GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 16 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 16 October 2026 · Updated daily
The plaintiffs claimed the right to inspect files in accordance with Article 15 (1) GDPR. They argued that the scope of application of the GDPR is not excluded according to Article 2 (2) because the GDPR should be applicable to all types of tax in favor of those affected. The Court had to assess whether the GDPR is applicable to a access request concerning personal data processed by the tax authority. According to Article 2 (2)(a) GDPR the regulation does not apply to the processing of personal data as part of an activity that does not fall within the scope of Union law. Therefore, the court ruled that the provisions of the GDPR in the area of tax law are only applicable to harmonized taxes, such as VAT, but not in the area of income taxation of natural persons. In this respect, there is no corresponding harmonization in the area of the European Union. The court explained further that the national legislature has not extended the material scope of application of the standard of Article 2 GDPR to the area of non-harmonized taxes. Accordingly, the Court denied the requested access according to Article 15 GDPR.
The parties argued about the amount in dispute for the data subject request. Dismisses the appeal brought by the applicant's representative against the decision of the Arbeitsgericht (Labour Court) Villingen-Schwenningen - Chambers of Radolfzell - of 13 November 2019 - 7 Ca 239/19
An employer (defendant) used a GPS positioning system installed in the company vehicles (which were allowed for private use as well) without a company agreement or the consent of the individual employee (plaintiff). The system was able to transmit GPS data around the clock, to monitor the battery level and to recognize when the ignition was switched on. The defendant tracked the plaintiff's use of his company vehicle during the plaintiff's work and leisure time. Several managers working for the defendant could view the data created by the GPS positioning system at any time via the internet. There was no company agreement on this GPS positioning system, especially since there was no works council in the company. The defendant did not comply with the plaintiff's repeated written and verbal requests to refrain from the GPS tracking, at least in his leisure time. The GPS tracking caused considerable inconvenience for the plaintiff. He was often called by his superior and asked why he had left home so late. Since the plaintiff did not want his private life to be controlled and monitored by the GPS tracking of the company car, he did not drive the company car but went on holiday in another car. Does the tracking of a company vehicle (which an employee is also free to use in his leisure time) by an employer via a GPS positioning system require the employee's consent or a company agreement? Is an employee who has been unlawfully monitored by such GPS positioning system entitled to non-material damages? The Supreme Court upheld the decisions of the lower instances, which awarded the plaintiff compensation for the non-material damage he had suffered as a result, totalling EUR 2 400 (approximately EUR 400 per month of surveillance). With the GPS tracking system, the defendant had introduced a technical measure for the permanent control of its sales staff, which affects human dignity, because it controls the privacy brought into the company by each employee. The use of thi
The claimant was previously involved in several proceedings regarding the police's treatment towards herself and the disclosure of her personal data to the public. To know more about the processing of her personal data by the Chief of Police, she submitted a subject access request. The Chief of Police provided her with a summary of the personal data processed with the information requested with undue delay, in June 2017. Thus, the Chief of Police set a penalty payment. Following the first answer, the Chief of Police completed with another decision in October 2017 which has been challenged by the applicant before the Court Rb. Zeeland-West-Brabant (Netherlands). The Court Rb. Zeeland-West-Brabant annulled the decision of October 2017 as it found it incomplete. However, based on the new Chief of Police supplementing decision submitted in January 2018 during the proceedings, it also ruled that the data controller does not have to take any other decision regarding the subject access request. Indeed, the lower court considered that the supplementing decision, so-called the "new overview" decision provided enough information and was, thus, complete. The claimant's appeal the Court Rb. Zeeland-West-Brabant's judgement before the Dutch State Council (Raad Van Staten). The applicant claimed mainly that the new overview decision has not been provided in comprehensible form. Especially, she argued that the information related to the purpose(s) of the processing, the recipients or categories of recipients and the origin were not stated clearly. Also, she argued that the new overview decision was still incomplete, as some of the personal data were missing. The Raad Van Staten had to decide on whether the information provided in the proceeding were sufficient enough to comply with Article 15 GDPR and the National data protection law. The Raad Van Staten considered that the data controller had to search another time and find all the personal data about the data subject to
The plaintiff asked to the State to grant him access to procedural files in which he was involved against the State of the Netherlands concerning forgeries offence. The applicant claimed that the procedural files contained his personal data and evidences which could help him to prove his innocence in the aforementioned case and all the cases in which he would have been involved as party against the State. The State refused to grant him the access. The Court clarified the interplay between the right to inspection under the ePrivacy Directive and the right to access under the GDPR. First, the Court examines the basis of the applicant's request pursuant to Article 12 of the Code of Civil Procedure which requires to state fully and truthfully the relevant facts, and to submit all the document relevant to the application. In this regard, the Court considered that the applicant did not comply with this obligation. Indeed, the Court pointed out there is no docuiment showing that the applicant submitted an inspection request of the procedural files at stake. Then, the Court clarified that both the ePrivacy Directive and the GDPR apply. It considered that the right of inspection of document including personal data is not absolute. However, it stated that the access right and the right of inspection have to be understood as a right to a complete overview of all personal data, in a form that enables the data subject to inspect his or her data and to check that they are correct and have been processed lawfully. Regarding the format, the Court recalled that the data subject cannot expect to be provided with the original document and that the material form depends on the concrete circumstances. Finally, the Court considered that in any cae, the applicant's purpose was not to verify the accuracy and lawfulness of the personal data processed but to use them to prove his innocence in the case he was involved against the State and in any proceedings to be brought against the S
The plaintiff contests the publication of his remuneration in accordance with the Hamburg Transparency Act (§ 3 (1) No. 15 HmbTG). The plaintiff is employed by the University Medical Center in Hamburg, a corporation under public law. The defendant's financial authority informed the University Medical Center that its subsidiaries would largely fail to meet the requirements of the Hamburg Transparency Act on the disclosure of management remuneration. It is asked to influence the management and to ensure that the next year's remuneration report is published. The University Medical Center informed the plaintiff that the intention was to transmit the requested information on his remuneration and fringe benefits to the defendant. The Hamburg Administrative Court had to decide, if the publication of the remuneration of the plaintiff is lawful. Plaintiff: The plaintiff argued his legitimate interest in determining that his salary information should not be published. He argued that the Hamburg Transparency Act is not applicable and therefore, the publication of his remuneration violates his general right of personality. In addition, according to the German Federal Data Protection Law (§ 26 BDSG,) personal data of employees for the purposes of the employment relationship should only be processed if this is for the decision on the establishment of an employment relationship or after the establishment of the employment relationship for its implementation or termination or for the exercise or fulfillment resulting from a law or a Collective agreement, a company or service agreement (collective agreement) resulting rights and obligations of the representation of interests of employees. This requirement is missing here. Defendant: The defendant is of the opinion that the plaintiff's salary should be published. According to the Hamburg Transparency Act, which is applicable according to the defendant, essential company data of municipal holdings, including a description of the
The first complainant is a company that is engaged, inter alia, in the purchase and sale, rental and leasing of real estate. The second plaintiff is the sole shareholder of the first complainant. The defendant is a journalist working for the group NDC MEDIA GROUP E.G, a newspaper publisher. The plaintiffs submitted a civil action before the District Court of the Northern Netherlands against NDC MEDIA GROUP E.G regarding an online press article concerning their company. This article has been published also via the Facebook's page of the journalist who wrote the article. In support of the newspaper publisher, the journalist counterclaimed that the first plaintiff processed his personal data and disclosed them to a third-party, without his consent. Indeed, the first plaintiff disclosed through a Facebook message the data subject municipality’s Personal Record databased (BRP) extract to a third party for the purpose of initiated the proceedings against the publisher. The Court had to pronounce itself mainly on the lawwfulness of disclosure of personal data through social network. The Court went through the balancing test to assess whether the conditions laid down in Article 10(2) of the ECHR for a restriction of the right to freedom of expression have been met. The Court recalled that the right for freedom of expression can only be restricted if this is provided for by law and is necessary in a democratic society. For example, a restriction provided by law exists if the court comes to the opinion that the publications, are unlawful within the meaning of Section 6:162 of the Civil Code - this article is the general basis for claims for damages that arise from torts. The District Court found that there has been a violation of a fundamental right which, by its nature and in view of its seriousness, leads to a claim for damages. Regarding the violation of the GDPR, the Court found that the first plaintiff - the data controller - has an independent obligation to proc
In the letter dated 27 July 2017, the plaintiff requested the defendant to take enforcement action against VZVZ - the administrator of a network to which certain categories of healthcare providers can connect and consult medical data about their patients in each other's systems (LSP). The claims made were as follows: a. The Personal Data Authority (defendant) must take action against VZVZ for the lack of explicit consent collected by people registered in the LSP; b. the defendant must review the view of its legal predecessor, the Dutch Data Protection Authority (Cbp), from 2014, that VZVZ has put in place sufficient technical and organisational safeguards to ensure that only personal data of patients who have given their consent for this purpose are processed; c. the defendant must confirm that VZVZ may not ask for a national identification number (BSN) in combination with a copy of a valid identity document in response to written requests to the effect that someone has been registered with the LSP. The plaintiff submitted four cases of patients who had been registered with the LSP without their permission. According to the plaintiff, she has thus demonstrated that patients are registered with the LSP without their explicit consent and that the system as such is therefore flawed. According to the plaintiff, the defendant must take enforcement action against VZVZ in order to rectify this. In addition to this enforcement request, the plaintiff also submitted an enforcement request to the defendant aimed at addressing pharmacists about the unlawful registration of patients with the LSP. The plaintiff lodged an appeal against the decision of 24 December 2018 (the contested decision), by which the defendant dismissed the claimant's complaint. The appeal is unfounded. The District Court dismissed the plaintiff's argument that the LSP as a system is unlawful. There is no reason to follow plaintiff in her view that healthcare providers are reporting patients in
The plaintiff was victim of a robbery in her flower shop. Afterwards, she cooperated with a TV program to talk about the robbery. The reconstruction of the scene was shot with the plaintiff’s fragment of voice. The TV program had been included at a later stage in a theatre show which was aimed to be broadcasted on TV. The plaintiff filled a complaint against the company using her voice in the theatre show. The plaintiff argued inter alia that her voice had been processed without any legal basis, and that the controller violated Article 6 GDPR. The Court had to assess whether a person’s fragment of voice constitutes personal data or anonymous data, whether the processing was lawful and whether the fragment of voice could be deleted. The Court found that anonymous data is data that cannot be traced back to an identified or identifiable person. In the present case, the fragment of voice could lead to the plaintiff’s identification without disproportionate efforts. The Court considered that the information gathered here was so unique that it could only relate to one person. It further found that voice data constitutes biometric data within the meaning of Article 4(14) GDPR. Regarding the lawfulness of the processing, the Court considered that the use of the voice in the context of an artistic form of expression falls within the scope of Article 6(1)(f) GDPR. Also, it stressed that the processing of the personal data for an artistic form of expression does not allow the exercise of the right of erasure under Article 17 GDPR pursuant to Article 85 GDPR and a specific provision in Article 43(2) of the Dutch Data Protection Act that makes Article 17 GDPR inapplicable in cases of artistic expression. Thus, the Court found that the processing of the personal data was lawful and rejected the complaint.
The complainant was added in the blacklists maintained by the Dutch financial institutions for the period of four years based on three wrongdoings, registered by the mortgage advisor Quion: * Running a cannabis farm in an apartment the complainant was still paying mortgage for; * Not using that apartment as her own place of residence; * Not notifying Quion about her employment termination before signing the mortgage agreement. The Court found the following: * Running a cannabis farm is a criminal offence. For this information to be added in financial blacklists, it must be sufficiently established that the complainant has indeed been involved in the crime. This was not the case in this lawsuit, so Quion was ordered to remove this record from the internal blacklist; * Quion was ordered to remove the record about not using the apartment for own residence from the external blacklist but could keep it in the internal list; * Quion was ordered to remove the record about the failure to inform about the complainant’s employment termination from the external blacklist but could keep it in the internal list. The decision was based almost entirely on the rules of the anti-fraud blacklist maintained by the Dutch financial institutions (“Protocol Incidentenwaarschuwingssysteem Financiële Instellingen”). One of the conditions for adding a person to these blacklists is proportionality, meaning that the interest of the financial institutions must outweigh the possible negative consequences of being added to this blacklist for the individuals. In this case the judge decided that Quion did not strike the right balance because the complainant kept paying the mortgage on time and there no damage was caused to the apartment or to the financial institutions.
The Dutch Council of State ruled on a claim for damages filed by a citizen whose data (name and address) were communicated via email between local authorities. This communication was intended to exchange data between municipalities to prevent abuse of the Public Administration Act when several requests for access to documents were made by the same applicant. The Council of State had to determine whether the processing of information by the local authorities had a legal ground under Article 6 of the GDPR, and whether such a violation would entitle the claimant to a compensation for moral damage. The lower court already recognized that the communication of the residence of the applicant was violating the principle of data minimization. However, regarding the claim for damages, the CoS notes that though Article 82(1) of the GDPR states that full compensation for actual non-material damage resulting from breaches of the GDPR must take place in a manner that does justice to the objectives of the Regulation, the GDPR does not specify how the non-material damage is to be determined and calculated. However, the Court of Justice has consistently held that the damage to be compensated must be real and certain. In this case, the CoS considers that the appellant does not bring the prove of his/her actual damage caused by the violation. The fact that an infringement of the AVG may result in material or immaterial damage and that a person concerned must receive full and actual compensation for the damage he has suffered does not mean that a breach of the AVG by definition results in damage and that damage must not have been 'real and certain'.
The Advocate General Campos Sanchez-Bordona considered that the restriction imposed by Hungary on the financing of civil organisation from abroad is not compatible with internal market provisions and the Charter, including the right to protection of personal data. He proposed that the Court of Justice should declare that the legislation at issue unduly restricts the free movement of capital, and lead to unjustified interference with the fundamental rights of respect for private life, protection of personal data and freedom of association protected by the Charter.
The plaintiff is a dentist in Germany but he used to practice in the Netherlands, where he was registered with the [https://www.bigregister.nl/ BIG-register] for healthcare professionals. Τhe Regional Health Care Disciplinary Boards in Amsterdam and Zwolle imposed disciplinary measures on him after complaints about his treatments. The plaintiff asked Google to remove all search results which linked to his name when searching for his name or the combination of his name and the search term "disciplinary law". Google removed some of them but refused to remove the rest claiming its legitimate interest under Article 6(1)(f) GDPR, the freedom of expression and the interest of the public in finding information online. The plaintiff on the other hand argued that he exercised his right to be forgotten on the basis of Article 17(1)(a) GDPR and Article 17(1)(c) GDPR and that the balancing test of the conflicting rights and interests should favor his rights and interests. He claimed that Google violated Article 12 GDPR by refusing to remove the links at stake without explaining the reasons why it did so in a transparent, concise and comprehensible form; these links reveal data relating to criminal convictions or otherwise sensitive data and require stricter protection under Article 9 GDPR and Article 10 GDPR, which Google violated. The Court had to assess whether Google had to remove all the links on the grounds of Article 17(1)(a) GDPR and Article 17(1)(c) GDPR or whether the exception of Article 17(3)(a) GDPR about the freedom of expression and information shall be applicable. The Court had to go through this balancing exercise. The Court noted that, although it follows from the case law that the right to privacy and the right to the protection of personal data take precedence over the right to freedom of information when balancing interests, in this case the interference with the the plaintiff's right to privacy was justified by the overriding public interest in acces
Τhe wife of a well-known German presenter had filed an action for injunction against the publication of the plaintiff's picture in two magazines. The reason and content of the first reporting was that the plaintiff’s husband surprisingly did not extend his engagement in his talk show and the question of why (speculatively) was posed. As a possible reason the report mentioned that the husband now had more time for his family and their recently acquired an estate (vineyard). In the past, the wife had repeatedly appeared publicly and had advertised herself and her estate (vineyard) in particular by means of an illustrated homestory in a magazine, thereby partially opening up her private life to the public. The husband had repeatedly stated in various interviews that due to his job he could not spend enough time with his family and the newly acquired (wine) estate. The report was illustrated with a picture of the couple from a public event with a blurred background. The second attacked photo report in another magazine had the occasion and included the husband's behaviour in his talk show. The text was illustrated with a photo of the plaintiff (depicting her pouring a glass of wine at a public event), signed with the words "(The plaintiff) and her husband have been amateur vintners for years and spend a lot of time on their winery". The wife was not directly involved in the event of the report, nor did the picture and the signature referred to the subject. The Court had to balance the right of the depicted person deriving from Articles 1(2), 2(1) of the Basic German Law and 8(1) ECHR with the rights of the press deriving from Articles 5(1) Basic German Law and 10(1) ECHR. The Court upheld the applicant's claim that she had a right to obtain an injunction against the dissemination of her image which she had not consented to. . The court justified its decision with the so-called graduated protection concept (abgestuftes Schutzkonzept), which is positively reflect
Τhe wife of a well-known German presenter had filed an action for injunction against the publication of the plaintiff's picture in two magazines. The reason and content of the first reporting was that the plaintiff’s husband surprisingly did not extend his engagement in his talk show and the question of why (speculatively) was posed. As a possible reason the report mentioned that the husband now had more time for his family and their recently acquired an estate (vineyard). In the past, the wife had repeatedly appeared publicly and had advertised herself and her estate (vineyard) in particular by means of an illustrated homestory in a magazine, thereby partially opening up her private life to the public. The husband had repeatedly stated in various interviews that due to his job he could not spend enough time with his family and the newly acquired (wine) estate. The report was illustrated with a picture of the couple from a public event with a blurred background. The second attacked photo report in another magazine had the occasion and included the husband's behaviour in his talk show. The text was illustrated with a photo of the plaintiff (depicting her pouring a glass of wine at a public event), signed with the words "(The plaintiff) and her husband have been amateur vintners for years and spend a lot of time on their winery". The wife was not directly involved in the event of the report, nor did the picture and the signature referred to the subject. The Court was asked to balance the right of the depicted person deriving from Articles 1(2), 2(1) of the Basic German Law and 8(1) ECHR with the rights of the press deriving from Articles 5(1) Basic German Law and 10(1) ECHR. The Court held that the action should be dismissed. The court justified its decision with the so-called graduated protection concept (abgestuftes Schutzkonzept), which is positively reflected in the German provisions of §§ 22, 23 of the Copyright in Works of Art and Photography Act (Geset
"In September 2018, a man from Düsseldorf had obtained a temporary injunction from the Düsseldorf Regional Court, which prohibited the Irish-based company Facebook from blocking the man from posting a specific text on www.facebook.com or from deleting the post. He had this injunction served on Facebook without an English translation. Facebook claimed that the company did not understand the content and needed an English translation." *https://www.olg-duesseldorf.nrw.de/behoerde/presse/Presse_aktuell/20200107_PM_Facebook/index.php* "The 7th Civil Senate ruled that the understanding of the language depends on the organization of the company as a whole. Facebook has a large number of users in Germany to whom the platform is made available entirely in German. The contractual documents used for this purpose are also in German. Concrete formulations in the terms of use show a thorough knowledge of the German language and German law. The Senate had to deal with this question because the man from Düsseldorf claimed the costs incurred by him in the amount of approximately EUR 730. This requires service of the preliminary injunction. The Senate had to clarify the validity of this service. The content of the contribution, which was not to be deleted, was irrelevant to the decision." *https://www.olg-duesseldorf.nrw.de/behoerde/presse/Presse_aktuell/20200107_PM_Facebook/index.php*
The ArbG Düsseldorf (Düsseldorf Labour Court) had set the amount in dispute at 500 euros. The party obliged to provide information refers to the fact that providing information would mean that the expenses incurred would be higher than 500 Euro. The ArbG Düsseldorf did not remedy the appeal and referred the case to the LAG Düsseldorf (Düsseldorf Higher Labour Court) for decision. The value of a request for information under Art. 15 GDPR is 500.00 euros, unless special circumstances arise
On 1 December 2006 plaintiff was arrested and charged of murdering an 8-year old boy. The first conviction was on 6 September 2007 and after multiple appeals on 22 may 2012 the final verdict was 11 years and 7 month prison followed by an involuntary commitment. The European Court of Human Rights rejected the application he made there. During the whole time, there was a lot of media coverage about this case and all proceedings. On 24 May 2015 the involuntary commitment started, and it has been extended with two years twice on 2 June 2017 and 29 May 2019. There was also media coverage about these extensions. When searching using Google search for the name of plaintiff, a lot of search results are found with publications about the crime he committed and the legal proceedings afterwards. After a request, Google removed 100 search results, but denied to remove 82 other results. It explained that with: "It is Google's understanding that the information about your client on these URL's - with regard to all the circumstances of the case we are aware of - is still relevant in relation to the purposes of data processing, and therefore the reference to this document in our search results is justified by the public interest." = The search results include information about criminal convictions and background of the crime. Based on Article 10 GDPR data processing about criminal convictions is only allowed under the control of an official authority. Data processing would also be allowed if processing is authorised by Union or Member State law, but this does not apply. Based on this, Google may not process this data. Article 32 GDPR and Article 33 GDPR also cannot justify the processing. Based on [https://curia.europa.eu/juris/document/document_print.jsf?doclang=EN&text=&pageIndex=0&docid=152065&cid=244711 CJEU - C-131/12 Google Spain], [https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:HR:2017:316 Hoge Raad - 15/03380] and Article 17 GDPR a weighing of the interests
The plaintiff asked from the Erasmus University Medical Centre Rotterdam (“EUMCR”) to provide her the DNA material of a person died in 2018 alleging that this person was her father. The deceased man had participated in a medical-scientific research at the EUMCR, prior to which he had filled in a “patient consent form”. According to this form, he expressed his wish that his body material would be treated confidentially. The EUMCR refused to provide the plaintiff the DNA material claiming that: * there is no legal basis under which it is obliged to provide this material, * the man’s wish had been expressed unambiguously, thus such a disclosure would contravene the GDPR and * it is bound by professional secrecy. The Court had to balance the plaintiff’s right to personality which includes her right to know her parents and the right of the deceased man and his family to privacy which is here protected by the EUMCR’s duty of confidentiality. The Court went through this balancing exercise and first invoked Recital 1 GDPR and Recital 4 GDPR and the definition of processing under Article 4(2) GDPR. Then, it noted that according to Article 9 GDPR and Recital 35 GDPR genetic data must be protected as sensitive data. The man’s consent to processing was only referred to the purposes of the research he participated in. Further, none of the requirements in Article 9(2) GDPR is fulfilled. The Court concluded that in this case the interest of the EUMCR must outweigh the plaintiff’s interest and the EUMCR must not provide her the DNA material. The Court rejected the plaintiff's claim.
The data subject owns and lives in a flat. The building in which the flat is situated belongs to the controller (a co-owner association). After a request of co-owners of the building the controller decided to install video cameras on the premises. The data subject objected to the video cameras being installed and he claimed it constituted an infringement of the right to respect for private life. The data subject sued the controller requesting the court ordering the controller to remove the cameras. The data subject argued that the video surveillance system installed by the controller infringed his right to respect for private life both under EU and national law. The controller stated that the video cameras were installed in order to monitor who is entering the building because there had been vandalism, thefts and burglaries, and that other measures previously taken had not been effective. The Romanian court stayed the proceedings and referred the following questions to the CJEU: (1) Are Articles 8 and 52 of the Charter and Article 7(f) of Directive 95/46 to be interpreted as precluding provisions of national law such as those at issue in the main proceedings, namely Article 5(2) of [Law No 677/2001], and Article 6 of [Decision No 52/2012 of the ANSPDCP], in accordance with which video surveillance may be used to ensure the safety and protection of individuals, property and valuables and for the pursuit of legitimate interests, without the data subject’s consent? (2) Are Articles 8 and 52 of the Charter to be interpreted as meaning that the limitation of rights and freedoms which results from video surveillance is in accordance with the principle of proportionality, satisfies the requirement of being ‘necessary’ and ‘meets objectives of general interest or the need to protect the rights and freedoms of others’, where the controller is able to take other measures to protect the legitimate interest in question? (3) Is Article 7(f) of Directive 95/46 to b