GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
The data subject had lodged a complaint against a former employer for GDPR violations. While the DPA found an infringement and issued a reprimand against the employer, it rejected the complaint insofar as the data subject sought further corrective measures. The Data Protection Board of Appeal subsequently held that the data subject lacked a legal interest in appealing the DPA’s decision, arguing that the right to an effective remedy under Article 78 GDPR primarily protects persons on whom the decision has direct legal effects, and that national procedural law may limit who has standing to seek judicial review. The Ombudsman disagreed and challenged this restrictive interpretation, relying on CJEU case law, including Schufa cases and Land Hessen. The Ombudsman argued that Article 78(1) GDPR grants both data subjects and controllers the right to an effective remedy against supervisory authority decisions, including review of the authority’s choice of corrective measures under Article 58(2) GDPR. The Ombudsman also referred to [https://www.privacy-regulation.eu/en/recital-141-GDPR.htm Recital 141 GDPR] and [https://fra.europa.eu/en/eu-charter/article/47-right-effective-remedy-and-fair-trial Article 47 of the EU Charter], emphasizing the need for full judicial review where a supervisory authority fails to intervene adequately to protect a data subject’s rights. Restricting data subjects to cases of ongoing violations, risks undermining uniform enforcement of the GDPR and lowering the level of data protection. The data subject must have the right to an effective judicial remedy under Article 78(1) GDPR against all aspects of a supervisory authority’s decision, including the selection and adequacy of corrective measures. This right is not limited to situations where the decision has binding legal effects on the data subject, nor may it be excluded by national procedural rules.
The data subject brought multiple claims against a credit information agency, arguing that its automated generation of various score values was unlawful under the GDPR. He sought declaratory relief, injunctive relief against exclusively automated scoring, disclosure of non-automated scores, damages, expanded access rights, and restrictions on the factors used in future scoring. The court of first instance dismissed the claims. The data subject appealed, relying in particular on Article 22 GDPR and arguing that negative scores could affect third-party decisions such as the conclusion of a rental agreement. The court has not yet published a final decision, but it has shared a notice of intention. The court intends to dismiss the appeal as unfounded. It agreed with the lower court that Article 22(1) GDPR was not applicable, because the automated generation of a score value, by itself, does not constitute a decision producing legal or similarly significant effects on the data subject. The court emphasised that Article 22 GDPR requires that the automated processing itself directly determines the outcome for the data subject, without independent decision-making by a third party. Where third parties, such as landlords or banks, merely take a score into account alongside other factors, the necessary causal link is missing. Referring to the CJEU’s judgment in C-634/21 (SCHUFA), the court stressed that Article 22 GDPR applies only where the automated result plays a decisive role in the final decision, which must be assessed on a case-by-case basis. Because the data subject failed to show that any automated score had directly caused a concrete adverse decision, all related claims, including injunctive relief, damages under Article 82 GDPR, and expanded access rights, were dismissed. It must be pointed out that this judgement is not binding yet.
The DPA carried out an ex officio inspection of the Rajec’s City Council, the controller, concerning its processing of personal data through a CCTV system. On 27 August 2019, the DPA issued a first-instance decision imposing a €10,000 fine and corrective measures. Following an appeal by the controller, the DPA issued a second-instance decision on 29 November 2019. It partially amended the first-instance decision and reduced the fine to €9,000. The DPA found that the controller had violated the principle of transparency under Article 5(1)(a) GDPR by failing to specify the legal basis for CCTV processing in its records of processing activities and by failing to provide information to data subjects before they entered the monitored area. The DPA also found a violation of the storage limitation principle under Article 5(1)(e) GDPR. According to the DPA, the controller retained CCTV footage for longer than necessary. Although the controller had set a seven-day retention period, the inspection found one recording that had been retained for around 20 days. The controller challenged the DPA’s decision before the administrative court. It argued, among other things, that its records of processing activities referred to relevant national laws and that the GDPR did not require a precise citation of Article 6 GDPR in such records. It also argued that, at the time of the inspection, there were no binding rules on how CCTV information notices had to be provided, and that the single over-retained recording was a one-off human error without consequences for data subjects. During the court proceedings, the Administrative Court of Bratislava examined whether the operative part of the DPA’s decision met the requirements applicable to administrative penalties. The court focused on whether the alleged infringements were described with sufficient precision in terms of the act, time, place and manner of commission. The court annulled the DPA’s decision and remanded the case. The court he
The DPA conducted an investigation on a controller’s premises and issued a fine of €10,000 and an order to take corrective measures. The controller contested the decision and the DPA lowered the fine to €9,000 and amended some of the factual findings. In its second decision, the DPA held that the controller violated the principle of transparency in Article 5(1)(a) GDPR by failing to inform data subjects about the existence of video surveillance at the point of entry in the monitored area and by failing to specify in the record of processing activities the legal basis for such personal data processing. The controller argued that the record of processing activities contained the legal basis for the processing of personal data (a national law provision), and claimed that the requirement to include a mention of Article 6 GDPR was overly formalist. Moreover, the controller argued that the pictograms placed at the entrance to the monitored area along with a notice of information on its website were meant to inform data subjects of the video surveillance carried out there. The DPA also found a violation of the principle of data minimisation in Article 5(1)(e) GDPR due to the longer than necessary data retention times. The controller claimed that the retention period was generally 7 days and only one recording was kept for longer due to an error. Finally, the DPA held that there was no violation in relation to the processing of employee data of the principle of legality in Article 5(1)(a) GDPR with reference to accountability in Article 5(2) GDPR, since the controller submitted at the time of the inspection a proportionality test in regard to the processing of employees’ personal data. The DPA ordered the controller to take measures to inform data subjects about the processing of their personal data in accordance with Article 13 GDPR. The controller contested the second DPA decision in court. The court annulled the DPA’s second decision and remanded the case to t
A data subject filed a lawsuit against Propuls d.o.o., the controller and publisher of the news portal direktno.hr, claiming that two articles published on 11 January 2023 and 31 January 2023 disclosed her personal data without her consent: The first article reported on payments related to the football club Dinamo Zagreb and included the data subject’s full name, bank account number, and payment amounts. The second article referred to the first article via a hyperlink but did not mention the data subject directly. The data subject argued that the disclosure violated her right to privacy and the protection of personal and family life under Croatian law and the GDPR. She claimed non-material damage and sought compensation as well as publication of the court decision in the controller's news portal. The controller admitted publishing the articles but argued that the information was accurate and that publishing the data served the public interest. The controller also stated that it had issued a correction upon the data subject request and argued that journalistic activity may be exempt from certain obligations under GDPR and it's exempt from liability if the facts concerned are true according to the Croatian Media Law. The evidence included the published articles, the correction request, witness testimony from journalists and the data subject, and financial records. The court held that the controller violated the data subject’s right to privacy and the protection of personal and family life. It reasoned that publishing her full name, bank account number, and payment amounts was disproportionate because the details were not necessary to inform the public about the football club payments. Following the ECHR jurisprudence, the court applied a proportionality test, balancing the controller’s freedom of expression against data subject's privacy rights under the Croatian Constitution and civil law. The court emphasised that the data subject was not a public figure, had no
The data subject filed an access request to the National Coordinator for Counterterrorism and Security (NCTV). The Ministry of Justice is the controller for the NCTV. The Ministry of Justice decided to grant access, but partly. What the data subject received, was an overview of their personal data, including the aim for which data was processed, the source and with whom it was shared. After their first appeal to the decision, the Ministry decided to grant more access and explained more context of the processed data. The data subject also received some copies of documents that were partly redacted. The data subject then appealed that decision to the court, because they believed more detail should be given about why their data were processed and shared with other parties. The data subject found the legal grounds mentioned in the overview to be too vague as they referred solely to the law, or the tasks of NCTV exercising its official authority. Furthermore, the data subject requested information, such as empolyee names, titles or departments of the organisations their data was shared with and why data was shared internationally. They also disputed the accuracy of the overview, because emails containing their personal information had a lot of redacted parts. This meant they were unable to review if their personal information was shared. The court rejected the appeal and found that the information received by the data subject was sufficient. The data subject's first complaint was that the information given to them was insufficient. The court held that Article 15 GDPR does not require the Ministry to provide more specific detail on why the data subject's data were processed. It is clear from case law that Article 15 GDPR does not require an organisation to provide full copies of all documents containing the data subject's data. It does require organisations to provide sufficient information to fulfil the goal of the right of access, i.e. to make it possible for the
On 20 November 2023, the data subject (a business owner) submitted an access request under Article 15(1) GDPR limited to the controller's legal department (a municipal authority), requesting a full written response and copies in accordance with Article 15(3) GDPR. On 12 December 2023, the controller asked the data subject to specify a reference date in order to process the request. On 18 December 2023, the data subject replied that no specific date was required and that the relevant date for the time limit to respond to such requests was the date of receipt. By letter dated 3 January 2024, the controller informed the data subject that the legal department did not store or process any personal data relating to them. Following that, the data subject alleged that the controller had not responded within the time limit set out in Article 12(3) GDPR. They argued that the one-month deadline expired on 22 December 2023 and that the request for a reference date did not suspend or extend the deadline. The controller argued that the request was excessive and made in bad faith. It submitted that the data subject had repeatedly exercised access rights between 2020 and 2024 in order to pursue unrelated damages claims. It also argued that the one-month period started only after the data subject responded to the request for a reference date. The court first held that a controller must provide information on measures taken under Articles 15 to 22 GDPR without undue delay and in any event within one month of receipt of the request. The period may only be extended by two further months where justified by the complexity or number of requests, and the controller must inform the data subject of the extension and the reasons within the initial one-month period. The court explained that the triggering event for the time limit was the receipt of the request on 22 November 2023, as the Article 12 GDPR and Article 15 GDPR did not require a data subject to specify a reference date for an acc
A politician, the operator of a website (the controller), appealed a DPA decision sanctioning him for the placement of optional cookies onto users’ devices when visiting his website, as well as for failing to inform data subjects of the processing of their personal data via the contact form available on the website. The DPA sanctioned the controller a total of RON 50,286.80 (approximately €10,000) for breaching Article 4(5)(a) & (b) Romanian Law no. 506/2004 transposing e-Privacy Directive 2002/58 and Article 12 GDPR, Article 13 GDPR and Article 14 GDPR. The controller claimed in its appeal that, among other things, the DPA failed to include in its decision the complete mandatory information prescribed by administrative law, that the cookies placed on the users’ devices were necessary, and that data subjects were informed of the processing activities on the website. Therefore, the controller requested the annulment of the DPA decision. The court dismissed the controller’s appeal. It found that the website links directing to the privacy policy and information notice were not functional, but that they became functional following communications from the DPA to the controller. Furthermore, the court noted that website users did not have a clear and visible way of providing consent to the use of cookies on the website. Moreover, the court found that the DPA decision contained most of the necessary information required by law. The court noted that the missing information referred only to the objections of the controller. However, the court emphasised that such an omission did not require the annulment of the DPA decision, since the controller was able to raise his objections during the appeal. Finally, the court emphasised the electoral context in which the violations occurred, pointing out that the increased danger for the unlawful processing of the personal data collected via the website at that time. Therefore, the court dismissed the controller’s appeal an
In 2008, a district court issued a payment order against the data subject for an unpaid lawyer’s fee. The payment order became final and enforceable in June 2008, but the data subject never paid the debt. After the judgement, the data subject changed her surname, moved to Germany and did not inform the lawyer (the controller) about these changes. The controller attempted to recover the unpaid legal fee from the data subject. He discovered the data subject’s new address and contacted her, requesting the outstanding payment. The data subject asked the controller where it got her address from, arguing that failing to provide this information would violate Article 14 GDPR. The controller responded that he had obtained the address in the course of his professional activity and could not disclose details due to his duty of professional secrecy. On the same day, the data subject filed a complaint with the Austrian Data Protection Authority (DSB). She alleged violations of Article 14(2)(f) GDPR, the principles of processing under Article 5(1)(b) GDPR, the lawfulness requirement under Article 6 GDPR, and her right to erasure under Article 17 GDPR. The data subject claimed she would not pay until these procedures were concluded. The DSB refused to deal with the complaint under Article 57(4) GDPR as it considered the complaint unfounded and abusive because it served only to delay or obstruct the enforcement of the debt. The data subject appealed this decision to the court. First, the court confirmed that supervisory authorities may refuse to act on complaints that are manifestly unfounded or abusive under Article 57(4) GDPR. It referred to the case law of the CJEU that clarifies that the concept of an “application” in Article 57(4) GDPR also covers complaints under Article 77 GDPR. Second, the court assessed whether the complaint pursued a legitimate data protection objective. It found that the data subject used the complaint primarily to delay or prevent the enforcement of
The data subject had initially requested that a electricity network operator (the controller) delete his email address from its systems. In March 2022, the controller confirmed that the deletion had been carried out. Nevertheless, in January 2024 the controller again contacted the data subject via the same email address to send a notification regarding a reading of the electricity meter. The data subject subsequently filed a complaint with the Austrian Data Protection Authority (DSB), arguing that the controller continued to process his personal data despite assuring him that it had been deleted. After the DSB failed to issue a decision within the six-month deadline, the data subject brought an inactivity complaint before the Federal Administrative Court on 23 February 2025, requesting that the court decide the case itself. During the proceedings, the controller initially argued that the email might have been collected again elsewhere due to human error. However, after a further internal review, the controller acknowledged that the email address had in fact not been deleted in 2022 as previously stated and had remained stored in its system until April 2024, when it was finally deleted. The court partially upheld the complaint. Because the controller retained the email address and used it to send a notification to the data subject, the court found that the processing lacked any valid legal basis under Article 6(1) GDPR. As a result, the court concluded that the processing was unlawful and therefore violated the principle of lawfulness under Article 5(1)(a) GDPR. The continued retention and use of the email address after a deletion request also contravened the principles of purpose limitation and data minimisation under Article 5(1)(b) and (c) GDPR, since the data were used again despite the data subject’s request that they no longer be stored. Furthermore, the controller breached the accountability principle under Article 5(2) GDPR by initially claiming that the da
A data subject hired an association whose business model is to automatically search for possible data protection violations and filing complaints or lawsuits on behalf of data subjects with the financial aid of litigation funders. The agreement between the data subject and the association foresees that the data subject receives 70% of possible profits coming from a favourable judicial or administrative decision and 30% of the profits go to the litigation funders. In the agreement, the association claims their offer would generate profit without any risk for their customers. The association made an access request and filed a complaint via a lawyer on behalf of the data subject. The telecommunication provider charged the data subject with a service fee the parties have not agreed upon. The access request concerned invoices of a telecommunication provider that the data subject was in a contractual relationship with and the service fee was indicated on the invoices. On the initiative of the association, not the data subject, the association made an access request, claiming the service fee let the data subject to believe that the telecommunication provider might possess documents concerning the data subject without their knowledge and might process their personal data unlawfully. The data subject already had access to the invoices through the telecommunication provider’s online portal for customers. The data subject did not, or did not remember, to explicitly mandate the association to lodge the access request. The lawyer hired by the association filed a complaint on behalf of the data subject because of a possible violation of Article 15 GDPR. The grounds of the violation were illustrated only rudimentary in the complaint. The association filed a total of more than 900 complaints with the DPA that follow the same pattern, with 142 of those complaints being filed against the telecommunication provider because of GDPR violations in the context of charging a servic
On 16 March 2023, the data subject (a private individual living in Vienna) subscribed to the ‘newsletter’ on the website of the controller (a family run optician company established in North Rhine-Westphalia) by entering his personal data in the registration form, confirming his consent to data processing by ticking a box and submitting the form. On 29 March 2023, the data subject sent by fax an information request pursuant to Article 15 GDPR. The controller acknowledged receipt of the request and stated that it would respond to it within the one-month period. However, by letter of 26 April 2023, the controller refused to provide the information since it classified the information request as an abuse of right for the purposes of the second sentence of Article 12(5)(b) GDPR. The controller sought a declaration from the referring court that the data subject is not entitled to compensation in the amount of €1000. The court decided to refer the following questions set out in point I. to the CJEU for a preliminary ruling pursuant to Article 267 TFEU: # Is the second sentence of Article 12(5) GDPR to be interpreted as meaning there cannot be an excessive information request from the data subject when the first request is made to the controller? # Is the second sentence of Article 12(5) GDPR to be interpreted as meaning that the controller can refuse an information request from the data subject if the data subject intends to use the information request to provoke claims for damages against the controller? # Is the second sentence of Article 12(5) GDPR to be interpreted as meaning that grounds for refusing to provide information can be provided by publicly available information about the data subject which suggests that the data subject is asserting claims for damages against the controller in a large number of cases of infringement of the law relating to the protection of personal data? # Is Article 4(2) GDPR to be interpreted as meaning that an information request from a
A court began investigating an airline company (the controller) for their potential consumer, competition and data protection violations following a dispute between two companies. The controller implemented a pre-selected consent box on their website when searching for flights. While the box was initially not pre-ticked, the website automatically ticked the box if a data subject did not do so. This meant that data subjects automatically consented to the website’s terms of use by clicking the “search” button. Furthermore, the controller required data subjects to create an account when booking flights, and filled out some of the information automatically when creating an account. This was also the case if a data subject wished to only look at flights without booking. The opposing company argued that data subjects were not allowed to give meaningful consent, as the option cannot be de-selected. In addition, the controller processed data subjects’ data without a legal basis by requiring them to create an account and by automatically filling in information. The data subject argued that the controller processed data beyond what is necessary for a flight booking or search, in violation of the principle of data minimisation (Article 5(1)(c) GDPR). The controller also violated Article 7(4) GDPR by making the provision of its services conditional to the data subject’s consent. The controller argued that data subjects could easily access the website’s terms and conditions, and that the automatic ticking of the box did not force data subjects to consent. Furthermore, the controller processed only the necessary data when creating data subjects’ accounts. The court found that the controller violated the GDPR and consumer laws through its pre-ticked boxes. The court highlighted that the website misled data subjects into thinking they have a choice, when in reality the website ticked the box automatically. The court dismissed the controller’s argument that the message next to
An individual working as a judge (the data subject) sued Microsoft Ireland Operations Limited and its Romanian establishments (the controllers) and requested in court the removal or blocking from the search engine Bing (the search engine) of all links and URL addresses containing content relating to him from the web page www.luju.ro in accordance with Article 17 GDPR, Article 18 GDPR, Article 21 GDPR and Article 22 GDPR. The data subject alleged that the content was defamatory. Furthermore, the data subject requested an interdiction for the search engine to publish or transmit any content from the above-mentioned web page relating to the data subject and the awarding of RON 199,000 (approximately €39,000) in immaterial damages. In addition, the data subject asked for the logic behind the search engine algorithm to be communicated to him, specifically related to the content from the website luju.ro involving the data subject and how it is prioritised in the search results. Moreover, the data subject requested the communication of the records of processing activities in relation to him carried out by the controllers under Article 30 GDPR, along with the evaluation of the impact on his rights in accordance with Article 35 GDPR. Previously, the data subject obtained in court an order for the elimination and blocking from the search engine Google of all links leading to published articles on him on the website luju.ro. The removal of links from the search engine The court referred to a previous judgement which held that several articles published on the website luju.ro about the data subject have an impact on his honour and dignity. Subsequently, the court declared that the articles identified by the data subject in the present lawsuit have a defamatory character, affecting in particular his professional reputation as a judge. However, the court held that the reference to the data subject’s profession does not exclude a violation of his private life protected un
The controller is an insurance company offering voluntary personal insurance. In the context of processing insurance applications, the controller requested and processed health data obtained from healthcare providers in order to assess insurability and determine potential liability. The Data Protection Ombudsman investigated the controller’s practices and concluded that the processing of health data at the application stage violated Article 9 GDPR. According to the Ombudsman, the national exception under Section 6(1)(1) of the Finnish Data Protection Act, which allows insurance companies to process health data, could only apply once an insurance contract had been concluded. On that basis, the Ombudsman ordered the controller to bring its processing into compliance with Article 9 GDPR. The Helsinki Administrative Court upheld the Ombudsman’s decision, finding that the concept of “insured person” under national law did not extend to insurance applicants prior to the conclusion of a contract. The controller appealed to the Supreme Administrative Court. The court overturned the decisions of both the Administrative Court and the Data Protection Ombudsman. The Court held that the concept of “insured person” in Section 6(1)(1) of the Finnish Data Protection Act must be interpreted to include the person who is the object of voluntary personal insurance, irrespective of whether the insurance contract has already been concluded or is still being applied for. This interpretation was supported by the structure and purpose of national insurance law, which requires the assessment of risk and liability already at the application stage. The Court found that processing health data during the insurance application phase is an inherent and necessary part of insurance activity and falls within the national exception permitted under Article 9(2)(g) GDPR. Interpreting the exception more narrowly would exclude a core element of insurance practice without support in the legislative histo
The DPA started an ex-officio investigation into the practices of an insurance company regarding the processing of health data in connection with applications for voluntary personal insurance. During the insurance application process, the controller requested health information from healthcare providers concerning individuals applying for insurance, or individuals for whose death, illness, or injury insurance was being sought. The processing was based on Section 6(1)(1) of the Finnish Data Protection Act, which provides a national derogation from the prohibition on processing special categories of personal data for insurance activities. In a decision issued on 8 June 2022, the DPA found that this derogation did not apply at the application stage, as applicants could not be considered “insured persons” within the meaning of Section 6(1)(1). On that basis, the DPA concluded that the processing of health data violated Article 9 GDPR and ordered the controller to bring its processing operations into compliance and to cease requesting health data during the application phase. The insurance company appealed. The first instance Court upheld the DPA’s substantive assessment, reasoning that neither the wording of the Data Protection Act nor its preparatory materials supported extending the concept of “insured person” to applicants prior to the conclusion of an insurance contract. The controller then appealed this decision, arguing that the insurance derogation must also cover the application stage, given the structure and purpose of insurance law and the obligation of insured persons to disclose relevant health information before insurance is provided. The court upheld the appeal, overturning both the DPA and the first instance court’s decisions. The Court held that the concept of “insured person” in Section 6(1)(1) of the Data Protection Act must be interpreted in light of national insurance legislation, in particular the Insurance Contracts Act. Although the Data Protect
In 2020 two TV programmes investigated and covered allegations of corruption against an Italian politician (the data subject). In this context, the programmes published private emails from the data subject. Both programmes aired on the Italian public broadcast RAI (the controller). The data subject filed a complaint in November 2020. In 2021 the DPA notified the parties that the preliminary investigation was closed. In 2023 the DPA held that the data were unlawfully processed and forbade their further processing. The procedure took almost three years in total. The controller challenged the decision in court on grounds that the DPA decided the complaint past the legal deadline. The court agreed with the controller and anulled the decision. In turn, the data subject challenged the ruling before the Supreme Court. In the Supreme Court, the parties put forward different interpretations of the law. The controller pointed to the DPA’s internal regulation, according to which the DPA shall adopt and notify sanctions within 120 days after the end of the investigation. The controller argued that this deadline was peremptory in nature and that the belated decision was, therefore, invalid. On the other hand, the data subject claimed that the term was merely indicative in nature and that its decision was therefore valid. The Supreme court upheld the first instance ruling. The court held that allowing the DPA to issue a sanction long after the violations took place, would undermine legal certainty as well as the controller’s right of defenceIn this regard, the court leveraged the case law of the Italian Constitutional court: see [https://www.cortecostituzionale.it/scheda-pronuncia/2021/151 Corte Cost. 151/2021].. On these grounds, the court concluded that the deadline was peremptory in nature and that the lower court had rightfully annulled the DPA’s decision.
In 2023 the French DPA (CNIL) found that, among other things, Amazon France Logistique (the controller) processed three indicators related to the work performance of their employees without a legal basis. The DPA took this finding into consideration when deciding on the fine issued to the controller, i.e. €32 million. The controller contested the decision. The Supreme Administrative Court found that the three indicators (i.e. the stow machine gun indicator, the idle time indicator, and the latency time indicator) were processed lawfully under Article 6(1)(f) GDPR (i.e. legitimate interest). The Court noted that the purpose of the indicators was the management of stock and order (stock machine gun indicator) and to flag interruptions in activity that cannot be detected by the other indicators used in order to identify their causes (idle time indicator and latency time indicator). The Court also noted that the right to private life of the employees was not excessively infringed upon by the processing of these indicators. In contrast, the Court maintained the DPA’s decision regarding the controller's violation of Article 5 GDPR, specifically the principle of data minimisation and accountability, by collecting a disproportionate amount of data and storing them for 31 days without showing the need for such processing. Therefore, the Court found that the controller processed the indicators based on a legitimate interest under Article 6(1)(f) GDPR and reduced the initial fine from €32 million to €15 million.
AB Storstockholms Lokaltrafik (the controller), the operator of public transport in Stockholm, equipped its ticket inspectors with body-worn cameras that continuously recorded video and audio during inspections. The cameras had a short circular memory, automatically overwriting footage unless inspectors saved it when issuing fines or facing threats. The stated purposes of the cameras were to prevent and document violence against inspectors and to verify the identity of fined passengers. Following a supervisory investigation, the Swedish Data Protection Authority found that the controller had infringed several provisions of the GDPR, including the obligation to provide information to data subjects. The Authority imposed an administrative fine in total SEK 16,000,000 (€1,420,670) of which SEK 4,000,000 (€355,188) was for failure to provide information to the data subjects. The controller challenged the Swedish DPA’s decision before the Administrative court of first instance (Förvaltningsrätten i Stockholm), which upheld the fine. The controller then appealed to the Administrative Court of Appeal (Kammarrätten i Stockholm), which annulled the fine, holding that Article 13 GDPR was not applicable. The Swedish DPA subsequently appealed to the Supreme Administrative Court of Sweden (Högsta förvaltningsdomstolen). The referring court identified the key issue as whether Article 13 GDPR or Article 14 GDPR applies to personal data collected by body-worn cameras. Resolving this question was necessary to determine the content, timing, and possible exceptions of the information obligation and to assess whether the Authority was entitled to impose an administrative fine for non-compliance with Article 13 GDPR. The court also noted uncertainty regarding the legal weight of the [https://www.edpb.europa.eu/about-edpb/who-we-are/legacy-art-29-working-party_en Article 29 Working Party’s Guidelines] on transparency, which provide that Article 13 GDPR applies to video surveillance. In
A professional notaries’ association (the controller) hired an accounting inspector (the data subject) in 2024. A year later, the controller dismissed the data subject for reasons related to his performance at work. Following his dismissal, the data subject requested the disclosure of his personal data including his work emails and other files. A month later, he filed an application with the Paris Labour Court seeking an order requiring the controller to provide him with the documents. The Paris Labour Court found that there were no grounds for the request. The data subject appealed the decision and argued in favour of obtaining access to his personal data in accordance with Article 15 GDPR. The data subject further claimed that the requested documents would enable him to respond to the decision of his dismissal. The Paris Court of Appeal held that the purpose of Article 15 GDPR is not to obtain copies of professional email correspondence of an employee in the course of his work, of which he is aware and which contains only his identity. Instead, the court noted that the purpose of the article is to enable the data subject to check that processing complies with the law, to check the accuracy of the data and, if needed, to ask for the rectification or erasure of the data. Furthermore, the Court noted that the controller sent the data subject a copy of his entire personnel file. Moreover, analysing the request from the perspective of Article 145 of the Code of Civil Procedure, it concluded that the requested documents would not serve the data subject in appealing his dismissal. Therefore, the Court rejected the data subject’s appeal.