GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Court case W137 2271316-1
An individual (the controller) installed a video surveillance system (CCTV) on their premises. The CCTV filmed a forest path, which run alongside their premises. The CCTV was active upon detection of movement and stored the recording on a SD card. The path was on the property of the controller but members of a partnership had the right to use the path for forestry and hunting purposes. In principle, other strangers were not allowed to use the path. As the controller explained, the members of the partnership decided, in majority but without the controller’s agreement, to use the path for hunting purposes. The route was necessary for the hunters to access the hunting area, located on the premises of a third party (a member of the partnership). According to the controller, the CCTV was installed as a protection and to gather evidence that unauthorised people used the path. Two of the members of the partnership lodged a complaint with the Austrian DPA (DSB), claiming the controller violated their right to privacy. The DPA found the controller filmed the area to collect evidence of the path’s misuse. However, the permanent surveillance of the path to make several potential complaints was not permissible. Nevertheless, the DPA noted that the controller removed the CCTV, so there was no mandate for further actions of the DPA. The controller initiated the appeal proceedings before The Federal Administrative Court (Bundesverwaltungsgericht) against the DPA’s decision. The court upheld the appeal, overturned the DPA’s decision and rejected the complaints by the data subjects. The court examined the legitimate interest pursued by the controller. All criteria of the legitimate interest stemming from the CJEU case law was fulfilled. The controller had a legitimate interest to monitor access to the path and bring cases against people misusing it. The court found no alternative, less privacy intrusive way to supervise the path. Moreover, the legitimate interest of the controller, i.e. to prevent the use of the path by unauthorised persons, outweighed the fundamental rights and freedoms of path users.
Valstybinė duomenų apsaugos inspekcija
The data subject is an employee of the controller, the budgetary institution Klaipėda City Social Support Centre (Klaipėdos miesto socialinės paramos centras). On 2 April 2021, the controller’s Ethics Committee received a report stating that the data subject allegedly had behaved in an unethical way in the workplace environment. These conducts consisted in writing disrespectful statements about her colleagues and managers in a closed Facebook group and, more generally, having a rude attitude while working. On 6 August 2021, the data subject filed a complaint with the DPA. She argued that the investigation of the Ethics Committee infringed data protection law, as it processed her personal data without a legal basis under Article 6(1) GDPR. The data subject complained that the Committee unlawfully obtained her correspondence in the closed Facebook group. The DPA upheld the complaint. It found that the controller could not base its processing on legitimate interest under Article 6(1)(f) GDPR and that, however, it had not applied the balancing test of interests and did not assess whether the legitimate interests of the controller override the rights and freedoms of the data subject. Moreover, the DPA noted that the controller can be considered equivalent a public authority acting in the performance of their task. Therefore, according to Article 6(1) GDPR, Article 6(1)(f) GDPR cannot apply. The decision was appealed before the Vilnius Regional Administrative Court (Vilniaus apygardos administracinis teismas). On 27 February 2023, the controller’s appeal was dismissed. The court held that the act of receiving and analysing the data subject’s posts constitutes processing of personal data under Article 4(2) GDPR. Moreover, it pointed out that the processing of personal data is lawful only if it relies on one of the legal basis contained in Article 6(1) GDPR. As for Article 6(1)(f) GDPR, the court found that the controller had not proven that its alleged interest of ensuring
Court case IECC 6
In August 2022, the claimant (the data subject) was on sick leave from their work. On 29 August 2022, the plaintiff was helping their mother-in-law trim a tree at her residential place. The claimant noticed a vehicle across the street with one of its occupants filming them with a phone. The plaintiff approached the vehicle and recognized the individuals, identifying them as senior managers from their company. The claimant subsequently expressed frustration, contending that they were being filmed without their consent and outside the work environment. The following day, the claimant was summoned to a meeting in which they were suspended with pay pending an investigation. During the meeting, the plaintiff asked about the recording, and was told not to focus on the video evidence, because there were credible witnesses to the incident in question. No such investigation took place. On 06 September 2022, the claimant attended a disciplinary hearing. On 12 September 2022, they were informed of their immediate termination, which was upheld after an appeal. It was claimed that the (unlawful) recording was not relied upon during these proceedings. The data subject complained, among others, that the defendant(s) wrongfully used, disclosed or processed its confidential information without consent or lawful purpose, thereby violating provisions of the GDPR and the Data Protection Act 2018. The data subject’s claim seeks damages, including non-material damages for the related stress, financial detriment, and reputational damages, inter alia. The plaintiff also issued motions to direct the defendant to comply with their request for access to, and copy of, the recording. In response thereto, an affidavit was issued confirming that one of the senior managers neither possessed the recording nor transferred it to anyone. The Circuit Civil Court held that the defendants and its agents breached the data subject’s personal data rights, because there was a sufficient causal link be
Plaintiff 1, Plaintiff 2, and Clara Wichmann Bureau Foundation
Two data subjects wanted to register as street sex workers in the prostitution zone of the municipality Nijmegen. This registration is mandatory for offering sexual services as the General Municipal Ordinance Nijmegen (“Algemene Plaatselijke Verordening Nijmegen - APV”) prohibits street prostitution in the municipality, except in designated areas. On 22 March 2022, the municipal executive (“het college”) designated a section of a street as an area where street prostitution was permitted, provided certain conditions are met. This was the designation decree (”aanwijzingsbesluit"). The conditions included mandatory registration with the mayor for street sex workers, who had to be at least 18 years old, and could either demonstrate that they were working as street sex workers in the city since 2020, or that they utilised healthcare services for street sex workers in the city since that date. On 27 and 28 April 2022, the data subjects submitted their application for registration in the new designated area to the mayor of the municipality (the controller). On 4 July 2022, the controller told the data subjects it would reject their application, to which the data subjects submitted a statement with their views to the controller. On 1 August 2022, the controller still rejected both applications, because the data subjects failed to adhere to the conditions for the registration. On 9 September 2022, the data subjects objected to the rejections together with Bureau Clara Wichmann (“Stichting Bureau Clara Wichmann – BCW”), a legal entity advocating for women's rights and combating gender discrimination. On 10 July 2023, the controller dismissed the objection. Following this, the data subjects together with BCW filed an appeal against the controller's decision at the District Court of First Instance of Gelderland ("Rechtbank Gelderland"). The data subjects argued that the registration requirement, along with the conditions attached to it, was in conflict with the GDPR and [https://eur-lex.europa.eu/eli/dir/2006/123/oj Directive 2006/123/EC on services in the internal market (Services Directive)], which regulates the provision of services within the EU. The data subjects argued that the fact that a person works as a sex worker should be considered special personal data under Article 9 GDPR. Therefore, the registration requirement processes special categories of personal data under Article 9 GDPR, which is not allowed. Moreover, the data subjects argued that the condition imposed by the mayor, which required street sex workers to demonstrate prior work experience or healthcare service usage in the municipality since 2020 was unlawful in light of the [https://eur-lex.europa.eu/eli/dir/2006/123/oj Services Directive]. The controller argued that the registration requirement complied with the GDPR, because the data subjects explicitly consented to the processing of their special personal data under Article 9 GDPR by submitting their application. The controller further argued that the registration requirement complied with the GDPR, because there was a compelling public interest that made the processing necessary, amongst other public order and the safety and well-being of street sex workers. Admissibility of the appeal The court held that BCW's appeal was inadmissible in the data subject’s appeal, because it was not directly affected by the decisions in question. The court distinguished this case from a previous ruling where BCW was considered an interested party, emphasizing that the current case involved individual decisions affecting specific individuals rather than a broader policy affecting a general or collective interest. Review of the Registration Requirement under the GDPR The court held that the registration requirement violated the GDPR for several reasons. The court dismissed the controller's argument that the data subjects explicitly consented to the processing of their special personal data under Article 9 GDPR. The court found that an application to register as street sex worker did not equate to explicit consent because the application form did not clearly indicate that such consent was given by the data subjects. Taking into account Article 4(11) GDPR, consent could not be freely given if the data subject did not have a genuine or free choice, or could not refuse or withdraw without adverse consequences. The court thus held that by requiring registration as a condition for offering sexual services as a street sex worker, street sex workers could not refuse or withdraw their consent to the processing of special categories of personal data without adverse consequences. Thus, submitting an application to be registered as street sex workers could not be regarded as providing explicit consent to the processing of special categories of personal data under Article 9 GDPR. The court also rejected the controller’s argument that the registration was lawful as there was a compelling public interest. The court found that these objectives did not necessitate the processing of special personal data, as there were alternative ways to address public order issues and provide care for street sex working without requiring registration. Compliance with the Services Directive The court agreed with the data subjects that the requirement for street sex workers to demonstrate prior work in the municipality or use of healthcare services since January 2020 was in conflict with the [https://eur-lex.europa.eu/eli/dir/2006/123/oj Services Directive]. The court held that the registration requirement amounted to a licensing system under the [https://eur-lex.europa.eu/eli/dir/2006/123/oj Services Directive]. The court further held that the condition was unjustified because it was based on the municipality’s extinction policy, which aimed to phase out street sex work. The court found that this policy objective did not constitute an "overriding reason of general interest" under the [https://eur-lex.europa.eu/eli/dir/2006/123/oj Services Directive] and was not sufficiently substantiated by concerns for public order or safety. Conclusion The court concluded that the registration requirement was non-binding because it conflicted with the GDPR. However, the court did not declare the entire Designation Decree non-binding, particularly the part that designated the location for the red-light district. The court emphasised that the decision to open the prostitution zone without a registration requirement was a policy matter for the municipal council. Thus, the the designation of the prostitution zone itself remained valid.
Court case 14 K 870/22
The data subject is a civil servant that works at a municipality (the controller). In 2017, the data subject had a stroke that led to a longer sick leave of the data subject. Following a medical examination by the public medical officer, the controller decided to attempt to transfer the data subject to early retirement in September 2018. This attempt ultimately failed, as the data subject successfully challenged the early retirement before the Administrative Court Stuttgart (Verwaltungsgericht Stuttgart – VG Stuttgart) in November 2021 therefore remaining a civil servant. However, on 5 July 2018 the controller had already sent out a job offer to about 80 staff members. It included the information that the previous staff member (the data subject) was about to be transferred to early retirement due to his incapacity to work. On 16 February 2022, the data subject sued the controller for €20,000 in damages before the VG Stuttgart due to the disclosure of his health information and claiming that the transfer of the his file to the municipality’s lawyer was also illegal. The court found that the lawsuit was admissible and belonged before the administrative court, even though [https://www.gesetze-im-internet.de/gg/art_34.html Article 34 Basic Law (Grundgesetz – GG)] assigns all claims of official liability to the civil courts. The VG Stuttgart argued that Article 82 GDPR was not an official liability claim. The court awarded the data subject €2,500 in non-material damages. The court held that there was a violation of Article 9(1) GDPR due to the disclosure of the alleged disability for service in the job offer the controller had sent out. This was health data under Article 4(15) GDPR, because the inability to work was due to the health status. The wording “previous office-bearer” made the data subject identifiable. The disclosure was neither necessary under Article 9(2)(b) nor (f) GDPR. The court also found that the data subject had suffered a non-material damage. The data subject had claimed that he had been asked by another staff member about his health status. Furthermore, the e-mail had reached a large number of employees and he feared that the e-mail could have been forwarded to external persons. This amounted to a non-material damage of €2,500. For the calculation of the exact amount of damages, the court factored in that the information was disclosed to over 80 recipients and that it was an especially sensitive information and that, even though the transferral procedure had not been finished, the data subject was marked as not fit for service before a large group of his colleagues. The court also recognised that there was no evidence that the disclosed information were really made public or at least known to anyone outside of the administration. The staff had been informed about their duty to confidentiality under the GDPR and there was no detailed information about the data subject’s health status. Furthermore, the information was given for a factual reason, and this was to inform possible applicants that, before they could formally assume office the transferral of the former office-bearer had to be finalised. Hence, the information was not given out arbitrarily. Therefore, an even higher damage did not seem justified. However, the transfer of the file to the controller’s lawyer was not a violation because it was justified under Article 9(2)(b), (f), and (h) GDPR.
Verifiera AB
The controller, Verifiera AB, operates a database that includes court decisions pertaining to involuntary psychiatric care and care of persons with substance abuse. The controller's business operations falls within the scope of the Swedish constitutional law on Freedom of Expression (Yttrandefrihetsgrundlag - YGL) due to their publishing license ("utgivningsbevis"). The Swedish DPA (Integritetsskyddsmyndigheten - IMY) issued a reprimand and an injunction against the controller. The DPA found that the publication of health-related court decisions by the controller violated Article 9(1) GDPR, which prohibits the processing of personal data related to health. It ordered the controller to take certain measures to comply with Article 9(1) GDPR. Although [https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2018218-med-kompletterande-bestammelser_sfs-2018-218/ Chapter 1, §7 of the Swedish Data Protection Act], states that the GDPR and the implementing national law shall not apply to the extent that this would conflict, among others, with the constitutional law on Freedom of Expression, the GDPR is still applicable when sensitive data is published under [https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/yttrandefrihetsgrundlag-19911469_sfs-1991-1469/#K1 Chapter 1, §20 YGL]. [https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/yttrandefrihetsgrundlag-19911469_sfs-1991-1469/#K1 Chapter 1, §20 YGL] states: “The provisions of this Constitution shall not preclude the enactment of legislation prohibiting the disclosure of personal data # revealing ethnic origin, skin colour or other similar characteristics, political opinions, religious or philosophical beliefs or trade union membership # concerning health, sex life or sexual orientation, or # which consists of genetic data or biometric data to uniquely identify a natural person.” Thus, the DPA held that Article 9(1) GDPR is ap
Staatssecretaris van Justitie en Veiligheid (State Secretary for Justice and Security)
The data subject has an Iranian nationality and applied for asylum in the Netherlands in 2016. After two applications and two appeals, the State Secretary for Justice and Security (the controller) granted the data subject asylum on 25 August 2021 and provided the data subject with a temporary asylum residence permit. On 22 September 2021, the data subjected requested access under Article 15 GDPR to their personal data that the controller processed and stored. On 22 October 2021, the controller replied to the access request and, amongst other things, provided the data subject with an overview of the disclosures of the data subject’s personal data. This showed that the controller transmitted the data subject’s personal data to, among others, the Central Agency for the Reception of Asylum Seekers (“Centraal Orgaan opvang asielzoekers - COA”) and the Repatriation and Departure Service (“Dienst Terugkeer & Vertrek - DT&V”). The data subject then objected to the processing of their personal data (specifically personal data belonging to special categories under Article 9 GDPR), namely the sharing of those data with the COA and DT&V. The controller rejected the objection of the processing on 7 December 2021. The data subject appealed this decision at the District Court of Northern Holland (“Rechtbank Noord-Holland”), and also sought damages under Article 82 GDPR for the unlawful processing of their (special categories of) personal data. The controller argued that there was no unlawful processing of (special categories of) personal data of the data subject and that the sharing of the personal data with the COA and DT&V was necessary under Article 6(1)(e) GDPR for the performance of a task carried out in the public interest or in the exercise of official authority of these agencies. The COA's tasks include providing guidance and accommodation to asylum seekers. The controller argued that this task also requires the processing of special categories of personal data under Article 9 GDPR to identify at the earliest possible stage whether the asylum seeker is a vulnerable person and needs specific support and guidance. The data subject argued that the sharing of personal data for the purpose of carrying out its duties and providing appropriate support could also be achieved by sharing no or less personal data with the COA. The controller could have also shared with the COA that the subject may need appropriate support and leave the COA to inquire what support is desired from the data subject to leave the data subject in control of what information it wants to share with the COA. The DT&V's task include implementing the return policy by customising a careful and humane departure strategy. The controller argued that it is therefore therefore of great importance that the DT&V is involved at the earliest possible stage, receiving as much (complete and verifiable) information about the foreign national as possible. Every piece of information, including special categories of personal data under Article 9 GDPR, can be important for deporting a foreign national efficiently and effectively. The data subject argued that the sharing of (sensitive) personal data with the DT&V even before a rejection decision becomes irrevocable would be unnecessary and premature. The data subject also argued that sharing of personal data with the DT&V after the data subject's asylum application was granted, was wrong as the DT&V had nothing to do with the data subject from then on as they were no longer under an obligation to leave. Unlawful processing The court found that the controller shared a large quantity of documents with the COA and the DT&V that contained both “normal” and special categories of personal data under Article 9 GDPR of the data subject. This included judgements, court rulings, a medical opinion and records of hearings. The court stated that it could follow that the tasks assigned to COA and the DT&V can be regarded as a task of (substantial) public interest as referred to in Article 6(1)(e) GDPR and Article 9(2)(g) GDPR. However, it could not understand why it was necessary for the controller to share the (special categories of) personal data with the COA and the DT&V in its entirety. The court held that the purpose for which the controller processed this data could be reasonably achieved in another, less detrimental manner. The court further held that in view of the principle of data minimisation under Article 5(1)(c) GDPR, the controller failed to substantiate why the COA’s purpose of careful reception of asylum seekers and DT&V’s purpose of the departure of aliens not eligible for residency, could only be achieved by sharing these documents with the data subject's personal data in its entirety. The court specifically took into account the sharing of personal data with the DT&V, stating that it could not understand why the sharing was necessary even before it was irrevocably established that a foreign national must leave the Netherlands. With regard to the sharing of the special personal data under Article 9 GDPR, the court held that it appeared nowhere that the controller weighed up whether the sharing of those data was proportionate in relation to the objective pursued by the sharing of those data, whether the right to the protection of personal data was respected and whether it was necessary to take appropriate and specific measures to protect the fundamental rights and interests of the data subject, as required under Article 9(2)(g) GDPR. The court therefore held that controller did not sufficiently observe the safeguards for the data processing of both 'ordinary' (Article 6 GDPR) and special categories of personal data (Article 9 GDPR). The controller’s sharing of large quantity of documents containing the data subject’s (sensitive) personal data with COA and DT&V was therefore unlawful, as there was no sufficient legal basis for this under Article 6 GDPR. This also violated the principle of data minimisation under Article 5(1)(c) GDPR. Non-material damages The court found that the data subject was entitled to compensation for non-material damages. The controller violated Articles 5, 6 and 9 GDPR and thereby violated the data subject’s right to privacy. The court found that the data subject could not substantiate the amount asked for non-material damages. Considering the circumstances of the case, including the nature, duration and seriousness of the infringement, the court set the amount of non-material damages to €500. The court saw no reason to award a higher amount in view of the fact that the sensitive personal data ended up with a group of professionals, who have a duty of confidentiality by virtue of their position, and the duration of the breach. Conclusion Thus, the court found that the controller violated Articles 5, 6 and 9 GDPR by unnecessarily sharing the data subject's personal data in its entirety with the COA and the DT&V. The court therefore ordered the controller to pay €500 in non-material damages to the data subject, and to pay the data subject’s costs of € 1.750 for the legal proceedings.
Meta Ireland
On 31 December 2022, the Irish DPA (“DPC”) prohibited Meta Ireland from using a contract under Article 6(1)(b) GDPR as a legal basis for behavioural advertising in connection with the Facebook and Instagram services. Meta Ireland was required to bring its processing activities related to behavioural advertising into compliance with Article 6(1) GDPR within three months. Meta Ireland responded by changing its processing basis to legitimate interest under Article 6(1)(f) GDPR. On 5 May 2023, the Norwegian DPA (“Datatilsynet”) requested under Article 61(1) GDPR the DPC to introduce a temporary ban on Meta Ireland’s processing of personal data for purposes related to behavioural advertising. The Datatilsynet held that legitimate interest was not a proper legal basis, either. The DPC did not comply with the request. On 14 July 2023, the Norwegian DPA issued a temporary ban themselves against the controllers Meta Ireland and Facebook Norway under Article 66(1) GDPR in combination with Article 58(2)(f) GDPR (see summary of the DPA's decision here). This only concerned processing activities in Norway. The DPA also stated its intention to request an urgent binding decision from the EDPB under Article 66(2) GDPR. On 3 and 4 August 2023, Meta Ireland and Facebook Norway applied for a temporary injunction against the DPA's decision, demanding that the DPA would be prohibited from implementing the decision. The Oslo District Court issued a ruling on 6 September 2023 and concluded that there was no probable cause for temporary injunction and dismissed the cases. The court also found that the conditions had been met under Article 66(1) GDPR for making an urgent binding decision. The deadline for compliance with the ban was 4 August 2023, however, Meta Ireland and Facebook Norway did not comply. Therefore, on 7 August 2023, the DPA issued a penalty of €86,992.56 (NOK one million) per day for failure to comply with the decision of 14 July 2023 based on §29 of the Norwegian Person
Court case 24 O 1624/23
The data subject signed a contract with the controller for telecommunications services. On 26 June 2023, the data subject received information about a data transmission. The data subject objected to the disclosure by the controller of his personal data included in a contract to a legal entity other than the parties to the contract. The controller registered contract data to a legal entity other than the parties to the contract, supporting a joint fraud control system for the credit industry. The controller shared the personal data (name, address, date of birth, dates of the start and end of a telecommunications contract, contract number and reporting feature) without explicit consent of the data subject. The data subject initiated legal proceedings and was seeking damages, in the form of non-material compensation, for a data transmission without consent. The Regional Court Memmingen dismissed the case on the grounds that the data subject had failed to prove the existence of any present or future damage that was reasonably likely to occur. The prevention of fraud may constitute a legitimate interest of the controller within the meaning of Article 6(1)(f) GDPR.
Austrian Data Protection Authority
The data subject and the controller both worked as nurses at the same hospital, on different wards. Over ten years before the events in question, the data subject had been hospitalised as a patient on the ward where the controller worked as a nurse. The controller's daughter, a school classmate of the data subject at the time, had visited her in hospital and the data subject's hospitalisation had briefly been discussed once in a social-skills class at school, without any diagnosis being disclosed. The data subject only told her closest friends about the hospitalisation itself. The data subject was later employed as a nurse at the same hospital, on a different ward, from October to April of a subsequent year. She and the controller belonged to a shared WhatsApp group used by both wards. Around Christmas, the controller's daughter recognised the data subject from her WhatsApp profile picture and reminded the controller that the data subject had once been her patient, the controller herself had not previously made this connection. The data subject resigned from her position, with her last working day followed by sick leave through the end of her notice period. On her first day back from holiday, the controller, deputy head of her ward, discussed recent events with the ward manager, including the data subject's resignation. In the course of this conversation, the controller mentioned that her daughter had gone to school with the data subject and asked the ward manager whether she had known that the data subject had been hospitalised on the relevant ward over ten years earlier. That same day, the ward manager told the data subject that staff at the hospital were aware of her earlier hospitalisation, intending to prepare her for the possibility that colleagues might raise it. The data subject later learned, from the site manager, that it was the controller who had disclosed this information to the ward manager. The data subject alleged that this disclosure led to her being bullied in the workplace. The controller denied any obligation on employees to disclose past hospitalisations to the employer and stated she had no other motive for the disclosure. The data subject lodged a complaint with the Austrian DPA, alleging a violation of her right to secrecy. The DPA upheld the complaint, finding that although the GDPR did not directly apply to this oral disclosure, the national constitutional right to secrecy under Section 1 DSG did apply, that the disclosed health data warranted heightened protection and that the controller had not shown sufficiently weighty grounds to justify the disclosure. The controller appealed to the Federal Administrative Court, arguing that the information was already publicly available (since it had once been mentioned at school) and that the disclosure was justified as processing of manifestly public data, as processing by a professional subject to confidentiality obligations, or as necessary for assessing an employee's fitness for work. The court dismissed the appeal and confirmed the DPA's decision in full. First, the court held that the GDPR's substantive scope did not apply to this case, since it concerned a purely oral disclosure of personal data, not automated or file-based processing. The applicable standard was instead the national constitutional right to secrecy under §1 DSG, interpreted in light of GDPR principles. The court noted that the disclosed information, the fact of a past hospitalisation, qualified as health data under Article 4(15) GDPR, given the broad interpretation the CJEU applies to that concept. Second, the court held that the information was not "generally available" within the meaning of §1(1) DSG, which would have excluded any protectable secrecy interest. It reasoned that data are only "generally available" if accessible to an indeterminate group of people, not merely to a limited circle of confidants. Since the data subject had only shared her hospitalisation with a small group of close friends and even the one classroom discussion of it involved only a defined group of classmates (not the public), the general-availability exception did not apply and the data subject retained a protectable secrecy interest. Third, addressing the controller's justification arguments in turn, the court held Article 9(2)(e) GDPR (data manifestly made public by the data subject) did not apply, for the same reasons the data was not "generally available“, Article 9(2)(a) GDPR (explicit consent) did not apply, since no explicit consent to this specific disclosure had ever been given and Article 9(2)(h) GDPR (processing necessary for assessing an employee's working capacity, among other health-related purposes) did not apply, because the disclosure was not shown to be necessary. The employer had no policy of taking such hospitalisations into account, the data subject had no duty to disclose them and no concrete workplace measures were linked to the disclosure. The court emphasised that health data attracts a particularly high level of protection, meaning that even if the controller's interest had been considered on a par with the data subject's, this would not have been sufficient to justify disclosure, given that the data subject was already leaving employment within a short period, her interest in confidentiality clearly outweighed any interest of the controller. The court accordingly confirmed that the controller had violated the data subject's right to secrecy under §1 DSG and declared an appeal on points of law (Revision) inadmissible, since the case turned on an individual assessment of undisputed facts and raised no question of fundamental legal importance.
Court case W256 2246230-1
The controller was responsible for a multi-partner customer loyalty programme. Customers of participating retail shops could register as members, collect points based on their purchases and subsequently redeem them to receive various "exclusive" benefits and discounts. For participation in the programme, the controller collected personal data from the customers. Only the data of customers who gave consent during the registration process were processed to create profiles of the members about their purchasing behaviour for the purpose of personalised advertising. This was not mandatory for the conclusion of the contract. Consent was obtained by signing up via a physical brochure at the partner shops or on the website. The physical brochure obtained consent through a signature field at the end of the registration form, slightly separated from the text “declaration of consent”. To the left of this, at the same height, was the mandatory field "Date" required for registration. The field for the signature was not marked with a "*" meaning "mandatory field". The website obtained consent under the heading "Enjoy your own personal benefits" with a tick box yes and no to the processing of data to benefit from exclusive benefits and promotions. After the Supreme Administrative Court (“Verwaltungsgerichtshof – VwGH”) annulled part of the DPA’s decision against the controller, the DPA started anew the respective part of the procedure against the controller. In that decision, the DPA held that the way the controller obtained consent on its website and on their physical registration brochure did not meet the requirements under Article 5(1)(a) GDPR in conjunction with Article 7(2) GDPR. As a result of the lack of consent, the controller could not base its processing of personal data on consent under Article 6(1)(a). Thus, DPA held that the controller also violated Article 6(1) GDPR in conjunction with Article 5(1)(a) GDPR. The DPA fined the controller €2 million under Article 83(
Datatilsynet
The controller, an employer, suspected that an employee had committed embezzlement and carried out an inspection of the employee’s mailbox. After discovering e-mail exchanges between the employee and another employee (the data subject), the controller also suspected that the data subject contributed to a possible embezzlement and accessed their mailbox as well. Access to the data subject’s mailbox was carried out by the controller with the assistance of a third party and a data processor. The inspection of the e-mails showed the data subject had breached their duty of loyalty in their employment by sharing insider information and other confidential information. The data subject was then dismissed. On 12 July 2020, the data subject lodged a complaint at the Norwegian DPA (“Datatilsynet”). The data subject argued that the controller had no legal basis for conducting an inspection and disclosing their personal data. The DPA found that the controller failed to comply with the accountability principle under Article 5(2) GDPR as the controller did not submit documentation of the legal basis for conducting the inspection of the data subject’s mailbox. The DPA held that the controller had a legitimate interest to inspect the data subject’s mailbox under Article 6(1) GDPR and Section 2 of the Norwegian E-mail Regulations (“[https://lovdata.no/dokument/LTI/forskrift/2018-07-02-1108 e-postforskriften]”). Under the E-mail Regulations, an employer has the right to access an employee’s mailbox in the event of "reasonable suspicion that the employee's use of a mailbox or other electronic equipment results in a serious breach of the obligations arising from the employment relationship or may provide grounds for termination or dismissal". However, the DPA found that the controller did not process the data subject’s personal data with sufficient transparency under Article 5(1)(a) GDPR and Article 14 GDPR, as the data subject was not informed about the processing. The DPA stated that
Court case W298 2255416-1
The data subject's partner was observed by a professional detective (the controller), because the partner's employer doubted the partner's medical condition as they were on sick leave. The data subject was listed as "target person 2" in the controller's observation report and was therefore also photographed 4 times (sometimes alone) by the controller on their private property. The photos and reports were send to their partner's lawyer and to the labour court without the data subject's consent. Therefore, the data subject lodged a complaint against a professional detective (the controller) with the Austrian DPA ("Datenschutzbehörde - DSB"). The controller argued they had to observe the data subject in addition to the data subject's partner to fulfill the assignment. The controller did accidentally referred to the data subject as the "target person" instead of a "witness". The controller however stated that no sensitive data was collected about the data subject and that the photographs were not intended to be used as evidence. The data subject responded to this claim, arguing that the photographs were unnecessary, as a basic report would have sufficed for such investigative purposes. The data subject emphasised that the photos were taken on the weekend on private property without their permission. The controller further argued that the data subject's full name was obtained from a land registry search, and that the photographs were of poor quality, and therefore the data subject was not clearly identifiable. Moreover, the controller argued that such photographs do not constitute sensitive data, emphasising that the data subject also had some photos on social media. The data subject responded to these claims, stating that the photographs were not blurry and that they had never been and would never be called be as a witness in their partner’s proceedings. Moreover, the fact that the data subject had photos on social media did not allow the controller to take pictures
Court case VI ZR 370/22
The data subject had a contract with a bank (the controller) from 1986 to 2000. Another bank informed the data subject that the controller had a claim against the data subject based on a Schufa (credit ranking agency) entry. Because of this, the data subject could not get a loan. Subsequently, the data subject requested access from the controller about the type and the scope of the personal data stored about the data subject. The controller objected to this request, stating that the request was too extensive and provided information to the extent that it considered was lawful. The data subject argued that this information was incomplete and asked again for access. The controller refused to provide further information. The data subject then filed a lawsuit at the District Court of Seligenstadt (Amtsgericht Seligenstadt - AG Seligenstadt) against the incomplete answer to the access request and claimed non-material damages. The District Court then ordered the controller to provide access under Article 15(1)(a) - (h) GDPR, and additionally the means of data processing, the media on which the data was stored, the frequency of deletion of the data subject's personal data, each location where the data was stored, whether a cloud was used for storage, which data was deleted in the last twelve months, the technical and organisational measures for processing and profiling of the data subject's personal data, how security was ensured, which data threats occurred, and the name of the data protection officer (DPO). However, the District Court did reject the compensation for non-material damages. The data subject appealed the decision at the Regional Court of Darmstadt (Landgericht Darmstadt - LG Darmstadt) and requested the Regional Court to order the controller to provide complete information under Article 15 GDPR, and reformulated its request to include all notes and assessments on the data subject, the algorithms used by the controller to evaluate the data, all processors
Servicekosten Consultancy V.O.F.
The data subject had a business credit card issued by the controller. In 2021, the controller asked the data subject to identify themselves online by taking a picture of the ID and then taking a selfie of themselves. The data subject wanted to upload a copy of the ID with a watermark on it for fraud prevention purposes (saying, for example: “copy for [the controller]”). The controller, on the other hand, rejected this copy, arguing that the data subject should upload a copy without any writing on it. Therefore, the data subject brought legal proceedings before the District Court of Amsterdam (Rechtbank Amsterdam - Rb. Amsterdam), seeking the court to declare that the controller cannot request an ID copy without the watermark and that the controller should not block the credit card. On 20 April 2022, the District Court of Amsterdam dismissed the data subject’s request. The data subject appealed the decision before the Court of Appeal of Amsterdam (Gerechtshof Amsterdam - GHAMS). They argued that the provisions of the [https://wetten.overheid.nl/BWBR0024282/2022-11-01 Money Laundering and Terrorist Financing Prevention Act (Wet ter voorkoming van witwassen en financieren van terrorisme – Wwft)] do not require that the identification process is performed in the way envisaged by the controller. Therefore, the legal basis provided for by Article 6(1)(c) GDPR cannot be used, since there is no legal obligation to require this kind of identification. Moreover, they argued that the controller should not store the copy of the ID. The controller pointed out that the electronic technique used in the scanning of the ID has currently the highest reliability in the field of authentication and that the use of this technique enables it to recognize high value forgeries of IDs better than with the use of persons trained and educated for this purpose. First of all, the court noted that the Wwft does not prescribe a way in which the identification should be conducted. Moreover, it pointed out that neither the GDPR nor the Wwft confer the data subject a right to a non-online identification. Secondly, the court noted that [https://eur-lex.europa.eu/eli/dir/2015/849/oj/eng Article 13(1)(a) Directive 2015/849] allows the controller to perform the identification through electronic means. Thirdly, the court agreed with the controller’s argument. It held that, since there is an added value in using this ID scanning tool, this use may be considered necessary within the meaning of Article 6(1)(c) GDPR in order to comply with its obligation to conduct a customer due diligence under the Wwft. The court pointed out that, due to the large amount of customers, the controller has a legitimate interest in organizing the identification and verification procedure as uniformly as possible. Fourthly, as for the retention issue, the court noted that the controller is obliged to keep a copy of the proof of identity whose authenticity it has verified by means of the scan pursuant to [https://wetten.overheid.nl/BWBR0024282/2022-11-01 Article 33(1) Wwft]. However, the court highlighted that the controller is obliged to store this data securely. Therefore, the court dismissed the appeal and upheld the judgement of the District Court of Amsterdam.
First complainant (data subject)
The data subject participated in a hunting event on 3 November 2018. During the event, another person (the controller) filmed and photographed the hunt and the data subject in order to document hunting practices and publish the material online. At the time of the recording, the data subject received no information about the the identity of the controller, the purposes of data processing, or the recipients of the data (Article 13 GDPR). On 6 November 2018, the data subject submitted an access request under Article 15 GDPR. He asked about the purposes of the processing, the categories of data processed, recipients, storage periods, legal basis, and requested a copy of all personal data concerning him. The controller did not respond. The data subject then filed a complaint at the Austrian DPA on 09 January 2019. The controller argued before the Austrian DPA that the recordings served journalistic purposes and therefore fell under the Austrian media privilege in § 9 DSG. He claimed that he acted as a form of “citizen journalist” and that complying with access requests would obstruct investigative journalism. The DPA rejected the argument that the media privilege applied. It nevertheless dismissed the data subject's complaint concerning Article 13 GDPR because it considered that the data subject already knew enough about the controller and the intended publication. However, the DPA upheld the complaint concerning Article 15 GDPR and ordered the controller to answer the access request. Both parties appealed to the Federal Administrative Court. First, the court held that the controller processed personal data within the meaning of Article 4(1) and Article 4(2) GDPR by recording photo and video material showing the data subject during the hunting event. Second, the court held that the Austrian media privilege in § 9 DSG did not apply. The court found that the controller was neither a media undertaking nor a media service within the meaning of Austrian media law. The controller published material on a private Facebook account and lacked the minimum organisational and economic structures required for a media enterprise. The court also rejected an extension of the exemption to “citizen journalists”. It noted that the Austrian legislature had intentionally drafted § 9 DSG narrowly and that an expansive interpretation would contradict the wording and legislative intent. The court further held that even a broader interpretation of § 9 DSG would not exempt the controller from complying with Article 15 GDPR because answering an access request would not undermine freedom of expression or journalistic activity in the circumstances of the case. Third, the court confirmed that the controller violated Article 15 GDPR by failing to answer the access request. Fourth, the court overturned the DPA’s finding regarding Article 13 GDPR. The court held that the controller violated Article 13 GDPR because he failed to provide the required information at the time he collected the image data. The court rejected the argument that the data subject already possessed the relevant information under Article 13(4) GDPR. The court also clarified that a later disclosure of information during proceedings could not retroactively remedy a violation of Article 13 GDPR. Finally, the court dismissed the controller’s appeal, upheld the access request by the data subject, and amended the decision to additionally establish a violation of Article 13 GDPR.
AS Ühisteenused
The data subject brought an action against AS Ühisteenused, a company providing parking services ('controller 1'). The company that made a claim against the data subject arising from a contractual penalty in the amount of €79,57 for a car parking violation. According to a debt notice of 29 April 2022 sent to the data subject, the violation occurred on the 17 April 2019 and the penalty was to be paid by 2 May 2019. The data subject sold the car on 27 August 2019, and was not aware of AS Ühisteenused's parking regulations or the alleged violation on 17 April 2019, as they did not personally use the car. On 25 March 2022, AS Ühisteenused and Julianus Inkasso OÜentered, a debt collection company (‘controller 2’) entered into an agency agreement on the basis of which and Julianus Inkasso OÜ was authorized to represent AS Ühisteenused in the recovery of the debt owed by the data subject. As two controllers jointly determined the purposes and means of processing, they became joint controllers under Article 26 GDPR. As a result, the data subject’s debt was published on the website taust.ee (eng translation: background.ee) by Julianus Inkasso OÜ. On 29 May 2022, the data subject requested both controllers to stop processing their personal data and delete them from the website. According to [https://www.riigiteataja.ee/akt/106072023098 §146 of the Estonian Civil Code], the expiry date for the request arising from a violation of the law is three years. Since the penalty was to be paid by 2 May 2019, the three-year deadline expired on 3 May 2022 and the claim was therefore time-barred. Therefore, the data subject asked a court to order the controller 2 to delete the debt information linked to them and to pay €270 by way of damages for per-litigation legal costs. In its reply, controller 1 stated that they have a right to disclose this type of data. In particular, under [https://www.riigiteataja.ee/akt/104012019011 § 10(2)(5) of the Estonian Data Protection Act], the transfer of personal data to a third party in connection with debt-relationship is permitted for a period of 5 years after the breach of an obligation. Additionally, according to [https://www.riigiteataja.ee/akt/122032024007 § 146(4) Estonian Civil Procedure Code], the expiry date for the claims is 10 years if the person responsible violates his or her duties intentionally. In this case, the debt notice was published 3 years after the breach occurred. The data subject argued that the controller 1 had no legal basis to process data subject’s personal data because the limitation period had expired. Therefore, it is neither lawful nor fair to disclose the claimant's personal data after the claim itself was time-barred. The first instance court gave its decision, which was appealed. The decision adopted by the first instance court was in part confirmed by the appeal court as follows: The court found that the controller's claim concerning the debt was time-barred and ordered controller 1 to pay related costs of the proceedings. On the other hand, and as far as the GDPR is concerned, the court ordered controller 2 to delete the data subject’s data from its website. Regarding the publication of the data subject’s debt on the website taust.ee, the court found that under Article 10(1) of the Estonian Data Protection Act, such processing is permitted for the purpose of assessing the creditworthiness of the data subject or for any similar purpose. However, the controller must verify the accuracy of the transferred data and the legal basis for such transfer. In addition, the Estonian law provides that transfer of this data to a third party cannot be permitted if such transfer would cause excessive damage to the rights or freedoms of the data subject, nor if more than five years have elapsed since the breach of the obligation. This constitutes a legitimate interest under Article 6(1)(f) GDPR. Although the 5-years period had not elapsed, yet, the court performed a balance between the interest of the controllers and the fundamental rights of the data subject. The court took the view that the controller 1 did not take active steps to obtain the debt within the limitation period in a sufficiently justified and timely manner to allow the disclosure of the data subject's debt after three years. The court stated that for a small debt of €79.57, if the creditor finds legal action too costly or complex, or fails to act within the limitation period, the creditor's interests in processing the data under Article 6(1)(f) GDPR do not outweigh the data subject’s interest in having the data deleted. The controllers should have complied with the data subject’s request to delete their personal data. All in all, the court found a breach of Article 6(1)(f) GDPR as the data subject personal data related to its time-barred debt were unlawfully disclosed. The controller 1 is ordered to pay related costs of the processing. The court also ordered the controller 2 to delete the data concerning the data subject’s debt from its website and pay the data subject €200 for damages incurred from per-litigation costs.
Person pretending to be the data subject
On 2 May 2023, a person identifying themself under the name of the data subject lodged a complaint with the DPA against a controller, a court. This complaint alleged that the controller had not provided information as required by Article 13 and Article 14 GDPR. On 24 January 2024, the data subject filed an inactivity suit against the DPA on the same matter, requesting access to the administrative file. In a procedural order on 25 January 2024, the court requested the alleged data subject to provide proof of their identity within two weeks as there were doubts about whether the person acting in the case was in fact the data subject. On 6 February 2024, a submission arrived under the data subject’s name with a declaration of personal and economic circumstances and other documents, noting the data subject was unable to attend due to illness. A follow-up order on 9 February 2024 reminded the data subject of the identity requirement and sought justification for why access to the file should be transmitted in print or electronic form. No further response was received and no evidence of identity was provided. First, the court found that the person acting as the data subject had not demonstrated that they were the person affected by the underlying complaint procedure towards the supervisory authority. The court noted numerous indicators suggesting that the person acting in the procedure might not be the data subject, including failure to respond to repeated requests to prove identity, absence from the hearing, failure to provide requested medical evidence and personal/economic declarations. The court also referenced similar earlier cases by the same person (like 29 K 8881/22) where identity doubts had arisen. Because the person continued to press cases without establishing identity, the court stated it would in future simply file such claims rather than decide them. As a result, the objective and subjective elements of a legal interest in pursuing the alleged claim coul
CJEU case C-740/22 Endemol Shine Finland
A data subject participated in a competition organized by Endemol Shine Finland. The latter made an oral request to the Etelä-Savon käräjäoikeus (District Court, South Savo, Finland) for information on possible ongoing or completed criminal proceedings concerning the data subject, for the purpose of clarifying their criminal record. The district court refused the request. Following this, Endemol Shine Finland brought an appeal against the judgement before the Itä-Suomen hovioikeus (Court of Appeal, Eastern Finland, Finland). The latter stayed the proceedings and referred three questions to the CJEU: # Does an oral transfer of personal data constitute processing of personal data within the meaning of Article 2(1) and 4(2) GDPR # Can public access to official documents allow information on criminal convictions or offences to be obtained from a court’s register without restriction when the request is made orally? # Is it relevant whether the person requesting the information is a company or a private individual? On the first question: Article 4(2) GDPR defines “processing” as: any operation or set of operations which is performed on the personal data or on sets of personal data, whether or not by automated means. The Court determined that the use of “any operation” in this definition is intended to give the concept of “processing” a broad scope, which is corroborated by the non-exhaustive nature, expressed by the phrase “such as”. The Court added that Article 4(2) GDPR does not lay down any condition as to the form of processing meaning that the concept of processing covers the oral disclosure of personal data. The question still arose as to whether the oral disclosure of personal data falls within the material scope of the GDPR. Article 2(1) GDPR provides that the GDPR applies to the processing wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system. Article 4(6) GDPR defines a “filing system” as: any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis. The oral disclosure of personal data constitutes processing other than by automated means. Therefore, the Court indicated that the data of that processing must form part or be intended to form part of a filing system in order for that processing to come within the material scope of the GDPR. In the present case, the Court held that it was clear that the data requested by Endemol Shine Finland Oy were contained in a “court’s register of persons” which constituted a filing system within the meaning of Article 4(6) GDPR. On the second and third questions: The Court pointed out that any processing of personal data must (i) comply with the principles relating to the processing of personal data and (ii) in order to comply with principle of lawfulness laid down in Article 5(1)(a) GDPR, satisfy one of the conditions listed in Article 6 GDPR (see [https://gdprhub.eu/index.php?title=CJEU_-_C-439/19_-_B_v._Latvijas_Republikas_Saeima C-439/19] and [https://gdprhub.eu/index.php?title=CJEU_-_C%E2%80%91634/21_-_SCHUFA C-634/21]). The Court found that the oral disclosure of the public data relating to criminal convictions may fall within Article 6(1)(e) GDPR, under which processing is lawful if and to the extent that it is “necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. Article 10 GDPR makes the processing of data relating to criminal convictions and offences subject to additional restrictions: under said provision, the processing of such data shall be carried out only under the control of an official authority, unless it is authorized by Union or Member State law providing the appropriate safeguards for the rights and freedoms of data subjects’. The Court considered that the GDPR does not preclude personal data being disclosed to the public if the disclosure is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, within the meaning of Article 6(1)(e) GDPR, even where the data related to criminal convictions and offences. In order to determine (i) whether public disclosure of personal data relating to criminal convictions is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, within the meaning of Article 6(1)(e) GDPR and (ii) whether the legislation authorising such disclosure provides for appropriate safeguards for the rights and freedoms of data subjects, the Court indicated that the judge must take into account the seriousness of the interference with the fundamental right to respect for private life and to the protection of personal data caused by that disclosure. Regarding the seriousness of the interference with those rights, due to the sensitivity of data relating to criminal convictions and offences, the processing of such data may constitute a particularly serious interference with the fundamental rights to respect private life and to the protection of personal data. The Court adds that this data relates to behaviour that gives rise to social disapproval and is liable to stigmatise the data subject (see [https://gdprhub.eu/index.php?title=CJEU_-_C-439/19_-_B_v._Latvijas_Republikas_Saeima C-439/19]). The Court found that in the light of the sensitivity of data relating to relating to criminal convictions and of the seriousness of the interference with the fundamental rights of data subjects to respect for private life and to the protection of personal data, which is caused by the disclosure of such data, those rights prevail over the public’s interest in having access to official documents. For the same reason, the right to freedom of information under Article 85 GDPR cannot justify the disclosure to any person who requests personal data relating to criminal convictions. Therefore, the Court held that Article 6(1)(e) and Article 10 GDPR preclude data relating to criminal convictions contained in a court’s filing system from being disclosed orally to any person for the purpose of ensuring public access to official documents if the person requesting the disclosure does not establish that they have a specific interest in obtaining said data. The Court added that it is irrelevant whether that person is a commercial company or a private individual.
Datatilsynet (DPA)
NAV, the Norwegian Labour and Welfare Administration, is a government agency that collaborates with local municipalities to provide a unified access to public labor and welfare services. Its primary functions include promoting employment and ensuring financial and social security. NAV administers a significant portion of the state budget and is one of the country's largest employers with about 22,000 employees. Nearly all citizens of Norway are in contact with NAV at some point of their life. NAV, in a letter to the data subject, admitted that it had unlawfully read his case files, equaling a violation of confidentiality. This formed the basis of the original complaint (Article 77 GDPR), which was declined by the DPA on the following basis: The Norwegian DPA Datatilsynet argued it is not the competent authority to assess the legality of isolated access to individual case files, and the potential violation of NAV employees' obligation to confidentiality. PVN related this appeal to a larger DPA investigation in September 2023 of NAV's insufficient logging, access and log controls. (Datatilsynet (Norway) - 23/00708). On 6 February 2024, PVN unanimously decided to uphold the DPA's decision not to further investigate this case. PVN underscored that this case does not concern the lawfulness of processing under Article 6 GDPR or the processing of special categories of personal data under Article 9 GDPR. Rather, the crux is whether one of the controller's employees had a valid reason to access a particular case file. PVN further argues that isolated incidences of "unnecessary" access to case files do not necessarily amount to a violation of Articles 24 and 25 GDPR, thereby not resulting in any corrective measures under Article 58(2) GDPR.