GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
BBVA
This decision is the result of an appeal against a Spanish DPA (AEPD) decision (a summary is available on GDPRhub) which fined Banco Bilbao Vizcaya Argentaria, SA (BBVA) a total of €5,000,000 for violating articles 6, 13 and 14 of the GDPR. The bank filed a judicial appeal against the DPA decision. Among other aspects, BBVA claimed that there was a total disconnection between the object of the procedure by the DPA and the complaints made by the data subjects. It argued that the DPA used specific and individual facts and complaints as an excuse to initiate a sort of general review of BBVA's practices and their data protection policy. While rejecting some of the arguments of BBVA, the Court agreed that there is a relevant disconnection between the initial complaints and the final DPA decision. The Court stressed that Article 57(1)(f) GDPR enables the DPA to investigate facts or the subject matter of the complaint. However, the Court considered that this would not cover the opening of a general procedure against the data protection policy itself. In its reasoning, it referred to one of its previous decisions from 23 April 2019 (Rec. 88/2017), in which it defined criteria for the application of the principles of the administrative sanctioning procedure within the scope of the DPA. In the case at hand, the judges agreed that the DPA failed: (i) to examine the facts reported in the complaints; (ii) to make an assessment of the evidence in relation to those facts; and (iii) to link the facts to the data protection policy document. Rather, they found that the DPA opened a general investigation into the data protection policy of BBVA. In the Court's view, the DPA was bound by the facts of the data subject complaints. Therefore, the DPA is (at least initially) limited to investigate said facts or the "subject matter of the complaint". The Court invoked the principle of legality, provided for in Article 25(1) of the [https://www.boe.es/buscar/pdf/1978/BOE-A-1978-31229-c
Court case G 287/2022-16, G 288/2022-14
Prompted by two complaints again decisions of the Austrian DPA, which were brought in before it, the Austrian Federal Administrative Court questioned the constitutionality of § 9(1) Austrian Data Protection Law (DSG) and sent an application to the Austrian Constitutional Court for the assessment of the constitutionality of § 9(1) DSG. Besides through the GDPR, and in contrast to the majority of other EU member states, data protection in Austria is also covered by the constitutional right to data protection and secrecy pursuant to § 1 DSG. This stood in contrast with § 9(1) DSG, which provided a blanket data protection exemption for a broad category of media actors. The first complaint, which the Federal Administrative Court took note of, was the case G 287/2022, which concerned an alleged data protection breach of a media company. The company had published a report and images of a house search, including unredacted pictures of a data subject's business card. The DPA rejected the complaint, arguing that considering the "media privilege" pursuant to § 9(1) DSG, it was not competent to handle the complaint. In complaint number two, concerning case G 288/2022, data subjects argued that a publishing company and a broadcasting company had unlawfully disclosed a "data leak" at an e-mail box attributable to the data subjects. Similar to the complaint mentioned above, the DPA deemed itself not competent pursuant to § 9(1) DSG. The data subjects in both cases appealed to the Federal Administrative Court which further sent an application to the Constitutional Court for the assessment of the constitutionality of § 9(1) DSG. The Austrian Constitutional Court sided with the data subjects and held that the "blanket" exemption, which § 9(1) Data Protection Act gives to media owners and journalists, is unconstitutional and not in line with the requirements of Article 85 GDPR. § 9(1) DSG provides - in implementation of the obligation under EU law pursuant to Article 85(1) GDPR - that the provisions of the DSG (and several chapters of the GDPR) do not apply to the processing of personal data by media owners, publishers, media staff and employees of a media company or media service within the meaning of the Austrian Media Act for journalistic purposes of the media company or media service. In its assessment, the Constitutional Court first noted that the legislator is subject to a double binding, namely a binding to Union law (in this case the opening clause of Article 85 GDPR) and a binding to the framework established by constitutional law. The relevant provision of Union law, Article 85 GDPR, only states that Member State should provide for "derogations or exemptions" to the GDPR for the processing of personal data for journalistic purposes "to the extent necessary to reconcile the right to the protection of personal data with the freedom of expression and information." Therefore, the Court held that Union law does not require the Austrian legislator to enact a provision according to which any data processing of media owners, publishers, media staff and employees of a media enterprise or media service within the meaning of the Media Act is completely exempted from the DSG and the GDPR. On the contrary, Article 85 GDPR obliges the Member States to define the relationship between data protection and freedom of expression in more detail to ensure an appropriate balance between the conflicting fundamental rights positions. As the regulatory content of § 9(1) DSG is not mandatory under EU law, the Constitutional Court held that the provision is subject to its review with regard to its conformity with domestic constitutional law. In the Austrian constitutional law in question, § 1 DSG, the Austrian fundamental right to data protection, § 1(1) DSG guarantees everyone the right to confidentiality of personal data concerning him or her, insofar as he or she has an interest worthy of protection, in particular with regard to respect for private life. § 1(2) DSG contains a material legal limitation in this regard. Apart from the use of personal data in the vital interest of the person concerned or with his or her consent, restrictions on the right to confidentiality are only permissible to protect the overriding legitimate interests of another person. On the basis of the fundamental right to data protection pursuant to § 1(1) DSG in conjunction with § 1(2) DSG, the Court thus held that the legislator is always required to weigh the interests of the data subject in the protection of his or her personal data against the opposing (legitimate) interests of another party. Consequently, the fundamental right to data protection pursuant to §1(1) DSG does not allow the legislator to categorically exclude the applicability of all data protection regulations of a substantive and procedural nature under the DSG in their entirety within the scope of application of the "media privilege". The Court therefore held § 9(1) DPA to be unconstitutional. In addition, although the Court did not elaborate its legal reasoning (or only to a limited extent), it also held that § 9(1) DPA would also have been unconstitutional under other Austrian constitutional law (namely, the principle of equality pursuant to [https://www.jusline.at/gesetz/b-vg/paragraf/artikel7 Article 7 B-VG] and [https://www.jusline.at/gesetz/stgg/paragraf/artikel2 Article 2 StGG], the right to a trial before the lawful judge pursuant to [https://www.jusline.at/gesetz/b-vg/paragraf/artikel83 Article 83(2) B-VG], the right to protection of personal data pursuant to [https://fra.europa.eu/en/eu-charter/article/8-protection-personal-data Article 8 CFR], and the right to privacy pursuant to [https://www.echr.coe.int/documents/convention_eng.pdf Article 8 ECHR]).
Stichting Onderzoek Marktinformatie (SOMI)
Stichting onderzoek Marktinformatie (SOMI), Stichting Take Back Your Privacy (STBYP) and Stichting Massaschade & Consument (SMC) are three Dutch Foundations focused on class actions. The Foundations all separately sued the TikTok group (the controller). TikTok is a social media platform where users can post, view, like and share videos. SOMI summoned TikTok Ireland, while STBYP and SMC started class actions against multiple TikTok entities. As the cases were similar, they were considered together in this preliminary ruling. = The foundations claimed that the controller violated the fundamental rights of children (all foundations) and adults (SMC). In particular, the way that the controller processed personal data violated the GDPR, the Telecommunications Act and the Media Act. In addition, the controller violated provisions of mandatory consumer and media law. The foundations stated that the controller shared personal data of users with third parties without a legal basis. The foundations each requested the Court to designate it as the exclusive representative within the meaning of [https://wetten.overheid.nl/jci1.3:c:BWBR0001827&boek=Derde&titeldeel=14&artikel=1018&z=2022-10-01&g=2022-10-01 Article 1018(1) of the Code of Civil Procedure] (Wetboek van Burgerlijke Rechtsvordering- Rv) for the data subjects as described in their summons. This concerned minors for SOMI and STBYP and minors and adults for SMC. Regarding the jurisdiction, the foundations stated that the Dutch Court had jurisdiction under Article 79(2) to 80 GDPR, as well as under [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2012:351:0001:0032:en:PDF the Brussels I Regulation] (Brussels I) and [https://wetten.overheid.nl/jci1.3:c:BWBR0001827&z=2021-01-01&g=2021-01-01 Code of Civil Procedure]. = The controller requested that the Court declared itself incompetent to take note of any claims that fell within the scope of the GDPR. According to the controller, the right to bring proceeding
Court case 5 O 195/22
The data subject registered at a platform which required her to enter her e-mail address, name, birthday, and gender. Additionally, she entered her phone number, which was an optional disclosure. The default privacy option of the platform disclosed the personal data to any person that has the data subject’s e-mail address or phone number. Between 2018 and 2019, a third-party collected the personal data by web-scraping the controller's service. In practice, the third party created lists with potential phone numbers and uploaded them to the contact-importer of the platform to detect if the numbers could be associated with users who did not change the default privacy options of the platform. By guessing the correct phone number, this allowed the third party to connect the phone number with the data subject's profile and access all the provided information. In April 2021, the third party published all the scraped personal data. The data subject filed an action against the platform, claiming that the latter did not take any security precaution to prevent the personal data form being scraped, for instance by means of a security captcha. The data subject asked the defendant to pay non-material damages. In its defense, the defendant argued that the scraping did not constitute a data protection breach because the information accessed was publicly available. The court held that the action is admissible but unfounded. The data subject was not entitled to the payment of non-material damages pursuant to Art 82(1) GDPR. The court noted that, according to the wording of the provision, the damage must be "suffered", from which it follows that the damage must actually have occurred and not merely be feared. The concept of damage was to be interpreted broadly according to Recital 146 GDPR, however, a mere infringement of the provisions of the GDPR would not be sufficient to be able to claim non-material damages. Rather, concrete damage must be proven. The data subject had not sufficiently demonstrated the existence of concrete, immaterial damage, which also includes fears, worries, stress and loss of comfort. Furthermore, the court considerably doubted the plaintiff's claimed "fears and worries"due to the fact that the mobile phone number was entered voluntarily and that the rest of the personal data was generally publicly accessible. On the basis of the above, the court held that the question of whether and to what extent the defendant had violated the GDPR was irrelevant.
Spotify
An Austrian data subject made an access request with Spotify. In January 2019, the data subject filed a complaint in response to Spotify's answer to the access request with the Austrian DSB. Subsequently, the complaint was forwarded to the Swedish IMY as the lead supervisory authority for Spotify. After three years of inactivity, the data subject requested a formal decision under Section 12 of the Swedish Administrative Law ("Förvaltningslagen (2017:900)"), which allows to demand a decision within four weeks, if a case is pending for more than six months. The IMY refused the demand, claiming that it is undertaking a parallel ex officio investigation into Spotify and that the complainant is not a party to the procedure. Section 12 of the Swedish Administrative Act would not apply to complainants under Article 77 GDPR as the complainant in such a case does not have a party status, according to the preparatory work of the Act. The Administrative Court held that in light of recitals 141 and 143 of the GDPR, Article 8 of the CFR, Articles 57(1)(f), 77, and 78 GDPR a complainant has a number of individual rights. In the court's view, the competent supervisory authority is obliged to process and investigate all submitted complaints concerning the processing of a data subject's personal data to an appropriate extent. Furthermore, any unsuccessful complaint must result in a reasoned decision against which the data subject must have the right to an effective remedy (see also the decision of the Stockholm Court of Appeal of 18 May 2022 in Case No 1426-22). A complainant cannot be placed in a worse position, solely because IMY chooses to deal with the complaint in the context of an additional ex officio investigation. In the view of the Administrative Court, the complainant is therefore a party to the case as far as his complaint and the processing of his personal data are concerned and can rely on Section 12 of the Swedish Administrative Law to get a decision within four w
Stichting Brein
Stichting Brein is a foundation involved in collectively counteracting and preventing copyright infringements. Ziggo is one of the largest internet service providers (ISPs) in the Netherlands. In December 2020, Brein started the "FLU-warning campaign". The aim of this campaign was to send warning letters to holders of IP addresses of which Brein, using special software, had found that they had uploaded copyright infringing material via BitTorrent for at least two times in a span of four weeks. However, Brein did not possess the name and address details of the torrent users, but only their IP-adresses. Hence, it needed the cooperation of Internet Service Provider (ISP) to link an IP address to name and address details. With this information, Brein would be able to send the warning letters. Ziggo, however, did not want to cooperate voluntarily. Therefore, Brein filed a submission at the Midden-Nederland Court of First Instance (Rechtbank) to force Ziggo to send the warning letters to the respective users. The first instance Court rejected this submission in a previous interim relief proceeding. This Court of First Instance held that combining IP addresses and contact details of ISP clients entailed the processing of personal data relating to criminal convictions and offences or related security measures (criminal data) pursuant to Article 10 GDPR. The ISP didn't receive a permit from Dutch the DPA to process criminal personal data, and therefore lacked a legal basis. The Court also held that Articles 32 and 33 UAVG (Dutch law for the implementation of the GDPR) were the only provisions which contained 'appropriate safeguards' as stated in Article 10 GDPR. Brein appealed this ruling. The Court of appeal held that it had to answer two questions: (1) if there was a legal basis that could force the ISP to cooperate with the request of Brein and (2) if the ISP was even allowed to combine the contact details and the IP addresses in the first place. The Court held that both questions should be answered negatively. The Court of appeal started by confirming that combining IP addresses and contact details was indeed processing of criminal data under Article 10 GDPR. The ISP would need a legal basis for this processing, which had to be conducted under the control of official authority or had to be authorised by Union or Member State law, providing appropriate safeguards for the rights and freedoms of data subjects. The first question was not a question regarding the GDPR. It concerned a balancing exercise in a Dutch provision (Article 6:162 BW) to determine if the ISP was obligated to supply the contact details of its users. The Court of appeal held that the ISP could not be obligated to supply the information. The second question was the fact if the ISP was even allowed to process the data under Article 10 GDPR. The Court rejected an argument from Brein that article 6:162 BW could be used besides Articles 32 and 33 UAVG to provide 'appropriate safeguards'. This argument was rejected by the Court because nothing in this provision could substantiate the claim by Brein. Brein also stated several reasons why Articles 32 and 33 UAVG could be used as legitimate grounds for processing. The controller also rejected all of these claims by Brein. Therefore, the Appealing Court held that the ISP did not have a legal ground under Article 10 GDPR to process the criminal data. The ISP could therefore not be obligated by the Court to combine the IP addresses and contact details in order to send warning letters to its users. The Court stated that Brein could have filed a request to force the ISP to get a licence from the Dutch DPA. However, since it didn't take this potential step, there was no legal basis for the processing in question.
Datenschutzbehörde
A number of data subjects attended a festival, during which they were allegedly recorded by a surveillance system without a legal basis. The data subjects contested that their right to information had been restricted by the controllers and processors, since they requested to be sent a copy of their personal data and to restrict further processing in accordance with Article 18(1) GDPR, which was met with the reply that the recordings had been deleted and that the data was not of personal nature due to it only showing persons up to the waist. The data subjects filed a complaint with the Austrian DPA who investigated the case. The defendants and alleged controllers were in the business of event management, advertising and consultancy. Part of their activities included counting visitor numbers and filtering this information into categories of age and gender. They recorded the visitor numbers at the festival through, among others, surveillance cameras. The defending parties denied that they were controllers pursuant to Article 4(7) GDPR. They argued that they organised the festival and processed the data of the data subject's on behalf of a contract with the local municipality, who should be deemed the controller. The municipality, however, had terminated the contract with the defendants. The defendants were in the process of disputing the validity of the termination in separate civil law proceedings in front of a regional court. Consequently, the Austrian DPA decided to suspend its decision on a complaint according to § 38 AVG until the regional court had decided in a civil law suit on whether the defendants in the complaint proceedings had acted on behalf of a valid contract with the municipality. The DPA believed that the answer to the question whether a valid contract was in place was an essential preliminary question to establish who the controllers were pursuant to Article 4(7) GDPR. The data subjects brought in a complaint against this decision by the DPA at
Court case 4 BV 21.2328
The plaintiff was the owner of a plot of land in the association area of the defendant, which operated a public water supply facility for the area. The building located on this property was used by the plaintiff and their employees exclusively as an architectural office. After the defendant had announced that the existing water meters would be replaced and converted to electronic water meters with the option of radio reading, the plaintiff objected by letter. The defendant rejected this objection and argued that the right of objection pursuant to [https://www.gesetze-bayern.de/Content/Document/BayGO-24 Article 24(4) sentence 5 of the Bavarian Law on Municipalities] did not apply to the plaintiff's property because a commercial enterprise was located there. Therefore, no personal data could be read out. Eventually, the water meter was installed using coercive measures and the plaintiff initiated court proceedings. In its judgement of 29 July 2021, the Administrative Court of Munich ordered the defendant, upon complaint by the plaintiff, to switch off the radio module of the electronic water meter in the plaintiff's property. The court ruled that the right to object was exercised properly and should have been granted. However, the defendant appealed this position by referring to of [https://dejure.org/gesetze/GG/13.html Article 13(1) of the German Basic Law] on protection of personal data. Accordingly, the right to object only existed if the data concerned the occupants of houses. In the case of rooms used for commercial or professional purposes, it was not possible to draw conclusions about personal data because of the associated contacts with business partners and visits by customers. The court in appeal had to consider, among others, whether information from the electronic water meter could be considered as personal data pursuant to Article 4(1) GDPR. The court first noted that the the primary reason for the right to object to the installation of a water meter with radio reading was the protection of personal data. Such data would be collected if a unit equipped with its own radio water meter was occupied or otherwise used by one person and thus only the water consumption data of this individual person was recorded and read. Also, in the case of flats or other premises that are jointly used by several persons, the recording of consumption data may under certain circumstances constitute an interference with the right to informational self-determination. The court recalled that Article 4(1) GDPR defines "personal data" as any information relating to an "identified or identifiable natural person". In the present case, the premise was used as an architectural office by several persons at the same time. However, taking into account whether several persons are registered in a flat at the time of the objection or whether more than one person is working in a unit used for business purposes would lead to arbitrary results in many cases. In contrast, the sole link to the (usage) "unit" existing in the property supplied is appropriate, as structural conditions usually exist more permanently than personal usage relationships and are also easier to determine. The court concluded that even in the case of joint use by several persons, if water consumption is continuously recorded by an electronic meter, it may be possible to draw conclusions about the consumption habits of individuals with only a little additional knowledge. Therefore, the court held that the collection of water usage data in the office constituted processing of personal data pursuant to Article 4(1) GDPR and dismissed the appeal.
Court case 1 S 27/22
The controller published a judgement produced by a local court which included the full names and addresses of the data subjects. It also published an agenda of a municipal council meeting which contained the names of the data subjects several times. Both documents were made available on the controller's homepage. The Court was of the opinion that the controller violated Article 5(1)(a) GDPR by publishing the personal data online. In considering whether the data subjects should consequently be entitled to compensation under Article 82(1) GDPR, the Court expressed its opinion that the mere loss of control over one's data does not constitute non-material damage. The Court reasoned that the concept of non-material damage should require that a certain threshold of inconvenience is crossed. It therefore deemed that not every unlawful processing of personal data should lead to a claim under Article 82(1) GDPR. The Court stayed the proceedings and requested a preliminary ruling by the CJEU on whether the concept of non-material damage requires that the data subject suffers a noticeable disadvantage and an objectively determinable impairment of their interests or whether a mere short-term loss of control over their data suffices.
A (...Bebidas S.A)
“A” brought an executive action against “B”. After this, an enforcement proceeding was started with an order to impound two vehicles. However, it became clear that it was impossible to impound the vehicles. After this, the pursuing creditor requested the controller to provide information about the journeys of these vehicles in question since a specific date. The controller is an entity responsible for collecting toll fees on highways with the use of an electronic system, thus monitoring the passage of vehicles at certain points installed on the road for this purpose. The controller is therefore able to register traffic and collects personal data from its clients. The controller is also responsible for the treatment of such data. The controller stated that it couldn't supply information concerning toll records (date, time and place) because this was part of the the concept of protection of privacy. These toll records could only be shared with the consent of data subjects, the owners of the cars. After this, the pursuing creditor requested the lifting of professional confidentiality from the controller so the record of the journeys of the cars could be disclosed, whic could result in the cars being seized. The Court held that those responsible for processing personal data, as well as those who, in the course of their duties, have knowledge of the personal data processed, are bound by professional secrecy, even after the end of their functions (Article 10 of Lei 58/2019), which directly mentions Article 38(5) GDPR. Lei 58/2019 is a national law for GDPR implementation). This duty of secrecy must give way to the duty to provide legally required information, particularly to the judicial authorities, and to the duties of the National Commission for Data Protection (Article 8 of Lei 58/2019). The Court held that the records collected by the controller are personal data which fall under the concept of protection of privacy and for which there is an obligation of confidentiality for the controller. The court considered the possibility of creating "individual driver profiles" with these records and held that this information is likely to limit the freedom of movement of clients of the controller and that this information could involve risks of intrusion in private life if strict mechanisms for processing, storage and access to the information are not established. The Court stated that this case presented a conflict between the duty of professional secrecy and the duty to cooperate with the administration of justice, which should be resolved through a judgment of proportionality through a judgment of weighting and coordination between these duties. In a balancing test of the interests at stake, the Court concluded that making the information available about the controller's clients and their private matters was not proportional in relation to the scope of the availibillity of the information.. The Court further stated a failure to obtain the information didn't jeopardize the applicant's interest in locating the vehicles. The success or failure of seizing the vehicles would not depend on the lifting of the profesional secrecy of the controller. The Court held that is was therefore not appropriate to lift the professional secrecy of the controller.
Court case 6 Ta 49/22
The controller operated a care service where the data subject was employed. The controller filmed the data subject in their work environment and published a thirty-six second video on Youtube for promotional purposes. The data subject had previously given verbal consent to the filming but had not received any further information about the purpose of the filming or their rights. Later, the data subject objected to the use of the video and claimed €6,000 in damages during proceedings before the labour court. The controller deactivated the video immediately afterwards. The parties involved reached an agreement and settled the dispute. The data subject had applied for legal aid for claiming damages up to €6,000. The ArbG Kiel granted it up to the amount of €2,000. Thereupon, the data subject then appealed to the LAG Schleswig-Holstein for legal aid in the amount of €6,000. The court upheld the original decision. The controller infringed the GDPR by filming the data subject and publishing the clip because the data subject had not given written consent and was not informed about the purpose of the data processing or their right to withdraw consent. The data subject is entitled for maximum damages of up to €2,000, but not €6,000 as requested. The data subject does not have to prove that damage within the meaning of Article 82(1) GDPR has occurred, as a breach of the GDPR itself constitutes non-material damage. Recital 146, sentences 1 and 6 GDPR support this interpretation, as the claims for damages serve to support the objectives of the Regulation and in particular to provide effective protection of individuals’ rights. The court confirmed that damages in this case can amount to a maximum of €2,000. The controller did not film the data subject in intimate situations or discriminate them and the data subject gave verbal consent to be filmed. Furthermore, the controller reduced the harm by taking the video down immediately after the data subject requested it. However, on the other hand, the controller was not only using photographs, but moving images for a commercial purpose. The court found that damages of €6,000 would not be justified in these circumstances. In similar cases, even lower amounts than €2,000 were awarded, or the cases were more severe because the controller’s actions were discriminating.
OC
An academic (the complainant) received EU funding for a research project and was discovered to have fraudulently claimed the money in personal expenses. OLAF recommended that the European Research Council Executive Agency (ERCEA) take appropriate measures to recover the sums and initiate proceedings for fraud and use of forgery. Within a year, OLAF issued a press release on the matter labelled [https://anti-fraud.ec.europa.eu/media-corner/news/olaf-investigation-uncovers-research-funding-fraud-greece-2020-05-05_en No. 13/2020.] The complainant argued that the press release identified her and in doing so OLAF had infringed Regulation (EU) 2018/1725.The Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the institutions, bodies, offices and agencies of the Union and on the free movement of such data is the version of the GDPR applicable to EU institutions. She agued that using the data contained in the press release, a reader could identify the fact that she was a Greek national woman, the amount of the funding, and the fact that her father worked at the same university. Moreover, a German Journalist had already identified her using the the press release and written an article about her. For this perceived breach, the complainant requested €1.1 million in damages. The General Court held that there was no personal data contained in the press release under Article 3(1) Regulation 2018/1725 (and 4(1) GDPR), because the applicant was not identified, and was not identifiable according to the 'means reasonably likely to be used' (Recital 16 Regulation 2018/1725 and Recital 26 GDPR). The General Court decided that whether OLAF’s press release contained personal data is tied not only to the ‘means reasonably likely to be used’ to identify the applicant but also by the ‘average or likely reader’ of said press release (para 76). The General Court therefore, disregarded the actual identification of the complainant by the German journalist. It argued that this journalist could not be considered an average reader since he was a professional with wide qualifications and an insider’s perspective due to his information network. Furthermore, the journalist appeared to be a daily reader of OLAF’s publications, which the General Court considered to be unusual (para 80). Since the General Court ruled that there was no breach, it did not go on to rule on damages.
DSB
The controller is an employer who allegedly surveilled its employees work phones and work email accounts from January until March 2021. The DSB (Austrian Data Protection Authority) heard of this conduct in media reports and initiated an ex officio investigation into the matter on 31 March 2021. On 29 July 2021 the DSB adopted an administrative act in which it declared the processing of the controller unlawful. The controller initiated court proceedings against the act claiming that its conduct was lawful and that the DSB - neither under national law nor under the GDPR - had the power to declare the processing unlawful. It argued that Article 58(2) GDPR does not provide a DPA with such a power, because "declaring the unlawfulness" is not listed there. Moreover, § 24 DSG (Austrian Data Protection Act) which provides the DPA with the power to make such a declaration only applies to proceedings which were initiated by a complaint and not by the DSB itself. The Federal Administrative Court (Bundesverwaltungsgericht – BVwG) decided in favour of the controller and set the administrative act aside. It found that there is no provision in national law or the GDPR that gave the DSB the power to declare the processing unlawful. The court first established that § 24 DSG, which provides the DSB with such a power, only applies to complaint proceedings and not ex officio proceedings. The court also rejected an analogous application of § 24 DSG, because it found that the legislator purposefully regulated complaint and ex officio proceedings differently so that there is no room for an analogous application. Moreover, it reasoned that in a complaint proceeding there is a data subject who may have a legal interest in the declaration in order to pursue further individual claims against the controller like a claim for damages; in ex officio proceedings no such interest exists. The court further found that there is no legal basis in the GDPR either, since Article 58(2) GDPR does not include a power to declare the processing unlawful, but only the power to issue a reprimand or to fine the controller.
Meta Platforms Ireland Limited
Meta Platforms Ireland (Meta) manages the social network Facebook in the European Union. Facebook Germany GmbH is a separate entity and “promotes the sale of advertising space on the internet address www.facebook.de”. Facebook contains a section called App Centre that allows users to access free games provided by third parties. While accessing these games, it is indicated that some personal data is shared with the gaming company, and the ability to publish data on behalf of the user is also given to the gaming company. Federal Union of Consumer Organisations and Associations, Germany (Federal Union) initiated an action for injunction before Regional Court, Berlin (Landgericht (LG) Berlin) in Germany claiming that the information provided by the games in the App Centre is unfair, and the ability of posting information on behalf of the user is a general condition that is to the disadvantage of the user. LG Berlin ruled against Meta, and this decision was appealed before the Higher Regional Court, Berlin (Kammergericht (KG) Berlin) which too was decided against Meta. Thereafter, Meta brought an appeal on a point of law before the Federal Court of Justice (Bundesgerichtshof (BGH), and the Court referred the following question for a preliminary ruling by the CJEU: “Do the rules in Chapter VIII, in particular in Article 80(1) and (2) and Article 84(1), of Regulation (EU) 2016/679 1 preclude national rules which – alongside the powers of intervention of the supervisory authorities responsible for monitoring and enforcing the Regulation and the options for legal redress for data subjects – empower, on the one hand, competitors and, on the other, associations, entities and chambers entitled under national law, to bring proceedings for breaches of Regulation (EU) 2016/679, independently of the infringement of specific rights of individual data subjects and without being mandated to do so by a data subject, against the infringer before the civil courts on the basis of the prohibition of unfair commercial practices or breach of a consumer protection law or the prohibition of the use of invalid general terms and conditions?” The CJEU held that interpretation of Article 80(1) GDPR and Article 84 GDPR is not necessary for answering the question raised in the present case. This is because Article 80(1) GDPR presupposes that a data subject has authorised an organisation to take legal measures on their behalf. Moreover, Article 84 GDPR deals with administrative and criminal penalties for infringements, which are not an issue in the present case. The CJEU held that it is necessary to interpret Article 80(2) GDPR, as it relates most closely to the facts of the case. The CJEU held that Article 80(2) GDPR gives the Member States discretion with respect to its implementation and “in order for it to be possible to proceed with the representative action without a mandate provided for in that provision, Member States must make use of the option made available to them by that provision to provide in their national law for that mode of representation of data subjects.” The CJEU noted that Germany did not exercise its discretion in this regard, as the national law in the present case “already allows consumer protection associations to bring legal proceedings against the person allegedly responsible for an infringement of the laws protecting personal data”. This national law was adopted to transpose Directive 2009/22 and existed when Data Protection Directive was in force. The CJEU, while examining the scope of Article 80(2) GDPR, held that the Federal Union was a consumer protection organisation and falls within the public interest objective of safeguarding rights of consumers. The infringement of rules relating to consumer protection might also relate to infringement of rules protecting personal data. Secondly, the CJEU, while examining the phrase “considers that the rights of a data subject under this Regulation have been infringed as a result of the processing” that is part of Article 80(2) GDPR, held that the entity in question cannot be “required to carry out a prior individual identification of the person specifically concerned by data processing that is allegedly contrary to the provisions of the GDPR.” This is because GDPR defines personal data as those belonging to “not only an ‘identified natural person’, but also an ‘identifiable natural person’”. Moreover, a representative action can be initiated when the representative organisation “considers” an infringement to have taken place, and not only when it can prove actual harm suffered by the data subject. The CJEU held that such an interpretation and presence of consumer protection associations strengthen the rights of data subjects, and a representative action might be better than several persons individually exercising their rights.
DSB
The data subject was a former employee of the controller. After having received an allegedly incomplete answer to his access request, the data subject lodged a complaint with the DSB (Austria). The DSG rejected to handle the complaint under Article 57(4) GDPR - considering it excessive - since there were at least 137 complaints of the data subject registered with the DSB. Moreover, these 137 cases were concerning only two subject matters. The first subject matter was that his son's citisenship was allegedly falsely recorded as Italian instead of German with the Austrian public authorities. The second subject matter was that the controller - his former employer - violated his data protection rights during the employment relationship. As the data subject was dissatisfied with the rejection but could not afford legal proceedings himself, he applied for legal aid (this means the exemption from court fees) with the BVwG in order to bring a legal action against the DPA's decision. The court rejected the application of the data subject because it found that the requirements for legal aid under national law were not met. One of the requirements is that the intended legal action may not appear futile. The court, however, concluded that a legal action against the DSB's decision appears futile, because the DSB rightfully rejected to handle the complaint under Article 57(4) GDPR. The court reasoned that the complaint was excessive, because the data subject had already lodged numerous complaints with the DSB about the same two subject matters (137) and the present complaint was closely linked to these complaints.
Commissioner for Data Protection and Information Security of the State Thüringen
The data subject exercised their right to mandate an organisation to lodge a complaint in their name under Article 80 GDPR. A similar right is also found in the national law, with the difference that it also allows to stand as a litigant. From a procedural point of view, Article 80(1) GDPR does not establish the right to stand as a litigant, but the power to bring a complaint or court proceedings on behalf of the data subject. Thus, while the authorised representative Art. 80 GDPR is authorised to represent within the meaning of the GDPR, it would have to be rejected pursuant to § 67 (3) sentence 1 VwGO (AdministrationCourt Code) in the absence of the requirements of the enumerative catalogue (Numerus Clausus) of § 67 (2) sentence 2 VwGO. The mentioned provisions of the Administration Court Code define exactly which Institutions can be litigators in court and legally represent someone, the organisation could bring Act in the name of the data subject under in the proceedings held upon GDPR (ex. filing in a complaint at the national DPA), but in procedures which are regulated in national law, could not be signed as a litigant for someone else. Due to the procedural failure, the court dismissed the appeal.
Berliner Beauftragte für Datenschutz und Informationssicherheit
In November 2019, the church tax office (controller) sent the data subjects questionnaires to provide information on the religious affiliation of their two minor children. In December 2019, the data subjects requested the controller to refrain from such requests. Nevertheless, the controller requested the data subjects to complete the forms again in January 2020. Consequently, in August 2020, the data subjects filed a complaint with the Berlin DPA (Berliner Beauftragte für Datenschutz und Informationssicherheit). They claimed that the questionnaire was unlawful under data protection law. The DPA dismissed the complaint, arguing mainly that it was not competent to decide on the matter because of the church's special competence. Furthermore it did not find a breach of data protection law. Before the court, the data subjects pursued their claim. The Administrative Court of Berlin dismissed the data subjects' claim. The court agreed with the DPA that it had rightfully declared itself incompetent in the matter. First, it held that church data protection such as in the case is subject to church supervision and not to state supervision. According to Article 91(2) GDPR, churches are entitled to establish their own independent supervisory authorities. While the wording of the provision does not clearly state whether such authority must be of an official nature or independent, the court interpreted the provision based on its systematic nature. As Article 91(2) GDPR explicitly mentions that the specific supervisory authority must fulfill the conditions of Chapter VI of the GDPR, such reference would be redundant if only state authorities were allowed since such authorities have to fulfill these regulations in any case. This position is also supported by Recital 128 GDPR. Therefore, the court found the independent nature of the church supervisory authorities to be GDPR-compliant. Second, it clarified that church data protection law must be understood as a comprehensive data protection rule within the meaning of the GDPR. According to Article 91(1) GDPR, churches may apply their own comprehensive rules relating data protection if they are in line with the GDPR. The court saw that compliance was sufficiently given in the data protection laws of the two big Christian churches in Germany. Third, the court dismissed the argument of the data subjects that the church supervisory is only competent for members of the respective religious community and that for non-members the state authorities are competent. It underlined that the competence of the church supervisory authority is only dependent on the fact that a church institution has acted and that Article 91(1) GDPR does not establish any additional requirements like the data subjects being members of the respective religious community. In a last step, the court found that the DPA did indeed have no obligation to further investigate the case. Also, its decision had been correct as the court could not find a data protection violation by the controller because the information requested by the questionnaire was necessary for the controller to fulfill their obligations for church taxing purposes.
Autoriteit Persoonsgegevens
In October 2018, the data subject, who was being represented by their attorney, were together approached by a journalist inside the courtroom. The journalist had certain documents from the case file which showed the data subject’s name, address and national identification number. Upon being asked by the data subject for the source of the documents, the journalist replied that they “were made available to him under the right of access to the case file” which the Administrative Jurisdiction Division of Council of State grants to journalists. Subsequently, the President of the Administrative Jurisdiction Division of Council of State confirmed to the data subject that certain documents were being given to journalists “to enable them to follow hearings, namely a copy of the notice of appeal, a copy of the response and, where appropriate, a copy of the contested judicial decision” and “those documents being destroyed at the end of the day.” The data subject and their attorney then approached the Dutch Data Protection Authority (DPA) and claimed that “allowing journalists to have access to personal data concerning them” amounted to a violation of GDPR. However, the DPA said that it was not competent to decide on the same due to Article 55(3) GDPR, which bars supervising authorities from supervising “processing operations of courts acting in their judicial capacity.” Thereafter, the DPA forwarded the request to the President of the Administrative Jurisdiction Division of Council of State. The President of the Administrative Jurisdiction Division of Council of State took note of the complaint and in consultation with the Data Protection Commission for Administrative Law Tribunals, Netherlands “formulated a new policy on access to documents from court files”. However, the DPA’s decision to not hear the matter, and to refer it to the President of the Administrative Jurisdiction Division of Council of State, was challenged by the data subject and his attorney before the District Court, Central Netherlands. The District Court, Central Netherlands stayed the proceedings and referred the following questions to the Court of Justice of the European Union (CJEU): 1. Is Article 55(3) of the General Data Protection Regulation (1) to be interpreted as meaning that ‘processing operations of courts acting in their judicial capacity’ can be understood to mean the provision by a judicial authority of access to procedural documents containing personal data, where such access is granted by making copies of those procedural documents available to a journalist, as described in the present order for reference? (a) In answering that question, is it relevant whether the national supervisory authority’s supervision of that form of data processing affects independent judicial decisions in specific cases? (b) In answering that question, is it relevant that, according to the judicial authority, the nature and purpose of the data processing is to inform a journalist in order to enable the journalist to better report on a public hearing in court proceedings, thereby serving the interests of openness and transparency in the administration of justice? (c) In answering that question, is it relevant whether there is any express legal basis for such data processing under national law? Before the Court of Justice, the data subject's attorney contended that the Council of State was not sharing the documents with journalists in its judicial capacity and in fact, the same was being done by its communication department. The CJEU considered the Advocate General’s opinion which stated that Recital 20 has the word “including”, and therefore the meaning of Article 55(3) GDPR cannot be “confined solely to guaranteeing the independence of the judges in the adoption of a given judicial decision.” It observed that supervision by DPA in such matters “would be liable to undermine, in general, the independence of the judiciary.” The CJEU held that the "processing of personal data carried out by courts in the context of their communication policy on cases before them falls outside the competence of the supervisory authority". Therefore, the court’s action of temporarily providing certain documents of cases to journalists, as described above, falls within the definition of ‘judicial capacity’, and the DPA will not have jurisdiction due to Article 55(3) GDPR.
DSB (Austria)
The controller is a psychotherapist and the data subject is his patient. About four years after the therapy had been stopped, the data subject requested access to his data. The therapist replied that no personal data was undergoing processing. The data subject was skeptical and filed a complaint with the Austrian DPA (DSB). The DSB considered the complaint excessive because 86 other complaints lodged by the data subject were still pending with it and therefore rejected to handle the complaint under Article 57(4) GDPR. The data subject appealed this decision to the Austrian Federal Court (Bundesverwaltunsgericht – BVwG). During the court proceedings, the DSB provided the court with a list of all pending cases which did not mention the content of the cases. The Austrian Federal Court held that the rejection by the DSB was unlawful because the DSB failed to show that the present complaint and the past complaints were homogeneous. The court clarified that, according to the last sentence of Article 57(4) GDPR, the DPA bears the burden of demonstrating the excessive character of the request. The court then found that the amount of complaints is an important factor in determining whether a complaint is excessive. However, it also reasoned that the complaint must be of repetitive character which only occurs when the present complaint and the previous ones are (nearly) identical. In the present case, the court concluded that DPA did not show that the complaints were (nearly) identical since it only provided a list of the complaints pending without describing their the content and similarities.
Court case II C 1228/19
The controller (the defendant) was an electricity company. The data subject (the plaintiff) was a customer. On 6 February 2019, due to an error, an employee of the defendant emailed to one of the company’s clients a file containing the personal data of other clients (data subjects), including the the plaintiff's. The information included: first name, surname, ID number, address, customer number, and numbers of invoices. After learning about the security breach, the defendant notified the Polish DPA of the incident. The defendant also sent a notification to the affected data subjects and asked the recipients of the unintentional disclosure the delete the file. After receiving a notice of the security breach, the plaintiff filed a complaint with the Polish DPA. Moreover, she requested the defendant to terminate her contract by mutual agreement due to the loss of confidence. The defendant stated that a one time breach of the plaintiff’s personal data did not constitute a gross breach of contract and therefore did not provide grounds for termination of the contract. Hence, the plaintiff decided to terminate the contract herself despite a financial penalty. Moreover, due to the security breach and fear that her personal data could be used by third parties, she set up a subscription account with the Credit Information Bureau to receive information on credit obligations attributed to her. On top of that, she suffered non-pecuniary harm from the stress and psychological discomfort related to the fear that her personal data could be used by third parties. Apart from the proceedings at the DPA, the plaintiff brought an action to court seeking damages for the non-material harm caused by the incident on the basis of Article 82 GDPR in the amount of PLN 20,000 (€4,247). First, the District Court of Warsaw-Praga (the Court) confirmed that the incident constituted a 'personal data breach' within the meaning of Article 4(12) GDPR. It also recalled that any person who suffered material or non-material damages due to a breach of the GDPR has a right to obtain compensation from the controller or processor under Article 82(1) GDPR. Second, the Court assessed the extent of the damage suffered by the plaintiff. It considered the personal data disclosed in the security breach to be 'highly sensitive'. The Court held that the plaintiff's fear of unauthorised use of her data by third parties must be considered 'real' given the news appearing in the media space reporting the illegal use of personal data to take out loans on other persons. Third, the Court noted that after learning of the violation, the defendant took all the necessary steps in order to prevent the damage from increasing further. The actions of the defendant led to the deletion of the file with personal data from the possession of the unauthorised party, which removed any further possibility of harm. The Court concluded that apart from the fear of her personal data being used by an unauthorised third party, the plaintiff was not affected by any further consequences. Thus, the non-pecuniary damage was small and the demand for PLN 20,000 (ca. €4,247) was excessive and inadequate to the extent of the damage suffered. The Court decided that the appropriate sum to award the plaintiff for inadequate protection under the GDPR and the infringement of her right to privacy was PLN 1,000 (ca. €212).