GDPR Art. 6 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this article. Contains: the article text, related recitals, cases citing it, enforcement stats and top fines, guidance, and related topics. Everything links back to its source on overview.legal — legal information, not advice.

Lawfulness of processing

Personal Data Controllers Lawful Basis Fairness & Transparency Consent GDPR Article 5 Principles of Processing Legitimate Interest Special Categories of Data
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679
  1. 1.

    Processing shall be lawful only if and to the extent that at least one of the following applies:

    Lawful Basis 512
    1. a)
      the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
      Consent Personal Data
    2. b)
      processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
      Personal Data
    3. c)
      processing is necessary for compliance with a legal obligation to which the controller is subject;
      Controllers
    4. d)
      processing is necessary in order to protect the vital interests of the data subject or of another natural person;
      Personal Data Lawful Basis
    5. e)
      processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
      Controllers
    6. f)
      processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
      Lawful Basis Legitimate Interest Personal Data
    7. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
  2. 2.

    Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.

    Fairness & Transparency 97
  3. 3.

    The basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:

    GDPR Article 5 Principles of Processing Personal Data Controllers 123
    1. a)
      Union law; or
    2. b)
      Member State law to which the controller is subject.
      Controllers
    3. The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.
      Personal Data GDPR Article 5 Principles of Processing Fairness & Transparency
  4. 4.

    Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:

    Personal Data Consent Controllers 58
    1. a)
      any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;
      Personal Data
    2. b)
      the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;
      Controllers Personal Data
    3. c)
      the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;
      Personal Data Special Categories of Data Criminal Data
    4. d)
      the possible consequences of the intended further processing for data subjects;
    5. e)
      the existence of appropriate safeguards, which may include encryption or pseudonymisation.
      Security Encryption Anonymization

Enforcement

Cited in 1,220 fines totalling €3.0B

Top authority: 🇪🇺Spanish Data Protection Authority (aepd) (358) · median fine €10,000 · see all enforcement for Art. 6 →

Connections by provision

6(1) 453 Case Law 49 Guidance 5 Literature 5 News .md
Case Law 453
Judgment of the Court (Grand Chamber) of 30 April 2024.#Criminal proceedings against M.N.#Request for a preliminary ruling from the Landgericht Berlin.#Reference for a preliminary ruling – Judicial cooperation in criminal matters – Directive 2014/41/EU – European Investigation Order (EIO) in criminal matters – Obtaining of evidence already in the possession of the competent authorities of the executing State – Conditions for issuing an EIO – Encrypted telecommunications service – EncroChat – Nee Judgment of the Court (Grand Chamber) of 5 June 2023.#European Commission v Republic of Poland.#Failure of a Member State to fulfil obligations – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union ‐ Rule of law – Effective legal protection in the fields covered by EU law – Independence of judges – Article 267 TFEU – Possibility of making a reference to the Court for a preliminary ruling – Primacy of EU law – Jurisdiction in relation t Judgment of the Court (Grand Chamber) of 2 December 2025.#X v Russmedia Digital SRL and Inform Media Press SRL.#Request for a preliminary ruling from the Curtea de Apel Cluj.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) – Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers Judgment of the General Court (Eighth Chamber, Extended Composition) of 27 April 2022.#Robert Roos and Others v European Parliament.#Public health – Requirement to present a valid EU digital COVID-19 certificate to access the Parliament’s buildings – Legal basis – Freedom and independence of Members of the European Parliament – Obligation to ensure the health of staff in the service of the European Union – Parliamentary immunity – Processing of personal data – Right to respect for private life – Judgment of the General Court (Seventh Chamber, Extended Composition) of 19 November 2025.#Amazon EU Sàrl, venant aux droits de Amazon Services Europe Sàrl v European Commission.#Digital services – Regulation (EU) 2022/2065 – Designation as a very large online platform – Plea of illegality – Admissibility – Article 33(1) and (4) of Regulation 2022/2065 – Right to respect for private and family life – Freedom to conduct a business – Right to property – Equal treatment – Freedom of expression – Da Judgment of the Court (First Chamber) of 13 November 2025.#Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).#Request for a preliminary ruling from the Curtea de Apel Bucureşti.#Reference for a preliminary ruling – Processing of personal data and the protection of privacy in the electronic communications sector – Directive 2002/58/EC – Article 13(1) and (2) – Unsolicited communications – Concept of communication ‘for the purposes of di Judgment of the Court (Grand Chamber) of 5 April 2022.#G.D. v The Commissioner of the Garda Síochána and Others.#Request for a preliminary ruling from the Supreme Court.#Reference for a preliminary ruling – Processing of personal data in the electronic communications sector – Confidentiality of the communications – Providers of electronic communications services – General and indiscriminate retention of traffic and location data – Access to data – Subsequent court supervision – Directive 2002/58 +445 more
Guidance 49
EDPB Work Programme 2019-2020 Guidelines 05/2020 on consent under Regulation 2016/679 Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 Guidelines 04/2022 on the calculation of administrative fines under the GDPR Guidelines 8/2020 on the targeting of social media users +41 more
Literature 5
Pay or Consent Models in Europe: Already Outdated or an Overlooked Crisis in Freely Given Consent? Generative AI and data protection Criminal Offence and Health Condition Information as Special Categories of Data, and the Legal Aspects of Processing in Labor Relations under GDPR and Georgian Law If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Privacy vs. business convenience: the Mousse judgment and the future of data protection in the EU
News 5
Record fine for Instagram following EDPB intervention EU Court: Irish DPC must investigate noyb complaint Facebook's GDPR bypass reaches Austrian Supreme Court Like to play alone? Ubisoft is still watching you! SO Warszawa - Case C 310/23
6(1)(a) 68 Case Law 33 Guidance 3 Literature 2 News .md
Case Law 68
Judgment of the Court (First Chamber) of 20 October 2022.#Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság.#Request for a preliminary ruling from the Fővárosi Törvényszék.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(b) and (e) – Principle of ‘purpose limitation’ – Principle of ‘storage limitation’ – Creation, from an existing database, of a datab LG Rostock - 3 O 762/19 BVwG - W 108 2284491-1 BGH - I ZR 7/16 Rotterdam Court: DPA did not err in finding ING contactless chip payments GDPR-compliant Judgment of the Court (Fourth Chamber) of 16 December 2021.#Criminal proceedings against HP.#Request for a preliminary ruling from the Spetsializiran nakazatelen sad.#Reference for a preliminary ruling – Judicial cooperation in criminal matters – European Investigation Order (EIO) – Directive 2014/41/EU – Article 2(c)(i) – Concept of ‘issuing authority’ – Article 6 – Conditions for issuing an EIO – Article 9(1) and (3) – Recognition of an EIO – EIO seeking to obtain traffic and location data ass Personvernnemnda (Norway) - 2018-14 (15/01355) BVwG - W256 2227693-1 +60 more
Guidance 33
Guidelines 05/2020 on consent under Regulation 2016/679 Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation Guidelines 02/2024 on Article 48 GDPR EDPB Document on response to the request from the European Commission for clarifications on the consistent application of the GDPR, focusing on health research EDPB Annual Report 2023 Opinion 3/2025 on the draft decision of the French Supervisory Authority (FR SA) regarding the “Lexing GDPR certification criteria” Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms +25 more
Literature 3
Generative AI and data protection If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Can the GPC standard eliminate consent banners in the EU?
News 2
Vienna Superior Court: Facebook must give access to data noyb survey: only 7% of users want Meta to use their personal data for AI
6(1)(b) 50 Case Law 40 Guidance 4 Literature 3 News .md
Case Law 50
Peter Puškár v Finančné riaditeľstvo Slovenskej republiky and Kriminálny úrad finančnej správy Meta Platforms v noyb Rotterdam Court: DPA did not err in finding ING contactless chip payments GDPR-compliant BVwG - W256 2227693-1 Judgment of the Court (Fourth Chamber) of 4 October 2024.#Maximilian Schrems v Meta Platforms Ireland Limited.#Request for a preliminary ruling from the Oberster Gerichtshof.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Online social networks – General terms of use relating to contracts concluded between a digital platform and a user – Personalised advertising – Article 5(1)(b) – Principle of purpos Judgment of the Court (Fourth Chamber) of 12 September 2024.#HTB Neunte Immobilien Portfolio geschlossene Investment UG & Co. KG and Ökorenta Neue Energien Ökostabil IV geschlossene Investment GmbH & Co. KG v Müller Rechtsanwaltsgesellschaft mbH and Others.#Requests for a preliminary ruling from the Amtsgericht München.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Points (b), (c) and (f) of the firs Judgment of the Court (Grand Chamber) of 30 April 2024.#Criminal proceedings against M.N.#Request for a preliminary ruling from the Landgericht Berlin.#Reference for a preliminary ruling – Judicial cooperation in criminal matters – Directive 2014/41/EU – European Investigation Order (EIO) in criminal matters – Obtaining of evidence already in the possession of the competent authorities of the executing State – Conditions for issuing an EIO – Encrypted telecommunications service – EncroChat – Nee Judgment of the Court (First Chamber) of 20 October 2022.#Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság.#Request for a preliminary ruling from the Fővárosi Törvényszék.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(b) and (e) – Principle of ‘purpose limitation’ – Principle of ‘storage limitation’ – Creation, from an existing database, of a datab +42 more
Guidance 40
Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects Contribution of the EDPB to the evaluation of the GDPR under Article 97 Guidelines 05/2020 on consent under Regulation 2016/679 EDPB Annual Report 2019 Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidelines 01/2020 on processing personal data in the context of connected vehicles and mobility related applications Statement 03/2021 on the ePrivacy Regulation +32 more
Literature 4
Can the GPC standard eliminate consent banners in the EU? Privacy vs. business convenience: the Mousse judgment and the future of data protection in the EU If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Pay or Consent Models in Europe: Already Outdated or an Overlooked Crisis in Freely Given Consent?
News 3
Vienna Superior Court: Facebook must give access to data Record fine for Instagram following EDPB intervention Facebook: We don’t need your consent!
6(1)(c) 72 Case Law 24 Guidance 2 Literature .md
Case Law 72
Judgment of the Court (First Chamber) of 3 April 2025.#L. H. v Ministerstvo zdravotnictví.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4 – Definitions – Article 6 – Lawfulness of processing – Article 86 – Public access to official documents – Data concerning the representative of a legal person – Case-law of a national court imposing an obligation to inform and consult the data subject prio Order of the Vice-President of the Court of 27 October 2021.#European Commission v Republic of Poland.#Interim relief – Article 279 TFEU – Application for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Disciplinary regime for judges – Examination of questions of law concerning the lack of independence of judges – Periodic penalty payment.#Case C-204/21 R NSA - III OSK 5037/21 Judgment of the Court (Grand Chamber) of 1 August 2022.#OT v Vyriausioji tarnybinės etikos komisija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 52(1) – Directive 95/46/EC – Article 7(c) – Article 8(1) – Regulation (EU) 2016/679 – Point (c) of the first subparagraph of Judgment of the General Court (Fifth Chamber, Extended Composition) of 24 May 2023.#Meta Platforms Ireland Ltd, formerly Facebook Ireland Ltd v European Commission.#Competition – Data market – Administrative procedure – Article 18(3) and Article 24(1)(d) of Regulation (EC) No 1/2003 – Request for information – Virtual data room – Obligation to state reasons – Legal certainty – Rights of the defence – Necessity of the information requested – Misuse of powers – Right to privacy – Proportionality – Judgment of the Court (Eighth Chamber) of 27 February 2025.#Amt der Tiroler Landesregierung v Datenschutzbehörde.#Request for a preliminary ruling from the Verwaltungsgerichtshof.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Direct designation of the controller by national law – Auxiliary administrative entity in the service of a regional government – Lack of Judgment of the Court (Third Chamber) of 9 November 2023.#Gesamtverband Autoteile-Handel e.V. v Scania CV AB.#Request for a preliminary ruling from the Landgericht Köln.#Reference for a preliminary ruling – Market for motor vehicle repair and maintenance information services – Regulation (EU) 2018/858 – Approval and market surveillance of repair and maintenance information services for motor vehicles and their trailers, and of systems, components and separate technical units intended for such ve Tax data sharing from FIOD criminal probe to Tax Authority not GDPR erasure violation +64 more
Guidance 24
Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT Statement 03/2021 on the ePrivacy Regulation EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro Guidelines 02/2024 on Article 48 GDPR EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT Statement 1/2025 on Age Assurance Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications +16 more
Literature 2
Generative AI and data protection Can the GPC standard eliminate consent banners in the EU?
6(1)(d) 11 Case Law 4 Guidance 1 Literature .md
Case Law 11
Peter Nowak v Data Protection Commissioner GOOGLE SPAIN SL V. AEPD (THE DPA) & MARIO COSTEJA GONZALEZ, 13.May.2014 (“GOOGLE v. Spain”) LG Rostock - 3 O 762/19 PHR - 22/01253 VwGH - Ro 2022/04/0026 OLG München - 36 U 1054/25 e VG Stuttgart - 1 K 12737/25 ¶70 GOOGLE SPAIN SL V. AEPD (THE DPA) & MARIO COSTEJA GONZALEZ, 13.May.2014 (“GOOGLE v. Spain”) +3 more
Guidance 4
Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms Statement 03/2021 on the ePrivacy Regulation Guidelines 02/2024 on Article 48 GDPR Guidelines 02/2024 on Article 48 GDPR
Literature 1
Can the GPC standard eliminate consent banners in the EU?
6(1)(e) 52 Case Law 14 Guidance 1 Literature .md
Case Law 52
Supreme Court upholds €300,000 fine against INPS for GDPR violations in COVID bonus data Judgment of the Court (Sixth Chamber) of 7 March 2024.#Endemol Shine Finland Oy.#Request for a preliminary ruling from the Itä-Suomen hovioikeus.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 2, 4, 6, 10 and 86 – Data held by a court relating to the criminal convictions of a natural person – Oral disclosure of such data to a commercial company on account of a competition organised by that company – Concept of ‘processing of personal data’ Tax data sharing from FIOD criminal probe to Tax Authority not GDPR erasure violation Judgment of the Court (First Chamber) of 4 October 2024.#Agentsia po vpisvaniyata v OL.#Request for a preliminary ruling from the Varhoven administrativen sad.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Publication in the commercial register of a company’s constitutive instrument containing personal data – Directive (EU) 2017/1132 – Non-compulsory personal data – Lack of consent of the data subjec Judgment of the Court (First Chamber) of 3 April 2025.#L. H. v Ministerstvo zdravotnictví.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4 – Definitions – Article 6 – Lawfulness of processing – Article 86 – Public access to official documents – Data concerning the representative of a legal person – Case-law of a national court imposing an obligation to inform and consult the data subject prio Judgment of the Court (Third Chamber) of 28 November 2024.#Nemzeti Adatvédelmi és Információszabadság Hatóság v UC.#Request for a preliminary ruling from the Kúria.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data and the free movement of such data – Regulation (EU) 2016/679 – Data processed when drawing up a COVID-19 certificate – Data not collected from the data subject – Information to be provided – Exception to the obligation t LG Rostock - 3 O 762/19 Peter Nowak v Data Protection Commissioner +44 more
Guidance 14
Guidelines 02/2024 on Article 48 GDPR Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s) EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro EDPB Annual Report 2023 Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) Opinion 15/2025 on the draft decision of the Austrian Supervisory Authority (AT SA) regarding the certification criteria of BDO Consulting GmbH Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms Guidelines 05/2020 on consent under Regulation 2016/679 +6 more
Literature 1
Can the GPC standard eliminate consent banners in the EU?
6(1)(f) 40 Case Law 18 Guidance 4 Literature 3 News .md
Case Law 40
LG Rostock - 3 O 762/19 German Supreme Court: No GDPR basis for debt transmission to credit agency; €500 damages BVwG - W256 2227693-1 Norges Høyesterett - 2021-2403-A Personvernnemnda (Norway) - 2018-14 (15/01355) Judgment of the Court (Fifth Chamber) of 8 December 2022.#VS v Inspektor v Inspektorata kam Visshia sadeben savet.#Request for a preliminary ruling from the Administrativen sad - Blagoevgrad.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Articles 2, 4 and 6 – Applicability of Regulation 2016/679 – Concept of ‘legitimate interest’ – Concept of ‘task carried out in the public interest or in the exercis USR - Us I-755/2025-8 Judgment of the Court (First Chamber) of 7 December 2023.#OQ v Land Hessen.#Request for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 22 – Automated individual decision-making – Credit information agencies – Automated establishment of a probability value concerning the ability of a person to meet payment commitments in the future (‘s +32 more
Guidance 18
Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models Guidelines 02/2024 on Article 48 GDPR Report of the work undertaken by the ChatGPT Taskforce Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms Guidelines 8/2020 on the targeting of social media users Guidelines 3/2019 on processing of personal data through video devices Guidelines 02/2024 on Article 48 GDPR +10 more
Literature 4
Generative AI and data protection Privacy vs. business convenience: the Mousse judgment and the future of data protection in the EU Can the GPC standard eliminate consent banners in the EU? If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation
News 3
BGH - I ZR 97/25 (This appears to be a legal citation and doesn't require translation.) USR - Reference number I-755/2025-8 Record fine for Instagram following EDPB intervention
6(2) 86 Case Law 10 Guidance 1 News .md
Case Law 86
Judgment of the Court (Third Chamber), 22 November 2012.#Josef Probst v mr.nexnet GmbH.#Reference for a preliminary ruling from the Bundesgerichtshof.#Electronic communications — Directive 2002/58/EC — Article 6(2) and (5) — Processing of personal data — Traffic data necessary for billing and debt collection — Debt collection by a third company — Persons acting under the authority of the providers of public communications networks and electronic communications services.#Case C‑119/12. CJEU - C-247/23 - Deldits Judgment of the Court (Third Chamber) of 28 July 2016.#Verein für Konsumenteninformation v Amazon EU Sàrl.#Request for a preliminary ruling from the Oberster Gerichtshof.#Reference for a preliminary ruling — Judicial cooperation in civil matters — Regulations (EC) No 864/2007 and (EC) No 593/2008 — Consumer protection — Directive 93/13/EEC — Data protection — Directive 95/46/EC — Online sales contracts concluded with consumers resident in other Member States — Unfair terms — General terms and co Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment Judgment of the Court (Grand Chamber) of 6 October 2020.#État luxembourgeois v B and Others.#Requests for a preliminary ruling from the Cour administrative (Luxembourg).#References for a preliminary ruling – Directive 2011/16/EU – Administrative cooperation in the field of taxation – Articles 1 and 5 – Decision ordering that information be provided to the competent authority of a Member State, acting in response to a request for exchange of information from the competent authority of another Mem Judgment of the Court (Fifth Chamber) of 17 June 2021.#Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA.#Request for a preliminary ruling from the Ondernemingsrechtbank Antwerpen.#Reference for a preliminary ruling – Intellectual property – Copyright and related rights – Directive 2001/29/EC – Article 3(1) and (2) – Concept of ‘making available to the public’ – Downloading of a file containing a protected work via a peer-to-peer network and the simultaneous Judgment of the Court (Eighth Chamber) of 5 October 2023.#RK v Ministerstvo zdravotnictví.#Request for a preliminary ruling from the Nejvyšší správní soud.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4(2) – Concept of ‘processing’ of personal data – Mobile application – Verification of the validity of ‘EU Digital COVID Certificates’ issued pursuant to Regulation (EU) 2021/953.#Case C-659/22 BGH: Court must grant unredacted file access in compulsory auctions under Art. 6(1)(e) +78 more
Guidance 10
EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Statement 2/2025 on the implementation of the PNR Directive in light of CJEU Judgment C-817/19 Template for Cross-Regulatory Cooperation Agreements EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) ¶54 EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) +2 more
News 1
What Happened to the Risk-Based Approach to Data Transfers?
6(3) 109 Case Law 14 Guidance .md
Case Law 109
Order of the Vice-President of the Court of 21 April 2023.#European Commission v Republic of Poland.#Interim relief – Article 163 of the Rules of Procedure of the Court of Justice – Application to cancel or vary an order for interim measures – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union – Effective judicial protection – Independence of judges – Non-execution – Change in circumstances – Periodic penalty payment.#Case C-204/21 R- Judgment of the General Court (First Chamber, Extended Composition) of 10 September 2025.#Meta Platforms Ireland Ltd v European Commission.#Digital services – Regulation (EU) 2022/2065 – Commission decision determining the amount of the supervisory fee for 2023 – Article 43(3) to (5) of Regulation 2022/2065 – Article 4(2) of Delegated Regulation (EU) 2023/1127 – Method for calculating the number of average monthly active recipients – Temporal adjustment of the effects of an annulment.#Case T-55/ Judgment of the Court (Grand Chamber) of 5 June 2023.#European Commission v Republic of Poland.#Failure of a Member State to fulfil obligations – Second subparagraph of Article 19(1) TEU – Article 47 of the Charter of Fundamental Rights of the European Union ‐ Rule of law – Effective legal protection in the fields covered by EU law – Independence of judges – Article 267 TFEU – Possibility of making a reference to the Court for a preliminary ruling – Primacy of EU law – Jurisdiction in relation t Judgment of the Court (Third Chamber) of 9 November 2023.#Gesamtverband Autoteile-Handel e.V. v Scania CV AB.#Request for a preliminary ruling from the Landgericht Köln.#Reference for a preliminary ruling – Market for motor vehicle repair and maintenance information services – Regulation (EU) 2018/858 – Approval and market surveillance of repair and maintenance information services for motor vehicles and their trailers, and of systems, components and separate technical units intended for such ve Judgment of the Court (First Chamber) of 7 September 2023.#A. G. v Lietuvos Respublikos generalinė prokuratūra.#Request for a preliminary ruling from the Lietuvos vyriausiasis administracinis teismas.#Reference for a preliminary ruling – Telecommunications – Processing of personal data in the electronic communications sector – Directive 2002/58/EC – Scope – Article 15(1) – Data retained by providers of electronic communications services and made available to authorities in charge of criminal pro Judgment of the General Court (First Chamber, Extended Composition) of 10 September 2025.#Tiktok Technology Ltd v European Commission.#Digital services – Regulation (EU) 2022/2065 – Commission decision determining the amount of the supervisory fee for 2023 – Article 43(3) to (5) of Regulation 2022/2065 – Article 4(2) of Delegated Regulation (EU) 2023/1127 – Method for calculating the number of average monthly active recipients – Temporal adjustment of the effects of an annulment.#Case T-58/24. BGH: Court must grant unredacted file access in compulsory auctions under Art. 6(1)(e) NSA - III OSK 5037/21 +101 more
Guidance 14
EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT Guidelines 02/2024 on Article 48 GDPR Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s) Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation Recommendations 02/2020 on the European Essential Guarantees for surveillance measures Statement 1/2025 on Age Assurance Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) +6 more
6(3)(a) 11 Case Law .md
Case Law 11
Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers ¶184 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers ¶104 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers ¶106 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers ¶182 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers ¶183 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers ¶185 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers ¶186 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers +3 more
6(3)(b) 9 Case Law .md
Case Law 9
Supreme Court upholds €300,000 fine against INPS for GDPR violations in COVID bonus data BGH: Court must grant unredacted file access in compulsory auctions under Art. 6(1)(e) Judgment of the Court (Third Chamber) of 2 March 2023.#Norra Stockholm Bygg AB v Per Nycander AB.#Request for a preliminary ruling from the Högsta domstolen.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 6(3) and (4) – Lawfulness of processing – Production of a document containing personal data in civil court proceedings – Article 23(1)(f) and (j) – Protection of judicial independence and judicial proceedings – Enforcement of civil law clai Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers ¶194 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers ¶193 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers ¶189 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers ¶105 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers +1 more
6(4) 24 Case Law 33 Guidance 1 Literature .md
Case Law 24
BVwG - W258 2227269-1/39E VwGH - VwGH Ro 2025/04/0007-7 Judgment of the Court (Third Chamber) of 2 March 2023.#Norra Stockholm Bygg AB v Per Nycander AB.#Request for a preliminary ruling from the Högsta domstolen.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 6(3) and (4) – Lawfulness of processing – Production of a document containing personal data in civil court proceedings – Article 23(1)(f) and (j) – Protection of judicial independence and judicial proceedings – Enforcement of civil law clai Judgment of the Court (First Chamber) of 20 October 2022.#Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság.#Request for a preliminary ruling from the Fővárosi Törvényszék.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(b) and (e) – Principle of ‘purpose limitation’ – Principle of ‘storage limitation’ – Creation, from an existing database, of a datab Tax data sharing from FIOD criminal probe to Tax Authority not GDPR erasure violation BVwG - W256 2227693-1 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment +16 more
Guidance 33
Opinion 1/2022 on the draft decision of the Luxembourg Supervisory Authority regarding the GDPR – CARPA certification criteria EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) EDPB Annual Report 2021 Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications Report of the work undertaken by the ChatGPT Taskforce Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR Recommendations 1/2025 on the 2027 WADA World Anti-Doping Code +25 more
Literature 1
Generative AI and data protection
6(4)(d) 1 Case Law .md
Case Law 1
GHARL - 200.256.426