GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
French DPA
During a trial involving a data subject their medical report was presented to the court. The data subject lodged a request to the DPA on 7 June 2023. The DPA closed their request in a decision of the 24 October 2023. The DPA noticed that he must not substitute the data subject in the first exercise of their rights with the controller. What’s more, the DPA declared itself incompetent to examine the relevance of the personal information involved regarding to the dispute. The 22 December 2023, the data subject lodged a complaint to the CE. The CE rendered its decision on 27 January 2025. By rejecting the data subject’s complaint, the CE confirms the legality of the DPA’s decision to close the request of the data subject. The CE notices that without a first exercise of the rights with the controller, the data subject’s request to the DPA has no object so the DPA is founded in closing the request. The CE also points out that an administration has the obligation to invite the data subject to regularize their request if it is defective in form or procedure or if incomplete ([https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367402 Article L.114-5] and [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367404 Article L.114-6 French Code of relations between public and administration]). As the absence of an object is not a formal or procedural defect, the DPA does not have an obligation to invite the data subject to regularize their request, as Articles [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367402 L.114-5] and [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000031367404 L.114-6 of the French Code of relations between public and administration] are not applicable. Additionally, the CE reminds that the legal ground of a processing can be the exercise or the defense of a right in a court of law. The CE underlines that this legal ground is an exception to the exercise of rights to erasure (Article 17 GDPR) and opposition (Article 21 GDPR), and to the interdiction of health related data processing according to Article 9 GDPR. After recalling these legal provisions, the CE clarifies the distribution of roles between DPA and judges when personal information is produced in court proceedings. CE indicates that the DPA is not competent to consider the relevance of the processed information regarding the dispute, and confirms the judge’s exclusive role in appreciating evidences in terms of relevance or loyalty.
An unnamed telecom provider
A customer (the data subject) filed a complaint against their telecom provider (the controller) after it failed to respond to their access request under Article 15 GDPR. The controller eventually responded to the request 14 months later, when the complaint was already pending. The Belgian DPA fined the controller €100,000 for violating Article 15 GDPR. The controller challenged the fine before the Belgian Court of Appeals. The Court reformed the DPAs decision and reduced the amount of the fine to €5,000. The Court found that the original €100,000 fine was disproportionate for a number of reasons: * the infraction was an isolated incident, affected a single data subject, and did not involve special categories of data; * the controller had no history of violating the GDPR; * the infraction caused no damage to the data subject but only mere inconvenience: * the infraction was not intentional; * the controller collaborated with the DPA during the investigation and implemented better procedures for handling access requests after the complaint was filed.
Court case 2 O 49/24
The controller is a credit rating agency calculating credit scores based on personal data. The data subject filed a criminal complaint against the controller in April 2023 for allegedly unlawful storage of payment defaults and allegedly criminal conduct by its employees. As a response, the controller temporarily suspended the provision of information regarding the data subject's data to third parties. The criminal proceedings were eventually discontinued, however the controller only learned that during the ongoing civil proceedings. The controller informed the data subject that it would not disclose his data set again until he gave his written consent and waived any subsequent claims that might arise from the credit rating (damages/compensation for pain and suffering). The data subject did not make such a declaration. The data subject requested - inter alia - that the controller be ordered to pay the data subject non-material damages pursuant to Article 82 GDPR, because the controller failed to transmit the current credit score calculated by the controller in particular to two banks contrary to their right to data portability under Article 20(2) GDPR. Additionally, the data subject claimed, that the controller had a contractual obligation to forward the data. The controller requests that the action be dismissed. The controller argued, that even if potential contractual partners had refused to enter into credit-related agreements with the data subject, the corresponding damages would not have been caused by the controller or by the information it failed to provide. The court held, that the data subject is not entitled to damages under Article 82(1) GDPR. = The court found, that the controller had not violated the GDPR as according to Article 20(1) GDPR, the data in question must have been made available to the controller by the data subject to establish an obligation to transfer the data (i.e. the right to data portability). However, the data to be disclosed is no
Court case IX R 25/22
It is disputed to what extent the plaintiff (data subject) can demand information from the tax office (the controller) in accordance with Article 15 GDPR. The data subject requested "the disclosure of copies of all stored information" relating to him with reference to the GDPR, whereupon the controller sent various overviews. In this regard, the data subject complained that not all relevant documents had been made available in accordance with Article 15 GDPR. The controller interpreted this as a request for comprehensive inspection of the files, which was officially approved. The data subject then requested information pursuant to Article 15 GDPR. The controller declared its willingness to allow the inspection of the files to fulfill the access request. However, the sending of all files was refused. Before the Thuringian Fiscal Court (Thüringer Finanzgericht - FG Thüringen) the data subject pursued his access request under Article 15(1) GDPR and the provision of copies pursuant to Article 15(3) GDPR. The controller sent the data subject various overviews during the legal proceedings. The FG dimissed the data subject's claims. After that the data subject was granted access to the files concerning the proceedings. With the appeal to the Federal Finance Court (Bundesfinanzhof - BFH), the data subject complained that the access request was not yet fulfilled. It claimed, that the listing of internal agency processes does not constitute the provision of information and that the access request cannot be countered with the objection of disproportionate effort. The controller requested that the appeal be dismissed because the access request had already been complied with and because Article 15 GDPR does not give rise to any further right to full access to the files. The court held, that the first instance court had erred in assuming that the controller could object to the access request on the grounds that the required provision of information would involve disproportion
Court case W298 2263736-1/9E
On the 14 October 2022, the data subject alleged a violation of his right to access under Article 15 GDPR by the controller. The Austrian DPA (Datenschutzbehörde – DSB) however rejected the complaint on the 18 October 2022. The DSB detailed that the data subject had lodged his first complaint on the 3 September 2018 and since then he had followed it with 73 other complaints. The DSB held that although Article 57(4) GDPR does not specify the meaning of “excessive”, it certainly indicates that a high number of complaints can be considered excessive. The DSB went on to say that the initiated proceedings were legally complex and the statements made by the data subject were very detailed which meant that a lot of resources would be necessary for the assessment of the case. As Article 57(4) GDPR enables the supervisory authority to choose between implementing a fee or refusing to process the complaint, the DSB found itself validated in its decision to reject the complaint. The data subject appealed the decision of the DSB to the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The data subject posed that the DSB had given no legal justification for the rejection of the complaint proceedings. The BVwG paused its assessment of the matter until the conclusion of the CJEU case C-416/23 which had been referred to the CJEU by the Supreme Administrative Court of Austria (Verwaltungsgerichtshof – VwGH). The CJEU in C-416/23 held that placing a numerical threshold on complaints would undermine the data subject's rights. The BVwG held that the DSB had failed to carry out an investigation into whether the data subject had abusive intensions. The BVwG found that there were no indications on an abusive intension of the data subject. Therefore, the BVwG concluded that the rejection of the complaint had been unlawful. The BVwG reverted the case back to the DSB for an adequate assessment of the claims.
CRIF GmbH
The controller CRIF GmbH operates a credit agency and processes personal data of the data subject in question for this purpose. The credit rating information about the data subject is not based on any payment history but only on general data such as address, age and gender. The controller purchased data on the data subject's first and last name, address and date of birth from X. X operates an address publishing and direct marketing company. The data subject did not consent to the processing of that data. The data subject cannot successfully run its business without appearing in the controller's database, because just that fact of not appearing reduces creditworthiness. Therefore the data subject did not pursue deletion but only the termination of processing by the controller of data from X. The court of first instance held, that the controller had wrongfully processed the data subject's personal data and ordered an injunction. It held, that the controller had inappropriately used data for the purpose of assessing creditworthiness, which had originally been collected for the purposes of address publishing and direct marketing by X. The controller therefore should have informed the data subject in accordance with Article 14 GDPR that it collects data from third parties. The court stated that [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10007517&FassungVom=2025-01-25&Artikel=&Paragraf=151&Anlage=&Uebergangsrecht= § 151 Trade Regulation] (Gewerbeordnung - GewO) - privileging data collected by address publisher and direct marketing companies - does not constitute a legal basis for the (further) processing of data because it is not a legal provision within the meaning of Article 6(1) in conjunction with Article 6(4)(h) GDPR, but only a standard under commercial law . The court did not find a connection between the original purpose of the address publisher - and the new purpose of credit assessment. The court found it irrelevant, that t
Court case 3 C 29/23
The data subject, a holder of an insurance policy of an insurance company (the controller), sued after the controller adjusted the premium amounts of their policy. The data subject claimed the adjustments were not fully communicated in accordance with the German Insurance Contract Act ([https://www.gesetze-im-internet.de/vvg_2008/ Versicherungsvertragsgesetz] - VVG), which mandates that reasons for premium changes be disclosed, including whether they are temporary or permanent. The contract between the data subject and the controller had been in place for several years, with premium adjustments occurring over time. The data subject argued that the controller did not provide adequate information about these adjustments. They also sought access to personal data related to their insurance policy under Article 15 GDPR, including details of premium adjustments, tariff changes, and policy terminations. The controller denied the request, asserting that the necessary information had already been provided. The court held that the data subject's claim for information under Article 15(1) GDPR was justified. The personal data in question, relating to the data subject’s insurance relationship, were considered personal data as per Article 4(1) GDPR. The controller was required to provide information on the processing of these personal data, which included the time and amount of premium adjustments, tariff changes, and tariff terminations. The court rejected the controller’s argument that the data subject's request was abusive according to Article 12(5)(b) GDPR. It emphasized that the GDPR grants a very strong right to information, aimed at ensuring transparency and data sovereignty. The data subject’s request was not deemed excessive, as it sought data related to his own contractual relationship and indicated that he no longer had access to the information. The court affirmed that the controller could not deny the request based on the data subject's potential economic intere
ASBL AA and B v. Direct Tax Administration (ACD)
On 19 May 2020, a Luxembourg bank informed the complainant that, by 30 June 2020, they would transmit the complainant's bank account information to the Luxembourg fiscal authorities. Afterwards, by latest the 30th September 2020, the Luxembourg fiscal authorities will share this information with the US fiscal authorities. The complainant, a French and American citizen connected to the association for the protection of civil rights ASBL, turned to the Luxembourg direct Tax Office (hereinafter: ACD), explaining that the data to be transferred on the basis of the FATCA concern identification, financial and economic data, i.e. personal data as defined in the GDPR. Thus, the complainant requested the ACD to erase the personal data and immediately discontinue the exchange of information between the ACD and the American fiscal authorities. The director of the ACD rejected this request, stating that the ASBL is not a data subject and the processing of the personal data of the complainant was necessary to respect the Luxembourg FATCA Agreement law to which the ACD is subject, Thus, in their view the request to restrict processing is not justified. The complainant turned to the Luxembourg Administrative Tribunal, which rejected the injunctive request to suspend the information sharing with the US fiscal authorities. The Tribunal also declared itself entitled neither to decide on the decision of the ACD, nor to invalidate it. As to the merit, the Tribunal found the request for invalidation unfounded, rejecting the request for a reimbursement and ordering the complainant to pay the costs. The ACD challenged the receivability of appeal. In relation to the GDPR-related questions, the court held the following. * Whether the GDPR was applicable to the data transfer With regards to the applicability of the GDPR and the law of the 1st August 2018 about the organisation of the Commission Nationale pour la Protection des Données (CNPD, the Luxembourg data protection supervisory aut
Court case 4 U 808/24
The data subject is a user of Facebook (the controller) and was a affected by a scraping incident. An unknown third party had used the possibility of finding user accounts through the users’ phone numbers for scraping Facebook by randomly generating phone numbers and searching for users. Through this method, the data subject's ID, first and last name, and gender were included in the data set and were linked to his phone number. Notably, while the data subject had set his phone number to be visible only to himself, he had left the searchability setting at the default "Everyone," allowing others to find his profile via his phone number. Following a scraping incident the data subject received spam calls and SMS messages. The data subject claimed in a written statement that he had fallen into a state of great discomfort and concern about possible abuse. However, the spam calls and SMS messages received under the disputed cell phone number were filtered out from the outset. The data subject claimed that the controller did not take appropriate measures to avoid the exploitation of the contact tool that allowed users to be found through their phone numbers. He sued the controller for damages of €3,000 and sought a declaratory judgement to acknowledge his future right to compensation. This declaratory judgement concerning damages is standard in German law due to statutory limitations that would otherwise prevent a person from bringing claims after a period of three years (such as for long-term consequences of a car accident). Additionally the data subjects applied for injunctions requesting that the controller refrains from processing his telephone number in any way that goes beyond the processing necessary for two-factor authentication and that the court orders the data subject to enhance its security measures. Following the lead decision of the German Federal Court of Justice (Bundesgerichtshof - BGH) - VI ZR 10/24 from 18 November 2024 the court held, that the mere
Court case 2 R 192/24h
The data controller is an online casino-game provider. The data subject set up an account, deposited money and lost it on the website. On 23rd May 2024, the data subject submitted (through his representative) an access request with the controller requesting access to their personal data, and specifically, all deposits and withdrawals and the stakes, wins and losses made on his account. The access request was made through the data subject’s representative, and included an electronically signed power of attorney and a copy of the data subject’s ID. On 26th May 2024, the controller refused the applicant’s request, asking for a handwritten power of attorney signed by the plaintiff in ink. The data subject did not respond to the controller’s response and filed the present action on 5th July 2024 with the Regional Court of Klagenfurt. The data subject sought that the controller be compelled to provide a digital copy of the data requested. On August 1st 2024, the controller sent further communication to the data subject’s representative and, in light of having received notice of the claim filed, deemed there to be a legally valid power of attorney within the meaning of Section 8 RAO and provided the information requested by the data subject on 23rd May. On 9th October, the data subject, having received the requested information, limited the scope of their filing to request only reimbursement of the costs incurred in the court proceeding. The trial court ruled that the controller could not rely on § 45 ZPO, an Austrian Civil Procedure provision which requires plaintiffs in a proceeding to bear the costs of such proceeding where the cause of action is not attributable to the action of the defendant and the defendant immediately acknowledges the claim in action. The controller had argued that this provision should apply as the power of attorney received in May 2024 was invalid. The trial judge ordered the controller to reimburse the data subject for their legal costs, to the
Court case I-25 U 25/24
The data subject is a user of Facebook (the controller). In April 2021, data of approximately 533 million Facebook users were made public on the internet. An unknown third party had used the possibility of finding user accounts through the users’ phone numbers for scraping Facebook by trying out randomly generated phone numbers. Through this method, they were able to obtain user profiles with matching phone numbers. The data subject in this case was also among the people affected by this scraping incident; his user ID, first and last name, and gender were included in the data set and were therefore linked to his phone number. Notably, while the data subject had set his phone number to be visible only to himself, he had left the searchability setting at the default "Everyone," allowing others to find his profile via his phone number. The data subject claimed that the controller did not take appropriate measures to avoid the exploitation of the contact tool that allowed users to be found through their phone numbers. He sued the controller for damages and sought a declaratory judgment to acknowledge his future right to compensation. This declaratory judgment concerning damages is standard in German law due to statutory limitations that would otherwise prevent a person from bringing claims after a period of three years (such as for long-term consequences of a car accident). The data subject argued that he had suffered a loss of control over his personal data, resulting in a feeling of unease and worrying about potential abuse of his data. This also resulted in a heightened distrust of emails and calls from unknown senders or numbers. After the controller rejected the data subject’s claims, the data subject initiated legal proceedings, claiming that the controller had violated the GDPR in several respects and had not adequately protected his data. The Regional Court Münster (Landgericht Münster - LG Münster) dismissed the action on 6 June 2024 because the data subject h
Court case 6 U 114/23
The plaintiff sued a private health insurance company (the controller) by way of an action by stages (Stufenklage) according to [https://www.gesetze-im-internet.de/englisch_zpo/englisch_zpo.html#p0945 § 254 German Civil Process Order (Zivilprozessordnung – ZPO)]. 57 clients of the controller had assigned claims to a third party (the plaintiff). The health insurance company had raised their insurance premiums. On the first stage, the claimant sued for information under Article 15 GDPR to be able to determine the premiums paid by the clients that had assigned their claims. On the second stage, the claimant sought a declaratory judgement that the raises of the insurance premiums by the controller were unlawful and were suing for an amount yet to be determined after having obtained the information from the first stage. The court of first instance, the Regional Court Wuppertal (Landgericht Wuppertal – LG Wuppertal) dismissed the lawsuit. = The court held that an action by stages was inadmissible because the claimant did not want to determine the exact amount of their claims but rather, if they had any claims at all. This made the claims brought forth on the second stage inadmissible because they were not specified enough under [https://www.gesetze-im-internet.de/englisch_zpo/englisch_zpo.html#p0934 § 253(2)(2) ZPO]. The claims for information on the first stage were however admissible. The admissible claims for information were, however, unfounded. This was due to the fact that the criteria of neither Article 15 GDPR nor other, national legal bases for the claims were matched. = The court held that Article 15 GDPR did not give right to information for two reasons: first, the right under Article 15 GDPR to obtain access to personal data is strictly personal and does not follow the assigned claim (as an exception to [https://www.gesetze-im-internet.de/bgb/__401.html § 401 German Civil Code (Bürgerliches Gesetzbuch – BGB)]). The court held that the right under Article 15 GDPR does neither follow assigned claims nor can it be transferred to others in itself, citing the German Federal Administrative Court [https://www.bverwg.de/160920U6C10.19.0 judgement 6 C 10/19]. The BVerwG had argued that the right under Article 15 GDPR was the elementary subjective data protection right and followed from [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%253A12012P%252FTXT Article 8(1) CFR]. The reason for this right was to facilitate the data subject’s right to data protection by providing the needed knowledge about the processing of their personal data. This right could not be executed by third parties without entirely changing its nature. The court referred to a [https://gesetze.berlin.de/bsbe/document/NJRE001572436 judgement of the Higher Regional Court Berlin (Kammergericht Berlin – KG Berlin)] which argued that it could be possible for the assignee to execute the assigning person’s Article 15 GDPR right through the power vested in the assignment (without transferring the Article 15 GDPR right itself). However, this at least had to be reflected in the claims made before the court. = Second, in this case, the court found that the exercise of the right under Article 15 GDPR amounted to an abuse of law. This followed from Article 12(5)(b) GDPR, because the wording included “in particular because of their repetitive character”, leaving room for other cases in which requests by data subjects could be manifestly unfounded or excessive. The court found that Member States had to refuse applying EU law whenever its norms are only used to achieve aims which do not fall within the aims of the respective legislation.
Court case 27 U 2473/24 e
The controller is a credit rating agency maintaining a database with 68,000,000 Germany-related datasets. The contractual partners of the controller transmit data from their customers to the controller. The controller stores the data it receives from its partners. In turn it calculates and provides its partners with information on which the statistical risk of payment default. The data subject is a craftsman and requested the erasure of an entry on his creditworthiness stored by the controller regarding a debt between €300 and €400 for which payment had been in default for months. The controller rejected the request. Consequently, the data subject filed a lawsuit requesting erasure of the entry based on Article 17 GDPR with the Regional Court of Augsburg (Landesgericht Augsburg - LG Augsburg). The court found the claim to be unfounded as the controller was justified in processing the data under Article 6(1)(f) GDPR. The data subject appealed this decision and brought forward that the controller should have notified the data subject of the data processing through push-notifications. In the Appeals process the Higher Regional Court Munich (Oberlandesgericht München - OLG München) fully upheld the decision of the first instance. It maintained that the interest of the controller for storing the data is not overridden by legitimate interests of the data subject. Even though the debt was eventually settled the information stored by the controller remained suitable for assessing the credit score. The court also agreed with the first instance that even the payment history on small amounts (in the case at hand an amount below €400,00) is appropriate for future risk assessments. Regarding the fact, that the data subject had eventually paid the claim the court agreed with the first instance that even a late payment is relevant for risk predications. The court held that while the controller is obliged to inform the data subject in accordance with Article 13 and 14 GDPR, t
The controller operates the social network Facebook. The data subject is a Facebook user. On the 16 September 2021, the data subject re-posted another user’s post on the alleged ineffectiveness and dangers of Covid-19 vaccinations, claiming the “studies published by the CDC, the British government and Oxford University have shown that Covid-19 vaccines are ineffective”. On the same day, the controller removed this post and informed the data subject about this deletion who then appealed the decision without giving further reasons. The controller, however, did not change its decision. The controller’s terms and conditions stipulated that all violations against the community standards expire after one year. With his lawsuit, the data subject demanded, inter alia, * the rectification of his data saved with the controller insofar as all deletion and blocking entries from the controller’s system should be deleted and the counter that counts them should be reset; * decide, by way of a declaratory judgement, that the controller was not allowed to remove the post and confer on the data subject any kind of blocking; * the unblocking of said Facebook post; * €50 in damages. The Regional Court (Landgericht Frankfurt – LG Frankfurt) dismissed the lawsuit completely. The data subject then appealed the decision to the Higher Regional Court Frankfurt (Oberlandesgericht Frankfurt – OLG Frankfurt). The OLG Frankfurt held that the controller had to delete all deletion and blocking entries older than 1 January 2021 and the entry referring to the 16 September 2021 and to reduce the respective counter accordingly. Furthermore, the OLG partially granted the data subject pre-court lawyer costs; the rest of the appeal was dismissed. = The legal basis for the deletion claim follows from Article 17(1)(a) GDPR. The controller was not able to demonstrate the necessity of the further processing of these data since the violations expired after one year according to the terms and conditions of the controller. After this deadline, violations cannot be used for sanctions anymore, so there was no reason to further retain these personal data. The court did not accept the controller’s explanation that the further retention of the data was necessary for quality management purposes. = However, a legal basis for further retention could arise from Article 17(3)(e) GDPR (establishment, exercise or defence of legal claims). This applied for possible future lawsuits. Thus, the blocking entries the controller saved for the year 2021 did not yet have to be deleted (except for the one on the 16 September 2021 because this was already part of this very lawsuit, hence, a future lawsuit could not arise). Because possible claims from before 2021 fell under the statute of limitations, the controller also could not rely on Article 17(3)(e) GDPR regarding these claims. The entries concerning the year 2021 were also not subject to erasure under Article 16(1) GDPR because they were not inaccurate. Rather, the entries were reporting the blockings and this was factually true. = The action for a declaratory judgement was not admissible under [https://www.gesetze-im-internet.de/zpo/__256.html § 256 of the Civil Process Order (Zivilprozessordnung – ZPO)]. This was due to the subsidiarity of declaratory judgements. The court held that a declaratory judgement was not necessary since the data subject could also sue for performance or injunction. The court also dismissed the claim for unblocking the said posting because the blocking was at least lawful under the new terms and conditions in conjunction with the community guidelines from 2022, which were lawful and valid and were forbidding fake news in the section “dangerous health information”. The court held that the postings contained “misinformation about vaccines” under the post-2022 guidelines, because public authorities had concluded this information was wrong and likely to lead to refusal of vaccinations. The court held that the controller had sufficiently shown that studies and public authorities had confirmed the effectiveness of the vaccinations. The court however explicitly did not decide whether the blocking was also legal under pre-2022 guidelines. However, there was still no right to demand unblocking, because at least they would be subject to new blocking under the new guidelines. Thus, under the dolo agit principle from [https://www.gesetze-im-internet.de/bgb/__242.html § 242 German Civil Code (Bürgerliches Gesetzbuch – BGB)]. = However, the court noted, that in the light of the right to freedom of expression under [https://www.gesetze-im-internet.de/gg/art_5.html Article 5(1) of the German Basic Law (Grundgesetz – GG)] also criticism of government policies, authorities and health organisations must be possible. This was due to the indirect third-party effect of fundamental rights (mittelbare Drittwirkung). The court agrees that there were no absolute truths and science relied on the constant questioning of previous knowledge and that scientific knowledge can still be subject to falsification. Therefore, an objective, fact-based criticism could not be deleted under the community guidelines of the controller. However, the criticism in the present case was found not to be objective or fact-based. = The court dismissed the claim for damages since there were no material as well as non-material damages. A material damage was not shown by the data subject. A non-material damage under Article 82(1) GDPR also required a minimum threshold of infringement that was not reached. A sole feeling of unease was not enough for a non-material damage.
Court case 202203653/1/A3
The data subject’s personal data was processed by the Tax Administration because it suspected him of not fulfilling his tax obligations. This suspicion was raised after the Fiscal Information and Investigation Service (FIOD) had carried out a criminal investigation into the data subject’s tax advisor. During the investigation, the FIOD drew on the assistance of three employees of the Tax Administration and data on the customer's of the tax advisor under investigation, including the personal data of the data subject, were analysed during the proceedings. The data subject requested the erasure of their data under Article 17 GDPR but the request was rejected by the controller, the Minister of Finance. In the Netherlands, the Tax Administration forms part of the Ministry of Finance. The data subject argued that the Tax Administration is processing his personal data for a purpose other than the purpose for which the FIOD initially collected the data. The data subject appealed the Minister's decision to the District Court of Central Netherlands (Rb. Midden-Nederlands) which held that the controller had complied with both the requirements of the GDPR as well as the Law Enforcement Directive. The data subject appealed this decision to the Administrative Jurisdiction Division of the Council of State (Afdeling Bestuursrechtspraak van de Raad van State – ABRvS). The court determined that since the data had been collected for the purpose of the detection of criminal offences, it had to consider whether the disclosure of data by the FIOD to the Tax Administration was permissible. It stated that under [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32016L0680 Article 9 of the Law Enforcement Directive], further processing of personal data is permissible if authorised by EU law. The court held that the further processing of data fell under the remit of the GDPR as the Tax Administration fulfills a task which is in the public interest. The court reiterated the Distri
Minister van Financiën
The data subject lives in the Netherlands and was a victim of the so-called "benefit scandal". The latter involved the usage of a discriminatory algorithm by the Dutch Tax Administration in order to detect frauds by families claiming childcare benefits (see AP (The Netherlands) - 25.11.2021). Since she wanted to know what personal data of her the Tax Administration (Belastingdienst, the controller) was processing, she filed an access request with the Tax Administration. More specifically, she requested the respective minister to access and list her personal data contained in the Fraud Alert Facility (Fraude Signalering Voorziening - FSV), a system used to detect possible frauds in an automatic way. The controller rejected the access request. It argued that the processing at hand fell within the scope of Article 23 GDPR. More specifically, the controller referred to [https://wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=41&z=2021-07-01&g=2021-07-01 Article 41(1)(i) of the Dutch GDPR Implementation Act] (Uitvoeringswet Algemene verordening gegevensbescherming - UAVG), stating that the controller can limit data subjects' rights (in this case, the right of access) in view of the protection of the rights and freedoms of others. The controller took the position that it could not comment further on this, as this would prejudice the purpose of the restriction. The controller, therefore, did not specify how the balancing of interests entailed on the basis of [https://wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=41&z=2021-07-01&g=2021-07-01 Article 41(2)(h) UAVG] was carried out. On these grounds, the data subject appealed the controller's decision before the District Court of Rotterdam (Rechtbank Rotterdam - Rb. Rotterdam). The court ruled that the controller did not give sufficient reasons for reject the data subject's access request. The court referred to the [https://zoek.officielebekendmakingen.nl/kst-34851-3.html Explanatory Memorandum of
Court case W292 2247063-1/18E
On the 16 December 2019, the data subject filed a complaint against the controller, a credit rating agency with the Austrian DPA (Datenschutzbehoerde – DSB). The data subject alleged that the controller stored data regarding a previous insolvency for an excessive period of time after the termination of the insolvency or restructuring proceedings. Making available data on the insolvency led to the data subject suffering damages as bank loans were made unavailable to him. In the particular circumstances of the data subject, the insolvency was caused due to guaranty commitments rather than his own actions. Any debt and guaranties were settled through the restructuring proceedings and all outstanding payments were made within a month. The controller had violated the data subject’s right to privacy under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597 Article 1(1) of the Austrian Data Protection Act] (Datenschutzgesetz - DSG) as none of the requirements of Article 6(1)(f) GDPR were met for the publication of credit-limiting information. The data subject later added that his right to rectification under Article 16 GDPR, his right to erasure under Article 17 GDPR and his right to restriction under Article 18 GDPR had been violated. He further added that he is exercising his right to object under Article 21 GDPR due to violations of Article 6(1)(e) & (f) GDPR. The data subject detailed that the credit rating agency stored and made available "negative entries" for seven years after the insolvency procedure had been wrapped up. The DSB rejected the complaint on 16 August 2021 stating that the consideration of non-payments in the near past is necessary in order to disseminate a complete profile of credit worthiness. The erasure from the insolvency register does not mean that this data must automatically be removed by credit rating agencies. The data subject appealed the decision to the Federal Administrative Court of Austria (Bundesverwaltungsgericht - BVwG) which also rejected their claim on the 28 September 2022. The data subject appealed the decision of the court to the Supreme Administrative Court (Verwaltungsgerichtshof -VwGH). The VwGH repealed the decision of the BVwG with reference to the joined CJEU judgments C-26/22 and C-64/22 and referred the case to a different department of the BVwG. The BVwG explained that it had to determine whether the processing was lawful in two separate time periods. (1) The processing of data while this information was still publicly available through the insolvency database With reference to the CJEU judgment C‑131/12, the BVwG reiterated the finding in this case which showed that courts must individually assess whether the processing of data by credit rating agencies while this data is available in a public register is necessary. In the present case, the BVwG concluded that the interest of the controller outweighed the interest of the data subject as it would not be feasible for other companies to make individual inquiries with the public insolvency database. The controller was fulfilling an important task which supports the effective functioning of the economy by compiling the information. (2) The processing of data after the data had been deleted from the public insolvency database Article 6(1)(f) GDPR sets out three requirements: 1 The legitimate interest of the controller, 2 The processing of personal data must be necessary to realise this legitimate interest and 3 the rights and freedoms of the data subject cannot outweigh this interest. The BVwG pointed to CJEU C-26/22 and C-64/22 and reiterated that these cases showed that credit rating agencies cannot store information about an insolvency longer than they are available in a public register if this is the source of the information. Further, the Attorney General had highlighted that it is vital to enable data subjects to re-enter the economy after data has been deleted from the insolvency register and this would be jeopardised if the credit rating agency were to store insolvency data for an extensive period of time. Therefore, the controller could not rely on Article 6(1)(f) GDPR after the data had been deleted from the insolvency register. The BVwG concluded, that the controller should have deleted the data.
Court case 6 U 127/24
The controller is a credit rating agency. Its contractual partners provide it with information relevant to the database from their business relationships with their customers. The controller stores this information as entries in its database in order to be able to provide its contractual partners with information. The data subject had previously initiated court procedures against the controller about the legality of the so-called score value, which the controller determines on the basis of the data available to it and which is intended to assess the creditworthiness of the person concerned. With regard to this procedure, the controller imposed a so-called score block until its conclusion, with the consequence that no more credit score values are transmitted in the event of a corresponding query by the controller's contractual partners. This can lead to difficulties for the data subject, e.g. for entering into new contracts. The data subject challenged the block imposed by the controller on the data subject of the database for the provision of information on contractual partners with the application to lift the so-called "score block" and to refrain from a future block until the decision in the main action. The Court of first instance dismissed the application for a preliminary injunction. The data subject's appealed this, seeking the court, to order the controller to immediately to lift the block imposed on the applicant of the database for the provision of information on contractual partners, the so-called "score block". The court stated, the data subject is only entitled to the rights of data subjects under Chapter III of the GDPR. The court found, that the data subject seeks the (re)commencement of the processing of personal data by the controller in the form of scoring and the transmission of the scoring value to third parties which is not listed in Chapter III. Thus, the court found, that the GDPR did not provide a legal basis for it's claim. The court also found, that there was no (quasi)contractual basis, as there is no contractual relationship between the controller and the data subject. The court found, that no violation of the data subject's general right of personality occurred. The court held, that the controller lawfully restricted the data processing according to Article 18 GDPR after the data subject objected to the processing. Furthermore, the court held, the controller in refraining from expressing an opinion about the data subject did not distort or falsify the representation of the data subject. Specifically the court also denied, that the notifications of the controller to third parties that a score value is not communicated impaired the rights of the data subject. The court held that this notification does not allow for any conclusions to be drawn about the creditworthiness of the data subject. In any way, the court held, that the decision of the controller to no longer provide information on the score values is based on an objective reason as according to Article 18 GDPR the controller is required to only store the data in question, when the data subject's consent to the processing of certain data has not been declared. The court held, that if the data subject wishes for the controller to resume the provision of its credit score, it must declare a clear, comprehensive and legally effective waiver of claims for damages based on previous processing practice. The court also held, that a monopolistic position of the controller did not matter for the case at hand.
GRAYDON NEDERLAND B.V.
The data subject made 9 access requests to the controller, two of the requests were not answered. On 8 April 2024, the data subject initiated legal proceedings against the controller before the district court. They argued that the controller violated Article 15(1)(c) GDPR because the controller did not give a full list of recipients of their personal data. The data subjects also wants access to who they share and will share personal data with in the future, especially recipients in third countries and international organisations. Second, the data subject argued that the controller must, under Article 15(1)(g) GDPR, reveal the source of the data. The data subject also claims the controller violated Article 12(1) until 12(4) GDPR. The controller argued that they have no obligation to share the identity of third parties because this is confidential business information. Therefore, the controller feels that they can partially restrict the data subject’s right of access based on Article 23 GDPR and Article 41(1)(e) of the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming – UAVG) The controller reacted to the second point and claims that all personal data is taken from one public source (de Kamer van Koophandel). First, the court assessed if the controller could rely on Article 41(1)(e) UAVG and Article 23 GDPR to deny an access request. The court did not find that a list of clients could damage the controller’s financial interests based on Article 41(1)(e) UAVG. The court found that the controller did not demonstrate why their customer base is a business secret. The controller did not explain how the size of the customer base and the identity of the third parties requested by the data subject negatively influenced its financial interests. Overall, the protection of business secrets is not a fundamental right and the rights of the data subject have priority over the rights of the controller. Furthermore, the controller does not
Court case III OSK 4727/21
A former employee of a health care institution filed a complaint with the Polish DPA (UODO). The employee (a data subject) claimed the health care institution (a controller) unlawfully processed their data stored on their business computer hard drive. For the data subject, there was no legal basis to process their data after the employment relationship ceased. Consequently, the data subject asked for deletion of their data. The DPA ordered deletion of personal data by the controller. According to the DPA, the controller didn’t have legitimate interest under Article 6(1)(f) GDPR to process the data. Although the controller argued the data were necessary for defence of legal claims, the claims were of hypothetical nature. Thus, the controller processed the data in advance. The controller brought an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The appeal was dismissed. The court found no evidence that processing of the data at stake was necessary for the purpose of controller’s legitimate interest. The court emphasised that purely theoretical, future claims cannot justify data processing once the employment relation came to an end under conciliatory agreement (mutual consent of the parties . Hence, the DPA’s decision was upheld. The controller lodged a cassation appeal before the Supreme Administrative Court (Naczelny Sąd Administracyjny – NSA). The Supreme Administrative Court upheld the cassation appeal. The court of first instance failed to hear the case properly. The appeal was not thoroughly assessed and not all the controller’s statements against the DPA decisions were answered. In particular, the court of first instance didn’t identify the category of data processed by the controller, nor the data stored on the hard drive. It remained unknown whether the hard drive contained also data of other individuals. Moreover, the court of first instance didn’t explain in detail why the controller was not