%D0%B0%D0%BA%D0%B0%D0%B7%D0%B0%D1%82%D0%B5%D0%BB%D0%BD%D0%BE-%D0%BF%D1%80%D0%BE%D1%86%D0%B5%D1%81%D1%83%D0%B0%D0%BB%D0%B5%D0%BD%20%D0%BA%D0%BE%D0%B4%D0%B5%D0%BA%D1%81.pdf here]. The court had doubts on the compatibility of said national law provisions with the Bulgarian Constitution, and stayed proceedings. In addition, the court had doubts on whether requesting additional information (e.g. place of birth, ethnicity, or marital status) is necessary, and whether the national provisions are consistent with [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016L0680 Article 10 of the Law Enforcement Directive (LED)]. The court referred the matter to the Constitutional Court. The Constitutional Court refused to give a substantive ruling, and the court therefore requested a preliminary ruling from the CJEU. The AG first stated that the data processing fell in the scope of the LED in accordance with [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016L0680 Article 2(1) LED]. The LED is applicable if the data processing is carried out by a competent authority ([https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016L0680 Article 3(7) LED]) and for the purposes listed in [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016L0680 Article 1(
In 2024 the federal Data Protection Authority (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, or BfDI) requested access from the Federal Intelligence Service (BND, the controller), to ensure that their activities complied with data protection law. The request related to the controller’s processing of foreign data subject’s communications. The controller refused this request on the grounds that the Independent Supervisory Board (UKR) had exclusive jurisdiction to review the case. The BfDI filed a complaint with the Federal Chancellery (the highest federal authority responsible for the controller), who rejected the claim. The BfDI brought a case to the Federal Administrative Court. The BfDI requested the court to order the controller to provide access, or alternatively, to declare that the controller violated the BfDI’s right to access under national law. On the other hand, the controller requested the court to dismiss the case. The court dismissed the claim on procedural grounds, stating that the BfDI did not have standing under national law. The court dismissed both claims of access and declaratory judgment. The court dismissed the BfDI’s argument regarding its standing based on a constitutional requirement for effective supervisory control. The court drew a distinction between the BfDI invoking a subjective public right as a public authority in comparison to a citizen. The court first clarified that this case falls outside of the scope of the GDPR, in accordance with Article 2(2)(a) GDPR. In these situations, national law provisions did not allow the BfDI to directly intervene against the controller for the purpose of data protection oversight. Instead, the BfDI must file a complaint with the competent supreme federal authority. This limitation must not be circumvented through the court proceedings. The court considered that the BfDI has sufficient powers to contribute to remedying situations it deems unlawful by raising an objection to the F
The data subject filed a complaint with a DPA on 18 June 2024 under Article 77 GDPR. The complaint concerned a controller established in another Member State and alleged an incomplete response to an access request under Article 15 GDPR. The DPA did not issue a decision within six months. On 26 August 2025, the data subject lodged a complaint with the court, claiming that the DPA had failed to comply with its obligation to decide within the statutory deadline. The DPA argued that the case involved cross-border processing and that another supervisory authority acted as the lead authority under Article 56 GDPR. It further stated that the decision deadline was suspended due to the cooperation procedure under Article 60 GDPR. The DPA formally transmitted the complaint to the lead authority on 22 October 2025. First, the court held that the case concerned cross-border processing within the meaning of Article 4(23) GDPR. Therefore, the cooperation and consistency mechanism under Articles 56 and 60 GDPR applied, making the foreign supervisory authority the lead authority. Second, the court considered that, in such cases, the competence to issue a final decision depends on the outcome of the cooperation procedure. It noted that only the lead authority can adopt binding decisions concerning cross-border processing, while other DPAs act as concerned authorities. Third, the court held that the decision period under national law was suspended pursuant to § 24 DSG during the cooperation procedure under Articles 56 and 60 GDPR. The court clarified that this suspension applied automatically from the moment the complaint was filed, not only after the formal initiation of cooperation between authorities. Finally, the court concluded that the DPA had not failed to act within the required time frame. As a result, there was no violation of the duty to decide, and the complaint was dismissed.
In 2023, the French Data Protection Authority (CNIL) fined Criteo, an advertising company (the controller), €40,000,000 for breaches of the GDPR related to the processing of browsing data through cookies for the purpose of placing personalised advertisements. The decision followed complaints lodged by Privacy International and noyb. The DPA found violations of Article 26(1) GDPR and Article 26(2) GDPR based on the lack of a joint controllers' agreement with its partners, Article 7(1) GDPR by processing user data without consent, Article 7(3) GDPR and Article 17 GDPR by failing to erase data subjects’ personal data based on their requests, and Article 12 GDPR, Article 13 GDPR, and Article 15 GDPR by failing to inform data subjects of the processing of their personal data. The controller appealed the decision asking for its annulment or, alternatively, the reduction of the fine. First, the Council of State (the court) held that the controller processed personal data since the identification of individuals would not be technically impossible based on the very large amount of information, sometimes very precise, collected and cross-referenced for a given identifier assigned to each data subject. Secondly, the court noted that the controller did not contest the DPA’s findings regarding the lack of a joint controllers' agreement. Thirdly, it found that the DPA’s conclusion regarding the violation of Article 7(1) GDPR did not disregard the principles of legality of offenses, presumption of innocence and exclusion of liability for others in criminal matters. Fourthly, it dismissed the argument that the contested decision was based on error of fact and assessment regarding the information provided to data subjects on the purposes for which their data were processed. Finally, the court noted that the controller could not rely on legitimate interest for continuing to process the data of data subjects who requested their erasure. Therefore, the court dismissed the cont
Reddit BV (the controller) is a social media platform. In March 2025, the Dutch DPA initiated an ex-officio investigation into the controller’s data processing activities. This investigation began as a result of media coverage revealing that the users’ public content was shared or sold to train developers’ AI models. While the DPA initially limited its investigations to Articles 6, 13 and 21 GDPR, it later widened the research to include Article 5 GDPR, and considered hearing personnel from the US. During the investigations, the controller objected to the DPA’s requests for information, and later ceased cooperating on the grounds that the DPA had not provided clear explanations on the reasons behind the investigation. In addition, the controller argued that the DPA had access to incorrect or unlawfully obtained information (including from a former employee seeking legal advice after copying confidential information), which it was not allowed to verify during the investigations. Some of the information the controller objected to was covered by legal professional privilege, which the DPA obtained through a procedure designed for this type of information. The DPA later informed the controller that it will impose a fine for refusing to grant it access to the necessary information during its investigations, in violation of Article 31 GDPR. The controller brought a case to the court in January 2025. The controller requested the court to order the DPA to provide information regarding the confidential information it had obtained, or alternatively, allow the controller to seize the evidence obtained by the DPA for potential future litigation. The controller later amended the request, asking the court to order the DPA to ensure the controller's right to refuse to give evidence. Finally, the controller requested the court order(s) to be subject to a €1,000,000 fine for noncompliance. The DPA requested the court to declare the controller’s case as inadmissible, as there was n
The case involves the use of 'M Pixel' to track users without consent, related to third-party tracking cookies.
In 2021, the Dutch Tax Administration informed a data subject that they were unlawfully included in its database (the Fraud Signalling System, FSV). The use of the FSV did not comply with the GDPR; some data subjects’ data were unlawfully processed, too many employees had access to the data, and the data retention periods were too long. The data subject made an access request, and also requested their data to be rectified and erased under Articles 16 and 17 GDPR respectively. In 2022, the Minister of Finance (the controller) rejected the rectification and erasure request. The data subject brought a case to the District Court of Noord-Holland, who ordered the controller to comply with the data subject’s erasure request within one month of the ruling. The controller appealed the decision to the court, arguing that they did not have the obligation to erase the data under Article 17(3) GDPR. The court reversed the decision of the District Court, and stated that the controller had the right to dismiss the data subject’s rectification and erasure request. Article 16 GDPR is limited to incorrect or incomplete personal data, and the data subject did not specify in what way their data was incorrect or inaccurate. According to the court, the data subject wished to clear their name through the rectification request, which is not provided for under the GDPR. In terms of Article 17 GDPR, the court considered that processing the personal data was provisionally necessary in the public interest for the purpose of remedying the unlawful adverse effects of the FSV. Therefore, the decision to deny the data subject’s erasure request was proportionate despite the fact that said data was processed unlawfully. The court also considered the measures the controller had taken to limit the further processing of the data subject’s data.
The Financial Ombudsman’s office (the controller) sent a letter containing the name, the address, and the case reference number of a customer (the data subject) to 28,366 public institutions and entities registered on an official government platform in February 2021. The data subject demanded compensation for the unauthorised disclosure of his personal data from the controller in November 2021. The controller refused to accept liability for the incident. The supervisory authority issued the controller a reprimand in September 2022 for disclosure of personal data in violation of Article 6(1) GDPR. The data subject brought a lawsuit for damages under Article 82 GDPR before the Regional Court in Warsaw in August 2023. The data subject stated that they had experienced severe stress and lost the sense of security and control over their data as a result of the unauthorised disclosure of the letter. The controller argued it was not at fault for the incident as it was caused by a temporary IT system failure that the controller could not have foreseen. The Regional Court in Warsaw held that the controller was undoubtedly liable for the unauthorised disclosure of the data subject’s personal data pursuant to Article 82 GDPR: the controller was an administrator for the government platform and had not taken adequate measures to secure the data. Second, the court held that the data subject had suffered non-material damage in connection with the aforementioned incident. It took into account that the data had been disclosed to numerous entities. In addition, the deterioration of the data subject’s mental state was confirmed by a witness. The court awarded the data subject PLN 40,000 in damages. It considered the data subject’s claim of PLN 50,000 to be excessive in light of established case law.
A data subject requested access to personal data processed about him, contained in an advice report from t[https://www.riec.nl/site/binaries/site-content/collections/documents/2014/01/01/corporate-brochure-riec-liec-engels/Corporate+brochure+Engels.pdf he Regional Information and Expertise Center (RIEC)], related to his application for a liquor and hospitality license. The RIEC report was prepared as part of a Bibob investigation (a Dutch law for integrity assessments in public administration) into the legality of the business transfer and financial flows. The Mayor (the controller) rejected the request under Article 15(4) GDPR, Article 23(1)(i) GDPR, and Article 41 GDPR, claiming that restricting access was necessary and proportionate to protect the rights and freedoms of others, including the Mayor himself, and that the RIEC report fell under the confidentiality obligation in Article 28 of the [https://www.justis.nl/sites/default/files/2022-10/Factsheet%20The%20Dutch%20Bibob%20Act.pdf Bibob Act.] The data subject filed an objection to this refusal, which the Mayor declared unfounded and maintained the refusal. The data subject subsequently appealed the decision to the District Court Overijssel. The court dismissed the appeal, holding that the controller lawfully refused access to the personal data in the RIEC report. The court found that the report was part of a [https://www.justis.nl/sites/default/files/2022-10/Factsheet%20The%20Dutch%20Bibob%20Act.pdf Bibob] investigation and therefore subject to the confidentiality obligations under [https://www.justis.nl/sites/default/files/2022-10/Factsheet%20The%20Dutch%20Bibob%20Act.pdf Article 28 of the Bibob Act,] which preclude disclosure except in limited circumstances that did not apply here. Also, the court confirmed that restricting access was necessary and proportionate to protect the rights and freedoms of others, including the Mayor and the RIEC, as permitted under Article 15(4) GDPR, Article 23(1)(i) GDPR, a
After moving to a new building in 2018, Stichting Focus Filmtheater, the controller, abolished cash payments and allowed customers to pay only by debit card, credit card, or online. The data subject objected to this policy, arguing that forcing card payments unnecessarily involves the processing of personal data and infringes his right to privacy. He therefore filed a complaint with the DPA. The DPA rejected the complaint following investigation, concluding that no likely violation of the GDPR occurred. It considered that card payments were used to ensure employee safety and to enable the performance of the contract with customers. The court of first instance upheld this view. The data subject then appealed to the Council of State, arguing that the DPA had failed to properly assess whether the processing was necessary and justified, and that less intrusive alternatives, such as allowing cash payments, were available. The court held that the DPA’s decision was insufficiently reasoned and therefore unlawful. The court clarified that compliance with the GDPR generally implies compliance with Articles 7 and 8 of the EU Charter and Article 8 ECHR, so no separate human-rights analysis was required. While the court accepted that “(social) safety” can in principle constitute a legitimate and well-defined purpose for processing personal data under Article 6(1)(b) GDPR, it emphasised that such a purpose must be substantiated in the specific circumstances of the case. In this instance, the data subject had credibly argued that staff safety was not actually at risk, and the DPA had failed to demonstrate that abolishing cash payments materially improved employee safety. The mere fact that cash can be stolen was not sufficient to establish a concrete and justified purpose. Because the existence of a legitimate purpose had not been adequately established, the DPA could not properly assess whether the processing was necessary for the performance of the contract or whether it was
Following the entry into force of the GDPR, the Irish DPA received complaints from users and non-users (the data subjects) of the ‘WhatsApp’ messaging service concerning the processing of personal data by WhatsApp Ireland Ltd (the controller). After receiving an European Data Protection Board (EDPB) 'binding decision' (28 July 2021) within the framework of the GDPR's consistency mechanism, the Irish DPA adopted a final decision on 20 August 2021, in which it found that the controller had infringed certain provisions of the GDPR. The Irish DPA imposed corrective measures on the controller, in particular administrative fines for a cumulative amount of €225 million. The controller, challenged the EDPB's binding decision before the European General Court (GC) and in - in parallel - the implementing final decision by the Irish DPA before an Irish court. On 7 December 2022, the GC rejected the controller’s action as inadmissible. In that order, the GC considered, in essence, that the binding decision did not constitute a challengeable act for the purpose of [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12008E263:EN:HTML Article 263(1) TFEU] and that the controller was not directly concerned with that decision, within the meaning of [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12008E263:EN:HTML Article 263(4) TFEU]. Additionally, the GC considered the controller’s action brought out of time, because the Irish DPA had informed the controller already of ‘the relevant content’ of the contested decision prior to the EDPB’s publication thereof on its website, thus the term under [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:12008E263:EN:HTML Article 263(5)] had already commenced then and not only with the publication. By its appeal lodged on 17 February 2023, the controller requested that the CJEU in essence to reject the GC's order and find the action admissible. The controller put forward two grounds of appeal: # The GC misin
A data subject applied for an exemption from compulsory education for school years 2022-2023 and 2023-2024 for their son. On 24 July 2022 the data subject submitted a list containing the specific objections to each of the schools within a reasonable distance from their home, as required by the municipality. On 5 April 2024 the data subject filed an erasure request (Article 17 GDPR) to remove this list, as they believed this list to be unlawfully processed. On 12 June 2024 the municipality decided not to grant the request for removal. The municipality held that is obliged under national law to process a declaration of objections to potential schoolsCompulsory Education Act (Leerplichtwet) 1969, https://wetten.overheid.nl/BWBR0002628/2024-01-01 and archive this informationArchival Act (Archiefwet), https://wetten.overheid.nl/BWBR0007376/2024-06-19. The data subject objected to this decision and appealed to the appeals committee of the municipality. They argued that the declaration did not have to list separate objections to each of the schools. This argument was rejected, and the data subject appealed the decision to the court. The court held that the list of objections to schools was lawfully processed and the municipality did not have to grant the data subject's erasure request (Article 17 GDPR). Firstly, national lawArticle 6(1) of the Compulsory Education Act (Leerplichtwet 1969), https://wetten.overheid.nl/BWBR0002628/2024-01-01 requires parents to declare on which grounds they need an exemption from compulsory education. Specifically, parents must submit a "personal declaration", which must explain the objections to the educational values of all schools within a reasonable area from their home. The court held that the authoritiesCompulsory Education Officers (Dutch: leerplichtambtenaar) and courts have to be able to investigate the objections to the educational values of all schools in the area. The court held that this is only possible if there is a list
A telecommunications company is the controller. In 2023, the controller carried out a large scale direct marketing campaign directed at data subjects who were customers of other telecommunication providers. The letters included a “contract summary“, with a price offer and cancellation policy. The marketing was directed at data subjects personally, with the controller including their name, address, and landline number. The controller obtained this data from a mailing list vendor without the data subjects’ consent. In September 2023, a qualified entity issued a cease and desist notice to the controller, due to data protection, competition, and consumer law violations. The qualified entity also requested information from the controller regarding its data processing activities and sources of data. The qualified entity later brought an injunction claim against the controller. Regarding the GDPR violations, the qualified entity requested the court to order the controller to refrain from processing data subjects’ address and contact information through direct marketing campaigns without their consent, as well as order the controller to fulfill its information obligations in accordance with Articles 14(1) and 15 GDPR. Finally, the qualified entity requested the court to order the controller to them a total of €243.51. The controller requested the court to dismiss all claims. The controller argued that its data processing activities were lawful under legitimate interests (Article 6(1)(f) GDPR). In addition, direct marketing activities always constitute a legitimate interest under Recital 47 GDPR. The court found that the controller had violated national competition and consumer laws in the direct marketing campaign, as it considered it an unfair commercial practice. The court found a violation of Articles 5(1)(a) and 6(1) GDPR). According to the court, the controller processed data subjects’ address and contact information without a legal basis in writing and sending the
The Romanian Constitutional Court examined the constitutionality of the legal provision in Article 2 Governmental Ordinance no. 7/2025 establishing a register for contagious diseases. The Institution of the President of Romania requested the constitutional check. It argued that the measure went beyond what was necessary because the personal data concerning the health of a person were stored for the entirety of that individual’s life with the express prohibition of erasure. This allegedly breached Article 1(3) Romanian Constitution, Article 26 Romanian Constitution, Article 20 Romanian Constitution, as well as Article 8 European Convention on Human Rights (EHCR), Article 148 Romanian Constitution, Article 7 EU Charter of Fundamental Rights (EUCFR) and Article 8(2) EUCFR. Furthermore, the Institution of the President emphasised that the legal provision fails to provide the necessary safeguards for the protection of the fundamental rights and liberties of the individual. Namely, the legal act failed to specify the liability of the controller and the applicable sanctions for breaches, and to ensure the confidentiality of the personal data processing among other shortcomings. This allegedly breached Article 26 Romanian Constitution, Article 1(5) Romanian Constitution, and Article 147(4) Romanian Constitution. The Constitutional Court held that the legal provision was unconstitutional. It found that the legal act failed to provide the necessary safeguards in relation to controller liability, sanctions, and confidentiality. However, the Court found that the measure of storing personal data concerning health for the entire duration of an individual’s life without the possibility of erasure was not in itself unconstitutional and did not violate the fundamental right to private life. The Court pointed out that the aim of such a legal provision is justified by its scientific or statistical purpose and abides by European legal provisions on health safety.
Meta's Business Tools tracked user behavior on third-party sites without valid consent, constituting unlawful processing of personal data.
The data subject was subject to a home visit by the public health authority following an external report raising concerns about her condition. After the visit, the authority created internal medical notes and administrative records documenting observations made by a physician, as well as information about the person who had reported the situation. The data subject subsequently requested access under Article 15 GDPR to all records held about her, including call logs, internal reports, medical notes, and any documents containing her name. The authority provided a GDPR response and later disclosed the entire file, but redacted personal data relating to authority staff and the reporting third party. The data subject brought an action seeking full, unredacted disclosure, arguing that the records did not accurately reflect what had occurred during the home visit and that she was entitled to receive the documents in their entirety under the GDPR. The court dismissed the claim, holding that the controller had fully complied with its obligations under Article 15 GDPR. It emphasised that the right of access and the right to obtain a copy under Article 15(3) GDPR concern only the data subject’s own personal data, not the documents or files as such in which those data appear. Relying expressly on the CJEU’s judgment in C-487/21 (CRIF), the court recalled that the concept of a “copy” under Article 15(3) GDPR refers to a faithful reproduction of the personal data undergoing processing, not necessarily to a copy of the entire document containing them. The decisive criterion is whether the information provided enables the data subject to obtain a complete and accurate understanding of the personal data processed about them and to effectively exercise their GDPR rights, such as rectification, erasure, or restriction of processing. The court further clarified, in line with the CJEU’s reasoning, that the controller is entitled to redact information in the same document that does not
In December 2024, the investigative television programme Report, by the national broadcaster Rai, aired a segment addressing a political controversy involving then-Minister Gennaro Sangiuliano. The controversy involved the provisional appointment of the Minister’s affair partner for a role of public relevance, then withdrawn. The programme shared excerpts of a private telephone conversation between Sangiuliano and his wife requesting to withdraw the appointment, as well as references to other communications with ministry officials. The broadcast suggested that personal considerations had influenced the decision not to proceed with the appointment. Following the broadcast, Sangiuliano and his wife filed separate complaints against Rai. In October 2025 the DPA imposed an administrative fine of €150,000 and ordered Rai to cease further processing of the audio recording, including its storage in its archives. The DPA held that the dissemination of the private conversation exceeded what was necessary for journalistic purposes and violated data protection principles, in particular the requirement of essentiality of information. Rai challenged the decision, arguing that the broadcast pursued a legitimate public interest and complied with the journalistic exemption under data protection law. The court annulled the DPA’s decision, holding that the broadcast fell within the legitimate exercise of investigative journalism and respected the proper balance between privacy and freedom of information. From a privacy perspective, the court emphasised that data protection rules do not prohibit the dissemination of personal data as such, but require a contextual assessment of whether the disclosure is essential to inform the public about matters of genuine public interest. In this case, the court found that the private conversation was not used to berate the Minister’s personal life, but to demonstrate, through unmediated evidence, the concrete influence of private relationships i