GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 16 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 16 October 2026 · Updated daily
"The entrepreneur conducting business activity consisting in obtaining information, including personal data of persons conducting business activity, from publicly available public registers [e.g. the National Court Register (KRS), the Central Registration and Information on Business (CEIDG), the Registry of National Economy (REGON)] and in analysing, interpreting and subsequently making this information available to interested customers, must comply with the information obligation in relation to those persons referred to in Article 14 of the General Data Protection Regulation (GDPR) by providing information directly to the data subject, as is apparent from the judgment of the Voivodeship Administrative Court in Warsaw of 11 December 2019 (ref. no.: II SA/Wa 1030/19). Moreover, according to the Voivodeship Administrative Court, the possible high cost of sending this information by post does not constitute a basis for the exemption from the information obligation. This concerns a case in which the President of the Personal Data Protection Office ordered by way of an administrative decision to fulfill the information obligation and imposed on the company an administrative fine in the amount of more than PLN 943 000 (for more information on this issue see: https://uodo.gov.pl/pl/138/786). Let us recall that the company was penalised in connection with a breach of the information obligation (Article 14 (1-3) of the General Data Protection Regulation), consisting in failure to provide the information contained in Article 14(1) GDPR and Article 14(2) GDPR to all natural persons whose personal data are processed by the company who are currently or were in the past sole traders, as well as to natural persons who have suspended their activity as sole traders. The company appealed to the Voivodeship Administrative Court against that decision. It argued, inter alia, that it was not under the information obligation resulting from Article 14 of the GDPR. The entity considered tha
Austria introduced [https://www.ris.bka.gv.at/eli/bgbl/1975/631/P135a/NOR40202514 § 135a] of the criminal procedures act (StPO) to allow the use of spy software on devices ("government hacking") to be able to tap encrypted communication between smartphones. The mandatory data retention via license plate readers was also challenged before the Court. Members of the Parliament (Social Democrats and the Liberal Party) have applied to the Constitutional Court (VfGH) claiming that the law violates citizens' fundamental rights. The Court decided that the surveillance law that permits the use of spying software to read encrypted messages contravenes the fundamental rights to private life according to Article 8 ECHR, to data protection as foreseen in § 1 of the Austrian data protection act (Datenschutzgesetz - DSG). The Court highlighted the difference between traditional wiretapping and modern computer systems which read encrypted messages. The latter provides insight into all areas of life allowing inferences about the user’s thoughts and preferences. Considering the particularities of the surveillance measure, this control mechanism was deemed to be not sufficient. The Court required an effective independent supervision by an institution which affords all appropriate technical means and human resources both at the beginning of the measure and the entire duration of the surveillance. The Court ruled that the recognition of licence plates, car types and driver pictures in a centralised database of the Ministry of Interior constitutes an indiscriminate data retention.
13 individuals requested the de-referencing of links leading to webpages which contained their personal data from Google LLC. Following Google’s refusal, the individuals filed complaints with the CNIL to request the de-referencing of the links at stake. The CNIL rejected all of the complaints. Thus, each of the complainants challenged the CNIL’s decision before the French Council of State (Conseil d’Etat). From these 13 appeals 18 different legal issues arose. In several instances the Court found that Google complied with the de-referencing requests prior to the appeals. Nevertheless, the Court clarified the framework in which a search engine must respect the right to be forgotten. It recalled that the right to be forgotten is not absolute and it always has to be balanced against the right of freedom of information. When implementing this balancing test the sensitivity of personal data should be taken into consideration. Insofar it does not concern sensitive personal data, the de-referencing must take place whenever the information provided with the link does not outweigh the right to information of the public. The Conseil d’ Etat set guidelines by stating that the balancing assessment should focus on three main elements: * The nature of the personal data, * the social importance of the data subject and * whether the information provided with the link is easily accessible. Insofar it regards sensitive personal data, the de-referencing must occur whenever the information provided with the link is not strictly necessary for the information of the public. In the latter case a stricter assessment has to be conducted, but it still has to follow the same three main elements.
The Durch Stichting Bureau Kredietregistratie (BKR), a private entity founded by banks, runs a Central Credit Information System (CKI). Dutch law requires banks to be connected to the CKI. The claimant wanted certain data to be delete. It brought a legal action based on Article 17 GDPR and Article 21 GDPR, read in conjunction with the Dutch Data Protection Act (Wet bescherming persoonsgegevens - Wbp). The Court of First Instance rejected the claims and dismissed the requests. Thus, the plaintiff appealed the decision before the Court of Appeal. The Arnhem-Leeuwarden Court of Appeal found that the registration of personal data in the CKI of the BKR does constitute processing of personal data under Article 6(1)(c) GDPR. In this instance, this means that the processing at stake is necessary for the compliance with a legal financial obligation and leads to several consequences. First, whenever the legal basis of the processing is necessary for compliance with a legal obligation each Member State may introduce more specific provisions according to Article 6(2) GDPR. In the present case, the processing is carried out under a national legal obligation and for the performance of a task carried out in the public interest since this system is the only credit registration system in the Netherlands. In addition, insofar the compliance with a legal obligation constitutes the primary the legal basis under Article 6(1)(c) GDPR, the Court found that the data subject cannot exercise his right to object pursuant to Article 21(1) GDPR. Secondly, the right to erasure does not apply to the extent that the processing is necessary for the compliance with a legal obligation carried out in the public interest, by virtue of Article 17(3)(b) GDPR. Indeed, it further is justified that the task carried out in the public interest under Article 6(1)(e) GDPR does not constitute an appropriate and adequate legal basis for all the personal data processed. Lastly, the Court recalled that other
The defendant, a credit agency had processed incorrect data on the plaintiff, who was denied a loan for a real estate purchase due to this entry and later had to enter into another loan agreement. The plaintiff sued the defendant for damages of EUR 8,271.67 and further requested a declaration that the defendant is liable for future damages. The first instance court (Landesgericht Feldkirch) awarded damages of EUR 2,000 to the plaintiff but rejected the further claims. The plaintiff appealed against this rejection, but it was upheld by the second instance court (OLG Innsbruck). The OLG Innsbruck admitted the plaintiff’s further appeal as there was no case law by the Austrian Supreme Court on the distribution of the burden of proof for damages under Article 82 GDPR. Does Article 82 GDPR put the burden of proof for damages that result from a data protection violation regarding *occurrence and amount of a damage, *causality and *unlawfulness on the injured party (data subject) or on the injuring party (controller/processor)? The OGH held, that Article 82 GDPR does not stipulate a reversal of the burden of proof from the injured party to the injuring party regarding occurrence and amount of a damage, causality or unlawfulness of the data processing. It is up to the injured party - the plaintiff - to prove all facts giving rise to liability. Only when it comes to the culpability, the burden of proof is shifted to the injured party (Article 82(3) GDPR) In the case at hand, the plaintiff did not proof any damages beyond the awarded EUR 2,000 and was further not able to proof the causality. Hence, the OGH upheld the judgment of the OLG Innsbruck.
A business added names and other personal information from a list of Austrian registered psychotherapists, which had been publicly available on a federal ministry‘s website, to their own register of psychotherapists and psychotherapists in training with supervision. The commercial website offered paid features for listees including prioritisation in search results and the possibility to add further information such as links and pictures. Action was brought by an association of Austrian psychotherapists in order to stop the publishing of listee's names without consent or, alternatively, stop providing a perceived competitive advantage to paying listees. The featuring of entries was seen as misleading since it was not clearly indicated that those were part of a paid advertising package. Can the defendant rely on Article 6 (1) (f) GDPR/legitimate interest as a basis for the processing and were appropriate information requirements according to Article 14 GDPR met? Can the defendant’s activities be challenged under competition law? The Austrian supreme court (Oberster Gerichtshof der Republik Österreich - OGH) refers to § 28 of the Austrian data protection act (Datenschutzgesetz - DSG) and concludes that this exclusively grant rights for group actions by associations and other bodies in front of the national data protection authority, but not in front of courts. In addition, it finds, was the association not explicitly legitimised by its individual members to bring such action for them, nor had it claimed to be doing so. It supports this by reference to Article 80 (2) GDPR which require an explicit provision from the national legislator for action brought by an organisation without explicit commission from the data subject. Hence, due to a lack of active legitimation to bring the action, it does not review the applicability of Article 6 (1) (f) and 14 GDPR. Regarding privacy related claims based on competition law, the supreme court raises the question of general
A kebab shop installed three cameras, two inside one outside. The outside camera has also captured a public street and a gas station on the other side. Instead of 72h under Austrian law, it kept data for 14-16 days. No warning signs were installed. The system was installed and accessed by the husband of the owner of the kebab place. A police officer reported the case, which was ultimately handled by the DPA. The DPA a violation of (I.) Articles 5(1)(a) and (c) as well as Article 6(1) GDPR and (II.) §§ 12, 50a and 50d of the Austrian Data Protection Act (DSG). The violations of the GDPR was taxed with EUR 1,200, the violation of the DSG with two times EUR 300. The controller disputed the legal and factual findings. He claimed that he has e.g. installed warning signs and changed the scope of the cameras and the deletion period. He further argued that he was not the controller, because his wife was the owner of the kebap place. The court saw no mistake in any factual findings. Later changes are irrelevant to find a violation of the GDPR. As the husband has actually bought and installed the camera, as well as reviewed the footage, he had factual control and is the controller under Article 4(7) GDPR. The court considered §§ 12 and 13 Austrian Data Protection Act (Datenschutzgesetz - DSG) inapplicable in lack of an opening clause specifically for the processing of pictures and videos under the GDPR. Hence the lawfulness of processing was assessed under Article 5 and 6 GDPR only. Given the financial situation of the controller, the penalty was reduced from EUR 1,800 to EUR 1,500.
The complainant made a submission to the Estonian DPA, which the DPA interpreted as a request for information and not as a complaint in terms of Article 77(1) GDPR. The complainant, however, expected the submission to be processed as a complaint within the meaning of Article 77(1) GDPR. The issue was mainly to know the margin of discretion within which the AKI assesses the complaints submitted and to what extend the administrative judge can review it. The court found that the complainant's submission to the DPA clearly requested DPA assistance in preventing unlawful use of the complainant's personal data and interpreting it merely as a request for information was not justified. The court emphasized that the intent of a submission must be considered by the DPA and that a more convenient process cannot be selected merely because a complaint is vaguely formulated or the content briefly stated. The court further noted that a complainant does not need to outline which data protection measures they expect the DPA to undertake, nor do they even need to understand what are the measures available to the DPA - rather, the DPA must evaluate the substance of a complaint and decide for itself which measures are appropriate and accompany any refusal to process a complaint with the required justification. The decision references Article 77(1) GDPR and Estonian Data Protection Act §28 p 1.
Different family members live in different parts of a house. One family member installed six cameras to film different parts of the property, claiming that for example postal letters were stolen. The other family members filed a "report" (Anzeige) with the DPA. The DPA understood the "report" to be a complaint under Article 77 GDPR. The DPA asked the local district authority (Bezirksverwaltungsbehörde) to investigate certain facts on behalf of the DPA and issued an order to stop the processing of personal data. The DPA has not found which exact areas were filmed and if the complaint was actually subject to CCTV surveillance. Has the DPA investigated all relevant facts? It is crucial that the data of the complainant was de facto processed. The DPA made no such finding in the entire decision. The decision was therefore invalid and was returned to the DPA to make these investigations.
The plaintiff had applied for a position at the Administrative Court. His application was rejected based on an assessment which included notes of the President of the Court. The plaintiff requested access to his personal file including that assessment, as provided for in Article 15(1) GDPR, which was kept by the Higher Administrative Court. The Court denied the request. Does Article 15 GDPR apply to hand written paper notes? In the judgement, as for the part that is relevant here, the Berlin-Brandenburg Administrative Court ruled that the GDPR does not apply to the notes of the President of the Administrative Court. According to Article 2(1) GDPR, it applies to data processing which is carried out wholly or partly by automated means. This term is not defined under Article 4 GDPR. According to Article 3(2) of the German Federal Data Protection Act (BSDG), the term automated data collection means the collection, processing or use of personal data using data processing equipment. In this case the President’s notes contain personal data of the plaintiff but they are handwritten and not collected or processed using data processing equipment.
The Austrian consumer organization ("Verein für Konsumenteninformation", VKI) has sued the provider of encrypted digital terristrial TV in Austria ("Simply TV") under the Austrian implementation of the Unfair Terms Directive 93/13/EEC (§ 6 Konsumentenschutzgesetz - KSchG) because it allegedly used 29 illegal clauses in its Terms of Service. Two clauses (18 and 19) concern data processing. The other parts of the judgment are irrelevant for the purpose of this page. = "The personal data provided by the subscriber as well as data on the type and frequency of his use of the services provided by Simply TV shall be collected, stored, used by Simply TV - insofar as this is necessary for the processing of subscriptions, for the provision of customer services as well as for the invoicing of remuneration - and transmitted to commissioned companies for the purposes of order data processing pursuant to § 11 Data Protection Act 2000." = "Simply TV may send electronic messages (in particular e-mail, SMS) to the subscriber for the purpose of informing him of offers from Simply TV in the pay-TV sector which are similar to the packages and/or channels already subscribed to by the subscriber. Simply TV will only transmit such messages if the subscriber has provided Simply TV with the relevant contact details (in particular e-mail address, telephone number) as part of the subscription. The subscriber may object to the transmission of such messages at any time in writing (post, fax, e-mail: infoservice@s*****.at). The subscriber will be informed of his right of revocation at each transmission of such messages." = VKI claimed that the clause is intransparent, as the controller does not inform about (1) the concrete companies data is shared with, (2) the the fact that the data subject can withdraw his consent at any time and because (3) the data subject may get the false impression that the clause would generally allow to use personal data as describted in the clause during the ent
The plaintiff had requested erasure of his personal data according to Article 17 GDPR claiming that the forwarding of data via e-mail to other municipalities and the publication on the VNG forum of his personal data constituted unlawful processing. He also claimed compensation for damages occurred from the unlawful processing on the basis of Article 82 GDPR. The defendant had rejected the request because the processing at stake was lawful and thus the requirement of Article 17(1)(d) GDPR was not fulfilled. According to the defendant, the lawfulness should be assessed on the basis of the Dutch Data Protection Act and not of the GDPR as the processing at stake took place before the GDPR came into force. Does the GDPR apply to events that happened before 25. 5. 2018? The Court found that the GDPR also applies to legal consequences of events which occurred before it came into force. The Dutch transitional law lists cases where the Act would still apply after the enforcement of the GDPR, but the present case is not among them. However, the lawfulness of the processing is based on a factual assessment and the facts took place before the GDPR. Hence, the facts should be examined in on the basis of the Act, while the legal consequences, such as the right to erasure and the right to compensation, on the basis of the GDPR. The Court ruled that the processing at stake was compliant with the Act and thus lawful. Consequently, the defendant rightly rejected the request to erasure based on Article 17(1)(d) GDPR. Finally, for the factual assessment of the right to compensation the plaintiff should apply before the civil and not the administrative courts according to the Dutch Data Protection Act (Wet bescherming persoonsgegevens - Wbp).
The provision at stake regulated the protection of personal data in the context of journalistic activities. The Court found that this provision created legal uncertainty and set limits to the right of freedom of expression and information. The Court found these limits disproportionate to the objective pursued, in the context of journalistic expression. Finally, the Court stressed that declaring an implementing provision unconstitutional does not impede the full implementation of the GDPR, since GDPR is directly applicable and most of its provisions are directly effective.
A citizen requested a copy of his personal data from a controller under Article 15 GDPR. The controller requested a copy of an identity document for identification purposes. Following the request of an official identity document, the data subject (the complainant) submitted a complaint before the Austrian DPA for violation of his right to access. The DPA dismissed the complaint as unfounded. The applicant lodged an appeal before the Federal Court and requested legal aid. The Court had to assess whether it was necessary to grant the complainant legal aid. The Court found it was not necessary to grant legal aid for to have the complainant represented by a lawyer, as the complainant was obviously able to file a complaint with the DPA himself, the Judged at the BVwG have to assist the complainant in filing the case and during the hearing ("Manuduktionspflicht") and the factual and legal issues are rather trivial. The application for legal aid was denied. No decision on the material issues was made.
The plaintiff is a dental specialist and demanded that the defendant, which operates a rating portal for doctors with more than six million users per month, delete his data published on this portal without his consent. The Court of First Instance found that the plaintiff could request the deletion of his personal data pursuant to Article 17(1)(d) GDPR since the data was unlawfully processed. The defendant claimed that its activities fall under exception in (Article 85 GDPR) read in conjunction with Recital 153 and the right to freedom of expression and information as it carries out processing activities for journalistic purposes. Is a platform that grants certain benefits to "premium" listings a journalistic platform? The Higher Regional Court focused in particular on whether the evaluation site was a “neutral information broker” by granting customers “hidden advantages” - terms developed through the case law of the Federal Supreme Court to assess whether the exception in Article 17(3) GDPR applies. The court examined the various functions of the site on a case by case basis and found that the site left the role as a “neutral information broker” through four of the contested functions. The controller can therefore not be seen as a journalistic platform. The doctors were therefore given the right to erasure under Article 17 GDPR. The Court admitted the appeal (“Revision”) to the Federal Supreme Court. → See the parallel case OLG Cologne - 15 U 89/19.
Two doctors sued a platform for deletion of their basic profile set up on the platform without their consent under Article 17 GDPR. They argued that due to the functions of the site, non-paying doctors (basic customers) were used on the site as an advertising platform for paying doctors (premium customers) in an inadmissible manner, partly due to functions hidden from regular users. Is a platform that grants certain benefits to "premium" listings a journalistic platform? The Higher Regional Court focused in particular on whether the evaluation site was a “neutral information broker” by granting customers “hidden advantages” - terms developed through the case law of the Federal Supreme Court to assess whether the exception in Article 17(3) GDPR applies. The court examined the various functions of the site on a case by case basis and found that the site left the role as a “neutral information broker” through four of the contested functions. The controller can therefore not be seen as a journalistic platform. The doctors were therefore given the right to erasure under Article 17 GDPR. The Court admitted the appeal (“Revision”) to the Federal Supreme Court. → See the parallel case OLG Cologne - 15 U 126/19.
The data subject requested deletion of a publication in the Dutch ‘Staatscourant’, the official government publication site, claiming violation of their privacy, honour and reputation. This request was denied by the State Secretary, so the data subject requested from the judge to order deletion. The data subject also asked for compensation under Article 82 GDPR because of alleged material and non-material damages. The judge rejected the case as inadmissible on the procedural ground that it was brought before the public court, while the competent court is the administrative one.
The claimant’s son applied for social support at home. Following the application, the City Public Health Department investigated and addressed a recommendation on whether the social support should be granted to the City Council. The City Council decided to not grant the social support. Then, the claimant requested a copy of the files processed during the application process, including the son's personal data related to his medical files. The City Council refused to grant the access. Who is the relevant controller? The Court first considered that all public entities involved in the application process and not only the City Council were joint controllers. Thus, the access request regarding the personal data could have been sent to the City Public Health Department as well. Then, the Court considered that the access to the personal data should have been granted by the City Council under the data protection law. However, the City Council already destroyed the personal data after it refused to grant the social support. Therefore, the Court considered that the refusal was legitimate.
Both the plaintiff and the defendant run pharmacies. The plaintiff alleged that the defendant sells prescription-free medicines via Amazon-Marketplace, violating competition law. Firstly, the Court found that customers disclose their health data to the sales platform Amazon deliberately and there is no data transmitted by the defendant to Amazon. After Amazon has transmitted the order data, the situation is comparable with a direct order from the defendant's online pharmacy. The legislator has permitted online pharmacies. Then, the Court found that customers’ order data is health data and fall within Article 9(1) GDPR. Amazon does not collect health data stricto sensu but it can draw conclusions about customers’ health from the order data. The plaintiff pointed out that any breaches of data protection laws by the Amazon Marketplace platform are not part of this legal dispute. It is also not a question whether any data protection breaches by the platform can be attributed to the defendant. The decisive factor here is the data processing by the defendant himself. The Court finally found that there is no explicit consent by the customers as requested under Article 9(2)(a) GDPR and an implied consent cannot fulfill the provision’s requirement. Additionally, the professional code of conduct of the Saxony-Anhalt Chamber of Pharmacists obliges pharmacists to obtain written consent.
An individual participated in the MasterCard's loyalty programme “Priceless Specials". The individual objected to MasterCard's processing of personal data and asked it to refrain from processing without adequate precautions against data misuse. Further, the complainant learned that the other participants’ sensitive personal data was publicly accessible online. Following the mentioned request, MasterCard informed the data subject that an incidence led to unauthorised online publication of the personal data of some of its customers. The representative of the data subject filed an injunction asking MasterCard to cease the processing and acknowledge its responsibilities regarding the lack of security. MasterCard did not respond. Thus, the complainant’s representative filed a motion before the Regional Court of Munich. The applicant based theirs claims principally on the GDPR and the German Civil Code (BGB). The Court emphasised the need to implement adequate and appropriate safety measures, but it rejected the application for injunction as unfounded. It found that the request was not sufficiently precise, since it didn't clearly ask what measures the defendant should take. Also, the Court pointed out that the applicant has the possibility to object to the processing of his personal data and to terminate the contract with the data controller. The Court stated that such an injunction would have been well founded only if the change of an existing condition to the processing could thwart or substantially complicate the realisation of a right of the plaintiff. In such context, it stressed that the right to stop unlawful processing of data is not enshrined as such in the German data protection act and that the mere processing of data contrary to the act does not constitute a violation of the law. Finally, it confirmed the data controller’s arguments that to cease the processing will not stop the risk of the personal data incident repetition and stated that measure