GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Enschede municipality
On 6 September 2017 the municipality of Enschede decided to start 24/7 WiFi tracking in the centre of the city. Its purpose was to measure the effectiveness of municipal investments, in view of the responsible use of public funds. The contract to execute this task was given to City Traffic B.V., now Bureau RMC. Bureau RMC then contracted an unnamed party to do the installation and maintenance of the sensors and to collect and validate the data gathered by the sensors. Information collected included hashed MAC-addresses, date and timestamp of exposure, signal strength and sensor ID. It was stored for a period between 6 and 7 months. Starting from 1 January 2019 the hashed MAC-addresses were also truncated. On 30 April 2020 the municipality gave an assignment to Bureau RMC to switch the tracking sensors off. The Dutch DPA concluded that the chosen anonymization method of truncating a small part of the hashed MAC address does not sufficiently exclude the risks of singling out, linking or deducing person’s identity based on a pseudonymous identifier + timestamp + location information (available via the sensor ID). Accofrding to the Dutch DPA employees of the controller could identify people in three ways: (a) When someone walks past sensor, their MAC address is registered and an employee in the vicinity of the sensor could see who is walking by and link the MAC address to the person walking by on that moment. (b) the moment that a device enters the range of the sensor and the moment when device leaves the range of the sensor were stored. If someone enters for a longer time but does not exit within range sensor, and employee could find out who is in the range of the sensor in the corresponding time-span and connect the MAC address to that person. (c) An employee could determine a movement pattern based on the readings of multiple sensors, and use this information to link the MAC address to a specific person. Because of these reasons the Dutch DPA held that the data pro
Garante per la protezione dei dati personali
On 16 September 2021, the Italian DPA issued a €200,000 fine against the controller, a university. While Covid-19 restrictions were in place, it used a proctoring software to ensure students were not cheating during the examination. Among other matters, the DPA found that the controller was processing biometric data without a legal basis. The controller challenged the DPA decision before the Court of Milan. On 20 October 2022, this Court partially upheld the controller’s appeal and overturned the DPA decision. It ruled that the data that was processed did not fall into the definition of biometric data as per Article 4(14) GDPR. On 12 January 2023, the DPA appealed the decision of the Court of Milan before the Supreme Court, which upheld the appeal and overturned the judgement. Firstly, the court analysed whether the data processed fell into the definition of biometric data in accordance with Article 4(14) GDPR. The court reminded that, according to this definition, personal data is biometric data when (1) it results from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person and (2) this processing allows or confirms the unique identification of that natural person. Secondly, the Supreme Court disagreed with the judgement of the Court of Milan: according to the former, this processing was actually involving biometric data. It observed that the software was not only filming students while they were taking the exam, but also analysing the recording. More specifically, it was detecting “unusual behaviours” and collecting these “anomalous elements” into a video. This video was then sent to the professor, who could then decide if a further investigation was necessary. The court pointed out that, among other functions, this processing allowed to uniquely identify the person, as during all the recording time the software constantly checks if the person behind the camera is actually the student who is supposed to take the exam. According to the judges’ opinion, the fact that then the video is assessed by a human being (the professor) is irrelevant for the qualification of this data as biometric data. As the Supreme Court is only allowed to rule on principles of law and not on matters of fact, the case was referred again to the Court of Milan.
Datenschutzbehörde (DPA)
The controller was an Austrian social security body and the data subjects were three employees. On 30 July 2020, the controller’s administrative board had a a non-public meeting and created a transcript of that meeting that only 26 people had access to. On 15 August 2020, a website published an article containing verbatim statements from named participants in the confidential transcribed meeting. On 16 October 2020, the controller started an internal investigation into the handling of meeting records and data security. In February 2021, it carried out a search of the email server logfiles of all employees for communications sent to a specific recipient domain. The search covered 6,000 employees’ mail server logfiles and produced a list containing sender and recipient email addresses, delivery status, subject line, size, and date and time of sending, but the controller did not review email content. The controller involved the works council chair of the head office, but it did not involve the local works councils representing the three data subjects, despite the controller’s internal works agreement requiring the local works council to be involved. The data subjects complained to the DPA on 15 February 2022. They argued that the controller had unlawfully searched employees’ email data without a valid legal basis and not with the correct procedure. The DPA upheld the complaint. The controller appealed to the Federal Administrative Court. First, the court held that the searched logfiles contained personal data within the meaning of Article 4(1) GDPR. The sender and recipient email addresses identified employees because they contained their first and last names, so searching those logfiles therefore amounted to processing under Article 4(2) GDPR. Second, the court rejected the DPA’s view that the controller needed a specific statutory basis because it was a public body. The court held that, in its relationship with employees, the controller acted under private law rat
LGS Handling Ltd
On 6 June 2018, a complaint was lodged against 3 controllers (LGS Handling Ltd, Louis Travel Ltd, Louis Aviation Ltd) regarding the implementation of an automated system for managing, monitoring and controlling the sick leave absences of their employees using a scoring tool known as the Bradford Factor. The Bradford factor is calculated based on the number of occasions of absence and the total number of days absent in a 52-week period. The Cypriot DPA ("Commissioner") indicated that the date of sick leave and the frequency of taking sick leave, insofar as the data subject’s identity is disclosed constitutes “special categories of personal data” as defined by Article 9(1) GDPR. Employers are entitled to exercise supervision over the frequency of sick leave and/or the validity of sick leave, however, this right must not be exercised within the limit set by the relevant legal framework and should therefore be limited to what is necessary. The Commissioner decided that the rating of statutory sick leave was beyond the competence of the employer and that the legitimate interest assessment was inconclusive. The decision also indicated that the legitimate interest assessment would have been valid if the automated system was simply counting the number of absences due to sick leave without multiplying with other factors such as frequency. The Commissioner therefore concluded that the controller had in fact breached Articles 6(1) and 9(2) GDPR and therefore imposed an administrative fine of €70, 000, €10,000 and €2,000 respectively. The controllers appealed this decision in front of the Cypriot Administrative Court on 25 October 2019. The appeal focused on whether the system they were using was investigated correctly. The administrative court decided that the Commissioner did not have the power nor the authority to impose on controllers whether or not to use a system because its power is limited to investigating whether the processing carried out is lawful. The a
LähiTapiola Keskinäinen Henkivakuutusyhtiö
The controller (LähiTapiola Keskinäinen Henkivakuutusyhtiö, a life insurance company) had asked the Administrative Court of Helsinki (the Court) to overturn the Finnish DPA's decision, according to which the controller had no legal basis to process the health data of life insurance applicants and it processed the data unnecessarily. The controller filed the appeal claiming that it must be able to process health data, because the health status of the insured party and the risks associated with it are at the centre of the risk assessment related to the granting of the insurance. The controller considered that insurance applicants must also be considered insured parties in accordance with [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L2P6 Section 6(1)(1) of the Finnish Data Protection Act], according to which insurance institutions may, despite the general prohibition in Article 9(1) GDPR, process the health data of the insured party and the claimant, which is necessary to determine the liability of the insurance institution. The controller also stated that the order issued by the DPA, on the basis of which it should assess the time period for which it is necessary to request health data, is vague and unspecified. The controller considered that it must be able to process all health data in order to assess which precise information is ultimately relevant. The Court noted that neither the Finnish Data Protection Act nor its preparatory material have defined what is meant by the insured party in connection with the application of the Act. However, in the Court's view, the preparatory material of the Act does not support as an interpretation that the legislator intended to extend the concept of "insured party" to apply also to the applicant an insurance before the conclusion of an insurance contract. In this respect, the Court also stated that the "insured party" is defined in [https://www.finlex.fi/fi/laki/ajantasa/1994/19940543#L1P2 Section 2(1)(5) of the Finni
OP-Henkivakuutus Oy
The controller (OP-Henkivakuutus Oy, a life insurance company) had asked the Administrative Court of Helsinki (the Court) to overturn the Finnish DPA's decision, according to which the controller had no legal basis to process the health data of life insurance applicants. The controller filed the appeal claiming that it must be able to process the health data because the health status of the insured party and the risks associated with it are at the centre of the risk assessment related to the granting of the insurance. The controller also considered that insurance applicants must also be considered insured parties in accordance with [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L2P6 Section 6(1)(1) of the Finnish Data Protection Act], according to which insurance institutions may, despite the general prohibition in Article 9(1) GDPR, process the health data of the insured party and the claimant, which is necessary to assess the risks of the insurance institution. The Court noted that neither the Finnish Data Protection Act nor its preparatory material have defined what is meant by the insured party in connection with the application of the Act. However, in the Court's view, the preparatory material of the Finnish Data Protection Act does not support as an interpretation that the legislator intended to extend the concept of "insured party" to apply also to the applicant of an insurance before the conclusion of an insurance contract. In this respect, the Court also stated that the "insured party" is defined in [https://www.finlex.fi/fi/laki/ajantasa/1994/19940543#L1P2 Section 2(1)(5) of the Finnish Insurance Contracts Act], according to which the insured refers to the party that is currently subject to personal insurance or non-life insurance policy. Thus, the Court considered that this definition could be used as a starting point for interpretation also when applying [https://www.finlex.fi/fi/laki/ajantasa/2018/20181050#L2P6 Section 6(1)(1) of the Finnish Da
Court case W298 2266986 -1/20E
A judicial officer (data subject) of an Austrian prison was injured by a prisoner in 2021, following which he reported the offence and started legal proceedings against the prisoner. During the criminal investigations, the judge granted access to the files to the accused, which included personal data of the data subject, among others information about her injury, annual salary, marital status and contact details. These data had been provided to the judge by the employer of the data subject, the Federal Ministry of Justice, who joined the proceedings as a co-participating private party and was represented in this by a state attorney. According to the data subject the controller should not have disclosed such information about her and this constituted a violation of her right to privacy, hence she filed a complaint with the Austrian DPA ('DSB'). The state attorney, hereinafter the controller, submitted that the employer had suffered a financial damage as a consequence of the sick leave of the data subject and had to provide documents about her health status to prove the damage in accordance with Austrian Criminal Procedural law. The controller believed this to be compliant with Article 9 GDPR. The data subject instead claimed that the documents should have been redacted. On 11 November 2022, the DSB dismissed the complaint stating that its competence is limited to verifying whether the documents provided by the controller were appropriate to serve as evidence for the investigation, which it confirmed. The DSB claimed that it cannot rule on the content of the documents adduced by a representative of a public authority during a court procedure. The data subject appealed the decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG) claiming that the controller provided more unredacted documents to the court than strictly necessary, thereby violating Article 5(1)(c) GDPR. The BVwG first of all considered that the DSB erred in assumi
Data subject
The data subject received unemployment benefits from a regional office (the controller) of the Austrian Public Employment Service (AMS). From 18 November 2016 until at least 19 January 2019, the regional office processed the data subject's personal data in connection with benefit eligibility checks. The processing included scheduling control appointments and ordering medical examinations to assess the data subject’s ability to work. The processed data included identification data and health data, such as references to heart problems and doubts about work capacity. The controller also transferred health-related information to a pension institution. The data subject argued that the controller processed her data during periods in which no active supervisory or benefit relationship existed, including periods of illness and periods in which benefits had been suspended. She also argued that the controller accessed social security data without a legal basis during those periods. On 25 July 2019, the data subject filed a complaint with the DPA against the controller. The DPA forwarded the complaint to the federal organisation of the AMS, not the controller (the regional office responsible for the data subject). The DPA later rejected the complaint, as it held that AMS Austria was the controller as the regional offices lacked separate legal personality. It also held that the processing was lawful because the AMS had statutory duties to verify eligibility for unemployment benefits. The data subject appealed the DPA decision before the Federal Administrative Court. First, the court held that the GDPR applied because while the alleged infringement started before the GDPR became applicable on 25 May 2018, it continued on after. Second, the court held that the DPA had incorrectly assessed AMS Austria as the controller. The court noted that Article 4(7) GDPR expressly recognises a “public authority” as a controller. It also referred to Article 6(1)(e) GDPR, which covers processi
Prisoner (data subject)
The data subject was an inmate in a prison. The controller operated the prison and employed a prison doctor. In a complaint to the Ombudsman board, the data subject said that the shower rooms caused skin irritation during cleaning work. On 27 April 2022, the Ombudsman board asked the Ministry of Justice for information. The prison’s legal office then asked the prison doctor to provide a medical statement to support the prison’s reply. On 04 May 2022, the doctor addressed what happened when the data subject contacted her in December 2021 and disclosed health data about the data subject. On 04 October 2022, the data subject filed a complaint with the Austrian DPA. They argued that there were outdated privacy notices and weak compliance in the prison, unauthorised internal access by prison staff to inmate data as well as unauthorised access to the data subject's phone, and unauthorised disclosure by a former lawyer who allegedly sought file access without a valid mandate and passed material to third parties. The data subject also accused the prison doctor of sharing sensitive health information without their consent and thereby violating Article 5 GDPR and Article 9 GDPR. On 22 February 2023, the DPA rejected the complaint. The data subject appealed to the Federal Administrative Court. First, the court focused on who qualified as the controller for the Ombudsman-related disclosure. It noted that Article 4(7) GDPR assigned controller status to the entity that decided the purposes and means of processing, not to individual employees acting on instructions. Second, the court upheld the DPA’s approach on the identification of the controller in a complaint. Following the national rule on complaint requirements (§ 24(2) DSG), the court held that when a complaint clearly targets a specific person who is not the controller for the processing, the authority has to dismiss the complaint. Third, the court held that the prison governor (as the prison authority) was the controller for disclosures made in replying to Ombudsman inquiries. National prison law assigned responsibility for such processing to the prison authority and treated the Ministry and the prison authority as jointly responsible in the prison IT context. The prison doctor acted as an employee providing statements on behalf of the prison authority. Therefore, she was not a controller under Article 4(7) GDPR for that processing. Finally, because the complaint was directed against a non-controller, the court dismissed the appeal and left other allegations outside the scope of this case.
Court case 3 Bs 146/23
The data subject as a data subject in this case, was a candidate for the election of the students' parliament at the University of Hamburg. Upon signing up for candidacy the data subject was requested to disclose his date of birth in the candidacy registration form, but he claimed this to be unnecessary and filed his candidacy without providing his date of birth. The University rejected his candidacy on this basis, claiming that all candidacies must also entail the candidates' date of birth. The data subject decided to file suit against the member organisation of the University with the Administrative Court of Hamburg (Verwaltungsgericht Hamburg, VG Hamburg) The controller is the University of Hamburg, a legal entity under public law of the City of Hamburg. The Hamburg University Election Act (Wahlordnung, WahlO) stipulates that to be able to run for elections, every candidate must provide their full name, student number, date of birth, current home address and an email address. In its submissions, the controller argued that processing the date of birth of candidates was necessary for the purpose of identifying them beyond doubt and ensuring that the candidates were of legal age. On 11 February 2023, the VG Hamburg, in the first instance, held that the data subject's candidacy registration form was incomplete because the required date of birth was missing and that this requirement does not raise any data protection concerns. Hence, the court took the view that he had not submitted a complete form in a timely manner and therefore could not run for election. The data subject thus decided to appeal the decision to the Higher Administrative Court of Hamburg (Oberverwaltungsgericht Hamburg, OVG Hamburg). The OVG Hamburg first of all held that the GDPR applies because the date of birth of a data subject constitutes personal data and its use in the context of the election is to be considered data processing. Further, the OVG held that the only legal basis for such da
CJEU case C‑319/22 Gesamtverband Autoteile-Handel (Access to vehicle information)
Scania, a manufacturers of heavy goods vehicles in Europe, grants car repairers access to repair and maintenance information via a website. That website enables searches to be carried out either on the basis of general vehicle information, such as the model, engine or the year of manufacture, or on a given vehicle, by entering the last seven figures of the Vehicle Identification Number (VIN) of that vehicle. VINs in this context are serial numbers and should not be confused for license plates. Gesamtverband, a competitor of Scania, argued that the information granted by Scania to repairers is anti-competitive. It requested the court to order Scania to grant also independent operators (rather than just repairers) access to the above information. Allowing indepenant operators this information would ensure effective competition in the market for vehicle repair and maintenance information services, as it ensures that the independent vehicle repair and maintenance market as a whole can compete with authorised dealers. Alongside other questions, the referring court (while taking the view that, as a general rule, the VIN does not constitute personal data) asked whether Article 61 of Regulation 2018/858 must be interpreted as imposing on vehicle manufacturers a legal obligation to process data, within the meaning of Article 6(1)(c) GDPR. The CJEU informally split the question into two topics. Firstly, whether a VIN can be considered personal data. Secondly, if a VIN is personal data, is an obligation to provide a VIN compatible with the GDPR? On the first point, the CJEU held that VINs constitute personal data within the meaning of Article 4(1) GDPR, in so far as the natural person who has access to a VIN may have means which reasonably allow them to use the VIN to identify the owner of the vehicle to which it relates. It is for the referring court to examine whether that occurs in each case. To come to this decision, the court referenced Article 4(1) GDPR which states that personal data is ‘any information relating to an identified or identifiable natural person’ and paragraphs 42 and 43 of Breyer (C 582/14, EU:C:2016:779). They also agreed with AG Bobek who stated in paragraphs 34 and 41 of his opinion that VINs are personal data to independant operators 'where [they] may reasonably have at their disposal the means enabling them to link a VIN to an identified or identifiable natural person. On the second point, the court decided that even when a VIN is classified as personal data, the GDPR does not preclude car manufacturers from being obliged to make them available to independent operators. Thus, Regulation 2018/858Regulation 2018/858 imposes an obligation on manufacturers to provide vehicle OBD information and vehicle repair and maintenance information. does not exclude the application of the legislation on data protection. Article 61(1) of Regulation 2018/858,Article 61(1) of Regulation 2018/858 states: 'Manufacturers shall provide to independent operators unrestricted, standardised and non-discriminatory access to vehicle OBD information, diagnostic and other equipment, tools including the complete references, and available downloads, of the applicable software and vehicle repair and maintenance information. Information shall be presented in an easily accessible manner in the form of machine-readable and electronically processable datasets. …' must be interpreted as meaning that it establishes a ‘legal obligation’, within the meaning of Article 6(1)(c) GDPR, on car manufacturers, to make the VINs of the vehicles which they manufacture available to independent operators, as ‘controllers’, within the meaning of Article 4(7) GDPR.
[plaintiff] BV
The data subject, an asset management professional, undertook an agreement with PME Investment Services. The agreement was that the data subject would take over a housing project mediated by PME, and in return PME would be awarded a fee and a minor percentage of the subsequent sale of the apartments. However, the data subject failed to uphold the agreement. As a result, on 9 May 2018, PME filed a suit against the data subject. After a first decision, on 27 January 2021, the case was brought to the attention of the Court of Appeal of Den Haag. In those proceedings, in an attempt to avoid liability, the data subject relied on the GDPR to anonymise and redact deeds which were key to the proceedings, on the basis of Article 5(1)(c) GDPR (data minimisation). In a judgment dated 4 October 2022, the Court of Appeal of Den Haag ignored the anonymised deeds and ruled in favour of PME and made a compensation order based on calculations which did not take into account the anonymised deeds. As a result, the compensation order was significantly higher than it would have been if the anonymised deeds were taken into account. On 3 January 2023, the data subject filed an appeal against the Court of Appeal's decision to the Supreme Court of the Netherlands. The Supreme Court of the Netherlands dismissed the appeal. In their ruling, the Supreme Court clarified the relationship between the GDPR and domestic evidentiary rules in civil proceedings. The Court held that it was possible to give evidence in a manner compliant with the GDPR and confirmed the CJEU case of Norra Stockholm Bygg AB ([https://gdprhub.eu/index.php?title=CJEU_-_C-268/21_-_Norra_Stockholm_Bygg Case C‑268/21]). In that case, the CJEU held that the GDPR does not contain an absolute ban on sharing personal data in civil proceedings as that would be in conflict with the right to a fair trial in Article 6 ECHR. However, in doing so, the national court must take into account the principle of proportionality and balance the right to a fair trial and Article 5(1)(c) GDPR (data minimisation). The CJEU concluded that it is for the national courts to determine whether the provision of personal data is sufficient and pertinent to achieve the objective pursued by the applicable provisions of national law and whether that objective could not be achieved by using less intrusive evidence in order to protect the personal data of data subjects. The Supreme Court relied on the CJEU's case to determine the issue at hand and found that the plaintiff's anonymisation of the deeds were not proportionate and veered on an abuse of rights. As a result, their purported reliance on the principle of data minimisation (Article 5(1)(c) GDPR) was unfounded. The plaintiff had the opportunity to provide the relevant evidence in a GDPR-compliant manner for the calculation of compensation, and chose not to. Furthermore, the Court of Appeal had a legal basis in Dutch Law to estimate the compensation without the relevant evidence that the plaintiff decided to not provide. Accordingly, the Supreme Court dismissed the appeal.
DSB (DPA)
On 28.11.2019, the data subject received their regional government's administrative decision regarding the recognition of previous qualifications and their experience in becoming a mountain sports guide. On 12.02.2020, the controller attempted to challenge the decision and sent an email to further recipients besides the affected authority. They expressed their concerns and included unredacted parts of the administrative decision. On 18.12.2020. the data subject lodged a complaint with the Austrian DPA (DSB) regarding the violation of their right to confidentiality under [https://ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=13.07.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=b2435486-6818-41ec-a0f8-4150a50eb221 §1(1) DSG]. On 09.12.2021, the DPA partly confirmed the data subject's complaint, stating that the the email contained personal data of the data subject under Article 4(1) GDPR. The controller subsequently appealed against the DPA's decision on 05.01.2022, arguing that their actions were justified by legitimate interests in safeguarding professional standards and public safety pursuant to Article 6(1)(f) GDPR. Furthermore, only parts of the administrative decision were cited, thereby adhering to the principle of data minimisation under Article 5(1)(c) GDPR. First, the court held that the data subject had neither consented to the processing of their personal data nor was the processing in their vital interest under [https://ris.bka.gv.at/eli/bgbl/i/1999/165/A1P1/NOR40139563?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=1&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=13.07.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=b2435486-6818-41ec-a0f8-4150a50eb221 §1(2) DSG]. Second, the controller had the obligation to determine the purpose of the data processing (see 12.02.2020) before executing it rather than throughout the proceedings under Article 5(1)(b) GDPR. The subsequent supplemental citation of the purpose is not reconcilable with the principle of good faith (Article 5(1)(a) GDPR). Third, the court stated that, in reference to the CJEU's decision in [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252 'Meta Platforms and Others' (C-252/21) ECLI:EU:C:2023:537], the burden of proof lies with the controller to demonstrate in a for the data subject understandable way that the data processing was legal, legitimate and necessary under Article 5(2) GDPR. Fourth, the court held that the supplemental citation of the purpose did not justify the processing of the data subject's personal data, since sending a warning to certain recipients with the affected data redacted was feasible. Therefore, the processing was not necessary under Article 6(1)(e) GDPR and Article 6(1)(f) GDPR. Hence, the court dismissed the appeal as unfounded. Fifth, the court held that no appeal to the Austrian Supreme Administrative Court (Verwaltungsgerichtshof) was admissible pursuant to [https://ris.bka.gv.at/eli/bgbl/1930/1/A133/NOR40201324?Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=B-VG&Gesetzesnummer=&VonArtikel=133&BisArtikel=&VonParagraf=&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=13.07.2026&VonInkrafttretedatum=&BisInkrafttretedatum=&VonAusserkrafttretedatum=&BisAusserkrafttretedatum=&NormabschnittnummerKombination=Und&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Position=1&SkipToDocumentPage=true&ResultFunctionToken=4c0c3096-fcc5-4494-8001-860e8840f341 Article 133(4) B-VG], as the case was primarily centred on questions of fact, and no legal questions of fundamental importance were raised. The decision was also entirely aligned with established case law.
The Finnish Motor Insurers' Centre
The Finnish Motor Insurers' Centre (the controller) had asked the Administrative Court of Helsinki (the Court) to overturn the Finnish DPA's decision, according to which the controller had been fined €52,000 for processing and requesting unnecessary patient information from healthcare providers. The controller filed the appeal claiming that it could not determine in advance whether certain information was necessary to settle a claim. The controller considered that under [https://www.finlex.fi/fi/laki/ajantasa/2016/20160460#L7P82 Section 82 of the Finnish Motor Liability Insurance Act], various information could be considered necessary, and therefore it had to process information other than that directly related to the traffic accident. The controller argued that it must evaluate both facts in favour of liability for damages and facts directly or indirectly against it, as well as other information necessary to assess the credibility of the evidence. In the controller's view, healthcare professionals would not ultimately be in a position to assess the legal question of what information is necessary to settle a claim. The Court noted that much of the injured party's health data may be necessary to assess the contribution of another injury to the occurrence of the relevant injury. Consequently, other health-related information necessary to settle a claim may sometimes be needed long before the traffic accident. In this respect, the Court considered that the information relating to healthcare appointments must, in principle, be considered as information necessary to establish the causation of the injury in order to settle a claim. Thus, the tasks related to the assessment of the claim belong to the core tasks of the insurance company and cannot be transferred, even partially, to the responsibility of the healthcare provider. The Court stated that the investigation carried out by the DPA could not be considered sufficient to prove that the controller had systematically collected and processed more information than it was entitled to do under [https://www.finlex.fi/fi/laki/ajantasa/2016/20160460#L7P82 Section 82 of the Finnish Motor Liability Insurance Act]. The Court also found that the DPA had not specified with sufficient precision what the unnecessary information could be. In light of this, the Court held that there was no reason to believe that the controller had systematically requested too extensive medical records or processed unnecessary patient information. The Court therefore concluded that the controller had not acted contrary to the principles of fairness or data minimisation, or to the requirements of data protection by design and default. As a result, the Court overturned the contested decision and removed the administrative fine imposed on the controller.
Grindr
In 2020, the Norwegian Consumer Council (NCC), with the assistance of noyb’s legal analysis, filed a complaint to the Norwegian Data Protection Authority against the dating app Grindr. The Norwegian DPA fined Grindr NOK 65 million for failing to collect users' valid consent for sharing data with third parties for profiling and advertising purposes from the Grindr App (Datatilsynet - 20/02136-18). This decision was appealed by Grindr in February 2022. They argued that; Grindr does not process special categories of data, had obtained valid consent, that there was no legal basis for imposing a fine and that the DPA has misinterpreted Article 83 GDPR when applying the fine. The Norweigen DPA re-considered the case but found no reason to change its decision. The DPA submitted the case to the Norwegian Privacy Appeals Board (Personvernnemnda) in December 2022. Both Grindr and the NCC were given the opportunity to submit comments. In August 2023, Grindr requested the right to attend and speak during the case under [https://lovdata.no/dokument/LTI/forskrift/2018-06-15-876 section 5(5) of the Regulations on the processing of personal data,] and requested that the Board's consideration of the case be postponed until the Court of Justice had ruled on cases [https://curia.europa.eu/juris/fiche.jsf?id=C%3B446%3B21%3BRP%3B1%3BP%3B1%3BC2021%2F0446%2FP&nat=or&mat=or&pcs=Oor&jur=C%2CT%2CF&num=C-446&for=&jge=&dates=&language=en&pro=&cit=none%252CC%252CCJ%252CR%252C2008E%252C%252C%252C%252C%252C%252C%252C%252C%252C%252Ctrue%252Cfalse%252Cfalse&oqp=&td=%3BALL&avg=&lgrec=en&lg=&cid=3298842 C-446/21 Schrems v Facebook Ireland] and [https://curia.europa.eu/juris/liste.jsf?nat=or&mat=or&pcs=Oor&jur=C%2CT%2CF&num=C-21%252F23&for=&jge=&dates=&language=en&pro=&cit=none%252CC%252CCJ%252CR%252C2008E%252C%252C%252C%252C%252C%252C%252C%252C%252C%252Ctrue%252Cfalse%252Cfalse&oqp=&td=%3BALL&avg=&lgrec=en&lg=&page=1&cid=3099852 C-21/23 Lindenapotheke] which at the time were both prelimary refer
Dutch Minister of Social Affairs and Employment
The Plaintiff submitted an application for the disclosure of reports on incidents involving biological agents to the controller, the Dutch Ministry of Social Affairs and Employment. On 6 December 2021, the defendant partially upheld the claim but only disclosed some information and withheld parts of the information in the eight documents submitted. In particular certain personal data and environmental information. The controller withheld data because the personal data concerned data relating to the health of the data subjects, which, in combination with information from other sources, made the data subjects identifiable. The reason for refusal to disclose was founded on [https://wetten.overheid.nl/BWBR0005252/2018-07-28 Articles 10 and 11 of the Dutch Government Information Act (Wob)], which says that information in the hands of Public authorities is generally public, except if it is contrary to overriding interest, in the sense of Article 9(1) GDPR. Health data, in particular, can constitute a particularly serious violation of fundamental rights, such as privacy rights, as Article 9(1) GDPR states. The controller also conceded that personal data (information on biological agents) was excluded from the disclosure, in line with the European Directive on Public Access to Environmental Information 2003/4/EC. The directive guarantees public access to environmental information held by or for public authorities, both upon request and through active dissemination. This was further implemented in [https://wetten.overheid.nl/BWBR0005252/2018-07-28 Article 10(4) Wob], which provides for an exemption for the publication of personal data if it concerns "environmental information on emissions into the environment”. However, according to the controller's opinion, biological agents are not emissions, and, therefore, they do not fall under the definition of "environmental information". The Court held the hearing on the matter on 7 August 2023, and its decision followed on 18 September 2023. The Court declared the plaintiff's claim well-founded. Specifically, the Court found that the controller had not sufficiently justified why certain information was withheld, in particular with regard to sensitive personal data and environmental information on emissions. On the one hand, the Court noted that the controller rightfully withheld the information of Documents 1, 4 and 5 as they would constitute a breach of [https://wetten.overheid.nl/BWBR0005252/2018-07-28 Article 10(1)(d) Wob] and consequently of Article 9 GDPR. The personal data in the Documents concerned data relating to the health of the data subjects which, in combination with information from other sources, made the data subjects identifiable. On the other hand, with regard to Documents 2, 3, 7 and 8, the Court found that the controller failed to give sufficient reasons as to why the data was sensitive personal data or why the disclosure would affect the privacy of data subjects. Additionally, the Court stated that the controller did not deliver sufficient reasons as to why no environmental information was provided. Citing [https://wetten.overheid.nl/BWBR0005252/2018-07-28 Article 10(4) Wob], which provides for an exemption for the publication of personal data if it concerns "environmental information on emissions into the environment", the Court emphasised that the definition is derived from the European Directive on public access to environmental information 2003/4/EC. According to European established case-law, the term has to be defined broadly. Thus, the Court concluded that the biological agents could be defined as emissions and, consequently, be considered environmental information. Hence, the controller did not sufficiently explain whether the withheld information contained environmental information for the exemption to apply. In conclusion, the Court annulled the contested decision and ordered the controller to rectify the situation within six weeks of this decision, taking into account the Court's findings.
Court case W274 2243598-1
In occasion of a hunting event, a data subject noticed that another person, the controller, took pictures and videos of him without his consent. Although the data subject clearly and specifically asked the controller to stop taking pictures of him, he kept photographing and recording him. The controller is an activist and deputy-chairman of an animal protection organization and had been publishing contents relating to hunting gatherings on the internet and social media platforms, which, according to the data subject, constitute unlawful processing of personal data. After the above-mentioned episode, the data subject made an access request under Article 15 GDPR by post, but the controller never replied. According to the data subject this constituted a violation of his right to privacy, in particular, he claimed that by taking and publishing pictures and videos of individuals without their consent, the controller violated Article 13 GDPR, Article 6 GDPR, Article 9 GDPR and Article 15 GDPR. The data subject thus filed a complaint with the Austrian DPA on 08 January 2019. In his submissions, the controller stated that he has been involved in the documentation of hunting events, specifically pheasant hunting ones, as in this case, to gather enough material in order to show how these animals are being hunted and to spread this information with the public. This material is then published online and would also be used for a press conference on the topic later that year. In this, he claimed to pursue journalistic purposes as a citizen journalist and thus fall under the protection of [https://ris.bka.gv.at/eli/bgbl/i/1999/165/A2P9/NOR40201397?ResultFunctionToken=0772c7e4-9cc1-4ff5-8299-e949f7c1a139&Position=1&SkipToDocumentPage=True&Abfrage=Bundesnormen&Kundmachungsorgan=&Index=&Titel=DSG&Gesetzesnummer=&VonArtikel=&BisArtikel=&VonParagraf=&BisParagraf=&VonAnlage=&BisAnlage=&Typ=&Kundmachungsnummer=&Unterzeichnungsdatum=&FassungVom=30.10.2023&VonInkrafttretedatum=&BisInkraft
Wojewoda Śląski
The Silesian Voivode (the body in charge of an administrative district in Poland) declared a resolution of the Katowice City Council invalid. The resolution included an appendix specifying what type of personal data was to be processed for electoral purposes in the district council election campaign. Included in this was electoral candidates' PESEL number (national identifiction number), and electoral candidates' professions. The Voivode found that the inclusion of the electoral candidates' profession was not supported by law. It was not necessary for the criteria needed for eligibility, which are proof of age and permanent residence in the district. Moreover, it held that the inclusion of the PESEL number was in breach of the principle of data minimisation (Article 5(1)(c) GDPR). The Voivode also found that the City Council, which is not the controller of the data collected by the Municipality, was not authorised to decide on the purposes for processing of personal data, as this is the exclusive competence of the City Mayor as controller. The City Council challenged the decision of the Voivode. The Administrative Court in Gliwice overturned the Voivode's decision. It stated, among other things, that the inclusion of the PESEL number was not in breach of the principle of data minimisation. Its inclusion was deemed necessary for the purposes of processing, which was to confirm the residential eligibility of candidates. The Voivode appealed the judgment to the Supreme Administrative Court. The Polish Supreme Administrative Court held that the use of the PESEL number (the national identification number of an individual) to confirm electoral candidates' residential eligibility was incompatible with the principle of data minimisation Article 5(1)(c) GDPR as it was uneccesary for the purposes of processing. Residential eligibility could be confirmed through less invasive means. In addition, the obligation for candidates to disclose their profession was in violation of the principle of data minimisation, as profession was irrelevant for for eligibility. As a result, the judgment of the Administrative Court was annuled.
Court case 2019/04546
The data subject was an employee of the company Ballymaguire Foods, the controller, and was responsible for supervising other 20 employees. During a meeting in March 2019, the Quality Control Manager showed CCTV footages to several managers and supervisors as an instance of poor food safety practice for the purpose of identifying corrective actions. While the data subject was not present in the meeting, they were informed about it by other employees. The data subject initially filed a complaint with the Irish DPA, but was not assigned to a complaint handler due to a backlog of complaints. Then, they filed a lawsuit before the Circuit Court, pursuant to [https://www.irishstatutebook.ie/eli/2018/act/7/section/117/enacted/en/html#sec117 section 117 of the 2018 Irish Data Protection Act]. In addition to claiming that the further processing of the CCTV footage was illegal, the data subject requested compensation for non-material damages on the grounds that they felt humiliated and more stressed at work after the incident. In response, the controller argued that employees were aware of the purposes of the CCTV system as informed in its privacy policy. In addition, it maintained that there was a legitimate interest in the use of the images and classified the alleged damages as mere "upset, anxiety and embarrassment". First, the Court found that the controller had failed in its duty of transparency as it had four different privacy policies in place, none of which were in the native language of the data subject. In addition, the Court highlighted that the controller cannot rely on legitimate interest without first carrying out an assessment of that interest in relation to the rights and freedoms of the data subject. For these reasons, it held that there was a violation of the data subject’s rights under the GDPR. Second, the Court referred to the decision rendered by the CJEU in the the UI v Österreichische Post case (Case C-300/21), in which it ruled that while there is
Court case W256 2234976-1 and W256 2234976-2
The data subject was marksmen from 2012 until about 2017 and participated in competitions. Controller 1 (first appellant in the present case) operates a website that offered shooting accessories and lessons. Controller 2 (second appellant in the present case) also operates a website where they added blogposts concerning these competitions and offered shooting lessons including advertisement for a company. Several reports by the two controllers, published on their respective websites, included an image and the name (and nickname) of the data subject. However, the data subject had never explicitly consented to this publication nor was there a contractual agreement at any time. The publications were mainly for advertising purposes. Controller 1 issued two of the reports in question; on 30 July 2015 and on 9 November 2015. Controller 2 published the other two reports, namely on 10 August 2016 and on 18 September 2016. The controllers took down the reports in September 2018 and November 2018, respectively. On 17 February 2019, the data subject filed two complaints before the DSB (Austria) for infringement of their fundamental right to data protection by the two controllers. The DSB joined the two cases in its decision of 13 July 2020 accepting the complaint and deciding in favour of the data subject: According to this decision, controller 1 unlawfully processed the data subject’s personal data from 9 November 2015 until 30 September 2018. Controller 2 unlawfully processed the same data from 10 August 2016 until November 2018. Both controllers appealed against this decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG), claiming that their activities were covered by the media exception of [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=2&Paragraf=9&Anlage=&Uebergangsrecht= § 9(1) Austrian Data Protection Act] (Datenschutzgesetz - DSG). First, the BVwG considered the application o