GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 16 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 16 October 2026 · Updated daily
1,507 results · Showing 1,501–1,507
Reference for a preliminary ruling by the Juzgado de lo Mercantil No. 5 de Madrid. Telefonica had refused to disclose to Promusicae, an NPO acting on behalf of its members who are holders of intellectual property rights, personal data relating to users of the internet who accessed the KaZaA file exchange program and shared files of recordings of Promusicae's members, by means of connections provided by Telefonica. Promusicae wanted to bring civil actions against those persons. Question referred: Whether EU law permits Member States to limit the duty of operators of telecom networks to supply traffic data. Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’), Directive 2001/29/EC of the European Parliament and of the Council of 22 May 2001 on the harmonisation of certain aspects of copyright and related rights in the information society, Directive 2004/48/EC of the European Parliament and of the Council of 29 April 2004 on the enforcement of intellectual property rights, and Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) do not require the Member States to lay down, in a situation such as that in the main proceedings, an obligation to communicate personal data in order to ensure effective protection of copyright in the context of civil proceedings. However, Community law requires that, when transposing those directives, the Member States take care to rely on an interpretation of them which allows a fair balance to be struck between the various fundamental rights protected by the Community legal order. Further, when implementing the measures transposing those directives, the authorities an
On 11th June 2002 the Commission of the European Communities found that the Bank Austria Creditanstalt AG (hereafter "Bank Austria") had taken part, from January 1995 to June 1998, in a cartel with several other Austrian banks, for which the Commission decided to impose a fine on it and the other banks concerned by the procedure. Afterwards, the Commission sent Bank Austria a draft non-confidential version of the decision imposing fines and asked for its permission to publish it. In response, Bank Austria asked the Commission to publish the decision imposing fines without the account of the facts relating to the year 1994 contained in Section 7 and to replace Sections 8 to 12 with a section of text proposed by itself. Despite discussions between the relevant services of the Commission and lawyers of all the banks concerned, they could not find an agreement on the version to be published in the light of the objections made by Bank Austria. Then, the competent director of the Commission’s Directorate-General for Competition, repeated the Commission’s view on the publication of the decision imposing fines and enclosed a revised non-confidential version of the decision. Therefore, Bank Austria asked the Hearing Officer to grant its request. The Hearing Officer provided Bank Austria with a new non-confidential version of the decision imposing fines, but Bank Austria still objected to the publication of that non-confidential version after. The Hearing Officer produced a revised non-confidential version of the decision and decided to reject Bank Austria’s objection to its publication. According to the Hearing Officer, the decision did not contain information to which confidential treatment is guaranteed by Community law. Consequently, Bank Austria lodged an application at the Registry of the Court of First Instance on 6th June 2003, in which Bank Austria claimed that the Court of Justice of the European Communities (CJEC) should annul the decision of the Hearing Off
The case is about Mrs. Lindqvist who worked as a catechist in the Alseda Parish (Sweden). At the end of 1998, she set up internet pages on her personal computer in order to allow parishioners preparing for their confirmation to obtain any information they needed. She requested the administrator of the Swedish Church’s website to set up a link between those pages and the website. The pages she had set up contained information about Mrs. Lindqvist and 18 of her colleagues in the parish. The pages contained information including their full names, first names, jobs held, hobbies, telephone numbers and medical information on one of her colleagues. She had not informed her colleagues of those pages, obtain their consent or sought approval from the supervisory authority to process the personal data and sensitive personal data. The public prosecutor brought a proceeding against her, that she was in breach of the PUL on grounds that she processed personal data automatically without giving prior written notice to the Supervisory Authority (Datainspektionen). In addition, she processed sensitive personal data and transferred personal data to a third country without authorization or consent from the data subjects. The Royal Court (Göta hovrätt) stayed the national proceedings and referred some question of law to the CJEU. The questions brought before the CJEU were: # Whether a self-made list, with personal data of others, published on the internet constitute processing of personal data wholly or partly by automatic means as defined under Article 3(1) Directive 95/46. # Whether the act of setting up internet home pages for 15 people with links between the pages which make it possible to search the pages using the first name be considered processing of personal data which forms part of a filing system within the meaning under Article 3(1) Directive 95/46? # Whether the processing of personal data is covered under the exception to processing under a household activity under Arti
Some Austrian public authorities and undertakings refused to provide a State control body with access to personal data concerning salaries and incomes of their employees. In doing so, they violated Austrian law. The Austrian Constitutional Court, however, suspected that such a national law may have been in violation of Directive 95/46/EC. In particular, the provision on which disclosure of employees’ data was based seemed in conflict with Articles 6(1)(b) and (c), namely purpose limitation and data minimization. In the opinion of the Austrian Constitutional Court, legal bases under Articles 7(c) and (e) of the Directive – i.e. legal obligation and public interest – should be read in light of Article 8 of the European Convention on Human Rights (ECHR), which protects privacy and family life. Therefore, the Austrian Constitutional Court referred the matter to the Court of Justice. The CJEU had to answer the question whether Directive 95/46/EC precluded the adoption of national law authorizing a State control body to collect and communicate, for the purpose of publication, data on the income of people employed by public bodies. The CJEU stated that processing of personal data should take place only in compliance with data protection principles and on grounds of a valid legal basis. Moreover, being privacy a fundamental right protected by the ECHR, interference with it should respect Article 8 of the Convention. To ascertain whether processing was compliant with the Convention, the CJEU performed a four-steps test commonly used by the European Court of Human Rights. It ascertained: # the existence of an interference with privacy in the facts at issue; # that interference was in accordance with Austrian law; # that the measure had a legitimate aim, namely to put pressure on public bodies so that they kept employees’ salaries within reasonable limits and did not burden State’s finances; # that proportionality was respected. In principle, taxpayers in a democratic soci
On the 7th December 2000, the European Commission brought an action before the Court of Justice seeking a declaration that Luxembourg had failed to implement Directive 95/46/EC (the Data Protection Directive, herein “the Directive”), and in doing so, had violated Article 32 of the Directive. Article 32(1) of the Directive required Member States to implement any local laws, regulations and administrative necessary to transpose the Directive within three years following the adoption of the Directive, and to notify the Commission of same. On 26th August 1999, the Commission issued a reasoned opinion to Luxembourg requesting that they adopt the measures necessary to transpose the Directive within two months. Luxembourg responded at the end of the stated period, stating that a preliminary draft law had been prepared for submission to the legislature and that the delay was attributable to the change in government which had occurred in that year. The Court referred to Luxembourg’s explanation for the delay, and referenced the previous decision in C-4707/98 Commission v Greece [2000]. In the Greece decision, the Court found that provisions, practices and circumstances existing in the domestic legal system of a Member State may not be successfully relied up to justify a failure to comply with obligations laid down in a Directive. The Court applied the dicta in Greece and accordingly found that Luxembourg had failed to fulfil their obligations under Article 32 of the Directive.
The applicant (Deely) sought to invoke the Freedom of Information Act 1997 (the 1997 Act) in order to understand why a prosecution order for a road traffic offence was brought against him. His request was rejected by the Information Commissioner and he sought to appeal this decision at the Irish High Court, pursuant to section 42 of the 1997 Act. Did the High Court have the remit to address the decisions made by the Information Commissioner? What is the standard of review in appeal of a point of law from a decision of the Commissioner? Mc Kechnie J held the following (at p452 of the judgment): "[A] court is confined in its remit on appeals on a point of law as follows: (a) It cannot set aside findings of primary fact unless there is no evidence to support such findings; (b) It ought not to set aside inferences drawn from such facts unless such inferences were ones which no reasonable decision-making body should draw. (c) It can however reverse such inferences if the same were based on interpretation of documents and should do so if incorrect; (d) If the conclusion reached by such bodies shows that they have taken an erroneous view of the law, then that also is a ground for setting aside the resulting decision."
The data subject participated in an integration course and was excluded from the course for disciplinary reasons. As a reaction, he addressed a letter to the organisation responsible for the integration course. In this letter, he asked the organisation to inform him about the reasons that lead to his exclusion from the course. In the letters, he did not refer to the GDPR, data protection or the processing of data. He repeated his request in four subsequent letters. The organisation rejected his request. The data subject lodged a complaint with the DPA, claiming a violation of Article 15 GDPR. The DPA rejected his complaint on the grounds that his request to the organisation could not be understood as an access request provided for by Article 15 GDPR. The data subject appealed the decision to the Federal Administrative Court (Bundesverwaltungsgericht). The court upheld the decision of the DPA. A request to access to their personal data by the data subject is a prerequisite for a possible violation of a data subject’s access right. Article 15 GDPR does not request the data subject to state any reasons for their access request or follow a specific format. However, it can be concluded from Recital 63, that under certain circumstances, the data subject can be expected to make their request precise, e.g. what personal data the data subject requests access to. In general, the request is to be interpreted objectively from a third-person-perspective, considering all circumstances. In the light of the aforementioned, the court decided that the letter the data subject sent to the organisation must objectively not be understood as an access request. It did not refer to the GDPR, data protection or the processing of personal data at all and merely expressed a request to the reason for his exclusion from the course, which is an information request. An information request is a different instrument that is separate from an access request pursuant to Article 15 GDPR. The first