Content type · 134 cases · 62 courts
Case Law
Court decisions and jurisprudence from EU and national courts
By topic Personal Data410 Processing316 Controllers245 Identification169 Consent168 Supervision166 Supervisory Authorities153 Law Enforcement147 Public Authority139 Public Sector136 Monitoring134 Legitimate Interest113 Data Controller112 IP Address110 Transparency98
CJEU 286
C-654/23 Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) Het Hof van Justitie van de EU (Eerste Kamer) beantwoordt een prejudiciële vraag over de uitleg van artikel 13 van Richtlijn 2002/58/EC (ePrivacy) en de verhouding tot de GDPR,… Mar 27, 2025
C-487/21 Österreichische Datenschutzbehörde v CRIF C-487/21 (Österreichische Datenschutzbehörde) Oct 26, 2023
C-601/21 Meta Platforms and Others v Bundeskartellamt C-601/21 (Meta Platforms (Bundeskartellamt)) Jul 4, 2023
C-75/24 P XH v European Commission Gaat om een beroep van T-613/21. In beroep wordt gesteld dat het Gerecht de professionele context als reden zag om de gegevens niet als persoonsgegevens te zien, maar dit is niet… Jan 15, 2026
C-57/23 JH v Policejní prezidium HvJ EU 20 november 2025, C-57/23, ECLI:EU:C:2025:905, (JH v Policejní prezidium). Nov 20, 2025
HvJ EU 9 januari 2025, C‑394/23 (Mousse) Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20… HvJ EU 9 januari 2025, C‑394/23 (Mousse). Jan 9, 2025
C-97/23 WhatsApp Ireland Ltd v European Data Protection Board WhatsApp Ireland Ltd appealed to the Court of Justice (Grand Chamber) seeking to set aside a General Court order that dismissed as inadmissible its action for annulment of EDPB… Grand Chamber Feb 10, 2026
C-291/24 Steiermärkische Bank und Sparkassen AG and Others v Österreichische Finanzmarktaufsichtsbehörde (FMA) Fourth Chamber Jan 29, 2026
C-422/24 Case C-422/24 - AB Storstockholms Lokaltrafik The Court of Justice of the European Union (CJEU) has ruled that when personal data is collected through cameras worn by inspectors in public transport, the obligation to provide… Jan 7, 2026
C-422/24 Case C-422/24 - AB Storstockholms Lokaltrafik. A new page has been created with the following information: "" Jan 7, 2026
C-492/23 X v Russmedia Digital SRL and Inform Media Press SRL In Case C-492/23, the Court of Justice of the European Union (Grand Chamber) addressed a preliminary reference from the Curtea de Apel Cluj concerning whether an online… Grand Chamber Dec 2, 2025
GDPRhub 50
BVerwG - 6 C 13.18 Since 2016, SpaceNet AG, an ISP, has been challenging a German law which provides for an obligation to store traffic and location data of all users without any reason and across… Jul 24, 2026
C‑769/22 European Commission v Hungary CJEU - C‑769/22 - European Commission v Hungary The background In 2021 Hungary adopted "Law LXXIX of 2021 adopting stricter measures against persons convicted of paedophilia and amending certain laws for the protection of… Jul 24, 2026
C‑474/24 NADA Austria and Others CJEU - C‑474/24 - NADA Austria and Others Several data subjects were subject to suspension proceedings by the Austrian Anti-Doping Legal Commission (ÖADR). Under Austrian law, the National Anti-Doping Agency (“NADA”)… Jul 24, 2026
C-311/18 CJEU - C-311/18 - Facebook Ireland and Schrems Maximillian Schrems, an Austrian citizen, had been a Facebook user since 2008. As is the case with users residing in the European Union, some of the data belonging to Mr. Schrems… Jul 17, 2026
C-78/18 Commission v Hungary (Transparency of associations) AG - C-78/18 - Commission v Hungary (Transparency of associations) In Commission v. Hungary (C-78/18), the European Commission challenged Hungary's 2017 transparency law requiring civil society organizations receiving foreign donations above a… Jul 17, 2026
C‑209/23 RRC Sports CJEU - C‑209/23 - RRC Sports Fédération internationale de football association (FIFA) is a Switzerland-based non-profit that acts as the global governing body for football. A large number of football clubs… Jul 16, 2026
C-673/17 Planet49 A German company called Planet49 organized an online lottery hosted on their webpage In order to participate in the lottery the participant had to enter a name and an address. Underneath the input field there were two checkboxes. The first checkbox required the… CJEU - C-673/17 - Planet49 Jul 16, 2026
C-350/21 Spetsializirana prokuratura CJEU - C-350/21 - Spetsializirana prokuratura (Retention of traffic and location data) In the context of criminal proceedings in Bulgaria, the prosecutor requested the Spetsializiran nakazatelen sad (Bulgarian Criminal Court) to give him access to data, including… Jul 16, 2026
General Court 37
T‑375/22 Izuzquiza and Others v Parliament GC - T‑375/22 - Izuzquiza and Others v Parliament Three individuals requested access from the European Parliament to documents detailing the amounts paid to Mr. Ioannis Lagos, a Greek Member of the European Parliament (MEP), and… Jul 16, 2026
T-367/23 Amazon EU Sàrl, venant aux droits de Amazon Services Europe Sàrl v European Commission Amazon EU Sàrl challenged the European Commission's decision designating Amazon Store as a very large online platform under Article 33(4) of the Digital Services Act (Regulation… Seventh Chamber, Extended Composition Nov 19, 2025
T-58/24 Tiktok Technology Ltd v European Commission In Case T-58/24, TikTok Technology Ltd challenged European Commission Implementing Decision C(2023) 8173, which determined TikTok's 2023 supervisory fee under the Digital Services… First Chamber, Extended Composition Sep 10, 2025
T-55/24 Meta Platforms Ireland Ltd v European Commission Meta Platforms Ireland Ltd challenged a European Commission decision setting the 2023 DSA supervisory fee for Facebook and Instagram, arguing the Commission unlawfully established… First Chamber, Extended Composition Sep 10, 2025
T-348/23 Zalando SE v European Commission In Case T-348/23, Zalando SE challenged the European Commission's April 2023 decision designating it as a very large online platform (VLOP) under the Digital Services Act… Seventh Chamber, Extended Composition Sep 3, 2025
T-553/23 Philippe Latombe v European Commission In Case T-553/23, French citizen Philippe Latombe sought annulment of the European Commission's Implementing Decision (EU) 2023/1795, which found that the United States ensures an… Tenth Chamber, Extended Composition Sep 3, 2025
T-183/23 Lisa Ballmann v European Data Protection Board In Case T-183/23, Lisa Ballmann sought annulment of the European Data Protection Board's decision refusing her request for access to the file prepared for Binding Decision 3/2022,… Tenth Chamber, Extended Composition Jul 16, 2025
T-319/24 Meta Platforms Ireland Ltd v European Data Protection Board In Case T-319/24, Meta Platforms Ireland Ltd sought annulment of EDPB Opinion 8/2024 on valid consent in the context of "consent or pay" models implemented by large online… Tenth Chamber Apr 29, 2025
T-318/24 An applicant (the data subject) participated in several EU staff selection procedures administered by the European Personnel Selection Office (EPSO), acting as controller, and created an EPSO account in the Talent system After he successfully passed one selection procedure, EPSO also stored his data in its recruitment portal. EPSO managed recruitment through two IT systems, both of which generated… GC - T-318/24 Dec 3, 2025
Federal Administrative Court 11
W137 2333649-1 On 13. January 2024, the data subject applied for an IT system administrator position and provided additional documents, regarding the use of their personal data Among other things, it was stated that the data subject's information would be considered as intellectual property, and further processing or reproduction would constitute an… BVwG - W137 2333649-1 Jul 8, 2026
W137 2327171-1 The controller, an assistant professor at a private university (the appellant), was engaged in an employment dispute with her university employer before a labour and social court 🔥 4 The data subject, a senior legal counsel employed by the university gave testimony as a witness in that employment proceeding. On 23 January 2025, the labour and social court… BVwG - W137 2327171-1 Jul 8, 2026
W254 2321912-1 The data subject, an Austrian citizen residing in Vienna, was enrolled in a distance-learning programme at a German university (the controller) When the data subject enrolled, the controller registered them under the official name shown on their identity document. The data subject experienced gender dysphoria and had… BVwG - W254 2321912-1 Apr 14, 2026
W254 2253353-1 On 7 April 2021, the data subject requested access to their data under Article 15 GDPR The controller replied on 12 April 2021 and provided further information on 27 May 2021 after the data subject made a further enquiry. As the controller's privacy policy listed… BVwG - W254 2253353-1 Nov 17, 2025
W291 2298748-1 A data subject wished to be addressed in a gender-neutral way and claimed they were misgendered by two companies (the controllers) in profile settings, tickets, and train announcements They initially sent a tweet to one of the involved controllers asking whether gender-neutral options would be available and later filed a complaint with the Equal Treatment… BVwG - W291 2298748-1 Oct 31, 2025
W258 2227269-1/39E On the 8 January 2019, the Austrian DPA (Datenschutzbehörde – DSB) launched an investigation into the actions of the Austrian postal service as it also had a business license for address publishing and direct marketing 🔥 3 Media reports had claimed that the postal service (the controller) sold data concerning the political affinities of data subjects to third parties. The controller ran a platform… BVwG - W258 2227269-1/39E Dec 27, 2024
W 108 2284491-1 The data subject visited a website operated by a media company (the controller) Upon opening the website a cookie banner showed up. This cookie banner was designed in such a way that a reject button was “hidden” in a second layer. The cookie banner’s first… BVwG - W 108 2284491-1 Jul 31, 2024
W211 2281442-1 The data subject and the controller both worked as nurses at the same hospital, on different wards Over ten years before the events in question, the data subject had been hospitalised as a patient on the ward where the controller worked as a nurse. The controller's daughter, a… BVwG - W211 2281442-1 Jun 12, 2024
BGH 8
BGH VI ZR 476/18 The applicant was an authorised officer of one of those companies In 2015, several articles appeared on the website of a US-American company, whose objective, according to its own statements, is "to make a lasting contribution to fraud… VI ZR 476/18 Jul 22, 2020
VI ZB 39/18 See facts at the GDPRhub entry to the "Planet 49 case" (C-637/1/) The second checkbox containing a preselected tick used by the defendant (Planet 49) read as follows: {| class="wikitable" !English translation !German original |- |‘I agree to the… I ZR 7/16 May 28, 2020
I ZR 97/25 I ZR 97/25 (This appears to be a legal citation and doesn't require translation.) Facts: The court has ruled that the data retention period for information regarding completed payment defaults by private credit agencies is not automatically limited by rules for… Jan 7, 2026
VI ZR 97/22 An employee of a private bank (the controller) erroneously sent a third party a message that was intended for a candidate in the controller’s staff selection process (the data subject) in October 2018 The message contained the data subject’s full name and information about their salary expectations. After the data subject was informed they were no longer considered for the… VI ZR 97/22 Jun 23, 2026
V ZB 90/25 A prospective bidder in a compulsory auction wanted to find out who owned the property being sold and filed a request to inspect certain files with a court (the controller) 🔥 4 The court of first instance granted them access to the files on the condition that the names and addresses of involved parties mentioned in the files (the data subjects) as well… V ZB 90/25 May 21, 2026
VI ZR 375/24 A debt collection agency (the controller) sent reminders to a customer (the data subject) for delayed installment payments related to a terminated electricity contract in November 2019 The data subject considered the claimed sums to be excessive and refused to pay. The controller transmitted the information on outstanding debts of €795 and €817 to a credit… VI ZR 375/2 May 12, 2026
VI ZR 109/23 The data subject, a private individual, objected to the controller’s processing of their personal data The controller, a commercial entity, had collected and processed the data subject’s personal data for marketing and profiling purposes. The data subject sent an email to the… BGH VI ZR 109/23 Jan 28, 2025
VI ZR 54/21 The controller is a private company, running a compare-and-review website for healthcare practitioners The data subject is a dentist, whose personal data (name, academic title, field of practice, address, and telephone number of the office) was published through an online profile… VI ZR 54/21 Dec 13, 2022
Supreme Administrative Court 6
1 As 183/2023-62 OAKS Consulting s.r.o. (the company) provided consulting services concerning market access conditions for medicinal products and medical devices 🔥 6 Pursuant to the Czech Act on Free Access to Information, it requested information from the General Health Insurance Company of the Czech Republic concerning the treatment of… NSS - 1 As 183/2023-62 Aug 4, 2026
N. 501417 Pour un RGPD Respecté, a French NGO that advocates for GDPR compliance, and three individuals requested the CNIL, the DPA, to partially repeal its 2020 recommendation on cookies and trackers They challenged Figure 5, which showed a cookie banner where users could refuse cookies through a “continue without accepting” link placed in the upper-right corner. After the DPA… CE - N. 501417 Jun 19, 2026
N. 433539 Several digital rights organisations asked the Prime Minister to repeal Decree No 2010-236 of 5 March 2010. The decree regulated an automated personal data processing system used by the French authority for freedom of communications (ARCOM, hereinafter the… CE - N. 433539 Apr 30, 2026
473833 The DPA imposed an €8 million administrative fine on Apple (the controller) in 2022 (CNIL - SAN-2022-025) The DPA found that Apple used identifiers stored on users’ devices to enable personalized advertising in the App Store without first obtaining valid user consent, as required by… CE - 473833 Oct 10, 2025
III OSK 5037/21 NSA - III OSK 5037/21 In March 2020, the Ombudsman requested the DPA to initiate proceedings regarding several laws that introduced an obligation for judges and prosecutors to declare their membership… Apr 29, 2025
451423 The French DPA had received a complaint on 28 May 2018 regarding the lawfulness of processing by Amazon Europe Core ('Provider' or 'The company') 🔥 3 The French DPA had forwarded this complaint to the Luxembourg DPA under the 'one stop shop' mechanism of Article 56 GDPR. The luxembourg DPA started an investigation regarding… CE - 451423 Jun 27, 2022
BVwG 4
W214 2235505-1 W214 2235505-1 On 02.06.2020, the complaining journalist requested information from the controller on the names and sums of all companies that received financial aid in the form of tax… Mar 11, 2024
W211 2230221-1 W211 2230221-1 The data subject filed a complaint with the Austrian Data Protection Authority (DSB) against the controller, requesting to be provided with recipients to whom the personal data… Sep 3, 2021
Administrative Court Berlin 3
42 K 25/25 VG Berlin - 42 K 25/25 A Jehovah’s Witnesses congregation (the controller) sent another congregation an introductory letter containing the personal data of two members (the data subjects) who were… Jun 17, 2026
42 K 73/25 The controller ran 29 outdoor swimming pools in Berlin In summer 2023, the controller introduced expanded identity verification checks and video surveillance measures due to safety concerns, such as aggressive behaviour and verbal and… VG Berlin - 42 K 73/25 May 6, 2026
42 K 51.25 The property management company of a high-rise building (the controller) had a video surveillance system installed at the entrances of the building in 2021 The installation was approved by the homeowners' association. The footage was stored for 72 hours, and there was no live monitoring. Signs indicating video surveillance were… VG Berlin - 42 K 51.25 Apr 20, 2026
CE 3
449209 On 7 December 2020, the French DPA (CNIL) imposed two fines totaling € 100 million on Google LLC and Google Ireland Ltd for violating Article 82 of the French Data Protection Act (which transposes the ePrivacy Directive) Google (1) had not obtained the user’s consent before depositing advertising cookies in the user’s terminal equipment, (2) had lacked to provide information, and (3) had not… 449209 Jan 28, 2022
439360 In February 2020 the French minister of the interior enacted the Decree No 2020-151 of 20 February 2020 authorising the automated processing of personal data known as "mobile note-taking application" (Décret n° 2020-151 du 20 février 2020 portant… 439360 Apr 13, 2021
449212 449212 On December, 7 2020, the French DPA imposed a financial penalty of 60 Million euros fine against Google LLC and a 40 million euros against Google Ireland Limited in accordance… Mar 4, 2021
Council of State 3
202307578/1/A3 The personal data of an individual was stored in the Fraud Detection System (FSV), an application used by the Dutch Tax Authority between 2012 and 2020 to record potential indicators of tax fraud The Minister of Finance was the controller. The data subject submitted an access request under Article 15 GDPR. In particular, she requested information about the personal data… RVS - 202307578/1/A3 Aug 5, 2026
202401622/1/A3 The Municipal Executive Board of Enschede, the controller, decided to conduct continuous pedestrian counts to obtain information about visitor numbers in the city centre From 25 May 2018, at least ten sensors captured the Media Access Control (hereinafter, MAC) addresses of devices with Wi-Fi enabled. When a sensor detected a MAC address, it was… RVS - 202401622/1/A3 Jul 29, 2026
202203653/1/A3 The data subject’s personal data was processed by the Tax Administration because it suspected him of not fulfilling his tax obligations This suspicion was raised after the Fiscal Information and Investigation Service (FIOD) had carried out a criminal investigation into the data subject’s tax advisor. During the… RvS - 202203653/1/A3 Nov 13, 2024
Hoge Raad 3
24/02161 The data subject applied for a credit card in 2008 and was granted it In July 2020, the bank (controller) requested that the data subject identify themselves online by providing a copy of their ID and a digital selfie. A bank employee would then… 24/02161 Feb 21, 2025
ECLI:NL:PHR:2023:935 The data subject, an asset management professional, undertook an agreement with PME Investment Services The agreement was that the data subject would take over a housing project mediated by PME, and in return PME would be awarded a fee and a minor percentage of the subsequent sale… ECLI:NL:PHR:2023:935 Oct 20, 2023
22/01253 A patient (the data subject) was treated in a hospital Because she believed that an error had been made, she held the hospital liable. The hospital involved its liability insurer. On behalf of this liability insurer, a doctor from… PHR - 22/01253 Aug 26, 2022
VwGH 2
VwGH Ro 2025/04/0007-7 The controller was an address publisher and direct advertising company that operated a data application to provide advertisers with personal data for targeted marketing measures 🔥 4 In 2019, following media reports concerning the alleged sale of personal data, particularly information about natural persons’ political party affinity, the Austrian DPA (DSB)… VwGH Ro 2025/04/0007-7 Jun 24, 2026
Ro 2022/04/0026 The data subjects, joint operators of a hotel and restaurant business, ran their establishment through a family business The controller operates an online travel platform accessible in Austria, on which registered users can post reviews and experience reports about listed establishments, in addition… Ro 2022/04/0026 May 17, 2024
Rb. Noord-Holland 2
C/15/376188 Rydo Telecom (the controller) is a telecommunications provider In 2023, a data subject made an access request following a dispute with the controller on whether the data subject received two phones they had purchased from the controller. The… C/15/376188 Jul 13, 2026
AWB-20_2618 The plaintiff received a tax assessment from the Dutch Tax and Customs Administration (i.e a letter in which it tells you how much you have to pay). She didn’t agree with its content, and therefore submitted an objection. The Tax and Customs Administration rejected the… AWB-20 2618 Oct 27, 2020
Rb. Rotterdam 2
ROT 25/8349, 25/8350, 25/6295, 25/6296 and 25/6297 A data subject submitted 73 separate GDPR requests to the Municipal Executive of Rotterdam, the controller, between November 2024 and February 2025 Most requests contained several sub-requests and relied on Articles 5, 6, 10, 14, 15, 16, 17 and 19 GDPR. The controller refused the requests under Articles 15, 16, 17 and 19 GDPR… ROT 25/8349, 25/8350, 25/6295, 25/6296 and 25/6297 Aug 19, 2026
ROT 25/7371 ING Bank N.V. (the controller) is a bank In 2022, several data subjects brought a complaint to the DPA regarding the controller’s contactless payments. The data subjects requested the controller to issue debit cards… ROT 25/7371 Jun 24, 2026
LG Frankfurt 2
6 U 81/23 Frankfurt am Main Regional Court - Case Number 6 U 81/23. The court awarded €100 in non-pecuniary damages for the storage and processing of cookies without the consent of the individual. While the violation was considered minor, and the… Jan 13, 2026
2-03 O 4/19 Τhe wife of a well-known German presenter had filed an action for injunction against the publication of the plaintiff's picture in two magazines The reason and content of the first reporting was that the plaintiff’s husband surprisingly did not extend his engagement in his talk show and the question of why (speculatively)… 2-03 O 4/19 Dec 19, 2019
National Court 2
SAN 3154/2026 In May 2021, a data subject lodged a complaint with the DPA against KFC Restaurants Spain, S.L.U., the controller, concerning the processing of personal data through its website The data subject claimed that the privacy information applicable to users in the EEA was not easily accessible, as the main privacy link led to a global policy. The data subject… AN - SAN 3154/2026 Jul 16, 2026
SAN 2996/2026 Unión General de Trabajadores (UGT), a trade union, lodged a complaint with the DPA (AEPD) against Amazon Road Transport Spain, S.L., the controller Applicants wishing to work within the Amazon Flex delivery programme were required to provide a certificate confirming that they had no criminal record. The certificates and other… AN - SAN 2996/2026 Jul 8, 2026
NSS 2
5 As 327/2022-48 A court held that Czech police legislation provides a sufficiently clear legal basis under the Law Enforcement Directive for taking biometric and genetic data from a convicted prisoner for future identification purposes English Summary. Facts. The controller was the Police of the Czech Republic. The data subject was a man who, in 2003, had been convicted of causing bodily harm and attempted… 5 As 327/2022-48 Aug 26, 2026
Norges Høyesterett 2
2021-2403-A In 2012, a company "Legelisten.no AS" launched a website where people could submit anonymous reviews of healthcare personnel From the same year, the Norwegian DPA Datatilsynet received multiple complaints from affected individuals. In one case in 2015, the DPA held that Legelisten did not have a legal… 2021-2403-A Dec 7, 2021
2019-1226-A The person was sent to prison for tax evasion in the years 2001 to 2006 The district court has assumed that A withheld share gains together about NOK 4.7 million and assets of just over NOK 4.5 million from taxation. The tax benefit is stated in the… 2019-1226-A Jun 26, 2019
Supreme Administrative Court of Bulgaria 2
8426/2026 BAC (Bulgaria) - 8426/2026 The data subject was a candidate for the position of senior legal counsel at the Bulgarian branch of the German commercial bank Flatex Degiro (the controller). As a prerequisite… Jul 30, 2026
7890/2026 BAC (Bulgaria) - 7890/2026 A data subject lodged a complaint with the Bulgarian DPA (CPDP), alleging that her neighbour (the controller) was unlawfully monitoring her property through CCTV. She claimed that… Jul 13, 2026
Supreme Court 2
15625/2026 Cass.Civ. - 15625/2026 Istituto nazionale della previdenza sociale (INPS, the controller) is the Italian National Institute for Social Security. In 2021, the DPA fined the controller €300,000 for its… May 21, 2026
III CZP 78/19 III CZP 78/19 The parties were involved in social initiatives aimed at supporting or questioning the need for certain investments in the vicinity of the housing estate where they live. The… Aug 6, 2020
Administrative Court Düsseldorf 1
29 K 3490/24 A district (the controller), acting as the lower water authority, initiated administrative proceedings after identifying unauthorised riverbank works and a private jetty on two riverside properties One property belonged to a water utility company, while the other belonged to a municipality and was leased to the data subjects. During those proceedings, the controller shared… VG Düsseldorf - 29 K 3490/24 Jun 22, 2026
Administrative Court in Rijeka 1
Us I-755/2025-8 The data subject was a member of the management board of Zagrebački holding, a company owned by the City of Zagreb, from 3 September 2021 until 31 March 2023 A television broadcaster published several pieces, including a video on its YouTube channel, reporting on the data subject’s resignation. The publications mentioned his name,… USR - Us I-755/2025-8 Nov 11, 2025
Administrative Court Munich 1
M 26a K 25.5210 The data subject had been liable to pay broadcasting contributions to the Controller, a German regional public broadcasting authority, since 2007 Following objections to several contribution assessment notices, the data subject submitted a request under Article 15 GDPR seeking a copy of all personal data processed about him… VG München - M 26a K 25.5210 May 18, 2026
Administrative Court of the Grand-Duchy of Luxembourg 1
49701C Cour Administrative - 49701C On 19 May 2020, a Luxembourg bank informed the complainant that, by 30 June 2020, they would transmit the complainant's bank account information to the Luxembourg fiscal… Dec 12, 2024
Administrative Court of Zagreb 1
Us I-4772/2023-10 A utility and municipal services enterprise, Zagrebački Holding d.o.o (the controller) provided users of its services with the option to request a copy of their bill via email. Where the name appearing in the email address differed from the user’s… US Zagreb - Us I-4772/2023-10 Jul 22, 2026
Administrative Court Stuttgart 1
1 K 12737/25 A resident of North Macedonia (the data subject) was expelled from German territory in September 2021, and a two-year ban on entry and residence was imposed on him The data subject subsequently re-entered German territory without a visa in December 2024 and travelled back to North Macedonia in July 2025. A federal police directorate (the… VG Stuttgart - 1 K 12737/25 Jul 14, 2026
BVerfG 1
1 BvR 2853/19 A data subject filed constitutional complaint because the AG Goslar (Goslar Local Court) denied his claims under Article 82 GDPR because of an unsolicited email Because he only claimed 500 EUR as compensation, the Goslar Local Court was the regular last instance under German law. The Goslar Local Court denied the preliminary ruling from… 1 BvR 2853/19 Jan 14, 2021
Court of Appeal 1
EWCA Civ 899 Vince v. Associated Newspapers Limited CA - EWCA Civ 899 Vince v. Associated Newspapers Limited Associated Newspapers Limited, the controller, published print and online articles in the Daily Mail and Mail+ on 8 and 9 June 2023 concerning a data subject. The articles were… Jul 15, 2026
Hof Amsterdam 1
200.324.736/01 The data subject had a business credit card issued by the controller In 2021, the controller asked the data subject to identify themselves online by taking a picture of the ID and then taking a selfie of themselves. The data subject wanted to… GHAMS - 200.324.736/01 Apr 30, 2024
Rb. Amsterdam 1
781904 ING Bank (the controller) is a bank One of the services the controller offers is to make contactless payments using an Android phone. This was initially done through its own app, however, the controller later… 781904 Jul 16, 2026
Rb. Den Haag 1
C/09/689833 Kindred Group PLC and Risepoint Limited (the controllers) are companies that provide online gambling products Several companies within Kindred Group PLC (Risepoint was initially in this group) offered online gambling products before a national law requiring a license entered into force.… C/09/689833 May 27, 2026
Rb. Overijssel 1
ZWO 25/2142 On 5 January 2025, the data subject submitted an access request to the Chief of Police, the controller, concerning her personal data for the period between 1 January 2016 and 31 December 2017 In particular, she requested information about searches carried out using her Citizen Service Number in a Basic Register of Persons. On 10 February 2025, the controller extended… ZWO 25/2142 Jul 24, 2026
EWCA 1
A3/2015/307 Dawson-Damer v Taylor Wessing LLP This case concerns a data subject access request (SAR) under the Data Protection Act (DPA) 1998. The data subjects were beneficiaries under a trust. The data controller was a firm… Jul 17, 2026
EWHC 1
QB-2021-000923 EWHC (UK) - Johnson v Eastlight Community Homes Ltd The defendant is a provider of social housing, the claimant is one of its tenants. A third party requested a rent statement from the defendant. In response to the request, the… Nov 16, 2021
First-Tier Tribunal 1
FT/EA/2024/0359 FT - FT/EA/2024/0359 A doctor submitted a freedom of information request to the Nursing and Midwifery Council, the controller, asking whether a named nurse had been struck off the register for… Jul 8, 2026
BVerwG 1
6 C 1.24 The data subject was employed by the German Federal Financial Supervisory Authority (BaFin), the public authority responsible for supervising banks, financial service providers, and insurance companies He worked as a case officer in a specialised unit dealing with serious financial misconduct, including organised crime and terrorism financing. Due to their work, employees in… 6 C 1.24 Nov 5, 2025
BAG 1
8 AZR 169/25 A company (the controller) commissioned a law firm to conduct a compliance investigation into alleged misconduct of a manager (the data subject) in August 2023 The investigation resulted in two compliance reports containing the allegations against the data subject, the names of whistleblowers and witnesses, and a summary of the findings… 8 AZR 169/25 Apr 16, 2026
Hof Arnhem-Leeuwarden 1
200.256.426 DFW (a Dutch movie distributor) applies a protocol to its processing of personal data which was approved by the Dutch DPA before the GDPR came into force DFW asked Ziggo (an internet service provider) to provide IP addresses of customers who according to DFW shared movies illegally. Ziggo refused to provide this information.… 200.256.426 Nov 5, 2019
High Court of Justice of the Basque Country 1
1713/2026 The data subject had worked for Fineco Sociedad de Valores, SA and GIIC Fineco Sociedad Gestora de Instituciones de Inversión Colectiva, SAU, the controller, since 2004 The data subject held a senior position and was presented externally as responsible for fixed income management. In May and June 2024, several work meetings took place via… TSJ PV - 1713/2026 Jul 17, 2026
Higher Regional Court Cologne 1
15 W 55/26 OLG Köln - 15 W 55/26 The data subject, a doctor, sought an injunction against the Controller, the operator of an online review platform, requiring the removal of, and prohibiting the future… Jun 12, 2026
Higher Regional Court Munich 1
36 U 1054/25 e OLG München - 36 U 1054/25 e The data subject had used a social media platform operated by the controller, an Irish company, since 2013. The controller provided “Business Tools” to third-party website… Jun 26, 2026
Higher Regional Court Vienna 1
13R70/25x OLG Wien - 13R70/25x A data subject brought proceedings against a controller after it refused to provide, free of charge, digital copies of invoices and transaction data following an access request.… Dec 1, 2025
Hof van Beroep 1
2021/AR/1044 Court of Appeal of Brussels - 2021/AR/1044 The Belgian tax department appealed a decision of the Belgian DPA that was provisionally enforceable, and asked for the immediate suspension of the implementing measures already… Jul 16, 2021
Hof van Beroep Brussel 1
2019/AR/74 This case started as a conflict between neighbours The controller (Y) and the data subject (X) are/were inhabitants of the same neighbourhood. The controller experienced nuisance (soot gas infiltration) because the data subject… Court of Appeal of Brussels - 2019/AR/741 Jun 12, 2019
LAG Schleswig-Holstein 1
6 Ta 49/22 The controller operated a care service where the data subject was employed The controller filmed the data subject in their work environment and published a thirty-six second video on Youtube for promotional purposes. The data subject had previously given… 6 Ta 49/22 Jun 1, 2022
LG Köln 1
28 O 168/22 The controller is an operator of a search engine If a user used specific keywords in a name-based search, the search engine showed search results that contained the following wording: "T ENTREPRENEUR, CMO AND VICTIM OF DOMESTIC… 28 O 168/22 Jul 4, 2022
LG Rostock 1
3 O 762/19 The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V (vzbv, the claimant) filed a lawsuit against advocado GmbH (advocado, the defendant), a German-based company that runs an online platform where attorneys can offer their services.… 3 O 762/19 Sep 15, 2020
Local Court Arnsberg 1
42 C 434/23 AG Arnsberg - 42 C 434/23 An Austrian citizen residing in Vienna (the data subject) subscribed to the newsletter of a family-run optician company (the controller) mainly operating in the German states of… Jul 1, 2026
Municipal Civil Court in Zagreb 1
Pn-877/2023-29 OGS Zagreb - Pn-877/2023-29 A data subject filed a lawsuit against Propuls d.o.o., the controller and publisher of the news portal direktno.hr, claiming that two articles published on 11 January 2023 and 31… Jan 16, 2026
OVG Berlin 1
OVG 3 S 24/20 A student, his/her parents and the school authority communicated a lot, this communication was requested to be deleted from the student´s file, as well as a copy of one report card Dispute — The school and authority refused to take out these documents, although the claimant claimed that they do not correspond with the reality. Holding — An obligation to… OVG 3 S 24/20 Jul 1, 2020
PVN 1
2018-14 (15/01355) Personvernnemnda (Norway) - 2018-14 (15/01355) In 2017, the Norwegian DPA Datatilsynet found that a company "Legelisten", running an anonymous review website of healthcare personnel, lacked a legal basis for processing and… Jan 21, 2019
Rb. Midden-Nederland 1
UTR 21/3403 The controller is the Minister of Finance The data subject’s personal data was processed by the Tax Authority because it suspected him of not fulfilling his tax obligations. This suspicion was raised after the Fiscal… UTR 21/3403 May 9, 2022
Regional Administrative Court Bratislava 1
BA-6S/221/2019 Sociálna poisťovňa, the social insurance agency (the controller), processes applications for foreign invalidity pensions and forwards related documents to the social insurance institutions of other EU Member States A data subject applied for a Danish invalidity pension. On 22 October 2018, the controller sent the data subject's sensitive personal data (including health data, personal… X - BA-6S/221/2019 Jun 25, 2025
Regional Court in Warsaw 1
III C 904/23 SO Warszawa - III C 904/23 The Financial Ombudsman’s office (the controller) sent a letter containing the name, the address, and the case reference number of a customer (the data subject) to 28,366 public… Feb 16, 2026
SO Warszawa 1
C 310/23 Permanent link: The responsible party did not respond adequately and provided unclear information or referred the individual to third parties As a result, the individual filed a complaint with the Data Protection Authority. The responsible party did not respond adequately and provided unclear information or referred the… Case C 310/23 Jan 13, 2026
Sibiu Tribunal 1
703/2026 On 5 June 2025, an individual (the data subject) made an access request under Article 15 GDPR to the Romanian National Railways Company, Societatea Națională de Căi Ferate SA (the controller) The data subject requested CCTV footage from 30 May 2025 and information regarding the processing of his personal data following an alleged altercation between the data subject… TS - 703/2026 Jul 3, 2026
Superior Administrative Court Saarlouis 1
2 A 165/24 OVG Saarlouis - 2 A 165/24 The data subject was an employee, the controller was the employer. On 14 January 2022, the data subject requested access to personal data from the controller under Article 15… May 13, 2025
Supreme Administrative Court of Finland 1
HFD:2021:125 Korkein hallinto-oikeus (Finland) - KHO:2021:125 The Regional Government of Åland had appointed Mr A as head of the regional Ålandic DPA for a probationary period of one year. Pursuant to section 10(2) of the Act on Public… Sep 10, 2021
Svea Court of Appeal 1
T 10711-21 Svea Hovrätt - T 10711-21 The data subject was a client of a bank (the controller). In 2020, the controller terminated their bank account based on "poor customer knowledge". Consequently the data subject… Oct 7, 2022
Tribunal of Bologna 1
RG 12124/2020 A data subject made an access request to Comet s.p.a., the controller, to verify the lawfulness of the processing of her personal data for marketing purposes In particular, she requested the information provided for in Article 15(1)(a) and (h) GDPR, and a copy of the personal data in possession of the controller. The controller did not… Trib. of Bologna - RG 12124/2020 Jul 30, 2022
VG Ansbach 1
14 K 19.01274 In December 2018, the data subject filed with the DPA (the defendant in this case), a complaint under Article 77 GDPR against a lawyer who had represented the data subject in a traffic accident, before he terminated the mandate In court proceedings after this termination, in which the lawyer's fee claim was at issue, the lawyer had submitted to the court a volume of documents containing extracts of all… 14 K 19.01274 Sep 22, 2021