GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 19 October 2026 · Updated daily
52 results · Showing 1–20
Data subject
The data subject was an existing customer of a telecommunications provider (the controller). An unknown third party used the data subject’s name, date of birth and bank account number to order a mobile phone contract and smartphone through the controller’s online shop without the data subject’s knowledge and provided a delivery address that had no connection to the data subject. The controller did not verify the identity of the person placing the order or compare the delivery address with the data subject’s existing address information. Despite instruction to require identity verification for the delivery, the delivery company handed the package to an unknown third party and recorded the data subject as the recipient. The data subject lodged a complaint with the Austrian Data Protection Authority (DPA), alleging that the controller had allowed a third party to use their personal data to conclude a contract without adequate identity verification. The controller argued that it had selected personal delivery with an identity check as an appropriate security measure. It also argued that the delivery company was independently responsible for the failure to check the recipient’s identity. The DPA upheld the complaint. The controller appealed to the Austrian Federal Administrative Court. First, the court held that the controller had violated Article 5(f) GDPR, Article 24 GDPR and Article 32 GDPR by failing to implement adequate technical and organisational measures to prevent identity fraud. Second, the court held that the controller had violated Article 5(1)(d) GDPR, which requires controllers to ensure the accuracy of personal data. By failing to verify the data subject’s identity or check the delivery address against the information already held for this existing customer, the controller had failed to take adequate measures to ensure data accuracy. Third, the court rejected the controller’s argument that arranging personal delivery with an identity check was sufficient. The controller had not convincingly explained how it monitored compliance with the personal delivery requirement. Relying on the delivery company’s contractual obligation to verify the recipient’s identity did not affect the controller’s own obligations. Finally, the court upheld the DPA's finding that the controller had infringed the data subject’s right to confidentiality under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=bundesnormen&Gesetzesnummer=10001597 § 1 DSG], read together with Article 5(1)(d) GDPR, Article 5(1)(f) GDPR, Article 24 GDPR and Article 32 GDPR. It dismissed the appeal and held that a further appeal was inadmissible.
ING Bank N.V.
ING Bank N.V. (the controller) is a bank. In 2022, several data subjects brought a complaint to the DPA regarding the controller’s contactless payments. The data subjects requested the controller to issue debit cards without a chip that would enable contactless payments. The controller stated that this was not possible, however, the contactless payment feature could be disabled on the data subjects’ cards. The data subjects later filed a complaint because the debit cards contained the chips even if the contactless feature was disabled. The DPA dismissed the complaint in 2024, on the grounds that further investigation would be needed to determine whether the controller violated the GDPR or not. The DPA stated that it had limited capacity and such an investigation would place a heavy burden on it. The data subjects appealed this decision to the court, who determined that the DPA had wrongfully failed to hear the data subjects during the objection phase. The DPA issued a new decision in 2025 and concluded that the controller had not violated the GDPR. The data subjects appealed this decision, arguing that the DPA had again not investigated the case sufficiently. In addition, the data subjects argued that the controller processed personal data through the debit card chip without a valid legal basis. This is because the chip allowed payments made with blocked or expired cards, meaning Article 6(1)(b) GDPR did not apply. The controller could also not rely on consent (Article 6(1)(a) GDPR) to process the data. The DPA argued that the GDPR does not require controllers to completely eliminate a risk. In addition, disabling contactless payments or blocking cards were related to the contract between the data subject and the controller; the DPA argued that this did not remove the basis to process personal data. The court found that the DPA investigated the complaint to an appropriate extent and was not required to conduct a further investigation. According to the court, the data subjects did not provide sufficient evidence that the controller’s statements were incorrect or that the DPA lacked the technical knowledge during its investigations. The court upheld the DPA’s reasoning that Article 32 GDPR does not require a security risk to be completely eliminated, and concluded that the DPA could reasonably decide that there was no violation of the GDPR. Similarly, the court upheld the DPA’s reasoning and concluded that the controller had a valid legal basis to process the data subjects’ personal data. The court saw no need to assess potential violations of other laws (e.g. fraud or forgery) or consumer law issues, on the grounds that the DPA’s investigation is limited to compliance with the GDPR. The DPA is also not required to coordinate or refer the case to other competent authorities. The court dismissed the appeal.
Court case S 5 SF 65/24 DS
The data subject (a child born in 2018), represented by her parents, was insured with the controller (a statutory health insurance provider) and participated in its digital bonus programme. The bonus programme was managed via an app. To handle the information technology operations of this programme, the controller hired the processor (an IT service provider), establishing a data processing agreement under Article 28 GDPR alongside specific information security guidelines. To provide these services, the processor utilised "MOVEit Transfer," a market-leading file transfer software developed by Progress Software Corp. On 31 May 2023, the software developer publicly announced a critical, previously unknown "zero-day" vulnerability in the software (later assigned CVE-2023-34362). At that exact moment, no security patch was available. On the very same day, 31 May 2023, the processor – alongside thousands of other companies worldwide – became the victim of a global cyberattack carried out by the hacker group "Clop." The hackers exploited this zero-day vulnerability to install a "web-shell" backdoor (typically named human2.aspx), bypassing authentication to exfiltrate database records. The compromised data included the data subject's first and last name, health insurance number, bonus points balance, and a bank account number (IBAN) belonging to her mother. No medical, health, or social security data was exfiltrated. On 1 June 2023, the developer released a security patch, which the processor installed immediately. On 2 June 2023, the German Federal Office for Information Security (BSI) issued a formal IT security warning (No. 2023-240133-1100, Version 1.1). The BSI classified the IT threat level as "3 / Orange" (business-critical), confirming active exploitation with data exfiltration. The BSI recommended immediately blocking all HTTP and HTTPS traffic to MOVEit environments, checking for specific Indicators of Compromise (IoCs) in the web server directories, and applying the newly released patch before reconnecting systems to the network. On 16 June 2023, the processor informed the controller about the incident. On 17 June 2023, the controller issued a public press release confirming that its external service provider for the bonus programme had been targeted on 31 May 2023. The release stated that the security vulnerability had been closed, that there was never any connection to the controller's internal IT systems, and that relevant supervisory authorities had been notified. The controller subsequently notified the data subject's parents. On 27 March 2024, the data subject, via legal counsel, sent a formal warning letter to the controller demanding an injunction, a declaration of liability for all potential future damages, and non-material damages of at least €3,000. Following the controller's refusal, the data subject filed a lawsuit with the Nuremberg Social Court (Sozialgericht Nürnberg), later expanding the claim to the processor as a joint defendant. The Court dismissed the lawsuit as partly inadmissible and otherwise unfounded, establishing the following legal principles: First, the Court held that a successful third-party cyberattack does not establish an irrebuttable presumption that a controller or processor failed to implement appropriate security measures under Article 32(1) GDPR and Article 5(1)(f) GDPR. To escape liability under Article 82(3) GDPR, an operator must prove they implemented robust baseline security controls (such as multi-factor authentication, encryption, and lockout policies) and applied a security patch immediately upon its release by the vendor, even if this occurred before formal alerts were issued by national IT security authorities. Second, the Court held that a claim for non-material damages under Article 82(1) GDPR based on the fear or distress of future data misuse cannot be established if the data subject is a minor who has no subjective knowledge or cognitive awareness of the data breach. Furthermore, if the compromised financial data (such as an IBAN) does not belong to the data subject personally, there is no direct risk of financial harm to them, rendering the alleged fear of financial damage unfounded. Third, the Court held that an injunction claim is inadmissible due to a lack of specificity if it merely demands that a controller stop making personal data accessible to third parties without implementing "state-of-the-art" security measures, without specifying the concrete technical or organisational measures the controller is required to take. Fourth, the Court held that a declaratory claim for potential future material damages is inadmissible under national procedural law (§ 55(1) SGG) if there is no realistic probability of future financial harm, particularly because the compromised bank account belonged to a third party (the mother) and the software vulnerability was immediately patched.
Agencija za zaštitu osobnih podataka (AZOP)
INA, a petrol station chain in Croatia, appealed, AZOP's, the DPA's, €5000 fine. The fine was based on AZOP's decision that INA, as a controller, did not take all necessary measures to prevent unauthorised access and visibility of the real-time CCTV feeds to all customers. INA disputed this decision, claiming legitimate grounds for such data processing, stressing that projecting real-time CCTV feeds in petrol station shops to customers is an accepted and normal practice in the industry and by the consumers themselves. The Court upheld the DPA's decision regardless, on two crucial grounds: the lack of compliance with the cumulative requirements to fulfil Art 6 GDPR and Art 32 (1 and 2) GDPR. Firstly, the Court sided with the DPA, stating INA, did not meet two of the three cumulative conditions, in depicting a legitimate interest for the purpose of ensuring a timely response by employees and deterring perpetrators of criminal and infringing acts. Therefore, the Court accepted the reasoning that, the requirement of necessity is not met, as the timely reaction by employees and a rapid response in the event of a harmful incident, can be achieved even without customers having real-time access to the video surveillance system. As Art 6(1)(f) prescribes that three conditions must be met cumulatively for the data controller to be able to demonstrate its legitimate interest for a lawful basis, the prescribed conditions are not cumulatively met. Secondly, the Court highlights that the screen's placement in the premises of the retail shop of the petrol station itself, with clear visibility for all, is contrary to Art 32(1) and (2) GDPR. The Court stresses INA failed to take necessary protection measures in accordance with existing and foreseeable risks of unauthorized disclosure of personal data. This becomes especially relevant, as the the controller allows customers, as unauthorised persons, access to the live feed in real time, exposing the personal data to risks such as copying, recording, or other unauthorised use of the video surveillance footage, or the sharing of such footage with third parties in any way.
H. (data subject)
The data subject had his personal data restricted in the population register due to risks to life and safety based on his work. On 20 January 2022, a bus driver employed by the controller, a bus company, caused a minor traffic accident involving the data subject. The data subject later shared his name and address with the driver, requesting written communication only. On 2 March 2022, the data subject’s legal representatives informed the controller that heightened protection measures were necessary if his data were processed electronically. The controller reported the accident and forwarded related correspondence to its insurance company via email. On 12 April 2022, the data subject submitted an access request under Article 15 GDPR limited to the accident-related processing. The controller did not respond within one month. On 28 June 2022, the data subject filed a complaint with the DPA, arguing unlawful email transmission, insufficient security measures, lack of breach notification, and failure to respond to the access request. On 16 November 2022, the DPA rejected the complaint. It found that the email transmission was lawful and sufficiently secure, and that the controller could not identify the data subject based on the request. The data subject challenged this decision before the court, seeking corrective measures and a fine. First, the court held that the controller lawfully processed the data under Article 6(1)(f) GDPR. Reporting the accident to the insurer constituted a legitimate interest, and the data subject’s interests did not override this. Second, the court found no violation of Article 32 GDPR or Article 5(1)(f) GDPR. It considered transport encryption (e.g. TLS) sufficient given the low risk. The transmitted data consisted only of the data subject’s last name, which was not sensitive and did not increase the risk to his safety, despite the register restriction. End-to-end encryption was therefore not required. Third, the court held that no obligation to carry out a data protection impact assessment (DPIA) arose under Article 35 GDPR, as the processing did not present a high risk. Similarly, no breach notification under Article 33 GDPR was required because no infringement occurred. Fourth, the court rejected the request to impose corrective measures or a fine under Article 58 GDPR. Finally, the court held that the controller violated Article 12(3) GDPR by failing to respond to the access request within one month. The controller could identify the data subject based on the context of the request and prior correspondence. The DPA failed to properly investigate and assess this issue. As a result, the court ordered the DPA to reassess the complaint regarding the delayed response, taking into account the court’s legal reasoning.
Court case Az. VI ZR 396/24
The controller is a music streaming service, which used an external processor until December 2019. At the time of termination of the contract, the processor informed the controller that all the personal data it was processing would be deleted. The controller never followed up on this communication to conduct the appropriate checks. It was discovered that the processor actually did not delete the data until 2023, and that from 2022 the users data were sold on the darknet. The controller informed the data subjects as soon as it knew about the incident. One of the data subjects affected sought compensation for immaterial damages. The Regional Court dismissed the claim, which was confirmed by the Court of Appeals. The court did establish that the controller failed to comply with its obligations to carefully monitor its processor. Still, they also reasoned that the data subject did not suffer any immaterial damages as a result of it. It assessed that receiving spam emails cannot account as a damage, and that fears and anxiety are normal everyday feelings that cannot amount to damages, especially after 2 years from the data breach. The rationale was that the further away from the event, the lower the probability of an actual damage occurring. Moreover, the fear was also resulting from the fact that the data subject was also hacked before in an unrelated incident, so no causal link could be established. The data subject filed an appeal to the Federal Court of Justice. The court upheld the appeal, and sent the judgement back to the court of appeals for it to award appropriate damages to the data subject. The court explained that a claim for damages under Article 82(1) needs, cumulatively, 1. A GDPR breach 2. The existence of an immaterial damage 3. A causal link between damage and breach. The breach of the controller’s obligations under Article 28 and Article 32 GDPR had already been established previously. Establishing the damage was more complicated. The court explained how the CJEU had already established that a claim for damages under Article 82 is admissible for infringements of Article 32 GDPR. The court of appeals’ finding that no immaterial damages were found did not take this into account. First of all, the data subject suffered a loss of control over their data, which was then misused (as it was sold on the darknet), which has to be construed as a immaterial damage. Legislation also pointed in this direction: Recital 146 GDPR affirms that “damage” must be interpreted broadly - a mere GDPR breach is not sufficient, it has to cause damage. Case law also affirmed that mere loss of control over one’s data as a result of a GDPR breach is sufficient. Other GDPR recitals also confirmed this, more specifically Recitals 75 and 85, reporting loss of control as a possible damage, even if no specific misuse follows from it. In any case, the fact that there was a misuse of the data subject’s data leaves no doubt about the presence of a damage. The misuse, in particular, was the unauthorised transfer to third parties, in the form of selling the data subject’s data on the darknet. It followed that the fears and anxieties of the data subject were not hypothetical but well founded; Thus, immaterial damage can be assumed at least from the point where the data subject’s data was sold on the darknet. In general, the court explained that the requirement for demonstrating fear of data misuse must not be excessive – the more plausible the misuse, the lower the requirements for fear of data misuse. The court of appeals erroneously assumed a threshold that cannot be applicable. Finally, the presence of a causal link cannot be dismissed because of previous hacking to the detriment of the data subject. The court agrees with the data subject that compensation for immaterial damages should be awarded, and refers the case back to the court of appeals.
Philippe Latombe
= The Schrems II ruling of the CJEU annulled the Commission’s adequacy decisionCommission Implementing Decision (EU) 2016/1250 of 12 July 2016. that declared that the US offered an equivalent level of protection for personal data. Following the decision, the EU and the US established the Trans-Atlantic Data Privacy Framework (DPF). The DPF is a set of legal acts which, altogether, aim to address the shortcomings in US protection of European data highlighted by Schrems II. In particular, the DPF established: * a Privacy and Civil Liberties Oversight Body (PCLOB) with oversight powers on the activities of intelligence agencies * a Data Protection Review Court (DPRC) with the power to review and overturn the PCLOB’s decisions. Based on the new safeguards introduced with the DPF, the Commission considered that the US offered an adequate level of data protection and adopted a new adequacy decision allowing for data flows ([https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj/eng Commission Implementing Decision 2023/1795 finding an adequate level of protection ensured by the United States]). The decision allowed EU entities to transfer data to US-based recipients on the basis of Article 45 GDPR (as long as the recipients were certified under the Data Privacy Framework programSee point 2.1.1. of the adequacy decision. A similar limitation was also in place for the Privacy Shield, i.e. the pre-Schrems II data transfer framework.). = In October 2023 French citizen Pierre LatombePhilippe Latombe is a Member of the French Parliament and a Commissioner for the French DPA (CNIL). However, he acted as a private citizen. filed an annulment action with the CJEU against the new adequacy decision from the commission (from now on: ´the adequacy decision´). Contrary to the Commission’s findings, Latombe claimed that the US did not ensure a sufficient level of protection for personal data in the context of third-country data transfers, as required by Article 45(2) GDPR. In particular, Latombe claimed that: * The DPRC was not "an independent and impartial tribunal previously established by law", as required by the right to fair trial under Article 47 CFR. * The adequacy decision violated Article 7 CFR and Article 8 CFR because the US did not ensure an adequate level of protection with regard to the bulk collection of personal data from intelligence agencies. * The adequacy decision violated Article 22 GDPR because the US legal system did not provide guarantees against automated decision-making comparable to those provided by Article 22 GDPR. * The data security obligations under the adequacy decision were too narrow, in violation of Article 32 GDPR and Article 42(2) GDPR. The Court held that the DPF granted a sufficient level of data protection at the time of its adoption. On these grounds, the Court dismissed the action on merits. Notably, the Court assessed the legality of the adequacy decision based on the factual and legal circumstances existing when the decision was adopted. The Court clarified that later legal and factual developments were not relevant to the assessmentSee margin 22 of the ruling.. = The Commission argued that the action was inadmissible because Latombe lacked standing for direct action. The Court, however, did not assess the admissibility on the action. Rather, the Court held that the action was unfounded and considered that in the case at hand, the proper administration of justice justified dismissing the action on its merits without ruling on admissibility. = == Contrary to Latombe’s arguments, the Court held that the DPRC was an independent and impartial tribunal in the sense of Article 47 CFR. The Court considered that the appointment of judges by the Attorney General, and the requirements for the role (which were, in essence, comparable to the requirements for serving as a federal judge), were sufficient to ensure the impartiality and independence of the body. The Court also considered that the DPRC had broad fact-finding powers as well as the power to overturn decisions from the PCLOB. Therefore, the independence and impartiality of the PCLOB (which Latombe also questioned) were not relevant to the assessment of the impartiality and independence of the DPRC. == With regards to the requirement that a tribunal be “established by law”, the Court acknowledged that the DPRC was established via a Regulation of the AG (and, therefore, by the executive rather than a formal law of Congress). However, the Court held that this circumstance was not enough to conclude that the DPRC was not “established by law”. In the Court’s view, the requirement that a court be established by law must not be interpreted formally but rather in relation to the guarantees of impartiality and independence of the court itselfIn this regard, the Court leveraged both ECtHR case law on Article 6 ECHR (“Right to a fair trial”) and the principle of the “substantial equivalence” of safeguards in other countries as established in the Schrems II ruling.. The Court held that the AG Regulation in question included sufficient guarantees in this sense. On these grounds, the Court dismissed Latombe’s argument. = As explained above, Latombe argued that the adequacy decision violated Article 7 CFR and Article 8 CFR (respectively, “Respect for private and family life” and “Protection of personal data”) because the US did not ensure an adequate level of protection with regard to the bulk collection of personal data from intelligence agencies. In particular, Latombe observed that Executive Order 12333 did not require previous authorization for bulk data collection from intelligence agencies. The Court, on the other hand, held that bulk data collection was not, in itself, incompatible with Article 7 CFR and Article 8 CFR. The Court held that US law provided sufficiently clear and precise rules on bulk data collection and that the DPRC had the power to exercise ex-post judicial oversight. With regards to judicial oversight specifically, the Court clarified that neither CJEU nor ECtHR case law necessarily require an ex ante authorization regime for the bulk collection of personal data. An ex post and independent judicial oversight, such as that carried out by the DPRC, may be considered sufficient if robust enough. = The Court held that US law provided sufficient guarantees for data subjects with regards to automated decision-making. In this regard, the Court observed that many US-based data controllers not established in the Union are nonetheless subject to Article 22 GDPR by virtue of Article 3(2) GDPR (Territorial scope). The Court also considered that even cases falling outside the scope of the GDPR are frequently covered under sectorial US lawsIn this regard, the Court mentioned the Fair Credit Reporting Act, the Equal Credit Opportunity Act, the Health Insurance Portability Act (HIPAA), the Fair Housing Act, and Title VII of the Civil Rights Act. and that such laws include sufficient safeguards with regards to automated decision-making. = Latombe claimed that the requirements for data security in the adequacy decision were narrower in scopeSpecifically, Latombe pointed out that the security requirements under point III.6(f) of Annex I applied when organizations “create, maintain, use, or disseminate personal data”- a notion much narrower than that of “data processing”. that those found in Article 22 GDPR. Therefore, he argued that the adequacy decision violated Article 32 GDPR read in conjunction with Article 42(2) GDPR. The Court, on the other hand, held that the security provisions of the adequacy decision were broad enough in scope when interpreted in light of the entire legal text. On these grounds, the Court held that the adequacy decision did not violate Article 32 GDPR.
User (data subject)
The controller operated a website offering paid and free trial software solutions. The data subject used the controller’s services. The controller stored only the data subject’s email address. On 30 September 2020, unknown third parties accessed the controller’s systems and obtained personal data of users, among it email addresses, usernames, names, addresses and telephone numbers. The attackers later made the data available online for free. The data subject claimed that their email address was affected by the incident. On 7 June 2023, the data subject submitted an access request under Article 15 GDPR and asserted further claims. The controller replied on 14 August 2023. The data subject argued that the controller had failed to ensure adequate security of processing and had therefore infringed the GDPR, in particular by not implementing sufficient technical and organisational measures within the meaning of Article 32 GDPR. They further alleged that the controller had not designated a representative in the European Union and had unlawfully transferred data outside the European Economic Area. They claimed that these infringements caused them discomfort and emotional distress. The data subject sought at least €3,000 in non-material damages under Article 82(1) GDPR for the data breach and at least €2,000 for an allegedly insufficient response to his Article 15 GDPR request. They also sought a declaration of liability for future material damage and an injunction requiring the controller to refrain from making personal data accessible to unauthorised third parties without state-of-the-art security measures. First, the court rejected the request for a declaration of liability for future damage, as it found no sufficient probability of future damage. The data subject had not demonstrated that they had suffered fraudulent contact attempts attributable to the breach. The court also noted that a previous, unrelated data breach had already affected the same email address. As a result, it held that the data subject had already lost control over that data before the incident. Second, the court found the injunction request insufficiently specific. The wording merely repeated the abstract standard of “state-of-the-art security measures” as reflected in Article 32(1) GDPR and referred to “unauthorised third parties” without concrete specification. Third, the court held that as the controller had responded to the access request, the claim under Article 15 GDPR had been fulfilled. Furthermore, the court found no substantiated non-material damage resulting from the alleged failure to appoint an EU representative or from alleged transfers outside the European Economic Area. Finally, the court denied compensation under Article 82(1) GDPR. It stated that a mere infringement of the GDPR did not automatically give rise to compensation. A data subject had to demonstrate actual material or non-material damage suffered. Referring to Recital 146, the court emphasised that damage must have been “suffered” and could not be purely hypothetical. It also held that the data subject had not proven a causal link between the alleged GDPR infringements and any emotional distress.
Court case 4-25-326
Genetic testing company Asper Biogene (the controller) was targeted by a cyberattack from September 26 to November 10 2023. The attackers exfiltrated data for about 10,000 data subjects from 22 EU Member States, including genetic data. The DPA investigated the incident and found that the controller did not implement sufficient security measures. In particular, the controller allowed weak passwords, used weak encryption for passwords, and did not implement multi-factor authentication. The DPA found a breach of Article 32 GDPR and issued a €80,000 fine. In the same investigation, the DPA found that the controller’s DPO was the sole member of the Board of Directors and that he formally appointed himself for the role. Furthermore, he lacked the data protection expertise required for the role. The DPA fined the controller €5,000 for violating Articles 37(5) and 38(6) GDPR. The controller challenged the decision. The Court annulled the DPA's decision. With regards to the violation of Article 32, the Court held that the controller could not be sanctioned based on the procedural rules in effect at the time of the violation. Specifically, Article 14 of the Criminal Code (now repealed) only allowed companies to be prosecuted for GDPR violations that were committed by a specific individual on behalf of the company. With regards to the appointment of the DPO, the Court confirmed the violation but considered the fine to be disproportionate and annulled it. In this regard the Court considered, among other factors, that the controller had since appointed a new DPO, that the proceedings were sufficient punishment for the controller, and that there was no public interest in the proceedings. The Court also held that the infringement was minor in nature.
Social Insurance Agency
Sociálna poisťovňa, the social insurance agency (the controller), processes applications for foreign invalidity pensions and forwards related documents to the social insurance institutions of other EU Member States. A data subject applied for a Danish invalidity pension. On 22 October 2018, the controller sent the data subject's sensitive personal data (including health data, personal identification number and a Danish personal identifier) to the Danish social insurance institution by ordinary (uninsured, untracked) second-class mail rather than by registered mail. The data subject could not confirm delivery and, in November 2018, filed a request with the Slovak DPA alleging that sending sensitive data by ordinary mail, without any proof of dispatch or protection against loss, violated their data protection rights. The controller resent the documents by the same method in December 2018. The DPA's first-instance decision (13 June 2019) found that the controller had violated Article 24(1) in conjunction with Article 32(1) and (2) GDPR, because sending sensitive personal data by ordinary rather than registered mail did not ensure a level of security appropriate to the risk. The DPA ordered the controller to use registered mail for such dispatches going forward and imposed a fine of €50,000. The controller's appeal was rejected, and the Slovak DPA president upheld the first-instance decision. The controller then brought an action before the Regional Administrative Court Bratislava, arguing among other things that: the parcel had in fact been delivered (as confirmed by the Danish institution by email), registered mail offers no greater protection against loss of confidentiality than ordinary mail, only one data subject was concerned and no damage had occurred and the decision's operative part improperly referred to the data of pension applicants generally, not just the individual data subject who had filed the complaint. The court did not rule on the substance of the s
Krajowa Szkoła Sądownictwa i Prokuratury (National School of Judiciary and Public Prosecutor)
The National School of Judiciary and Public Prosecutor (also known as KSSiP, the controller) notified the DPA regarding a data breach in April 2020. The national police notified the controller of the appearance of personal data on the internet related to the controller’s website domain. The data breach involved the access to a copy of the controller’s training site database created during a test migration to a new training platform. This led to the disclosure of personal data of over 50,000 people whose data was collected on the training platform, including judges, prosecutors and law clerks. Following an investigation, the DPA fined the controller PLN 100,000 (€22,000) for failing to implement appropriate technical and organisational measures. According to the DPA, the controller had not properly taken the risks of processing into account, as it did not carry out an impact assessment on the effectiveness of the measures. Furthermore, the controller had not fulfilled several obligations as a controller. For example, the controller had not verified whether its instructions were being complied with by the company hired to carry out the database migration (the processor). In its decision, the DPA stated that the controller violated Articles 5(1)(f), Article 24(1), Article 25(1), 28(3), Article 32(1) and Article 32(2) GDPR. The DPA decided not to fine the processor, as it had complied with its obligations under the GDPR; here, the DPA stated that the data breach occurred as a result of the actions taken by the controller. The controller appealed the case to the Administrative Court, who upheld the reasoning of the DPA in August 2022. The controller later appealed the case to the Supreme Administrative Court. The controller argued that it had implemented sufficient technical and organisational measures, and that the Administrative Court had not had not fully assessed the factual circumstances of the case and had applied the GDPR erroneously by placing all of the resp
Court case I C 874/22
A data subject owned a vehicle that was involved in a road collision. The data subject’s insurer (the controller) handled the claim settlement and calculated the damages. However, the controller disclosed personal data of the data subject to the other person involved, and accidentally paid part of the compensation meant for the data subject to the other person. The data subject brought a case to the court. The data subject argued that they felt stress and concern for their security as a result of the loss of control over their personal data, and requested compensation. The controller argued that the case should be dismissed, as the data subject failed to identify the legal basis for the claimed amount and failed to indicate whether they were seeking compensation or damages from the proceedings. Furthermore, the controller argued that the data breach occurred due to a human error, and could not have been prevented. The court found a violation of Articles 24 and 32 GDPR. According to the court, the fact that an employee had mistakenly forwarded a document containing a data subject’s data was already sufficient to demonstrate that the controller had not implemented appropriate measures to ensure security of processing. In terms of damages under Article 82(1) GDPR, the fear of misuse or dissemination of their data can be sufficient. Applied to this case, the court stated that the controller caused the data subject non-material damage by transferring an unnecessary amount of data to a third person. Finally, the fact that the data breach happened as a result of a human error was irrelevant. In calculating the damages, the court considered that while the data subject’s fear was justified, the damage was also limited; this is because the data was not made public or processed further unlawfully. Therefore, the court ordered the controller to pay the data subject PLN 1,500 (approximately €350) in damages.
Court case 13R3/24t
The data subject is an individual whose personal data (name, address, date of birth) are stored in the Austrian Central Population Register. The controller is a company responsible for collecting broadcasting fees and is legally allowed to receive population-register data to identify liable fee payers. In May 2020, it became public that a hacker was offering large quantities of Austrian register data for sale. The controller issued a press release informing the public about the incident and clarifying that it was unclear whether the leaked data came from its systems. It also notified the Data Protection Authority (DSB) under Article 33 GDPR, but it did not individually notify potentially affected persons. The data subject did not know in 2020 whether he was affected. In 2023, he learned that his data had indeed appeared in the leaked dataset. To understand what data the controller was processing, he submitted an Article 15 GDPR access request on 4 March 2023. The controller warned of delays due to high workload and ultimately responded only on 24 May 2023. Believing that the controller had exceeded the legal response period, the data subject instructed a lawyer to file a complaint with the DSB. He paid the lawyer €200. He then brought a civil action claiming €200 in material damages for attorney’s fees and €200 in non-material damages arguing that he had to hire a lawyer and since DSB proceedings do not provide cost reimbursement, he considers these expenses a recoverable financial loss under Article 82 GDPR. He further claims that the defendant breached Article 34 GDPR by not notifying him of the 2020 data breach and as a result, he spent around 240 hours dealing with anger, worry, and efforts to obtain withheld information, justifying non-material harm. The first-instance civil court rejected the material-damages claim as inadmissible, holding that administrative procedure costs are normally borne by the parties. It dismissed the non-material-damages claim becaus
Municipality of Malý Lapáš
A kindergarten teacher (hereinafter, the teacher) has been working for the Municipality of Malý Lapáš (hereinafter, the municipal school) since January 2016. On 4 July 2023, the controller immediately terminated the teacher's employment on the basis of a serious breach of work discipline. The municipal school relied on two incidents. First, the teacher had allegedly left the workplace shortly before the end of her working hours without the consent of her superior. Second, she had published photographs of children from the kindergarten on her private Facebook profile. The photographs were taken during an overnight kindergarten event. The teacher published seven photographs alongside a post thanking a local pizzeria for providing sponsored pizza to the children. She maintained that she had tried to avoid showing the children's faces and that her intention was merely to thank the sponsor. The municipal school argued that the photographs constituted personal data and that the teacher was not authorised to publish them on her private Facebook account. Parents provided an informed consent at the beginning of each school year which permitted the publication of photographs through specified channels, including the municipality's website, the kindergarten's official website, EduPage and within the kindergarten premises. This consent did not cover publication on an employee's private Facebook profile. The teacher admitted that she did not have prior written consent from the children's legal representatives for publication on her private account. She considered the general informed consent sufficient and claimed that the parents had been aware of the planned publication. After the termination of her employment, she attempted to obtain additional consent from the parents. The teacher challenged the immediate termination before the Court and requested a declaration that the termination was invalid as well as compensation for lost wages. The Court upheld the teacher's claim and declared the immediate termination of her employment invalid. Regarding the photographs, the Court held that the overnight kindergarten event was connected to the teacher's employment. She therefore remained bound by her confidentiality obligations under [https://dataprotection.gov.sk/files/en/legislation-guidelines/legislation-case-law/national-legislation/2024_11_15_act_18_2018_on_personal_data_protection_and_amending_and_suplementing_certain_acts_as_amended-docx.pdf § 79 Act No. 18/2018 on Personal Data Protection]. The Court considered that, under Article 5 GDPR, the publication of the children's photographs on the teacher's private Facebook profile required prior consent from their legal representatives. The general informed consent signed by the parents did not cover publication on a private social-media account, as it was limited to specified channels used by the kindergarten. Since the teacher had published the photographs without prior parental consent, despite having received data-protection training and being bound by confidentiality obligations, the Court found that she had breached her data-protection and employment duties, including [https://www.employment.gov.sk/files/praca-zamestnanost/vztah-zamestnanca-zamestnavatela/zakonnik-prace/zakonnik-prace-anglicka-verzia-labour-code-full-wording-2012.pdf § 81(f) Labour Code]. However, the Court held that the breach was not serious enough to justify immediate termination under [https://www.employment.gov.sk/files/praca-zamestnanost/vztah-zamestnanca-zamestnavatela/zakonnik-prace/zakonnik-prace-anglicka-verzia-labour-code-full-wording-2012.pdf § 68(1)(b) Labour Code]. It considered the circumstances of the publication, the teacher's intention to thank a sponsor, her attempt to limit the children's identifiability, her previous work record, the absence of proven complaints and the lack of demonstrated damage to the municipal school. The Court also found that the municipal school had not sufficiently proven that the teacher's early departure from the workplace constituted a serious breach of work discipline. Consequently, the Court held that immediate termination was disproportionate and declared it invalid. The claim for compensation for lost wages was separated into independent proceedings. No GDPR fine or other data-protection corrective measure was imposed.
Complainant represented by Fellner Wratzfeld & Partner Rechtsanwälte GmbH (Plaintiff)
In late 2021, vaccination reminder letters were sent to uninsured persons over 18 residing in Austria who had not yet received a COVID-19 vaccine. The letters were issued in the name of various health institutions and officials, including the COVID-19 project manager and a chief physician. Numerous recipients filed complaints with the Austrian DPA, alleging unlawful access to their data stored in the central vaccination register. Following an official investigation, the DPA determined that the complainant was responsible for the data processing and had unlawfully accessed and used health data for the mailing campaign. The complainant contested this decision, arguing that it was not the data controller and that the access to vaccination data was justified under pandemic management regulations. The case was subsequently referred to the Federal Administrative Court. The Court ruled that the complainant was not the data controller within the meaning of Article 4 GDPR#7. It found that the ultimate decision-making authority regarding the purpose and means of the data processing lay with the city’s health department and the responsible city councillor, rather than the complainant. The complainant had merely executed the data processing based on political and administrative directives. The Court also held that the DPA had failed to correctly identify the data controller and had erroneously directed its decision against the complainant. Given the misleading nature of the vaccination reminder letters, which bore multiple institutional logos and signatures, the complainants could not reasonably determine the responsible party. The Court further emphasized that under Austrian procedural law, complainants are not necessarily required to specify the exact data controller when filing a complaint. As a result, the Court annulled the DPA’s decision without replacement, leaving the original complaint unresolved. The ruling clarified that the determination of the correct data contro
Defendant
Data Controller (B) had entered into contract with defendant company to ensure back-up of personal data in case of physical or technical incidents, and to establish regular testing, assessment and evaluation of the efficiency of the technical and organisational measures. Witness 2 explains, and this is uncontested, that the Data Controller was subject to a ransomware attack on 12ᵗʰ August 2020. The Data Controller’s systems were locked and they were unable to restore using back-ups. t is found in the terms of service that the defendant has assumed obligations to ensure access and availability of processed data for the Data Controller. Witness 1 has explained that they, as Executive Officer in the Data Controlling company, were unaware that they ought be in possession of an access key to the back-up. The witness for Data Controller explains that the defendant company had not established a procedure for testing, assessment and evaluation of the feasibility of using the back-up to restore access to the processed data. Irrespective of * it according to the Witness 1’s statement is found apparent, that the customer themselves create the access-key upon installation * the customer in this process is informed that they themselves are responsible for storing the access-key; which the defendant company is not in possession of * it being stated in the terms of service appendix that the customer them selves are responsible for setting up the system and software and access-key used, and it is apparent that there can be no other outcome The defendant did not take steps to ensure that the Data Controller was in possession of the access key and thus had the ability to restore access and availability of the personal data in the back-up. The defendant is found guilty of being negligent in their obligations stated in the Article 32(1) & Article 83(2), (4)(a), (9). The sanction is set as a monetary penalty of €5 ,360 (DKK 40,000). In setting the sanction the court has takien into
Datenschutzbehörde (DPA)
The controller was a political party, the data subjects were recipients of two campaign emails. On 22 November 2021, a staff member of the controller sent two emails with attached “open letters” as part of a political campaign, using an open distribution list in the “To” field instead of using blind copy (BCC). Each email exposed around 400 email addresses, including at least 100 personalised addresses showing first and last names. The controller had collected the email addresses from publicly accessible sources and relied on legitimate interest under Article 6(1)(f) GDPR for the processing, instead of asking for consent. On 4 December 2021, the controller notified the DPA of the personal data breach. On 22 April 2022, in separate supervisory proceedings, the DPA found that the controller had unlawfully disclosed political opinions through the open distribution list. Subsequently, it initiated administrative fine proceedings. On 14 December 2023, the DPA imposed a fine of €50,700 under Article 83(5)(a) GDPR for infringements of Article 5(1)(a) and (c) GDPR and Article 9(1) GDPR. The controller appealed to the court. It argued that the email addresses did not reveal political opinions, that [https://www.jusline.at/gesetz/dsg/paragraf/artikel2zu30 § 30 DSG] required attribution to a natural person in a leadership position, and that the fine was disproportionate. The court partly upheld the appeal and amended part of the decision. First, the court held that the combination of the personalised email addresses and the political content attributed a political opinion to at least part of the recipients. By making the distribution list visible to all recipients, the controller disclosed special categories of personal data within the meaning of Article 9(1) GDPR and no exception under Article 9(2) GDPR applied. Legitimate interests under Article 6(1)(f) GDPR can not justify the processing of special categories of data. Second, the court confirmed a violation of Article 5
Norwegian System of Patient Injury Compensation
A data subject requested access to her data processed by the board within the [https://www.npe.no/no/ Norwegian System of Patient Injury Compensation] (Norsk pasienterstatning), a controller. The data subject was a party to proceedings before the controller and her request covered the documents of the case, including the logs data. The data subject stood on the position that the controller’s employees didn’t check the documents in depth, while examining her case. For this reason, the data subject wanted to verify who and when accessed her documents. The controller partially answered the access request. The data subject didn’t receive the information she asked for, in particular whether printouts of the documents were done, or the documents were sent by e-mail or copied and stored elsewhere. The data subject complained with the Norwegian DPA (Datatilsynet) and notified the Ministry of Public health. The data subject claimed that the controller violated Article 32 GDPR, because they didn’t secure the data properly as there was no logs control in place. Moreover, lack of access to log data deprived the data subject from scrutinising the controller’s conduct with their case. Additionally, the data subject filed an access request with the [https://www.helseklage.no National Appeals Body for the Health Service] (Nasjonalt klageorgan for helsetjenesten), which was the body competent to deal with appeals and/or complaints against the controller's decisions. The appeal body answered the request and provided the data subject with the dates and purposes of access to the data subject’s documents. Nevertheless, in reference to the Ministry of Public health letter, the appeal body didn’t disclosed the identity of employees who accessed the documents. The DPA issued a decision, stating that access request was answered. Moreover, alleged violation of Article 32 GDPR were not found. Thus, the DPA closed the case. The data subject lodged an appeal with the Privacy Appeals Board (Personvernnemnda), sustaining her previous arguments. Also, the data subject pointed out that the DPA violated Article 57(1)(f) GDPR by refusing to examine the case. The Privacy Appeals Board dismissed the appeal. Firstly, the controller didn’t violate Article 32 GDPR. A log control was implemented. Furthermore, the Privacy Appeals Board had no doubts that the members of the controller’s board, who examined the case, had lawful access to the documents. Secondly, the data subject’s complaint didn’t provide the DPA with sufficient grounds to examine compliance with Article 32 GDPR. The data subject asked the DPA only for additional investigation whether or not the security of data was good enough under the GDPR. According to the Privacy Appeals Board, such a claim didn’t oblige the DPA to further investigate the case. Hence, the DPA didn’t violate Article 57(1)(f) GDPR. Thirdly, the data subject received the answer to the access request. All the information disclosed by the controller and the the National Appeals Body for the Health Service satisfied the purposes indicated by the data subject in the request. Then, there was no reason to provide the data subject with the identity of the controller employees who accessed the data. The Privacy Appeals Board explained that in principle employees’ identity under the CJEU Pankki case was not covered by the Article 15 GDPR.
STAAT DER NEDERLANDEN (Ministerie van Volksgezondheid, Welzijn en Sport),
Before the COVID-19 pandemic: The State and others were already aware that the IT systems of the GGD were outdated and would not be suitable for handling a large epidemic or pandemic. Nevertheless, no adequate measures were taken to improve the systems. March 2020: The GGD systems, HPZone, and later CoronIT, are used to combat the COVID-19 pandemic. April 2020: The European Data Protection Board (EDPB) emphasizes the importance of data protection in combating the coronavirus. January 22, 2021: GGD GHOR Nederland reports a data breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP). This is referred to in the media as the "corona data leak." January 28, 2021: GGD GHOR publishes a page with "Frequently Asked Questions and Answers about Data Theft" on their website. At this time, there is still much uncertainty about the extent of the data leak. February 2021: Following media reports about the theft and trade of personal data from GGD systems, the AP announces that it will intensify its supervision of the GGD. KPMG advises GGD GHOR to stop using HPZone as soon as possible due to inadequate data protection. The AP investigates the security of websites linked to DigiD, including www.coronatest.nl. April 2021 to January 2022: The AP investigates whether GGD GHOR and two local GGDs have taken appropriate technical and organizational measures to protect personal data in the context of testing, vaccinating, and contact tracing. The AP acknowledges that the GGDs faced a huge challenge due to the pandemic, but emphasizes that good data security is essential, especially given the large amount of sensitive data the GGD processes. The AP shares its findings with GGD GHOR and gives them until March 1, 2022, to implement improvements. November 25, 2021: Stichting ICAM is founded with the aim of taking action against (threatened) privacy violations of citizens, including claiming compensation after data breaches. April 25, 2022: GGD GHOR sends letters to 1,2
Employee
On 01 September 1999, the data subject started working for the controller, a medical service responsible for providing health assessments for health insurers. Starting on 22 November 2017, the data subject became unable to work due to illness. Their health insurer ordered an assessment of the data subject's disability on 06 June 2018 due to doubts about their inability to work. This assessment was to be done by the controller, who also happened to be the employer of the data subject. The controller had specific rules in form of a "special case" unit of 36 people in place for this occurrence to prevent preferential treatment or discrimination for its employees. A developed role concept within this unit ensured that the relevant expert assessments were not processed by employees who worked with the person concerned in a department, which was also technically secured with separate storing of key and file. Merging was only possible using a key stored in an encryption library. An employee the data subject was familiar with produced the required assessment report for the controller and the health insurer in cooperation with the data subject's doctor via a phone call. On 01 August 2018, the data subject requested a coworker to check whether an assessment report about them was available in the database and to send a picture of it. The coworker complied. On 15 August 2018, the data subject requested compensation of €20,000 from the controller outside of court, but they denied the claim. The data subject also sought material damages in the second instance by way of a payment and declaratory action, each based on Article 82(1) of the GDPR and § 823(1) of the German Civil Code (BGB) in conjunction with Article 2(1) and Article 1(1) of the Constitutional Law (GG). The controller then expressed an immediate termination on 05 December 2019 and 12 December 2019 respectively. The data subject alleged the controller violated their right to privacy based on Article 82(1) GDPR, saying