GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Agentsia po vpisvaniyata
The data subject is a shareholder of a company in Bulgaria. On 14 January 2021, the company’s constitutive instrument was sent to the Registration Agency (Agentsia po vpisvaniyata), the Bulgarian authority managing the commercial register (the controller in the case at hand). This instrument, which includes the surname, first name, identification number, identity card number, date and place of issue of that card, as well as the data subject’s address and signature, was made available to the public by the Agency as submitted. On 8 July 2021, the data subject requested the controller to erase the personal data relating to her contained in that constitutive instrument. In order to comply with this request, on 26 January 2022 the controller requested the data subject to provide a copy of the instrument in which the personal data of the company members, other than the personal data required by law, were redacted. On 31 January 2022, the data subject brought an action before the Administrative Court of Dobrich (Administrativen sad Dobrich) seeking annulment of the controller’s decision and an order that the controller compensate her for the alleged non-material damage. On 5 May 2022, this court annulled the decision and ordered the controller to pay compensation to data subject in the amount of BGN 500 (approximately €255). The court ruled that, first, the damage consisted in psychological and emotional suffering, i.e. fear of possible abuse, as well as the sense of powerlessness and disappointment that her personal data could not be protected. Second, the damage stemmed also from the controller’s decision, which had led to an infringement of the right to erasure and the unlawful processing of her data contained in the constitutive instrument. The controller appealed this judgement in front of the Supreme Administrative Court (Varhoven administrativen sad), which stayed the proceedings and referred the following questions to the CJEU: # if [https://eur-lex.europa.eu/leg
Nederlands Instituut voor Forensische Psychiatrie en Psychologie (Netherlands Institute for Forensic Psychiatry and Psychology)
A data subject underwent psychiatrist examination within a court proceeding. The court assigned that task to Netherlands Institute for Forensic Psychiatry and Psychology (Nederlands Instituut voor Forensische Psychiatrie en Psychologie). During the examination, the Institute created the final report and additional documents, including the feedback report, which was not shared with the court. The feedback report contained, inter alia, the notes and comments of doctors performing patient's examination. The data subject filed an access request in reference to the feedback report with the Minister of Legal Protection. The Minister excluded the application of the GDPR and didn’t disclosed the data. The appeal proceedings, initiated by the data subject resulted in the dismissal of the Minister’s decision. The District Court of First Instance of Gelderland (Rechtbank Gelderland) examining the appeal found the GDPR applied to the case. However, the access request didn’t cover the personal data within the meaning of the GDPR. The data subject lodged an appeal with the Dutch Council of State (Raad van State; the Supreme Administrative Court). The court rejected the appeal. The court explained that under Article 2(2)(d) GDPR the GDPR doesn’t apply to processing of personal data within criminal proceedings. The feedback report was drafted as a part of criminal proceedings against the data subject. The purpose of the feedback report was to monitor the quality of the final report, disclosed to the court. For the court, the feedback report served then as the prosecution the criminal proceedings. Consequently, the GDPR, including Article 15, didn’t apply to the data subject’s request and the Minister was entitled to reject that request.
Bunq BV
The data subject has multiple bank accounts with the controller, a bank. On 13 November 2023, the controller asked the data subject to provide documents concerning their source of income. Since the data subject did not reply to this request, the controller closed their bank account. On 29 November 2023, the data subject filed an access request to the controller according to Article 15 GDPR. On 2 January 2024, the controller replied to the data subject, sending several data processed by it. However, the data subject considered it implausible that the controller does not process any data about the blocking of the account and that the logic behind the decision-making cannot be explained. Therefore, the data subject informed the controller about this and requested the latter not to delete their data pursuant to Article 18(1) GDPR since they intended to file a lawsuit. On 5 February 2024, the data subject initiated legal proceeding against the controller before the District Court of The Hague (Rechtbank Den Haag – Rb. Den Haag). More specifically, the data subject aimed at acquiring more information about the decision-making process about the blocking of their bank account and if this decision had been taken through automated means. The controller argued that it had already sufficiently acted on the access request and pointed out that there was no automated decision-making (ADM). Indeed, the controller explained that, even though an alert about a suspicious transaction is triggered automatically, then human intervention is required to decide whether to take further action. Furthermore, it noted that in the case at hand [https://wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=41&z=2021-07-01&g=2021-07-01 Article 41(1)(d) of the Dutch GDPR Implementation Act] (Uitvoeringswet Algemene verordening gegevensbescherming – UAVG) applies, since the purpose of this processing is preventing criminal offences pursuant to the [https://wetten.overheid.nl/jci1.3:c:BWBR0024
Court case 6 O 65/24
The Maltesian controller operates an online gambling platform. The data subject is a former customer of the controller. By way of an action by stages (Stufenklage), the data subject sued the controller first to provide him with the information under Article 15 GDPR and, on the second stage, to pay an amount that is to be determined after obtaining the claimed information from the controller. He requested the information under Article 15 GDPR to be sent as an Excel file. During the relevant timespan, the controller operated its platform under a Maltesian gambling licence, but did not have a licence in the German State (Land) of Baden-Württemberg. The data subject claims that he was not aware of this legal situation and therefore wants the money back that he paid to the controller. The court held that payment data as well as data concerning the data subject’s usage of the platform were personal data as they were clearly linked to the data subject. Otherwise, the court concluded, the controller, who deems its offering legal, wouldn’t have been able to provide its service to the data subject. Therefore, the data subject was identifiable under Article 4(1) GDPR. Under Article 15(3) GDPR, the information has to be provided in a commonly used electronic form, if the data subject makes his request by electronic means. Neither Article 15 nor Article 12 GDPR specify any certain format; but one can derive from the said norms that the data subject had a right to choose between electronic, written or other form of information. Where the legal literature concludes that data copies only have to be provided in the format they are already in without any editing, the court disagrees with this position. The court rather points to the obligation of providing the information in an electronic form under Article 15(3)(3) GDPR that includes an obligation to convert data to a commonly used electronic format. Even though there is no explicit statement in the GDPR about who can choose the c
Court case III OSK 769/23
The data subject is a former member of Jehovah's Witnesses (the controller). She left the organisation in 2020. The data that the controller has collected during the time of her membership was retained by the controller after her exit. The data subject decided to lodge a complaint against the controller claiming that, # the processing does not have a lawful basis under the GDPR and, # the controller did not allow for her exercise of right to be forgotten under Article 17 GDPR as they did not erase her data from their data base and did not return physical documents containing her personal data. The complaint was rejected by the DPA. The case was later lodged with the Administrative Court and was decided in favour of the controller. The data subject lodged an appeal with the Supreme Administrative Court. The Polish Supreme Administrative court did not revisit all the facts of the case, but only specific errors raised by the data subject. The cassation appeal was rejected in its entirety due to the fact, that, 1) the data subject did not specify which specific subsection of Article 9 GDPR is supposed to be violated and therefore is the legal basis of the appeal and, 2) the factual nature of the appeal was incorrect, as the data subject claimed Article 9 GDPR cannot be fulfilled, as she never consented for processing. The Supreme Administrative Court has expressed or affirmed the following: # Processing of historical data of a former member of a religious organisation may be lawful under Article 6(1)(f) GDPR and does not have to be based on consent Article 6(1)(a) GDPR. # As the data is sensitive within the meaning of Article 9 GDPR, such processing of historical data of a former member will be lawful under Article 9(2)(d) GDPR (the internal processing by certain organisations), subject to appropriate technical safeguards. # Data regarding former members which relate to ongoing court proceedings should be processed on the basis of Article 9(2)(f) GDPR (exercise or defence of legal claims), however as the data subject did not raise this point in her appeal, the court could not examine this further. # Data of former members which is still necessary for the purpose of collection may be retained. In the case of the controller, data of former members are indispensable for realisation of statutory purposes. # The GDPR, specifically Article 17, does not bestow rights upon any enforcement organs, be it a court or a DPA, to demand a return of documents or copies of documents.
Court case PVN-2024-05
The data subject underwent medical treatment in a hospital managed by the controller following an work related injury. The controller issued a report that was used by the data subject to apply for workers’ compensation. This application was rejected by the competent authority. After that, the data subject filed a rectification and deletion request to the controller, asking the latter to modify the medical report. The controller rejected this request. On 8 December 2023, the DPA closed the case without deciding whether the controller had violated the GDPR and without considering any corrective measures. The DPA pointed out that it does not have medical or healthcare expertise and, therefore, concluded that it was not appropriate to consider the complaint pursuant to Article 57(1)(f) GDPR. Moreover, the DPA pointed out that, according to national law (see holding below) and as already stated by the Data Protection Board, the DPA does not have the power to carry out a real review of what information is correct or relevant to include in a patient record. On 27 December 2023, the data subject complained about this decision. The DPA considered the complaint and upheld its decision not to conduct further investigations. Therefore, on 2 April 2024, the case was submitted to the Data Protection Board (Personvernnemnda). The data subject believed that the DPA has not considered her case and that the DPA has a duty to check that GDPR is complied with. On the handling of the complaint by the DPA First, the Board held that the DPA has closed the case without making a decision and without considering the data subject's complaint. Pursuant to Article 57(1)(f) GDPR, the DPA shall investigate a complaint lodged by a data subject and investigate, to the extent appropriate, the subject matter of the complaint, as well as inform the complainant of the course and outcome of the investigation within a reasonable time. According to the Board, this provision does not allow for a discretionary assessment of which complaints should be processed and which can be closed without processing. Secondly, the DPA pointed out that keeping a patient record involves the processing of personal data. [https://lovdata.no/dokument/NL/lov/1999-07-02-64 Sections 39 and 40 of the Health Personnel Act] (Lov om helsepersonell m.v.) impose a duty on health personnel to keep patient records. These personnel must assess what is relevant and necessary information about the patient and the health care. According to [https://lovdata.no/dokument/NL/lov/1999-07-02-64 Section 42 and 43 of the Health Personnel Act], a person can demand to correct this record to the health personnel. Refusals of demands for correction may be appealed to the county medical officer. Moreover, pursuant to [https://lovdata.no/lov/2014-06-20-42/§26 Section 26 of the Patient Records Act] (Pasientjournalloven), the Norwegian DPA supervises compliance with the GDPR, with the exception to supervisory tasks that are the responsibility of the Norwegian Board of Health Supervision. The Board recalled a previous decision of its, where it had held that data protection legislation does not give either the DPA or the Board the authority to review information in patient records for the purpose of ordering changes to the content of a record at the request of a data subject. On the contrary, it had held that the correctness of such journal entries must be assessed by the health enterprise and possibly by the county medical officer in connection with an appeal against a refusal to rectify. On the rectification and erasure request Thirdly, the Board noted that the data subject’s rectification request has been stored in the hospital’s systems in a way that meets the requirements for supplementing personal data under Article 16 GDPR. Therefore, it considered that the controller fulfilled the rectification request. Finally, the Board noted that the right to erasure does not apply to patient records, since they fall into the exception of Article 17(3)(b) GDPR. Therefore, the Board upheld the data subject’s complaint that the DPA has not considered the case has been upheld. However, it did not uphold her claim that she can demand deletion or further rectification.
[Verzoeker]
The claimant is the father of a child treated at Antonius Hospital (controller). During the treatment a social worker was involved with the child and the parents who performed social work for his family. In 2015, upon his request, the father received a copy of his child's medical record from the controller but claimed that several details were missing, including details about the social worker. In May 2022, the father exercised his right to access, pursuant to Article 15 GDPR, requesting information from the controller about the social worker, log data on his child's file and involved healthcare providers registration data. The controller provided limited data, arguing further records didn’t exist or weren’t covered by the request. The father filed a case before the Court of first instance which rejected the father's request. Before the Court of Appeal, the father explained that he had requested several times to obtain access to all personal data regarding himself and his child but the controller has not provided any data outside his child's medical record and that the controller has misunderstood his request. The controller claimed that they did not need to provide an overview of the complete log data, because the father is not entitled to this data under Article 15 GDPR, because it does not concern personal data of him or his child. The court of Appeal decided to overturn the decision of the Court of first instance and grant part of the fathers requests. First, the Court of Appeal held that the controller must provide the father with a copy of the personal data it processes about himself and his child in connection with the treatment that still has in his possession, pursuant to Article 15(1) and Article 15(3) GDPR, noting that the controller interpreted the father's access request too narrowly. As far as possible, the controller must choose to provide the personal data in a way that does not infringe the rights or freedoms of its employees and of the mothe
Court case 62 O 88/23
The data subject is a client of the controller that operates two social media platforms which allow users to create their own profile and share it with friends. The controller earns money through personalised ads which are tailored to the user’s behaviour. Upon registration, the user provides the controller with their full name, their date of birth and gender. Additionally, the user is asked to enter their phone number and e-mail address. On the registration page, the new user is informed that by clicking the “Register now” button they consent to the controller’s terms and conditions and they can learn about the collection, sharing, and processing of personal data in the data guidelines of the controller. In these guidelines and in the social media portal’s help section users are being informed that the controller offers the users a personalised experience and state-of-the-art technology to ensure secure and functional operation for everyone. Additionally, the terms and conditions include detailed information about the processing of personal data and why they are necessary for personalising the contents shown to the user. The data subject accepted these terms and conditions that were subsequently changed during the time they used the platform. At first, the controller based its processing on Article 6(1)(b) GDPR. Since 5 April 2023, the controller informed the users the processing was done under Article 6(1)(f) GDPR and offered a possibility to object to the processing. Starting from 3 November 2023, the controller then introduced a consent model. It gave the data subject one of the three following options: either consent to the processing of their personal data for advertising, subscribe to the ad-free version, or leave the platform by deleting the account after possibly obtaining a copy of their data. On 8 November 2023, the data subject consented to the processing of their data for advertising purposes. The data subject filed a lawsuit with the Regional Court Aschaffenburg (Landgericht Aschaffenburg – LG Aschaffenburg) and claimed, inter alia, access to their personal data processed by the controller as well as non-material damages of an amount in the discretion of the court but at least €1,500. The court dismissed the data subject’s claim for access to their personal data because, respectively, the controller either already provided the information that fall under Article 15 GDPR, or the claimed information (i.e. the frequency of processing of the data) did not fall into the scope of Article 15 GDPR. The information that the controller needed to provide had been mainly provided by the data protection guidelines. According to Article 82(2) GDPR there are three eligibility criteria: a processing of personal data which is unlawful under the GDPR; a damage suffered; and a causal connection between the unlawful processing and the damage. The claim for non-material damages under Article 82(1) GDPR was dismissed by the court. The court held that it did not have to decide about whether the controller had violated Article 6 GDPR or Article 15 GDPR because the data subject had not provided sufficient evidence for having suffered a non-material damage. The court recalled that the right to compensation is not limited to severe cases of infringements of the GDPR. However, an infringement of the GDPR in itself does not constitute a non-material damage. An only individually noticeable inconvenience is not sufficient. Despite the broad scope, there has to be a suffered damage according to Recital 146, which required an objectively comprehensible and factually existing damage. This is necessary to avoid solely abstract, non-real consequences. The data subject had not demonstrated to the court a sufficient impact on their personal concerns that were causally linked to the processing by the controller. The loss of control over their personal data, as claimed by the data subject, and the claimed discomfort caused by the processing of their personal data for marketing purposes were found to be not specific enough. The bad feeling about contributing to a business model of the controller that the data subject dislikes did not constitute a damage. The court further held that the statement of the data subject was inconsistent. On the one hand, the data subject alleged discomfort and a negative feeling while on the other hand, they were not willing to pay for the ad-free subscription model to get rid of the advertisement in total and also of the negative feeling. The court furthermore referred to CJEU - C-252/21 and recalled that a monopoly of a social network itself did not automatically render the data subject’s consent invalid. Rather, the users had a freedom of choice when provided with the possibility of paying an appropriate amount of money for an equivalent alternative that does not include such processing of personal data. The controller had implemented this judgement by implementing their consent model with an alternative that included paying a fee. The court concludes that the data subject’s reluctance towards the processing could not have been that great if they chose to consent rather than to pay the fee.
Court case W214 2254151-1
The data subject is the owner of an apartment. The controller managed the building where the data subject's apartment was located. The building heating was provided by a company (K-Company). Additionally, each apartment had an individual contract with another provider (I-Company). Also, the controller concluded an agreement with I-Company according to which I-Company prepared the consumption invoices, using for that purpose data provided by the controller. The building's apartments were equipped with meters capable to send consumption data regarding water (cold and hot) & heating to I-Company. The apartments’ owners received the individual statements of water (cold and hot) & heating. Remote meter (radio-based) monitored the consumption. The data subject's meter was not calibrated since 2018 and the data subject refused I-Company access to the apartment. Consequently, the data subject received consumption statement based on extrapolated values. The data subject requested, under Article 16 GDPR, the controller to rectify their data regarding the extrapolated consumption. The controller claimed that they didn’t prepare the consumption invoices and that the data could not be rectified by them. In response, the data subject lodged a complaint with the Austrian DPA (DSB). The DPA examined the case and found the controller didn’t transmit incorrect data used for billing the data subject. Moreover, it was the I-Company who prepared the individual invoices. Hence, the controller was unable to rectify the data. Additionally, for the DPA the controller was not a controller under Article 4(7) GDPR, as they didn’t determine the means and purposes of data processing. The data subject initiated the appeal proceedings before the Federal Administrative Court (Bundesverwaltungsgericht). The court dismissed the appeal. The court found that the Controller was a data controller for the processing at hand. It was apparent that the controller determined the means and purposes of
Court case 3 U 2469/23
On 1 October 2020, a journalist uploaded a video to the Youtube platform (controller). The data subject complained about statements made about him and the company he was part of. The journalist did not reply to any emails about the uploaded video. On 13 November 2020, the data subject complained to the controller about the video. In response on the same day, the controller asked the data subject for providing the specific statements in corresponding time. On 7 May 2021, the data subject's lawyer requested the deletion of the video from the Youtube (controllers platform). The controller asked the data subject to provide proof of identity and information about the statements that violated personal rights. The data subject sent a power of attorney. The controller explained that more information was needed about the image, name, or other personal data. The data subject's lawyer wrote to the controller on 8 November 2021. The controller then blocked the video for the local state domain and informed the data subject by email on 16 November 2021. The controller has not provided any further steps. The data subject initiated legal proceeding, which resulted in the controller being ordered to refrain from making the contribution to the video posted by the journalist. The controller had not fulfilled its obligation to request appropriate information from the author of the video. The controller appeals against aforementioned judgement. The Higher Regional Court Nuremberg amended the judgement of the Regional Court of Nuremberg-Fürth of 14 November 2023, case no. 11 O 7452/21. The action is dismissed. The link between the data subject and the company was found to be weak, as the data subject was not in a representative position. The Higher Regional Court Nuremberg concluded that the video presented opinions rather than established facts about the data subjects professional capacity and operations in the company.
Datenschutzbehörde
In 2022, the data subject (represented by their parents) filed an access request with the DPA. They aimed at accessing some documents concerning an investigation conducted by the DPA on a controller. According to a statement of the DPA, the data subject was not a party in this procedure. After receiving an answer only partially disclosing the file of this investigation, the data subject filed a complaint with the DPA (which, in this case, acts both as the supervisory authority and the controller), arguing that no complete copy of the documents of the file had been made available. The DPA rejected this complaint, pointing out that, on the one hand, it had disclosed the information provided for by Article 15(1) and (2) GDPR. On the other hand, the data subject does not have a right to inspect the entire file since they are not a party of this investigation proceeding. In a separate and previous legal proceeding before the BVwG, the data subject appealed this complaint. In this case, the BVwG did not upheld the complaint. It ruled that the DPA lawfully only partially disclosed the documents contained in the file and that the disclosed parts easily allow the data subject to get the information stated in Article 15(1) and (2) GDPR. As for Article 15(3) GDPR, the DPA suspended the proceedings, due to the fact that there was a preliminary ruling proceeding before the CJEU under number C-487/21. After the CJEU issued its judgement in case C-487/21, Österreichische Datenschutzbehörde and CRIF, the DPA rejected the data subject’s complaint. It argued that, in light of this judgement, Article 15(3) GDPR does not enshrine an independent right, but merely represents a modality of the provision of information. Therefore, the data subject appealed the DPA’s decision before the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). First, the court noted that in case C-487/21, Österreichische Datenschutzbehörde and CRIF, the CJEU had ruled that Article 15(3) GDPR must be interpreted as meaning that the right to obtain from the controller a copy of the personal data undergoing processing means that the data subject must be given a faithful and intelligible reproduction of all those data. Furthermore, the CJEU ruled that this right should entail the right to obtain copies from databases which contain those data, if the provision of such a copy is essential in order to enable the data subject to exercise effectively the rights conferred on them by the GDPR, taking also into account the rights and freedoms of others. Therefore, according to the court, Article 15(3) GDPR does not confer to the data subject a separate and independent right to obtain copies in addition to the information provided according to Article 15(1) GDPR. As for the case at hand, the court noted that, in its previous judgement, it had already ruled that the DPA had already provided the data subject with the information in full within the meaning of Article 15(1) to 15(3) GDPR in a sufficiently understandable and comprehensible manner. Therefore, the DPA concluded that – since the data subject’s right of access has already been satisfied – there is no need to provide them with a copy of the documents. On these grounds, the court ruled that the DPA rightly rejected the complaint concerning the violation of Article 15(3) GDPR.
SCHUFA Holding AG
The data subject and the controller entered into a telecommunications contract beginning on the 24.08.2020. Subsequently, the data subject was notified that his personal data was shared with [https://www.schufa.de/ SCHUFA Holding AG], a credit rating agency. On the 25.08.2020, the controller notified SCHUFA of the conclusion of the contract and transferred various information regarding the contractual relationship with the data subject. In August 2023, SCHUFA provided the data subject with a copy of his recorded personal data which included the information on the telecommunications contract. In September 2023, the data subject contacted the controller claiming immaterial damages under Article 82(1) GDPR. In October 2023, SCHUFA announced that they would begin to delete personal data connected with telecommunications contracts. Also in October 2023, the data subject filed a lawsuit regarding the claimed immaterial damages and argued that he suffered from the transmission of data from the controller to SCHUFA. He claimed that the transmission was unlawful and could not be justified on a legal basis as per Article 6(1)(a), (b) and (f) GDPR. He elaborated that upon reception of the information by SCHUFA he felt loss of control and great worry regarding his creditworthiness. He further claimed entitlement to injunctive relief under Article 6(1) and Article 17 GDPR. The controller claimed that there had been no violation of the GDPR as the transmission of data protects consumers from overindebtedness, enables more precise prognosis of risk of default and ensures the functionality of credit rating agencies which are essential for economic trade. The controller argued that the data subject had suffered no damage and that his reactions were engineered and far-fetched. It based this argument on the fact that each citizen usually has several telecommunications contracts so the disclosure of this information in no way sets him apart from others. Therefore, the transfer of data does not give banks or insurance companies a reason to critically investigate him. The controller denied the existence of a right to injunctive relief under the GDPR and specifically under Article 17 GDPR. The court found that the data subject hadn’t suffered material nor immaterial current and future damages and that his claim for injunctive relief is unfounded. With reference to the CJEU case C-300/21, the court reiterated that the mere violation of the GDPR does not entitle a claimant to damages. The data subject must show and prove concrete material or immaterial damage, the violation of the GDPR as well as a causal link between the damage suffered and the GDPR violation. The court rejected the data subject’s claims of worry and loss of control in connection with the specific data transferred by the controller as the copy of the data subject’s personal data recorded by SCHUFA shows several other entries, including unsecured credits. In regard to the injunction, the court stated that neither Article 17 GDPR nor Article 79(1) GDPR include a right to injunctive relief. Due to the primacy of the GDPR, a claim for injunctive relief under national law is also excluded. With regard to damages, the court concluded that future incurring damages are impossible due to the erasure of the personal data in question. The erasure of the data further negates the data subjects claim to worry induced. The court reasoned that the multiple other entries render the claim to immaterial damage suffered unfounded. Therefore, the court rejected the claim.
Court case 24797/2024
The case is part of a broader dispute between a company and some of its employees. During a meeting between the managers of the company and the employees, one of the employees (the controller) recorded the ongoing conversation, without the managers being aware of this. Some years later, another employee used this recording during a labour trial as evidence. Therefore, the managers (the data subjects in this case) filed a complaint with the Italian DPA (Garante per la protezione dei dati personali). The DPA rejected this complaint, arguing that the processing at hand had the only purpose of proving the employee's statements during the trial. The data subjects appealed the DPA's decision before the Court of Venice (Tribunale di Venezia). Contrary to the DPA, the court upheld the data subjects' claims, ruling that the processing was unlawful and fining the controller €5,000. The court gave the following reasons: # when the recording was made, there was no defence needs but only some "organisational problems" in the company; # the trial in which the recording was used took place years later; # the household exemption provided for by Article 2(2)(c) GDPR does not apply. The controller appealed this decision before the Italian Supreme Court (Corte di cassazione). First, the court pointed out that the recording occurred in 2016, i.e. a time when the GDPR was not yet in force. The court recalled that A[https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196!vig=2016-11-14~art24 rticle 24(f) of the then-applicable Italian Data Protection Code] stated that the data subject's consent was not needed when the processing was necessary "to assert or defend a legal claim, provided that the data are processed exclusively for such purposes and for no longer than is necessary for the pursuit of those purposes". On this point, the court noted that, according to national case law, this rule applies not only during the trial on itself, but also regarding
Meta Platforms Ireland Ltd
Meta Platforms Ireland Ltd (the controller) is the provider of the social network Facebook in the EU. Facebook contains a section called “App Centre”, that allows users to access free games provided by third parties. While accessing these games, it is indicated that some personal data is collected by the third party providing the game. The user was also informed that, by using the applications concerned, they accepted the general conditions of those applications and their data protection policy. The Federal Union of Consumer Organisations and Associations (Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband eV), a German consumer association, brought an action before the Regional Court of Berlin (Landesgericht Berlin – LG Berlin), claiming that the controller failed to comply with the legal requirements to obtain valid consent from the user under the GDPR. The action was brought independently of a specific infringement of a data subject’s GDPR rights and without a mandate from a specific data subject. The Federal Union based its standing on national law allowing a consumer protection organization to bring proceedings on the basis of the infringement of the prohibition of unfair commercial practices (or a breach of a consumer protection law or the prohibition of the use of invalid general terms and conditions). In this case, the Federal Union deemed that the controller had breached the above cited law by having violated data protection law. The LG Berlin upheld the action; the controller appealed this decision before the Higher Regional Court of Berlin (Kammergericht Berlin – KG Berlin). This appeal was dismissed and the controller further appealed the judgement of KG Berlin before the Federal Court of Justice (Bundesgerichtshof – BGH). The BGH had doubts as to the admissibility of the action brought by the Federal Union. Therefore, it referred a question to the CJEU for a preliminary ruling on the interpretation of Article 80(1), 80(2) and 84(1) GDPR. The CJEU answered these questions on 28 April 2022 with the judgement C-319/20, Meta Platforms Ireland. However, after the CJEU judgement, the BGH still had doubts about the interpretation of Article 80(2) GDPR. More specifically, it observed that the CJEU had not ruled on the condition, laid down in this Article, according to which a consumer protection association must consider that the rights of a data subject have been infringed “as a result of the processing”. The BGH had this doubt since the GDPR violation at stake concerns the information obligations, set by Article 12(1), 13(1)(c) and 13(1)(e) GDPR. The BGH wondered if the concept of ‘processing’, within the meaning of Article 4(2) GDPR, encompasses situations preceding the collection of such data. The Advocate General (Richard De La Tour) opined that the obligation on controllers to provide information about reasons for processing personal data, legal basis for processing, and the intended recipient of personal data does not by itself amount to processing of personal data. However, where this provision is not complied with, it could lead to personal data being processed unlawfully. Therefore, he argued that the provision of information required by Article 12(1) and 13(1) GDPR could be a condition precedent to determine the lawfulness of any subsequent processing of personal data. Where the data controller fails to comply with this prerequisite, a not-for-profit organization would have the legal standing to bring a representative action against the data controller for breach of data subject rights, even where the data subject has not expressly asked the organization to do so, and where the actual processing of the personal data is yet to take place. The AG further opined that Article 80(2) GDPR must be interpreted in this way to safeguard the rights of the data subjects under the GDPR. The court recalled that, as for the material scope of the mechanism set by Article 80(2) GDPR, the entity must consider that the rights of a data subject under GDPR have been infringed “as a result of the processing”. The court pointed out that it had already clarified that it is not necessary to prove the existence of a “specific infringement” of the rights of one data subject, but it is sufficient to claim that the processing of data is liable to affect the rights which identified or identifiable natural persons derive from the GDPR (see C-319/20, Meta Platforms Ireland, paras. 70 and 72). The court also specified that Article 80(2) GDPR requires that the infringement of GDPR occurs in the course of the processing of personal data. After that, the court analysed whether the violation of Article 12(1), 13(1)(c) and 13(1)(e) GDPR constitutes an infringement of GDPR rights “as a result of the processing” under Article 80(2) GDPR. First of all, the court pointed out that the general aim of the GDPR, as set by Article 1 and Recital 10 GDPR, is to ensure a high level of protection of personal data. To that end, Chapters II and III GDPR set the specific requirements for the processing of personal data. More specifically, the court observed that any processing must comply with the principles set by Article 5 GDPR. Pursuant to Article 5(1)(a) GDPR, personal data must be processed lawfully, fairly and in a transparent manner. Moreover, as for Article 5(1)(b) GDPR, the court recalled its case law stating that this provision requires that the purposes of the processing be stated clearly and identified, at the latest, when personal data are collected (see [https://curia.europa.eu/juris/document/document.jsf?text=&docid=254583&pageIndex=0&doclang=FR&mode=lst&dir=&occ=first&part=1&cid=4078239 C-175/20, Valsts ieņēmumu dienests (Processing of personal data for tax purposes)], paras. 64 and 65). Generally speaking, according to Article 5 GDPR the processing must satisfy specific requirements of transparency. Article 13(1)(c) and 13(1)(e) GDPR imposes an obligation on the controller to inform the data subject of the purposes of the processing, of the legal basis for that processing and of the recipients or categories of recipients of those data. According to Article 12(1) GDPR, this information must be concise, transparent, comprehensible, easily accessible, and formulated in clear and plain language. The court noted that the obligation to provide transparent information ensures observance of the principles of transparency and fairness laid down in Article 5(1) GDPR. The court also highlighted that the controller’s obligation to provide this information is the corollary of the data subjects' right to information under Articles 12 and 13 GDPR and is, therefore, part of the rights enforceable by representative action according to Article 80(2) GDPR. The court recalled that, according to its case law (see see C-319/20, Meta Platforms Ireland, para. 76), the mechanism set by Article 80(2) GDPR has a preventive function. The court also noted that the infringement of information obligations can prevent the data subject from giving an “informed” consent within the meaning of Article 4(11) GDPR and, therefore, render the processing unlawful under Article 5(1)(a) GDPR. In other words, the validity of the consent given by the data subject also depends on whether that person has previously obtained the information. On these grounds, the court held that the right of the data subject, under Article 12(1), 13(1)(c) and 13(1)(e) GDPR, to obtain from the controller, in a concise, transparent, intelligible and easily accessible form, using clear and plain language, information relating to the purpose of such processing and to the recipients of such data, constitutes a right whose infringement allows recourse to the representative action mechanism provided for in Article 80(2) GDPR.
Court case W137 2278780-1
The data subject was a department head at the Department of Education (the controller). On 20 January 2022, the data subject sent an access request under Article 15 GDPR to the controller regarding his stored personal data. On 25 May 2022, the data subject sent another request. At the same time, two proceedings were pending before the Labour and Social Court (“Arbeits- und Sozialgericht”) between the data subject and the controller. On 30 June 2022 and 17 August 2023, the controller responded to the request and provided the data subject with information. This included a total of 187 documents relating to the data subject and his personal file. However, the controller refused to provide information to certain emails and statements, claiming it relied on overriding confidentiality interests, which would outweigh the data subject’s interest in receiving this information. As there were labour and social court proceedings pending, these emails and statements were part of these proceedings. Providing this information would therefore mean a deterioration of the controller’s litigation position. On 27 September 2022, the data subject lodged a complaint at the Austrian DPA (“Datenschutzbehörde - DSB”) against the controller for violating their right of access under Article 15 GDPR. According to the data subject, the controller provided the data subject with incomplete information. The data subject argued that he was still missing the following documents: the extensive volume of written complaints against the data subject at the controller’s personnel department, the written requests for dismissal from the data subject’s function as appointed department head, statements on the data subject to the controller and other relevant files. The DPA rejected the complaint, because there were no indications that the information provided by the controller was incomplete. The DPA also held that the controller was cooperative throughout the proceedings and had been able to demonstrate in a comprehensible manner that no data existed regarding the other information the data subject requested. Apart from the data subject's mere speculation, they had not provided any substantiated evidence of incomplete information. The data subject appealed this decision at the Federal Administrative Court (“Bundesverwaltungsgericht – BVwG”), arguing that the controller had not yet provided the data subject with complete information regarding his processed data. The claim that the requested data no longer existed was incorrect, because it was suddenly introduced as evidence in the labour court proceedings by the controller in 2022 and 2023. According to various statements in these proceedings, there were also other files that still needed to be given to the data subject. The data subject also rejected the claim that certain information could not be shared due to the ongoing labour court proceedings, as this legal view of the controller overlooks the principle of immediacy in personnel matters under labour law. The court agreed with the controller that it had a confidentiality interest. As the data subject was provided with extensive information and that the controller’s refusal to provide information was only limited to the emails and statements, the court held that requesting access to strengthen the data subject's case goes beyond the protective purpose of this right. Thus, the controller’s legitimate interest in confidentiality outweighed the interests of the data subject. The court further held that the physical folders requested by the data subject are exclusively physical files located in the controller’s office. The court thus agreed with the DPA’s reasoning that these physical files did not qualify as a filing system. With regard to the other information that the data subject claimed the controller had about them, the court found that these documents or files do not exist at all. By providing a negative answer to the data subject, the controller also complied in this regard with the access request. The court therefore held that the controller was justified to withhold certain information and thus the controller did comply with the the data subject's access request. The data subject’s right of access was thus not violated.
La Ligue des droits de l'Homme
Several applicants, including the The Human Rights League (la Ligue des droits de l'Homme) and the National Council of Bar Associations filed requests to The Supreme Administrative Court of France to annul the [https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000047416587 Decree of 6 April 2023]. The applicants brought forward a number of charges against the Decree, including unclear purpose of the Decree, its interference with the principle of data minimisation, right to information, right to object and the security of data. The Decree authorised the implementation of automated processing of personal data relating to the care of minors returning from areas of operation of terrorist groups. The processing covered the data of French minors, minors presumed to be French minors, as well as foreign minors present in French territory, who lived in or transited through the Iraqi-Syrian zone or any other area in which terrorist groups operate. The data included the data identifying minors, their current situation (family, judicial, administrative, medical and educational) and identification data of persons exercising the parental authority. The court rejected all requests. At the beginning the court ruled out the allegation of incompetence of the regulatory power by referring to the legal basis of the Decree ([https://www.conseil-constitutionnel.fr/le-bloc-de-constitutionnalite/texte-integral-de-la-constitution-du-4-octobre-1958-en-vigueur Article 34 of French Constitution]). Then, it explained why data-principles charges against the Decree were unfounded. First, regarding the purpose of the Decree, the court emphasised it was precisely indicated in Article 1 of Decree. The idea that stood behind the Decree was to better help minors coming from the areas exposed to terrorist groups operations. The processing of the data aimed at providing the minors with appropriate care and prevent them from getting involved in criminal activities as well as spreading radicalism. Hence,
Twitter international company ULC
The data subject is a user of the platform X (formerly known as Twitter) of which the controller is Twitter International Company ULC. On 11 October 2023, the controller temporarily restricted ("shadowbanned") the account of the data subject, for posting a message that included the word “child pornography”. The message read: “The chats of hundreds of millions of people will soon be scanned to detect a relatively small number of criminals, no matter how bad. Strong criticism of European plans against child pornography: 'Not proportionate'” [link to a newspaper article].The controller automatically detected the post as potentially violating their policy. The shadowban meant that the data subject's account and posted messages temporarily did not appear in searches or on the timeline of other users. The controller did not notify the data subject of the shadowban. The data subject only found out through other users that told him they could not find his account. Subsequently, the data subject did an access request on 13 October 2023, to, amongst other things, understand what the shadowban entailed and why this happened. On 16 October 2023, the controller lifted the restriction after an additional review. This was also not communicated to the data subject. On 14 November 2023, the controller responded to the access request, and referred to various sections of their privacy policy in response to the data subject's questions. On 17 November 2023, the data subject initiated proceedings by application (“verzoekschriftprocedure”) at the District Court of Amsterdam (“Rechtbank Amsterdam”). The data subject requested the court to order the controller to respond to his access request under Article 15 GDPR, and his request for information on automated decision-making under Article 22 GDPR. The data subject also requested the court to impose a penalty of € 4.000 on the controller for every day it did not comply. The controller argued that they complied with the data subject’s access request by referring to their privacy policy. Moreover, the controller argued that the data subject is a journalist and pursuing a PhD in automated decision-making and may want to write articles about the controller’s systems and thus is misusing their right to access. The controller further argued that they did not provide full access due to trade secrets and fears that the data subject will make these secrets public. Lastly, the controller argued that there was no automated decision-making when shadowbanning users, as the parameters of the detection system are determined by humans. On 12 January 2024, the data subject received a letter by the controller which provided information about the imposed shadowban. On the abuse of right to access The court held that the data subject does not have to explain the motivation of their access request. A data subject may abuse this right to access, however, it is up to the controller to prove this. The court dismissed the controller’s argument as there was no proof that the data subject had ulterior motives for the access request. Furthermore, it is clear that being a journalist was not be the only reason why the data subject did an access request. Response to access request was not transparent or concrete The controller’s only response within a month was a general message that only referred to specific parts of the Privacy Policy. The court found that this did not comply with the GDPR, as it did not extend on how the data subject’s personal data was processed. The response only provided the data subject with information on how the controller may process personal data. This did not allow for the data subject to understand how the controller processed the data subject’s personal data and whether this is lawful. It also forced the data subject to search for answers, rather than providing a clear overview. The court held that the controller so far had not given a clear overview of the data subject’s processing of their personal data. The court took into account the CJEU judgement in C-33/22 - Österreichische Datenschutzbehörde and held that the controller cannot suffice with a summary of personal data without providing any context on the basis on which it was processed, as the controller did in its letter of 12 January 2024. The court held that the controller needs to provide a full and true copy of the document containing the personal data that has been processed. The court dismissed the controller’s argument on trade secrets as it did not substantiate its respective claim, or explained why certain personal data of the data subject could not be shared. The court held that the controller could not hide behind 'trade secrets' and thus evade its obligations under GDPR. Access to information on automated decision-making regarding the shadowban The court dismissed the controller’s argument that their system to shadowban users is not automated decision-making. The court held that it is not about whether the system is made by people, but whether there is human intervention in the decision-making. The court found that the automated decision-making significantly affected the data subject. The data subject used the account for his profession as a journalist and being shadowbanned affected his employment. Moreover, by being connected to child abuse, the controller could have notified an American organisation which would have led to not being allowed to travel to the US. The court held that under Article 13 GDPR and Article 14 GDPR, the controller should have pro-actively provided transparent information on the automated decision-making. The controller should have notified the data subject on the shadowban and inform him about the next steps and possible consequences. This would have also allowed the data subject to appeal this decision. The court further held that the controller should have at least provided information about the automated decision-making, its underlying logic, its importance and its expected impact on the data subject when the data subject made an access request and asked for information on the existence of automated decision-making under Article 15(1)(h) GDPR. By only providing information on this, three months after the access request, the controller was too late. The court further held that the information provided was unclear and did not allow the data subject to verify the lawfulness of the processing. The court held that although the controller has the responsibility to protect its platform and is allowed to shadowban users, it does need to provide information surrounding this and cannot hide behind ‘trade secrets’. On the specifics of the access request The court dismissed the controller’s argument that it does not use reputation scores and labels for accounts as there was clear proof it did. The court therefore held that the controller needs to provide access on the reputation scores and labels they use on the accounts of users. The court further held that the controller needs to provide access on the processing of personal data in the context of their system "Guano", which provides a chronological overview of all actions taken on an account. The court dismissed the controller’s argument of business secrecy, as the access is about the processing of personal data. Conclusion Thus, the court held that the controller’s response to the access request was insufficient. The court ordered the controller to respond to the access request within a month and provide information on the various categories of personal data concerned and the automated decision-making. Moreover, the court held that the controller had to provide specific information on reputation scores, labels and their system Guano. The court imposed a penalty of € 4.000 per day for non-compliance.
Google Ireland Limited
The data subject filed a lawsuit with the first instance court, the Regional Court of Cologne (“Landgerichts Köln”) seeking injunctive relief. The data subject further requested the court to order Google Ireland Limited (the controller) to erase search results that linked to an article which contained false information about the data subject and included a photograph of the data subject that infringed the data subject’s copyright. The article used the photograph to make allegations of the data subject. The photograph was taken by the data subject’s wife, who did not give the website the right to use the photograph for the mentioned article. The first instance court agreed with Google Ireland's view that they are not the controller, but the US based Google Limited Liability Company (LLC), because they make the decisions about how to respond to a search query and how the relevant search results are displayed. Google LLC was also named as the controller in the privacy policy. Although Google Ireland Limited operates the Google search engine in Germany and other European countries, it had no influence on how the search results were generated. The court therefore dismissed the action for injunctive relief and request for erasure. The data subject appealed the decision of the first instance court for failing to recognise that Google Ireland Limited is a controller under Article 4(7) GDPR. It further requested the court to erase the search results related to the article with inaccurate information of the data subject. On whether Google Ireland Limited is a controller The court disagreed with the first instance court and held that Google Ireland Limited is the controller. The court held that it is irrelevant whether the controller only offers access to the search engine and took into account the CJEU judgement in C-131/12 - Google Spain and C-231/22 - Belgian State and held that the mere display of information containing personal data constitutes the processing of such d
Spotify AB
On 12 June 2023, the Swedish DPA (“IMY”) imposed a fine of €5,167,615 (SEK 58 million) on Spotify AB (the controller) for violating the GDPR. The DPA held that the controller did not provide sufficiently clear information in the access request and violated Article 12(1), 15(1)(a) to (d), (1)(g) and (2) GDPR. The controller appealed the DPA’s decision at the Administrative Court of Stockholm (“Förvaltningsrätten I Stockholm”) and requested to annul the DPA’s decision, to impose a reprimand instead of a fine or otherwise reduce the imposed fine. The controller did not agree that with the DPA’s reliance on the guidelines of the EDPB and the Article 29 Working Party for their decision, as these were not legally binding. The controller argued that there was no requirement of how the information on categories of personal data should be presented under Article 15(1)(b) GDPR and thus it complied with the provision regardless of the generalised information. Also, the controller argued that there was a link to the privacy policy that had a more detailed description of the different categories. The controller further argued there was no obligation to provide information on the storage periods in relation to each category of personal data under Article 15(1)(d) GDPR, to provide precise information on the criteria for determining the storage periods and to provide information on which third countries the personal data was transferred to under Article 15(2) GDPR. Moreover, the controller argued that there was also no obligation to provide an explanation to the codes and numbers relating to personal data contained in the technical log files. There was also no obligation to provide this explanation in a specific language other than English. EDPB’s Guidelines The court agreed with the controller that the EDPB and Article 29 Working Party Guidelines are not legally binding. However, the court held that they can be used to support the interpretation of the GDPR. The court further
AVROTROS
The controller is a Dutch radio and television broadcaster. On its website it offers a forum called “Radar”, where people who had signed up can post articles and reply to other people’s posts. The users must comply with some conditions of use, called “Huisregels” (House rules). Compliance with those rules is monitored by the moderators of the forum. The data subject has been participating in the forum since 2006. After being banned for the violation of the house rules, the data subject filed an access request. The controller did not act on this request. Therefore, the data subject sued the controller before the District Court Midden-Nederland (Rechtbank Midden-Nederland), asking the court to order the controller to comply with the access request and provide him a copy of his information relating to the violation of the house rules. The controller argued it was not obliged to act on the access request since the so called “journalistic exception” applied: Article 85 GDPR provides that Member States shall reconcile by law the right to protection of personal data with the right to freedom of expression and information, including the processing for journalistic purposes. To this purpose, [https://wetten.overheid.nl/jci1.3:c:BWBR0040940&hoofdstuk=4&artikel=43&z=2018-05-25&g=2018-05-25 Article 43 of the GDPR Implementation Act] (Uitvoeringswet Algemene verordening gegevensbescherming – UAVG) foresees that Article 15 GDPR shall not apply to the processing of personal data exclusively for journalistic purposes. On 4 January 2023, the court stated that the controller could not rely on the so called “journalistic exception”. Moreover, it ruled that the controller had already sufficiently given the data subject access to his personal data, but ordered it to provide him with the information as described in Article 15(1)(a) to 15(1)(h) GDPR. Both the data subject and the controller appealed the decision before the Court of Appeal of Arnhem-Leeuwarden (Gerechtshof Arnhem-Leeuwarden). The data subject argued that he has the right to access his data, since the information about his moderation process does not fall under the journalistic exception. The controller that the data subject cannot invoke the right to access in this case and that this exception applies, since Radar has fulfilled the role of public watchdog for many years and the forum has the purpose of providing inputs for the TV programmes broadcast by the controller. The court recalled that the purpose of the right of access is to enable the data subject to acquaint himself with the personal data collected about him and to check whether those data are accurate and have been processed lawfully. The court noted that the CJEU had ruled that a processing can be considered for journalistic purposed, and therefore national law implementing Article 85 GDPR applies, only if the sole purpose of the processing is the disclosure to the public of information, opinions or ideas (see [https://curia.europa.eu/juris/document/document.jsf?text=&docid=210766&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=440401 C-345/17, Buivids, para. 59]; [https://curia.europa.eu/juris/document/document.jsf?text=&docid=76075&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=440744 C-73/07, Satamedia, para. 62]). The court held that the forum is an integral part of Radar’s entire journalistic platform and that the processing of personal data on the forum cannot be viewed separately from the journalistic purposes served by the controller with its TV programmes. In other words, the forum and the other products managed by the controller are so closely linked that the sole purpose of the whole set of journalistic activities is the disclosure of information, opinions and ideas to the public. As for moderation, the court ruled that it equally serves the public exchange of information, data and ideas. For example, the deletion of an offensive message is necessary to protect the freedom of expression of forum users among themselves. Therefore, the court set aside the data subject’s appeal and held that no right of access existed since [https://wetten.overheid.nl/BWBR0040940/2018-05-25/#Hoofdstuk4_Artikel43 Article 43 UAVG] applied.