Content type · 50 cases · 1 courts
Case Law
Court decisions and jurisprudence from EU and national courts
Court: CJEU (50) Clear filter
CJEU 194
CJEU: Data collected by private detectives on estate agents constitutes personal data Personal data: Data collected by private detectives relating to persons acting as estate agents concern identified or identifiable natural persons, and therefore constitute… Nov 7, 2013
CJEU: Member States may but need not transpose exceptions to the right to be informed Right to be informed (derogation): Member States are allowed but not required to transpose into national law exceptions to the obligation to inform. (¶¶42-46, 50) Nov 7, 2013
CJEU: Fingerprints in passports valid; no less invasive effective alternative exists No sufficiently effective yet less invasive alternative exist as taking fingerprints/pictures is causes no physical or mental discomfort and the technology for the only… Oct 17, 2013
CJEU: Storing fingerprints in passports is necessary and proportionate for border security Necessity/proportionality: Secure storage of fingerprints reduces risk of passports falsification and to facilitates EU borders control and,thus, it is appropriate.(¶¶ 41-45). Oct 17, 2013
CJEU: Taking and storing fingerprints in passports constitutes processing of personal data Processing: Taking and storing fingerprints constitute processing. (¶¶ 28–29) Oct 17, 2013
CJEU: Fingerprints constitute personal data under EU data protection law Personal data: Fingerprints constitute personal data, as they objectively contain unique information about individuals which allows them to be identified with precision. (¶ 27) Oct 17, 2013
CJEU: centralized storage of fingerprint data does not affect validity of Regulation Centralized storage of the data and used for other purposes does not affect the validity of the Regulation, which provides only for preventing illegal entry into the EU. (¶¶ 61-62) Oct 17, 2013
CJEU: Passport fingerprint processing not based on consent as passports are essential Lawful basis: It is essential for citizens of the EU to own a passport in order to travel to a third country, and a passport must contain fingerprints. Therefore, citizens are not… Oct 17, 2013
CJEU Worten: Controllers must implement appropriate technical and organizational security Security: Data protection law requires controllers (not Member States) to adopt technical and organizational measures which, having regard to the state of the art and cost of… May 30, 2013
CJEU Worten: Worker daily work and rest time records constitute personal data Personal Data: Data contained in the record of working time concerning, in relation to each worker, the daily work periods and rest periods, constitute personal data because they… May 30, 2013
Worten v ACT: processing working time records lawful if necessary for legal compliance Necessity/proportionality: Collection and processing of personal data contained in the record of working time to ensure compliance with national legislation relating to working… CJEU May 30, 2013
CJEU: Communicating IP subscriber's name and address is processing of personal data Processing: Communication of name and address sought by applicants constitutes processing of personal data. (¶ 52) Apr 19, 2012
CJEU: IP addresses are personal data under EU data protection law Personal Data: IP addresses are personal data within the scope of EU data protection law Apr 19, 2012
EU data protection rules do not preclude courts ordering IP address disclosure to Balancing of fundamental rights: EU data protection rules do not preclude national legislation from providing that national courts can order IP address information to be provided… CJEU Apr 19, 2012
CJEU: Data Retention Directive does not preclude IP subscriber disclosure in copyright Data Retention Directive (Directive 2006/24): Directive 2006/24 deals exclusively with handling and retention of data generated by electronic communication service providers for… Apr 19, 2012
CJEU: Access requests cannot be denied on privacy grounds without specific case analysis Egan & Hackett v. Parliament Mar 28, 2012
CJEU: Directive 95/46 Art. 7(f) has direct effect; sufficiently precise and unconditional Direct applicability of Directive 95/46: Whenever the provisions of a Directive appear to be unconditional and sufficiently precise,they have direct effect if the Member State has… Nov 25, 2011
CJEU: IP addresses are protected personal data as they identify users Personal data: IP addresses are protected personal data because they allow the concerned users to be precisely identified. (¶ 51) Nov 24, 2011
CJEU: Member States cannot add lawful grounds for data processing beyond Directive 95/46 Valid purposes for processing: EU data protection law sets out an exhaustive and restrictive list of cases in which the processing of personal data can be regarded as lawful.… Nov 24, 2011
CJEU: ISP filtering injunction violates data protection, privacy and free expression Necessity/proportionality: Requiring ISPs to install a system for filtering electronic communications would be incompatible with EU Directives, namely with Article 15(1) of… Nov 24, 2011
CJEU: Parliament must show disclosure specifically undermines privacy Dennekamp I Nov 23, 2011
Dennekamp I: Regs 1049/2001 and 45/2001 have equal weight; both must be applied Balancing fundamental rights: Regulation 1049/2001 (access to documents) and Regulation 45/2001 (data protection) do not contain any provisions granting one primacy over the… CJEU Nov 23, 2011
Jordana v Commission: Commission erred by failing to apply Regulation 45/2001 in access Access: Article 4(1)(b) of Regulation 1049/2001 is indivisible, and requires that the violation of private life and the integrity of the individual are always analyzed in… CJEU ·in French Jul 7, 2011
CJEU Jordana: Transfer of personal data constitutes processing under Reg. 45/2001 Processing: Transfer of data constitutes processing. (¶ 91) in French Jul 7, 2011
CJEU: names on reserve list and appointment decisions are personal data under Reg. 45/2001 Definition of personal data: The first and last names of the persons on the reserve list and the officials mentioned in the individual decisions of appointment to grade A6 can be… Jul 7, 2011
V & EDPS V. EUROPEAN PARLAMENT, 5.7.2011 (“V v. European Parliament”) V. v. Parliament CJEU Jul 5, 2011
ECLI:EU:F:2011:101 CJEU: Transferring medical data to third party constitutes interference with Art. 8 ECHR V. v. Parliament Jul 5, 2011
CJEU Schecke: Legal persons protected under EU data law only if name identifies natural Personal Data: Legal persons can claim protection under EU data protection law only insofar as the official title of the legal person identifies one or more natural persons. It is… Nov 9, 2010
CJEU: Processing of beneficiary data not based on consent; individuals must be informed Purpose for processing: The legislation at issue does base the processing on consent. Rather, it provides that they are to be informed. Thus, processing is not based on their… Nov 9, 2010
CJEU: Mandatory publication of CAP beneficiaries' personal data violates proportionality Interference with the fundamental rights of privacy and data protection: Chapter of Fundamental Rights (CFR) Article 52(1) accepts that limitations may be imposed on fundamental… Nov 9, 2010
CJEU: Commission lawfully redacted participant names from meeting minutes under Access Access: Where a request based on Regulation No 1049/2001 (Access to Documents Regulation) seeks to obtain documents including personal data, applicable EU data protection law… Jun 29, 2010
CJEU Bavarian Lager: Disclosing personal data in access-to-documents requests is Processing: Communication of personal data in response to a request for access to documents constitutes processing. (¶69) Jun 29, 2010
CJEU: names of meeting participants are personal data under Regulation No 45/2001 Personal data: Surnames and forenames may be regarded as personal data. Thus the list of names of participants in a meeting is personal data, since persons can be identified. (¶… Jun 29, 2010
CJEU: DPAs must act with complete independence, free from any external influence Independence of Supervisory Authorities: Independence means a status which ensures that the body concerned can act completely freely, without taking any instructions or being put… Mar 9, 2010
CJEU Rijkeboer: One-year limit on storing recipient info of disclosed data is unfair Right of Access: Rules limiting the storage of information on the recipients or categories of recipient of personal data and on the content of the data disclosed to a period of… May 7, 2009
CJEU: IP addresses and connection data disclosed to third parties constitute personal data Personal Data: Communication of names and physical addresses of certain users, whose IP address and date and time of connection were know, involves the making available of… Feb 19, 2009
CJEU: ISPs need not store temporary IP addresses for copyright civil litigation Balancing rights: The judgment relies heavily on the Promusicae judgment to hold that: (1) Access providers which merely provide users with Internet access, without offering other… Feb 19, 2009
CJEU: collecting, republishing and transferring already-published personal data is SATAKUNNAN & SATAMEDIA Dec 16, 2008
CJEU: Tax authority income data remains personal data despite prior public publication SATAKUNNAN & SATAMEDIA Dec 16, 2008
CJEU: Member States must provide data protection derogations for journalistic purposes SATAKUNNAN & SATAMEDIA Dec 16, 2008
CJEU: Names and addresses of internet users whose IP addresses are known are personal data Personal Data: Names and physical addresses of certain users of an internet service, whose IP address and date and time of connection were know, are personal data, that is,… Jan 29, 2008
ECLI:EU:C:2008:54 Productores de Música de España (Promusicae) v Telefónica de España SAU Balancing fundamental rights: EU law does not require Member States to lay down an obligation to communicate personal data in order to ensure effective protection of copyright in… CJEU Jan 29, 2008
CJEU: Leak of personal data to journalist and press release both constitute processing Processing: A leak (unauthorised transmission of personal data to a journalist by someone inside OLAF) and the publication of a press release each constitute processing (¶204) Sep 12, 2007
CJEU: Unnamed individual identifiable in OLAF press release constitutes personal data Personal data: The information published in the press release was personal data, since the data subject was easily identifiable, under the circumstances. The fact that the… in French Sep 12, 2007
CJEU: Personal data leak is grave and manifest violation; burden of proof shifts to EU Non-contractual liability under EU law: The normal rule is that the burden of proof is on the applicant to establish: i) the illegal action of a EU institution; ii) damages; iii)… Sep 12, 2007
CJEU annuls PNR data transfer decision as ultra vires under Art. 95 EC Transfers: Where the transfers of personal data are authorized under an agreement that was adopted ultra vires, the authorization is void. May 30, 2006
CJEU: Legal persons cannot invoke EU data protection rules (Bank Austria v Commission) Personal data: The data of a legal person is not protected under EU data protection law. (¶ 95) May 30, 2006
ECB's inclusion of letters in staff files constitutes personal data processing Processing: Inclusion of the letters in the personal files constitutes processing. (¶ 39) CJEU ·in German Feb 18, 2004
CJEU: Employer may assess necessity of staff email use and proportionality of file Necessity/proportionality: An employer may consider whether the use of internal email by staff (i) was necessary for the performance of their contract of employment; (ii) whether… Feb 18, 2004