GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 16 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 16 October 2026 · Updated daily
On 29 September 2008, Mr Jori was appointed Data Protection Supervisor for a 6 year term, which would terminate around the end of September 2014. However, Mr Jori was asked to vacate the office on 31 December 2011. Upon proposal by the Hungarian Prime Minister, Mr Peterfalvi was appointed as Head Authority for a term of nine years. The AG considers that the European Commission does not dispute in any way the right of Hungary to modify its institutional set up for its data protection authority. The issue disputed is that, in changing the institutional set up, Hungary failed to fulfil its obligation to respect the independence of their supervisor by terminating its employment before the beginning of their term. [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 28(1) Dir.95/46] puts forward the need for supervision of the personal data protection by an independent authority as an essential component of the protection of individual in personal data processing. As found by the [https://curia.europa.eu/juris/document/document.jsf?text=&docid=79752&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=682589 CJEU in C-518/07], the term “with complete independence” is interpreted broadly and autonomously in light of the objective to ensure the effectiveness and reliability of the supervision of data protection compliance. Moreover, the guarantee of independence is established not to grant a special status to those authorities themselves as well as their agents but rather to strengthen the protection of individuals and bodies affected by their decisions. Still from [https://curia.europa.eu/juris/document/document.jsf?text=&docid=79752&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=682589 CJEU in C-518/07], the CJEU held that actions that may lead to “prior compliance” would not be consistent with the requirement of “complete independence” which Member States must guarantee their supervisory authority. The AG shares the E
In proceedings contesting a decision imposing a fine for a traffic offence, the plaintiff sought to show that she had never received any order of the fine or any subsequent demands for payment that had been issued by the public prosecutor, as they had been sent to the wrong address. To prove this, she requested her municipality to disclose her various addresses in 2008 and 2009. In response, the municipality provided a certified transcript of the personal data in question and, in exchange, demanded payment of a fee of EUR 12,80. The plaintiff brought an action contesting that request for payment. The referring court was of the view that Article 12(a) of Directive 95/46 can be construed in two ways: - the communication of personal data must take place without excessive delay or excessive expense; or - the communication of personal data must take place without excessive delay and without expense. In the former case, it is permissible to levy a fee, so long as it is not excessive. In the latter case, levying a fee is prohibited. The referring court therefore decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling: - Whether Article 12(a) of Directive 95/46 is to be interpreted as precluding the levying of fees in respect of the communication of personal data by a public authority; - Whether the levying of the present fee is excessive. If it was found that Article 12(a) of Directive 95/46 must be interpreted as meaning that personal data is to be communicated free of charge, the referring court was then uncertain as to: - Whether the provision of access to data against payment pursuant to a provision under national law constitute compliance with the obligation to communicate data undergoing processing. Article 12(a) of Directive 95/46 does not require Member States to levy fees when the right of access to personal data is exercised, nor does it prohibit the levying of such fees as long as they are not exces
The Belgian Professional Institute of Real Estate Agents (IPI) had used private detectives to collect information on a real estate company that allegedly breached regulatory rules. The admissibility of the private detectives’ evidence in court was questioned on the grounds that the company’s agents had not been informed that their personal data would be processed by third parties in accordance with [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 11(1) of the Data Protection Directive 95/46]. IPI argued that the use of private detectives fell within the exception under [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 13(1)(d) of Directive 95/46], which permits the collection of data without consent for the prevention, investigation, detection and prosecution of breaches for regulated professions. Belgian law had specified exceptions for journalistic purposes, artistic or literary expression, public authorities exercising judicial police duties, police services and the European Centre for Missing and Sexually Abused Children. The Belgian Constitutional Court considered that the Belgian law did not strictly transpose exceptions comparable to [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 13 of Directive 95/46/EC]. It referred three questions to the ECJ for clarification on the obligations for Member States to implement Article 13 in national law: # Does [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Article 13(1)(d) of Directive 95/46] leave Member States free to choose whether or not to provide for an exception to the immediate obligation to inform under Article 11(1) to protect others’ rights and freedoms? # Do professional activities of private detectives (governed by national law) come within an exception referred to in [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML Articl
Mr. Schwarz (the data subject), applied to the Stadt Bochum for a passport, however, refused to have his fingerprints taken. As a result, the local authorities rejected his application. The data subject challenged the validity of Article 1(2) Regulation No 2252/2004 of 13 December 2004 on standards for security features and biometrics in passports and travel documents issued by Member States, which creates the obligation to take fingerprints of individuals applying for passports. In the proceedings before the referring court, the data subject argued, among other claims, that the provision infringes upon the right to the protection of personal data and private life, as protected in Article 7 and 8 of the Charter of Fundamental Rights of the European Union. The Court firstly affirmed that the taking and storage of fingerprints in passports is a threat to the abovementioned rights. Fingerprints constitute personal data as they contain unique information about individuals that allows for their precise identification. Moreover, the taking of fingerprints by national authorities and storage in the data subject’s passport classifies as the processing of personal data based on Article 2(b) Directive 95/46. However, the Court argued that this infringement is justified in accordance with Article 7(2) and Article 8(2) of the Charter of the European Union because the two rights are not absolute by virtue of Article 52(1) of the Charter of the European Union. The measure was provided for by law, namely, Article 1(2) Regulation No 2252/2004 and pursues objectives of general interest recognized by the Union—preventing the falsification of passports and fraudulent uses thereof, and illegal entry. In addition, the Court determined that the measure is proportionate to these aims for the following reasons: no effective alternative measures exist, specific safeguards are implemented to protect such data from being misused and abused, and it does not constitute as an operation of an i
On 9 March 2010, the ACT carried out an inspection at a Worten establishment. As a result of the inspection, an official report was drawn up, the main message being that the working time register, as required by national law, was not available for immediate consultation by the ACT. The report was followed by an order to provide the legally required information from the labour register. Two years later, by decision of 14 March 2020, the ACT found that Worten had committed a serious breach of labour law for breaching the rules on the working time register set out in Article 202(1) of the Labour Code, as Worten had failed to allow the ACT to immediately consult the working time register of the workers employed in the establishment concerned. The infringement was considered to be grave because the purpose of the working time register is to check immediately and rapidly whether the undertaking's activity is organised in accordance with the rules on working time. A fine of EUR 2 000 was imposed. Worten then brought an action for the annulment of the decision before the Tribunal do Trabalho de Viseu. The Tribunal decided to stay the proceedings and requested the Court of Justice to give a preliminary ruling on the following questions: # Is Article 2 of Directive 95/46 … to be interpreted as meaning that the record of working time, that is, the indication, in relation to each worker, of the times when working hours begin and end, as well as the corresponding breaks and intervals, is included within the concept of “personal data”? # If so, is the Portuguese State obliged, under Article 17(1) of Directive 95/46 … to provide for appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network? # Likewise, if Question 2 is answered in the affirmative, when the Member State do
A data subject (the claimant) purchased a television on credit through a financial services provider (the controller). Following a dispute, a court approved a consent order in February 2008 requiring the controller to discharge the credit agreement and delete all related data. Despite this order, the controller made erroneous data entries falsely showing the data subject owed £1,500 and transmitted this incorrect information to a credit reference agency (Equifax) between February and October 2008. When the data subject discovered the incorrect entries in May 2008, the false data remained on his credit file for approximately four months after discovery before removal in October 2008. The data subject had not complained immediately, only writing to the controller in July after checking again in June. The controller failed to defend against the data subject's counterclaim alleging breaches of the Data Protection Act 1998, resulting in a judgment in default. The Court of Appeal held that nominal damages satisfy the "damage" requirement under section 13(1) of the Data Protection Act 1998, thereby enabling a claim for distress damages under section 13(2) without proving substantial financial loss. The Court awarded £1 in nominal damages and £750 in damages for distress, establishing that frustration caused by breaches of important data protection principles merits compensation. The Court rejected applying discrimination law damages bands to data protection cases and confirmed that compensation aims to adequately remedy breaches, not to punish. The decision establishes that even single-episode breaches involving inaccurate data shared with third parties can warrant substantial non-material damages where the data subject suffered distress from the violation.
On 5 July 2005 the European Commission sent a letter of formal notice to the Republic of Austria in which it claimed that the organisation of the Austrian Data Protection Commission (Datenschutzkommission – DSK) failed to satisfy the criterion of independence set out in the second subparagraph of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A31995L0046 Article 28(1) of Directive 95/46/EC]. The Commission did not consider the observations of the Republic of Austria satisfactory and, therefore, issued a reasoned opinion pursuant to [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012E%2FTXT Article 258(1) TFEU]. On 9 December 2009, the European Commission brought the matter in front of the Court of Justice of the European Union. The Commission and the EDPS noted that, according to the then-current national law, the managing member of DSK needed to be a member of the Federal Chancellery (Bundeskanzleramt). More in general, they pointed out that the office of DSK was structurally integrated with the departments of the Chancellery. They argued that this was contrary to the criterion of independence set out in the second subparagraph of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A31995L0046 Article 28(1) of Directive 95/46/EC], as staff members were subject to the supervision of the Chancellery. The Republic of Austria argued that the requirement of set by the second subparagraph of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A31995L0046 Article 28(1) of Directive 95/46/EC] relates to “functional independence” and that the DSK had such independence, since [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&FassungVom=2010-11-18&Artikel=2&Paragraf=37&Anlage=&Uebergangsrecht= § 37(1) of the then-in force Austrian Data Protection Code] (Datenschutzgesetz - DSG 2000) provided for its members to be independent and not to be bound by instructions given by the government. It point
The publishing companies Bonnier Audio AB, Earbooks AB, Norstedts Förlagsgrupp AB, Piratförlaget AB and Storyside AB (the "publishers") claimed that their exclusive rights regarding audio books had been infringed by means of an FTP (‘file transfer protocol’) server which allows file sharing and data transfer between computers connected to the internet. The publishers had applied for an order for disclosure of the identification data about the person who was using the IP address from which was assumed that the files were sent. The service provider Perfect Communications Sweden AB ("ePhone") challenged this application, arguing in particular that the injunction sought is contrary to Directive 2006/24. Eventually the applicants appealed to the Supreme Court (högsta domstolen), which referred to the following questions to the CJEU for a preliminary ruling: 1. Does Directive 2006/24, and in particular Articles 3 to 5 and 11 thereof, preclude the application of a national provision which is based on Article 8 of Directive 2004/48 and which permits an internet service provider in civil proceedings, in order to identify a particular subscriber, to be ordered to give a copyright holder or its representative information on the subscriber to whom the internet service provider provided a specific IP address, which address, it is claimed, was used in the infringement? The question is based on the assumption that the applicant has adduced clear evidence of the infringement of a particular copyright and that the measure is proportionate. 2. Is the answer to Question 1 affected by the fact that the Member State has not implemented [Directive 2006/24] despite the fact that the period prescribed for implementation has expired?’ The CJEU first established that the applicants seek the communication of the name and address of an internet subscriber or user using the IP address from which it is presumed that the alleged illegal file exchange took place, in order to identify
The claimants, which had worked for former MEPs, asked for the annulment of a decision by the European Parliament which would deny them access to Parliamentary Assistance Allowance documents. They needed access to these documents for legal proceedings. The European Parliament refused access based on article 4 (1) (b) Regulation 1049/2001 and article 3 (2) Regulation 45/2001, except that lists open to the public during the period of professional activity of the persons. The requested documents would reveal the political view of former MEP assistants and this constitutes sensitive data. The CJEU held that the strict view the EP held, by automatically denying access to documents revealing the identity of former MEP assistants, without considering the circumstances, holds no grounds. The CJEU held that withholding disclosure is possible, but only after an assessment of the situation was made, and how publicising those documents would impact the privacy of the assistants of former MEPs. The Parliamant thus failed to show to what extent the disclose would specifically and effectively undermine the right to privacy.
SABAM is a management company which represents authors, composers and publishers of musical works. Netlog ran an online social networking platform. On their Netlog profile, users could keep a diary, indicate their hobbies and interests, show who their friends are, display personal photos or publish video clips. However, SABAM claimed that the social network offered all users the opportunity to make use, by means of their profile, of the musical and audio-visual works in SABAM’s repertoire, making those works available to the public in such a way that other users of that network could access them without SABAM’s consent and without Netlog paying it any fee. SABAM first unsuccessfully tried to negotiate a licensing agreement with the social network, then gave it a notice that it should give an undertaking to cease and desist from making available to the public musical and audio-visual works from SABAM’s repertoire without the necessary authorisation - also without results. Given the lack of action taken by the social network, SABAM had it summoned before the Brussels Court of First Instance (rechtbank van eerste aanleg te Brussel) in injunction proceedings under Article 87(1) of the Law of 30 June 1994 on copyright and related rights. It requested that Netlog be ordered immediately to cease unlawfully making available musical or audio-visual works from SABAM’s repertoire and to pay a penalty of €1000 for each day of delay in complying with that order. The social network submitted that granting SABAM’s injunction would (1) effectively impose on Netlog a general obligation to monitor, which was prohibited by Article 15(1) of Directive 2000/31 and (2) introduce, at Netlog's own cost and for an unlimited period, a system for filtering most of the information which is stored on its servers in order to identify and block electronic files containing musical, cinematographic or audio-visual work in respect of which SABAM claims to hold rights. The rechtbank decided to stay t
The Belgian Association of Authors, Composers and Publishers ('SABAM') is a collective management organisation with the goal of collecting, distributing, administrating and managing all authors' rights in Belgium and abroad. Scarlet is an Internet Service Provider ('ISP') which provides its customers with access to the internet without offering other services such as downloading or file sharing. In 2004, SABAM concluded that copyrighted works in its catalogue were being downloaded by Scarlet internet users through 'peer-to-peer networks' without authorisation or paying the royalties owed to artists. It brought proceedings against the ISP to court, claiming the company was best placed to bring measures to stop these copyright infringements. First, it sought a declaration that copyright infringements had occurred through the use of Scarlet services. Second, it sought an order requiring Scarlet to prevent these by blocking such delivery of files containing copyrighted works using peer-to-peer software. Thirdly, it requested that the ISP provide the organisation with details of the measures that it would apply to comply with the judgment. In a first judgment in 2004, the First Instance Court of Brussels held that copyright had been infringed. It nonetheless could not determine if the measures proposed by SABAM were technically feasible and appointed an expert to assess this. The appointed expert concluded that whilst there were some significant obstacles, this was feasible. In a second judgment in 2007, the court ordered the ISP to bring an end to the copyright infringements by installing a filtering and blocking system. Scarlet appealed, claiming such a system would effectively require the general surveillance of all communications passing through its system, a breach of Article 15 Directive 2000/31. Further, the company "considered that the installation of a filtering system would be in breach of the provisions of European Union law on the protection of personal dat
ASNEF and FECEMD challenged the [https://apdcat.gencat.cat/web/.content/01-autoritat/normativa/documentos/2643.pdf Spanish Royal Decree 1720/2007]. They claimed that [https://apdcat.gencat.cat/web/.content/01-autoritat/normativa/documentos/2643.pdf Article 10(2)(a) and (2)(b) of the Royal decree], allowing extra-EU data transfers without the consent of the data subject in specific instances provided by national law (i.e when the processing serves a legitimate interest of the controller, when it is necessary to fulfil a duty imposed on them, when the data is public accessible) is compatible with [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7(f) Dir.95/46], providing legal basis for data processing. Two questions were referred to the CJEU: 1. Must [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7(f) Dir.95/46] be interpreted as precluding the application of national rules which, in the absence of the interested party’s consent, and to allow processing of his personal data that is necessary to pursue a legitimate interest of the controller or of third parties to whom the data will be disclosed, not only require that fundamental rights and freedoms should not be prejudiced, but also require the data to appear in public sources? 2. Are the conditions for conferring on it direct effect met by [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7(f) Dir.95/46]? Answer to the first question The objective of ensuring an equivalent level of protection in all Member States that [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 7 Dir.95/46] sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as being lawful. Thus, Member States cannot add new principles relating to the lawfulness of the processing of personal data to [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0
Deutsche Telekom, a telecommunications network operator in Germany, publishes directories containing data related to its own customers and that of subscribers of approximately 100 other undertakings in accordance with paragraphs 47(1), 104 and 105 of the Telekommunikationsgesetz (German Law on Telecommunications) (‘TKG’). GoYellow and Telex AG operate an internet and telephone directory enquiry service through the use of available data provided to them by Deutsche Telekom for remuneration. However, the aforementioned companies came to a disagreement as to the scope of the data Deutsche Telekom has to provide to GoYellow and Telex AG. The matter was brought before the Bundesnetzagentur. On 11 September 2006, the Court ordered Deutsche Telekom to grant access to GoYellow and Telex AG to both data relating to Deutsche Telekom’s own subscribers and external data (i.e. data related to the subscribers of third-party telephone service providers), even when subscribers wished the respective data to be published solely by Deutsche Telekom. Deutsche Telekom challenged this decision before the Verwaltungsgericht Köln (Administrative Court, Cologne). On 14 February 2008, the Court dismissed the action. Deutsche Telekom appealed before the Bundesverwaltungsgericht (Federal Administrative Court) on the grounds that an obligation to make such external data available infringes Article 25(2) Universal Service Directive 2002/22/EC and Article 12 ePrivacy Directive 2002/58/EC—the matter was referred to the CJEU for a preliminary ruling. The Court firstly determined that Article 25 Universal Service Directive 2002/22/EC does not provide for full harmonization and is aimed at guaranteeing that at least one extensive directory is made available to end-users. Therefore, a minimum requirement is outlined under this article and Member States can consequently impose more stringent provisions. The Court thus held that Article 25(2) Universal Service Directive 2002/22/EC does not preclude na
In 2005, Council Regulation 1290/05 created two agricultural funds, namely: the European Agricultural Guarantee Fund (EAGF) and the European Agricultural Fund for Rural Development (EAFRD). This Regulation required that the names of the beneficiaries of the funds, their place of establishment/residence, the postal code of this place and the annual amounts received by each of them were published on the Bundesanstalt’s website. The site was provided with a search tool. An agricultural undertaking, in the legal form of a partnership, and a full-time farmer applied to receive funds. Both of them asked the Wiesbaden Administrative Court to order the the competent local authority, Land Hessen (the controller), to refrain from, or to be prohibited from, transmitting or publishing those data for the purposes of the general publication of information on the financial amounts granted. The controller maintained that the obligation to publish arose from the legal text of Regulations n. 1290/2005 and n. 259/2008 (rules for the publication of information on the beneficiaries of the funds), but undertook not to publish amounts received by beneficiaries until a final decision was rendered. In turn, the Administrative Court believed that the obligation to publish constituted an unjustified interference with the fundamental right to the protection of personal data. It considered that this obligation did not improve the prevention of irregularities, since extensive control mechanisms for that purpose were already in place. In those circumstances, the Administrative Court referred to the CJEU for preliminary rulings on the validity os such provisions. The CJEU recalled that, since the right to data protection is not absolute, it can be limited when the requirements set out in Article 52(1) of the Charter are met. In the case at hand, it acknowledged that such interference with Articles 7 and 8 of the Charter was provided for by law and met an objective of general interest, namely,
The co-involved party filed a complaint before the Austrian DPA that the property manager publicly posted a letter from the Camber of Labor solely addressed to the co-involved party, thus violating the right to confidentiality according to §1 of the Austrian Data Protection Act (DSG). The co-involved party consulted with the Chamber of Labor regarding a circular resolution on renovating the facade of the property, expressing her concerns. The property manager was notified of the result of the consultation and received a letter specifically addressed to the co-involved party. Subsequently, the property manager displayed both the letter and the response publicly in the hallway. The letter included not only the questions of the co-involved party but also her name and address, that she was a member of the Chamber of Labor (Arbeiterkammer), and that she turned to them with her concerns. The property manager stated that she was legally obliged to do so, referencing §24 of the WEG (Law of Condominiums), and she was allowed to do that according to Article 6(1)(c) GDPR. However, the DPA stated that displaying the entire e-mail was disproportionate to fulfilling the property manager's obligations. The property manager (complainant) filed a complaint against the Austrian Data Protection Authority's decision at the Austrian Federal Administrative Court. She argued that the DPA was wrong in assuming that the data of the co-involved party was private, as the name and address of the co-involved party can be publicly accessed and identified in other ways (such as based on the name on the doorbell) and that the membership of the Chamber of Labor is mandatory, meaning it was not private information either. She also challenged the impossibility of legal justification as this act of data processing fell under the scope of legitimate interest. Furthermore, the DPA was also accused of not considering important evidence (letters) when ruling. The Court ruled that the complainant is ac
The European Commission alleged that the Federal State of Germany was in violation of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A31995L0046 Article 28(1) of Directive 95/46/EC] (this provision is now replaced by the GDPR, specifically Article 52 GDPR) for subjecting the supervisory authorities that monitored data processing carried out by public bodies to federal states’ scrutiny. Therefore, a distinction was made between data processed by public bodies and data processed by non-public bodies. The State of Germany allowed for the government of the respective federal states to influence and even cancel and replace decisions of the supervisory authorities. The second sentence of [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A31995L0046 Article 28(1) of the Directive] stated: "These authorities shall act with complete independence in exercising the functions entrusted to them". The Commission The Commission relied on a broad interpretation of the words “with complete independence” meaning that a supervisory authority must be free from any influence therefore including state scrutiny. Germany The State of Germany highlighted that in light of the principle of democracy, independence should be interpreted narrowly. The state of Germany put forward a narrower interpretation of the words “with complete independence” to mean that supervisory authorities must have function independence meaning that those authorities must be independent from bodies outside of the public sector which are under their supervision. Germany interpreted the state scrutiny as the the administration’s internal monitoring mechanism implemented by the authorities attached to the same administrative machinery which were also bound by the GDPR. Further, it claimed that certain principles of EC law and the principle of democracy opposed the interpretation of the Commission. The principles of EC law related to the retention of implemented national systems. The CJEU ana
Mr. Rijkeboer requested the Board of Aldermen of Rotterdam (“the College”) to notify him of all the personal data related to him that the local authority disclosed to third parties in the two years prior. It also asked to have access to the identity of these third parties and to the content of the data disclosed to them. In particular, he wanted to know who had access to his address. The College complied only partially with this request by notifying him only of the data processed within the last year from his request. This was done in compliance with [https://wetten.overheid.nl/BWBR0006723/2014-01-01 Article 103(1) Wet GBA]. Always according to [https://wetten.overheid.nl/BWBR0006723/2014-01-01 Article 110 Wet GBA], the data related to Mr. Rijkeboer dating prior to the ones disclosed to him were erased. The question referred to the CJEU was whether the restriction laid out in the Wet GBA on the communication of data to one year prior to the relevant request compatible with [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 12(a) Dir.95/46] whether or not read in conjunction with [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 6(1)(e) Dir.95/46] and the principle of proportionality?’ [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 6(1)(e) Dir.95/46] requires Member States to ensure that personal data is kept for no longer than necessary for the purpose for which the data were collected. [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31995L0046 Article 12(a) Dir.95/46] provides data subjects with the right to access their personal data and to information on the recipients of those data, without setting a time-limit. THE CJEU considered that Mr. Rijkeboer’s claims concerns two different categories of data: 1. Personal data kept by local authority on a person, such as name and address, which is “basic data”; 2. Information on recipients or categorie
LSG was a society acting as a trustee to enforce the rights of music producers and artists in respect of the exploitation of their work. After LSG clients suffered financial loss due copyright infringements (in particular the creation of file-sharing systems on which people exchanged copies of saved musics), LSG decided to file civil proceedings. In this context, it requested the Commercial Court of Vienna to order Tele2, an internet access provider who assigned IP addresses to its clients, to provide information about the holders of these IP addresses. The information included names and physical addresses. Tele2 argued that it was not an intermediary under Article 5(1)(a) and 8(3) of Directive 2001/29. The Commercial Court did not follow Tele2’s position. It considered Tele2 as an intermediary and ordered it to provide the requested information. Tele2 therefore filed an appeal with the Oberster Gerichtshof (Supreme Court), stating that as an Internet provider, it didn’t exercise control over the services the users use. The Supreme Court decided to refer two questions to the CJEU in order to obtain clarification regarding the interpretation of Articles 5(1)(a) and 8(3) of Directive 2001/29. (1) “Is the term “intermediary” in Article 5(1)(a) and Article 8(3) of Directive [2001/29] to be interpreted as including an access provider who merely provides a user with access to the network by allocating him a dynamic IP address but does not himself provide him with any services such as email, FTP or file sharing services and does not exercise any control, whether de iure or de facto, over the services which the user makes use of?” (2) “Is Article 8(3) of Directive [2004/48], regard being had to Article 6 and Article 15 of Directive [2002/58], to be interpreted (restrictively) as not permitting the disclosure of personal traffic data to private third parties for the purposes of civil proceedings for alleged infringements of exclusive rights protected by copyright (rights o
In 1996, the Austrian citizen Heinz Huber moved to Germany to become self-employed as an insurance agent. As a non-national of Germany his data was stored in the register of foreigners, including his name, date and place of birth, nationality, sex, marital and residential status, previous domiciles as well as an assigned reference number used by the public authorities in charge. Since such a register did not exist for German nationals, Mr. Huber felt discriminated by the processing of his data within and requested a deletion thereof. His erasure request was rejected by the Federal Office for Migration and Refugees, the public authority in charge of the register. Mr. Huber brought legal action before the administrative courts in Germany further challenged by the authority. Since there were serious doubts regarding whether such a different treatment of nationals and non-nationals can be justified, the Higher Administrative Court of Nordrhein-Westfalen referred several questions regarding the compatibility with the principle of necessity and the prohibition of discrimination to CJEU for a preliminary ruling. The European Court of Justice (CJEU) held that the use of a foreign register for the purpose of providing support to the authorities responsible for the right of residence is, in principle, legitimate and compatible with the prohibition of discrimination on grounds of nationality laid down by [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12012P/TXT&from=EN Article 12(1) ECFR]. It is necessary for Member States to have the relevant particulars and documents available in order to ascertain whether a right of residence in its territory exists for nationals of other Member States. However, this requires that the register contains only data necessary for these purposes and that its centralised nature enables corresponding legislation to be more effectively applied. Similarly, Union law does not exclude Member States from adopting measures enabling th
Reference for preliminary ruling was made by the Supreme Administrative Court in Helsinki (Korkein hallinto-oikeus). The reference related to the interpretation of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Satakunnan Markkinapörssi Oy collected for its own use tax data on individuals available from the tax authorities. Using those data, it published each year in the regional editions of the Veropörssi newspaper containing a list giving tax information of approximately 1.2 million natural persons. Satakunnan Markkinapörssi Oy transferred the published personal data on a CD-ROM to Satamedia Oy (owned by the same shareholders) which disseminated them by a text messaging system.. Following complainta from individuals, the Finnish DPA investigated the activity of Satakunnan Markkinapörssi Oy and Satamedia Oy, and requested the data protection board (Tietosuojalautakunta) to prohibit the latter from carrying on the processing activities. The board rejected the request. Eventually, the DPA brought an appeal before the Supreme Administrative Court, which referred the following questions for a preliminary ruling: (1) Whether collection, publication, transfer of a CD ROM and text messages constitutes processing of personal data; (2) Whether it is processing for solely journalistic purposes within the meaning of Article 9 of Directive 95/46; (3) Whether Article 17 and principles of Directive 95/46 preclude publication of data collected for journalistic purposes and their onward transfer for commercial purposes; (4) Whether personal data that have already been published in the media fall outside scope of Directive 95/46. Definition of personal data Definition of processing Scope of Directive 95/46 Processing for solely journalistic purposes 1. Article 3(1) of Directive 95/46/EC is to be interpreted as meaning t