GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Court case 4 S 1/21
In April 2019, the data subject received an advertising email to his professional email address in which a training course organised by the controller was advertised. The data subject had neither ordered this advertisement nor otherwise consented to its receipt. He objected to such mailings by email and set the controller a deadline of 30 May 2019. In June 2019, the controller sent the data subject another advertising email for this event. The data subject started a legal action claiming that the controller had unlawfully obtained his email address, as it was neither generally accessible nor communicated by him. In January 2021, the District Court of Heidelberg (AG Heidelberg) partially granted the action. It ordered the controller to cease and desist further advertising emails and to provide the information requested by the data subject on his personal data and otherwise dismissed the action with regard to the requested damages for pain and suffering. It held that a claim for damages for pain and suffering pursuant to Article 82(1) GDPR did not exist, as the data subject had not suffered any noticeable disadvantage and no objectively comprehensible impairment of personal interests of a certain weight as a result of receiving the two advertising emails. The Regional Court of Heidelberg awarded the data subject damages under Article 82 GDPR in the amount of €25. The court held that the data subject suffered damages because he had to deal with the unsolicited advertising emails of the controller, determine their origin, seek information from the controller by means of a letter and delete the unsolicited emails. An external effect of the infringement affecting the data subject in the sense of a risk of damage to his reputation or profession or a discriminatory effect towards third parties was not apparent. In order to compensate for the impairments suffered, the court considered the payment of €25, similar to the usual lump sum for expenses in traffic accidents for the circumstances and expenses in connection with the settlement of the claim, to be appropriate. The court further announced that the data subject did not suffer any further damage - regardless of whether it was material or immaterial - so that there was no further claim.
Court case 10 C 4.20
In June 2015, an insolvency administrator requested tax information of an insolvency debtor from a tax office. They did so in order to examine insolvency claims, invoking the Freedom of Information Act of the State of North Rhine-Westphalia. The tax office rejected the application with reference to the obligation of tax secrecy. The insolvency administrator successfully challenged the rejection before the lower administrative courts, which was in turn challenged by the tax office. In the meantime, the General Tax Code (Abgabenordnung - AO) was amended due to the entry into force of the GDPR. In particular, the AO now contains various grounds for exclusion of existing claims for access to information under the Freedom of Information Acts and the GDPR. Due to the questions of EU law raised by the case with regard to Article 23(1)(e) GDPR and Article 23(1)(j) GDPR, the BVerwG had suspended the proceedings and made a reference for a preliminary ruling to the CJEU. The CJEU (Case C-620/19) declared that it had no jurisdiction in view of the fact that the present case concerns legal entities to which the GDPR does not apply. After the proceedings resumed, the tax office claimed that § 32e and § 32c (1) AO would constitute a restriction on the requirement to provide access to information to the insolvency administrator. § 32e AO would amount to a Rechtsgrundverweisung. This means that since the insolvency administrator is not the data subject, the conditions for the right to access under Article 15 GDPR are not met, and § 32c (1) AO would constitute a permissible restriction on the right to information within the scope of the GDPR, as provided for by Article 23 GDPR. The BVerwG held that the insolvency administrator had no right to access of information of data from tax authorities. The court came to the conclusion with a Rechtsfolgenverweisung: § 32e AO extends the restrictions on the right to information provided for in Sections § 32a to § 32d AO under Article 15 GDPR to claims for access to information arising from the freedom of information laws of the Federal Republic of Germany or the Länder by means of a reference to the legal consequences. Also a data subject's right to information under Article 15 GDPR does not exist vis-à-vis a tax authority, insofar as the provision would interfere with the tax authority's assertion, exercise or defense of civil law claims within the meaning of Article 23(1)(j) GDPR. The BVerwG decided that Article 23(1)(j) GDPR, which enables national provisions that restrict rights of data subjects or information obligations if these provisions help to enforce civil claims, also covers the enforcement of civil claims by public authorities. This is also confirmed by the objective of Article 23(1)(j) GDPR to guarantee the enforcement of civil law claims, which suggests that the provision is an opening clause also in favor of public authorities. The special provisions that may exist in national law on information and disclosure obligations for the purpose of determining evidence should remain unaffected by the provisions of data protection law.
Court case Ra 2020/04/0187
The controller is an address publisher and direct advertising company that operates a data application in order to provide advertisers with personal data for targeted marketing measures. In 2019, the Austrian Data Protection Authority (DSB) initiated an ex officio investigation against the controller, following media reports about the alleged sale of personal data, in particular information about the political affinity of individual persons. Based on the findings, the DSB issued a fine of €18,000,000. The natural persons responsible for the infringements belonged to the economic unit formed by the controller as a legal person. Therefore the infringement was attributed to the controller. The controller appealed to the Federal Administrative Court (BVwG), arguing that it was not sufficient for a legal person to have committed a criminal offence for a fine to be imposed on it under the GDPR. As a legal person that cannot act on its own, the actions of a natural person must also be attributed to it but the DSB had omitted this attribution. The BVwG agreed with the controller's reasoning. Since the DSB had not named the natural person whose breach of the GDPR was to be attributed to the controller, the DSB's decision proved to be unlawful. The DSB filed an extraordinary official appeal against this decision with the Austrian Supreme Administrative Court (VwGH). It referred to the pending case of the Higher Regional Court of Berlin (KG Berlin) before the Court of Justice of the European Union (CJEU) (Case C-807/21) where the question at issue - as in the case at hand - is whether the supervisory authority must record and name those natural persons who are responsible for the infringement in order to enable attribution to the legal person, or whether this is not necessary. The DSB therefore requested to refer the question of the direct criminal liability of a legal person under Article 83 GDPR and the question of the compatibility of § 30 Datenschutzgesetz (Austrian Data
Court case 13 O 129/21
The controller is a credit reference agency. The data subject entered into a contract with a mobile phone provider under the address of his parents. The mobile phone was used by the data subject's brother. During the term of the contract, the mobile phone provider was unable to debit an amount due and, therefore, sent debt collection letters to the registered address. However, the data subject did no longer live at his parents' address. The debt was then settled in the short term, but the mobile phone provider terminated the contract and initiated a negative entry in the controller's debt register. One year later, the data subject requested the controller to delete the negative entry, because he has never received any which the controller refused. The controller felt it was entitled to keep the entry, because the debt has not been paid initially and two debt collection letters had been sent to the parents' address. Subsequently, the data subject obtained a judgement ordering the controller to delete the entry. The controller, however, did not immediately comply with the judgement. As it turned out, the data was still processed by the controller and shared with its customers. Only three months later, after the data subject again requested deletion, the controller finally removed the entry. The data subject then initiated new court proceedings claiming damages for the unlawful storage of its data. The controller applied for the dismissal of the claim, arguing that the negative entry was stored lawfully and the data subject did not suffer any damages. The incident partially occurred before the GDPR came into effect. The facts of the case were therefore partly assessed on the old version of the German Data Protection Act (BDSG a.F.). The Regional Court Hannover (Landgericht Hannover - LG Hannover) awarded €5000 in damages to the data subject according to Article 82 GDPR, since the the processing of the data by the controller violated the old German Data Protection Act and the new one. The court found that a credit reference agency may lawfully process data under the old and new version of the German Data Protection Act, if it proves that the data subject has received two debt collection letters by the creditor before the data is transferred from the creditor to the credit agency. However, the court determined that, in the case at hand, the defendant was not able to provide such proof, since the debt collection letters were sent to the parents' address and not the current address of the data subject. Moreover, the LG Hannover held that the claimant suffered non-material damages in the sense of Article 82(1) GDPR, because the controller unlawfully disclosed the data to its customers. The court also held that under Article 82 GDPR the violation does not need to amount to a grave violation, unlike usually required in German law for the compensation of non-material damages. Furthermore, the court came to the conclusion that the defendant was responsible for the event giving rise to the damages according to Article 82(3) GDPR. It held that initially the defendant was not obliged to verify whether the data subject received two debt collection letters by the mobile phone provider, but could rely on the mobile phone provider acting in accordance with the law. However, after the data subject had informed the controller that he has never received any debt collection letters, the controller was obliged to check whether this information was true. As it never did so, the court concluded that the controller was responsible for the damages which occurred after this time. When the LG Hannover determined the amount of damages, it took into consideration that the data was processed to calculate a credit score, which can significantly affect the professional and private life of a person, that the controller did not comply with its obligation to verify the lawfulness of the processing for two years and that the plaintiff himself contributed to the existence of the negative entries by not informing the mobile phone provider of the change of his address.
Unknown data subject (complainant)
The complainant is the parent of a minor who was a patient at a child and adolescent psychiatry center. They claimed that the family, including their underage children, had been filmed in the patient's room during a visit. In 2021, they filed a complaint with the Austrian Data Protection Authority (DSB) regarding the lawfulness of these recordings. The DSB rejected the handling of the complaint based on Articles 57(4) and 77 (1) GDPR, arguing that the complainant had made excessive use of the right to lodge a complaint. Between August and 2018 and August 2021, the complainant had indeed brought a total of 29 similar proceedings to the DSB pertaining to their underage daughter's personal data. The complainant appealed this decision with the Austrian Federal Administrative Court (BVwG). The BVwG decided in favour of the complainant. It repealed the contested decision and instructed the DSB to resume the procedure. According to the BVwG, the DSB did not meet the threshold set out in Article 57(4) GDPR for demonstrating the manifestly unfounded or excessive character of these requests. The minimum requirements would have entailed an overview of the content of the proceedings pending at the DBS, as well as assessing their similarity. Furthermore, the court held that the DSB did not specifically explain the excessive nature of the inquiries, but rather made legally irrelevant speculations about the complainant's motivations, instead of assessing the merit of the complaint.
AP (The Netherlands)
The SVB (controller), a social security administrator in the Netherlands, structurally send personal data of newly born children to the Tax Administration. The controller has this data, as it is responsible for paying out the general child allowance. The tax office is responsible for paying out the child-related budget (an extra allowance for low-income families). The data subject's father believed that the controller wrongfully shared his daughter's information with the Tax Administration in connection with the child-related budget. He never submitted an application for this allowance and, in view of his income, he was not eligible for it. Complaint 1: on 4 January 2017, the data subject's father submitted a complaint with the Dutch DPA. He argued that the controller failed to carry out a proportionality test, which was a breach of the Wpb.'Wet bescherming persoonsgegevens,' the implementation of Directive (EU) 2016/680 (the GDPR predecessor) He requested the DPA to order the controller to immediately cease the structural provision of data on all children to the Tax Authorities. Complaint 2: on 17 May 2019, the data subject filed another complaint with the DPA against the controller and the Tax Authority (now based on the GDPR). He argued that the controller violated the principle of proportionality and subsidiarity contained in the GDPR. He requested the DPA to order the controller and the Tax Authority to remove his daughter's personal data from their systems. (He has now limited this complaint to the controller). On 19 November 2020, the DPA rejected the complaint. The data subject's father also started legal proceedings against the controller. This resulted in a [https://gdprhub.eu/index.php?title=Rb._Midden-Nederland_-_AWB_-_20_3811 Court ruling on 4 May 2021], where the Court held that the controller had indeed unlawfully invaded the privacy of the data subject by providing her personal data to the Tax Administration. The controller appealed this decision t
Court case 5 O 151/19
Facts pending decision. Questions referred: 1. In the light of recital 85 and the third sentence of recital 146 of the GDPR, is the concept of ‘non-material damage’ in Article 82(1) of the GDPR to be understood as covering any impairment of the protected legal position, irrespective of the other effects and materiality of that impairment? 2. Is liability for compensation under Article 82(3) of the GDPR excluded by the fact that the infringement is attributed to human error in the individual case on the part of a person acting under the authority of the processor or controller within the meaning of Article 29 of the GDPR? 3. Is it permissible or necessary to base the assessment of compensation for non-material damage on the criteria for determining fines set out in Article 83 of the GDPR, in particular in Article 83(2) and 83(5) of the GDPR? 4. Must the compensation be determined for each individual infringement, or are several infringements – or at least several infringements of the same nature – penalised by means of an overall amount of compensation, which is not determined by adding up individual amounts but is based on an evaluative overall assessment?
Court case 16 K 16155/21
Controller is a tax office. Data subject is an individual whose income from self-employment was audited. Data subject found that their personal data was processed unlawfully, and requested the Financial Court Berlin-Brandenburg to order the controller to pay (effective punitive) damages pursuant to Article 82 GDPR. The chairman on the Court informed the parties on 21.04.2021 that the claim for damages possibly needed to be brought before the ordinary courts, rather than the financial courts, since this could be regarded a claim for official liability (Article 34 GG and Article 40(2) VwGO). Data subject found that Article 82 GDPR constitutes a separate basis for a claim, and found that the financial court was compatible to rule. The Court held the claim is inadmissible. The Court stated that a claim, pursuant to Article 82 GDPR, directed at state authorities, must be asserted in accordance with the procedural rules of the respective Member State for the enforcement of claims in the event of breaches of official duties, in Germany therefore before the ordinary courts (Article 34 GG, Article 40(2) VwGO). Moreover, the Court considered the reference to Article 79(2) GDPR from Article 82(6) GDPR, and the fact that one could argue that Article 82(6) GDPR overrides Member State procedural law. The Court, however, noted that Article 79(2) GDPR only regulates international jurisdiction. This means that this provision only regulates which courts of which state have jurisdiction in a claim for damages, and does not regulate which court within a Member State is compatible to handle such a claim. The Court claimed that this interpretation is supported by recital 145 because this recital only addresses cross-border situations, and the fact that the European Parliament and the Council of the European Union already have no regulatory competence for the procedural enforcement of claims within the Member States.
Court case 29 K 7031/19
The applicant complained to the DPA of the State of North Rhine-Westphalia (the LDI) about the actions of the District Court of C. He worked for several decades as a civilian employee for the police authorities and intelligence services. In 2016, he was charged with tax evasion by the District Court of C. and eventually was sentenced to a suspended sentence of imprisonment. Following an appeal, the case was referred back to this Court. The proceedings there are still ongoing and are currently suspended. The complainant argued that apparently the investigation file, which had been received by the Court, together with the indictment, had been copied in full or at least a substantial part and distributed to third parties. These parties included journalists of the T. Zeitung (Z), who had reported on the allegations against the applicant in their articles before the case was known to the public. Moreover, the day before the opening of the main hearing, the newspaper again carried an extensive report using personal data from the indictment. Further letters also showed that Z had knowledge of the contents of the criminal case file. The complainant, by letter dated 15 December 2017, requested the DPA, to take measures against the District Court of C., i.e., to prohibit the Court from transferring the judicial files concerning him in whole or in part to the press authorities or to reconstruct the criminal file for that purpose. In response, in early 2018, the DPA replied that courts are largely exempt from scrutiny by the DPA. The inadmissible disclosure of court records falls within the field of jurisdiction or justice, not administrative action. Consequently, the DPA was unable to provide assistance within the scope of its competence. The authority in its letter did not indicate to the claimant how he could appeal against this position. One and a half years later - in September 2019 - the complainant filed a lawsuit requesting the enforcement of the GDPR by the LDI, namel
Federal State of Bavaria
The data subject is in a dispute with their former lawyer about the lawyer's fee claim. The attorney represented the data subject in proceedings concerning a traffic accident but terminated the mandate. A lawsuit over the lawyer's fee claim ensued. To proof his claim, the lawyer submitted the correspondence with the data subject to the court. The correspondence contained personal data such as car plate number, names, attending doctor, and the data subjects injuries from the traffic accident. The data subject takes the view that the personal data should have been masked before the documents were submitted to the court. In a letter to the lawyer, dated March 2016, the data subject complained about a breach of secrecy. The Bavarian Data Protection Authority (DPA) received a complaint from data subject in January 2019. In May 2019 the DPA replied that it considered the course of action by the lawyer not an infringement of data protection guidelines. Masking of personal data was therefore not necessary. The data transfer was a data processing under Article 4(2) GDPR. Legal basis was Article 6(1)(f) GDPR and the data processing was necessary to pursue a legitimate interest. The pursuit of a fee claim is considered such a legitimate interest. Article 9(1) GDPR specified that health data, such as injuries from an accident, are special categories of data. The DPA holds, that the requirement in Article 9(2)(f) GDPR for processing special categories, was fulfilled. The processing was necessary to exercise a legal claim. While masking of the personal data was technically possible, the data processing (without masking) was necessary to reinforce the fee claim with authentic evidence. Generally, it must be possible to submit unaltered evidence in a law suit. Otherwise any evidence would bear the risk of potential data law infringement. Courts and attorneys are subject to the professional duty of confidentiality, which the DPA considered a sufficient data protection measure for
Court case 14 K 19.01274
In December 2018, the data subject filed with the DPA (the defendant in this case), a complaint under Article 77 GDPR against a lawyer who had represented the data subject in a traffic accident, before he terminated the mandate. In court proceedings after this termination, in which the lawyer's fee claim was at issue, the lawyer had submitted to the court a volume of documents containing extracts of all correspondence with the opposing insurance company, in which personal data and business secrets had not been blacked out. Since data subject had not released the lawyer from data protection and confidentiality, the data subject perceived this to be a breach of confidentiality. By letter dated 30 March 2016, the data subject contacted the lawyer regarding this breach. The data subject also complained to the Court about the lawyer's conduct, but this did not lead to any action undertaken by the Court. DPA acknowledged receipt of the complaint by letter dated 7 January 2019. In response to this complaint dated 31 May 2019, the DPA informed the data subject that it did not see any breach of data protection law in the conduct complained of and that there was therefore no reason for further supervisory measures pursuant to Article 58 GDPR. The lawyer was under no obligation to make the data subject's data unidentifiable when forwarding it to the court. According to the DPA, this processing was legitimised under Article 6(1)(f) GDPR since the pursuit of fee claims undoubtedly constitutes a legitimate interest of the lawyer. Moreover, the DPA held that, insofar as the personal data transferred were data belonging to special categories of data within the meaning of Article 9(1) GDPR (such as information on the consequences of the accident/injuries suffered by the data subject in the accident), the additional requirements of Article 9(2) GDPR were also met, as the transfer had been necessary for the assertion of legal claims. The data subject then brought the action to the Co
Court case 1 U 69/20
A defendant appealed a first instance decision by the Regional Court of Potsdam. In that case, they made an unsuccessful counterclaim for set-off of damages they owed on account of the unauthorized further use of their photograph and name in connection with the plaintiff's Internet presence. The Higher Regional Court of Brandenburg held that a claim for damages can only arise from Article 82 GDPR if concrete damage has been sufficiently presented by the claimant. It rejected the appeal and stated that such a claim had no material prospect of success in this case. It justified its approach by reference to a decision by the Higher Regional Court of Bremen, which followed the same legal approach regarding an Article 82 GDPR claim.
Verein für Konsumenten Information (VKI)
The plaintiff (the Austrian association Verein für Konsumenten Information) sued the defendant (an online shopping platform operating throughout Austria) over several business practices, terms and conditions they found in violation with consumer protection law and the GDPR. More precisely, the association criticized several non-transparent contractual clauses on interests and creditworthiness checks as well as the defendant making decisions based on classifications by external credit scoring agencies in violation of Article 22 GDPR. The defendant argued that the association had no right to take legal action under applicable data protection law. In this regard, the appealing court already decided that the association lacks the legitimacy to assert data protection violations. The OGH decided that the previous court failed to take into account that the systematic infringement of Article 22 GDPR in connection with consumer credit ratings could in fact allow the association to take legal action under the GDPR. The court decided that the appeal is admissible because the legitimacy of the plaintiffs associations under §§ 28 and 29 of the Austrian Consumer Protection Act (Konsumentenschutzgesetz - KSchG) is not ultimately clarified. The court refers to a parallel case of the plaintiff currently pending at the CJEU as part of an preliminary ruling procedure. In this regard, the CJEU has to decide on whether the GDPR precludes national rules from granting associations the power to take legal action against unfair business practices or violations of consumer protection laws without a mandate and irrespective of the violation of specific rights of individual data subjects (see here). Until this decision is delivered by the CJEU the present procedure is put on hold.
Belgian Federal Public Service Finance
The Belgian tax department appealed a decision of the Belgian DPA that was provisionally enforceable, and asked for the immediate suspension of the implementing measures already taken until the Court has ruled on the merits of the case. According to the Court, an appeal against an administrative decision can only be effective if the applicant is not put under pressure to pay a fine or to comply with the contested decision immediately. Article 66 GDPR provides the possibility of an "urgency procedure" where a supervisory authority considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects. By way of derogation the supervisory authority can immediately adopt provisional measures intended to produce legal effects on its own territory with a specified period of validity which shall not exceed three months. Reading this Article (together with article 60 and 62 of the GDPR), it can be deduced that the European legislator did not intend to make decisions of the litigation chamber of a DPA provisionally enforceable. Article 108, § 1, par. 2 WOG, which provides for the provisional enforceability of the decisions of the Belgian DPA, must be interpreted strictly: in order to suspend the measures adopted by the DPA, the applicant must prove and motivate that the immediate enforceability of the measure would violate the right to an effective remedy as set out in Article 47 of the Charter of Fundamental Rights of the EU ('the Charter'). In this case the court rules by interlocutory judgment that: * the Belgian tax department did not put forward any concrete evidence, either in the application or at the hearing, to justify its claim for suspension and, therefore, its application is unfounded; * the Court prepares the case for hearing on the merits on Wednesday 10 November 2021.
Court case 1 W 18/21
The data subject wanted to assert a claim for compensation for immaterial damage against the controller. To this end, the data subject first applied for legal aid. For this purpose, the data subject set out the unlawfulness of a data processing - not described in the decision. Nothing was said about a non-material damage. For this reason, the Regional Court of Bremen dismissed the application. The data subject filed an immediate appeal against this decision. The Bremen Higher Regional Court (OLG Bremen) rejected the application. The requirements for a claim for damages were not fully presented. Article 82 GDPR presupposes damage. The asserted mere breach of the provisions of the GDPR is not sufficient for a claim. Furthermore, the court found that there was no need to refer the case to the ECJ. First, the wording of Article 82 GDPR clearly presupposes a damage. In this respect, the decision differed from the decision of the Federal Constitutional Court of 14 January 2021 (BVerfG - 1 BvR 2853/19). In that decision, the issue was not whether any damage had occurred at all, but whether there was a materiality threshold for this claim. Second, there is no obligation to make a reference under Article 267(3) TFEU for the proceedings here, since a decision on a legal aid application does not bind the court in the subsequent main action. In this respect, the parties are free to have the issue, which was originally decided only provisionally, re-examined by the courts.
Microsoft Ireland Operations Limited
The claimant requested Microsoft Ireland to remove a number of URLs (links) from a list of search engine results following a search by the claimant's name in Microsoft's search engine, Bing. The claimant based his request on Articles 17(1)(a) and (c) GDPR and Articles 10 and 21 GDPR. The Court first examined its competence to rule on the request. The request is of an international nature as the applicant is domiciled in the UK and Microsoft is domiciled in Ireland. It noted that the dispute falls within the scope of the Brussels I bis Regulation in substantive, formal and temporal terms. Recital 147 GDPR states that the general rules of jurisdiction of the Brussels I bis Regulation should not prejudice the application of the specific rules of jurisdiction contained in the GDPR. This means that in a situation where both the Brussels I bis Regulation and the AVG are applicable, the Brussels I bis Regulation cannot take away the competence designated by the GDPR. The Court referred to the case law of the CJEU (see [https://curia.europa.eu/juris/document/document.jsf?text=&docid=111742&pageIndex=0&doclang=en&mode=req&dir=&occ=first&part=1&cid=2540581 CJEU 25 November 2011, ECLI:EU:C:2011:685, eDate Advertising GMBH/Martinez]), from which it follows that Article 7(2) Brussels I bis Regulation, in the event of an alleged infringement of personal rights by content placed on the internet, must be interpreted as meaning that the victim may also lodge the claim with the court where he has his 'centre of interests'. The CJEU defines the centre of interests as follows: "That place is usually the victim's habitual residence, but it may also be a Member State in which the victim does not habitually reside, provided that other evidence, such as the pursuit of a professional activity, may show that there is a particularly close connection with that State." Whilst the claimant considered that he has the centre of interests in the Netherlands since he conducts his professional ac
Court case 10 A 10302/21
The controller erected an LED billboard on a private car park. As there had been regular vandalism there in the past, the controller set up various cameras that operated around the clock and partially recorded the public traffic area. The DPA ordered, among other things, that the data processing by one of the cameras be stopped and that this camera be dismantled. The controller objected to this order. The court of first instance (VG Mainz - 1 K 584/19.MZ) ruled that the discontinuation order was lawful, but that the dismantling order was unlawful. The controller accepted this decision and, in particular, accepted that he would no longer be allowed to switch on the camera. In contrast, the defendant appealed against the annulment of the dismantling order. The appeal was unsuccessful. The Higher Administrative Court of Rhineland-Palatinate (OVG Rheinland-Pfalz) ruled that, firstly, the scope of application of the GDPR was not opened for the switched-off camera. Secondly, Article 58(2)(f) GDPR does not authorise the ordering of the dismantling of a (decommissioned) camera. = In the court's opinion, the scope of application of the GDPR is not opened. There was no processing within the meaning of Article 4(2) GDPR. Video recordings and their temporary storage are indisputably data processing, but a deactivated camera does not process data (any longer). In the second instance, the operator of the LED board no longer objected to the order of discontinuance. The order has become unappealable. In the absence of any indications of continued operation contrary to the order, the court held that it was to be assumed that the camera was and remained deactivated. = Pursuant to Art. 58(2)(f) GDPR, the supervisory authority has all corrective powers allowing it to impose a temporary or definitive limitation on processing, including a ban. The DPA made use of this power by ordering to deactivate the camera and therefore to stop the processing. Article 58(2)(f) GDPR does not est
Parliament of the Republic of Latvia (Latvijas Republikas Saeima)
An individual lodged a constitutional complaint reference on the national Law on Road Traffic is consistent with the fundamental right to respect for private life. The individual’s legal interest was grounded to the imposition of penalty points after some road traffic offences. These points were entered in the national register of vehicles and drivers. Moreover, any company and any third person may obtain information relating to penalty points imposed on another person, either by enquiring directly at the CSDD or by using the services provided by commercial re-users. The relative Article 14(1)(2) of national law was stated that “Information relating […] to fines for the commission of road traffic offences which have been imposed on a person […] shall be regarded as information in the public domain”. Latvian Parliament intended to improve road safety through each driver who infringes traffic regulations, particularly those disregarding them systematically, be openly identified. The only requirement for disclosure of the information, which contained in the national register of vehicles and their drivers, was subject to the condition that the information seeker must provide the national identification number of the drivers about whom they wish to enquire. The CSDD handles the National Register, and they insisted that they transfer the legal ownership of the transmitted data under no circumstances. So, the re-users should use these data only to deduce the seriousness and frequency of those offences and ascertain whether a given person has committed road traffic offences. Since penalty points were classified as public data, may be re-used for commercial or non-commercial purposes other than the initial purpose for which the information was collected. However, article 14(1)(2) of the Road Traffic National Act does not impose limits on the re-use of these data relating to penalty points. Under the contracts in which CSDD concludes with commercial re-users, the acquirer affirms that it will use the information obtained in accordance with the purposes indicated in the contract and in compliance with the legislation in force. Therefore, it cannot be ruled out if any possible processing is inappropriate or disproportionate. It should be well-known to everyone that the GDPR provides enhanced protection to sensitive data. Article 10 of the GDPR refers to these data collections which are capable to give rise to social disapproval. The at-issue grant of data access is liable to stigmatise the data subject, and thereby, it is possible to constitute a serious interference with his or her private or professional life. The referring national Court also asked CJEU whether the provisions of the GDPR must be interpreted as precluding national legislation which obliges the public body responsible for the register to disclose those data to any person who requests them, without that person having to establish a specific interest in obtaining the data. Since information relating to penalty points can be communicated upon request and transmitted for re-use to several companies, an individual filed a constitutional complaint challenging the conformity of the Act on Road Traffic with the right to privacy set out in the Latvian Constitution. Because the Latvian Parliament adopted the National Law on Road Traffic, that institution participated in the proceedings. The CSDD, which processes the data at issue, was also heard. In addition, the National Data Protection Authority, Latvia) was also invited to give their opinion as amici curiae before the referring Court. The Latvian Parliament explained that, in practice, disclosure of the information contained in the national register of vehicles and their drivers is subject to the condition that the person requesting the information must provide the national identification number of the driver about whom he or she wishes to enquire. Moreover, the CSDD pointed out that the Law on Road Traffic does not impose limits on either public access to or re-use of data relating to penalty points. As regards that they do not provide the legal transfer of the data; re-users must ensure by themselves that the information transmitted does not exceed the initial purpose for which the information was collected. However, the National Data Protection Authority expressed its doubts about whether the Law on Road Traffic is consistent with the Latvian Constitution, which lays down the right to respect for private life. In its view, the importance and the objective of the processing carried out on the basis of the provision at issue in the main proceedings are not clearly established, and it cannot, therefore, be ruled out that processing is inappropriate or disproportionate. The National Parliament considers that the provision at issue is lawful because it is justified by the objective of improving road safety, which requires that traffic offenders be openly identified and that drivers be deterred from committing offences. Also, the Right of Access to Information, which was directly included in the National Constitution, should be respected. The CSDD explained to the referring Court the functioning of the penalty points system and confirmed that the national legislation does not impose any limits on public access to and on the re-use of data relating to penalty points. Also, it pointed out that these contracts do not provide for the legal transfer of data, and these re-users shall ensure that the information transmitted to their customers does not exceed that which can be obtained from the CSDD. For example, one of the contractual terms stipulates that the acquirer of the information must use it in the manner laid down in the regulations in force and in accordance with the purposes indicated in the contract. The National Data Protection Authority was in the position to observed that, Latvia’s statistics on traffic accidents, although showing a decrease in the number of accidents, there is no proof that the penalty points system and public access to information relating to it have contributed to that favourable development. So did not rule out the possibility that the data processing at issue may be inappropriate or disproportionate. First of all, this CJEU’s proceedings do not concern the Law on Road Traffic in its entirety, but only in so far as that provision makes information relating to penalty points entered in the national vehicle register accessible to the public. That Court further considers that penalty points are personal data and must therefore be processed in accordance with the right to respect for private life. It emphasises that in assessing the scope of Article 96 of the Latvian Constitution, an account must be taken of the GDPR as well as of Article 16 TFEU and Article 8 of the Charter of Fundamental Rights of the European Union. The CJEU highlighted that the term offence refers exclusively to criminal offence and that the term remains an autonomous concept of EU law. That means that it is not decisive if an offence is classified as an administrative offence in a national legal system. In determining whether an offence qualify as criminal offence we have to recall the three Engel criteria, namely (a) the legal classification of the offence under national law; (b) the nature of the offence; and (c) the degree of severity of the penalty incurred, the objective pursued by that provision. The EU Grand Chamber first took note that a traffic offence is liable to give rise to penalties of a certain severity and those points have legal consequences which may even extend to a driving ban or to constitute a serious interference with the fundamental rights to respect for private life and to the protection of personal data, since it may give rise to social disapproval and result in stigmatisation of the data subject. Furthermore, it was asserted that disclosure of the National Road Traffic Act broadly falls within the material scope of the GDPR, and no exception is applicable. Article 2(2)(a) and (b) of the GDPR represents partly a continuation of the first indent of Article 3(2) of Directive 95/46. Therefore, the provisions of the GDPR shall not be interpreted in broader terms the Titles V and VI of the EU Treaty/Treaty of Lisbon and, in any case, border than the area of public security, defence, and State security. The Court held that the GDPR also precludes the Latvian Parliament from authoring the CSDD to disclose penalty points to economic operators in order for the data to be re-used for commercial or non-commercial purposes. Court consideration was the public disclosure and re-use of information under the view of Article 5 of the GDPR and more broadly lawful in light of the proportionality principle. The Court held that the Latvian Act goes beyond what is necessary to improve road safety as there are other less restrictive methods to achieve that objective. For example, by depriving the drivers of the right to drive a vehicle, a ban whose breach may be punished by effective sentences without public disclosure is necessary. The penalty points system aims to influence the conduct of road users by distinguishing vehicle drivers who, systematically and in bad faith, disregard road traffic rules from drivers who occasionally commit offences. However, the lack of any further condition to obtain access may result in the data being disclosed for reasons unrelated to the objective of general interest of improving road safety.
Court case 2021-07
The data subject lodged a complaint with the the Norwegian DPA (Datatilsynet) stating that they had been subject to an unauthorized credit rating. An employee of the credit rating agency has indeed triggered a credit check on the complainant to contact them in private matter. However, the data was not disclosed to other parties. Therefore, the DPA found it unlikely that data protection legislation had been violated and decided not to investigate the case further. The complainant, however, was neither informed of the closure of the case nor of their right to appeal by the DPA, but only after asking for the status of the investigation and performing own online research. The complainant therefore appealed the DPA's decision to dismiss the case, which was rejected and submitted to the Norwegian Privacy Appeal Board by the DPA. The Appeal Board decided that according to national law a party is granted the right to appeal to an individual decision. The DPAs decision to terminate the case without deciding whether the complainant's personal data has been processed unlawfully must be regarded as a decision that is decisive for the complainants individual rights, granting them the right to appeal according to [https://lovdata.no/dokument/NLE/lov/1967-02-10/KAPITTEL_6#%C2%A728 section 28(1)], [https://lovdata.no/dokument/NLE/lov/1967-02-10/KAPITTEL_1#%C2%A72 2(1)(a)(b)] [https://lovdata.no/dokument/NLE/lov/1967-02-10/ Public Administration Act]. Furthermore, the Board pointed to the data subject’s right to receive information on the outcome of the complaint under Article 77(2) GDPR and Article 57(1)(f) GDPR. The case was therefore returned to the DPA for an assessment on the merits of the case.
Facebook Ireland Ltd
The Belgian DPA brought an action before Court of First Instance of Brussels, Belgium on 11 September 2015, seeking an injunction against Facebook Ireland, Facebook Inc. and Facebook Belgium. This action aimed to put an end to what the Belgian DPA described as ‘serious and large-scale infringements, by Facebook, of the legislation relating to privacy’. On 16 February 2018, the Court of First Instance held that the Facebook social network did not adequately inform Belgian internet users of the collection and use of the information concerned. Furthermore, the consent given by the internet users to the collection and processing of that data was held to be invalid. Facebook Ireland, Facebook Inc. and Facebook Belgium, however, appealed that judgement before the Brussels Court of Appeal. Before ruling on the substance of the case, the Court of Appeal referred certain questions to the CJEU regarding the ‘one-stop shop’ mechanism provided for by the GDPR. Indeed, Facebook Ireland (established in Ireland) was identified as the controller. The Court of Appeal of Brussel therefore referred six questions to the CJEU: (1) Should Article 55(1), Articles 56 to 58 and Articles 60 to 66 of [Regulation 2016/679], read together with Articles 7, 8 and 47 of the [Charter], be interpreted as meaning that a supervisory authority which, pursuant to national law adopted in implementation of Article 58(5) of that regulation, has the competence to initiate or engage in legal proceedings before a court in its Member State against infringements of that regulation cannot exercise that competence in connection with cross-border data processing if it is not the lead supervisory authority for that cross-border data processing? (2) Does the answer to the first question referred differ if the controller of that cross-border data processing does not have its main establishment in that Member State but does have another establishment there? (3) Does the answer to the first questio