GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 16 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 16 October 2026 · Updated daily
The Austrian postal service ("Österreichische Post AG", a private stock company, of which 52,9% is owned by the Republic of Austria) also sells data for direct marketing purposes ("list brokerage"). These lists include names and addresses and other factors that are largely generated using other public information and predictive models. The postal service also sold data that included a likeliness of the political affiliation (similar to: 45% social-democratic, 20% conservative, 5% Green Party). This was mainly intended for postal mailings by said political parties. The data was generated using public information about voting behavior in each voting district in Austria, aga and alike and was sold publicly. The postal service mainly relied on § 151 of the Austrian Business Code of 1994 ("Gewerbeordnung 1994", GewO) that regulates address brokers. The national law does not differentiate between different types of data, but limits the use solely to marketing purposes. The postal service took the view that predictions about the political affiliation of a data subject does not itself constitute "special categories of data" under Article 9 GDPR. A data subject (Dr. Christian Wirthensohn, a privacy lawyer) made an access request, receiving a copy of his alleged political affiliations (a percentage per political party). He sued the postal service for € 2.500 in emotional damages for a number of alleged violations (illegal processing of data, lack of data minimization, delayed access to data, lack of information). What is the relationship between national laws (like § 151 GewO) and GDPR? Is a prediction of a political affiliation a "special category of data" under Article 9(1) GDPR? How much are the damages under Article 82 GDPR in this case? The Court found a violation of the GDPR, as the data falls under Article 9 GDPR and awarded € 800 in emotional damages. The Austrian Business Code cannot override Article 9 GDPR. There are no rules on the calculation of damages in G
Fashion ID embedded Facebook's 'Like' plug-in, transmitting user data to Facebook without user consent or knowledge, violating third-party consent requirements.
The person was sent to prison for tax evasion in the years 2001 to 2006. The district court has assumed that A withheld share gains together about NOK 4.7 million and assets of just over NOK 4.5 million from taxation. The tax benefit is stated in the judgment to be approximately NOK 1.5 million reduced income tax and NOK 53 000 in reduced wealth tax. A was further convicted of complicity to the fact that a partner in an investment partnership evaded more than NOK 700 000 in tax in the years 2003 to 2006. Finally, the person was convicted of having contributed to a total of three employees in the Eltek Group evading NOK 425 000 in tax in 2002. On 31 October 2013, Økokrim decided that the person's DNA profile should be «registered in the identity register (DNA register), cf. the Attorney General's guidelines of 1 October 2013 ». The person did not receive the decision until April 2016, and he then complained to the Attorney General. The Attorney General also discussed the relationship of Article 8 ECHR and the DNA registration. The guidelines of 15 August 2008 provided a threshold for registration which he did not consider to be in contrary to Article 8 ECHR. The person who´s DNA was registered claimed that his right to privacy has been infringed. The registration of the person´s DNA was found to not be disproportionate. The ruling was issued with dissent 4-1. The Supreme Court's majority (para. 23-106) highlighted in particular that he was convicted of a serious crime and that the threshold for registering a convicted felon was delimited in a sufficiently precise manner. The majority highlighted that the law in question opened for the DNA to be deleted pursuant to an assessment in the concrete, and that the law had detailed regulation concerning the access and access rights to the data, the right of access for the data subject, as well as regulating the storage of the data. In the opinion of the majority, this ensured appropriate safeguards and was proportionate
Deutsche Bank S.p.A. asked a customer to provide his sensitive data in order to sign a contract for a bank account. The customer initially accepted the clause included in the contract, but then he withdrew his consent. As a result, the bank interrupted the service. The Court had to assess whether this sensitive data was necessary for the Bank in order to conclude a contract for a bank account. The Court found that the processing of the customer's sensitive data was not necessary for the execution of the relevant contract. Such a clause violates the principle of data minimization as provided for in Article 5(1)(c) GDPR. Consequently, according to Article 1418 of the Italian Civil Code, the contractual clause was declared invalid as contrary to mandatory rules.
This case started as a conflict between neighbours. The controller (Y) and the data subject (X) are/were inhabitants of the same neighbourhood. The controller experienced nuisance (soot gas infiltration) because the data subject had amended his home to prevent the backlash of wood smoke. The controller repeatedly emailed the data subject about this, but the data subject did not change his behaviour. Between 22 November 2017 and 15 December 2018, the controller made three video recordings of the wood smoke, and uploaded these videos on YouTube. He also sent the videos to the data subject “to confront him with the intrusions he had caused on the private lives of his neighbours”. On 11/01/2019, the data subject then requested the controller to remove the videos, which Y did not do. On 15/01/2019, however, the controller saw that all of his videos were deleted from YouTube, and several requests of the Belgian DPA to remove certain video recordings. On 14/02/2019, the DPA warned the controller that they could sanction him for posting the videos, and issue high fines. The controller replied that he already removed three videos. However, on 18 April, he was notified that the DPA would investigate the case. However, before the DPA had even issued a legally binding decision, the controller lodged an appeal with the Court of Appeal because he challenged the impartiality of the DPA. He claimed, inter alia, that the DPA had put him under pressure with threat of a (large) fine, without having been informed of any substantive complaint. First, the Court considered that the data subject had filed his complaint after he had been advised by staff of the DPA. Moreover, the Court criticised the fact that staff of the DPA can first advise data subjects regarding potential complaints, and later advise the DPA on these complaints in another capacity. However, it also mentioned that it “cannot anticipate and proactively impose on the [DPA] how it should handle administrative dispute
In June 2017, a Greek medical doctor working for a Greek clinic performed a hair transplant on the claimant. Shortly after, the claimant lost his hair even in places that were not affected by the surgery. His hair only regrew months later. In the course of the claimant's stay in Greece, both the doctor and employees of the Greek clinic had taken picture of the claimant - even during the surgery. These pictures were published on the Greek clinic's website, together with the claimant's name. The claimant had not consented to this processing of personal data and requested the removal of the photographs and his other personal data. A dispute ensued between the claimant and the doctor (the defendant). The claimant requested a) repayment of the remuneration paid to the defendant of EUR 5,880 and b) damages of EUR 20,000 for the photographs published on the Internet. The defendant argued that the surgery had been performed lege artis and that the photographs had been published by the Greek clinic without the defendant's knowledge and had been removed immediately after the claimant's request. As there was no economic or personal interdependence between the Greek clinic and the defendant, the defendant should not be liable for any damages occurred. The OLG Linz dismissed the appeal (which only concerned the claim for damages) and upheld the decision of the Landesgericht Linz which had dismissed the claim. The unauthorised action of employees of the Greek clinic to put the claimant's name on the photographs and to publish them on the internet without his consent constituted an interference that was unforeseeable for the defendant. As a result, under Article 82(3) the defendant cannot be held responsible for the processing of the claimant's personal data by the Greek clinic.
In that case, the Claimant brought an action against the deletion of a video from the 1970s that he shared in a social network where the word "negro" appeared several times. He also complained about having his account limited to "read only" mode for a few days (the exact duration is disputed between the parties). With regard to Article 99(2) GDPR, the Court already expressed doubts as to whether Article 82 GDPR is applicable to the deletion/blocking that took place in March/April 2018, as this regarded a past and completed situation. However, this point could be left open as for the Court, the video deletion and temporary account blocking was lawful under Article 6(1)(a) GDPR in connection with the terms of use of the network. In any event, the Claimant did not suffer any non-material damages pursuant to Artcile 82(1) GDPR. Not every perceived discomfort without serious impairment of an individual's self-image or reputation may constitute such damage. Recital 146 to the GDPR, referring to "full and effective compensation", does not alter this finding. Otherwise, an almost "unconditional" right to non-material compensation would arise under data protection law.
Mr Schrems (permanent resident in Vienna) has brought a lawsuit against Facebook Ireland Ltd (headquartered in Dublin) before the Regional Court in Vienna ("Landesgericht für Zivilrechtssachen Wien", LGfZRS) under Article 79 GDPR. The Viennese Civil Court (LGfZRS) has denied jurisdiction. The Higher Regional Court (OLG) has overturned the judgment and held that the Civil Court has jurisdiction in the case. = Facebook argued that the case was inadmissible, as § 29(2) Austrian Data Protection Act (DSG) only allowed damages claims before civil courts, while all other GDPR rights (like the right to erasure, right to access and alike) have to be brought before the DPAs. Parallel enforcement would violate the Austrian Constitutional rules on the separation of powers between the judiciary and the executive. Facebook argued that Mr Schrems would try to enforce "general claims" that need to be brought before DPAs. If any court is in charge then it would have to be the Viennese Commercial Court ("Handeslgericht Wien"). Further claims on a change of the applications were made, that are irrelevant from a GDPR perspective and therefore not expanded here. = Mr Schrems argued that Article 77 and 79 GDPR explicitly allow parallel procedures ("without prejudice to any available administrative or non-judicial remedy"). § 29(2) DSG only talks about damages, but does not regulate other situations. It explicitly does not refer to the Courts of First Instance (of which there are three in Vienna) but to the Viennese Civil Court. § 29(2) DSG therefore overrides the general rules on jurisdictions of these three courts. The Austrian Government has objected to that in the GDPR negotiations. EU law overrides Austrian law. All claims are explicitly in his name only. All claims are personal claims by Mr Schrems and are not "general claims". GDPR explicitly allows "dual track" enforcement ("Doppelgleisigkeit"). Most of the legal literature agrees with this concept. The Austrian government
The case focused on contractual terms and privacy policy issues related to Google+, not on cookie consent or tracking violations.
On November 26, 2018, a lawsuit was filed by UGT (Spanish trade union) regarding a collective labor conflict. Another lawsuit was filed on December 12, 2018, by CCOO (Spanish trade union) concerning the same collective labor conflict. TELEPIZZA S.A.U., a pizza delivery chain, wanted to implement the "Proyecto Tracker" (Tracker Project), which required delivery drivers to provide their personal cell phones with internet connection for geolocation purposes during their working hours. Telepizza's purpose was to ensure that customers ordering their pizzas were aware of the status of their order at all times. The company argued that its main competitor, as well as other digital food delivery platforms, offered geolocation systems for orders, which made its implementation necessary to maintain a similar offer. The Collective Agreement for cooked product manufacturers for home delivery did not regulate the requirement for workers to provide mobile phones. Telepizza initiated an amendment of working contracts to be signed by new employees to include the mandatory provision of personal devices and the installation of a company-developed app for this purpose. Employees would be responsible for activating the app at the beginning of their shift so geolocation would start, as well as for its deactivation at the end of the shift. The trade unions also complained about the app accessing the phone's gallery. In compensation, the employer was to pay a monthly amount that it determined unilaterally. The repeated refusal or supervening impossibility of providing the personal phone by the employee was foreseen to be sufficient cause for the termination of the employment contract. The company explained that the acceptance of this system would be voluntary in the case of delivery drivers already contracted. The Court declared the nullity of the "Tracker Project" as well as the nullity of the clauses introduced in the contracts that required the contribution of the cell phone with inte
In 2017, the Norwegian DPA Datatilsynet found that a company "Legelisten", running an anonymous review website of healthcare personnel, lacked a legal basis for processing and instructed them to allow said personnel to opt out of being listed and reviewed, in addition to several other instructions. Both the initial complainant and Legelisten responded to the DPA's decision with complaints. The DPA considered both complaints, but did not find any grounds to change their decision. Consequently, the case was submitted to the Norwegian Privacy Appeals Board, who considered comments from the initial complainant, Legelisten, the Norwegian Consumer Council, and the DPA. The Board focused their assessment on the lawfulness of processing of personal data on the website Legelisten.no. First, they considered the applicable law, as the GDPR had entered into force since the initial complaints dating back to 2012. They found that the GDPR would indeed apply. The Board reviewed several aspects relating to the case in question, summarised below. = The Board agreed with the DPA's finding that Legelisten is the controller for all processing of personal data related to their site (as listed above), for both users and the healthcare personnel, because they in all these instances determine how the personal data will be processed (the purpose) and the means (technical platform, layout, which processors to use). = The Board agreed with the DPA's finding that there were no exemptions or derogations for processing carried out for journalistic purposes in this case. = The DPA found that Legelisten lacked a legal basis for processing contact information (email address) of users submitting reviews, because they could not rely on consent as this was not found to have been provided voluntarily. The Board agreed that email addresses will often reveal the identity of a person and is, as such, personal data, and that information related to visits to or contact with specialist healthcare pers
The German Customs Authority, through a self-evaluation questionnaire, requested of Deutsch Post AG, all those natural persons who are in charge of managing customs matters (or those responsible for dealing with such matters) to send, among other things, the Tax Identification Numbers and the details of the tax offices responsible for their taxation. The German Customs Authority stated that, if there were no cooperation, it would be impossible to determine whether the requirements, which were laid down in the German Customs Code as well as in the Commission Implementing Regulation (2015/2447/EU), were satisfied. If it would be impossible to make that determination, then the German Customs Authority is obliged to revoke any customs authorisations held by Deutsche Post. Deutsche Post AG expanded upon the nature and extent of the personal data of third parties that must be submitted so that an undertaking can qualify for the customs status of an authorised economic operator (AEO). According to EU Regulation 2015/2447, customs authorities shall, after recognising the status of AEO, provide to the customs user some simplifications. For example, customs authorities shall not re-examine those criteria which have already been examined when granting the status of AEO. Deutsche Post AG claims that individuals who are undertaking affected by the fulfilment requirements raised by the German Customs Authority, are numerous. It also claims that some of those individuals are unwilling to agree to the transmission of their personal data. The third claim of Deutsche Post AG was that the collection of Tax Identification Numbers is neither necessary nor appropriate for determining the reliability of an entity, in terms of customs law, and the verification of the individual tax situation of all the individuals affected is disproportionate in relation to the objective. The main argument of the German Customs Authority is that the exchange of these data is necessary to ensure unmistak
A German company called Planet49 organized an online lottery hosted on their webpage. In order to participate in the lottery the participant had to enter a name and an address. Underneath the input field there were two checkboxes. The first checkbox required the user to accept being contacted by firms for promotional offers. The second checkbox required the user to consent to cookies being installed on the participants computer. The first checkbox was not pre-ticked, while the second checkbox was. To participate in the lottery the user had to tick, at least, the first checkbox. The Federation of German Consumer Organisations (the “Bundesverband”) initated court proceedings against Planet49, claiming that the declaration of consent did not meet the requirements for a freely given and informed consent. The case reached the Federal Court of Justice (“Bundesgerichtshof”), which referred questions regarding the scope of consent under provisions of the Data Protection Directive 95/46/EC, the ePrivacy Directive 2002/58/EC, and the GDPR to the CJEU. The case was referred to the Court of Justice on 5 October 2017 - before the GDPR became applicable on 25 May 2018. As the Bundesverband sought an injunction to prevent Planet49 from continuing its practices in the future, the Court’s decision takes into account the requirements for consent on the basis of both the Directive 95/46/EC and the GDPR. The Court assessed the requirements for a valid consent under both Directive 95/46/EC and the GDPR and found that there were no substantial differences between them, noting however that the GDPR explicitly states requirements that need to be inferred under Directive 95/46/EC. As the Court notes, the notion of consent under the ePrivacy directive should have the same meaning as consent under Directive 95/46/EC and the GDPR. A key question posed by the referring court in relation to the consent requirement was whether consent could be “passive” or if it had to be “active”. The C
The plaintiff was employed by an international group as head of the “Legal Mergers & Acquisitions”. A longstanding labour dispute began between the plaintiff and his employer. As a result, the plaintiff was assigned to various positions having a lower hierarchy and lower wage level. During the conflict, the plaintiff received several warnings from its employer for improperly fulfilling his work and was finally dismissed. In the context of this dispute, the plaintiff requested access to personal data under Article 15 GDPR. The right to access relates, among other things, to any correspondence about the plaintiff in parallel with the personnel file, and the inclusion of the plaintiff in internal 'negative lists'. This is of importance because a Business Practices Office (BPO) proceeding against the plaintiff was initiated in 2014 - it equals a whistle blower system. In an email from the head of HR to the plaintiff on March 8, 2017, the plaintiff was informed that a compliance check was planned for all (job) appointments in the legal area, which would also check whether a BPO Proceedings result in a violation of the rules. However, the first instance rejected the right of the plaintiff to claim information about the personal performance and the behavioural data processed by the employer, which was not stored in the personnel file. The employer refused to communicate this information because of third-parties interests, namely business secrets. The Land court confirmed that Article 15 GDPR also exists in an employment law relationship, and a Member State is authorized to issue specific national regulations on employee data within certain limits. According to the GDPR, personal data is all information that relates to an identified or identifiable natural person ('data subject'), and, in an employment relationship, the employer inevitably processes personal data of its employees. It has been judged that the plaintiff is entitled to information about personal perform
The employer communicated sensitive data (pro justicia reports) to third parties without a legal basis and asked for damages. These were refused by the employer in the first place. The court order the employer (the Minister of Justice) to pay 300 # of damages for violation of the data protection legislation, considering that the privacy-sensitive personal data have ended up with a small group of professionals, i.e. employees and members of the Disciplinary Board, and that they have a duty of confidentiality by virtue of their position. This does not detract from the fact that the plaintiff's privacy has been violated and that this has understandably been perceived by the plaintiff as unpleasant and disadvantageous. All things considered, the court deems compensation of €300 to be fair.
The Supreme Court of Ireland requested a preliminary ruling on whether a national body established in order to ensure enforcement of EU law must be able to disapply a rule of national law that is contrary to EU law. Three people were excluded from a recruitment procedure of the national police force of Ireland (Án Garda Síochána) due to the fact that they were above the maximum age for recruitment. They brought a complaint before the Equality Tribunal alleging that the setting of a maximum age limit constitutes discrimination prohibited by [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32000L0078 EU Directive 2000/78] and Irish law transposing the Directive. The Equality Tribunal is a body of the Workplace Relations Commission of Ireland. The Minister for Justice and Equality argued that the Equality Tribunal lacked jurisdiction as the Admissions and Appointments Regulation was an instrument of national law and that only courts established under the Constitution of Ireland had jurisdiction to disapply such an instrument. The Equality Tribunal proceeded to consider the complaints but provided that it would consider the jurisdictional issue. The Minister for Justice and Equality brought an action before the High Court of Ireland to prohibit the Equality Tribunal from acting contrary to national law and the order was upheld by the High Court. The High Court held that the Tribunal lacked jurisdiction to issue a legally binding decision on the incompatability of national and EU law as under [https://www.irishstatutebook.ie/eli/cons/en/html Article 34 of the Constitution of Ireland] this was reserved solely for the High Court. The Equality Tribunal appealed the decision to the Supreme Court which sided with the argument of the High Court but examined whether such a division of jurisdiction complies with the principles of equivalence and effectiveness. The CJEU stated that in essence, the referring court asked whether a national body established to ensure
A person received a spam email and asked from the sender a total amount of damages of EUR 500; the defendant acknowledged the claim in the amount of EUR 50 and the claimant still pursued the claim for an additional amount of at least EUR 500 of immaterial damages. The defendant contested the claim and asked the court to dismiss the claim. The defendant argued that the claimant had not suffered anything more than "minimal" damages. The court held that the infringement of GDPR as such without damages as a consequence thereof will not give rise to a claim for damages and that "minimal damages" do not give raise to damages under Article 82 GDPR. The decision is based on German literature on the GDPR.
An employee wanted to take revenge on his employer, Morrisons, because he was annoyed by disciplinary proceedings and sanctions taken by the employer against him. As part of his regular job, the employee had access to payroll data which he was required to process for an annual audit. The employee copied the data onto a personal USB stick, then posted a file containing the personal details of 99,998 employees on a file-sharing website, placed links to the website elsewhere on the internet, and anonymously sent a CD containing a copy of the data to newspapers in the UK. In the letter to the newspapers, the employee purported to be a concerned person who had worryingly discovered that payroll data relating to almost 100,000 of Morrisons’ employees was available on the web. The data so disclosed consisted of the names, addresses, gender, dates of birth, phone numbers, national insurance numbers, bank sort codes, bank account numbers and salaries. The employee was charged with fraud under the Computer Misuse Act 1990 and under section 55 of the Data Protection Act 1998 (DPA) and was sentenced to a term of eight years imprisonment. Connected to the data breach, 5,518 of Morrisons’ employees subsequently sued their employer in a mass claim for damages for misuse of private information, breach of confidence and breach of statutory duty owed under section 4(4) of the DPA. The employees argued that Morrisons was primarily liable under those heads of claim but, if not, then Morrisons was to be held vicariously liable for the wrongful conduct of its employee who committed the offence. The trial court held that Morrisons did not disclosed the information or misused it and was not the data controller in respect of the information disclosed on the web. Accordingly, Morrisons owed no duty to the claimants under the DPA and was not directly liable in respect of any breach of confidence or misuse of private information. However, merely because the employee became the data controller
The defendant was a lawyer who ran her website. The applicant alleged that the website was not adapted to the requirements of the GDPR, because it did not contain all the legally required information about the processing of personal data (currently resulting from Article 13 GDPR). In addition, it violated the law on unfair competition (the applicant was also a lawyer). The Court prohibited the defendant from using her unencrypted website, related to her activity as a lawyer, without a data protection declaration compliant with the GDPR. The Court found that the defendant's action violates unfair competition laws.
Following a request from the Finnish DPA, the Finnish Data Protection Board adopted a decision prohibiting a religious community (the Jehovah’s Witnesses Community) from collecting or processing personal data in the course of door-to-door preaching carried out by its members unless the legal requirements for processing were satisfied. The Data Protection Board imposed a ban on the collection of personal data by the Jehovah’s Witnesses Community for a period of six months unless those conditions were observed. The Jehovah’s Witnesses Community appealed the decision before the Administrative Court in Helsinki, Finland (Helsingin hallinto-oikeus), which annulled the decision on the grounds, inter alia, that the Jehovah’s Witnesses Community was not a controller and that its activity did not constitute unlawful processing. The DPA challenged that judgment before the Supreme Administrative Court in Finland (Korkein hallinto-oikeus). The Supreme Administrative Court referred questions to the CJEU for a preliminary ruling on the following matters: (1) Whether the collection and other processing of personal data carried out by the members of a religious community in connection with door-to-door preaching fall outside the scope of the Data Protection Directive 95/46 under the exceptions stipulated in [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A31995L0046 Article 3(2) of the Data Protection Directive 95/46]? (2) Whether personal data collected otherwise than by automatic means in connection with the door-to-door preaching constitute a 'filing system' in light of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A31995L0046 Article 2(c) of the Data Protection Directive 95/46]? (3) Whether the phrase “alone or jointly with others determines the purposes and means of the processing of personal data” in light of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A31995L0046 Article 2(d) of the Data Protection Directive 95/46] means that a r