GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Court case 27 O 60/24
The controller is a telecommunications company. The data subject and the controller entered into a mobile phone contract. During the conclusion of the contract the controller provided the data subject with an information sheet that included information about the transfer of personal data to the Schufa, a credit rating agency. Subsequently, the controller transferred the name, the date of birth, the address, and information about the conclusion of the contract to Schufa. Following his request, Schufa informed the data subject about the data forwarded by the controller. In a [https://www.schufa.de/newsroom/schufa/daten-loeschung-telekommunikationskonten/ press release made public on 19 October 2023], Schufa informed the public that it was going to delete information transferred by telecommunication companies by the 20 October 2023. Schufa noted that the Conference of the German Data Protection Agencies (Datenschutzkonferenz der Länder) was of the [https://www.datenschutzkonferenz-online.de/media/dskb/20210929_top_07_beschluss_positivdaten.pdf opinion] that the transfer and processing of so called positive data (i.e. data without connection to a payment default or another violation of the contract by the data subject) required the consent of the data subject. Data concerning the conclusion of a contract would constitute such positive data. With his lawsuit, the data subject claimed, inter alia, €4,000 in non-material damages. The court recognised the controller’s interest in lowering its financial risk. If the controller enters into a contract in which it periodically charges the client for its services without a pre-paid system, there is a certain risk of the client not paying for services made in advance. This risk increases when the client is handed a mobile phone at the beginning of the long term contract. Therefore, a risk of being defrauded exists for the controller. The court further recognises the possible advantage of a standardised notification about the contract conclusion to Schufa. In cases where a (potential) client enters several mobile phone contracts by using their real name without a sensible reason, this can thus be noticed. However, concerning the standardised transfer of data to Schufa without any specific suspicion the court concludes that in the balancing test necessary under Article 6(1)(f) GDPR the data subject’s interest override the interest of the controller. This is due to the fact that a client typically doesn’t expect this kind of data transfer. Especially, customers can expect being asked for their explicit consent prior to such a transfer. If the controller insists to transmit data to Schufa it can condition the closure of a contract on the data subject’s consent to the data transfer. Due to this possibility, the automated transfer of data to Schufa goes beyond the strictly necessary criterion referred to in Recital 47. If the controller does not ask for consent upon closure of the contract it might still transmit data to Schufa if circumstances appear that make it likely that the customer has provided misleading information, especially about their creditworthiness, or if specific risk factors occur. Therefore, the controller unlawfully submitted the data subject's personal data to Schufa. This constituted an infringement in terms of Article 82(1) GDPR. However, the court held that there is no damage and rejected the respective claim. The burden of proof lies with the data subject even though there is no specific threshold of severity that needs to be met. The data subject failed to prove a non-material damage. On the one hand, the data subject did not confirm in the oral hearing the previously claimed constant fear of uncomfortable further inquiries, a general uncomfortable feeling, and a feeling of powerlessness. The court therefore considers the previous written statement a text module. On the other hand, the court believed the data subject that he was angry about the data transfer. This, however, did not amount to a non-material damage. The court does not believe the claim made by the data subject that he has trouble sleeping at night due to the data transfer.
Court case III OSK 4804/21
A school (the controller) installed a fingerprint scanner by the entrance to the canteen. By scanning students’ fingerprints the device verified whether a meal was paid. The processing was based on their parents’ consent. The Polish DPA (UODO) initiated ex officio proceedings against the controller. During the proceedings, the controller explained they didn’t possess the students’ fingerprint samples. Such a sample was stored only within the fingerprint scanner. When a student ceased to eat in the canteen, their fingerprint stored in the fingerprint scanner was immediately deleted. After investigation, the DPA found violations of Article 5(1)(c) GDPR and Article 9(1) GDPR. The controller processed the biometric data under Article 4(14) GDPR. Nevertheless, the processing of biometric data was not based on a valid consent under Article 9(2)(a) GDPR. The students not using the fingerprint scanner were treated differently, i.e., they had to verify their identity by telling their name and contract number while entering the canteen. For this reason, the DPA claimed the consent was not freely given. Moreover, the DPA stated that processing of the biometric data violated data minimisation principle, as the controller was able to use less privacy intrusive means. Hence, the controller was fined PLN 20,000. Additionally, the DPA ordered deletion of the students’ fingerprints data and a ban on its further processing. The controller lodged an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The controller argued they didn’t process biometric data. Furthermore, the controller disagreed with the DPA that the parents’ consent was an inappropriate legal basis for the processing at stake. The court upheld the appeal. For the court the interpretation of the data minimisation principle, relied upon by the DPA, was too strict. The controller proved the relation between the fingerprints processing and its purpose. Furthermore, the parents’ consent obtained by the controller was lawful and didn’t violate Article 9(1) GDPR and Article 9(2)(a) GDPR. The DPA brought a cassation appeal before the Supreme Administrative Court (Naczelny Sąd Administracyjny – NSA). The Supreme Administrative Court dismissed the cassation appeal. According to the court, if the consent for data processing was compliant with the GDPR, in particular Article 9(2)(a) GDPR, the purpose of processing and the scope of collected data were lawful as well. The court stated that lawful consent guaranteed that the data minimisation principle was respected. Consequently, the processing based on the consent had to be scrutinised by verifying whether the consent was, inter alia, freely given, informed, unambiguous and explicit. Since the controller obtained valid consent under Article 9(2)(a) GDPR, the DPA was unable to find a violation of the data minimisation principle. The court didn’t find any proof of discrimination of students not using the fingerprint scanner. All the students had access to the canteen and were served equally. Thus, the alleged violation of Article 9(2)(a) GDPR didn’t occur. Also, the court found the fingerprints were stored exclusively in the fingerprint scanner. Fingerprints collected by the fingerprint scanner were combined with a specific number, which was transferred to a software. The software attributed the number with the students’ identity. As a result, the fingerprint scanner was unable to combine the fingerprint with the students’ identity; at the same time, the controller didn’t possess the data base of students’ fingerprints.
DSB (Austria)
The data subject underwent a rehabilitation stay in a therapy centre approved by the controller, a social insurance provider. On 27 June 2022, a district court requested the controller to disclose the location of the data subject’s rehabilitation stay in the context of enforcement proceedings. The controller provided the name and address of the therapy centre. The data subject later argued that this information revealed sensitive health data and that the disclosure was unlawful. He also claimed that the controller failed to properly assess the legality of the court’s request and should have refused or sought clarification. On 10 January 2023, the data subject filed a complaint with the DPA, alleging a violation of his right to confidentiality and unlawful processing of health data. The DPA rejected the complaint. The data subject appealed to the court, maintaining that the disclosure lacked a legal basis and exceeded what was necessary. First, the court classified the information about the rehabilitation location as health data within the meaning of Article 9 GDPR, as it allowed inferences about the data subject’s medical condition. Second, the court held that the disclosure was lawful under Article 6(1)(c) GDPR and Article 6(1)(e) GDPR because the controller acted under a legal obligation and in the exercise of a task in the public interest. The relevant legal basis derived from national provisions requiring social insurance bodies to provide information to courts. Third, the court found that Article 9(2)(g) GDPR applied, as the processing was necessary for reasons of substantial public interest based on national law. Fourth, the court emphasised that the controller complied with the principle of data minimisation under Article 5(1)(c) GDPR, as it disclosed only the specific information requested by the court and nothing beyond that. Fifth, the court rejected the argument that the controller had to assess the legality of the court order in detail. It held that there was no obvious unlawfulness or excess of competence in the request, and the controller could reasonably rely on it. Finally, the court concluded that the interference with the right to confidentiality under § 1 DSG was justified and proportionate. It therefore dismissed the appeal and confirmed that no GDPR violation had occurred.
CJEU case C‑621/22 Koninklijke Nederlandse Lawn Tennisbond
The controller is a tennis federation. Members of an affiliated tennis association, they automatically become a member of the tennis federation. In 2018, the controller supplied two of its sponsors (a Sporting equipment retailer and a online betting company) with the personal data of its members in exchange for money. The sponsors used the personal data for marketing purposes. After complaints were lodged by members of the controller with the Dutch DPA (Autoriteit Persoonsgegevens), itheld that the controller had violated Articles 6(1)(a) and (f) GDPR in combination with Article 5(1)(a) GDPR, as it had disclosed personal data without the consent of the data subjects or any other valid legal basis. The DPA purported that only an interest in law, with a legal basis can prove a legitimate interest under the GDPR and fined the controller €525,000. The controller brought an action against the DPA’s decision before the District Court of Amsterdam (Rechtbank Amsterdam - Rb. Amsterdam) and argued that the disclosure of the personal data of its members was justified due to a legitimate interest as per Article 6(1)(f) GDPR. The legitimate interest is comprised of creating a close connection with the data subjects and being able to offer them discounts and offers from sponsors enabling them to play tennis at a more affordable price. In general, the controller argued that any interest, as long as it is not unlawful, can constitute a legitimate interest. On the 22 September 2022, the District Court requested a preliminary ruling by the CJEU since it had doubts as to the interpretation of legitimate interests under Article 6(1)(f) GDPR and so posed the following three questions to the CJEU: 1. How should the District Court interpret legitimate interests under Article 6(1)(f) GDPR? 2. Is it to be interpreted as encompassing only interests founded in law? 3. Can any interest classify as a legitimate interest as long as it is not unlawful? More specifically: can a purely commercial interest and the present interest, namely the provision of personal data for a fee without the consent of the data subject, be classified as a legitimate interest under certain circumstances? If so, what circumstances determine whether a purely commercial interest is a legitimate interest? The court decided to answer the questions together and referred to the judgment C 252/21, recalling that the legal basis of legitimate interest under Article 6(1)(f) GDPR should be interpreted narrowly as they legitimise the processing of personal data without the data subjects consent. However, in principle, a wide range of interests is capable of being regarded as legitimate and as per Recital 47, a legitimate interest must not be grounded in law. The court highlights that the recital cites direct marketing purposes in general as an example of legitimate interests that may be pursued by a controller. Therefore, a legitimate interest is not limited to interests enshrined in and determined by law. The court states that the interest must be analysed taking into account the applicable legal framework and all the circumstances of the case. In addition to the pursuit of a legitimate interest the processing of personal data has to be necessary for the purposes of the legitimate interests pursued. Also, a balancing test between the data subject’s interests or fundamental freedoms and rights over the legitimate interest of the controller has to be performed. As to the necessity, the processing is only necessary when the legitimate interest pursued cannot reasonably be achieved as effectively by other – less restrictive – means. In the case at hand, the controller could have informed its members beforehand and asked whether they agree to the transmission of their data to the sponsors for marketing purposes. This alternative would limit the disclosure of data to what is absolutely necessary. Regarding the balancing test, the court highlighted that the disclosure of data to a sponsor operating casinos and gambling websites could even have negative effects on the data subjects (e.g. the risk to develop gambling addiction). Particular importance must be attached to the question whether, at the time when their personal data were collected for the purpose of joining a tennis club, those members could reasonably have foreseen that those data would be disclosed to third parties for marketing purposes, in return for payment The court concluded that a legitimate interest does not have to follow from a legal norm but it must be lawful. Further, an interest only meets the requirements of Article 6(1)(f) GDPR if it is absolutely necessary and the fundamental rights and freedoms of the data subjects do not outweigh this interest.
CJEU case C‑21/23 Lindenapotheke
The reference originates from a civil dispute between two competing pharmacists (the controller and DR) brought before a German regional court (Landgericht Dessau-Roßlau – LG Dessau-Roßlau). The controller sold non-prescription but pharmacy-only medicine through Amazon requiring customers to enter their name, delivery address and the information necessary for the individualization of the medicines. On the basis of the German legislation on unfair commercial practices, DR sought an injunction prohibiting the controller from selling pharmacy-only but non-prescription medication through Amazon unless customers could express their consent to the data processing in advance. DR alleged that the sale through Amazon was unlawful under the GDPR as it did not ask for the prior consent of the customer’s as required under Article 9(2) GDPR for the processing of sensitive data. The Regional Court and the Higher Regional Court (Oberlandesgericht Naumburg – OLG Naumburg) held that the marketing of pharmacy-only medication is contrary to paragraph 3 of a national law on unfair competition ([https://www.gesetze-im-internet.de/uwg_2004/__3.html §3 Gesetz gegen den unlauteren Wettbewerb (UWG)]). Also, without explicit consent from the customers, the processing is prohibited under the GDPR since it entails the processing of special categories of personal data. The controller then appealed the case to the Federal Court of Justice (Bundesgerichtshof - BGH) which referred to the CJEU the following preliminary questions: 1) Does the GDPR preclude national provisions which grant competitors the power to take action against the infringer for infringements of the GDPR by way of an action before the civil courts under the prohibition of unfair commercial practices? 2) Are the data of an online pharmacist’s customers in connection with online-orders for pharmacy-only (but not prescription-only) medicines health data within the meaning of Article 9(1) GDPR? 1. First question (Chapter VII
Meta Platforms Ireland Limited
In 2018, Meta Platforms Ireland (“controller”) presented new Facebook terms of service to its users in the European Union, with a view of obtaining their consent. The data subject, a Facebook user, accepted the new terms of service presented by the controller. The data subject received advertisement for a female politician on the basis of the analysis that he was similar to other “customers” who “liked” her. He also regularly received advertising aimed at homosexuals and invitations to corresponding events. The data subject had publically referred to his homosexuality, but had never mentioned his sexual orientation on Facebook, nor published any sensitive data. He hadn’t authorised the controller to use the fields in his profile relating to his relationship status, employer, job title or education for the purposes of targeted advertising either. Those advertisements and invitations were not based directly on his sexual orientation or his “friends” on Facebook, but on an analysis of their particular interests. The data subject claimed that the controller recorded all data relating to him, including those obtained through third parties or plug-ins, and stored them for an indefinite period. Subsequently, during a panel discussion, the data subject referred to his sexual orientation during a speech aimed at criticizing the allegedly unlawful processing by the controller of data relating to his sexual orientation. The data subject therefore brought an action before the Landesgericht für Zivilsachen Wien (Regional Court for Civil Matters, Vienna, Austria) seeking enforcement, a declaration and an injunction concerning the allegedly unlawful processing of his personal data. His action was dismissed at first instance on 30 June 2020 and, on appeal, by the Oberlandesgericht Wien (Higher Regional Court, Vienna, Austria) on 7 December 2020. The data subject therefore lodged an appeal with the Oberster Gerichtshof (Supreme Court). The latter referred a total of four questions to the CJEU. However, two of them were withdrawn following the judgement of 4 July 2023, Meta Platforms and Others. The two remaining questions are: # Does the data minimisation principle (Article 5(1)(c) GDPR) mean that all personal data held by a platform may be aggregated analysed and processed for the purposes of targeted advertising without any restriction? # Does Article 5(1)(b) read in conjunction with Article 9(2)(e) GDPR mean that a statement made by a person about their sexual orientation for the purposes of a panel discussion permits a controller to process other data concerning their sexual orientation to offer them personalised advertising? Advocate General Rantos published his opinion on the matter on 25 April 2024. On the first question: Firstly, the Advocate General recalled that the CJEU has stated that the principle of data minimisation set out in Article 5(1)(c) GDPR provides that personal data should be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. This reflects the principle of proportionality. Therefore, the principle of data minimisation aims to minimise the restrictions on the right to the protection of personal data caused by the processing (§20 of the Opinion). The Advocate General considered that the absence of any limitation is, by definition, contrary to the principle of data minimisation (§21 of the Opinion). Regarding the restrictions relating to time, the Advocate General states that in the absence of a specific provision in the GDPR, the EU judicature cannot set a mandatory time limit of the retention of such data. An initially lawful processing may over time, become incompatible in particular with Article 5(1)(c) GDPR if the data is no longer necessary in light of the purposes for which they were collected. Therefore, the referring courts must assess if the period of retention of personal data by the controller is justified having regard to the legitimate aim of processing said data, for the purposes of personalised advertising (§22 of the Opinion). Regarding the restrictions relating to the type of data, the Advocate General held that it is also for the referring court to determine whether the processing of personal data may be considered lawful in accordance with the principle of proportionality, with regard to the circumstances of the present case (§23 of the Opinion). Secondly, the Advocate General indicated that Article 5(1)(c) uses very general conditions (“adequacy”, “relevance”, “necessity”) which demonstrates that the EU legislature intended to leave a wide discretion to the competent authorities. Indeed, these conditions can only be interpreted on a case-by-case basis (§25 of the Opinion). However, the Advocate General considered that certain distinctions may be drawn depending on the impact on data subjects’ rights. On the one hand, a distinction can be made between 'static data' (age or sex for example) and ‘behavioural’ data (monitoring users’ browsing habits for example), as the latter is in general more intrusive as regards to the data subject’s rights. Regarding behavioural data, a distinction can also be drawn between ‘active’ behaviour (clicking on the ‘like’ button for example) and ‘passive’ behaviour (visiting a website for example), as the latter is generally more intrusive for the user. On the other hand, the Advocate General also distinguishes between the processing of personal data collected of the Facebook platform, and outside that platform, the latter being more intrusive for the data subject (§25 of the Opinion). The Advocate General also held that it is important to take into account the reasonable expectations of data subjects (§26 of the Opinion). Therefore, the Advocate General found that Article 5(1)(c) GDPR does not allow the processing of personal data for the purposes of targeted advertising without restriction as to time or type of data. The referred court must assess, in light of the circumstances and by applying the principle of proportionality, the extent to which the data retention period and the amount of data processed are justified with regard to the purpose (§28 of the Opinion). On the second question: Article 5(1)(b) GDPR establishes that personal data must be collected for specified, explicit and legitimate purposes. Article 9(1) GDPR indicates that processing of data concerning, inter alia, a natural person’s sexual orientation is prohibited, unless such processing falls under one of the exemptions provided for in Article 9(2) GDPR. Under, Article 9(2)(e) GDPR, one of these exemptions is when the personal data is made manifestly public by the data subject. The Advocate General pointed out that the use of the adverb ‘manifestly’ and the fact that this provision is an exemption to the general prohibition requires a particularly stringent application of that exemption. The data subject must be fully aware that by an explicit act they are making their personal data accessible to anyone (§35 of the Opinion). In the present case, the sensitive data was disclosed outside the Facebook platform and outside any other platform or computer application. The CJEU ruled that clicking on ‘Like’ or ‘Share’ buttons does not make the data resulting from the clicking manifestly public ([https://gdprhub.eu/index.php?title=CJEU_-_C-252/21_-_Meta_Platforms_and_Others_v_Bundeskartellamt CJEU, Meta Platforms and Others]). The Advocate General made a distinction between (i) whether the data subject’s statement on his sexual orientation constitutes an act by which he manifestly made public that sexual orientation and (ii) if the response is affirmative, whether this permits the processing of this personal data for personalised advertising purposes (§39 of the Opinion). On the first question, the Advocate General noted that Article 9(2)(e) GDPR requires two conditions to be met: an ‘objective’ condition that the personal data must be ‘manifestly made public’ and a ‘subjective’ condition that ‘the data subject’ makes it manifestly public (§41 of the Opinion). Regarding the first condition, he considered that in the present case, the panel discussion was broadcast live and then as a stream and the subject addressed at the panel was of public interest. Therefore, the data subject’s statement may have reached an indefinite public, much wider than that in attendance (§42 of the Opinion). Regarding the second condition, he held that it was possible to assume that the data subject had full awareness of making that orientation manifestly public, in particular in the context of an event which was open and accessible to the press (§43 of the Opinion). The Advocate General also noted that although once the ‘protected’ personal data has been manifestly made public, it becomes ‘ordinary’ data, it must still however be processed lawfully under the conditions laid down in Articles 6 and 7 GDPR, and in compliance with the principles of Article 5 GDPR (§46 of the Opinion). Therefore, a statement made by a data subject about their own sexual orientation during a panel discussion open to the public may constitute an act by which the data subject has manifestly made public those data under Article 9(2)(e) GDPR. However, this does not in itself permit the processing of those data with a view to aggregating and analysing the data for the purpose of personalised advertising. On 4 October 2024 the CJEU answered the two remaining preliminary questions. On the first question: Firstly, the CJEU stated that Article 5(1)(c) GDPR does not allow the controller, in particular a social network platform, to process the data collected inside and outside the platform for the purpose of targeted advertising for unlimited time and without distinction as to type of data. The CJEU based the reasoning on previous judgements, especially the Schufa case and the Digi case, providing for the interpretation of the data minimisation principle. The CJEU recalls that the data minimisation principle stipulates that personal data must be adequate, relevant and limited to what is necessary in relation to the processing purposes. Regarding the temporal limitation on the processing of personal data, the CJEU emphasised that the principle of data minimisation requires the controller to limit the retention period of personal data to what is strictly necessary in the light of the objective of the processing activity. Regarding the collection, aggregation and processing of personal data for the purposes of targeted advertising, without distinction as to the type of those data, the CJEU held that a controller may not collect personal data in a generalised and indiscriminate manner and must refrain from collecting data which are not strictly necessary for the processing purpose. On the second question: Secondly, the CJEU ruled that the fact that a person made a public statement about their sexual orientation does not authorise the operator of an online social network platform to process other data relation to the sexual orientation of that person. Therefore, in such a case the exemption in Article 9(2)(e) GDPR is not applicable. Initially, the CJEU explained that Meta processed data subject’s data concerning his sexual orientation before it was disclosed publicly by the data subject. Therefore, the exception in Article Article 9(2)(e) GDPR could only affect data processing after that date. Then, the court recalled its judgements putting forward the concept of strict interpretation of Article 9(2) GDPR (in particular, Meta C‑252/21 case). Hence, for Article 9(2)(e) GDPR specifically the data subject needs to have intention to make their data publicly accessible. Disclosure of sexual orientation during a panel organised for general public might fall within Article 9(2)(e) GDPR. Yet, such a disclosure does not refer to any kind of data relating to data subject’s sexual orientation. Thus, the processing of other personal data relating to the data subjects sexual orientation is not not covered from the exemption of Article 9(2)(e) GDPR. Also, the fact that an individual manifestly made public information concerning their sexual orientation does not mean that the individual consented to processing of other data relating to their sexual orientation by the operator of an online social network platform within the meaning of Article 9(2)(a) GDPR.
Court case 21-20.979
A data subject initiated civil proceedings against its employer (the controller). The data subject alleged wage and trade union discrimination. In first instance, the court examining the case ordered the controller to provide the data subject with employment data regarding nine designated employees, including pay slips of the last 3 years. The controller lodged an appeal against the order with the [https://www.cours-appel.justice.fr/caen Caen Court of Appeal] (Cour d'appel de Caen), which confirmed the decision of first instance. It considered that the production of payslips was not only necessary but also the only means available to the data subject to prove the alleged discrimination. The controller then appealed the case before the Supreme Court (Cour de cassation). The Supreme Court first recognised that the right to prove a discrimination can justify the production of documents containing (third party) personal data. Weighing this right to evidence against the right to data protection, the Supreme Court stated that the production of documents containing personal data must be indispensable to the exercise of the right to evidence and proportionate to the aim pursued. Applying the principle of data minimisation, the Supreme Court held that a Court ordering the production of such evidence must, where appropriate of its own motion, limit the production of documents to what is strictly necessary to prove discrimination. By requiring the controller to produce payslips, without limiting the data to be produced to what would be strictly necessary to the proof of discrimination, the Caen Court of Appeal therefore violated the principle of minimisation. The Court therefore overturned the decision of the Caen Court of Appeal and sent the case to [https://www.cours-appel.justice.fr/rouen the Rouen Court of Appeal] (Cour d'appel de Rouen).
Court case 10 O 4/24
On 22 November 2019, a data subject entered into a mobile phone contract with the controller (a telecommunications company). The telecommunications company transmitted to 2 credit information agencies so called 'positive data' about the data subject, in particular information about the commissioning and execution of the contract which included data required to identify the respective person. The data subject received a leaflet regarding the transmission of data to S with a reference to a right of objection. On 19 October 2023, one of the credit information agencies published a press release stating that it would delete customer account information relating to the constoller. This decision was due to following the assessment of the Data Protection Conference of the German States (DSK) and the body of the independent German federal and state data protection supervisory authorities that the transmission and processing of data from the telecommunications sector by credit information agencies for credit scoring cannot be based on a "legitimate interest" according to Article 6(1)(a) of the GDPR and consent is required. The data subject filed a case before the court of first instance (Regional Court of Itzehoe- LG Itzehoe) requesting that the controller is ordered to compensate them for immaterial damages for the data protection breach, cease and desist transmitting their personal data to the credit information agencies and compensate them for all future damages that the plaintiff has suffered and/or will suffer as a result of the unauthorized transmission. They claim that they did not consent to having their personal data shared with the credit information agencies and that the transmission is unlawful and violated Article 6(1) and Article 5(1)(a) GDPR. They alleged it caused non-material damage in the form of loss of control over their data deriving from the transmission, impact on economic decisions and financial freedom, and suffering fear of data loss and sleep dis
Court case W256 2248861-1/8E
The data subject filed a complaint on the 25 March 2021 against the controller, her former partner’s lawyer, with the Austrian DPA (DSB). The data subject alleged that the controller had violated her right to privacy under [https://www.jusline.at/gesetz/dsg/paragraf/artikel1zu1 paragraph 1(1) of the Austrian Data Protection Act (Datenschutzgesetz – DSG]). Since 2020, the controller and the data subject’s lawyer have been engaged in settling the divorce proceedings. The data subject’s former partner demonstrated detailed knowledge of the data subject’s extramarital affair which made her conclude that he may still have access to the video surveillance cameras in her home. The data subject’s lawyer therefore requested the controller to submit the recorded video material through a data carrier. The controller responded to this request by sending an unsecured zip file in an email containing 41 files showing the data subject engaging in explicit actions. In her complaint, the data subject argued primarily that she did not expect the transmission of such explicit content and therefore had not consented to this processing of her data. Further, she argued that the unsecured transmission of the data via email as well as the disclosure of the material to employees of the controller was unnecessary. She further argued that the transmission of the highly sensitive data should have been carried out in person, directly by her ex-partner. The DSB held that the controller processed the data to give effect to a legitimate interest under Article 6(1)(f) GDPR and that under Article 32 GDPR a data subject is not entitled to select which security measures are implemented for the processing. The data subject appealed the decision to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The court recalled, that the data subject had alleged only a breach of [https://www.jusline.at/gesetz/dsg/paragraf/artikel1zu1 paragraph 1(1) of the Austrian Data Protection Act (§1(1)
Court case 13 O 220/23
The controller is a telecommunications company. The data subject and the controller entered into a mobile phone contract. During the conclusion of the contract the controller provided the data subject with an information sheet that included information about the transfer of personal data to the Schufa, a credit rating agency. Following the closure of the contract, the controller transmitted personal data of the data subject to Schufa, such as the fact that a contract was formed, name, date of birth, address, date of the contract closure, and the contract identifier. The data subject had not explicitly consented to this transfer. [https://www.schufa.de/newsroom/schufa/daten-loeschung-telekommunikationskonten/ In a press release made public on 19 October 2023], Schufa informed the public that it was going to delete information transferred by telecommunication companies by the 20 October 2023. Schufa noted that the Conference of the German Data Protection Agencies (Datenschutzkonferenz der Länder) was of the [https://www.datenschutzkonferenz-online.de/media/dskb/20210929_top_07_beschluss_positivdaten.pdf opinion] that the transfer and processing of so called positive data (i.e. data without connection to a payment default or another violation of the contract by the data subject) required the consent of the data subject. Data concerning the conclusion of a contract would constitute such positive data. With his lawsuit, the data subject claimed, inter alia, non-material damages and a declaratory judgement that all future damages arising from the alleged GDPR infringement have to be borne by the controller. This declaratory judgement concerning damages is a standard in German law due to statutory limitation that would otherwise prevent the person claiming damages from bringing any claims after a period of three years (such as for long-term consequences of a car accident). The court held that the action for a declaratory judgement was inadmissible. The data subject failed to present the court with a sufficient legal interest which is needed for such a declaratory judgement under [https://www.gesetze-im-internet.de/englisch_zpo/englisch_zpo.html#p0950 § 256 German Civil Process Order (Zivilprozessordnung – ZPO)]. In cases of declaratory judgements concerning future material damages the admissibility of such an action is depends on the probability of such a damage. The data subject needs to present the court with sufficient facts and bears the burden of proof. Even when considering just the data subject’s claims, the court found that there was no plausible future damage. Concerning the non-material damages, the lawsuit was dismissed. The criteria of Article 82(1) GDPR were not met. The court held that there was no GDPR infringement since the controller could rely on Article 6(1)(f) GDPR for the data transfer to Schufa. The court admitted that in the German case law there is a controversy on the question whether the right to privacy and data protection of the data subject outweighs the controller’s claimed legitimate interests (fraud prevention, overborrowing, and credit risk prognosis). In similar cases, some other courts held that the rights and interests of the data subject took precedence over the controller's legitimate interests ([https://gdprhub.eu/index.php?title=LG_Stuttgart_-_27_O_60/24 see for example LG Stuttgart 27 O 60/24]). The court in the present case, however, decided that the interests of the controller superseded. The court held that also the data subject had an indirect interest in the transfer of their data since risk minimization for the controller had to result in lower prices for the consumer. Furthermore, the so called positive data (like the data about the conclusion of the contract) were less invasive than negative data (e. g. about customers failing to pay). Also, a lack of positive data can lead to a negative bias in the scoring of the controller. The data subject also failed to present the court with facts that the transfer of the personal data in this case had a negative effect on his score. These facts had to be taken into account in the weighing of the conflicting positions at hand. Finally, the court stated that the constant fear of negative questions about his creditworthiness claimed by the data subject were not plausible because the transferred data are neutral.
Court case W287 2248365-1/12E
A journalist submitted a query on the outcome of an interrogation of two police officers to the state police department. The state police department responded that due to paragraph [https://www.ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?ResultFunctionToken=5fed9deb-b9d5-47fc-901c-04b45e84e503&Position=1&SkipToDocumentPage=True&Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=05.11.2024&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=Datenschutzgesetz 1(1) of the Austrian National Data Protection Act] (Datenschutzgesetz – DSG) the provision of information was not possible. In its reasoning the state police department highlighted that the police officers in question were identifiable through publicly available video footage. It further stated that the journalist did not show an outweighing interest which would warrant the provision of information. The journalist responded to the state police department explaining that he is not interested in personal data on the police officers but merely requests to know the outcome of the interrogation which he was informed about. He further submitted that he does not intend to publish the provided information. The state police department explained that providing the information would enable drawing conclusions on whether the officers were subject to disciplinary measures which in turn affects their standing as employees and therefore their concerns their right to privacy. The journalist filed a complaint on the 6 October 2021 alleging that the state police department had not objectively balanced the interests of the police officers with the journalists request for information. The complaint was forwarded t
Court case W252 2277317-1
The data subject filed a complaint with the Austrian DPA (DSB) on the 5 January 2021 against her ex-partner (the controller). In her complaint, she detailed that her former partner had recorded their fights in order to use these recordings in divorce proceedings. The DSB rejected the data subject’s claim as it found that the DSB was not authorized to make a decision in this case due to the principle of proportionality (“Übermaßverbot”) as it found that making a decision in this case would excessively infringe on the concerned parties rights. The data subject appealed the decision of the DSB to the Federal Administrative Court (Bundesverwaltungsgericht - BVwG). The BVwG assessed whether the controller violated the data subject’s right to privacy through making recordings to be used as evidence in divorce proceedings. In assessing whether the so called household exception in Article 2(2)(c) GDPR prevents the application of the GDPR in this case, the BVwG referred to C-25/17, in which the CJEU showed that only exclusively personal or familial actions are precluded by this provision. The court held that the disapplication of the GDPR through the household exemption is to be interpreted in a restrictive way and that the controller did not intend to use the recordings for merely personal purposes. Therefore the court held that the GDPR applied to the processing and also rejected the DSB’s claim of the limitation due to the principle of proportionality. The court accepted that the recordings intended to be used in divorce proceedings can be legitimized under Article 6(1)(f) GDPR. It highlighted that as per C-26/22 and C-64/22, it must be assessed whether the legitimate interest cannot be achieved through less invasive means. The court held that the recording was indeed necessary for the interest pursued by the controller. However, the court stated that the interest of the data subject not to be recorded in her own home, outweighed the interest of the controller to avoid financial disadvantages in divorce proceedings. Therefore, the recording could not be based on Article 6(1)(f) GDPR and was therefore unlawful.
HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG
In the main proceedings, the applicants are investment companies which hold shares indirectly through a trust company in investment funds. The applicants request the defendants, which are trust companies, to disclose the names and addresses of all their partners with indirect shareholdings in the investment funds concerned. The defendants object to such a disclosure, arguing that there are clauses prohibiting disclosure of those data to other shareholders. Moreover, they think that the only reason for which the applicants want to access this data is because they want to promote their own investment products. This matter was brought before the Local Court of Munich (Amtsgericht München – AG München). According to this Court, the case law of the Federal Court of Justice (Bundesgerichtshof – BGH) and of the Higher Regional Court of Munich (Oberlandesgericht München – OLG München) obliges the defendants to share the data, except from the case when there is an abuse of rights. However, the AG München is uncertain as to the compatibility of this case law with the GDPR and, therefore, stayed the proceedings and referred the matter to the CJEU for a preliminary ruling. In short, the Court asked the CJEU if Article 6(1)(b) and 6(1)(f) GDPR must be interpreted in the sense that a processing of personal data, consisting in disclosing the identity of all the partners with indirect shareholdings in a fund irrespective of the size of their shareholding in the capital of those funds, for the purpose of contacting them and negotiating the purchase of their shares or to coordinate with them, can be either * regarded as necessary for the performance of a contract to which the data subjects are parties, or * for the purposes of legitimate interests pursued by the controller or by a third party. First, since the referring court made a reference to an obligation stemming from national case law, the CJEU considered necessary to reformulate the questions referred as extending to the in
Court case 3 Ca 77/24
The controller was president of a large association of air sports clubs ("the association") and the data subject was an employee of this association. On 11 May 2023, the data subject wrote an email to 24 people, including the controller, in which the data subject addressed, among other things, his health situation and its cause. In her capacity as president, the controller sent a circular to all (almost 10,000) members of the association on 11 June 2023 stating that the data subject - despite being on sick leave since November 2022 - had made unfounded allegations against (among others) the controller. On the 6 June 2023, the controller terminated the employment relationship with the data subject. However, subsequently the controller was voted out of her position as president of the association. The data subject then continued to work for the association as it retracted the termination of employment. The data subject was affected in his daily life at the airport (the location of the association's air sports activities) by the controller's circular. In particular, when the data subject met new people from the numerous airports and clubs affiliated with the association, he was confronted with the controller's circular. The data subject demanded at least €17,000 in non-material damages from the controller for degrading him by publishing sensitive data, namely his illness and its duration. Furthermore, the data subject argued, that the controller gave the impression that the data subject was damaging the association by falsely "calling in sick". The court held, that the data subject is entitled to €10,000 compensation from the controller in accordance with Article 82(1) GDPR. The court found that the controller had violated the lawfulness principle in article 5(1) GDPR and that they had processed special categories under article 9(1) GDPR unlawfully. The court further elaborated that the controller had processed data without consent from the data subject and tha
Telecom provider (Controller)
The data subject had a mobile contract with the controller, a telecommunications company, starting 17 April 2019. The contract included privacy notices stating that personal data, including contract initiation, execution, and completion (“positive data”), could be sent to a credit scoring agency for credit scoring, under Article 6(1)(b) and (f) GDPR. The data subject did not provide explicit consent. On 18 April 2019, the controller transmitted positive data to the credit scoring agency. On 12 October 2023, the data subject received a credit report confirming this transmission. The report showed a high credit score and contained no negative entries. The data subject claimed this transmission caused immaterial harm, including loss of control over personal data, stress, and fear of economic disadvantage. They requested compensation of €5,000, a permanent injunction against future positive data transmission without consent. The controller argued that the transmission served legitimate interests, namely fraud prevention and accurate risk assessment, and that the data had been deleted by the credit scoring agency between October and November 2023. First, the court confirmed that fraud prevention constituted a legitimate interest under Article 6(1)(f) GDPR. Alternative measures, such as staff training, only offering pre-paid contracts, or sectoral data pools, were insufficient. Second, the court carried out a proportionality assessment. The data subject’s interest in data protection and economic security did not outweigh the controller’s interest. The positive data were accurate, non-sensitive, and had been disclosed transparently in contract documents. The data subject’s score was high, and the data had been deleted already, eliminating the risk of further adverse effects. Third, the court decided the data subject did not demonstrate immaterial damage under Article 82(1) GDPR. The claimed loss of control, stress, and anxiety over future transactions were hypothetical and lacked concrete causation or impact. Mere apprehension of future misuse was insufficient. Finally, the court concluded that there was no violation of GDPR obligations, as processing was justified under Article 6(1)(f) GDPR. Consequently, the court dismissed the data subject’s claims.
Arbeitsmarktservice Österreich
On 25 November 2019, the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde – DSB) against the controller, the Austrian unemployment office (“Arbeitsmarktservice Österreich”). The data subject received unemployment payments through the controller which is a body that helps people find employment. The controller had retained data on the data subject’s transactions relating to their unemployment between 1992 and 1994. Between 1992 and 1994, the data subject had received unemployment payments and emergency aid payments. When on the 16 November 2019 the data subject again wanted to apply for unemployment payments, his account included pre-saved information on him. It included the data subject’s address and family status as well as information on transactions between 1992 and 1994. The DSB rejected the complaint on 3 February 2021, as it considered the processing of the data to be necessary for the execution of the controller’s current obligations. The data subject appealed this decision to the Federal Administrative Court (Bundesverwaltungsgericht BVwG) which accepted that the processing was unlawful but rejected the claim in relation to the right to erasure. The BVwG reasoned that an Austrian law governing the actions of the controller ([https://www.jusline.at/gesetz/amsg/paragraf/25 §25 Abs. 9 Arbeitsmarktservicegesetz – AMSG]) set out a clear limit of seven years for the retention of this kind of data (as defined in paragraph 25(1) AMSG). When the data is needed after the seven year period, the data could be requested from social insurance agencies. Therefore, the BVwG concluded that the processing had been in violation of Article 5(1)(e) GDPR since 2018. In relation to the erasure of the data, the BVwG held that the data from 1992-1994 is needed for the current unemployment payments therefore it rejected the argument that the data subject's right to erasure had been violated under Article 17 GDPR. Both the data subject and the controller ap
Human-Etisk Forbund (the Norwegian Humanist Association )
The Church of Norway had access to birth certificates of children. Some data subjects discovered that they or their children were listed as member of the Church of Norway. Although the state church system was abolished, and there was no legal basis for access to confidential information from the National Population Register, the data were processed by the Church of Norway. The data subjects lodged a complaint with the Norwegian DPA (Datatilsynet). In parallel, a Norwegian NGO, the Norwegian Humanist Association (Human-Etisk Forbund) filed similar complaints on behalf of five of its members. The DPA reprimanded the Church of Norway for a violation of Article 6(1) GDPR, Article 14(1)(d) GDPR, Article 14(2)(f) GDPR in conjunction with Article 12(1) GDPR. The DPA found the Church of Norway accessed and processed birth certificates for members' children from the National Population Register without a legal basis. Additionally, the Church of Norway didn’t provide its members with easy accessible information about the processing taking place. The data subject, including the ones represented by the Norwegian Humanist Association, appealed against the DPA decision with the Data Protection Board (Personvernnemnda). The data subjects stood on a position that the reprimand issued against the Church or Norway was inadequate and more severe correction measures needed to be applied by the DPA. The Data Protection Board dismissed the appeal. The aim of the appeal was to contest the measures applied by the DPA in reaction to the GDPR violation. However, the Board found no need to reconsider the appropriateness of the measure imposed by the DPA. The Privacy Appeals Board emphasised that the DPA’s choice of reaction towards a violation of the GDPR was not supposed to be influenced by data subject’s expectation of “revenge”. Hence, the data subject had no interest in the outcome of the case after the DPA's correction measure brought the processing into compliance with the GDPR.
Court case IX R 6/23
The parties involved are in dispute about the fact that the German tax office requires a copy of the rental agreements from the landlady (taxpayer) as part of an income tax return. The landlady is the data controller, the tenants are the data subjects and the tax office would be the recipient of the data. In the income tax returns for 2018 and 2019, the controller submitted her statements of the total rental income, depreciation, administrative and maintenance expenses for the respective property for its income from letting and leasing various properties. The tax office requested a copy of the rental agreements, service charge settlements and on claimed maintenance expenses from the controller. The controller submitted the gross and net rental income with the names of the tenants blacked out as well as the operating costs for the various apartments and documents on the maintenance expenses, but not the requested copies of the rental agreements and maintenance expenses. The data controller argued that the disclosure of the requested documents was not possible without the consent of the data subjects. Furthermore the tax office was not entitled to request the documents, as the rental agreements were not required to check the actual income. The tax office responded with a request for the rental agreements in question, referring to the duty of cooperation of the controller under the German Fiscal Code (Abgabenordnung - AO). The documents are necessary for the verification of the income data submitted by the controller. The tax office rejected an objection on its decision by the controller as unfounded and repeated the obligation to cooperate according to AO. The duty to cooperate includes in particular the complete and truthful disclosure of the facts relevant to taxation and the provision of evidence. The tax office may, at its own discretion, determine which evidence it deems necessary within the meaning of the relevant section of the AO. The tax office requires the names of the tenants and the respective rental agreements to verify the tax-relevant circumstances. The GDPR does not prevent the fulfillment of the obligations to cooperate, as the controller is entitled to transfer the personal data contained in the contracts for the purpose of fulfilling these tax obligations in accordance with Article 6(1)(c) GDPR. The Fiscal Court Nuremberg (Finanzgericht Nürnberg - FG Nürnberg) dismissed a legal action brought by the controller. The Federal Fiscal Court dismissed the appeal as unfounded. The Fiscal Court Nuremberg correctly assumed that the tax office was entitled to request the rental agreements from the data controller. The rental agreements are documents that can be requested for inspection by the tax office in accordance with § 97(1) AO. The request to submit the document is an administrative action within the meaning of § 118 AO. The court considered the tax offices request for the documents to be a discretionary decision by the administration. This disclosure of documents is subject to the principle of proportionality, i.e. it must be suitable and necessary to clarify the facts, the fulfillment of the obligation must be possible for the person concerned and the use must be necessary, proportionate and reasonable The court held that the tax office needed the rental agreements to check the tax-relevant circumstances and that these represented a suitable means. The rental agreements would contain tax-relevant information e.g. amount of the agreed rent, rent increases, the composition of the rent, the scope of the right of use and the actual implementation of the rental. The tax office had no other equally effective means of clarification. The income tax returns and income documents of the data controller were insufficient as a means of control, as they are prepared without the involvement of the tenants. Personal data of the tenants are required in order to be able to allocate the payment flows to the respective tenancy. The tenants data in the rental agreements are personal data pursuant to Article 4(1) GDPR and the disclosure by the data controller constitutes a data processing operation pursuant to Article 4(2) GDPR. It was also possible for the controller to disclose the tenants data because she is entitled to do so under Article 6(1)(c) GDPR in conjunction with § 97 AO. Accordingly, the court held that data processing by disclosing the rental agreements to the tax office is considered lawful if it is necessary for the fulfillment of a legal obligation to which the controller is subject. In this case, the court considered this legal obligation to be based on § 97 AO. The subsequent data processing by the tax office is also lawful, as § 29(b) AO allows the processing of personal data by the tax authority if it is necessary for the exercise of public authority. The court found that Section 29(b) AO is the national legal basis for data processing in conjunction with Article 6(1)(e) GDPR.
Employee versus Employer
The data subject was an employee at a company. Him and the employer (controller) had a difficult relationship, after the latter had unsuccessfully tried to let him go for not adequately fulfilling his duties. Then he decided to relocate him in another region, despite the data subject's opposition. On 4 February 22, the data subject submitted a medical certificate for incapacity to work for the period between 4 February and 4 March 2022, due to an injury suffered outside of working hours on that day. The controller suspected a feigned illness and engaged a detective agency to monitor the employee during that period. The investigators observed him in public areas and near his home, recording his physical activities such as shopping, carrying heavy objects, and working on his terrace. When the data subject became aware of it, he filed a case before the court of first instance (Regional Labor Court of Düsseldorf - AG Düsseldorf) seeking compensation for immaterial damages at least €25,000, under Article 82(1) GDPR, for the unlawful processing of his personal data and especially health data. The Labour Court dismissed the claim, holding that the controller had legitimate interest in the surveillance and it was necessary for the exercise of his rights under Article 9(2)(b) GDPR in conjunction with § 26(3) of the German Federal Data Protection Act (BDSG). On the data subject's appeal, the court (Higher Labour Court of Düsseldorf -LAG) overturned the ruling and ordered the controller to pay compensation in the amount of €1,500. Both parties appealed to the Federal Labour Court (BAG). The data subject sought a higher sum while the employer sought dismissal of all damages. The Federal Labour Court dismissed both appeals, upholding the award of €1,500 in damages under Article 82(1) GDPR. First, it found that observing and documenting the data subject’s physical condition, such as his gait and mobility, constituted processing of health data under Article 9(1) GDPR. Se
Court case 1 O 64/24
The data subject entered into a telecommunications contract with the controller who then informed a credit rating agency about the establishment of the contract and disclosed personal data in connection with the contract. The data subject claimed that he never consented to the transmission of the data. He elaborated that the controller acted unlawfully as the transmission of the data was not necessary for the performance of the contract nor justified through legitimate interest under Article 6(1)(f) GDPR. In addition, the data subject claimed appropriate damages as he believed that the transmission of data negatively affected his credit score which caused him persistent existential worries. The controller argued that the transmission of data is necessary for fraud prevention, prevention of overindebtedness and for the precise prognosis of risk of default. Further, it stated that the transmission in question was indicated to the data subject when entering into the contract and rejected the argument that the data transmitted affected the credit score of the data subject. Before the claim was filed by the data subject, the credit rating agency had already deleted the data indicating whether a telecommunications contract had been entered into. The regional court of Passau (Landesgericht Passau – LG Passau) held that the data transmission was permissible under Article 6(1)(f) GDPR as it was necessary for the legitimate interests of the controller and third parties. The transmission of data was held to be necessary for fraud prevention as it allows for more precise prognosis on overindebtedness and risk of default. Moreover, due to the narrow scope of the transmitted data the court found that the fundamental rights or freedoms of the data subject did not outweigh the controller’s interests. The court further rejected the data subject’s claim to damages under Article 82(1) GDPR. It found the argument that precisely this transmission of data negatively affected the data subject’s sentiment not credible (especially since his credit score showed a “very low risk” of default). The data subjects claim was found to be unwarranted and therefore rejected by the court.