Content type · 50 cases · 1 courts

Case Law

Court decisions and jurisprudence from EU and national courts

Court: CJEU (50) Clear filter
CJEU 189
Data Protection Commissioner v. Schrems and Facebook Schrems I Social Media Privacy Shield Oct 6, 2015
WELTIMMO S.R.O. V. NEMZETI A DATVEDELMI ES INFORMACIOSZABADSAGH ATOSAG (HUNGARIAN DPA), 1.10.15 (“WELTIMMO”) Definition of processing: The operation of loading personal data on an internet page constitutes processing. (¶37) Personal Data Lawful Basis Oct 1, 2015
SMARANDA BARA ET AL. V. PRESEDINTELE CASEI NATIONALE DE ASIGURARI DE SANATATE (CNAS) ET AL., 1.10.2015 (“BARA”) Processing: Both the transfer of the data by ANAF, and the subsequent processing by CNAS, constitute processing of personal data. (¶ 29) Personal Data Lawful Basis Oct 1, 2015
SMARANDA BARA ET AL. V. PRESEDINTELE CASEI NATIONALE DE ASIGURARI DE SANATATE (CNAS) ET AL., 1.10.2015 (“BARA”) Principle of fairness and lawfulness: The requirement of fair processing laid down in Article 6 of Directive 95/46 requires a public administrative body to inform the data
 Personal Data Criminal Data Oct 1, 2015
SMARANDA BARA ET AL. V. PRESEDINTELE CASEI NATIONALE DE ASIGURARI DE SANATATE (CNAS) ET AL., 1.10.2015 (“BARA”) Personal data: Tax data transferred are personal data, since they are “information relating to an identified or identifiable natural person.” (¶ 29) Personal Data Data Portability Oct 1, 2015
WELTIMMO S.R.O. V. NEMZETI A DATVEDELMI ES INFORMACIOSZABADSAGH ATOSAG (HUNGARIAN DPA), 1.10.15 (“WELTIMMO”) Establishment: The concept of establishment must be interpreted broadly. The legal form of such establishment (e.g. branch, subsidiary etc) is not the determining factor. The
 Controllers Representatives Oct 1, 2015
SMARANDA BARA ET AL. V. PRESEDINTELE CASEI NATIONALE DE ASIGURARI DE SANATATE (CNAS) ET AL., 1.10.2015 (“BARA”) Right to be informed: National law that does not require the specific transfer involved in the case cannot constitute “prior information” under Article 10 of Directive 95/46
 Processing Criminal Data Oct 1, 2015
WELTIMMO S.R.O. V. NEMZETI A DATVEDELMI ES INFORMACIOSZABADSAGH ATOSAG (HUNGARIAN DPA), 1.10.15 (“WELTIMMO”) Data protection authorities powers and cooperation: In the event that the Hungarian DPA should consider that Weltimmo has an establishment not in Hungary, but in another Member
 Supervisory Authorities Supervision Oct 1, 2015
CLIENT EARTH ET AL. V. EFSA, 16.7.2015 (“CLIENT EARTH”) Personal data: The information as to which expert is the author of each comment made by the external experts constitutes personal data even where the information is provided as
 Personal Data Right to Object Jul 16, 2015
CLIENT EARTH ET AL. V. EFSA, 16.7.2015 (“CLIENT EARTH”) Necessity/proportionality: No automatic priority can be conferred on the objective of transparency over the right to protection of personal data.Where obtaining the information
 Personal Data Fairness & Transparency Jul 16, 2015
DENNEKAMP V. EUROPEAN PARLIAMENT (15.7.2015) (“DENNEKAMP II”) Data transfers: Articles 7–9 of Regulation 45/2001 precisely limit the possibility of transferring personal data so as to make it subject to strict conditions which, if not
 Personal Data Consent Jul 15, 2015
DENNEKAMP V. EUROPEAN PARLIAMENT (15.7.2015) (“DENNEKAMP II”) Necessity: An applicant for access to documents containing personal data must establish necessity (i.e. the transfer must be the most appropriate of the possible measures and it
 Minors Legitimate Interest Jul 15, 2015
McCULLOUGH V. CEDEFOP (11.6.2015) (“McCULLOUGH”) Personal data: Personal does not mean private. Surnames in minutes are personal data even where (i) the minutes refer to meetings in connection with the exercise of their public
 Personal Data IP Address Jun 11, 2015
RYNES V. ÚƘAD PRO OCHRANU OSOBNICH ÚDAJĆź, 11.12.2014 (“RYNES”) Personal data: The image of a person recorded by a camera constitutes personal data because it makes it possible to identify the person concerned. (¶ 22) Identification Material scope (GDPR) Dec 11, 2014
RYNES V. ÚƘAD PRO OCHRANU OSOBNICH ÚDAJƼ, 11.12.2014 (“RYNES”) Household exception: The household exception must be interpreted narrowly. Video surveillance that covers, even partially, a public space cannot be regarded as a purely personal
 Consent Video Surveillance Dec 11, 2014
RYNES V. ÚƘAD PRO OCHRANU OSOBNICH ÚDAJƼ, 11.12.2014 (“RYNES”) Legitimate interest: Arts. 7(f), 11(2) and 13(1)(d) and (g) make it possible to take into account the legitimate interests of the controller in protecting the property, health and
 Legitimate Interest Lawful Basis Dec 11, 2014
MINISTER VOOR IMMIGRATIE V. M, 17.7.2014 (“Minister v. M”) Personal data: The data relating to the applicant for a residence permit included in the minute (applicant’s name, DOB, nationality, gender, ethnicity, religion and language)
 Religious Beliefs Personal Data Jul 17, 2014
MINISTER VOOR IMMIGRATIE V. M, 17.7.2014 (“Minister v. M”) Right to access: The right of access is a per-requisite to obtain rectification, erasure or blocking of personal data (¶¶ 44-46). To comply with the right of access it is
 Personal Data Right of Access Procedures Jul 17, 2014
C-131/12 Google Spain SL and Google Inc. v AEPD and Mario Costeja GonzĂĄlez C-131/12 (Google Spain) Minors Controllers May 13, 2014
GOOGLE SPAIN SL V. AEPD (THE DPA) & MARIO COSTEJA GONZALEZ, 13.May.2014 (“GOOGLE v. Spain”) Concept of ‘controller’: A search engine operator determines the purposes and means of that activity and thus of the processing of personal data that it itself carries out within
 Controllers Personal Data May 13, 2014
GOOGLE SPAIN SL V. AEPD (THE DPA) & MARIO COSTEJA GONZALEZ, 13.May.2014 (“GOOGLE v. Spain”) Processing: The operation of loading personal data on an internet page must be considered processing (as the court held in Lindquist). Crawling the internet in search of
 Personal Data Lawful Basis May 13, 2014
GOOGLE SPAIN SL V. AEPD (THE DPA) & MARIO COSTEJA GONZALEZ, 13.May.2014 (“GOOGLE v. Spain”) đŸ”„ 3 Legitimate interest balancing test: Legitimate interest requires balancing of the interest of the controller and third party with the interest of the data subject. In this
 Consent Personal Data May 13, 2014
GOOGLE SPAIN SL V. AEPD (THE DPA) & MARIO COSTEJA GONZALEZ, 13.May.2014 (“GOOGLE v. Spain”) Concept of ‘establishment’: An ‘establishment’ exists where an organization engages in the effective and real exercise of activity through stable arrangements in a EU Member
 Controllers Territorial scope (GDPR) May 13, 2014
GOOGLE SPAIN SL V. AEPD (THE DPA) & MARIO COSTEJA GONZALEZ, 13.May.2014 (“GOOGLE v. Spain”) Right to object: A data subject has a right to object to the processing based on legitimate interest. Data controllers must suspend processing and conduct a review as soon as an
 Personal Data Consent May 13, 2014
C-293/12 Digital Rights Ireland Ltd v Minister for Communications đŸ”„ 4 C-293/12 (Digital Rights Ireland) Right to Object Telecommunications Apr 8, 2014
DIGITAL RIGHTS IRELAND LTD V. IRELAND, Data retention: Legally mandated communications meta-data retention can only be a justified interference with the right of privacy and the right to data protection under EU law if
 Personal Data Consent Apr 8, 2014
DIGITAL RIGHTS IRELAND LTD V. IRELAND, Article 7 CFR: The obligation on providers of publicly available electronic communications services or public communications networks to retain data relating to a person’s private
 Consent Minors Apr 8, 2014
X, 12.12.2013 (“X”) Access: Directive 95/46 does not require Member States to levy fees when the right of access to personal data is exercised, nor does it prohibit the levying of such fees as long
 Personal Data Minors Dec 12, 2013
IPI V. ENGLEBERT (7.Nov.2013) (“ENGLEBERT”) Personal data: Data collected by private detectives relating to persons acting as estate agents concern identified or identifiable natural persons, and therefore constitute
 Personal Data IP Address Nov 7, 2013
IPI V. ENGLEBERT (7.Nov.2013) (“ENGLEBERT”) Right to be informed (derogation): Member States are allowed but not required to transpose into national law exceptions to the obligation to inform. (¶¶42-46, 50) Personal Data Fairness & Transparency Nov 7, 2013
SCHWARZ V. BOCHUM, 17.10.2014 (“SCHWARZ”) No sufficiently effective yet less invasive alternative exist as taking fingerprints/pictures is causes no physical or mental discomfort and the technology for the only
 Biometric Data Biometric Data Oct 17, 2013
SCHWARZ V. BOCHUM, 17.10.2014 (“SCHWARZ”) Necessity/proportionality: Secure storage of fingerprints reduces risk of passports falsification and to facilitates EU borders control and,thus, it is appropriate.(¶¶ 41-45). Biometric Data Biometric Data Oct 17, 2013
SCHWARZ V. BOCHUM, 17.10.2014 (“SCHWARZ”) Processing: Taking and storing fingerprints constitute processing. (¶¶ 28–29) Personal Data Processing Oct 17, 2013
SCHWARZ V. BOCHUM, 17.10.2014 (“SCHWARZ”) Personal data: Fingerprints constitute personal data, as they objectively contain unique information about individuals which allows them to be identified with precision. (¶ 27) Personal Data Biometric Data Oct 17, 2013
SCHWARZ V. BOCHUM, 17.10.2014 (“SCHWARZ”) Centralized storage of the data and used for other purposes does not affect the validity of the Regulation, which provides only for preventing illegal entry into the EU. (¶¶ 61-62) Lawful Basis Biometric Data Oct 17, 2013
SCHWARZ V. BOCHUM, 17.10.2014 (“SCHWARZ”) Lawful basis: It is essential for citizens of the EU to own a passport in order to travel to a third country, and a passport must contain fingerprints. Therefore, citizens are not
 Consent Legitimate Interest Oct 17, 2013
WORTEN-EQUIPAMENTOS PARA O LAR SA V. ACT (AUTHORITY FOR WORKING CONDITIONS), 30.5.2013 (“WORTEN”) Security: Data protection law requires controllers (not Member States) to adopt technical and organizational measures which, having regard to the state of the art and cost of
 Security Controllers May 30, 2013
WORTEN-EQUIPAMENTOS PARA O LAR SA V. ACT (AUTHORITY FOR WORKING CONDITIONS), 30.5.2013 (“WORTEN”) Personal Data: Data contained in the record of working time concerning, in relation to each worker, the daily work periods and rest periods, constitute personal data because they
 Personal Data IP Address May 30, 2013
WORTEN-EQUIPAMENTOS PARA O LAR SA V. ACT (AUTHORITY FOR WORKING CONDITIONS), 30.5.2013 (“WORTEN”) Necessity/proportionality: Collection and processing of personal data contained in the record of working time to ensure compliance with national legislation relating to working
 Consent Personal Data May 30, 2013
BONNIER AUDIO ABET AL. V. PERFECT COMMUNICATIONS WEDEN, 19.April.2012 (“BONNIER”) Processing: Communication of name and address sought by applicants constitutes processing of personal data. (¶ 52) Personal Data IP Address Apr 19, 2012
BONNIER AUDIO ABET AL. V. PERFECT COMMUNICATIONS WEDEN, 19.April.2012 (“BONNIER”) Personal Data: IP addresses are personal data within the scope of EU data protection law IP Address Personal Data Apr 19, 2012
BONNIER AUDIO ABET AL. V. PERFECT COMMUNICATIONS WEDEN, 19.April.2012 (“BONNIER”) Balancing of fundamental rights: EU data protection rules do not preclude national legislation from providing that national courts can order IP address information to be provided
 IP Address Personal Data Apr 19, 2012
BONNIER AUDIO ABET AL. V. PERFECT COMMUNICATIONS WEDEN, 19.April.2012 (“BONNIER”) Cookies Personal Data Apr 19, 2012
BONNIER AUDIO ABET AL. V. PERFECT COMMUNICATIONS WEDEN, 19.April.2012 (“BONNIER”) Data Retention Directive (Directive 2006/24): Directive 2006/24 deals exclusively with handling and retention of data generated by electronic communication service providers for
 Telecommunications Storage Limitation Apr 19, 2012
EGAN & HACKETT V. EUROPEAN PARLIAMENT, 28.3.2012 (“EGAN & HACKETT”) Egan & Hackett v. Parliament Data Subject Rights Exercise Modalities and Procedures Personal Data Mar 28, 2012
ASOCIACION NACIONAL DE ESTABLECIMIENTOS FINANCIEROS DE CREDITO (ASNEF) AND FEDERACION DE COMERCIO ELECTRONICO Y MARKETING DIRECTO (FECEMD) V. ADMINISTRACION DEL ESTADO, 24.Nov.2011 (“ASNEF”) Direct applicability of Directive 95/46: Whenever the provisions of a Directive appear to be unconditional and sufficiently precise,they have direct effect if the Member State has
 Consent Personal Data Nov 25, 2011
SCARLET EXTENDED SA V. SOCIETE BELGE DES AUTEURS, COMPOSITEURS ET EDITEURS SCRL (SABAM), 24.Nov.2011 (“SCARLET”) Personal data: IP addresses are protected personal data because they allow the concerned users to be precisely identified. (¶ 51) Personal Data IP Address Nov 24, 2011
ASOCIACION NACIONAL DE ESTABLECIMIENTOS FINANCIEROS DE CREDITO (ASNEF) AND FEDERACION DE COMERCIO ELECTRONICO Y MARKETING DIRECTO (FECEMD) V. ADMINISTRACION DEL ESTADO, 24.Nov.2011 (“ASNEF”) Valid purposes for processing: EU data protection law sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as lawful.
 Consent Personal Data Nov 24, 2011
SCARLET EXTENDED SA V. SOCIETE BELGE DES AUTEURS, COMPOSITEURS ET EDITEURS SCRL (SABAM), 24.Nov.2011 (“SCARLET”) Necessity/proportionality: Requiring ISPs to install a system for filtering electronic communications would be incompatible with EU Directives, namely with Article 15(1) of
 Telecommunications Monitoring Nov 24, 2011
DENNEKAMP V. EUROPEAN PARLIAMENT, 23.11.2011 (“DENNEKAMPI”) Dennekamp I Criminal Data Special Categories of Data Nov 23, 2011
All 189 CJEU cases →