Content type · 150 cases · 78 courts
Case Law
Court decisions and jurisprudence from EU and national courts
By topic Personal Data445 Processing337 Controllers278 Identification188 Consent184 Supervision183 Supervisory Authorities175 Public Authority156 Monitoring144 Law Enforcement133 Legitimate Interest129 Right of Access113 Transparency106 Security95 Processors92
CJEU 342
C-61/19 Orange Romania C-61/19 - Orange Romania The Court of Justice of the European Union ruled on whether a telecommunications provider obtains valid consent under Directive 95/46/EC (and the corresponding GDPR standard) when… Sep 16, 2026
C-798/24 Jautiva CJEU · C-798/24 - Jautiva Seventeen natural persons, who were minority shareholders of a public limited liability company, brought proceedings before the Satversmes tiesa (the Constitutional Court of… Sep 3, 2026
C-654/23 Inteligo Media SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) Het Hof van Justitie van de EU (Eerste Kamer) beantwoordt een prejudiciële vraag over de uitleg van artikel 13 van Richtlijn 2002/58/EC (ePrivacy) en de verhouding tot de GDPR,… Mar 27, 2025
C-487/21 Österreichische Datenschutzbehörde v CRIF C-487/21 (Österreichische Datenschutzbehörde) Oct 26, 2023
C-601/21 Meta Platforms and Others v Bundeskartellamt C-601/21 (Meta Platforms (Bundeskartellamt)) Jul 4, 2023
C-75/24 P XH v European Commission Gaat om een beroep van T-613/21. In beroep wordt gesteld dat het Gerecht de professionele context als reden zag om de gegevens niet als persoonsgegevens te zien, maar dit is niet… Jan 15, 2026
C-57/23 JH v Policejní prezidium HvJ EU 20 november 2025, C-57/23, ECLI:EU:C:2025:905, (JH v Policejní prezidium). Nov 20, 2025
HvJ EU 9 januari 2025, C‑394/23 (Mousse) Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20… HvJ EU 9 januari 2025, C‑394/23 (Mousse). Jan 9, 2025
C‑769/22 European Commission v Hungary C‑769/22 - European Commission v Hungary The background In 2021 Hungary adopted "Law LXXIX of 2021 adopting stricter measures against persons convicted of paedophilia and amending certain laws for the protection of… Jul 24, 2026
C‑474/24 NADA Austria and Others C‑474/24 - NADA Austria and Others Several data subjects were subject to suspension proceedings by the Austrian Anti-Doping Legal Commission (ÖADR). Under Austrian law, the National Anti-Doping Agency (“NADA”)… Jul 24, 2026
C-311/18 C-311/18 - Facebook Ireland and Schrems Maximillian Schrems, an Austrian citizen, had been a Facebook user since 2008. As is the case with users residing in the European Union, some of the data belonging to Mr. Schrems… Jul 17, 2026
C-78/18 Commission v Hungary (Transparency of associations) AG - C-78/18 - Commission v Hungary (Transparency of associations) In Commission v. Hungary (C-78/18), the European Commission challenged Hungary's 2017 transparency law requiring civil society organizations receiving foreign donations above a… Jul 17, 2026
C‑209/23 RRC Sports C‑209/23 - RRC Sports Fédération internationale de football association (FIFA) is a Switzerland-based non-profit that acts as the global governing body for football. A large number of football clubs… Jul 16, 2026
C-673/17 Planet49 A German company called Planet49 organized an online lottery hosted on their webpage In order to participate in the lottery the participant had to enter a name and an address. Underneath the input field there were two checkboxes. The first checkbox required the… C-673/17 - Planet49 Jul 16, 2026
General Court 37
T‑375/22 Izuzquiza and Others v Parliament GC - T‑375/22 - Izuzquiza and Others v Parliament Three individuals requested access from the European Parliament to documents detailing the amounts paid to Mr. Ioannis Lagos, a Greek Member of the European Parliament (MEP), and… Jul 16, 2026
T-367/23 Amazon EU Sàrl, venant aux droits de Amazon Services Europe Sàrl v European Commission Amazon EU Sàrl challenged the European Commission's decision designating Amazon Store as a very large online platform under Article 33(4) of the Digital Services Act (Regulation… Seventh Chamber, Extended Composition Nov 19, 2025
T-58/24 Tiktok Technology Ltd v European Commission In Case T-58/24, TikTok Technology Ltd challenged European Commission Implementing Decision C(2023) 8173, which determined TikTok's 2023 supervisory fee under the Digital Services… First Chamber, Extended Composition Sep 10, 2025
T-55/24 Meta Platforms Ireland Ltd v European Commission Meta Platforms Ireland Ltd challenged a European Commission decision setting the 2023 DSA supervisory fee for Facebook and Instagram, arguing the Commission unlawfully established… First Chamber, Extended Composition Sep 10, 2025
T-348/23 Zalando SE v European Commission In Case T-348/23, Zalando SE challenged the European Commission's April 2023 decision designating it as a very large online platform (VLOP) under the Digital Services Act… Seventh Chamber, Extended Composition Sep 3, 2025
T-553/23 Philippe Latombe v European Commission In Case T-553/23, French citizen Philippe Latombe sought annulment of the European Commission's Implementing Decision (EU) 2023/1795, which found that the United States ensures an… Tenth Chamber, Extended Composition Sep 3, 2025
T-183/23 Lisa Ballmann v European Data Protection Board In Case T-183/23, Lisa Ballmann sought annulment of the European Data Protection Board's decision refusing her request for access to the file prepared for Binding Decision 3/2022,… Tenth Chamber, Extended Composition Jul 16, 2025
T-319/24 Meta Platforms Ireland Ltd v European Data Protection Board In Case T-319/24, Meta Platforms Ireland Ltd sought annulment of EDPB Opinion 8/2024 on valid consent in the context of "consent or pay" models implemented by large online… Tenth Chamber Apr 29, 2025
T-318/24 GC T-318/24: EPSO access logs and Article 17 access requests under Regulation 2018/1725 An applicant (the data subject) participated in several EU staff selection procedures administered by the European Personnel Selection Office (EPSO), acting as controller, and… Dec 3, 2025
Federal Administrative Court 23
W274 2320278-1 Austrian Federal Administrative Court: address publisher's data transfer and Article 15 An address publishing service and direct marketing company (the controller) sent the address data of a data subject to clients as part of its business activities. The clients are… Sep 14, 2026
W256 2337399-1 BVwG reduces DPA fine for undisclosed call recording from €25,500 to €22,000 A marketing company (controller) that specialises in recruiting personnel for third companies was fined by the DPA for recording telephone interviews with potential customers… Sep 3, 2026
W137 2334047-1 The data subject did not pay for items ordered and collected from a pharmacy (controller) After several reminders, the controller commissioned a debt collection agency, which pointed to several enforcement proceedings against the data subject. The controller then… BVwG - W137 2334047-1 Aug 3, 2026
W605 2289290-2/18E The data subject received social benefits from a public authority (controller) because of their unemployment The controller has established an investigation unit that investigates undeclared workers and people who refuse to work but receive benefits. Employees from that investigation… BVwG - W605 2289290-2/18E Jul 14, 2026
W298 2314952-1 The data subject was a policeman who was subject to disciplinary measures He filed a complaint concerning those disciplinary measures. The decision concerning the complaint was published on an official website of the Federal Chancellery of Austria that… BVwG - W298 2314952-1 Jul 13, 2026
W254 2314468-1 The data subject sent an access request to the service provider (the processor) It replied that it held no personal data concerning the data subject in its capacity as controller. It explained that it provided services to N-GmbH and acted as its processor.… BVwG - W254 2314468-1 Jul 8, 2026
W137 2333649-1 Federal Administrative Court: retention of job applicant data for potential legal claims The data subject applied for a job with the association and provided additional documents, regarding the use of their personal data. Among other things, it was stated that the… Jul 8, 2026
W137 2327171-1 Austrian FAC rules on publishing full court judgment naming witness on social media The controller, an assistant professor at a private university (the appellant), was engaged in an employment dispute with her university employer before a labour and social court.… Jul 8, 2026
BGH 9
BGH VI ZR 476/18 The applicant was an authorised officer of one of those companies In 2015, several articles appeared on the website of a US-American company, whose objective, according to its own statements, is "to make a lasting contribution to fraud… VI ZR 476/18 Jul 22, 2020
VI ZB 39/18 BGH: Preselected checkbox for web analytics cookies does not constitute valid consent See facts at the GDPRhub entry to the "Planet 49 case" (C-637/1/). The second checkbox containing a preselected tick used by the defendant (Planet 49) read as follows: {|… May 28, 2020
I ZR 97/25 I ZR 97/25 (This appears to be a legal citation and doesn't require translation.) Facts: The court has ruled that the data retention period for information regarding completed payment defaults by private credit agencies is not automatically limited by rules for… Jan 7, 2026
VI ZR 144/23 BGH: GDPR not exhaustive on injunctive relief; online store data transfer case remanded The operator of an online store (the controller) had embedded third-party features in its website. As a result of this practice, the data of users accessing the website (the data… Jul 21, 2026
VI ZR 97/22 BGH · VI ZR 97/22 An employee of a private bank (the controller) erroneously sent a third party a message that was intended for a candidate in the controller’s staff selection process (the data… Jun 23, 2026
V ZB 90/25 BGH · V ZB 90/25 A prospective bidder in a compulsory auction wanted to find out who owned the property being sold and filed a request to inspect certain files with a court (the controller). The… May 21, 2026
VI ZR 375/24 BGH · VI ZR 375/2 A debt collection agency (the controller) sent reminders to a customer (the data subject) for delayed installment payments related to a terminated electricity contract in November… May 12, 2026
VI ZR 109/23 German Supreme Court: GDPR non-material damages need no severity threshold The data subject, a private individual, objected to the controller’s processing of their personal data. The controller, a commercial entity, had collected and processed the data… Jan 28, 2025
VI ZR 54/21 The controller is a private company, running a compare-and-review website for healthcare practitioners The data subject is a dentist, whose personal data (name, academic title, field of practice, address, and telephone number of the office) was published through an online profile… VI ZR 54/21 Dec 13, 2022
Supreme Administrative Court 8
KHO:2026:64 KHO: Consent required for cookies and web requests; no CJEU referral needed A media company that provides news services did not request user context for the placement and use of cookies or certain web requests on several websites it managed. In June 2023,… Aug 27, 2026
1 As 183/2023-62 Health insurer must disclose aggregated patient treatment data under Free Access to OAKS Consulting s.r.o. (the company) provided consulting services concerning market access conditions for medicinal products and medical devices. Pursuant to the Czech Act on Free… Aug 4, 2026
N. 501417 Supreme Administrative Court · CE - N. 501417 Pour un RGPD Respecté, a French NGO that advocates for GDPR compliance, and three individuals requested the CNIL, the DPA, to partially repeal its 2020 recommendation on cookies… Jun 19, 2026
N. 433539 Several digital rights organisations asked the Prime Minister to repeal Decree No 2010-236 of 5 March 2010. The decree regulated an automated personal data processing system used by the French authority for freedom of communications (ARCOM, hereinafter the… CE - N. 433539 Apr 30, 2026
5 As 327/2022-48 The controller was the Police of the Czech Republic The data subject was a man who, in 2003, had been convicted of causing bodily harm and attempted murder committed in a particularly brutal manner and sentenced to 18 years'… NSS - 5 As 327/2022-48 Dec 15, 2025
473833 The DPA imposed an €8 million administrative fine on Apple (the controller) in 2022 (CNIL - SAN-2022-025) The DPA found that Apple used identifiers stored on users’ devices to enable personalized advertising in the App Store without first obtaining valid user consent, as required by… CE - 473833 Oct 10, 2025
III OSK 5037/21 DPA need not assess law's constitutionality or GDPR proportionality, only legal basis In March 2020, the Ombudsman requested the DPA to initiate proceedings regarding several laws that introduced an obligation for judges and prosecutors to declare their membership… Apr 29, 2025
451423 French Supreme Court reviews CNIL €35M cookie consent fine against Amazon The French DPA had received a complaint on 28 May 2018 regarding the lawfulness of processing by Amazon Europe Core ('Provider' or 'The company'). The French DPA had forwarded… Jun 27, 2022
Council of State 4
202406435/1/A3 Council of State: UWV did not need substantive physician review of rectification request UWV, the controller, is the Dutch employee insurance agency. In February 2023, the data subject requested the rectification of a medical report drafted by an insurance physician… Aug 26, 2026
202307578/1/A3 Council of State: Tax Authority adequately fulfilled GDPR access request on FSV The personal data of an individual was stored in the Fraud Detection System (FSV), an application used by the Dutch Tax Authority between 2012 and 2020 to record potential… Aug 5, 2026
202401622/1/A3 Council of State: Enschede Wi-Fi pedestrian tracking unlawful; DPA €600 fine upheld The Municipal Executive Board of Enschede, the controller, decided to conduct continuous pedestrian counts to obtain information about visitor numbers in the city centre. From 25… Jul 29, 2026
202203653/1/A3 Council of State: Tax Administration may process personal data from FIOD criminal The data subject’s personal data was processed by the Tax Administration because it suspected him of not fulfilling his tax obligations. This suspicion was raised after the Fiscal… Nov 13, 2024
Administrative Court Berlin 3
42 K 25/25 VG Berlin - 42 K 25/25 A Jehovah’s Witnesses congregation (the controller) sent another congregation an introductory letter containing the personal data of two members (the data subjects) who were… Jun 17, 2026
42 K 73/25 The controller ran 29 outdoor swimming pools in Berlin In summer 2023, the controller introduced expanded identity verification checks and video surveillance measures due to safety concerns, such as aggressive behaviour and verbal and… VG Berlin - 42 K 73/25 May 6, 2026
42 K 51.25 VG Berlin: DPA correctly found residential video surveillance for property protection The property management company of a high-rise building (the controller) had a video surveillance system installed at the entrances of the building in 2021. The installation was… Apr 20, 2026
Administrative Court of Cyprus 3
688/2022 Cyprus Court upholds DPA finding that Sigma TV unlawfully disclosed financial data On 13 March 2019, Sigma, a Cypriot TV channel operated within DIAS Media Group (ΕΚΔΟΤΙΚΟΣ ΟΙΚΟΣ ΔΗΜΟΣΙΑ ΔΙΑΣ ΛΙΜΙΤΕΔ), published a report disclosing financial information… May 26, 2026
14/2021 Cypriot court backs DPA fines of €40,000 each on football clubs and €25,000 on processor On 26 July 2021, a journalist informed the Cypriot DPA of a security vulnerability on an online platform. This online platform hosted ticket purchase sites of two Cypriot football… May 12, 2026
1181/18 Cyprus court annuls DPA order requiring access to confidential academic promotion files An assistant professor (the data subject) requested access to the content of evaluation reports by independent reviewers and letters of recommendation prepared during the academic… Dec 8, 2025
CE 3
449209 CE asks CJEU if GDPR one-stop-shop applies to ePrivacy cookie consent cases On 7 December 2020, the French DPA (CNIL) imposed two fines totaling € 100 million on Google LLC and Google Ireland Ltd for violating Article 82 of the French Data Protection Act… Jan 28, 2022
439360 French Conseil d'État strikes down GendNotes police app decree for excessive special data In February 2020 the French minister of the interior enacted the Decree No. 2020-151 of 20 February 2020 authorising the automated processing of personal data known as "mobile… Apr 13, 2021
449212 CE upholds CNIL competence to fine Google €100M for cookies despite no lead authority role On December, 7 2020, the French DPA imposed a financial penalty of 60 Million euros fine against Google LLC and a 40 million euros against Google Ireland Limited in accordance… Mar 4, 2021
Hoge Raad 3
24/02161 The data subject applied for a credit card in 2008 and was granted it In July 2020, the bank (controller) requested that the data subject identify themselves online by providing a copy of their ID and a digital selfie. A bank employee would then… 24/02161 Feb 21, 2025
ECLI:NL:PHR:2023:935 The data subject, an asset management professional, undertook an agreement with PME Investment Services The agreement was that the data subject would take over a housing project mediated by PME, and in return PME would be awarded a fee and a minor percentage of the subsequent sale… ECLI:NL:PHR:2023:935 Oct 20, 2023
22/01253 Dutch Supreme Court: patient not entitled to access peer-review assessment of medical file A patient (the data subject) was treated in a hospital. Because she believed that an error had been made, she held the hospital liable. The hospital involved its liability… Aug 26, 2022
Administrative Court Munich 2
M 32 E 26.3990 VG Munich: university may be GDPR controller for professors' editorial work emails The author of a manuscript (the data subject) submitted their text to an editorial office of a quarterly journal for review in November 2025. The journal was published by a… Aug 11, 2026
M 26a K 25.5210 Munich Court: §11(8) RBStV validly restricts Art. 15 GDPR access for broadcasting The data subject had been liable to pay broadcasting contributions to the Controller, a German regional public broadcasting authority, since 2007. Following objections to several… May 18, 2026
VwGH 2
VwGH Ro 2025/04/0007-7 VwGH: €18M DSB fine annulled — GDPR corporate fine requires identified culpable natural The controller was an address publisher and direct advertising company that operated a data application to provide advertisers with personal data for targeted marketing measures.… Jun 24, 2026
Ro 2022/04/0026 Austrian VwGH: hotel listings and user reviews on travel platform serve legitimate The data subjects, joint operators of a hotel and restaurant business, ran their establishment through a family business. The controller operates an online travel platform… May 17, 2024
BVerwG 2
6 C 13.18 Since 2016, SpaceNet AG, an ISP, has been challenging a German law which provides for an obligation to store traffic and location data of all users without any reason and across… Jul 24, 2026
6 C 1.24 BVerwG: Registration address blocking renewed for BaFin officers facing general unit The data subject was employed by the German Federal Financial Supervisory Authority (BaFin), the public authority responsible for supervising banks, financial service providers,… Nov 5, 2025
BVwG 2
W214 2235505-1 W214 2235505-1 On 02.06.2020, the complaining journalist requested information from the controller on the names and sums of all companies that received financial aid in the form of tax… Mar 11, 2024
W211 2230221-1 W211 2230221-1 The data subject filed a complaint with the Austrian Data Protection Authority (DSB) against the controller, requesting to be provided with recipients to whom the personal data… Sep 3, 2021
Rb. Den Haag 2
C/09/697386 / HA ZA 26-52 Den Haag District Court: 51 gamblers sue Unibet operator Risepoint over unanswered GDPR The District Court of The Hague (the Court) considered an action brought by 51 individuals who had participated in online gambling offered through the website Unibet before 1… Sep 2, 2026
C/09/689833 Kindred Group PLC and Risepoint Limited (the controllers) are companies that provide online gambling products Several companies within Kindred Group PLC (Risepoint was initially in this group) offered online gambling products before a national law requiring a license entered into force.… C/09/689833 May 27, 2026
Rb. Noord-Holland 2
C/15/376188 Rydo Telecom (the controller) is a telecommunications provider In 2023, a data subject made an access request following a dispute with the controller on whether the data subject received two phones they had purchased from the controller. The… C/15/376188 Jul 13, 2026
AWB-20_2618 The plaintiff received a tax assessment from the Dutch Tax and Customs Administration (i.e a letter in which it tells you how much you have to pay). She didn’t agree with its content, and therefore submitted an objection. The Tax and Customs Administration rejected the… AWB-20 2618 Oct 27, 2020
Rb. Rotterdam 2
ROT 25/8349, 25/8350, 25/6295, 25/6296 and 25/6297 Rotterdam court upholds municipality's refusal of excessive GDPR requests A data subject submitted 73 separate GDPR requests to the Municipal Executive of Rotterdam, the controller, between November 2024 and February 2025. Most requests contained… Aug 19, 2026
ROT 25/7371 ING Bank N.V. (the controller) is a bank In 2022, several data subjects brought a complaint to the DPA regarding the controller’s contactless payments. The data subjects requested the controller to issue debit cards… ROT 25/7371 Jun 24, 2026
High Court 2
2026 IEHC 640 High Court · 2026 IEHC 640 The Irish Council for Civil Liberties (ICCL), a qualified entity, brought a representative action against Microsoft Ireland Operations Limited concerning the processing of… Sep 25, 2026
2016 IEHC 323 High Court examines DPA inquiry into Meta's refusal of raw data access and portability On 25 May 2018, Michael Veale, the data subject, submitted an access and data portability request to Meta Platforms Ireland Limited (MPIL) (then Facebook Ireland Limited), the… Aug 21, 2026
LG Frankfurt 2
6 U 81/23 Frankfurt am Main Regional Court - Case Number 6 U 81/23. The court awarded €100 in non-pecuniary damages for the storage and processing of cookies without the consent of the individual. While the violation was considered minor, and the… Jan 13, 2026
2-03 O 4/19 LG Frankfurt: Wife of presenter not entitled to injunction against publication of her Τhe wife of a well-known German presenter had filed an action for injunction against the publication of the plaintiff's picture in two magazines. The reason and content of the… Dec 19, 2019
National Court 2
SAN 3154/2026 National court annuls DPA sanction against KFC Spain over website privacy information In May 2021, a data subject lodged a complaint with the DPA against KFC Restaurants Spain, S.L.U., the controller, concerning the processing of personal data through its website.… Jul 16, 2026
SAN 2996/2026 Audiencia Nacional: appeal against AEPD €2 million fine on Amazon Flex criminal record Unión General de Trabajadores (UGT), a trade union, lodged a complaint with the DPA (AEPD) against Amazon Road Transport Spain, S.L., the controller. Applicants wishing to work… Jul 8, 2026
Norges Høyesterett 2
2021-2403-A Norwegian Supreme Court: Legelisten.no has Art. 6(1)(f) legal basis for doctor reviews In 2012, a company "Legelisten.no AS" launched a website where people could submit anonymous reviews of healthcare personnel. From the same year, the Norwegian DPA Datatilsynet… Dec 7, 2021
2019-1226-A The person was sent to prison for tax evasion in the years 2001 to 2006 The district court has assumed that A withheld share gains together about NOK 4.7 million and assets of just over NOK 4.5 million from taxation. The tax benefit is stated in the… 2019-1226-A Jun 26, 2019
Supreme Administrative Court of Bulgaria 2
8426/2026 Bulgarian SAC: criminal record check for bank counsel role lawful under GDPR Art. 6(1)(c) The data subject was a candidate for the position of senior legal counsel at the Bulgarian branch of the German commercial bank Flatex Degiro (the controller). As a prerequisite… Jul 30, 2026
7890/2026 BAC (Bulgaria) - 7890/2026 A data subject lodged a complaint with the Bulgarian DPA (CPDP), alleging that her neighbour (the controller) was unlawfully monitoring her property through CCTV. She claimed that… Jul 13, 2026
Supreme Court 2
15625/2026 Cass.Civ. - 15625/2026 Istituto nazionale della previdenza sociale (INPS, the controller) is the Italian National Institute for Social Security. In 2021, the DPA fined the controller €300,000 for its… May 21, 2026
III CZP 78/19 III CZP 78/19 The parties were involved in social initiatives aimed at supporting or questioning the need for certain investments in the vicinity of the housing estate where they live. The… Aug 6, 2020
Administrative Court Düsseldorf 1
29 K 3490/24 VG Düsseldorf: data subjects challenge district's sharing of personal data in water-law A district (the controller), acting as the lower water authority, initiated administrative proceedings after identifying unauthorised riverbank works and a private jetty on two… Jun 22, 2026
Administrative Court Hannover 1
10 A 5144/23 VG Hannover: Controller appeals DPA reprimand over unlawful workplace video surveillance The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the… Aug 7, 2026
Administrative Court in Rijeka 1
Us I-755/2025-8 Rijeka Court: AZOP decision on media reporting of former Zagrebački Holding board The data subject was a member of the management board of Zagrebački holding, a company owned by the City of Zagreb, from 3 September 2021 until 31 March 2023. A television… Nov 11, 2025
ADMINISTRATIVE COURT OF CYPRUS 1
1421/2022 Cyprus court upholds €5,000 DPA fine on Pancyprian Judo Federation for Article 31 GDPR On 3 November 2021, a data subject filed a complaint with the Cypriot DPA against an individual who managed a club affiliated with the Pancyprian Judo Federation. The complaint… May 20, 2026
Administrative Court of the Grand-Duchy of Luxembourg 1
49701C Cour Administrative - 49701C On 19 May 2020, a Luxembourg bank informed the complainant that, by 30 June 2020, they would transmit the complainant's bank account information to the Luxembourg fiscal… Dec 12, 2024
Administrative Court of Zagreb 1
Us I-4772/2023-10 A utility and municipal services enterprise, Zagrebački Holding d.o.o (the controller) provided users of its services with the option to request a copy of their bill via email. Where the name appearing in the email address differed from the user’s… US Zagreb - Us I-4772/2023-10 Jul 22, 2026
Administrative Court Osnabrück 1
7 A 170/24 VG Osnabrück - 7 A 170/24 A firearms authority (the controller) sent the holder of a hunting license and a firearms ownership card (the data subject) information required under Articles 13 and 14 GDPR… Aug 19, 2026
Administrative Court Stuttgart 1
1 K 12737/25 VG Stuttgart orders deletion of SIS alert for refusal of entry under Art. 17 GDPR A resident of North Macedonia (the data subject) was expelled from German territory in September 2021, and a two-year ban on entry and residence was imposed on him. The data… Jul 14, 2026
Austrian Supreme Court (for Civil and Criminal Matters) 1
6Ob148/25w The controller runs an address publishing business as well as a credit information agency As part of its credit assessment activity, it (i) checks that individuals whose credit score is requested exist with data like their name and address and (ii) issues credit scores… OGH - 6Ob148/25w Aug 12, 2026
BVerfG 1
1 BvR 2853/19 BVerfG: Goslar Local Court violated right to lawful judge by denying CJEU referral in A data subject filed constitutional complaint because the AG Goslar (Goslar Local Court) denied his claims under Article 82 GDPR because of an unsolicited email. Because he only… Jan 14, 2021
Cologne Higher Labour Court 1
6 SLa 116/26 LAG Köln - 6 SLa 116/26 The data subject had applied for a secretary position in a human resources consulting company (the controller) in January 2025. He later filed a lawsuit claiming he had been… Jun 25, 2026
Court of Appeal 1
EWCA Civ 899 Vince v. Associated Newspapers Limited CA - EWCA Civ 899 Vince v. Associated Newspapers Limited Associated Newspapers Limited, the controller, published print and online articles in the Daily Mail and Mail+ on 8 and 9 June 2023 concerning a data subject. The articles were… Jul 15, 2026
Hof Amsterdam 1
200.324.736/01 The data subject had a business credit card issued by the controller In 2021, the controller asked the data subject to identify themselves online by taking a picture of the ID and then taking a selfie of themselves. The data subject wanted to… GHAMS - 200.324.736/01 Apr 30, 2024
Court of Appeal (Civil Division) 1
2026 EWCA Civ 1130 EWCA (UK) - 2026 EWCA Civ 1130 Three persons who had brought personal injury claims arising from road traffic accidents and whose personal and health data were included in a spreadsheet prepared for use in… Sep 2, 2026
Rb. Amsterdam 1
781904 ING Bank (the controller) is a bank One of the services the controller offers is to make contactless payments using an Android phone. This was initially done through its own app, however, the controller later… 781904 Jul 16, 2026
District Court of Nitra 1
53Cpr/1/2023 District Court of Nitra · Ss. v Nitra - 53Cpr/1/2023 A kindergarten teacher (hereinafter, the teacher) has been working for the Municipality of Malý Lapáš (hereinafter, the municipal school) since January 2016. On 4 July 2023, the… Feb 14, 2025
Rb. Overijssel 1
ZWO 25/2142 Police wrongly assessed access request under GDPR instead of Police Data Act On 5 January 2025, the data subject submitted an access request to the Chief of Police, the controller, concerning her personal data for the period between 1 January 2016 and 31… Jul 24, 2026
EWCA 1
A3/2015/307 Dawson-Damer v Taylor Wessing LLP This case concerns a data subject access request (SAR) under the Data Protection Act (DPA) 1998. The data subjects were beneficiaries under a trust. The data controller was a firm… Jul 17, 2026
EWHC 1
QB-2021-000923 EWHC (UK) - Johnson v Eastlight Community Homes Ltd The defendant is a provider of social housing, the claimant is one of its tenants. A third party requested a rent statement from the defendant. In response to the request, the… Nov 16, 2021
First-tier Tribunal 1
EA/2025/0298 FTT: Kent County Council FOIA refusal of Kent Test scores and DOB upheld On November 2024, a person (the requestee) made a request under the Freedom of Information Act 2000 to Kent County Council, the controller, concerning candidates who sat the Kent… Jun 2, 2026
First-Tier Tribunal 1
FT/EA/2024/0359 FTT allows appeal: NMC should have neither confirmed nor denied holding nurse's data A doctor submitted a freedom of information request to the Nursing and Midwifery Council, the controller, asking whether a named nurse had been struck off the register for… Sep 18, 2026
First-tier Tribunal, General Regulatory Chamber 1
FT/EA/2025/0312 FTT upholds UKIPO's FOIA withholding of copyright exception documents under s.27 A person (the applicant) submitted an FOIA request to the UK Intellectual Property Office (UKIPO), asking for all materials containing the exact phrase “Copyright and Database… Sep 18, 2026
BAG 1
8 AZR 169/25 BAG · 8 AZR 169/25 A company (the controller) commissioned a law firm to conduct a compliance investigation into alleged misconduct of a manager (the data subject) in August 2023. The investigation… Apr 16, 2026
Hof Arnhem-Leeuwarden 1
200.256.426 Court rejects DFW request for Ziggo customer IP addresses due to insufficient transparency DFW (a Dutch movie distributor) applies a protocol to its processing of personal data which was approved by the Dutch DPA before the GDPR came into force. DFW asked Ziggo (an… Nov 5, 2019
Helsinki Court of Appeal 1
HelHO:2026:8 HelHO - HelHO:2026:8 A company (A) requested information from the District Court of Eastern Uusimaa (Itä-Uudenmaan käräjäoikeus; the controller) regarding pending and closed criminal matters involving… Sep 7, 2026
High Court of Justice of the Basque Country 1
1713/2026 High Court of Justice of the Basque Country · TSJ PV - 1713/2026 The data subject had worked for Fineco Sociedad de Valores, SA and GIIC Fineco Sociedad Gestora de Instituciones de Inversión Colectiva, SAU, the controller, since 2004. The data… Jul 17, 2026
Higher Administrative Court of Saxony 1
7 C 35/24 OVG Sachsen - 7 C 35/24 The plaintiffs challenged a decision approving the amendment plan concerning the southern runway and apron at Leipzig/Halle Airport. During the proceedings, they sought permission… Jun 15, 2026
Higher Regional Court Cologne 1
15 W 55/26 OLG Köln - 15 W 55/26 The data subject, a doctor, sought an injunction against the Controller, the operator of an online review platform, requiring the removal of, and prohibiting the future… Jun 12, 2026
Higher Regional Court Munich 1
36 U 1054/25 e OLG München - 36 U 1054/25 e The data subject had used a social media platform operated by the controller, an Irish company, since 2013. The controller provided “Business Tools” to third-party website… Jun 26, 2026
Higher Regional Court Vienna 1
13R70/25x OLG Wien - 13R70/25x A data subject brought proceedings against a controller after it refused to provide, free of charge, digital copies of invoices and transaction data following an access request.… Dec 1, 2025
Hof van Beroep 1
2021/AR/1044 Court of Appeal of Brussels - 2021/AR/1044 The Belgian tax department appealed a decision of the Belgian DPA that was provisionally enforceable, and asked for the immediate suspension of the implementing measures already… Jul 16, 2021
Hof van Beroep Brussel 1
2019/AR/74 This case started as a conflict between neighbours The controller (Y) and the data subject (X) are/were inhabitants of the same neighbourhood. The controller experienced nuisance (soot gas infiltration) because the data subject… Court of Appeal of Brussels - 2019/AR/741 Jun 12, 2019
KHO 1
KHO-2026-65 KHO-2026-65: Document unavailable (broken redirect) Sfl deleted page KHO - KHO-2026-65 Broken redirect: Problems with Unicode :( Sep 9, 2026
LAG Schleswig-Holstein 1
6 Ta 49/22 The controller operated a care service where the data subject was employed The controller filmed the data subject in their work environment and published a thirty-six second video on Youtube for promotional purposes. The data subject had previously given… 6 Ta 49/22 Jun 1, 2022
LG Köln 1
28 O 168/22 The controller is an operator of a search engine If a user used specific keywords in a name-based search, the search engine showed search results that contained the following wording: "T ENTREPRENEUR, CMO AND VICTIM OF DOMESTIC… 28 O 168/22 Jul 4, 2022
LG Rostock 1
3 O 762/19 LG Rostock: Pre-ticked cookie consent boxes invalid under Art 6(1)(a) GDPR The German consumer organisation Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. (vzbv, the claimant) filed a lawsuit… Sep 15, 2020
Local Court Arnsberg 1
42 C 434/23 AG Arnsberg - 42 C 434/23 An Austrian citizen residing in Vienna (the data subject) subscribed to the newsletter of a family-run optician company (the controller) mainly operating in the German states of… Jul 1, 2026
Municipal Civil Court in Zagreb 1
Pn-877/2023-29 Zagreb court considers GDPR claim against Propuls d.o.o. over bank details in news article A data subject filed a lawsuit against Propuls d.o.o., the controller and publisher of the news portal direktno.hr, claiming that two articles published on 11 January 2023 and 31… Jan 16, 2026
NSS 1
OVG Berlin 1
OVG 3 S 24/20 OVG Berlin: Interim injunction denied for removal of student file documents A student, his/her parents and the school authority communicated a lot, this communication was requested to be deleted from the student´s file, as well as a copy of one report… Jul 1, 2020
PVN 1
2018-14 (15/01355) Personvernnemnda (Norway) - 2018-14 (15/01355) In 2017, the Norwegian DPA Datatilsynet found that a company "Legelisten", running an anonymous review website of healthcare personnel, lacked a legal basis for processing and… Jan 21, 2019
Rb. Midden-Nederland 1
UTR 21/3403 The controller is the Minister of Finance The data subject’s personal data was processed by the Tax Authority because it suspected him of not fulfilling his tax obligations. This suspicion was raised after the Fiscal… UTR 21/3403 May 9, 2022
Regional Administrative Court Bratislava 1
BA-6S/221/2019 Court upholds €50,000 fine on Sociálna poisťovňa for sending sensitive data by ordinary Sociálna poisťovňa, the social insurance agency (the controller), processes applications for foreign invalidity pensions and forwards related documents to the social insurance… Jun 25, 2025
Regional Court Frankfurt am Main 1
2-06 O 234/25 LG Frankfurt am Main - 2-06 O 234/25 A company operating a financial education portal and a YouTube channel with about 1,5 million subscribers and one of its co-founders (the plaintiffs) had repeatedly requested the… Sep 16, 2026
Regional Court in Warsaw 1
III C 904/23 SO Warszawa - III C 904/23 The Financial Ombudsman’s office (the controller) sent a letter containing the name, the address, and the case reference number of a customer (the data subject) to 28,366 public… Feb 16, 2026
SO Warszawa 1
C 310/23 SO Warszawa: Controller warned for violating GDPR Arts. 5(1), 6(1), and 15(1) Permanent link: The responsible party did not respond adequately and provided unclear information or referred the individual to third parties. As a result, the individual filed a… Jan 13, 2026
Sibiu Tribunal 1
703/2026 Sibiu Tribunal: rail company liable for refusal of CCTV access request On 5 June 2025, an individual (the data subject) made an access request under Article 15 GDPR to the Romanian National Railways Company, Societatea Națională de Căi Ferate SA (the… Jul 3, 2026
Superior Administrative Court Saarlouis 1
2 A 165/24 OVG Saarlouis - 2 A 165/24 The data subject was an employee, the controller was the employer. On 14 January 2022, the data subject requested access to personal data from the controller under Article 15… May 13, 2025
Supreme Administrative Court of Finland 1
HFD:2021:125 Korkein hallinto-oikeus (Finland) - KHO:2021:125 The Regional Government of Åland had appointed Mr A as head of the regional Ålandic DPA for a probationary period of one year. Pursuant to section 10(2) of the Act on Public… Sep 10, 2021
Supreme Civil Court 1
21-20.979 Supreme Court: production of third-party personal data must be indispensable and A data subject initiated civil proceedings against its employer (the controller). The data subject alleged wage and trade union discrimination. In first instance, the court… Oct 3, 2024
Svea Court of Appeal 1
T 10711-21 Svea Hovrätt - T 10711-21 The data subject was a client of a bank (the controller). In 2020, the controller terminated their bank account based on "poor customer knowledge". Consequently the data subject… Oct 7, 2022
The Supreme Administrative Court of Finland 1
KHO:2026:65 Finnish Supreme Administrative Court: cookie banner with harder "Reject All" violates A media company (the controller) utilised a two-layer banner to request user consent for the use of cookies on the website of a magazine specialised in language owned by the… Aug 27, 2026
Tribunal of Bologna 1
RG 12124/2020 Tribunal of Bologna orders Comet s.p.a. to fulfil data subject's Art. 15 GDPR access A data subject made an access request to Comet s.p.a., the controller, to verify the lawfulness of the processing of her personal data for marketing purposes. In particular, she… Jul 30, 2022
VG Ansbach 1
14 K 19.01274 VG Ansbach: Lawyer not required to redact client data when submitting files to court In December 2018, the data subject filed with the DPA (the defendant in this case), a complaint under Article 77 GDPR against a lawyer who had represented the data subject in a… Sep 22, 2021