GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 20 October 2026 · Updated daily
Court case 2021/AR/163
A bailiff’s office dealing with debt recovery for parking tickets on behalf of the city requested the driver to fill in a form with personal data. The driver filed a complaint for violation of access right (Article 15), obligation to inform (Article 12), proportionality principle and illegal reuse of their data (Article 5 and 6), and minimisation principle. The Belgian Data Protection Authority considered that the form did not comply with the GDPR, and therefore issued a decision in which it reprimanded the bailiff’s office, ordered it to change its processes to comply with the GDPR and to pay a fine. The bailiff’s office, disagreeing with the decision, appealed it before the Court of Appeal. The Court confirmed its powers in accordance with Article 78 GPDR: the Court can annul and even adopt a new decision in so far as all facts and legal issues were already discussed in front of the APD. The Court can do so in case of a manifest factual or legal error by the APD. The Court confirmed the violations already noted by the Belgian DPA. However, the Court of Appeal annulled the fine (and only the fine) on the grounds that the Litigation Chamber abused its powers when inflicting an administrative fine. According to the Court, the Data Protection Authority should consider the full range of sanctions at its disposal before issuing a fine, and only impose a fine on organisations/people who do not comply with its injunctions. Inflicting an administrative fine as from the first offence was deemed contrary to the proportionality principle, which implies that the sanction must be proportionate to the infringement. In this regard, the Court noted that the DPA confirmed that the violation was not intentional and that the form with the requested personal data at stake was not sent back by the complainant. Therefore, the Court of Appeal annuls the fine, and considers that the DPA should have instead used other corrective powers. The remaining parts of the Belgian DPA 's dec
Prezes Urzędu Ochrony Danych Osobowych
On 20 August 2020, the Polish DPA [https://gdprhub.eu/index.php%3Ftitle=UODO_-_ZSO%C5%9AS.421.25.2019 imposed a fine] of approximately €11,000 on the Warsaw University of Life Sciences (SGGW) for failing to implement sufficient technical and organizational measures to prevent exposure of over 80000 records about study candidates. The data breach occurred as a result of a theft of a university employee's private laptop, on which the personal data of candidates for studies had been saved. The university argued that it had not been a controller of the data stored on the stolen device. Instead, it was the employee acting without knowledge of SGGW and in violation of internal procedures. The court fully upheld the DPA's decision and stated that the SGGW had violated the GDPR. The court disagreed with the argument that the SGGW had not been a data controller in the case. The university determined the purposes and means of the processing of personal data. Its employee was always acting on behalf of the university. Subsequently, the court agreed with the DPA that the university violated several provisions of the GDPR, including the principle of integrity and confidentiality and that the fine was correctly imposed.
Główny Geodeta Kraju
On 24 August 2020, the Polish DPA fined the Chief National Surveyor (Główny Geodeta Kraju, GGK) 100,000 PLN for violating Article 5(1)(a) GDPR and Article 6(1) GDPR by publishing, on its website, numbers of land and mortgage registers without any legal basis. Users of the website, without any additional authorization, had direct access to the land and mortgage registers via hyperlinked numbers. Each register included, inter alia, names and surnames of property owners and their parents, PESEL numbers and real estate addresses. GGK appealed this decision, arguing that the legal basis for the publishing of register numbers on the website was confirmed by Chapter 6 of Annex II to the Directive 2007/2/EC of the European Parliament and of the Council of 14 March 2007 establishing an Infrastructure for Spatial Information in the European Community (INSPIRE). The Court dismissed the appeal and held that the unique numbers identifying land and mortgage registers are personal data. According to the Court, the publication of land and mortgage register numbers allows for easy, indirect identification of property owners. Thus, the land and mortgage register numbers constitute personal data. The Court also stated that GGK had no legal grounds to disclose these register numbers (as the INSPIRE Directive did not relate to the issue in question), and deliberately violated the provisions of the GDPR. It held that the € 22,150 (100,000 PLN) fine which the DPA imposed on GGK is therefore justified. The Court also found that the GGK violated Article 36(4)(16) of the Act of 6 July 1982 on land and mortgage registers. The court found that the argument of the GKK that the restrictions set out in this provision did not apply in this case was incorrect.
Court case C/08/262365 / KG ZA 21-46
The defendant has posted content of the plaintiff’s child on social media. The plaintiff has not given her consent. The plaintiff has asked the defendant to remove the content. The defendant did not remove the content. The defendant states that she could post the content considering she is attached to the child and because her child is his halfsister. Does the defendant have to remove the content of the minor from social media because the plaintiff (the minor's mother) did not give her consent? The court holds that based on the GDPR and the Dutch GDPR Implementation Act the legal guardian of a minor under the age of sixteen has to give consent for posting content (photos or videos) of the minor.
Court case 9 U 34/21
The plaintiff, a member of Mastercard’s loyalty program, sought compensation after her personal data got hacked from the Mastercard network and then published online. The claim was based on two cases of apparent non-compliance with GDPR: (1) the defendant not granting right of access Article 15 GDPR; (2) not implementing appropriate technical and organizational measures to prevent a data breach (Article 32 GDPR). Does the plaintiff have a right to compensation according to Article 82(1) GDPR and does Article 82(3) GDPR stipulate a reversal of the burden of proof so that the onus is on the controller to show that it has not acted wrongly? The Higher Regional Court dismissed the claim as it considered the appeal to be without merit. The Higher Regional Court maintained that every individual that has suffered material or non-material damages is entitled to receive compensation from the controller for the damage suffered Article 82(1) GDPR. However, for the controller to be held liable a breach of duty by the controller must have occurred. Furthermore, it is imperative that the damage suffered, is not merely attributable to a processing of personal data during which a violation of the GDPR has occurred. Yet, the Court did not identify the aforementioned breach of duty by the controller. That is for the reason that the defendant neither violated Article 15 GDPR by not responding within the set limits nor did the plaintiff show that the defendant did not implement appropriate technical and organizational measures as provided for by Article 32 GDPR. The Court held that the GDPR does not change the fact that the burden of proof to show that a breach of duty has occurred must be borne by the plaintiff. Citing the Austrian Supreme Court the Higher Regional Court Stuttgart maintained that EU law does not contain any specific rules on the burden of proof. Hence, the onus is on the claimant to show and prove the prerequisites for the claim. Only when it has been shown by the
Court case VSRS Sodba IV Ips 2/2021
The applicant is an official for the Supreme State Prosecutor's Office. From March and June 2017, the applicant disclosed the personal data of thirty-two data subjects without a legal basis in Slovenian law and without the consent of these data subjects. The Slovenian DPA (Information Commissioner or IP) defined the applicant's disclosures as a repeated violation of the first paragraph of Article 8 of the Slovenian Personal Data Protection Act (ZVOP-1). The IP further determined that the applicant had committed thirty-two offenses under Article 91 of the ZVOP-1. As a result, the Slovenian IP invoked domestic criminal regulating misdemeanor offenses (called the Minor Offenses Act or ZP-1) to impose on the applicant a fine of EUR 830 for each offense, as well as an additional EUR 2,380 sanction. Slovenia remains the only EU country which has not passed a national act implementing the GDPR. The Slovenian legal system does not allow for the issuing of administrative fines by agencies such as a DPA, which means that even courts cannot initiate proceedings. This should not be a barrier to the implementation of the GDPR because Article 83(9) creates an exception for such countries that do not provide administrative fines, allowing them to impose fines through competent national courts. Slovenia negligently failed to invoke this exception at the time of adoption of the GDPR, and instead continues to rely on ZVOP-1 for data protection. In summary, in Slovenia there is no entity that can impose administrative fines as prescribed by the GDPR, but the DPA can at least impose at least misdemeanor fines under ZVOP-1. ZVOP-1 gives the Slovenian DPA the power to directly issue misdemeanor fines through the procedural rules defined by the Minor Offenses Act (ZP-1). ZVOP-1 also sets maximum limits on the fines that the DPA can impose: €1 million for large companies, €300,000 for smaller companies, and €20,000 for individuals. These maximum fines are significantly lower than
Court case 5 L 623/21.F
The applicant operates a sales outlet for the display and sale of barbecues, barbecue accessories and products relating to barbecuing. In line with the special regulations associated with the coronavirus pandemic, restrictions had been imposed on him in his shop in relation to the need to use certain hygiene measures. The applicant considered that he remained in a worse situation than garden, biulding and DYI markets to which customers would have barrier-free acces. The applicant's activity was subject to the restriction that the customer had to make a prior appointment in the shop and provide personal data for this purpose: name, address and telephone number. The trader was obliged to record personal data for the purposes of tracing infections. The outlet was obliged to store this personal data for a period of one month after the appointment of the individual customer, secure it against access by third parties, for the competent authorities and to transmit the data upon request of these authorities, as well as to delete or destroy it immediately after the expiry of the above period in a secure manner and in accordance with data protection legislation. A specific provision of the regulation issued in connection with the coronavirus pandemic has excluded the application of Article 13 GDPR, Article 15 GDPR Article 18 GDPR and Article 20 GDPR concerning the obligation to inform and the right of access to personal data. Customers were to be informed of these restrictions. Therefore, the applicant applied to the Administrative Court Frankfurt am Main for a temporary injunction to regulate the operation of its sales outlet so that it would not be subject to any special restrictions. Is the contested provision in Paragraph 3a(1), second sentence, No 22 of the CoKoBeV lawful? The Court found that the exemption to provide information if and to the extent that the data subject already has the information (Article 13 (4) GDPR), it does not provide for the power of a publi
Futura Internationale
Futura Internationale appealed against the French DPA's decision to impose a fine of 500,000 EUR on Futura Internationale for sending unsolicited marketing communications. Did the French DPA breach the constitutional principle of non-retroactivity of the law by applying the GDPR? Was the fine of € 500,000 imposed by the French DPA proportionate? The highest administrative court of France (Conseil d'Etat) dismissed the claim that even if the investigation by the (French DPA) CNIL started in March 2018, the infringement continued after the GDPR entered into force. Futura Internationale was notified of its administrative fine in October 2018. Therefore, the Court held that the French DPA (CNIL) applied the relevant law by applying the GDPR. There was no breach of the constitutional principle of non-retroactivity of the law by the CNIL. The French Court then assessed Article 83 GDPR and agreed that Futura Internationale failed to comply with several GDPR obligations, including the principle of data minimisation, the obligation to inform data subjects, the obligation to respect the right to object, the obligation to cooperate with the DPA and the obligation to safeguard data transferred internationally. It held that the violations were particularly important and persistent. Therefore, the Court concluded that the French DPA had not imposed a disproportionate fine. 500 000 EUR fine was 2.5% of Futura Internationale's annual global turnover. Therefore, the French Court rejected Futura Internationale's appeal against the French DPA's decision.
Deutsche Wohnen SE
The DPA of Berlin fined Deutsche Wohnen SE for violating Article 5(1)(c) and Article 5(1)(e) GDPR, because the DPA found that the company did not delete old data of tenants in a sufficient way. Deutsche Wohnen SE processed personal data like proof of identity, work, salary and creditworthiness, as well as data about health insurance, social insurance and tax within the framework of business activities. The Deutsche Wohnen SE did not agree with the DPA's decision and brought the action before court. The Court held that the fine notice was not valid. The fine notice was enacted against the Deutsche Wohnen SE as a legal entity under private law which is represented by its management. The Court, however, found that a legal entity can't be the subject of a fine procedure. According to the Court, only a natural person could commit an administrative offence in a reproachable way, while the legal entity just could be a secondary party, to which the actions of its representatives or board members are attributable. The DPA, on the contrary, held the opinion that a legal entity and a natural person can be treated in the same way in Administrative Offences Law. Furthermore, the fine notice did not mention the board member who committed or omitted the relevant action by name, nor contained it information about time and scene of the administrative offence or on what the reproach is supported. Therefore, the fine notice also cannot be reinterpreted into a separate decision according to § 30 (4) OWiG without having to adjust the fine procedure.
Court case 0856/20.0BELRA
A citizen requested that the Tax Office provided her/him with the National Tax Number (NIF) of the owner of a neighbouring building and land, so as to request a check on the exact boundaries of the lands owned by both. The Tax Office, alleging Article 68 of the National Tax Law and the Data Protection Act, refused the request. The petitioner considered that the NIF of the owner of a building does not fall under the definition of what constitutes data that is protected by tax secrecy, as such data should be publicly available. Does the tax number of the owner of a building constitute personal data or data that should be publicly available? The appeal concerns the decision of the Administrative Court of Leiria, which dismissed the request for information made to the Portuguese Tax Office to provide the Portuguese National Tax Number (NIF) of an alleged neighbour, in order to contact this third party for purposes of checking the boundaries of an allegedly adjacent land. Before, it had been solidly anchored in the Portuguese jurisprudence a flexible approach to the duty of confidentiality and the protection of taxpayer data, with the Courts generally accepting that the NIF was not part of the sphere of intimacy in private life, and so, not personal data, but considered as publicly available data on taxpayers. In fact, it was the general understanding that publicly available personal data could be revealed, which encompassed public data or personal data contained in an official public document, as is the case, for example, with the NIF, as well as fiscal data that does not reflect or denounce the tax status of taxpayers. However, with Decree-Law no. 14/2013, of 28 January, the legislator started to adopt a much more rigid position regarding this information, with the new Law reflecting an increasing concern with the protection and treatment of individual data. This Decree modified the Portuguese General Tax Law (Lei Geral Tributária, or LGT) and added a new exception to the duty of confidentiality - contained in paragraph e) of paragraph 2 of Article 64, that states that the National Tax Number and home address associated with the National Tax Number are both considered “personal data”. Therefore, the NIF is now considered as personal data, with the exception of statistical and research purposes, and should only be made available under the strict terms provided for in the LGT. This understanding of the NIF as personal data in 2013 remains in conformity with the concept of "personal data", currently translated into Article 4(1) of the GDPR. With the amendment of 2013 and the introduction of a new exception in the LGT, the Court could only conclude that the legislator not only considers that the two pieces of information - NIF and the tax address - are "personal data", but only seems to accept the availability of both in the strict circumstances expressly provided in the Law. As for the right to information that the Appellant (the other neighbour) claims to have been violated, it is clarified that this is not an absolute right and that, consequently, it cannot prevail over the protection granted, also constitutionally, to the right to privacy and the requirement of a corresponding duty of confidentiality imposed on the Tax Office in regard to the data elevated by law to the condition of "personal data".
Court case 1 BvR 2853/19
A data subject filed constitutional complaint because the AG Goslar (Goslar Local Court) denied his claims under Article 82 GDPR because of an unsolicited email. Because he only claimed 500 EUR as compensation, the Goslar Local Court was the regular last instance under German law. The Goslar Local Court denied the preliminary ruling from the CJEU. Was the Goslar Local Court obliged to hear the CJEU for a prelimary ruling? The judgment of the Goslar Local Court of 27 September 2019 - 28 C 7/19 - violates the complainant's fundamental right under Article 101(1) sentence 2 of the Basic Law. The judgment is set aside. The matter is referred back to the Goslar Local Court for a new hearing and decision. This renders the order of the Goslar Local Court of 11 November 2019 - 28 C 7/19 - irrelevant.
Municipality Oldambt
On 1 July 2016 the municipality put a piece of land with an unused shooting range up for sale for a symbolic amount of 1 EUR. The claimant was interested in buying it. To reuse the old shooting range, claimant was required to get an environmental permit from the municipality. The online form available on the sites of the Dutch municipalities, has two options for such permit applications: the complete form, which is available to competent authorities only, and the publicly available version of this form. The information that an applicant wants to keep private is removed from the publicly available version. More specifically, the publicly available version doesn’t contain the applicant’s social security number (BSN) and phone number. When submitting the digital application, an applicant is presented with the following choice: Do you give permission to make publicly available personal and address details of the applicant/notifier and, if applicable, the authorised representative? The claimant submitted his environmental permit application on 9 December 2016. He filled in his social security number, last name, initials, address, phone number and email. He consented to making his data publicly available. On 7 October 2017 and 7 December 2017 the municipality published a draft statement and draft decision, making them available on its site, on the Government Gazette (Staatscourant) and on www.ruimtelijkeplannen.nl. On 2 December 2018 a local journalist twitted about the fact that the municipality has published claimant’s data on its website, including the social security number and phone number. On the same day the claimant reported the data breach to the municipality under GDPR, telling the municipality to remove his data and mentioning non-material and material damages (for the costs involving increased house security). On 3 December 2018 the municipality has included the claimant’s environmental permission application as an agenda item in the council’s meeting and published the agenda on its site, including the claimant’s email, phone number and social security number. Social security and phone numbers were removed from the site on 4 December 2018. The municipality has admitted that personal data breach took place but asked the claimant to substantiate any material damage resulting from the municipality's actions, as it was not prepared to pay non-material damages. The claimant responded with a list of security measures that would be necessary to prevent burglary, blackmail and/or threats. On 10 April 2019, the municipality rejected the claims for material and non-material damages as not sufficiently substantiated. Should the claimant be awarded a (non-)material damage compensation from the municipality for the data breach? The Subdistrict Court concluded that the municipality has violated the GDPR by causing data leaks and is therefore liable for damages towards the claimant. In the circumstances of this case there was no reason to award material damages compensation, but there is reason to award (limited) immaterial damages to the claimant. The Court considered the damage compensation claim based on the Dutch Civil Code. The Subdistrict Court arrived at the conclusion that the security measures taken by the claimant could not be regarded as reasonable costs to prevent or limit damage because of the data leaks. The municipality can only be responsible for the breach of the social security number, phone number and email address of the claimant, and nothing else. It was taken into account that the claimant opted in for the public application process, making his address and name publicly available. Against this background it cannot be seen that, because of the data leaks, claimant was forced to secure his home to protect himself, his family, and his possessions. When it comes to the non-material damage compensation, the Subdistrict Court rules that the claimant had not, or at least insufficiently, demonstrated that he has suffered psychological injury because of the unlawful actions of the municipality. Only a strong psychological discomfort, such as temporary feelings of stress or anxiety, are sufficient for compensation of immaterial damage. However, the privacy of the claimant has been violated repeatedly by the municipality because of the unlawful publication of his social security number, the e-mail address, and the telephone number without his consent. These data are sensitive by nature, especially the social security number. The adverse consequences of leaking these, such as identity fraud, are obvious. Therefore, the Court ruled that the claimant was eligible for 500 EUR in non-material damages compensation.
Land Nordrhein-Westfalen
D.-H.T acting as the insolvency administrator of J & S Service (‘data subject’) requested certain tax information about the data subject from the German local tax authorities (‘data controller’). The German Abgabenordnung (‘Tax Code’) extends the application of the GDPR to legal persons, not just natural persons. However, the data controller refused D.-H.T’s request for information, relying on Article 23(1)(e)&(j) GDPR and Paragraph 32 German Tax Code. D.-H.T successfully challenged this refusal at the German Administrative Court. The data controller lodged an appeal to the Higher Administrative Court which affirmed the judgment of the court of first instance, holding that because D.-H.T (a company) was the insolvency administrator of the data subject (another company), it could therefore exercise all access rights of the data subject. It also reasoned that the data subject's right to access information was not limited by any specific legislation on tax secrecy. The dissatisfied data controller lodged a further appeal against this decision to the German Federal Administrative Court which then requested a preliminary ruling from the CJEU on interpretation of Article 23(1)(j) GDPR. The Advocate General found that the CJEU lacked jurisdiction to give a preliminary ruling because the scope of the relevant provision of the German Tax Code which sought to protect information of legal persons was materially different from the scope of the GDPR which protects the personal data of natural persons. On the merits, he found that the limitation in Article 23(1)(j) GDPR applies to the enforcement of civil law claims pursued by both private persons and public bodies. He also found that this limitation in Article 23(1)(j) GDPR includes the defence against civil law claims and does not depend on the condition that a civil law claim must first be established. The CJEU emphasized that the GDPR’s main aim is to protect the fundamental right of natural persons with respect to the
Verein für Konsumenteninformation (VKI)
The Verein für Konsumenten Information (VKI) is an Austrian consumer rights organisation and entiteld to bring collective redress lawsuits and class actions in the interest of consumers pursuant to §§ 28 and 29 of the Austrian Consumer Protection Act (Konsumentenschutzgesetz - KSchG). The VKI brought a lawsuit against two car rental companies due to their allegedly unlawful general terms and conditions, which contained clauses that are (accordning to the VKI) violating Article 25(2) GDPR. The decisions of the first and second court were appealed, the case is currently (January 2021) still pending at the Austrian Supreme Court (Oberster Gerichtshof - OGH), which referred to following question to the CJEU under Article 267 TFEU: Does the GDPR preclude national regulations which, among other things, grant associations the power to take action for violations of the GDPR by way of an action before the civil courts, irrespective of the violation of specific rights of individual data subjects, inter alia from the point of view of the prohibition of the use of ineffective general terms and conditions? The OGH will take its decision in the merits of the case once the CJEU has decided on the requested preliminary ruling. This page will be adapted accordingly then and linked to the CJEU decision which will also be published on GDPRhub.eu.
unnkown police investigator (data subject and complainant before the DSB)
The data subject is a member of the police unit called task force for combating street crime (Einsatzgruppe für die Bekämpfung der Straßenkriminalität - EGS) and operates as an undercover agent. After being summoned to a hearing by an parliamentary committee of inquiry, his full name was disclosed in the minutes of this hearing which were published online. The data subject requested the removal of his full name from the minutes since revealing his identity this would jeapordize his work as an undercover agent. After the parliamentary committee rejected his request, he filed a complaint with the Austrian DPA (Datenschutzbehörde -DSB). The DSB rejected the complaint because it did not consider itself competent. The European legal system forsees a separation of state powers. As a parliamentary committee of inquiry is part of the legislative state power, the DSB - as part of the administrative state power - could not exert control over it. Furthermore, § 35 Austrian Data Protection Act (Datenschutzgesetz - DSG) only allows for the DSB to exert its investigative and corrective powers over certain supreme administrative organs (such as the Federal Ministers), but not over a parliamentary committee. The data subject filed an appeal against this decision with the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG), which now issued its judgment. Is the DSB competent to exert its investigative and corrective powers over a parliamentary committee of inquiry and handle a data subject's complaint regarding the violation of his GDPR rights by the parliamentary committee? The BVwG initially held that the exemption under Article 2(2)(a) GDPR (processing of personal data in the course of an activity which falls outside the scope of Union law) does not apply on the case at hand. According to the BVwG, the substantive provisions of the GDPR and the DSG are also applicable to acts which, like those of a parliamentary committee of inquiry, are attributable to th
Hoist Finance AB
The appellant asked Hoist, the defendant, to remove data concerning him from the Stichting Bureau Kredietregistratie (BKR register). The appellant had taken a loan out in 1998 for his house, which was increased various times. The appellant got divorced in 2009, he was the one that paid the interest charge on the loan and mortgage charge for the house. The appellant then sold the house with a residual debt which was eventually waived in 2016. The appellant was then admitted on a municipal debt relief program for 10 months. There was a backlog in the appellant's payment of credit (loan) recorded in the Central Credit Information System (CKI) of the Stichting Bureau Kredietregistratie (BKR). The appellant was admitted to the debt scheduling scheme for natural persons (WSNP) where Hoist was one of the listed creditors (debt of € 38244.74). The debt rescheduling scheme ended with a clean slate in February 2018. Hoist reported in the CKI that the credit ended in January 2018. CKI stated that the registration with regard to the credit will be removed in January 2023. The appellant asked for Hoist to remove data concerning him from the Stichting Bureau Kredietregistratie (BKR) by July 2018, which Hoist refused to do. Hoist refused again after another request from the appellant in March 2019. The appellant went to court to request that Hoist be ordered to remove the BKR registration in his name so that he would be able to buy his current rental home and replace his old car. Hoist refused. The appellant lodged an appeal against a decision of 13 December 2019 from the District Court of The Hague (Rb. Den Haag). The District Court's judgement rejected the appellant's request to order Hoist to remove the appellant's name from the BKR. This was on the basis that there was a legitimate interest for processing the appellant's personal data in the BKR. The processing was necessary for BKR and its business customers, such as Hoist, and was therefore lawful under Article 6(1)(
X1
Contested decision: The complainant's personal data would be processed in the context of a fan page on Facebook bearing her name and first name. The management rights of this fan page are assigned to at least one of the joint controllers (X1 and X2). The Litigation Chamber deems it sufficient to first of all contact the joint controllers in order to warn them to stop any violations against the GDPR and to act on the complainant's request to data portability. Written procedure: In view of the health risks posed by the COVID-19 pandemic and the urge for digitalisation, the Market Court was pioneering the use of the written procedure. However, the DPA made a decision after receiving a complaint through the standard form on its website and without giving the defendant the opportunity to make its point of view known (in writing). DPA's position: The DPA contests the admissibility of the appeal on the grounds that the contested decision is not subject to annulment since the decision was taken in the course of the proceedings preceding the decision on the merits. These decisions are temporary prima facie decisions, without any substantive assessment of the merits. According to the DPA's view there is no legally binding decision at stake and decisions taken at preceding the decision on the merits should be excluded from the right to an effective remedy (read: appeal), according to recital 143 of the preamble of the GDPR. * The court states that a warning (with publication) constitutes a sanction and that it follows from the mere fact of it being a corrective measure that it may be liable to have an adverse effect on the person to whom it is addressed * The court held that, although the litigation chamber may be an administrative body, it has far-reaching power, making it a semi-judicial body. As a consequence, the general principles of sound administration apply on the process * The Court of Appeal cannot use its full jurisdiction when it receives an appeal against provisional and corrective measures. In the case at hand the court annulled the decision of the DPA's litigation chamber for failure to observe principles of sound administration, more specifically because the duty to be heard was disregarded.
Autoriteit Persoonsgegevens
On 21 of January 2019 complainant lodged a complaint with Autoriteit Persoonsgegevens against a data broker called Focum. In his view, Focum processed his data unlawfully and wrongly rejected his erasure request. On 21 of February 2020 complainant started a court case against Autoriteit Persoonsgegevens for not deciding on his complaint on time and demanding compensation. Complainant believes that AP is obliged to issue a decision within a reasonable timeline, which is 8 weeks according to the Dutch Administrative law. Autoriteit Persoonsgegevens disagrees: Article 78(2) GDPR defines the applicable time frame in line with Article 4:13(1) of the Dutch Administrative law. AP must inform complainant of the progress or settlement of the complaint within 3 months. The Court ruled against complainant’s arguments for the following reasons: 1) Article 78(2) GDPR defines the applicable time frame in line with Article 4:13(1) of the Dutch Administrative law. The reason for not putting a deadline in the law is because complaints can lead to long and complex investigations and include cross-border data processing, meaning that other supervisory authorities might need to get involved. 2) According to Recital 141 GDPR, AP must update complainant within a reasonable period. In this case, AP sent an email to complainant on 20 march 2019, which counts as a progress report even if it doesn’t explicitly say so in the email itself. Moreover, the email stated that the investigation involved cross-border processing and that the complaint may be handled together with other European supervisory authorities. 3) When assessing whether the decision on the complaint took too long, the Court took the following into account: - AP was conducting their investigation based on several different complaints from different people. - The investigation included an on-site inspection and coordination with other supervisory authorities in the EU. - COVID-19 measures that have slowed the AP down.
Court case 5 Bs 152/20
The applicant was a property company and a (former) sister company of a hospital operating company. The hospital operating company filed for insolvency in April 2010, and in October of the same year the hospital operations were discontinued. After the clinic ceased to operate, the patient files kept in paper form remained in two basement rooms originally intended to house the files. The hospital building subsequently stood empty and was temporarily looked after by different caretakers. In the end, a security service also carried out external checks on the building. On 10 May 2020, a Youtuber entered the former hospital building, including the two file rooms located in the basement, and came across the patient files that had been left behind. The video uploaded on the video platform "youtube" caused a broad media response as well as complaints from former patients under data protection law. The competent DPA tried to contact responsible persons of the applicant or clinic for clarification and to establish remedial measures, but these attempts have essentially remained fruitless. In the meantime, the local public authorities, in consultation with the DPA, undertook measures to secure the building and, in particular, to prevent unauthorised persons from accessing the file rooms. After further attempts of unauthorised entry by third parties had occurred, the regulatory authorities, following a corresponding request for administrative assistance by the supervisory authority, commissioned a 24-hour surveillance by a private security service. Finally, in June 2020, the DPA issued a decision based on Article 58(2)(d) GDPR. The property company filed an application for interim relief against this order. By decision of 30 July 2020, the Administrative Court granted the application and restored the suspensive effect of the applicant's action. The appeal of the defendant (DPA) is directed against the above Court's decision. Was the mere storage of the files in the clinic b
A student (defendant)
A student, the defendant, had allegedly told her teacher, the plaintiff, that she did not want her examination grades to be published or otherwise communicated to third parties other than herself. Nonetheless, the plaintiff had released the grades of all his students, the defendant's included, to their class representatives in order for them to communicate the results to their classmates in a common WhatsApp group. As a result, the defendant lodged a complaint before the Austrian data protection authority, claiming that the disclosing of her grades constituted a violation of confidentiality, to which she considered her teacher to be subject to. The data protection authority sustained the defendant's - plaintiff before them - complaint and held that the teacher - defendant before them - had violated his student's right to confidentiality, arguing that a grade constitutes a personal data such as defined in Article 4(1) GDPR and had to be protected according to the applicable principles of the law, such as confidentiality. The disclosing of grades from the teacher to the class representatives had in view thereof to be considered a breach of confidentiality of the data. This decision was appealed by the teacher before the Federal Administrative Court of Austria, primarily arguing that it should not be him as teacher but the competent authority he was acting on behalf of, the Ministry of education, that should be held responsible as data controller. Can a teacher be considered data controller as defined in Article 4(7) GDPR and therefore be held liable in case of a breach of the applicable data protection principles? The Federal Administrative Court of Austria amended the data protection authority's decision by holding that the plaintiff could not be considered data controller since he was only teaching as part of the school's organisation and under official and professional supervision of the headmaster (§ 56 of the national school teaching law). This would also