GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
15 results · Showing 1–15
Court case W256 2337399-1
A marketing company (controller) that specialises in recruiting personnel for third companies was fined by the DPA for recording telephone interviews with potential customers (data subjects) with €25,500. The records were used for internal training purposes for the controller’s staff. In some occasions, the data subjects were not informed about the recording, in other cases only after the recording has already started. After the DPA’s reprimand, the controller stopped the processing, cooperated with a law firm and a data protection officer to establish and adapt a privacy notice, internal contracts and other documents and guidelines in conformity with the GDPR. The controller employs on average 18-20 people and has an annual turnover of €4,231,213.16 for the year prior the infringement. The controller appealed the DPA’s fine, not the unlawfulness of the processing. The court partially upheld the DPA’s decision, but reduced the amount of fine to €22,000. As far as the calculation of the fine was concerned, the court added the individual fines for the two violations, but limited the total amount of fine to the specified fine for the graves infringement, in accordance with Article 83(3) GDPR. Since both processing operations were linked to each other, Article 83(3) GDPR applied. Both infringements fell under Article 83(5) GDPR. Therefore, the specified amount of fine for the infringements is €20,000,000 or 4% of the total worldwide annual turnover of the preceding financial year. Since the first sum was higher, the static maximum fine in this case was €20,000,000. The static maximum fine must be adjusted to the individual case at hand: When assessing the amount of fine, Article 83(1) GDPR postulates that the fine must be effective, proportionate and dissuasive. One of the aims of the fine is the specific deterrence of the controller. For this purpose, the amount of fine should be in proportion to the size of the enterprise (in this case 18-20 employees, therefore a small enterprise with a structural adjacency to a micro-enterprise). Its annual turnover can be considered as well. The court held that the infringement at hand was of medium gravity. This is because on the one hand, all data subjects that were interviewed by the controller were affected, several data of each data subject were unlawfully processed and the unlawful processing continued for a period of four months. On the other hand, according to the court, the controller violated the GDPR with negligence not intent, the data processed was not of special importance and the obtained data was merely used for internal training purposes. The court considered, as aggravating factors (Article 83(2)(k) GDPR), that the controller violated the GDPR on two occasions: the unlawful recording of the interviews and failure to comply with the obligation to inform the data subjects pursuant to Article 13 GDPR. From the fact that the specified amount of fine for the infringements was this high, the court concluded a special importance of the protected legal interest. As a mitigating factor (Article 83(2)(k) GDPR), the court took into account that there were no previous GDPR violations by the controller. Moreover, the controller cooperated with the DPA by providing further audio material of interviews. This could be considered a mitigating factor, because with it, the controller exceeded its obligations under Article 31 GDPR and by doing so, did more than what was asked from him under the GDPR anyways. Also, the controller stopped the unlawful processing after the DPA ordered it to do so. The lack of damages suffered by the data subject was not a mitigating factor, contrary to the controllers claim, because the court held that the data subject suffered immaterial damages by loss of control over their data. Neither did the other privacy safety measures that the controller conducted be considered a mitigating factor (technical and organisational measures pursuant to Article 83(4)(a) GDPR) because they did not exceed what was asked from it under the GDPR).
Court case 6 SLa 116/26
The data subject had applied for a secretary position in a human resources consulting company (the controller) in January 2025. He later filed a lawsuit claiming he had been discriminated against in the recruitment process on the basis of his gender and his disability. In October 2025, the data subject amended his lawsuit to include a claim for non-material damages of at least €1,000 under Article 82 GDPR. He claimed to have lost the control of his personal data as the controller had submitted a screenshot of the data subject’s Facebook profile to the court as an attachment to its answer to the lawsuit without first informing him of the collection and processing of his data in accordance with Article 14 GDPR. The court of first instance issued a default judgment where it dismissed the damages claim on 14 October 2025, as the data subject failed to appear before the court. This outcome was upheld in a final decision in January 2026: the court of first instance held that the data subject had voluntarily made the personal data at issue available for viewing by an unlimited number of people on his Facebook profile. Therefore, he had not suffered a significant loss of control over his personal data. The data subject appealed this decision to the Cologne Higher Labour Court in February 2026. The higher labour court dismissed the data subject’s claim for damages under Article 82 GDPR. First, the court held that the controller had not fully complied with its obligations under Article 14 GDPR – it had not provided the data subject the contact information of its data protection officer, specified the categories of personal data being processed, or explicitly identified the legitimate interests pursued. While the court found that there had been a violation of Article 14 GDPR, it also pointed out that a GDPR infringement alone could not give rise to a claim for damages. According to the court, the data subject had not suffered non-pecuniary damage in the present case. He had not lost control over his personal data or been reduced to a mere object of data collection, as he had made a voluntary decision to make the personal data at issue publicly available by setting this information to “public” on his own Facebook profile. The court held that this was not comparable to a Google search, where information that the data subject themselves has not chosen to publish could also have been made available by third parties.
Data subjects versus Supervisory Authority
A district (the controller), acting as the lower water authority, initiated administrative proceedings after identifying unauthorised riverbank works and a private jetty on two riverside properties. One property belonged to a water utility company, while the other belonged to a municipality and was leased to the data subjects. During those proceedings, the controller shared the data subjects' personal data with various participants, including the owners of the affected properties, other public authorities and a lawyer who claimed to represent the data subjects. The data subjects lodged a complaint with the competent supervisory authority (LDI NRW), alleging that the controller had unlawfully processed and disclosed their personal data. They argued that their personal data had been shared with uninvolved third parties, that the controller had communicated with a lawyer whom they had not authorised, recorded a telephone conversation with an unknown person, and transmitted personal data by unencrypted email. The controller's data protection officer addressed each allegation and provided additional factual information concerning the disputed processing operations. The DPA initially informed the data subjects that no GDPR infringement was apparent, invited them to provide any additional factual information, and explained that it would obtain extracts from the controller's administrative file if there were concrete indications that it contained relevant facts not already available. The data subjects did not identify any additional facts and instead reiterated their legal position that the controller had breached its GDPR accountability obligations. The DPA rejected the complaint, concluding that no GDPR infringement could be established. The data subjects then brought an action before the Verwaltungsgericht Düsseldorf (Administrative Court Düsseldorf), seeking a fresh decision on their complaint on the basis that the DPA had failed to adequately investigate the complaint because it had not obtained the controller's administrative file before reaching its decision. The court held that Articles 57(1)(f) and 77(1) GDPR give rise to an enforceable right requiring a supervisory authority to investigate a complaint to the extent appropriate in the circumstances before determining whether a GDPR infringement has occurred. Recital 141 GDPR requires the investigation to extend as far as is appropriate in light of the circumstances of the individual case, including the significance of the complaint and the seriousness of the alleged infringement. Applying these principles, the court held that the DPA had adequately investigated the complaint. It had considered each allegation together with the detailed response provided by the controller's data protection officer, invited the data subjects to provide any additional factual information, and explained that it would obtain extracts from the administrative file if concrete indications emerged that further relevant facts required clarification. As the data subjects did not provide any additional facts and there were no objective indications that the information already available was inaccurate or incomplete, the court held that the DPA was not required to obtain the controller's administrative file or undertake further investigations in the absence of concrete indications that additional factual clarification was necessary. The court further held that the DPA had correctly concluded that no GDPR infringement had occurred. The court held that the disputed processing was lawful under Article 6(1)(e) GDPR, read together with Article 6(3) GDPR and § 88 of the German Water Resources Act (WHG), which provided the legal basis for the processing. The court also held that the transmission of personal data by email did not infringe Article 5(1)(f) GDPR because, in the circumstances of the case, transport encryption provided an appropriate level of security.
CJEU case C‑383/23 ILVA (Fine for an infringement of the GDPR)
ILVA (the controller) operates a chain of furniture stores and is part of the Lars Larsen Group (the undertaking). The total undertaking's turnover was multiple times higher than that of the controller. The controller is charged before the Danish courts with violating the GDPR in relation to the retention of the data of at least 350,000 former customers. On the recommendation of the Danish DPA, the Public Prosecutor’s Office sought the imposition of a fine of DKK1,500,000 (approximately 201,000€) on the controller. The calculation of that amount was based not only on the turnover of the controller, but also on the overall turnover of the undertaking. The Aarhus District Court (Retten i Aarhus) found that since the charges had been brought only against the controller, it was not necessary to take into account the turnover of the undertaking to determine the amount of the fine. Furthermore, the court noted that the controller was engaged in an independent retail activity and that it had not been set up by the parent company for the sole purpose of processing the undertaking's data. The Public Prosecutor’s Office appealed to the High Court of Western Denmark (Vestre Landsret), which decided to stay the proceedings and to request a preliminary ruling asking in essence, whether Article 83(4) to (6) GDPR, read in the light of Recital 150, must be interpreted as meaning that the term ‘undertaking’ in those provisions corresponds to the concept of ‘undertaking’, within the meaning of Articles 101 and 102 TFEU, with the result that, where a fine for infringement of the GDPR is imposed on a controller which is or forms part of an undertaking, the amount of the fine is to be determined on the basis of a percentage of the undertaking’s total worldwide annual turnover in the preceding business year. The AG emphasised that the notion of “undertaking” has been recently interpreted by the CJEU in C-807/21 Deutsche Wohnen. According to the CJEU, the undertaking should be understoo
CNPD
The Luxembourg DPA ("Commission Nationale pour la Protection des Données - CNPD") launched an investigation on a group of companies with a subsidiary based in Luxembourg (the controller). The group of companies had appointed a single DPO (the group's DPO) under Article 37(2) GDPR to handle all data protection matters and had appointed a lawyer as the local contact point in Luxembourg to assist the group's DPO. Article 37(2) GDPR allows for the possibility to appoint one DPO for a group of undertakings. The controller had also established a GDPR Board, a committee dedicated to data protection in Luxembourg. The DPO however was not a member of the GDPR Board and was only informed of the subjects discussed there through the minutes of the GDPR Board and through the questions raised by the local contact point during these meetings. The group's DPO did not seat in Luxembourg and was involved mostly indirectly, through the local contact point, in data protection-related matters of the Luxembourg entity. During the course of the investigation, the controller did appoint its own DPO, that started on 1 October 2020. The DPA found that even if the Group's DPO was participating in numerous meetings at a group level and regularly organised meetings with its local points of contact, this was not sufficient to demonstrate the direct, formal and permanent involvement of the DPO in Luxembourg. Therefore, the DPA found that the controller did not sufficiently involve the DPO with data protection matters violating Article 38(1) GDPR and Article 39 GDPR. It further found that the controller did not provided its DPO with the necessary resources and power, violating Article 38(2) GDPR. Thus, the DPA fined the controller €18,000. The controller appealed this decision at the Administrative Court of the Grand Duchy of Luxembourg ("Tribunal administratif du Grand-Duché de Luxembourg - TADM"), seeking annulment of the decision. The controller argued that the DPA used their power excessively in finding violations of Article 38(1) and (2) and Article 39 GDPR. Moreover, the controller argued that the French DPA ("CNIL") had investigated its parent company and the other entities located in France and did not find any violations or made any comments regarding the appointment of the group’s DPO. The controller also argued that the fine amount was disproportionate. Involvement of the group's DPO The court held that in order for the DPO to comply with its obligation to inform and advise the controller under Article 39(1) GDPR, it is necessary and imperative for the DPO to be involved in questions and projects involving issues relating to the protection of personal data at the earliest possible stage. The court found that the handling of the requests and complaints by data subjects was done by a local contact point without intervention of the group's DPO. The group's DPO was only involved when a data subject was not satisfied with the handling by the local contact point. Although the controller referred to regular communications via telephone, video conferences and e-mails between the local contact point and the group's DPO, it did not provide any documentation of these communications. It was also not demonstrated that the group's DPO had preliminary been consulted about putting into place the GDPR Board. The court dismissed the controller's argument that the DPA did not take into account that the controller appointed its own DPO during the investigation. The DPA only considered the facts as they existed on the day it started its investigation. The court agreed with the DPA that any changes made by the controller during the investigation would not eliminate an established breach and would not relieve the controller from their responsibility. The court also dismissed the controller's argument that the CNIL came to a different conclusion during its investigation of the parent company of the group and the other entities located in France. The court held that the CNIL's finding had no relevance as it did not concern the activities in Luxembourg and both the court and DPA are not bounded by decisions from administrative authorities or courts in other countries. Thus, the court found that the DPO was not directly involved in all data protection-related matters. Therefore, the controller violated Article 38(1) GDPR and Article 39 GDPR. Available resources for the DPO The court held that the controller did not present any information about formalising the working time devoted to data protection of the local contact point. The court also noted that the local contact point was the only lawyer in the controller's company in Luxembourg. The court held that the DPO had to be involved in all personal data protection related matters, general consultation was not sufficient. The court then took into account the volume of activities of the controller in Luxembourg (70 sites, between 1600 and 2100 employees and 25000 consumers per day), which would have justified at least one full time person being devoted to data protection. The court thus found that the controller violated Article 38(2) GDPR by not providing sufficient resources to its DPO. Imposed fine Concerning the proportionality of the fine, the court took into account Article 83 GDPR and the seriousness of the violation. The court found that the fine was proportionate as the violations that were found were serious, involved potentially a large number of people and lasted at least from 25 May 2018 to 1 October 2020. Thus, the court dismissed the appeal and upheld the DPA's decision that the controller violated Article 38(1) and (2) and Article 39 GDPR.
Court case 9 AZR 383/19
The Works Council Chairman of a subsidiary was appointed as the DPO of the mother company and its German subsidiaries in 2015. With the parallel appointment of the same person as the DPO for the whole group of undertakings, the mother company, the controller, aimed to synchronize the privacy standards in the group. In 2017, the controller asked the DPA of Thüringen whether such an appointment was lawful, due to concerns of conflict of interests and lack of reliability as under [https://dejure.org/gesetze/BDSG_a.F. § 4f(2) of the German Federal Privacy Law (Bundesdatenschutzgesetz - BDSG)]in its old version (a.F.). The DPA communicated in writing on 24 November 2017 that the requirements for a DPO appointment were not fulfilled at that time since the DPO was also the Works Council Chairman, therefore the appointment was null for incompatibility. Hence, the DPA declared that the controller did not have a DPO from 2015 on and that it should appoint a new DPO by 8 January 2018 or it would risk a fine of €50,000. As a consequence, the controller informed the DPO that it would revoke his appointment of 2015 with immediate effect. Upon entry into force of the GDPR, the controller also sent him a separate revocation letter referring to the operational reasons under Article 38(3) GDPR, second sentence. The DPO therefore filed a lawsuit in front of the Labour Court to challenge his revocation. In its submissions, the controller requested that the appeal be dismissed since the incompatibility of offices constitutes an important reason within the meaning of [https://dejure.org/gesetze/BDSG_a.F. § 4f(3) BDSG (a.F.)] and [https://www.gesetze-im-internet.de/bdsg_2018/index.html § 38(2) BDSG, § 6(4) BDSG] in conjunction with [https://www.gesetze-im-internet.de/bgb/ § 626 of the German Civil Code (Bürgerliches Gesetzbuch -BGB)]. In the first instance, the Labor Court of Dresden upheld the claim of the DPO and the Regional Labor Court of Saxony also dismissed the controller's appeal in its judgment of 19 August 2019. The controller, however, continuted to pursue its motion to dismiss the DPO's claim before the German Federal Labour Court (Bundesarbeitsgericht - BAG). In 2021, the BAG suspended proceedings as it referred four questions to the CJEU asking whether German national law was compatible with Article 38(3) GDPR, second sentence. In its judgment C-453/21 X-Fab Dresden GmbH & Co. KG, the CJEU held that Member states may lay down more specific rules on dismissals and that a conflict of interests can be given if the DPO carries out other functions within the company that determine the scope of processing on behalf of the controller. The BAG held that this assessment made by the CJEU regarding a conflict of interest pursuant to Article 38(2) GDPR has not only applied since the amendment of the BDSG after entry into force of the GDPR, but already corresponded to the legal situation within the scope of the [https://dejure.org/gesetze/BDSG_a.F. BDSG (a.F.).] On 6 June 2023, the BAG issued its final judgment on the case. First of all, it held that the initial appointment of the employee as DPO itself was lawful, due to the fact that reliability is not a reason for an appointment to be invalid and null, but lack thereof can be a reason for revoking the appointment of a DPO under [https://dejure.org/gesetze/BDSG_a.F. § 38(5) BDSG (a.F.).] Secondly, the BAG held that the revocation of the appointment of the employee as DPO was justified for good cause in accordance with [https://dejure.org/gesetze/BDSG_a.F. § 4f(3) BDSG (a.F.)] in conjunction with [https://www.gesetze-im-internet.de/bgb/ § 626(1) BGB]. Such reasons exists if DPO's funciton is made impossible or are at risk as for instance if he does not (or no longer) have the necessary expertise or reliability within the meaning of [https://dejure.org/gesetze/BDSG_a.F. § 4f(2) BDSG (a.F.).] Reliability of the DPO could be called into question if there was a risk of conflicts of interest. The BAG held, making reference to the CJEU's preliminary ruling on Article 38(6) GDPR, that such a conflict of interests can be given if the DPO holds a position within the controller's undertaking that would allow him to determine the purposes and means of processing of personal data. In the BAG's view, if the works council chairman also acted as DPO, a concrete risk of a conflict of interest was given which put the independence of the DPO's functions at risk. As a matter of fact, the works council chairman requests access to specific personal data of employees and decides which protective measures to adopt in that regard. At the same time, the DPO is called upon to assess in a neutral and independent way whether the actions taken by the works council are in line with data protection provisions. Due to these structural limitations, the DPO may struggle to ensure both neutrality and independence from the works council's resolutions, as he is the chairsperson thereof. For all these reasons, the BAG held that this conflict compromises the functional independence of the DPO, potentially undermining data protection provisions and as a result, the employer is justified to revoke the appointment of the employee in question as DPO.
Gegevensbeschermingsautoriteit
on 21 April 2022, the complainants filed a complaint with the data protection authority alleging the unlawful consultation of their professional mailboxes by the DPO of defendant when investigating the leak of an internal mail to a trade union organization, ACV. The complainants state that they were not aware of this processing and that it should not have happened without their consent. The disputes chamber has dismissed the complaint on the grounds of (i) the absence of a high risk within the meaning of Article 35.5 GDPR and (ii) the fact that the present complaint is only a side dispute that is part of a broader trade union dispute for which it is not competent . When appealing against the decision of the litigation chamber, the complainants rely on the following defenses: (i) violation of the dismissal policy of the litigation chamber; (ii) violation of the right to participate during the pre-litigation phase and ask the court to annul the contested decision and order the data protection authority to pay the costs of the proceedings. Regarding the motivation of the dismissal, the litigation chamber admits that due to a technical error, the contested decision once refers incorrectly to a 'technical dismissal', while it is clear that they mean a dismissal for reasons of expediency, since the litigation chamber considers a hearing on the merits undesirable and refers to 3.2.1. of the dismissal policy that deals with the dismissal for reasons of expediency. The court follows the reasoning of the DPA and dismisses this part of the complaint. the Court of Appeal refers within this framework to an earlier judgment that the DPA, as a supervisory authority, is completely independent under Article 52 GDPR in the performance of the tasks and powers entrusted to it and, as a result, has a discretionary power to decide whether or not to dismiss a complaint. With regard to violating the adversarial debate, the law establishing the data protection authority makes a clear dist
X-Fab Dresden GmbH & Co. KG
The data subject was an employee of the controller, X-FAB (a semiconductor foundry), and held two functions in the company: he was the chairman of the work council and the DPO of X-Fab and other companies of the same group of undertakings. However, on 1 December 2017, the data subject was dismissed from his duties as a DPO, at the request of the [https://gdprhub.eu/index.php?title=TLfDI_(Thuringia) DPA of Thuringen (TLfDI) (Germany)]. As a precautionary measure, the other undertakings also decided to dismiss him, based on the second sentence of Article 38(3) of the GDPR, which had in the intervening period become applicable. Dissatisfied, the DPO brought action before the a Court in Germany, asking to be reinstated in his position. The controller argued that his positions as a DPO and as the chair of the work council were incompatible as there was a potential conflict of interests between the two functions. In subsequent proceedings, both the courts of first instance and of appeal upheld the data subject’s action. The controller then appealed to the Bundesarbeitsgericht (Federal labour court of Germany). This Federal Court observed that the outcome of this appeal would depend on the interpretation of EU Law. Specifically, the Bundesarbeitsgericht stated that the question arose as to whether the second sentence of Article 38(3) GDPR (He or she shall not be dismissed or penalised by the controller or the processor for performing his tasks) precludes national legislation from making the dismissal of a DPO subject to stricter conditions than those laid down by EU law. If this was the case, the Court wondered whether that provision had a sufficient legal basis. The Court also noted that it would be necessary to determine whether the functions of chair of the works council and of DPO may be performed simultaneously the same person or whether that would give rise to a conflict of interests within the meaning of the second sentence of the aforementioned article. The Bundesarbeitsgericht asked the following preliminary questions to the CJEU: ‘(1) Is the second sentence of Article 38(3) of [the GDPR] to be interpreted as precluding a provision in national law, such as, in the present case, Paragraph 38(1) and (2) in conjunction with the first sentence of Paragraph 6(4) of the [BDSG], which makes dismissal of the [DPO] by the controller, who is his employer, subject to certain conditions set out therein, irrespective of whether such dismissal relates to the performance of his tasks? If the first question is answered in the affirmative: (2) Does the second sentence of Article 38(3) GDPR also preclude such a provision in national law if the designation of the [DPO] is mandatory not in accordance with Article 37(1) GDPR, but only in accordance with the law of the Member State? If the first question is answered in the affirmative: (3) Does the second sentence of Article 38(3) of the GDPR have sufficient legal basis, in particular in so far as it covers [DPOs] that have an employment relationship with the controller? If the first question is answered in the negative: (4) Is there a conflict of interests within the meaning of the second sentence of Article 38(6) of the GDPR if the [DPO] also holds the office of [chair] of the works council established at the controlling body? Must specific tasks have been assigned within the works council in order for such a conflict of interests to be assumed to exist?’ Not applicable The CJEU provided answers to the first and fourth preliminary question. It started with the first question by interpreting Article 38(3) GDPR. According to its own case law, to do so we need to consider the wording of the provision, it's meaning in everyday language, as well as its context and objectives. First, with regard to the wording, the Court held that the GDPR did not define the terms ‘dismissed’, ‘penalised’ and ‘for performing his [or her] tasks’ in the second sentence of Article 38(3) GDPR. Thus, it considered the use of these terms in normal everyday language to determine their meanings. Based on this line of reasoning, the CJEU concluded that the dismissal of a DPO grounded on the performance of his or her tasks is not allowed. The CJEU also held that the second sentence of Article 38(3) GDPR is intended to apply to any relationship between DPOs and controllers/processors, irrespective of the nature of the relationship. Second, with regard to the objective of the second sentence of Article 38(3) GDPR, the CJEU referred to Recital 97, which states that DPOs should be in a position from where they can perform their duties and tasks in an independent manner. This independence should enable them to carry out tasks in accordance with the objective of the GDPR, thereby ensuring its consistent and homogeneous application. The CJEU also emphasized this independence is also apparent in the first and third sentences of Article 38(3) GDPR. The first sentence of states that DPOs should not to receive any instructions regarding the exercise of his duties, while the third states that DPOs should also report directly to the highest level of management of the controller/processor. In this context, Article 38(5) GDPR provides that DPO is to be bound by secrecy or confidentiality. Therefore, the CJEU concluded that the objective of Article 38(3) GDPR was to preserve the functional independence of the DPO and to ensure that the GDPR is effective. Third, the Court assessed the context of the provision. The CJEU assessed the preamble of the GDPR and noted that it was adopted on the basis of Article 16(2) TFEU. This provision states that the Council of the European Union and the European Parliament were laying down rules for the protection of natural persons with regard to the processing of personal data on the one hand, and the free movement of such data on the other. The CJEU held that laying down rules against the dismissal of a DPO fell within the scope of protection of natural persons. From this context, it followed that each member state was free to lay down more protective specific rules concerning the dismissal of a DPO, as long as these national provisions were compatible with the GDPR and EU law, especially with the second sentence of Article 38(3) GDPR. However, if a DPO no longer possesses the professional qualities for the position, he/she cannot be protected as this would undermine the GDPR's objective of ensuring a consistent and homogeneous application of data protection rules. Answering the first preliminary question, the CJEU concluded that it was up to the national court to determine if the specific national provision was compatible with the GDPR and EU law. The CJEU then assessed the fourth question. Just like with the first question, the court looked at the wording, the objective and the context of the provision. First, the Court looked at the wording of Article 38(3) GDPR itself by assessing the wording of this provision in everyday language. The court stated that the there was no established incompatibility in the GDPR between the performance of the DPO's duties on the one hand, and the performance of other duties on the other. Article 38(3) GDPR specifically provided that the DPO can be given tasks other than those for which he/she is responsible under Article 39 GDPR. Second, the court looked at the objective of Article 38(3) GDPR, which was to preserve the functional independence of the DPO and, consequently, to ensure the effectiveness of the GDPR. Third, the CJEU looked at the context of Article 38(3) GDPR and noted that, according to Article 39(1)(b) GDPR, the task of the DPO was to monitor compliance with the GDPR, EU law and/or national data protection law. The DPO also had to assess the policies of the controller or processor regarding data protection, including the assignment of responsibilities, awareness-raising and training of staff. It followed from this that a DPO cannot be entrusted with tasks or duties which would result in him or her determining the objectives and methods of processing personal data on behalf of the controller or its processor. Under EU law or national law, the review of those objectives and methods must be carried out independently by the DPO. An assessment of a potential conflict of interests, within the meaning of Article 38(3) GDPR, must be carried out on a case by case basis, with an assessment of all the relevant circumstances. The Court emphasised the organisational structure of the controller or its processor and in the light of all the applicable rules, including any policies of the controller or its processor, as an important factor. The CJEU concluded that a conflict of interest' may exist where a DPO is entrusted with other tasks or duties, which would result in he/she determining the objectives and methods of processing personal data on behalf of the processor/controller. National courts had to assess such a situation on a case by case basis, considering all the relevant circumstances. The courts had to pay particular attention to the organisational structure of the controller/processor in the light of all applicable rules, including the own policies of the controller/processor.
Court case 8 Ca 135/22
A German employer attempted to terminate their DPO’s employment contract without notice. The reason was that the employer claims that the DPO did not perform their duties adequately over a period of several years. The DPO contested the validity of this termination under § 6(4) BDSG, which only allows employers to terminate the employment of their DPOs for "important reasons". A month prior, an auditing company had issued an expert opinion on a lack of data protection measures and associated risks within the company where the DPO is appointed. Implementing such data protection measures would have taken up considerable additional working time of the DPO. However, they did not notify their employer that they could not undertake such tasks. The DPO argued that these tasks were of a structural nature and therefore not their responsibility, but that of the management board. The Labour Court of Heilbronn held the termination of the employment contract is invalid. DPOs enjoy special protection in the context of termination of employment under § 38(2) BDSG and § 6(4) BDSG in conjunction with § 626 BGB in Germany. The special protection of DPOs, which is in addition to that awarded under Article 38(3) GDPR, is permitted under EU law. As aforementioned, the BDSG only allows terminations of DPOs for "important reason". On the other hand, pursuant to § 626 BGB, the employment relationship may be terminated without observing a notice period if, considering all circumstances, there are facts on the basis of which the DPO cannot reasonably be expected to continue the employment relationship even until the expiry of the notice period. However, the court declared the dismissal of the DPO to be invalid, as no reasonable grounds to warrant such a termination were found. The justification of termination was based exclusively on the failure of the DPO to complete their responsibilities as opposed to evidence of a concrete breach of duty, which is not a valid ground for termination without notice under the 38(2) BDSG and § 6(4) BDSG. The expert opinion by the auditing company did not prescribe responsibility to the DPO in their duties of implementing the GDPR, but only revealed data protection deficiencies within the company, which is the responsibility of the employer to implement on an organizational level. The court further iterated that the employer could have revoked the DPO’s appointment should they have concretely breached their duties, as opposed to terminating their employment from the company.
Court case 2 AZR 225/20
The case concerns a dispute regarding the validity of an ordinary termination of a data protection officer's (DPO) employment relationship. The plaintiff had been working for the defendant as the company DPO starting on 1 February 2018. In a letter dated 13 July 2018, the defendant, the plaintiff's employer, terminated the employment relationship with effect from 15 August 2018. In order to make the termination effective, the defendant invoked a restructuring measure which had led to the discontinuation of the plaintiff's need for employment. The plaintiff applied for a declaration to declare that the employment relationship between her and the defendant was not terminated by the defendant's notice of termination. The plaintiff invoked a special protection against the dismissal of DPOs pursuant to section 38(2) in conjunction with section 6(4) sentence 2 of the German Federal Data Protection, according to which DPOs may not be dismissed without observing a notice period unless facts exist which entitle the employer to terminate the employment relationship for "good cause". The defendant filed a motion to dismiss the action, arguing that the plaintiff could not invoke the special protection as the law would violated Article 38(3) GDPR which mandates that DPOs shall only be protected from dismissals which relate to the performance of their tasks. Consequently, the court asked the CJEU for a preliminary ruling on whether, as argued by the defendant, the national and European norms are in conflict. The CJEU answered that the norms are not in conflict. Therefore, the German Federal Labour Court decided to agree with the plaintiff. According to the CJEU (see C-534/20), Article 38(3) second sentence GDPR is to be interpreted as not precluding a national rule, under which a data protection officer employed by a controller or processor may be dismissed only for good cause, even if the dismissal is not related to the performance of his or her duties, provided that that rule does not prejudice the attainment of the objectives of the GDPR. This is not the case in regards the discussed provisions of the German data protection law. Based on this CJEU ruling, the Federal Labour Court elaborated that the special protection against dismissal protects data protection officers from losing their job which may threaten them - even in a disguised form - because of the performance of his or her duties. Moreover, the special protection against dismissal protects their independence in the performance of their statutory duties, which benefits the enforcement of the objectives of the German data protection law and the GDPR.
Data subject against COMET S.P.A.
A data subject made an access request to Comet s.p.a., the controller, to verify the lawfulness of the processing of her personal data for marketing purposes. In particular, she requested the information provided for in Article 15(1)(a) and (h) GDPR, and a copy of the personal data in possession of the controller. The controller did not respond to the request. Therefore, the data subject appealed to the Tribunal of Bologna, requesting an order for the fulfilment of her right under Article 15 GDPR. She stated that the controller must (have) processed her personal data, since she had a 'loyalty card' from the controller and documentation relating to the purchase of a smart TV (receipt and financing contract). The Court held that it was becoming increasingly crucial to protect people's rights when it comes to the processing of their personal data, especially from an economic standpoint. In doing so, it is necessary to remember that protecting people's fundamental rights cannot be sacrificed in favour of the interests of the market alone. The Court recalled that the GDPR, although known as the Privacy Regulation, actually has a far wider scope of application that extends beyond and individual's right to privacy, which is historically linked to their most private sphere. While the liberal concept of privacy requires essentially refraining from something for its protection, the current conception of privacy has an interactive and dynamic nature. It particularly concerns personal data and their circulation. The right to data protection is the cornerstone of the (positive) freedom to fully control the flow of an individual's own data. It is distinct from the (negative) freedom not to be interfered with in an individual's own private sphere. This is also, and above all, in the logic of market regulation covered by the GDPR. The Court added that it was sufficient to say that the Economist' described personal data as the new 'most valuable resource', i.e. the new oil. The
Leistritz AG
Leistritz is a private company (the Company) based in Germany that is required under German law to have a Data Protection Officer (DPO). LH was the ‘Head of Legal Affairs’ in the Company, and subsequently, also became its Data Protection Officer from 1 February 2018. On 13 July 2018, the Company issued a letter by which it terminated LH’s employment with the Company, effective 15 August 2018. In the letter, the Company relied on internal restructuring measures, as per which the “activity of internal legal adviser and the data protection service were to be outsourced.” LH challenged the validity of termination of her employment and claimed that the same was invalid as per Article 38(2) GDPR and Section 6(4) BDSG, as the employment could be terminated only in case of a “just cause”. The Court agreed with the plaintiff and declared LH's termination unlawful since no “just cause” was to be found in the present case. The Company filed an appeal against the decision. The issue raised was whether Article 38(3) GDPR allows a Member State to make laws that impose stricter conditions for the termination of a DPO. Noting a divergence in German jurisprudence, the Federal Labour Court stayed the proceedings and referred the following questions to the CJEU for a preliminary ruling: 1. Is the second sentence of Article 38(3) GDPR to be interpreted as precluding a provision in national law, such as Paragraph 38(1) and (2) in conjunction with the second sentence of Paragraph 6(4) of the Bundesdatenschutzgesetz (Federal Law on data protection), which declares ordinary termination of the employment contract of the data protection officer by the data controller, who is his employer, to be impermissible, irrespective of whether his contract is terminated for performing his tasks? If the first question is answered in the affirmative: 2. Does the second sentence of Article 38(3) GDPR also preclude such a provision in national law if the designation of the data protection officer is not mandatory in accordance with Article 37(1) GDPR, but is mandatory only in accordance with the law of the Member State? If the first question is answered in the affirmative: 3. Is the second sentence of Article 38(3) GDPR based on a sufficient enabling clause, in particular in so far as this covers data protection officers that are party to an employment contract with the data controller? Answering the first question, the CJEU held that there are certain words within Article 38(3) GDPR that are otherwise not defined within the GDPR. To interpret these provisions requires reference to their ordinary meaning in everyday language as well as the context in which they appear in GDPR. The CJEU concluded that Article 38(3) GDPR is intended only to ensure a DPO's functional independence, not to govern the overall employment relationship between a controller or a processor; it applies irrespective of the nature of the DPO's employment relationship with the controller or processor. Because the EU is to support and complement the efforts of member states in the field of worker protections, the CJEU held that Article 38(3) GDPR does not preclude “national legislation which provides that a controller or a processor may terminate the employment contract of a data protection officer, who is a member of his or her staff, only with just cause, even if the contractual termination is not related to the performance of that officer’s tasks, in so far as such legislation does not undermine the achievement of the objectives of the GDPR.” As the first question was answered in the negative, the CJEU did not answer the remaining two questions.
Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (Germany)
The Job Centre of Diepholz (controller) dismissed its Data Protection Officer (DPO). The German Federal Data Protection Authority (BfDI - Bundesbeauftragter für den Datenschutz und die Informationsfreiheit) issued an immediately enforceable order against the Job Centre under Article 58(2)(d) GDPR to bring its processing into compliance with the GDPR and re-designate the dismissed DPO. The controller applied for interim relief before the Administrative Court of Köln (VG Köln - Verwaltungsgericht Köln) against this order. The VG Köln held that there was no necessity for the BfDI to make the order immediately enforceable because the controller had already designated a new DPO. Furthermore, the court concluded that Article 58(2)(d) GDPR does not empower the DPA to order the controller to re-designate its dismissed DPO, because neither designating nor dismissing a DPO constitutes processing according to Article 4(2) GDPR
Court case 2R149/21a
A district authority had issued a decision allowing for hawks to be shot in a certain rural area. This decision contained certain personal data of the claimant. The respondent(a natural person) published this decision on their private website. The claimant asked the respondent to redact/anonymise the claimant's personal data on their website but the respondent refused. Consequently, the claimant filded a complaint with the Austrian Data Protection Authority (Datenschutzbehörde - DSB), represented by an attorney. The DSB upheld the complaint, held that the respondent had violated the claimant's data protection rights (remark: the exact GDPR violations are not specified in the judgment) and ordered the respondent to remove the claimant's personal data from their website. The respondent filed an appeal to the Federal Administrative Court (Bundesverwaltungsgericht - BVwG) which dismissed the appeal. The claimant filed a lawsuit, claiming the costs of their attorney under Article 82 GDPR. The claimant argued that the respondent had acted unlawfully and culpably, as they refused to redact/remove the personal data despite the claimant's explicit request. The first instance court upheld the claim and the respondent filed an appeal with the Higher Regional Court Linz (Oberlandesgericht Linz - OLG Linz). The OLG Linz dismissed the appeal. It noted that Article 57(3) GDPR only states that the performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer. Hence Article 57(3) GDPR does not forbid that a controller can be put under the obligation to pay/refund legal costs in connection with a complaint procedure under Article 77 GDPR. Furthermore, the EFTA Court in E-11/19 and E-12/19 only held that a data subject cannot incur costs in a proceeding where they have become a party to the case by virtue of a controller appealing against a supervisory authority’s decision. However it did no
Le service intégré de l'accueil et de l'orientation (SIAO)
Several NGOs brought a complaint before the Conseil d’Etat to stop a new form of cooperation between two national services (SIAO and OFII) in charge of asylum seekers and beneficiaries of international protection. This new form of cooperation leads to a new joint database and, thus, to a new processing operation of the applications for asylum by the SIAO and the OFII. This new database includes the personal data of the asylum seekers. The Conseil d’Etat had to assess when the Data Protection Impact Assessments (DPIA) according to Article 35 GDPR should be carried out in this case. The Conseil d’Etat stated that the DPIA must be carried out prior to the processing operation, but it must also be updated after the actual launch of the processing operation to ensure that the risks to the rights and freedoms of the natural persons whose personal data are processed are always duly taken into account. If further found that carrying out the DPIA when initiating the processing operation was sufficient to comply with Article 35 GDPR.