GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 13 October 2026 · Updated daily
The data subject had private health and long-term care insurance with the controller since 2010. Over the years, the controller adjusted the monthly insurance premiums several times, and informed the data subject of these adjustments through policy supplements and standardised explanatory letters, which the data subject no longer possessed. In March 2023, the data subject requested that the controller provide copies of the documents relating to past premium adjustments. After the controller refused, the data subject brought an action seeking access under Article 15(1) and (3) GDPR. Specifically, the data subject requested information concerning the contribution history of the insurance contract, including the dates and amounts of old and new premiums, tariff changes, and tariff terminations for several years. The court of first instance dismissed the claim. On appeal, the appellate court partially upheld the data subject’s request, holding that the requested information constituted personal data and therefore fell within the scope of Article 15 GDPR. The controller appealed to the Federal Court of Justice. The controller argued that the requested information did not constitute personal data because premium adjustments and tariff information were determined on an abstract, tariff-based basis and were not linked to the individual data subject. It further argued that the data subject’s request constituted an abuse of rights, as it was intended to prepare a repayment claim rather than to exercise data protection rights. The Court upheld the appeal, set aside the appellate judgment, and referred the case back for a new decision. The Court confirmed that Article 15 GDPR applies irrespective of the data subject’s motivation and that a request for access cannot be refused merely because it serves purposes unrelated to data protection. It also rejected the controller’s argument that the request constituted an abuse of rights under Article 12(5) GDPR. However, the Court hel
The controller, SCHUFA Holding AG, operates a credit information agency that collects and stores information on payment defaults reported by its contractual partners for the purpose of assessing consumers’ creditworthiness. The data subject had three undisputed payment defaults recorded by SCHUFA. Each claim had been fully settled between December 2020 and December 2022. Despite settlement, SCHUFA continued to store the corresponding entries and made them available to its clients for credit assessments. Over the course of the proceedings, SCHUFA progressively deleted the entries, relying in part on codes of conduct under Article 40 GDPR approved by the Hessian DPA, which provide for deletion after three years, or after 18 months under specific conditions. The data subject sought deletion of the entries, compensation for non-material damage under Article 82 GDPR, and reimbursement of pre-trial legal costs. After the deletion claims were declared settled, the Cologne Higher Regional Court awarded the data subject €500 in non-material damages, holding that continued storage after settlement was unlawful. The court reasoned that, following the CJEU’s judgment in SCHUFA Holding (C-26/22 and C-64/22), private credit agencies could not store data longer than comparable entries in the public debtor register, which must be deleted immediately upon proof of full satisfaction of the claim. SCHUFA appealed the decision to the Federal Court of Justice. The Federal Court of Justice upheld the appeal. The Court confirmed that credit information agencies pursue legitimate interests within the meaning of Article 6(1)(f) GDPR, both in their own economic interest and in the interest of their customers, such as lenders seeking reliable creditworthiness assessments. It emphasised that credit reporting serves recognised economic and consumer-protection functions and may, in principle, justify the processing of data on payment defaults. However, the Court held that the Court of Appeal w
On 14 May 2025, a group of 32 members of the National Council of the Slovak Republic (the proposers) submitted a proposal to the Constitutional Court of the Slovak Republic challenging Act No. 109/2025 Coll. The Act, which entered into effect on 1 June 2025, required NGOs, associations, and international organisations with annual income exceeding €35,000 to submit a financial report. The report had to list all income sources and expenditures. It required identifying contributors who provided monetary support exceeding €5,000 per year. The reports were to be published in the public section of the financial statements register. The law also removed previous protections guaranteeing donor anonymity under the Foundations Act and the Funds Act. The proposers objected to the law on several grounds. They claimed that publishing donor names violated privacy and data protection rights under the [https://www.prezident.sk/upload-files/46422.pdf Constitution], the [https://www.echr.coe.int/documents/d/echr/convention_ENG Convention], and the [https://www.europarl.europa.eu/charter/pdf/text_en.pdf EU Charter], and conflicted with EU rules on free movement of capital. They argued that the law violated freedom of association by imposing detailed reporting and public disclosure obligations that could deter donors and limit NGO activities. They also contended that the legislative process was unconstitutional, as debate in the National Council was limited and curtailed, preventing meaningful discussion. Additionally, they requested that the Court refer a question to the Court of Justice of the European Union for a preliminary ruling. On 11 August 2025, the Public Defender of Rights (the Ombudsman) also filed a motion to challenge the law. The Ombudsman emphasised that NGOs, especially those promoting human rights, perform a public watchdog function and therefore require protection from disproportionate state interference. He argued that the disclosure obligations were not necessary t
In June 2021, the data subject lodged a complaint with the Austrian Data Protection Authority (DSB) under Article 77 GDPR, alleging a violation of his right to data secrecy. The data subject concerned the use of his professional email address by a bank employee (the controller) for a private matter in 2019. The DSB rejected the complaint on the basis of § [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 24(4) of the Austrian Data Protection Act (DSG)], which provides that the right to have a complaint examined expires one year after the data subject becomes aware of the alleged infringement and, in any event, three years after the event. The data subject had acknowledged that he became aware of the alleged breach no later than April 2019, meaning the one-year subjective limitation period had elapsed. The data subject appealed to the Federal Administrative Court (BVwG), but the court dismissed the appeal. The data subject then appealed to the Supreme Administrative Court of Austria (VwGH), arguing that [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 § 24(4) DSG] was incompatible with Article 77 GDPR, which does not provide for any limitation period, and that national law could not restrict a directly applicable EU right. The Supreme Administrative Court dismissed the appeal as unfounded. It held that [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 § 24(4) DSG] is compatible with Article 77 GDPR. The Court found that, in the absence of EU-level harmonization of procedural time limits, Member States retain procedural autonomy to regulate the modalities for exercising GDPR rights, including the introduction of limitation periods, provided that the principles of equivalence and effectiveness are respected. The one-year subjective limitation period under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001
The controller is a national newspaper that published an article reporting on the criminal conviction of the data subject for the sexual exploitation of two underage girls. The article included information about the criminal proceedings and identified the data subject by name, while omitting his surname. The data subject initiated civil proceedings against the controller, arguing that the publication unlawfully interfered with his right to privacy and data protection, in particular under Article 10 GDPR. He claimed that the disclosure of his identity and professional background made him easily identifiable and caused disproportionate reputational harm. He further argued that the offence was relatively minor and did not justify such intrusive reporting. The controller argued that it had acted within its journalistic freedom and fulfilled its duty to inform the public about serious criminal offences. It maintained that sufficient care had been taken to limit identification by omitting the data subject’s surname and that the reporting was accurate, balanced, and in the public interest. The Court rejected the data subject’s claims and held that the publication was lawful. The Court carried out a balancing exercise between the data subject’s right to respect for private life under Article 8 ECHR and the controller’s freedom of expression under Article 10 ECHR, as required when applying Article 10 GDPR. It found that the balance weighed in favour of the controller. In particular, the Court held that the article was based on accurate and established facts, namely a criminal conviction. The disclosure contributed to a debate of general public interest, as sexual exploitation of minors, especially in the context of online platforms, raises serious societal concerns, regardless of the data subject’s characterisation of the offence as “light”. The Court further considered the data subject’s professional background and found that mentioning his profession was justified, as it
The controller was the Police of the Czech Republic. The data subject was a man who, in 2003, had been convicted of causing bodily harm and attempted murder committed in a particularly brutal manner and sentenced to 18 years' imprisonment along with mandatory outpatient treatment for alcohol addiction. He had prior criminal convictions. On 17 February 2021, while the data subject was still serving his sentence, a police forensic technician took his fingerprints, collected biological samples capable of revealing genetic information, measured his body and took photographs , relying on § 65 of the Police Act, which allows police to collect such data from persons serving a sentence for an intentional criminal offence, for the purpose of future identification. To carry out these procedures, the data subject was escorted from prison to a police facility by police officers, who restrained him with handcuffs. The data subject brought proceedings against the police alleging an unlawful interference with his rights, based on two separate grounds: (1) that the identification procedures themselves were unlawful, because the processing of his personal data was not necessary given his advanced age, deteriorated health and low risk of reoffending, because his transfer to the police outside the prison did not comply with § 42a(1) of the Execution of Sentences Act and (2) that his physical restraint during the escort was unlawful. The regional court dismissed his claim regarding the identification procedures, finding that his criminal history and the severity of his offences justified the interference. In a related, separately handled case concerning the escort itself, a different court later found that the escort had indeed been unlawful, because the police lacked legal authority to remove him from prison other than for the specific purpose defined in § 42a(1) and this finding was not challenged on appeal. The data subject appealed the dismissal regarding the identification procedu
The data subject is a participant in a pension fund operated by the controller. He receives pension benefits and is concerned about the accuracy of his pension accrual, particularly in light of the upcoming transition to a new pension system. Because no rights can be derived from the Uniform Pension Overview (UPO), the data subject tried obtaining more certainty regarding the correctness of his pension. Relying on Article 15 GDPR, the data subject requested that the controller provide (i) a complete overview of the personal data on which his pension calculation was based, (ii) a clear explanation of how those data resulted in the pension amounts shown in the UPO, and (iii) a confirmation that the data used were correct. The requested information included, inter alia, pensionable salary, part-time percentages, years of service, and value transfers. The controller refused to provide the requested information. It argued that the GDPR did not provide a legal basis for the request, that the data subject had already retired before the GDPR became applicable, and that the requested information did not qualify as personal data. The controller further submitted that the GDPR was not intended to enable verification of pension calculations or pension administration and that the relevant data were already accessible through the UPO. The data subject brought proceedings before the Court, seeking an order to the controller to provide the requested information, a penalty payment, and an award of costs. The Court dismissed the request in its entirety. The Court held that the scope of the right of access under Article 15 GDPR is limited to personal data as defined in Article 4(1) GDPR. While that concept is broad and may include both objective and subjective information relating to an identifiable person, it does not extend to calculations themselves. The Court found that the data subject’s request was primarily aimed at obtaining the pension calculations themselves and a comprehe
In late 2021, the data subject received a personalised COVID-19 vaccination reminder letter containing the data subject’s name, address and proposed vaccination appointments. This information was taken from the central vaccination register and patient index, and the letter displayed logos of several public bodies and social insurance entities. On 10 December 2021, the data subject filed a complaint with the DPA. They alleged that the municipal authority (assumed to be the controller) had unlawfully processed and disclosed sensitive health data by sending the vaccination reminder. Separately, the DPA opened an ex officio investigation into the vaccination reminder campaign. In that investigation, the DPA concluded that the municipal authority involved in the campaign acted as controller under Article 4(7) GDPR. The DPA later upheld the data subject’s complaint, as it held that the assumed controller had unlawfully accessed and processed data from the central vaccination register and patient index while having no sufficient legal basis. It rejected the data subject’s request to prohibit further processing and rejected the request for a fine. The municipal authority appealed before the court. It argued, among other things, that it was not the controller for the processing and that the processing had formed part of pandemic management measures. First, the court examined who acted as controller under Article 4(7) GDPR. The court found that the relevant political officeholder, acting within the framework of public health administration, had determined the purpose and essential means of the processing. The municipal authority involved in the campaign merely implemented their instructions. The court therefore held that it had not determined the purposes and means of the processing and was actually not the controller under Article 4(7) GDPR. Second, the court considered that the data subject could not reasonably identify the correct controller because the vaccination rem
The controller placed cookies on the data subject’s terminal equipment and processed the resulting data for advertising purposes without obtaining the data subject’s consent. The personal data concerned included, in particular, the data subject’s IP address and a cookie identifier. The data subject brought an action before the Regional Court (LG Frankfurt), seeking an injunction and compensation for non-material damage. The controller argued that the data subject had knowingly triggered the processing and that the data were only processed in aggregated and pseudonymised form. The controller further contended that the data subject could have deleted the cookies from his device at any time. The Court rejected these arguments and granted an injunction and awarded damages of €1,500 to the data subject. The controller subsequently appealed the decision to the OLG Frankfurt. The Court partially upheld the lower court's decision. The court held that the controller could not rely on the fact that the data subject was technically able to delete cookies from his terminal equipment. The lawfulness of processing depends on the existence of valid prior consent, not on the data subject’s ability to mitigate the effects of unlawful processing after the fact. The Court further clarified that the burden of proof for demonstrating valid consent rests with the controller. Accordingly, the controller’s argument that the data subject had failed to show that he did not consent was dismissed as irrelevant. With regard to damages, the court found that the infringement did not result in a significant loss of control over personal data, as the data subject was aware of the processing and the personal data at issue (IP address and cookie ID) were not particularly sensitive. Nevertheless, the court held that the storage and processing of cookies for advertising purposes without consent gave rise to a feeling of being monitored, which amounted to non-material damage. Given that the impairment
Forsters LLP (the controller) is a firm acting on behalf of a couple involved in litigation with a neighbour (the recipient). On 15 July 2025 the recipient made an access request to the controller under Article 15 UK GDPR and asked for documents relevant to the main litigation proceedings. On 18 August 2025 the controller responded to the access request by including a link for accessing the requested information along with a user name and a password for downloading the files. The following day the recipient informed the controller that the email contained files unrelated to him and his case. The controller claimed an error led to the disclosure of the data and asked for the immediate erasure of the files. The recipient refused to comply with the request. The controller filed for an interim injunction seeking delivery up of confidential and privileged documents disclosed by mistake in response to the access request, citing the rights under Article 5(1) UK GDPR of affected data subjects. The court pointed out that there was no justification for the recipient to hold on to the confidential documents that were completely unrelated to his case and had been disclosed by mistake. Among others, the court rejected the claims that the compromised confidentiality of the documents should entitle the recipient to hold on to them. Instead, the court emphasised that it can help the controller regain control over the documents even if their confidentiality was compromised. Furthermore, the court rejected the argument that the documents might establish the truth in the main proceedings and thus the recipient should be allowed to use them. Instead, the court pointed out that the recipient would not have been aware of the contents of the documents without the accidental disclosure. Therefore, the court granted the interim injunction and ordered the recipient to deliver up all 3,300 documents in his possession, delete any copies he held and not use any information from the
The data subject was hospitalised in the Eaubonne Montmorency Hospital Centre (the controller) in 2019. The first medical report created at the time of hospitalisation indicated a diagnosis of bipolar affective disorder, among others. The data subject showed that the controller issued a second medical report during the same hospital visit with a diagnosis of an adjustment disorder. Furthermore, she submitted medical reports from other hospitals ruling out the diagnosis of bipolar disorder. In 2020, the data subject made a request to the controller for the rectification of the initial medical diagnosis under Article 16 GDPR and Article 17 GDPR. The controller rejected her request and the data subject filed a petition before the Administrative Court of Cergy-Pontoise for an order to correct the medical records. The petition was rejected by the court. The data subject filed an appeal with the Administrative Court of Appeals of Versailles to overturn the judgment of the Administrative Court of Cergy-Pontoise. In the appeal, the data subject sought the same order for rectification. The court rejected the data subject’s appeal. The court noted that the initial diagnosis was the result of subjective medical assessments of the data subject’s state of health. Moreover, the court emphasised that a different subsequent diagnosis did not imply that the initial diagnosis was inaccurate. Therefore, the court found that the diagnosis cannot be subject to the right of rectification.
Austria implemented a [https://www.bmf.gv.at/services/wiereg/wiereg-register.html public register of beneficial owners (WiEReG)] in order to comply with [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024L1640 EU anti-money laundering and counter-terrorist financing rules]. The register contains personal data of natural persons who ultimately own or control legal entities, including sensitive information such as name, date of birth, nationality, residence, and the type and extent of their economic interest. These data are collected from multiple sources, including the company register, association register, foundation and fund register, tax authorities, Statistics Austria, other state registers, and direct reporting by the legal entities themselves. The register originally allowed public access to this information for anyone. The data subject in this case was a beneficial owner of a private foundation and a member of its foundation board. He requested that the Federal Minister of Finance, acting as the register authority and controller, restrict public access to his data in the register or block it entirely. He argued that making his personal data publicly accessible violated his constitutional rights to privacy and data protection and breached GDPR rules, especially because he was not notified of access and could not control who viewed his data. The Federal Minister of Finance rejected the request on 3 August 2022, stating that the data subject’s status as a beneficial owner was already evident from other public registers, particularly the company register, so there was no reason to block access. The data subject appealed to the Federal Administrative Court, which dismissed the appeal on 5 October 2022. The court held that the data subject was registered in the beneficial ownership register due to his company holdings, and that his residence was already blocked from view in the register. However, the court also emphasized that this did not change the o
The Romanian DPA issued a fine to a company (the controller) in April 2025 for the unlawful processing of its employees’ personal data via surveillance cameras in one of its storage facilities in violation of Article 5(1)(a) and (b) GDPR, Article 5(2) GDPR, Article 6(1) GDPR, and Article 5 Law no. 190/2018 (Legea nr. 190/2018). The controller appealed the DPA’s decision in court arguing, among other things, that the DPA failed to indicate the specific violation committed and the specific time and date. The controller asked the court to annul the DPA’s decision. The court found that the DPA failed to provide a concrete description of the violations committed by the controller. The court noted that the DPA’s decision only provided a generic mention that the personal data processing activities carried out by the controller were in breach of Article 5(1)(a) and (b) GDPR, Article 5(2) GDPR and Article 6(1) GDPR along with Article 5 Law nr. 190/2018. Furthermore, the court found that the DPA’s decision failed to identify and mention the exact date and context of the alleged unlawful processing activities. Instead, the decision only specified that the processing began in 2017. Therefore, the court upheld the controller’s appeal against the DPA’s decision and annulled said decision.
An assistant professor (the data subject) requested access to the content of evaluation reports by independent reviewers and letters of recommendation prepared during the academic promotion procedure from the University of Cyprus (the controller). The controller refused access during the ongoing promotion process, relying on their [https://www.ucy.ac.cy/legislation/wp-content/uploads/Rules_of_Evaluation_for_Professional_Advancement_Continuation_or_Termination_of_Employment_of_Academic_Staff_09.05.2023.pdf internal regulations] and long-standing academic practice requiring confidentiality and anonymity of external reviewers to protect objectivity and impartiality. They indicated, however, that access could be granted after completion of the procedure, with the reviewers’ identities redacted. The data subject filed a complaint with the Commissioner, the Cypriot DPA. The DPA held that the controller had violated the right of access to personal data under [https://www.afapdp.org/wp-content/uploads/2018/05/Chypre-Loi-n%C2%B0138I-sur-le-traitement-des-donnees-personnelles-2001.pdf Article 12 of Cypriot data protection law] and issued a formal decision ordering the controller to ensure access, suggesting anonymization of reviewers’ names. The controller then appealed that decision before the Administrative Court. The Administrative Court annulled the DPA’s decision. It held that the DPA had failed to properly balance the data subject’s right of access under Article 15 GDPR against the legitimate interests of the controller in preserving confidentiality and procedural integrity during an ongoing promotion process. The Court emphasized that the timing of the access request was crucial and that temporary restrictions could be justified where disclosure might affect the fairness and objectivity of a complex administrative procedure. The Court further found that the DPA had focused too narrowly on anonymization and had not adequately considered whether deferring access unti
On 16 July 2021, a data subject and a bank (the controller) concluded a Custody Agreement for Financial Instruments. Under this agreement, the bank had to open a custody account for the data subject, safeguard and settle financial instruments, report on account activity, collect income, and keep the data subject informed about the status and changes of the custody account. On the same day, the parties also concluded a Service Agreement, which defined the rights and obligations related to that service. Article 4 of this agreement required the bank to keep all client information confidential in accordance with applicable laws and prohibited disclosure to third parties without written consent or a legal basis. On 11 January 2023, the controller mistakenly sent the data subject’s monthly custodial account statement, which contained sensitive personal and financial data, to another client instead of the data subject. The controller requested that the unintended recipient delete the email and corrected the technical error. The data subject remained uncertain about the extent of the data disclosure. Subsequently, she initiated a lawsuit claiming that this incident caused stress, anxiety, discomfort, and a loss of trust in the controller, and requested compensation for non-material damages. The Court held that the controller violated the data subject’s right to privacy under Croatian law and that this violation constituted non-material damage. It also referred to the violation of GDPR, without pointing out any specific article. The Court awarded compensation on the basis of Croatian civil law, specifically the rules on protection of personality rights and non-material damages under the Croatian Obligations Act. The court explained that the right to privacy is a personal non-property right that gives an individual full authority over their private life, including the ability to exclude others from accessing, collecting, or disclosing personal data without consent. Because
Meta Platforms Ireland Ltd (the controller) is a company that operates the social media platform Facebook. An umbrella consumer organisation brought a complaint regarding Facebook’s “Find Friends” feature. This feature allows registered data subjects to upload third persons’ contact information, as well as pictures, nicknames, relationship status or professional details. This also applies to third persons who are not Facebook users. At the time, the controller stored all this data, including log data related to calls and text messages (metadata). Data subjects who uploaded this data were able to delete it from their account at any moment. According to the controller’s privacy policy, the aim of this processing was to help connect people or generate friend suggestions for data subjects. The controller retained data of non-registered data subjects in the event that they created an account in the future. The consumer organisation brought a case against the controller in June 2018, demanding that the court issue a cease-and-desist subject to a penalty. According to the organisation, the “Friends Finder” feature violated Article 6(1)(a) GDPR, 25(2) GDPR and 5(1)(c) GDPR, because the controller processed data subjects’ data without consent. The organisation also argued that the controller created comprehensive user profiles for personalised advertising purposes without a legal basis, in violation of Article 6(1) GDPR. In addition, the controller lacked explicit consent to process sensitive personal data that users entered in their accounts, in violation of Article 9(2)(a) GDPR. Finally, the organisation argued that the controller did not meet its information obligations by providing legal bases without linking them to specific data processing activities and purposes. This was a violation of Article 13(2)(f) GDPR. The controller argued that the organisation did not have standing, and contested the competence of the court. The controller also argued that its processing ac
Russmedia Digital (Russmedia), a Romanian company, is the owner of the online marketplace www.publi24.ro on which ads for - inter alia - goods or services from Romania can be published, either free of charge or for a fee. An unidentified person published an ad on that online marketplace, the content of which was disparaging and offensive towards the data subject, stating that it offered sexual services (‘the ad’). That ad contained photographs originating from the data subject's social network account but used for the ad without the data subject's consent. The identity of the person posting that ad was not verified prior to publication. When contacted by the data subject, the controller removed the ad from its online marketplace less than an hour later. However, the same ad has been placed online, indicating the the original source as Russmedia, by other websites with advertising content, where it can still be accessed. = Arguing that the ad at issue infringed her rights, the data subject brought an action against Russmedia. The Court of First Instance upheld that action and ordered Russmedia, on the basis of Romanian law to pay the data subject non-material damage caused to her by the infringement of her right of personal portrayal and right to honour and reputation, the breach of her right to privacy, and the improper processing of her personal data. That court took the view that the ad at issue constituted a failure by Russmedia to meet the obligations imposed on it by the GDPR. However, a specialised court upheld Russmedia’s ensuing appeal, ruling that the action brought by the data subject was unfounded because Russmedia was not the author of the ad at issue. The court held that Russmedia was merely providing a service for storing ads, without being actively involved ‘in the content’ of those ads. That court therefore found that Russmedia was exempted from liability by Romanian law for the damage claimed. = The data subject brought an appeal against that d
On 23 October 2021, an individual submitted an access request to the Ministry of Justice of the Slovak Republic under the Slovak Freedom of Information Act (Act No. 211/2000 Coll.; “Freedom of Information Act”). The request concerned documents exchanged in proceedings before the European Court of Human Rights (ECtHR) in Shiksaitov v. Slovak Republic (applications nos. 56751/16 and 33762/17). The request covered all submissions made by the Slovak Republic to the ECtHR, all submissions made by the applicant in those proceedings, and all annexes attached to those documents. The Ministry partially granted the request. It disclosed certain government submissions but anonymised parts of the documents. It refused to disclose the applicant’s complaint in full, parts describing the facts of domestic criminal proceedings, file numbers of domestic cases, information relating to the applicant’s financial claims for just satisfaction, and all annexes attached to the government’s submissions. The Ministry relied mainly on Section 11(1)(d) of the Freedom of Information Act (information relating to court decision-making) and Section 9(1) and (2) of the same Act (protection of personality, privacy, and personal data). The requester appealed within the administrative procedure. He argued that the Ministry had misapplied the statutory exceptions, failed to consider partial disclosure, and did not properly explain which legal grounds applied to which parts of the withheld information. The Ministry dismissed the appeal and upheld its original decision. The requester then brought an action before the Administrative Court in Bratislava, seeking annulment of the Ministry’s decisions and a remittal for new proceedings. The Administrative Court in Bratislava annulled the Ministry’s decision and remitted the case for further proceedings. The court held that the Ministry had partly applied the Freedom of Information Act correctly but had committed a legal error in refusing access to the anne
A data subject brought proceedings against a controller after it refused to provide, free of charge, digital copies of invoices and transaction data following an access request. The data subject argued that Article 15(3) GDPR entitled them to receive a complete copy of the personal data processed by the controller, including the copies of invoices and transaction data. The controller argued that it had complied with both of the data subject's requests for information in a timely and complete manner. It argued that Article 15(3) GDPR entitled the data subject to a copy of their personal data, rather than to copies of documents as such. The controller alleged that it had disclosed the payment details provided by the data subject, thereby enabling them to clearly identify which bank account had been debited. The first-instance court dismissed the data subject’s action. It acknowledged that, according to the CJEU in judgement [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62021CJ0487 C-487/21], copies of whole documents must be provided only where they are indispensable for the data subject to understand the processing of their personal data or to effectively exercise their GDPR rights. The court considered that the data subject had not proved such necessity. It noted that they had already received the relevant invoices during the contractual relationship following the respective billing periods and the information disclosed by the controller was sufficient to understand the processing at issue. The therefore found that the controller could make any re-sending of invoices conditional upon payment of a fee. The data subject appealed to the Higher Regional Court of Vienna (OLG WIEN) and argued that in accordance with the case law of the CJEU ([https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:62022CJ0307 CJEU judgment C-307/22]) a data subject need not provide reasons for requesting a copy of their personal data from the controller, and that the right
Meta, the controller, is the developer of the instruments “Meta Business Tools”, which are integrated by many third-party websites and apps. Their aim is to monitor and enhance the effectiveness of advertisement. The processes transferring data from the third-party websites to Meta take place regardless of whether the user has activated Meta apps at that moment, and regardless of whether the user has given consent. The data subject’s personal data were being processed according to the procedures described above, despite having objected to the processing of such personal data on his Instagram profile's settings. The data subject thus filed a complaint with the court, asking for an order for the controller to stop processing his data and to delete or anonymise all personal data currently stored, and to be awarded immaterial damages. The controller claims that the data processing carried out with the use of Meta Business tools is “inherent in the contemporary use of the internet”, and that it has no way of making sure that third-party companies have obtained consent from users. The court awarded immaterial damages for €5,000, holding that fear of misuse of one's personal data can amount to immaterial damage. Firstly, it declared the requests to order the controller to cease processing and to delete his personal data inadmissible. The requests were not sufficiently specific, as they did not refer to specific data points. Further on, the court rejected the controllers arguments, affirming that: “Ultimately, the objections raised are not legal arguments, but purely political ones based on the erroneous assumption that the defendant has a quasi-natural right to the undisturbed use of the "business tools" it has designed. Legally, the opposite is true: if the defendant brings applications onto the market with which it cannot ensure legally compliant operation for all users, then it will have to refrain from using these "tools" if the parties concerned take legal a