GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Veesion
A French company, Veesion created a software for CCTV cameras aimed at detecting suspicious behaviour (gestures) of people. It was based on an algorithmic processing of the images collected by the cameras. The software was popular amongst shops, using it to monitor their commercial premises. The French DPA (CNIL) found the software violated the GDPR, especially the right to object under Article 21 GDPR, and informed the company of the result of the investigation. Also, the DPA mentioned the company clients had to be informed about the outcome of the investigation. In response, the company claimed the DPA's legal reasoning was wrong, mostly because the right to object didn’t apply to the processing of data within the system, pursuant to Article R. 253-6 of the Code of Internal Security ([https://www.legifrance.gouv.fr/codes/texte_lc/LEGITEXT000025503132/ Code de la sécurité intérieure]). Consequently, the company requested the French Supreme Administrative Court (Conseil d’Etat) to suspend the execution of the letter. The court rejected the request as unfounded. The Veesion software was not covered by Article R. 253-6 of the Code of Internal Security, as it was applicable only to certain category of the CCTV, namely the CCTV related to the national security, protection against threats to public security or their prevention. Hence, it didn't cover an algorithmic processing of the images collected by the cameras, which was the functionality of the software. The court didn’t come across with any other reasons to suspend the execution of the letter or making the software compliant with the provisions of law.
Employee (data subject)
The data subject was employed by the controller and requested access to information under Article 15(1) GDPR regarding a transfer decision and a disciplinary warning. The controller responded within the deadline, providing documents and partially redacted records. The data subject claimed the information was incomplete and asserted that years of delayed access left them unable to assess how the personal data was processed. They sought immaterial damages under Article 82(1) GDPR, arguing a loss of control and uncertainty, alternatively relying on national liability doctrines. In the original decision, the labor court dismissed the claim. After a revision, the higher court awarded €2,000 in damages. Both parties appealed to the Federal Labor Court. First, the court opined that mere infringement of the right of access, and the abstract “loss of control” inherent in any such infringement, does not constitute compensable damage, as Article 82 GDPR requires a distinct, concrete harm causally linked to the violation. It considered that negative feelings or fears may qualify as immaterial damage only if objectively justified; a purely hypothetical risk of data misuse is insufficient. Unlike a data breach, delayed or incomplete access does not itself increase misuse risk. As no concrete harm was substantiated, neither GDPR-based nor alternative national-law damage claims succeeded. Hence, the court denied any compensation under Article 82(1) GDPR, as the data subject failed to demonstrate an immaterial damage had occurred.
Bayerischen Landesamtes für Datenschutzaufsicht
The data subject took part in a three day seminar organised by the controller in January 2020. The controller sent the data subject a document listing the participants of the seminar, noting who wanted to arrive a day earlier and indicating the room categories booked and whether breakfast had been booked. On 22 January 2020, the data subject requested access under Article 15 GDPR, including information about the controller’s authorisation to store data, the time, recipient and purpose of the forwarding of data and the purposes for processing. On 15 February 2020, the data subject lodged a complaint with the Bavarian DPA (“Bayerischen Landesamtes für Datenschutzaufsicht”) for the misuse of personal data of participants in a seminar by sending out the participants list and failure to provide information about the use of the data subject’s personal data. The data subject explained that in addition to the names, the list of seminar participants sent by the controller also showed the room category booked, from which conclusions could be drawn about the financial situation of the participants. On 6 March 2020, the DPA requested the controller to provide the data subject with the information under Article 15 GDPR. On 12 March 2020, the controller replied, stating that they deleted the data subject’s personal data and only saved the email address, which was needed for the seminar and would be deleted afterwards. The controller further stated that sending out the list of participants to the data subject was an oversight and would not happen again. On 24 March 2020, the DPA sent the data subject a final notification that they requested the controller again to provide information. No other supervisory measures under Article 58(2) GDPR were needed according to the DPA and the case was considered closed. The DPA informed the data subject it was welcome to contact the DPA again if it did not receive the information from the controller within four weeks, which the data subject d
Tenants
The data subjects are tenants in a house which an estate agent (data processor) was commissioned to sell by the owners (controllers). On 11 August 2022, pictures of the interior were taken by the data processor's employees at an appointment with the data subjects while present, inviting the employees in. These pictures were published under a sales advertisement on a real estate website and included in a printed exposé that was handed out to prospective buyers during viewing appointments. Following the publication, the data subjects were approached by persons about the pictures of their living quarters, causing them to feel exposed and observed. On 12 January 2023, the controllers were requested by the data subjects to provide information about the storage of the pictures and to submit proof of a declaration of consent to the taking of the pictures by the data subjects. The same was requested of the data processor on 13 February 2023. The data processor was also requested to pay pre-trial legal fees of €659,74 by 24 February 2023. On 03 March 2023, the processor rejected the data subjects' claims, citing the immediate deletion of the pictures that had taken place since finding out the data subjects felt uncomfortable by them. The data subjects alleged that the processor took the pictures in question without their consent. The publication and resulting "unmasking" caused the subjects non-material damages that cannot be compensated by simply deleting the pictures. Therefore, they claim the processor is obligated to provide information and pay appropriate compensation for pain and suffering. They requested that the data processor be ordered to provide information about the pictures taken as well as whether and to what extent digital and/or analog copies of pictures on which the data subjects can be recognized in the property were made and where these are stored, that the processor be forced to provide verifiable evidence of this. They also requested a copy of persona
AC
[https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000046221284?init=true&page=1&query=bio%C3%A9thique&searchField=ALL&tab_selection=all The Bioethics Law] (la loi sur la bioéthique) amended the [https://www.legifrance.gouv.fr/codes/texte_lc/LEGITEXT000006072665/ Public Health Code] (Code de la santé publique) to grant individuals who were conceived with the assistance of third party donors the right to access the identity and some non-identifying data of the donor. This amendment also required donors to expressly consent to the communication of their identity and data to the Commission for the Access of Persons born from Medical Assistance to Procreation (CAPADD). Donation was not permitted without this consent. The data included age, general condition, physical characteristics, family and personal situation, country of birth and motivation for the donation. The transitional provisions of the amendment made it possible to obtain the consent of the donor who made their donation before the amendment was enacted. The applicants decided to challenge the legality of the amendment before the Supreme Administrative Court of France. The applicants put forward several arguments to cancel the amendment to the Public Health Code, inter alia alleged infringement of principal of legal certainty or conformity of the amendment with French constitution. One of the arguments referred to a violation of Article 21(1) GDPR and Article 6(1)(e) GDPR. The applicants claimed that the former donors, namely donors who were not under the consent requirement of the new law, could not exercise their right in relation to the authority – CAPADD. The CAPADD was entitled to processes the contact data of former donors, transferred from the organisation or establishment where they made their donation. A person conceived by medical assistance may request to access the data of a particular former donor. Then, the CAPADD would contact this former donor to obtain their consent for disclosure of the data. The court decided to reject applicants’ request as it was not substantiated enough. The court based its reasoning on the extensive interpretation of the contested provisions. Also it recalled the Constitutional Council’s [https://www.conseil-constitutionnel.fr/decision/2023/20231052QPC.htm judgement] relevant for the case at hand. Regarding the alleged violation of the GDPR, the court held that it was unfounded. As long as former donors' data transfers from the organisation or establishment where they made their donation to the CAPADD were based on Article 6(1)(e) GDPR, each donor would enjoy the right to object under Article 21(1) GDPR. Neither, the original law, nor the contested amendment would impede the application of Article 21(1) GDPR to transfer at hand. The plea that former donors could not object to the transfer of personal data concerning them was therefore rejected.
Addiko Bank
Between May 2018 and April 2019, several customers of a bank (‘controller’) asked it to provide them with a copy of documents containing their personal data, including loan contracts they had concluded, repayment plans, documents relating to changes in interest rates and account statements. Some of these requests were explicitly motivated by the data subjects’ desire to bring a claim or legal action against the controller. The controller refused to give access to these documents. The data subjects lodged complaints with the Croatian DPA claiming that this rejection constituted a violation of Article 15(3) GDPR. As the controller did not comply with the injunctions issued by the DPA in 26 specific cases, the DPA ordered it to pay a HRK 1,100,000 (€146,667) fine. The controller considered that Article 15(3) GDPR confers only a right to a copy of the personal data being processed, to the exclusion of the documents containing them. Therefore, the controller brought an action before the Administrative Court of Zagreb against the administrative fine imposed by the DPA. The Administrative Court decided to stay the proceedings and referred the following questions to the CJEU: 1) Does Article 15(3) GDPR oblige the controller to provide the data subject with a copy of the document containing their personal data? 2) May the controller reject an access request made as a means of obtaining documentation to assist the data subject with bringing legal proceedings against the controller? On the first question First, the CJEU indicated that by its wording, Article 15(3) GDPR confers on the data subject the right to obtain an accurate reproduction of personal data concerning them, understood in a broad sense, which are subject of a processing carried out by the controller (§25 of the Order). Second, the CJEU noted that the term ‘copy’ does not refer to a document as such, but to the personal data it contains, which must be complete. The copy must therefore contain all the pe
Court case 6 O 2465/23
The controller is a credit rating agency, which provides information on the creditworthiness of individuals to its partners. This is done by calculating a credit score reflecting the probability of the person fulfilling credit-relevant contracts, based on collected information and past experience of the data subject. The data subject argued that the credit score calculated by the controller would have negative effects on them make the conclusion of contracts difficult for them. The data subject further argued that the credit scoring by the controller was in violation of Article 22(1) GDPR. The data subject therefore claimed injunctive relief at the Regional Court Traunstein (“Landsgericht Traunstein”). The data subject also claimed non-material damages of at least € 5,000 from the controller due to unlawful and discriminatory processing of their personal data when calculating the credit score. This included using their address, age and gender for calculating the credit score by the controller. Furthermore, the data subject argued that their right of access under Article 15(1)(h) GDPR was not fulfilled. The data subject requested the court to order the controller to provide information on the specific manner the credit score was calculated, including the calculation method used, the personal characteristics of the data subject used for the calculation, the various risk classes and how they are categorized, the weighting of categories of criteria and of individual criteria in relation to each other that most strongly influence the final credit score and more. The controller argued that besides providing the credit score to its partners, it also provides the information on which the score calculation is based. The data subject was able to conclude various credit-relevant contracts in the recent past even after the controller provided credit scores to the potential contractual partners of the data subject. The controller argued that the data subject’s claims were gen
Court case Ro 2022/04/0026
The data subjects, joint operators of a hotel and restaurant business, ran their establishment through a family business. The controller operates an online travel platform accessible in Austria, on which registered users can post reviews and experience reports about listed establishments, in addition to general information. The data subjects' business was listed on the platform without their consent and was reviewed by users a few times per month, in comments that identified the data subjects by name, including both positive and negative reviews. On 27 June 2019, the data subjects requested that the controller erase all their personal data from the platform. The controller did not comply. On 28 August 2019, the data subjects lodged a complaint with the Austrian DPA, alleging unlawful processing and a violation of their right to erasure under Article 17(1)(d) GDPR. The DPA rejected the complaint on 18 September 2020, relying on Article 6(1)(f) GDPR (legitimate interests) as the legal basis for the processing. The data subjects appealed to the Federal Administrative Court (BVwG), which held an oral hearing and dismissed the appeal on 13 May 2022. The BVwG found that the platform's processing served a legitimate interest in freedom of expression and information that the reviews concerned the data subjects' social andprofessional sphere rather than their private sphere, that it was reasonable to expect the data subjects to monitor the platform for unjustified criticism and that the controller had taken adequate measures against abusive reviews. The BVwG declared an appeal on points of law (Revision) admissible, citing the absence of Supreme Administrative Court case-law on the principles governing the balancing of interests for review platforms under Article 6(1)(f) GDPR. The data subjects appealed to the Supreme Administrative Court. The court dismissed the appeal as unfounded, addressing each contested element of the three-part test under Article 6(1)(f) GDPR (legitimate interest, necessity, no overriding interest of the data subject). On legitimate interest: The court held that the exercise of freedom of expression and information can constitute a legitimate interest under Article 6(1)(f) GDPR. It reasoned that both service recipients' freedom to express opinions about service quality and the conduct of those providing the service and prospective recipients' freedom to access such opinions, were protected by this provision and that the platform served this purpose by enabling reviews and structured searches. The court held that the controller's pursuit of commercial interests alongside this function did not undermine the legitimate interest, since Article 6(1)(f) GDPR expressly covers interests of the controller "or a third party" and the data subjects had not substantiated their claim that the controller had abandoned a neutral intermediary role. It also rejected the argument that the public's interest was too narrow to qualify as legitimate merely because the hotel's clientele was limited, holding that such considerations belong to the separate balancing-of-interests stage, not to the threshold question of whether a legitimate interest exists at all. On the sphere of privacy affected: The court agreed with the lower court that the reviews concerned the data subjects' social sphere (specifically, their professional sphere as hotel operators) rather than their private sphere, since the criticised conduct occurred in public in the course of providing services to third parties. It held that this classification does not change merely because the business could hypothetically be sold to a third party in future, such a change of circumstances could be considered if and when it actually occurred, but did not retroactively reclassify the current processing. On the reasonableness of monitoring the platform: The court held that requiring the data subjects to check the platform for reviews was not excessive, given the low frequency of reviews, the availability of an email notification service and the fact that hotel operators offering services to the public must accept a degree of observation and criticism. The court limited the relevant comparison to the controller's own platform, not all review platforms on which the business might be listed, since only a claim against this controller was at issue. On protection against abuse: The court held that the absence of identity verification for reviewers was a relevant factor in the balancing exercise, but that a blanket requirement for reviewers to identify themselves would be disproportionate, given the recognised value of anonymous expression online. It held that the controller's existing measures allowing establishment representatives to report abusive reviews for removal, were sufficient, although it criticised the lower court's findings on this point as underdeveloped. However, since the data subjects failed to show that any specific personal data would have been removed had a stricter verification system existed, this shortcoming did not establish unlawfulness in the specific case. On the second data subject's claim of heightened risk as a former political figure: The court held that a data subject wishing to invoke a "particular situation" under Article 21 GDPR must lodge an actual objection to processing on that basis; simply mentioning a past political role during proceedings did not amount to such an objection and the erasure request had in fact been based solely on unlawful processing under Article 17(1)(d) GDPR, not the objection-based ground under Article 17(1)(c) GDPR. Finally, the court declined the data subjects' request for a preliminary reference to the CJEU, noting that the CJEU has already made clear that the case-specific balancing of interests under Article 6(1)(f) GDPR is a matter for the national court. (C-252/21)
Customer (Data subject)
The data subject was in a dispute with a health insurance company (the controller) about premium adjustment issues in their insurance plan, and associated missed explanation obligations. The data subject repeatedly used their right to access information via Article 15 GDPR to obtain data about the contribution history of the insurance contract. The data subject's original access request sought extensive documentation (all correspondence and attachments). The controller refused such frequent and extensive requests, citing Article 12(5) GDPR, which allows a controller to refuse or charge a reasonable fee for excessive or repetitive requests. The court confirmed that only the personal data of the data subject falls within the scope of Article 15 GDPR. The mere fact that some documents like formal letters or appended documents in insurance correspondence exist does not mean the entire document collection is personal data if only parts of them relate to the data subject. The court explicitly stated that an access request may be repeated and the existence of prior disclosures does not extinguish the right to access further relevant personal data, so a controller cannot claim that a prior fulfillment of a request automatically precludes subsequent valid requests under Article 15 GDPR. The court further held that the broad set of documents originally requested by the data subject was too general and did not meet this requirement. Only specific documents about the data subject’s insurance relationship were treated as identifiable personal information. The court granted the data subject a more narrowly tailored access right to certain personal data, which requires the controller to provide a copy of specific personal information about the data subject’s contract for the years 2017 to 2019, including the dates and amounts of old and new insurance contributions, the dates of insurance plan changes and the dates when the insurance plans were terminated.
Court case W292 2248672-1
The data subject wanted to enter into an energy supply contract with an energy supplier in 2020, but received a letter back on 1 October 2020 from the energy supplier that this was not possible due to an insufficient credit rating. This credit check was done by a credit reference agency (the controller). On 7 October 2020, the data subject submitted an access request under Article 15 GDPR to the controller. On 8 October 2020, the controller provided the data subject with the personal data it had of the data subject, including their name and address. It also stated that the energy supplier had made a credit inquiry to the controller about the data subject on 1 October 2020. On 7 January 2021, the data subject requested the controller to properly comply with its obligation to provide access. On 13 January 2021, the controller replied that there was no right to access under Article 15(1)(h) GDPR with regard to the calculation of credit scores and the parameters and methods that were used to calculate a risk value as those were seen as business secrets of the controller. On 17 March 2021, the data subject lodged a complaint against the controller at the Austrian DPA (“Datenschutzbehörde -DSB“). The controller argued in the proceeding that there was no automated decision-making within the meaning of Article 22 GDPR and that there was therefore no right of access under Article 15 GDPR. It furthermore argued that it calculated the credit score on the basis of the parameters “qualified payment defaults (debt collection entries, insolvency, etc.) age, and place of residence”. Regarding the data subject, the controller sent a “medium” credit score to the energy supplier. No negative payment history data was available in the controller’s system to determine the creditworthiness score of the data subject. The controller stated it collected data from publicly available sources, data from address publishers and information on payment experience provided by corporate customers an
XXXX
The Austrian Data Protection Authority (DSB) fined a controller 500 000€ for failing to fulfil its obligations under Articles 12 and 15-22 of the GDPR. The controller collected information and marketing classifications on the party affiliations of the entire Austrian population. Data subjects filled out more than 30 000 requests. In response, the controller created a web contact form to enforce the three most frequently used data subject rights, thereby limiting other contact options. The controller did not adequately facilitate the exercise of data subject rights by limiting them to "the three most used". The three most used data subject rights were the right of access, the right to erasure and the right to object. Other data subject rights were not included in the contact form. Data subjects requested to exercise their rights under the GDPR. The controller failed to provide appropriate mechanisms or responses to these requests, leading to complaints from the data subjects. The DSB initiated an investigation into the controller's practices following these complaints. The investigation revealed that the controller had not sufficiently complied with the GDPR, particularly regarding the facilitation of data subject rights. The controller appealed. The Federal Administrative Court dismissed the appeal of the controller as unfounded. The Federal Administrative Court upheld the DSB's decision that the controller violated Article 12(2) GDPR by failing to facilitate the exercise of data subject rights in a transparent and accessible manner, as it restricted requests to only three data subject rights through a mandatory contact form: 1. right of access, 2. right to erasure, and 3. right to object. The Federal Administrative Court held that the requirement to provide a copy of an ID as a prerequisite for exercising these rights violated Article 12(6) GDPR, as it imposed an unnecessary burden on data subject.
ING Bank N.V.
In 2003, the data subject opened an account with revolving credit at a Dutch bank, ING Bank N.V. (the controller). In October 2006, the data subject had a delay in the payment of his credit. In December 2006, the controller terminated the data subject’s contract and claimed payment of the then outstanding debt of €27,985.63. In 2007, the data subject made a payment arrangement, but ceased to honour this arrangement after paying only a few instalments. The controller sent letters requesting payments in 2015, 2017 and 2019 to the data subject. On 23 March 2023, the data subject successfully invoked the statute of limitations. The data subject’s balance deficit was registered by the controller in the Central Credit Information System (“Centraal Krediet Informatiesysteem – CKI”), which is administered by the Central Credit Registration Office (“Bureau Krediet Registratie – BKR”). The controller is obligated under [https://wetten.overheid.nl/BWBR0020368/2024-07-10 Article 4(32) of the Dutch financial Supervision Act] (“Wet financieel toezicht – Wft”) to participate in the Central Credit Information System. The aim of the credit registration is twofold: on the one hand to protect consumers from over-indebtedness, and on the other hand to protect credit providers from borrowers who have been found to be unable or unwilling to repay their loans. The workings of the CKI is laid down in the Dutch General Regulations CKI (“Algemeen Reglement CKI – AR”), including that the retention period is five years after fulfilling the debts. In this case, the retention period started when the data subject invoked the statute of limitations, thereby writing off his debts. The data subject then requested the controller to erase the registration. The controller did not comply. The data subject filed an urgency procedure (“kort geding”) under Dutch civil law at the Amsterdam District Court (“Rechtbank Amsterdam”) against the controller. The data subject requested the court to order the controller to erase the registration in the CKI. The data subject argued that their interests in erasing this registration outweighed the interests of the controller. The data subject lived in small social housing that does not allow for all his three kids to live there. This is why the data subject wanted to buy a house, but could not get a mortgage due to the registration in the CKI. The data subject argued that he had a stable financial situation as he had a permanent employment contract for an indefinite period and savings of around €23,000.00. The controller argued that there was not an urgent interest of the data subject as the data subject had housing to live in. Moreover, the controller suffered nearly €30,000 in damages because the data subject did not repay the loan and was successful in invoking the statute of limitations. The controller argued that if registration was removed, another credit provider would mistakenly think that the data subject had a clean credit history. The court held that the controller processed personal data as part of registering the personal data of the data subject in the CKI with the legal basis of legitimate interests under Article 6(1)(f) GDPR. The court held further that under Article 21(1) GDPR, the data subject has the right to object to processing of his personal data on the basis of Article 6(1)(f) GDPR at any time on grounds relating to his particular situation and the controller must then cease processing, unless it puts forward compelling legitimate grounds for the processing which outweigh the interests, rights and freedoms of the data subject. The court then performed a balancing of interests. The court also took into account that with the passage of time after registration in the CKI, the interests of the data subject will increasingly weigh more. The interests of the data subject to obtain a mortgage to provide a place for his children that is now not possible in his current rental house was found to be a concrete interest for removing the registration in the CKI. The court noticed that there was no information about other debts of the data subject, in any case not after invoking the statute of limitations. The court also noticed that the data subject was financially stable and therefore found that there are no concerns about the data subject’s recent financial past. Moreover, the five-year retention period started on 23 March 2021 when the data subject invoked the statute of limitations. Thus, only two years were left. The court agreed with the controller that the five-year retention period was intended, among other things, to protect other credit institutions by informing them with the recent financial past of a registered person. However, as this is about the recent financial past, that is also the reason why the registration is removed after five years in any case (no matter how serious the default or how large the write-off may have been). The court found that the controller did not provide sufficient arguments to uphold the remaining two years of the retention period to protect the data subject from over-indebtedness and other financial problems or to protect other lending institutions. The court thus held that the interests of the data subject outweighed the interests of the controller. The court ordered the controller to erase the registration of the data subject in the CKI within 14 days and to pay the costs of the proceedings.
Court case VI ZR 223/21
In April 2019, following Article 15 GDPR, the data subject requested access to his personal data from an insurance company related to a terminated pension insurance contract that was initiated in 2004 and settled by 2017. The information included transcripts of statements and copies of data from the contract in order to be able to examine a possible right of withdrawal. The controller provided the personal data it had stored (name, address, date of birth, email address, bank details, nationality, marital status, health data) and financial details like the total contributions paid, but the data subject considered it was insufficient, particularly regarding specific data and documentation related to the insurance dealings. The data subject requested the following data: # the statements made by the controller to the data subject (letters of termination, statements and enquiries regarding the contract, statements regarding the state of health); # the statements made by the controller to the data subject or to third parties (insurance certificate with supplements, cover letters, termination letters, payment reminders, settlement letters, notifications about the status of the contract); # accounting data for each incoming and outgoing payment stored in relation to the data subject's insurance contract; and # the fund profits achieved, the amount of the administration, distribution and acquisition costs deducted from the data subject's insurance premium, the capital at risk, the probability of loss occurrence and/or the actual value of the risk protection. In 2020, the Regional Court of Stuttgart (Landgericht Stuttgart - LG Stuttgart) dismissed the claim because there was no entitlement to further information than that already provided. In 2021, upon appeal by the data subject, the Higher Regional Court of Stuttgart (Oberlandesgerichts Stuttgart - OLG Stuttgart) partially amended the Regional Court’s judgment and ordered the controller to provide the data subject with information about statements and transactions, and awarded partial reimbursement for the data subject legal costs. The case was then appealed to the Appeal Court with regard to the rejected claim for transcripts and copies. The data subject is pursuing his request to the extent of the appeal being dismissed, with the proviso that with regard to the request for information under item "4" (fund profits achieved, etc.), the data subject is now requesting the transmission of copies of the more precisely specified data directly, i.e. not as previously by way of a staged action. In the alternative, the data subject has applied in the Appeal instance for copies of the personal data contained in the documents to be sent to him. The German Federal Court of Justice (Bundesgerichtshof – BGH) held that the data subject is entitled to request additional information under Article 15(1) GDPR, specifically copies of statements he made to the controller. However, the court limited this right to personal data, excluding internal processes of the controller that do not directly concern the data subject, such as internal financial calculations and risk assessments which were deemed not to be personal data. Furthermore, the Court found that the data subject does not have rights to the more detailed data he sought referred to fund profits and risk assessments, as these do not constitute personal data under GDPR. BGH also clarified that the right to a copy under Article 15(3) GDPR does not extend beyond the scope of Article 15(1), meaning the data subject is only entitled to copies of his personal data, not other documents or data beyond this. The decision also stated that the data subject's claims for copies of data do not arise from Section 3 of the Insurance Contracts Act (VVG), as the insurance relationship had been fully terminated and settled. As such, these rights no longer apply. The Court also found that the Regional Court incorrectly denied the data subject's right to receive copies of statements made by the controller and booking data related to the data subject's contract and transactions, these should be reassessed and was referred back to the Appeal Court for a new hearing and decision.
The data subject is a user of the Facebook, Instagram and WhatsApp platforms. On 3 November 2023, Facebook (“the controller”) introduced their “Pay or Okay” model. On 10 November 2023, the data subject consented to the use of their data for ads on Facebook and Instagram. On 15 May 2023, the data subject requested access, damages and injunctive relief from the Regional court Regensburg (“Landgericht Regensburg”). The controller answered that it could not reply within the deadline under Article 12(3) GDPR, but only within three months’ time. The controller replied on 5 June 2023. The controller stated that it does not forward any information for advertising purposes to advertisers who personally identify users in the context of the processing at issue, unless the user has consented to the forwarding of their data to a specific advertiser. On 13 February 2024, the data subject amended its application and requested the Regional court Regensburg (“Landgericht Regensburg”) to order the controller to provide access under Article 15 GDPR and answer the specific questions the data subject had about their personal data in connection with the targeted advertising. Moreover, the data subject requested the Court to order the controller to pay the data subject non-material damages and to erase the personal data collected in the period between 25 May 2018 and 6 November 2023 under Article 17 GDPR. The data subject argued that they suffered a loss of control over its personal data. The inadequate information provided by the controller resulted in the data subject not knowing how their personal data had possibly been passed on to which third parties, or how it had been used by the controller for targeted advertising. Moreover, the data subject argued that they had received a lot of spam due to leaked data from his Facebook account. The data subject also argued that they always found the use of their personal data for the purposes of advertising aimed at them personally unpleasant. The data subject admitted they gave consent on 10 November 2023 to allow the controller to use personal data for advertising purposes. But the data subject argued that they had no choice, as this would have meant breaking off contact with numerous friends and acquaintances. The controller argued that they already complied with the access request by providing the information either in their privacy policy or in the letter of 5 June 2023. Moreover, the controller argued that there was no claim for damages as there had been no violations of the GDPR. Access Request The Court dismissed the data subject’s request for access after looking at the specific questions the data subject asked the controller in their access request under Article 15 GDPR. Regarding the data subject’s question on which personal data the controller processes for advertising purposes, the Court held that this could be found in the controller’s privacy policy. The privacy policy also explained how it collects personal data to provide personalised advertising. In that regard, the controller already provided the necessary information. Regarding the data subject’s question how often the above data was processed, the Court stated that this did not fall within the scope of Article 15 GDPR. Regarding the data subject’s questions on the forwarding of data to third parties for advertising purposes, the Court held that they were already answered by the controller in their reply of 5 June 2023. The Court thus found that the controller complied with the access request regarding this aspect. The Court stated that it was irrelevant whether the answer of the controller contained any inaccuracy and referred to national commercial case law ([http://juris.bundesgerichtshof.de/cgi-bin/rechtsprechung/document.py?Gericht=bgh&Art=en&az=III%20ZR%20136/18&nr=110327 BGH III ZR 136/18]). The question regarding what data was collected for targeted advertising purposes using WhatsApp, the Court stated that Whatsapp is not operated by the controller, but by the controller WhatsApp Ireland Limited. Moreover, the controller stated in its letter of 5 June 2023 that it does not process any data of European WhatsApp users for the purpose of personalised advertising. Thus, the Court found that the controller already complied with the access request. Non-material Damages The Court found that the data subject was not entitled to compensation for non-material damages pursuant to Article 82(1) GDPR, because the data subject did not proof it had suffered any non-material damage. The Court found the argumentation of the data subject too generalised as the data subject did not indicate to what extent the alleged loss of control should constitute damage that goes beyond a mere negative consequence. Moreover, the alleged increased volume of spam could not be categorised as damage within the meaning of the GDPR. The data subject also did not proof there was a causal link between the increased volume of spam and the controller’s processing for the placement of personal advertising. The Court stated that people who do not have a Facebook account also receive unsolicited text messages and spam emails. Regarding the data subject’s argument that they had no choice but to give consent, the Court took into account the CJEU case Bundeskartellamt. The CJEU ruled that the controller’s dominant position on the market for online social networks did not in itself preclude the users of such a network from effectively consenting to the processing of their personal data by the controller. According to the CJEU, the freedom of the user is safeguarded if an equivalent alternative is offered for a reasonable fee that does not involve such data processing operations. Thus, the Regional court Regensburg held that this freedom was ensured by the controller with the introduction of their “Pay or Okay” model. The data subject decided against the ad-free paid subscription and consented to receiving personalised advertising. Erasure Request Regarding the request for erasure, the Court stated that the data subject was not entitled to erasure of their data under Article 17 GDPR, as the data subject expressly consented to the controller for continuing to use their personal data for advertising purposes. According to the Court, the requirements for the right to erasure pursuant to Article 17(1)(b) GDPR were therefore not met in any case due to the existence of consent. Conclusion The Court thus dismissed the case and ordered the data subject to pay the costs of the case, which was set at € 7,000.
Court case 1592/23
A company (the controller) entered into contract with another company represented by its CEO (the data subject). The data subject claimed that after the conclusion of the contract between the companies, the controller processed their data for marketing purposes, as they received marketing calls from the controller. The data subject requested (via e-mail) the controller to delete their data under Article 17 GDPR. Nevertheless, the data subject received another marketing call. The data subject file a complaint with the Polish DPA (UODO). During the proceedings, the controller explained that the data they processed were treated as data of a legal person, not the data subject’s data. After the investigation, the DPA stated that the controller processed the data under Article 6(1)(b) GDPR, since there was contractual relationship between the controller and the company represented by the data subject. Hence, the data provided with the controller served the purpose of facilitating the contract. Afterwards, the data subject filed another deletion request under Article 17 GDPR, regarding all their data processed by the controller. The controller answered the request and asked the data subject to clarify whether they wished to close the account with the controller. If so, the data subject was asked to send written application to close the account and delete the data. Once again, the data subject received marketing call from the controller. The data subject’s data was eventually deleted once the DPA contacted the controller. The DPA issued the reprimand against the controller for unlawful processing of data for marketing purposes. For the DPA, after the second deletion request, there was no legal basis in place to process the data for marketing purposes. The controller brought an appeal against the DPA’s decision before the Voivodeship Administrative Court in Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The controller argued that, inter alia, they didn’t contac
Budapest Főváros IV. Kerület Újpest Önkormányzat Polgármesteri Hivatala
In February 2020, the Újpest administration (the controller) obtained personal data about Hungarian residents from the Hungarian Treasury and Budapest district office. The intent was to determine eligibility for a program seeking to provide financial supports to residents made vulnerable by the COVID-19 pandemic. The Hungarian DPA initiated an investigation after a report alerted it of the processing. The DPA determined that the controller failed to timely inform data subjects of the categories of personal data processed, the purposes of processing, or how they could exercise their rights in relation to the processing. On 22 April 2021, it found that the controller violated Articles 5, 14, and 12(1) GDPR. Pursuant to Article 58(2)(d), the DPA ordered the controller to erase the personal data of data subjects who were entitled to the right to erasure but had not requested it. The controller challenged the DPA’s order before the Fővárosi Törvényszék (Budapest High Court), arguing that Article 58(2)(d) GDPR does not empower the DPA to order the erasure of personal data in the absence of an Article 17 GDPR request from the data subject. Seeking clarification on the interpretations of Article 17 and 58(2)(d) GDPR, the Budapest High Court referred two questions to the CJEU: # Can a DPA order a controller or processor to erase unlawfully processed personal data despite the absence of a request from the data subject? # If the DPA can exercise such corrective power, is that so whether or not the personal data were obtained from the data subject? In deciding the first question, the Court held that some corrective powers under Article 58(2) GDPR, namely 58(2)(d) and (g) GDPR, may be exercised by the DPA on its own motion. Article 58(2)(c) GDPR, on the other hand, does require a prior data subject request. The Court noted that the plain language of Article 58(2)(d) and (g) GDPR does not require a data subject request to authorize the DPA’s corrective power. Article 58 GDPR
Finanzamt
The data subject had a dispute with the German tax authority (Finanzamt), which was resolved by a previous judgement. After that, on 14 October 2020, the data subject filed an access request with this authority, which is the controller in the present case. On 21 October 2020, the controller rejected the request, arguing that they did not have a right to access under Article 15 GDPR as the legal proceeding with the FA was already terminated. Moreover, the controller argued that the request was excessive under Article 12(5) GDPR. The data subject started a lawsuit against the controller before the Berlin-Brandenburg Fiscal Court (Finanzgericht Berlin-Brandenburg – FG Berlin-Brandenburg). The data subject claimed they had not only the right to obtain a copy of their personal data, but also to have a copy of the documents or an extract of the database where their personal data was contained. The court did not uphold the data subject’s requests. The court argued that Article 15(3) GDPR must be interpreted restrictively and, therefore, the data subject did not have the right they claimed. Moreover, the court held that, even if the data subject had such a right, their request would have been excessive as per Article 12(5) GDPR. Therefore, the data subject lodged an appeal against the decision with the Federal Fiscal Court (Bundesfinanzhof – BFH). First of all, the BFH noted that the right to access under Article 15 GDPR is conferred to data subjects independently from any other legal proceeding. It stated that the purpose of this article is to ensure that the data subject is aware of the processing of their personal data and can verify the lawfulness of the processing. Secondly, the BFH dismissed the data subject’s argument and found that the data subject has no general right to obtain a copy of extracts from documents where personal data is contained. According to the court, the data subject can normally verify the accuracy of the personal data and the lawfulness of i
Klarna Bank AB
On 28 March 2022, the Swedish DPA ("IMY") fined Klarna AB ("the controller") €730,000 (SEK 7,300,000) for not providing data subjects with adequate information related to their processing activities. The DPA found that the controller violated the GDPR in several respects. The controller appealed the DPA's decision to a court of first instance, the Administrative Court of Stockholm ("FiS"). The Administrative Court upheld the controller's appeal in part and lowered the administrative fine to €600,000 (SEK 6,000,000) because the violations did not cause considerable harm and were not intentional and the controller had improved its information. The DPA appealed this decision to a court of appeal, the Administrative Court of Appeal of Stockholm ("KamR Stockholm"), requesting the fine to be raised back to €730,000 (SEK 7,300,000). The court of appeal, reviewed the entire appealed decision to decide whether the controller should be fined on the grounds put forward by the DPA. The Court therefore reviewed whether the controller provided complete or sufficient information on different aspects in their privacy policy and if they fulfilled the requirements on how it should be provided under Article 12 GDPR, Article 13 GDPR and Article 14 GDPR. The court of appeal disagreed with the court of first instance on whether the controller infringed Article 13(1)(f) GDPR by not indicating the specific countries to which personal data is transferred. The court of appeal found that the GDPR does not require that the specific third countries must be named. Therefore, the Court held that the controller did not violate Article 13(1)(f) GDPR by not specifying the third countries in their privacy policy. Moreover, the court of appeal disagreed with the court of first instance on whether the information provided by the controller on the rights of data subjects fulfilled the requirements of Article 13(2)(b) GDPR. This Article requires the controller to inform the data subject of the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning him or her, or to object to processing, and of the right to data portability. The court of appeal held that the wording of the provision does not indicate anything other than that the data subject must be informed of the existence of the rights. The court of appeal found that there is nothing to suggest that the controller, in addition to informing the data subject of the existence of the rights listed in Article 13(2)(b) GDPR, is obliged to describe the meaning of the rights in more detail. Therefore, unlike the court of first instance, the court of appeal found that the controller did not violate Article 13(2)(b) GDPR in that respect. The court of appeal agreed with the court of first instance that the controller failed to provide information on safeguards for third country transfers (Article 13(1)(f) GDPR) and the use of a scoring model in their automated decision-making and how the data was processed in it (Article 14(2)(g) GDPR). Thus, the court of appeal held that the controller violated Article 13(1)(f) GDPR and Article 14(2)(g) GDPR regarding these two elements of the privacy policy. Moreover, the court of appeal found that the controller did not provide information on automated decision-making in such an easily accessible form as required by Article 12(1) GDPR. The court of appeal considered that spreading information over different sections does not necessarily mean that the information is difficult to access by data subjects. However, the court of appeal found that the information on automated decision-making in the privacy policy referred to different sections of the privacy policy which made the information not easily accessible as it was difficult to identify what the relevant information was in the referred sections. The court of appeal also found that the information about the right to data portability was provided in such a way that it was difficult to understand that it is a separate right. The right to restriction was also expressed in the privacy policy as "oppose" and "stop processing". This was different terminology than the GDPR and created obscurity according to the court of appeal. Due to these ambiguities, the court of appeal found that the controller violated Article 12(1) GDPR. Given this new legal assessment, the court of appeal evaluated the appropriateness of the fine. As a mitigating factor, the court of appeal recognised that the breaches did not take place for a long time and the privacy policy had been continuously improved. However, the court of appeal took into account that the information concerned a large number of data subjects and that the shortcomings related to information based on articles that are fundamental to the data subjects. Finally, the court of appeal dismissed the controller’s argument that the DPA’s case took unreasonably long and that the controller’s right to be informed without delay of the significance of and grounds for the accusations was violated. Thus, the court of appeal did not see a reason to reduce the fine on the basis of Article 83(2) GDPR and [https://fra.europa.eu/en/law-reference/european-convention-human-rights-article-6 Article 6(1) and 6(3)(a) ECHR]. Thus, the court of appeal held that for an effective, proportionate, and dissuasive measure, the violations justified an administrative fine of €730,000 (SEK 7,300,000), which was the maximum amount according to the penalty framework in the case, and upheld the DPA’s appeal.
Court case 11 Sa 808/23
The data subject, a job seeker with over ten years of experience in debt and accounts management, applied twice for a position at a housing company (the controller) on 3 August 2022 and 3 December 2022. The controller did not respond to either application. On 18 May 2023, the data subject requested access to his personal data under Article 15 GDPR. After receiving no response, he sent reminders on 3 June 2023 and 18 June 2023, with deadlines of 17 June 2023 and 28 June 2023. The controller still did not respond. The data subject then filed a lawsuit at the Labour Court Düsseldorf ("Arbeitsgericht Düsseldorf - AG Düsseldorf") seeking a copy of his data, information on all the recipients to whom his personal data was disclosed to, and €5,000 in non-material damages. The first instance court ruled partially in favour of the data subject, granting the access request but denying the claim for non-material damages. The court held that a violation of Article 15(1) GDPR always means a loss of control and cannot be considered as the damage itself. Therefore, the court found that the data subject did not demonstrate any non-material damage entitling him to compensation. The data subject then appealed this decision at the Regional Labour Court Düsseldorf ("Landesarbeitsgericht Düsseldorf - LAG Düsseldorf"), adjusting his claim to €2,500 in non-material damages. First, the court held that the controller violated Article 15 GDPR in conjunction with Article 12(3) GDPR by not providing information on the data subject's personal data, its processing purposes, and the recipients of the personal data to the data subject after repeated requests. Second, the court determined whether the violation under Article 15 GDPR gave rise to a claim for compensation for material and non-material damage under Article 82(1) GDPR. The court held that Article 82(1) GDPR should not be interpreted too narrow. The court took into account that some case law take the view that violations under Artic
Court case 2021/04/0030-4
A data subject, an entrepreneur, requested access to their personal data at a credit ranking agency (“controller”). The controller provided certain information, including that a specifically named company had carried out a query regarding the identity and creditworthiness of the data subject. The data subject lodged a complaint with the Austrian DPA (“Datenschutzbehörde”) against the controller for violating their right of access under Article 15 GDPR and for violating the principles of data minimisation (Article 5(1)(c) GDPR), confidentiality (Article 5(1)(f) GDPR) and the controller’s information obligation under Article 14 GDPR regarding the transfer of the data subject’s data to a third party. The data subject argued that the information that the controller provided was inadequate as it did not provide the origin of the data, storage period, processing purposes and a copy was missing. The DPA dismissed the complaint, stating that the controller provided sufficient information. The DPA held that the controller fulfilled the information obligations as the information was publicly accessible on a website. The data subject appealed this decision to the Federal Administrative Court (“Bundesverwaltungsgericht”). The Federal Administrative Court partially upheld the complaint against the controller, stating that the controller violated the data subject’s right of access by providing insufficient information on the storage period within the meaning of Article 15(1)(d) GDPR. At the same time, the court dismissed the data subject’s arguments concerning the information on the origin of the data and the processing purposes. Concerning transparency obligations, the court further held that the controller did not fulfil its duty to provide information on the recipients of data and thereby violated Article 14(1)(e) GDPR. Finally, the court rejected the complaint on the alleged violations of data minimisation and right to confidentiality. Both the DPA and the controller appe