GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 16 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 16 October 2026 · Updated daily
The company offered educational services through a fan page hosted by Facebook. As administrators, they obtained statistical information on visitors to the fan page via Facebook Insights offered by Facebook free of charge under non-negotiable conditions of use. The information was obtained using cookies, each containing a unique user code, stored by Facebook in the devices of visitors and were active for two years. The unique code could be matched with users registered on Facebook and their personal data was collected when the fan page was opened. Neither the company nor Facebook notified users/visitors of the fan page of the storing of cookies or processing of their personal data. The Independent Data Protection Centre Germany, (ULD) made a decision on 3rd November 2011 against the company ordering them to deactivate the fan page within the prescribed period or pay a penalty fine on grounds that: 1. Neither Facebook nor the company notified the users that Facebook collected Personal data of the users; 2. Facebook processed personal data of the users. The company brought a dispute against that decision arguing that it was not responsible for the processing of personal data under the data protection law. This dispute went back and forth from the Administrative Court to the Federal Court who referred the matter to the CJEU seeking clarifications on whether an administrator of a fan page hosted by a social network is a controller within the definition under Article 2 (d)of Directive 95/46. The CJEU held that the mere fact of using a social network doesn’t make the user a controller responsible for processing personal data. However, an administrator who creates a fan page, consents to the use policy, cookies policy, defines the objectives and promotes its activities has an influence on the processing of personal data for the purpose of producing a statistical report, by Facebook, on the fan page, whether anonymized or not. Thus, the administrator is a joint contro
The data subject concluded a mobile phone contract with the controller on 25 September 2018. The contract gave the data subject the option to change her payment plan in the fourth to the sixth month of the contract in exchange for a contractual extension of another 24 months, which the defendant took on 27 December 2018. On the same day she received an affirmative response from the controller which stated that her "present payment plan will be cancelled on 27 December 2020". On 6 January 2019, the data subject sent the controller a letter stating that she is exercising her right to withdraw from the contract within 14 days after the contract ([https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32011L0083 Article 9 Consumer Rights Directive]). From 11 February 2019 until 10 July 2019 the controller invoiced her several times. The data subject did not pay these invoices. On 16 September 2019 the controller arranged an out-of-court SCHUFA entry against the data subject. On 27 September 2019, the controller commissioned the deletion of the entry by the SCHUFA. However, only after instructing the SCHUFA a second time to delete the entry, the entry was finally marked as to be deleted on 19.07.2021. As a result of the entry, the data subject was denied a loan on the 26 March 2020 and on 29 December 2020 a loan was only granted on the condition that the entry is erased. Because of the oustanding invoices, the controller initiated court proceedings against the data subject arguing that the data subject was bound by the contract and did not have a right to withdraw from the contract, because the change of the payment plan was a mere alteration of the original contract and not a new replacing contract. The data subject, on the other hand, argued that it was indeed a new contract which replaced the old one so she had a fourteen day period to withdraw from the contract under the respective German provision of [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:3201
The claimant, Peter Nowak, was a trainee accountant who failed one open book examination for the fourth time. He initially tried challenging the result of that examination, but his claim was rejected. Shortly after, he made an access request to the Institute of Chartered Accountants of Ireland ('CAI') seeking all the personal data relating to him that it held. In response, the CAI sent him a number of documents, but refused to send him his exam script on the ground that it did not contain personal data within the meaning of the 1995 Data Protection Directive. He then contacted the DPC to challenge the reason given for the refusal to disclose his examination script. It replied to him and stated that "exam scripts do not generally fall to be considered [for data protection purposes] … because this material would not generally constitute personal data". He did not accept this decision and after more exchanges submitted a formal complaint. The DPC informed him it could not identify a contravention of data protection legislation and consequently would not investigate. Thus, he brought an action against that decision in court. The Circuit Court, High Court and Court of Appeal all dismissed his claims. However, the Supreme Court allowed an appeal against the judgment of the Court of Appeal, and held that the action brought by Mr Nowak against the decision of the Data Protection Commissioner was admissible. The Supreme Court was nonetheless uncertain whether an examination script can constitute personal data within the meaning of Directive 95/46, so referred the following questions to the CJEU for a preliminary ruling: # Is information recorded in/as answers given by a candidate during a professional examination capable of being personal data, within the meaning of Directive 95/46? # If the answer to Question 1 is that all or some of such information may be personal data within the meaning of the Directive, what factors are relevant in determining whether in any given case
In the case of a public interest (road safety), it is appropriate and proportionate to monitor the speed at which cars travel, through a registration of the speed with a radar, including a photograph of the vehicle license plate, which will only be used if necessary for the purposes of criminal or administrative fining proceedings. There is no interference on the constitutionally protected right to privacy or intimacy, inasmuch as the image collected by a radar is directed at the vehicle, and, more specifically, at its license plate, while the driver is not visible nor identifiable. A driver was caught speeding and was issued an administrative fine of inhibition of driving for a period of 90 days. The driver appealed the decision to the Court of First Instance, considering her/his right to privacy was violated by being photographed by a speeding radar. That meant that having her/his photograph taken and used as proof in the proceedings should be considered illegally obtained evidence. Also, the driver considered that there was no evidence that the radar had been registered and approved by the data protection authority (CNPD), as is legally required, and so, the radar infringed the national data protection law. The Court of First Instance upheld the administrative decision. The driver, then, appealed to the Appeal Court. The data protection authority, CNPD, is responsible for giving opinions, controlling and inspecting compliance with legal and regulatory provisions regarding the treatment and protection of personal data, as per article 23 of Act 67/98, of 26 October. In accordance with the provisions of article 3, a) of this Act, personal data is “any information, of any nature and regardless of the respective support, including sound and image, relating to the identified or identifiable natural person who may have data be identified, directly or indirectly, namely by reference to an identification number or to one or more specific elements of their physical,
It all started with an accident between a tram and a taxi on the streets of Riga, the capital of Latvia. A minor passenger had suddenly opened the cab's door, which scraped the side of a tram. The taxi driver's insurer refused to pay out on the basis that the collision was the fault of the passenger. The tram company did not know who the passenger was, so it asked the Latvian police. The police disclosed the passenger's name but refused to disclose his identity card number or address because the national law did not include disclosure provisions for such data to third persons. The tram company challenged police refusal before the National Court, and the Court referred two questions to the CJEU. The main question referred to the CJEU was whether Article 7(f) of DPD imposes an obligation on a Data Controller to disclose all the personal data necessary to start court proceedings against a person. The National Supreme Court further questioned whether the answer to the latter would vary if that person were a minor or not. The CJEU laid down three cumulative conditions that make lawful the processing of personal data. When first applying the test, it was determined that the pursuit of a legitimate interest is not a question that should be answered only by the Data Controller. The same criterion should be answered by any party to whom the data are asked to be disclosed. Secondly, the CJEU continued with the need to process personal data for the purposes of legitimate interests; and ended with the balancing test that asserted that the fundamental rights and freedoms of the person concerned do not take precedence by the data protection. The judge in para 29 & 30 specified that (a) is a legitimate interest if the interest of an injured party, in obtaining the personal information of the person who caused the damage, is based on the intention to sue the latter person. It was also noticed that (b) the address and/or the identification number of that person appears strictly
Article 2188 of the Italian civil code states that companies must be on a publicly available register. Salvatore Manni was the sole director of a building company, Italiana Costruzioni Srl, which was awarded a contract for the construction of a large building complex. Mr Manni however experienced difficulties selling the units of this building complex. In this context, Manni brought proceedings against the Chamber of Commerce of Lecce, claiming that those poor sale results were due to the fact that he was still presented, in the official company register of the Chamber of Commerce, as the sole director of another company ('Immobiliare Salentina’) which had been declare bankrupt and struck off the register of companies a few years ago. Manni also claimed that a credit scoring company had used these data from the register to give him a negative rating. Mr Manni requested the Lecce Chamber of Commerce in charge of the register to erase, anonymise or block the data linking him to Immobiliare Salentina. He also asked for damages as compensation for the reputational harm he had suffered. The Court of Lecce initially upheld his claim, and ordered the Chamber of Commerce to anonymise his data and to give him 2000 EUR in damages. The Chamber of Commerce appealed this decision to the Court of Cassation. In this context, the Court of Cassation referred the following questions to the CJEU for a preliminary ruling: * Does the obligation to remove data no longer necessary for the purpose stated under Article 6(1)(e) take precedence over the Italian law obligation to include details on the register? * Is there a derogation to the principle under Article 3 Directive 68/151 that there should be no time limit to data published in the companies registered? The Court highlighted that under Article 2(1)(d) Directive 68/151, Member States must make the disclosure by companies of appointments, termination of office, legal proceedings, entering into administration etc... compulsory. A
This case concerns a data subject access request (SAR) under the Data Protection Act (DPA) 1998. The data subjects were beneficiaries under a trust. The data controller was a firm of solicitors, holding trust money as trustees. Following the appointment of further trustees and transfer of trust money into a new trust for other discretionary beneficiaries, the data subjects challenged the validity of these appointments and served the data controller with a SAR under section 7(2) DPA 1998. The data controller refused to make the disclosure, stating that the personal data was covered by Legal Professional Privilege (LPP), and therefore exempted from disclosure under Schedule 7 para. 10 DPA 1998. Furthermore, the data controller asserted that the supply of information required a disproportionate effort. The data subjects contended that many categories of personal data held by the data controller were not privileged and that, if any, the only privilege on which the data controller could rely was litigation privilege. The data subjects applied to the court for a declaration under section 7(9) DPA 1998 that the data controller had not complied with the request and to oblige the data controller to comply with the SAR. At trial, the court agreed with the data controller and refused to make such an order. The appellate court had to determine: # whether, taking a narrow view, the LLP exception is limited to documents subject only to legal professional privilege under English law; # whether, if the narrow view is correct, any further search would involve "disproportionate effort" for the purposes of section 8(2) DPA 1998 so that the data controller is excused from doing so; # whether the exercise of the court’s discretion under section 7(9) DPA 1998 can be refused because the data subject's real motive was to use the information in legal proceedings against the data controller. The Court of Appeal held that 'privilege' in the LLP exception is limited to legal professional pri
The case focused on data retention laws and their compatibility with EU laws, not cookies or consent mechanisms.
Mr. Breyer accessed several websites, which provided topical information, operated by German Federal Institutions which were accessible to the public. To prevent attacks, the sites stored information on all access operations in log files. Information stored include name of the web page, terms entered in the search fields, time of access, quantity of data transferred, an indication of whether the access was successful and the IP address of the computer that accessed the website. Mr. Breyer brought an action before the German Administrative Court seeking an order to restrain the Federal Republic of Germany from storing his access information of his visit to the website. This first action was dismissed. He appealed to the Court of Appeal. The court granted the injunction but only in part. The court ordered the Federal Republic of Germany to refrain from storing or arranging with third parties to store, at the end of each consultation period, information relating to Mr. Breyer's access including his IP address and any information that could result in revealing his identity. The court further stated that a dynamic IP address together with the date on which the website was accessed, where the user had revealed his identity during that consultation period, amounts to personal data since the user’s identity is tied to that particular dynamic IP address. On the other hand, the court observed stated that where Mr Breyer did not reveal his identity and only the internet service provider knew his identity the dynamic IP address doesn’t amount to personal data. Mr Breyer and the Federal Republic of Germany each brought an appeal on a point of law before the Federal Court of Justice, Germany (Bundesgerichtshof). Mr Breyer sought to have his application for an injunction upheld in its entirety while the Federal Republic of Germany sought to have it dismissed. The Federal court stayed the proceedings and referred the following issues to the CJEU. The CJEU answered the following
Amazon EU is a company established in Luxembourg which, among other activities, via a website with a domain name with the extension .de, addresses consumers residing in Austria, with whom it concludes electronic sales contracts. The company has no registered office or establishment in Austria. The VKI, which is an entity qualified to bring actions for injunctions within the meaning of Directive 2009/22, brought an action before the Austrian courts for an injunction to prohibit the use of the terms in Amazon EU's general terms and conditions especially relating to the applicable law for its contracts. The VKI considered them contrary to legal prohibitions or accepted principles of morality. The court at first instance presumed that in principle the Rome I Regulation applies and, on the basis of Article 6(2) of that regulation, held that the clause on the choice of applicable law was invalid, on the ground that the choice of law should not have the result of depriving consumers of the protection afforded to them by the law of their State of habitual residence. The court concluded that the validity of the other terms had to be assessed in the light of Austrian law. The appellate court, to which both parties to the main proceedings appealed, set aside the judgment of the first-instance court and referred the case back to it for rehearing. It considered that the Rome I Regulation was relevant for the determination of the applicable law. It held that Article 6(2) of the regulation did not allow the conclusion that Amazon EU's choice of applicable law was invalid, and that in accordance with Article 10(1) of the regulation that term should instead have been assessed in the light of Luxembourg law. = The Oberster Gerichtshof (Supreme Court, Austria), to which the VKI appealed, is uncertain as to the law applicable in the main proceedings. In those circumstances it decided to stay the proceedings and to refer the following questions to the Court for a preliminary ruling:
Eight prominent individuals (including actors, a BBC executive, and a footballer) sued MGN Limited, publisher of the Daily Mirror and Sunday Mirror newspapers. Over approximately 7 years, MGN journalists and private investigators systematically accessed the claimants' voicemail messages without authorization using various techniques including exploiting default PIN codes and "farming" (accessing contacts' voicemail boxes for additional information). One claimant (Alan Yentob) had his voicemail hacked at least twice daily for 7 years. The hacked information was then used to publish articles about the claimants, with sources disguised as "friends" or "pals." Additionally, private investigators employed "blagging" techniques, using deception to obtain personal information from third parties. The claimants suffered distress and damage to personal relationships, as published articles revealed confidential information that only a select few knew, causing those individuals to suspect each other of leaking information to journalists. The Court of Appeal upheld the first instance judgment and rejected all four grounds of appeal. The court established several key principles for damages under the tort of misuse of private information: First, damages are not limited to distress and injury to feelings. The court held that compensation can be awarded for the invasion of privacy itself and loss of control over private information, independent of any distress caused. The court stated: "misappropriating (misusing) private information without causing upset is still a wrong." Second, the court rejected arguments that damages should be limited by reference to personal injury tariffs or discrimination/harassment bands. While such references provide a "sanity check," the court found that each invasive act may give rise to a separate cause of action, and the "atomized" approach of awarding separate damages for each article and each act of hacking was appropriate. Third, the court reject
Article 315 (currently 322) of Romanian Law No 95/2006 mandated that all public authorities must transmit any data necessary to determine the insurance status of individuals to the National Health Insurance Fund (CNAS). The law also recognised persons without a taxable income qualify as insured. The National Tax Administration Agency (ANAF) transmitted data related to several self-employed persons, the applicants, including their income, based on a common 2007 Protocol, not subject to official publication. Neither authority informed the data subjects of this transmission. In this preliminary ruling, the Court clarified, first, that Article 124 TFEU (prohibiting privileged access by public authorities to financial institutions) is exclusively related to the Union’s economic and monetary policy, irrelevant to the proceedings and thus rejected as inadmissible. Second, since the fourth question concerned the lawfulness of data processing in a specific context, it benefited from a presumption of relevance to the dispute at hand. As a result, it was deemed admissible. Then the Court held that the Directive 95/46 was applicable. First, because the data transferred (names, categories of income, taxes paid) constitutes personal data. Second, both the transfer of data from ANAF to CNAS and the subsequent processing performed by CNAS constitute data processing. Therefore, the rules set out in Articles 10 and 11 (information that must be communicated to the data subject) are also applicable to the processing in dispute, in the limits set in Article 13. With regards to substance, the Court stated, first, that Article 10 sets out what information must be provided to the data subjects if their data was collected directly from them. This includes providing the identity of the “recipients of data” (Article 10(c)) in order to ensure fair processing. Thus, the Court and the Advocate General agreed that the principle of fair processing “requires a public administrative body to inform
Weltimmo was a company registered in Slovakia that ran a property dealing website concerning Hungarian properties. For that purpose, it processed the personal data of advertisers. The advertisements were free of charge for one month but a fee had to be paid once this time had passed. Many advertisers sent a request by e-mail for the deletion of both their advertisements and their personal data as from that period. However, Weltimmo did not delete those data and charged the interested parties for the price of its services. As the amounts charged were not paid, Weltimmo forwarded the personal data of the advertisers concerned to debt collection agencies. These advertisers lodged complaints with the Hungarian data protection authority, which fined the company HUF 10 million (approximately €32,000). Weltimmo appealed the fine before the Budapest administrative and labour court, which set aside the DPA's decision on the basis that certain facts were unclear. The company then appealed this decision to the Kúria submitting that there was no need for further clarification of the facts, since, pursuant to Article 4(1)(a) of Directive 95/46, the Hungarian DPA in this case was not competent and could not apply Hungarian law in respect of a supplier of services established in another Member State. Weltimmo also maintained that, under Article 28(6) of Directive 95/46, the Hungarian DPA should have asked the Slovak DPA to act in its place. The Kúria had doubts concerning the determination of the applicable law and the powers of the Hungarian data protection authority under Articles 4(1) and 28 of Directive 95/46, and therefore decided to stay the proceedings and refer the following questions to the CJEU for a preliminary ruling: # Can Article 28(1) of Directive 95/46 be interpreted as meaning that the provisions of national law of a Member State are applicable in its territory to a situation where a data controller runs a property dealing website established only in another Mem
Maximillian Schrems, an Austrian citizen, had been a Facebook user since 2008. Some of Mr. Schrems personal data had been transferred by Facebook Ireland to its servers belonging to Facebook Inc., located in the US. Personal data transferred by undertakings such as Facebook Ireland to their parent company established in the US can be accessed by the NSA and other US security agencies in the course of a mass and indiscriminate surveillance. EU citizens have no effective rights to be heard on question of surveillance and interception of their data by the NSA and other US security agencies. The Commission had declared data transfers to the US legal under Article 25(6) of the Data Protection Directive 95/46 (Directive 95/46) when complying with safe-harbor regime by Decision 2000/520 (the Adequacy Decision), finding the US's protection of personal data adequate in Article 1 of the decision, if the recipients adhered to so called safe harbor privacy principles. These included derogations from data protection principles for US national interests. In Article 3 of the decision the Commission heightened the threshold for DPAs to take action within the scope of Article Article 25 of Directive 95/46. In 2013, Mr. Schrems complained to the Irish Data Protection Commissioner (DPC) seeking to prohibit these transfers, claiming that the US did not have an adequate level of protection. When this complaint was rejected, he brought an action against the decision before the Irish High Court, which in turn referred a number of questions to the CJEU, asking in essence whether Article 25(6) of Directive 95/46, read in the light of Articles 7, 8 and 47 CFR, must be interpreted to mean that an Adequacy Decision prevents a DPA from examining the claim of a data subject regarding transfer of personal data to that third country when it contends that the law and practices in force in the third country do not ensure an adequate level of protection. The AG opined, that the derogations provi
The applicant contested the decision of the European Parliament wherein the access was refused with regards to the documents affiliated to Members of European Parliament that contained information about additional pension scheme and thereby containing personal data. The Parliament refused access on the ground that such disclosure would prejudice the legitimate interests of MEPs and violate their privacy. The Court held that if the applicant wants to have access to documents containing personal data, then it must be proven that the transfer of personal data is the most suitable of the possible measures for attaining applicant's objective i.e. the applicant must show legitimate reasons to that effect. The Court agreed that the transfer is necessary since it is the only way for determining whether MEP's voting behavior regarding additional pension scheme is influenced by their financial interest. Hence, the Court stated that the legitimate interests and privacy of MEPs were not prejudiced by such a transfer and thereby Article 8(b) of Regulation 45/2001 was not violated.
Mr. Rynes installed a camera system on his family home for the purpose of protection, health and life of his family. His family had, for several years been subjected to attacks by unknown people and it was difficult to identify them. The camera system recorded the entrance to his home, the public foot path, and the entrance to the house opposite his home. On the night of 6th to 7th October 2007, there was an attack on his home. The camera system made it possible to identify the two suspects involved. Mr. Rynes handed over to the police the recording to be relied on in the criminal proceedings. One of the suspects questioned the legality of the video recording and Mr Rynes was found to have infringed Law No. 101/2000 with respect to the protection of personal data. In particular, he was found to be a data controller who used the camera system to collect information without the consent of persons moving on the streets or opposite house. In addition, he had failed to inform them of the processing of personal data and lastly, as a Data Controller, he had not fulfilled the obligation to report the processing to the relevant office. Mr Rynes brought an action challenging this decision before the Prague City Court who dismissed the action. He appealed the decision to the Supreme Administrative Court who stayed the proceedings and referred the matter to the CJEU. The dispute in question is whether the operation of a home camera system which records people for purpose of protecting the property but monitors a public space amounts to processing of personal data as enumerated under Article 3(1) Directive 95/46. The court looked at the term personal data under Article 3(1) Directive 95/46 and Article 2(a) Directive 95/46 which is defined as any information relating to an identified or identifiable natural person, an identified person being one who can be identified directly or indirectly in reference to one or more factors specific to his physical identity. Accordingly, the
This decision ruled about two joined cases which concern third country people who applied for a residence permit in the Netherlands. In immigration procedures in the Netherlands, when deciding on an application for asylum, the officer in charge of an application drafts a decision and a minute which contains a justification of the decision for internal purpose. This minute contains information such as name, date of birth, ethnicity, religion and gender. It also includes a legal analysis which consists in an assessment of the information in the light of the legal provisions. These minutes were made available upon request until it the administration realised the amount of work it represented. From July 2009, the requests for communication of the minutes were therefore systematically refused and the administration provided a summary of the personal data contained in the document. The two applicants for residency requested a copy of the minute, which the administration refused. They only received the summary of personal data included in the documents. Both applicants contested this refusal with two different District Courts. These procedures were joint and several questions were referred to the Court of Justice for a preliminary ruling. The Court summarized these questions as follows: 1) The referring courts ask whether Article 2(a) of Directive 95/46 must be interpreted as meaning that the data relating to the applicant for a residence permit and the legal analysis included in the minute are ‘personal data’ within the meaning of that provision. 2) Does the protection of the rights and freedoms of others, within the meaning of Article 13(1)(g) of [Directive 95/46] …, also cover the interest in an internal undisturbed exchange of views within the public authority concerned? If the answer to that is in the negative, can that interest then be covered by Article 13(1)(d) or (f) of that directive? 3) The referring courts ask whether Article 12(a) of Directive 95/46 and Ar
The data subject made multiple subject access requests (SARs) to the Ministry of Justice following his wife's death, seeking personal data concerning communications between officials about the inquest. The first relevant SAR was made on 22 October 2006. The data subject made further requests on 19 December 2006, 21 April 2007, and 12 September 2007. The data controller failed to respond within the statutory 40-day period under section 7(8) DPA 1998. Material was eventually disclosed approximately 17 months after the relevant request, in March 2009. Some material was withheld for over 6 years on grounds of legal professional privilege, though the court later found one annotated document should have been disclosed as privilege had been waived when shown to a non-lawyer for independent opinion. The data subject sought damages for breach of statutory duty, distress caused by the delays, and time/costs incurred pursuing the requests. The High Court held that the controller breached section 7(8) DPA 1998 by failing to respond to the data subject's SAR within the prescribed 40-day period. On damages, the court held: First, the data subject was entitled to nominal damages of GBP 1 for the breach, as he failed to properly quantify his professional time and expenses. Second, critically, the court held that once "damage" (even nominal) was established under section 13(1), the data subject became entitled to compensation for distress under section 13(2). The court stated: "By accepting that the claimant suffered some damage... even if only to the extent of a nominal sum, it follows that the claimant has satisfied the requirements of section 13(2)(a), which means that an individual who has also suffered relevant distress is entitled to an award of compensation in respect of it." Third, the court awarded £2,250 for distress caused specifically by the delays in responding to the SARs, stating this represented "fair and proportionate compensation for the distress." On the withhel
In March 2010, Mario Costeja Gonzalez, a Spanish national, lodged a complaint against the newspaper 'La Vanguardia Ediciones', Google Spain and Google Inc. with the Spanish DPA (AEPD). The complaint was based on the fact that when internet users entered his name in Google Search, they would find links to two pages of the newspaper (from 19 January and 9 March 1998) on which an announcement mentioning his name appeared for a real-estate auction connected with attachment proceedings for the recovery of social security debts that he owed. The AEPD rejected the complaint in so far it related to the newspaper, as the articles had been lawfully published by order of the Ministry of Labour and Social Affairs. However, it upheld the complaint against Google Spain and Google Inc. because it considered "that it has the power to require the withdrawal of data and the prohibition of access to certain data by the operators of search engines when it considers that the locating and dissemination of the data are liable to compromise the fundamental right to data protection and the dignity of persons in the broad sense, and this would also encompass the mere wish of the person concerned that such data not be known to third parties." The two Google entities brought separate actions before the Spanish High Court appealing the AEPD's decision. The court joined the two cases, and stated that the case raised the question of what obligations are owed by operators of search engines to protect personal data. It held that the answer to this question depended on the correct interpretation of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A31995L0046 Directive 95/46]. = # With regard to the territorial application of Directive [95/46] and, consequently, of the Spanish data protection legislation: (a) must it be considered that an “establishment”, within the meaning of Article 4(1)(a) of Directive 95/46, exists when any one or more of the following circumstances arise: * when the
The European Union adopted Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC (i.e. Data Retention Directive) in 2006. The legislation imposed an obligation on Member States to store telecommunications data for a certain period to combat serious crime and terrorism by granting law enforcement authorities access to such data. Under Article 3 of said Directive, providers of publicly available electronic communications services/networks were obliged to retain metadata for the purpose of making them accessible, if necessary, to relevant national authorities. Metadata refers to information about a communication as opposed to its contents (e.g. traffic and location data). On 11 August 2006, Digital Rights (DRI), a privacy advocacy group, challenged the legality of legislative measures concerning the retention of data relating to electronic communications before the High Court on grounds related to the right to privacy and protection of personal data, as enshrined in Article 7 and 8 of the Charter of Fundamental Rights of the European Union (i.e. the Charter). In particular, the applicants sought to declare the Data Retention Directive and Part 7 of the Criminal Justice (Terrorist Offences) Act 2005 which require telephone communications service providers to retain traffic and location data relating to those providers for a prescribed time period to prevent, detect, investigate, and prosecute crime (and ensure security of the State). The High Court decided to halt proceedings and refer the matter to the Court of Justice of the European Union for a preliminary ruling. Kärntner Landesregierung, Mr. Seitlinger, Mr Tschohl and 11.128 other applicants brought proceedings before the Verfassungsgerichtshof to annul paragraph 102a of the T