The court ruled in favor of the defendant. The court found that the documents were relevant to the plaintiff's employment history and should be kept. The court also found that the plaintiff did not have a legitimate interest in having the documents removed. First there is a moot point: Even if the court ruled in the plaintiff's favor, it wouldn't change anything. The defendant already agreed to remove the documents. Also there is no legal basis: the laws cited by the plaintiff (§§ 112 & 113 BBG and GDPR) don't guarantee removal of documents unless proven false or irrelevant. Personnel files aim to present a complete picture of the employee's history, including disciplinary actions. Removing documents generally goes against this goal. There is only an exception for serious misconduct: only serious misconduct accusations might warrant removal to allow for future career advancement without the burden of past issues. In simpler terms, the court ruled that since the documents were already being removed, there was no need for a formal decision.

VGH München - 6 ZB 23.530


holding_ANSPDCP (Romania) - Fine against Enel Energie Muntenia SA

The DPA found that the controller did not adopt sufficient security measures under Article 32 GDPR, which led to the unlawful disclosure a customers personal data to another customer. The DPA fined the controller €10,000 for this data breach.
The DPA further noted that the security incident should have been notified within 72 hours from the moment the controller became aware of it under Article 33 GDPR. Thus it issued a warning as the controller failed notify the DPA.
In addition, the DPA ordered the controller to:
  * implement approperate technical and organisational measures, in particular to train it's employees to work GDPR-compliant;
  * contact the complainant to request them to take steps to delete, destroy, as appropriate, personal information to which they had access;
  * adopt internal measures to mitigate the risks to which the data subject's personal data was exposed, to prevent future unlawful disclosure or access to their personal data.


holding_Datatilsynet (Denmark) - 2020-441-4364

The Danish DPA found that Zoo has not complied with Article 32 (1) of the GDPR by failing to implement an appropriate level of security of the login page for annual cardholders. The DPA advised to introduce a procedure that ensures regular assessment of the effectiveness of the security measures.
Furthermore, the DPA stated that the Zoo did not notify properly about the measures taken to deal with the breach and thus failed to comply with Article 33 (3) of the GDPR.
The DPA assessed that the Zoo did not comply with Article 34(1) of the GDPR by failing to carry out an adequate assessment of the risks posed to the data subjects. The communication provided by the Zoo to the annual cardholders was incomplete and inaccurate.
In the view of the DPA, a communication of the data breach only via a website to some of the data subjects constitutes a breach of Article 5(1a) of the GDPR.
The Zoo has been ordered to rectify the incomplete communication to all data subjects and to inform the data subjects of the breach in cases where there was a high risk. If the Zoo finds that it is not possible or requires a disproportionate effort to make an individual notification of the data subjects, the communication can be made by public announcement or similar measure.

Datatilsynet (Denmark) - 2020-441-4364


holding_Datatilsynet (Denmark) - 2020-431-0061 (Helsingor decision no. 4)

The DPA temporarily suspended its processing ban against Helsingor municipality until 5 November 2022, and also ordered the municipality to:
  * Change the data processing agreement with Google so that the DPA's remarks in their 14 July and 18 August decisions, are implemented. This includes, at a minimum, a clarification of where and if Google acts as a sole controller and any uncertainties that may entail that Google acts beyond their role as a processor, see Article 28(3)(a) GDPR.
  * Document that all transfers of personal data to insecure third countries, are in line with the GDPR.
  * Describe all data flows and identify the personal data that are shared with the vendor, and clarify when the vendor acts as a sole or joint controller. This documentation must include the whole technology stack used by the municipality (for this processing activity).
  * Update their data protection impact assessment based on all identified risks.
  * Consult the DPA if the DPIA shows any high risks the municipality is not able to mitigate.
  * If any processing activities are still not in line with the GDPR before the DPA's deadline 3 November 2022, present a final plan for bringing them in line with the GDPR.


holding_Datatilsynet (Norway) - 21/03656

The DPA rejected the controller's views as it argued that the exceptions in Article 14(5) GDPR should be interpreted and applied narrowly and it is not sufficient to “assume” that a data subject has received the information required under Article 14 GDPR, as the controller did in this case. In addition, the DPA found the controller's privacy policy to be incomplete and misleading.
The controller did not raise any arguments to contest the DPA's conclusions and informed the DPA that it was in the process of updating their privacy policy, internal documentation and routines.
The DPA held that the controller had violated Article 14 GDPR and ordered it to take measures to ensure that data subjects, including shareholders whose personal data are processed pursuant to the Norwegian Public Limited Liability Companies Act, are provided with all of the information required by Article 14 GDPR, including by amending its privacy policy as necessary. The controller was also ordered to inform the DPA about its measures taken within four weeks.

Datatilsynet (Norway) - 21/03656


holding_Rb. Noord-Nederland - C/18/190912/HA RK 19-19

The data processing of Google is based on Article 6(1)(f). The content of the page linked to also has to be taken in account. Article 10 GDPR states that processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out in principle only under the control of official authority. When a trade-off has to be made, based on Article 17 and 21, plaintiff's right to privacy shall normally outweigh Google's economical interests. In this case, it is relevant what the CJEU has determined in CJEU - C-136/17 - GC et al v. CNIL paragraphs 46, 47, 66, 67, 68, 76, 77, 78 and 79.
Plaintiff has been convicted for murderer committed in 2006. While the jail time has ended, the involuntary commitment had not been ended yet. Publicity which involved naming the full name of plaintiff are caused by his own actions. Plaintiff did not explain why the search results cause harm at this moment, considering the involuntary commitment is not finished yet. The search results do not point to wrong information in any way. The information, even from 2006 is still relevant.
The request will be rejected, because the conditions from Article 17(1) GDPR are not met. Listing of the search results shown after searching for the name of the plaintiff are required to protect the freedom of expression and information as defined in Article 11 Charter of Fundamental Rights of the European Union. This means the situation as described in Article 17(3)(a) GDPR applies.


The Council of State validated most of the interpretations or recommendations provided in the guidelines:
- Individuals should be able to decline to give consent as easily as to give consent; Individuals must be able to withdraw their consent as easily as they gave it; - User consent should be given for each purpose, which implies specific information; - Individuals must be informed of the identity of the controllers depositing cookies; the list containing the identity of the controllers must be made available to them at the time consent is obtained and must be regularly updated; - Data controllers must be able to demonstrate that they have obtained valid consent to the CNIL.
However, in its decision of 19 June 2020, the Council of State suppressed a paragraph in which the CNIL considered that the Internet user should not suffer major inconvenience in the event of the absence or withdrawal of consent. The CNIL considered in particular that access to a website could never be subject to the acceptance of cookies ("cookie walls").
The Council of State considered that by deducting this general prohibition from the GDPR, the CNIL had gone beyond what is legally possible with guidelines, which are an instrument of "soft law".

CE - N° 434684


The Regional Court of Essen rejected the data subject's claim entirely.
Regarding the notification letters, the court concluded that the data subject has no right to access under Article 15 GDPR , because the notification letters are standardised letters sent to every policy holder and, therefore, not personal data under Article 4(1) GDPR. Moreover the court found that the controller can refuse to act on the request according to Article 12(5)(b) GDPR, because the request is excessive. The court held that the "repetitive character" of a request is just an example under Article 12(5) GDPR and that an access request can also be considered excessive if the request does not serve the purpose of verifying the lawfulness of the processing as stated in Recital 63. The court then established that the data subject's request does not serve this purpose but solely aims at verifying the validity of the premium increases.

LG Essen - 18 O 204/21


The DSB held that at a legal person has the constitutional right to data protection under § 1 DSG (Austrian Data Protection Act) and is entitled to lodge a complaint before the DSB if these rights are violated. The DSB further held that the procedural provisions of the DSG - which deal with the procedure before the DSB - also apply regarding data protection complaints lodged by legal persons.
The DSB reasoned as follows:
  * §1 DSG has a wider scope of applicability than Article 8 GRC (the latter only protects natural persons).
  * As Article 16(2) TFEU leaves it to member states to grant data protection rights to legal persons as well as long as this does compromise the level of protection of the GRC, nor the primacy, unity and effectiveness of Union law.
  * The provisions of the DSG - which deal with the procedure before the DSB - must also apply on legal persons because the Austrian legislator cannot be accused of treating legal persons grossly disadvantageously differently from natural persons in the pursuit of their constitutionally guaranteed rights without comprehensible reason.
In conclusion, the DSB held that the company was entitled to lodge a complaint, but rejected the complaint on the merits of the case as there was no violation of data protection rights granted by § 1 DSG.

DSB (Austria) - 2020-0.191.240


The Spanish DPA (AEPD) held that:
  * i) the lack of sufficient information on the first layer of the cookie banner,
  * ii) the lack of information as to the type of cookie and the time it remained active,
  * iii) as well as the absence of a "refuse all cookie" option
constituted a breach of Article 22(2) of the Spanish Law on Services of the Information Society and Electronic Commerce (LSSI).
The Spanish DPA therefore imposed a warning sanction on the defendant, ASOCAPAC. The DPA also outlined that the defendant had a month to modify the cookie banner and introduce a new cookie policy.

AEPD (Spain) - PS/00264/2020


holding_RvS (Netherlands) - 202006082/1/A3

The Council of State declared the appeal unfounded.
The District Court rightly decided that the Municipality had reason to doubt the identity of the appellant on the basis of Article 12(6) GDPR. This is apparent from the way in which the appellant's request was submitted, namely the words "beneficiary of [appellant]', and 'Beneficiary, Authorized Agent and Representative for the legal fiction [appellant]', as well as from the fact that the appellant did not comply with the request for identification.
Contrary to what the appellant argued, the fact that the Municipality sent correspondence to his home address did not alter the fact that it could reasonably have doubts about his identity. It is true that only the appellant lives at the address in question, but this does not necessarily mean that he is also the person who made the request. Other persons could live at that address who are not registered there and who can send letters on behalf of the appellant. The residential address therefore does not automatically provide a definitive answer about the identity of the applicant.
Further, the fact that the municipality, as argued by the appellant, has not objected in other proceedings to the way in which he arranged his requests and has even previously used the description 'beneficiary of [appellant]', does not affect the fact that that in this case the Municipality could have reasonable doubts about his identity. The Municipality rightly stated that under the GDPR, it is important that it ascertains his identity. The aim of the GDPR is to strive for high protection of personal data.
The Council of State also emphasised that the nature of the data requested has no bearing on the applicability of Article 12(6) GDPR, and he Municipality did not have to take into account the sensitivity of the data requested. The appellant also has not argued that there is an objective obstacle for him to submit his application via DigiD or to identify himself at the town hall. The District Court therefore rightly considered that the information required by the Municipality was proportionate.

RvS (Netherlands) - 202006082/1/A3


With regard to the Schrems II decision:
The French Court outlined relevant segments in the the Schrems II CJEU decision. In this case, the CJEU held that Articles 46(1) and 46(2)(c) GDPR must be interpreted as meaning that a data subject, whose personal data is transferred to a third country, benefits from a level of protection essentially equivalent to that guaranteed by the GDPR and the EU Charter of Fundamental Rights.
The French Court also highlighted that the CJEU held that the Privacy Shield adequacy decision (adopted as per Article 45(3) GDPR) was invalid. It was deemed invalid as it did not provide an adequate level of protection to personal data transfers from the EU to companies in the US. This is notably because public authorities in the US are able to request access to such personal data as a result of surveillance laws: Article 702 Foreign Intelligence Surveillance Act (FISA) or the Executive Order (EO) 12333. These law allow for bulk collection of personal data. They do not allow a data subject to enforce any rights before a tribunal.
With regard to national law relating to collection and processing of data:
The French Court outlined that Article L. 1462-1 of the public health code provides for the Health Data Hub and the collection of health data from the existing national health data system (as per Article L. 1461-1).
Article L. 3131-1 of the public health code stipulates that the Health Minister can prescribe an Order in the public interest in case of a public health emergency, such as a pandemic. This order must be proportionate and necessary. As such, a Ministerial Order of the 10 July 2020 prescribed measures necessary to combat covid-19, including the processing of personal data concerning health (see Article L. 3131-16 public health code)
With regard to the risk of transfer of data due to the contractual arrangement with Microsoft:
The French Court stipulated the FISA and EO allows US public authorities to have access to transfers of data to the US from the EU without such appropriate safeguards for data subject. Therefore, any transfer of data to the US would be deemed to infringe Article 44 and subsequent of the GDPR, following the recent Schrems II decision by the CJEU. This is the case unless justified within derogation pursuant to Article 49.
The Court highlighted that the contract with Microsoft stipulates that data must not be processed outside of the stipulated geographical zone (Netherlands). This is true unless resolution of issues must be achieved outside of this zone subject to authorisation by the Health Data Hub. However, the Minister for Solidarity and Health introduced a Order of the 9th October 2020, which stipulated that no data transfer outside of the EU would be performed. The French Court therefore outlined that this imposed on a barrier on the contractual arrangement with Microsoft which allowed for such a possibility. Therefore, the Court deemed that there was no possibility of transfer of personal data outside of the EU as a result of the contract. The claimant’s claim that there was an interference with fundamental rights, including to data protection, is not well founded.
With regard to the risk of other transfers of personal data:
The Court addressed the claimant’s concern that Microsoft, as an American company, is subject to FISA and EO. This means that it can be under the obligation to transfer data to American public authorities even if the data is stored in the EU and the contract between the Health Data Hub and Microsoft preclude such transfers. The Court held that it was necessary to consider the level of protection afforded during the transfers of data in light of the contractual stipulation, the law in the third country and the judicial system there.
The Court highlighted that the French DPA (CNIL) stipulated in its defense that the risk of a transfer to the US by virtue of US surveillance law could not be excluded. This would subsequently infringe Article 28 and 48 GDPR which prohibit transfers to third countries unless agreed upon by the data controller or as a result of a legal obligation provided for in EU law or a Member State’s law.
However, the French Court outlined that the CJEU in Schrems II only discussed circumstances where data is transfered to the US and did not discuss circumstances where such data is processed in the EU by American corporations subject to US law. The French Court also noted that the CJEU held that derogations found under Article 49 may allow for such transfers where necessary for a public interest recognised by EU law or the law of a Member State. It also deemed that there was public interest in allowing the use of health data in the context of the Covid-19 crisis and therefore, public interest in contracting with Microsoft on the technical aspects. The Court noted that such measures must be proportionate to the risk posed by the public health emergency and necessary considering the urgency and the absence of technical alternatives. The Court highlighted that it is the French DPA which must assess any potential public interest in link with the Covid-19 pandemic.
The French Court also outlined that the claimants only claimed that there was a risk of a violation of the GDPR should Microsoft have to grant access to personal data to US public authorities rather than claiming a direct violation of the Regulation.
The Court stipulated that the Health Data Hub must ensure that the data processor, Microsoft, adopts appropriate technical and organisational measures to ensure the protection of the rights of data subjects (pursuant to Article 28 GDPR). In light of this Article, Microsoft must also provide all information required and allow audits to be conducted.
The Court therefore did not order the suspension of the Health Data Hub.

CE - N° 444937


The HDPA found, first of all, itself competent to decide on the case as the personal data collected (a) has not been characterised as "classified information" (b) nor does it relate to activities concerning national security, as required by the national Data Protection Act.
Then, the HDPA rejected the complaint as it found the processing necessary for the protection of military facilities and thus lawful according to Articles 6(1)(e) and 9(2)(g) GDPR.
Lastly, the HDPA imposed the corrective measure of Article 58(2)(d), ordering the Military Hospital to appoint a DPO.

HDPA (Greece) - 20/2020


The Court upheld the appeal and ordered the controller to pay € 2,500, - as non-material damages to the data subject.
First, the Court considered that the controller violated Article 32(1) and Article 5(1)(f) GDPR because it failed to implement sufficient organisational measures to ensure an appropriate level of data protection. In this regard, the Court considered Article 82(4) GDPR and noted that it is irrelevant whether the security deficiencies of CodeShip could be attributed to controller. Due to the quality and sensitivity of the stored data, as well as the scope of access, it was negligent of controller to rely on CodeShip to have erased the access information, without checking this with CodeShip and/or changing the access information themselves.
Second, the Court found that it is also not relevant that controller immediately took all necessary measures to exclude further unlawful access to the digital document archive after the incident, since they should have done so immediately after the termination of the business relationship with CodeShip.
Third, the Court stated that the requirement of causality between the GDPR breach and the damage, laid down in Article 82(1) GDPR, had been fulfilled. This requirement is not sufficed if damage occurred, but did not result directly from a breach of the controller (OLG Stuttgart, judgment of 31 March 2021, ref. 9 U 34/21). However, in this case, the Court noted that the damage would not have occurred if controller would have taken sufficient organisational security measures.
Lastly, the Court considered that Article 82 GDPR also covers non-material damage like the “loss of control over data” (which is mentioned as example in recital 75). In this regard, the Court considered the judgement of LG Essen, judgement of 23.9.2021 - 6 O 190/21, and held that in this case, there is not only an "insignificant or perceived violation of personal rights", and that identity theft is obviously sufficient for a claim for damages. Because the data subject’s personal data had not yet been misused, however, the Court considered that the amount of € 2,500, - was appropriate.

LG München - 31 O 16606/20


The Belgian DPA reminded the defendant that, notwithstanding the fact that notary was one of the professions allowed to consult the national register for natural persons, they should, pursuant to Article 3 of the Belgian law for organising a national register for natural persons, always do so for tasks that fall within their competence and are specific to the performance of their notary assignments.
The register should therefore not be used for tasks that are common to any employer, such as sending mail to their employees or former employees. By consulting the national register for that purpose, the defendant processed data unlawfully, thus going against Article 6 combined with Article 5(1)(a) GDPR.

APD/GBA (Belgium) - 48/2021


holding_Rb. Midden-Nederland - ECLI:NL:RBMNE:2023:6043

The Court held that the controller was in violation of Article 12(3) GDPR, as they had failed to respond to the data subject's access request within the one-month deadline.
The Court noted that, while the controller did respond with a request for more information, this response was after the one-month deadline established by Article 12(3) GDPR. Usually, a request for more information would have suspended the one-month deadline. However, in this case it was not suspended, as the response was done after the deadline had passed. The Court further held that there was no infringement of Article 15 GDPR, as the data subject did not respond to the controller's request for more information. As such, the controller was entitled to set aside the access request on 10 February 2023.
As a result, the Court held that the controller was liable for damages for their violation of Article 12(3) GDPR, and awarded the data subject €707 in damages. The amount awarded was calculated on the basis of domestic administrative law, as the controller (the University of Utrecht) is an administrative body.


Noting that the company had not actively cooperated and had failed to implement the required measures within the prescribed period, as spelled out in the formal notice, the CNIL imposed a fine of €3,000 on the company Société nouvelle de l'annuaire français.
More specifically:
  * concerning Article 16 GDPR (right to rectification), it was found that the company had failed to follow up on a data subject's request to rectify his postal address from his personal to his professional address within the prescribed period. The deadline for rectifying the personal data of the complainant had been largely exceeded as the company's director implemented the required measures in July 2021, whereas the deadline expired in September 2020;
  * concerning Article 17 GDPR (right to erasure), it was also found that the erasure requests of several data subjects had not been processed within the prescribed period. Several requests which were supposed to have been processed had, in fact, not been followed up on, even after the formal notice period had expired. The CNIL considered that if the data controller had indeed reinitialized its database by taking only the INSEE data, this was not sufficient to ensure that the requests were taken into account;
  * concerning Article 30 GDPR (record of processing activities), it was found that the company had failed to create and complete a record of processing activities although processing a large amount of personal data constituted the core of its activity.

CNIL (France) - SAN-2021-014


The court issued its final judgment on 20 September 2023 and held that, since the access request by the data subject was drafted in general terms and had a broad scope, the defendant correctly replied with a general overview of the personal data and criminal records about him being processed. The plaintiff objected to this response and the defendant asked him to specify his request in line with Recital 63 GDPR. As the plaintiff again answered in general terms, claiming he requested access to all his personal data, the court held that the defendant was right in replying in broad terms too. When the plaintiff substantiated his request at the appeal hearing, mentioning specific data he wished to have access to, the court held that it was too late and he should have mentioned this at the time of objection or submit a new request.
Further, upon hearing the defendant on its search operations, the court held that the defendant did carry out a sufficiently complete research when looking for the plaintiff’s personal data in its possession.
As regards the provision of copies of personal data of the plaintiff under Article 15(3) GDPR, making reference to CJEU C-487/21, the court specified that a right to obtain a copy of one’s personal data does not constitute an obligation for an administrative body to provide copies of documents entailing the data subject’s personal data. The latter can choose to provide an understandable reproduction of such data as long as a copy of the documents is not indispensable for the data subject to exercise his rights under the GDPR. The court held in this respect, that the plaintiff did not make it clear in his request that the data was indispensable for him to exercise his rights, hence the defendant was not bound to provide him with a copy of his personal data.
As regards the plaintiff’s criminal records, the court also held that he had no right to obtain a copy thereof under the WJSG.
In light of the above, the court declared the appeal to be unfounded as the defendant had answered in a complete and clear manner to the plaintiff’s access request.

Rb. Amsterdam - 22/4916


holding_Garante per la protezione dei dati personali (Italy) - 10065894

First, The DPA pointed out that video surveillance by natural persons can be exempt from GDPR when used for purely personal purposes under Article 2(2) GDPR. However, this exemption only applies when cameras are limited to the controller's own property and immediate surroundings.
In examining the footage, the DPA found that the controller's cameras captured areas beyond their immediate property, including neighbors' doors and windows. This meant the processing could not benefit from the household exemption under Article 2(2) GDPR.
Furthermore, since the controller lacked any valid legal basis for capturing these third-party areas, the DPA found a violation of Article 6 GDPR. The processing also violated the principle of lawfulness under Article 5(1)(a) GDPR, as filming neighbors' private areas without proper justification went against fundamental data protection principles.
Based on these violations, the DPA ordered the controller to adjust the cameras' viewing angle to exclude neighbors' private areas within 90 days and imposed a fine of €400.


holding_ANSPDCP (Romania) - Fine against Global Ports’s Services S.R.L.

First, the DPA found that this processing activity lacked of legal basis. More specifically, the DPA pointed out that the controller had not proven that it had previously used other less intrusive methods to achieve the purpose of the processing. Therefore, it found a violation of Article 5(1)(a), 5(1)(c), 5(2) and 6 GDPR.
Secondly, the DPA noted that the controller did not provide data subject with the information set by Article 14 GDPR. Therefore, it found a violation of this article in combination with Article 12 GDPR.
Finally, the DPA pointed out that the controller had stored the data for a period of 6 months, which exceeds the period of 30 days set by Article 5(1)(e) of the national law implementing GDPR (Lege nr. 190/2018). Therefore, it found a violation of Article 5(1)(e) GDPR.
On these grounds, it fined the controller RON 9,947.60 (€2,000).


holding_Datatilsynet (Norway) - 20/02368

The DPA held that the controller lacked a legal basis as per Article 6(1)(f) GDPR for accessing and monitoring the data subject's email inbox, that they had failed to provide required information to the data subject as per Article 13 GDPR and for failure to assess the data subject's objection as per Article 21 GDPR. For this, the DPA fined the controller €9,775 and required them to improve internals controls for employee emails as per Article 24 GDPR.

On the legal basis
First, the DPA assessed if the controller had a legal basis as per a national (Norwegian) regulation concerning employers' access to employees' inboxes and other electronically stored material, which allows such processing if one of two possible conditions are fulfilled. First, the DPA found that "upholding customer relations and daily operations" and "suspicion of violations of work duties", as argued by the controller, are legitimate purposes as per the regulation §2(1). However, this only allows for single accesses for a specified purpose. Automatic enabling of forwarding is considered as continuous surveillance and the processing could therefore not be based on this condition.
Continuous surveillance is regulated by §2(2), but solely for purposes of administrating the computer network or to uncover or solve security breaches in the network. Consequently, the processing could not either be based on this condition.
Further, the DPA found that the conditions in Article 6(1) GDPR was not fulfilled. The only available legal ground for this type of processing is Article 6(1)(f) GDPR, where three conditions must be fulfilled: the processing must be necessary for legitimate interests, and these interests must outweigh the rights and freedoms of the data subject.
The DPA had already concluded that the purposes were legitimate. However, they held that the purposes could have been achieved by less privacy-invasive measures, for example by deactivating the email inbox and/or enable automatic forwarding themselves. Consequently, the DPA held that the controller lacked a valid legal basis as per Article 6(1)(f) GDPR.

On the right to object
The DPA found that the controller was unable to demonstrate that they had considered the data subject's objection, or that they had conducted a specific legitimate interest assessment in line with Article 21 GDPR.

On the obligation to inform data subjects
The DPA held that it is highly likely that the controller had violated the right to information as per Article 13 GDPR.

Datatilsynet (Norway) - 20/02368


holding_DPC (Ireland) - Meta Platforms Ireland Limited (Instagram) - IN-18-5-7

In the Final Decision, the DPC identified four issues which had to be addressed (three issues the DPC intended to address and an additional issue on which the EDPB directed the DPC to make a finding).

Issue 1 – Whether clicking on the “Agree to Terms” button constitutes or must be considered consent for the purposes of the GDPR and, if so, whether it is valid consent for the purposes of the GDPR
The DPC identified the first issue as consisting of two parts: “first, whether clicking the ‘Agree to Terms’ button actually constitutes consent for the purposes of the GDPR and, second, whether the act of clicking ‘Agree to Terms’ necessarily must be considered consent for such purposes” (34).
On the first point, the DPC accepted Meta IE’s argument and proposed, by way of its Draft Decision, to conclude that “as a matter of fact, Meta Ireland did not – and did not seek – to rely on consent as the legal basis for all processing” (46).
Regarding the second point, the DPC held that Meta IE was also not legally obliged to rely on consent as the legal basis for processing of personal data in this context. The DPC emphasized that there is no hierarchy of legal bases for the processing of personal data under the GDPR, any implication otherwise would be “inherently problematic”, and “[no] one ground has normative priority over the others” (51).
However, in its binding decision the EDPB instructed the DPC to remove its conclusion on finding 1 (EDPB - 203), stating as follows:
“The EDPB agrees with the IE SA and Meta IE that there is no hierarchy between these legal bases. However, this does not mean that a controller, as Meta IE in the present case, has absolute discretion to choose the legal basis that suits better its commercial interests. The controller may only rely on one of the legal basis established under Article 6 GDPR if it is appropriate for the processing at stake" (EDPB - 107). “[The DPC] cannot categorically conclude… that Meta IE is not legally obliged to rely on consent to carry out the personal data processing… without further investigating its processing operations, the categories of data processed, and the purposes they serve” (EDPB - 202).
Accordingly, the DPC made no finding on the matters encompassed by their assessment of issue 1.

Issue 2 – Whether Meta Ireland could rely on Article 6(1)(b) GDPR as a lawful basis for processing of personal data in the context of the Terms of Use and/or Data Policy
The second issue concerned whether Meta IE could rely on Article 6(1)(b) GDPR as the lawful basis for processing of personal data. In order to do so, the controller had to demonstrate that such “processing is necessary for the performance of a contract to which the data subject is a party”.
Taking into account the complainant’s submissions, the EDPB guidelines and the framing of Article 6(1)(b), the DPC acknowledged that “consideration of the meaning of the term ‘contract’ within a data protection context is required”. However, the DPC also asserted that an assessment of the terms “necessary” and “performance” is also required, and they “do not have competence to consider substantive issues of contract law, and, accordingly [their] analysis is limited to the specific contract entered into by the named data subject and Meta Ireland in respect of the Instagram service” (87). The DPC took a broad approach in determining what is necessary for the performance of a contract based on what is “reflected in the terms of the precise contract between those parties” (95). The DPC explained that, in their view, “the core of the service offered is premised on the delivery of personalised advertising” (106) and proposed to conclude that “Meta Ireland may in principle rely on Article 6(1)(b) as a legal basis of the processing of users’ data necessary for the provision of the Instagram service, including through the provision of behavioural advertising” (116).
When issuing its Binding Decision, the EDPB, emphasised "the complexity, massive scale and intrusiveness of the behavioural advertising practice that Meta IE conducts through the Instagram service" (EDPB - 99). With regard to Article 6(1)(b) GDPR as a lawful basis for data processing and the determination of what is necessary for the performance of a contract, the EDPB stated as follows:
"The GDPR makes Meta IE, as a data controller for the processing at stake, directly responsible for complying with the Regulation’s principles, including the processing of data in a lawful, fair and transparent manner, and any obligations derived therefrom. This obligation applies even where the practical application of GDPR principles… is inconvenient or runs counter to the commercial interests of Meta IE and its business model” (EDPB - 108).
"The EDPB agrees that SAs do not have under the GDPR a broad and general competence in contractual matters. However, the EDPB considers that the supervisory tasks that the GDPR bestows on SAs imply a limited competence to assess a contract's validity, insofar as it is relevant to the fulfilment of their tasks under the GDPR… the SAs would thus be obliged to always consider a contract valid, even in situations where it is manifestly evident it is not" (EDPB - 112).
"...the concept of necessity has its own independent meaning under EU law. It must be interpreted in a manner that fully reflects the objective pursued by an EU instrument, in this case, the GDPR" (EDPB - 119).
Turning to the facts of the case, the EDPB outlined a number of factors which, in contradiction to the view of the DPC, support the argument that data processing for personalised advertising is not essential to the contract between Meta IE and users of Instagram. Firstly, "Meta IE promotes... the perception that the main purpose of the Instagram service serves and for which it processes its users' data is to enable them to share content and communicate with others" (EDPB - 120). The EDPB also takes into account Article 21(2) and (3) GDPR, "the absolute right available to data subjects... to object to the processing of their personal data for direct marketing purposes". Because this right exists, "the processing cannot be necessary to perform a contract [as the] subject has the possibility to opt out from it at any time, and without providing any reason" (EDPB - 125). The EDPB continues, outlining the inherent risk of a finding in the DPC’s decision that Meta IE can process personal data on the basis of Article 6(1)(b):
“...there is a risk that the Draft Decision’s failure to establish Meta IE's infringement of Article 6(1)(b) GDPR, pursuant to the [DPC]'s interpretation of it, nullifies this provision and makes lawful theoretically any collection and reuse of personal data in connection with the performance of a contract with a data subject" (EDPB - 134). "As a result, owing to the number of users of the Instagram service, the market power, and influence of Meta IE and its economically attractive business model, the risks derived from the current findings of the Draft Decision could go beyond the Complainant and the millions of users of Instagram service in the EEA and affect the protection of the hundreds of millions of people covered by the GDPR" (EDPB - 135).
In light of all of the above, the EDPB directed the following:
“...behavioural adveritising performed by Meta in the context of the Instagram service is objectively not necessary for the performance of Meta IE's alleged contract with data users for the Instagram service and is not an essential or core element of it" (EDPB - 136). "Meta has inappropriately relied on Article 6(1)(b) GDPR to process the complainant's personal data in the context of the Instagram Terms of Use and therefore lacks a legal basis to process these data for the purpose of behavioural advertising. Meta IE has not relied on any other legal basis to process personal data in the context of the Instagram Terms of Use for the purpose of behavioural advertising. Meta IE has consequently infringed Article 6(1) GDPR by unlawfully processing personal data” (EDPB - 137).
Accordingly, under instruction from the EDPB, The DPC altered “Finding 2” of its Draft Decision, finding that “Meta Ireland was not entitled to rely on Article 6(1)(b) GDPR to process the Complainant’s personal data for the purpose of behavioural advertising in the context of the Instagram Terms of Use”.

Issue 3 – Whether Meta Ireland provided the requisite information on the legal basis for processing on foot of Article 6(1)(b) GDPR and whether it did so in a transparent manner
On the issue of transparency, Article 13(1) GDPR outlines the information the controller must provide to a data subject at the time when personal data are obtained and Article 12(1) GDPR details the manner in which this data must be provided.
Describing the information provided by Meta IE to Instagram users, the DPC stated:
“Meta Ireland has not provided meaningful information as to the processing operation(s) and/or set(s) of operations that occur in the context of the Instagram service, either on the basis of Article 6(1)(b) GDPR or any other legal basis. Indeed, I would go so far as to say that it is impossible for the user to identify with any degree of specificity what processing is carried out on what data, on foot of the specified lawful bases, in order to fulfil these objectives… Indeed, it could be said that there is a significant deficit of information made available to data subjects” (188). “Taking into account the circular, disjointed nature of the information provided by Meta Ireland and the generalised, high-level overview it provided, I am not satisfied that the information was clear and concise” (190).
The DPC also describes the “significant link” (194) between the principle of transparency and the principle of fairness in Article 5(1)(a) GDPR, and finds that, with regards to the issue of transparency, it is appropriate to made a finding of an infringement of the principle of Article 5(1)(a) (Para 197).
In light of the above, the DPC found that “In relation to processing for which Meta Ireland indicated reliance upon Article 6(1)(b) GDPR, Articles 5(1)(a), 12(1) and 13(1)(c) have been infringed”.

Issue 4 (Additional Issue) – Whether Meta Ireland Infringed the Article 5(1)(a) Principle of Fairness
During the course of the Article 60 GDPR consultation period, the Italian DPA raised an objection to the DPC’s draft decision. The purpose of this objection was to require the amendment of the Draft Decision to include a new finding of infringement of the Article 5(1)(a) GDPR principle of fairness. The DPC decided not to follow the objection, as the “principle of fairness was not examined during the course of this inquiry and, consequently, Meta Ireland was not afforded the opportunity to be heard in response to a particularised area of wrongdoing” (200). The matter was referred to the EDPB, who determined as follows:
"the principle of fairness has an independent meaning and… an assessment of Meta IE’s compliance with the principle of transparency does not automatically rule out the need for an assessment of Meta IE’s compliance with the principle of fairness too" (EDPB - 224).
"the concept of fairness stems from the EU Charter of Fundamental Rights" (EDPB - 225).
“Fairness is an overarching principle which requires that personal data should not be processed in a way that is unjustifiably detrimental, unlawfully discriminatory, unexpected or misleading to the data subject… [it] underpins the entire data protection framework and seeks to address power asymmetries between the data controllers and the data subjects in order to cancel out the negative effects of such asymmetries and ensure the effective exercise of the data subjects’ rights” ( EDPB - 225, 226).
"The combination of factors, such as the asymmetry of the information created by Meta IE with regard to the Instagram service users, combined with the ‘take it or leave it’ situation that they are faced with… systematically disadvantages the Instagram service users, limits their control over the processing of their personal data and undermines the exercise of their rights” (EDPB - 234).
Accordingly, the EDPB instructed the DPC to include a finding of an infringement of the principle of fairness under Article 5(1)(a) of the GDPR by Meta IE, and to adopt the "appropriate corrective measures, by addressing, but without being limited to, the question of an administrative fine for this infringement” (EDPB - 235).
As directed by the EDPB, the DPC found that “Meta Ireland has infringed the principle of fairness pursuant to Article 5(1)(a) GDPR”.

Summary of Envisaged Action
The DPC made an order pursuant to Article 58(2)(d) GDPR, requiring Meta IE to bring processing into compliance in accordance with its transparency obligations under Articles 5(1)(a), 12(1) and 12(1)(c) GDPR, within 3 months of the date of the date of notification of any final decision. The order also requires Meta IE to address the EDPB’s finding that it is not entitled to carry out data processing on the basis of Article 6(1)(b) GDPR, and to bring its processing into compliance with Article 6(1) GDPR.
Furthermore, pursuant to Articles 58(2)(i) and 83 GDPR, and under the direction of the EDPB, the DPC imposed an administrative fine in the amount of €180 million. This fine is made up of an €70 million fine for failing to provide sufficient information on processing operations (Articles 5(1)(a) and 13(1)(c) GDPR); a €60 million fine for failing to provide this information in a concise, transparent, intelligent, and easily accessible form, using clear and plain language (Articles 5(1)(a) and 12(1) GDPR); and a €50 million fine for the unlawful processing of personal data (Article 6(1) GDPR).


holding_Persónuvernd (Iceland) - Nr. 2020123144

After analysing the facts of the case, the Icelandic DPA considered that Creditinfo had complied with Article 14 of the GDPR. In particular, the Icelandic DPA noted that Creditinfo had provided sufficient evidence that a letter containing an information notice had been sent to the data subject prior to the publication of the personal data, in accordance with its operating license. The Icelandic DPA therefore concluded that Creditinfo had respected the terms of its operating license, and had not infringed Article 14 GDPR.
With regards to the fact that the Complainant was claiming not having received the letter, the Iceland DPA simply noted that it was not in a position to resolve the dispute regarding this factual aspect of the case but that it could however take a position on whether Creditinfo had complied with the procedure set out in its operating license (which, here, proved to be the case).

Persónuvernd (Iceland) - Nr. 2020123144


holding_CNPD (Portugal) - Deliberação 2021/533

The CNPD found that the National Statistical Institute, being the controller of the data processing, had not carried out the necessary Data Protection Impact Assessment for this particular processing, having only carried out an impact assessment for the general statistical activities. Therefore, Institute had not been able to assess the risks of this particular processing of data, that might include transfers of personal data to third countries without an adequate level of protection. The controller did not seek the DPA's advice either; consulting only with the Portuguese National Security Cabinet ("Gabinete Nacional de Segurança") about the census' cybersecurity requirements.
The DPA stated that even given the cybersecurity requirements of the census, additional measures could have been put in place to mitigate the risk to individual's personal data, ensuring greater control over the data by the National Institute, and limiting the processing of personal data to EU Member States; and by implication not processing the personal data in third countries. However, the choices made by the National Institute meant personal data might be processed in the United States and other countries in Cloudflare's network (for instance, South Africa, China, India, Jordan, Mexico, Russia, and Singapore).
The National Institute, as a controller, accepted Cloudflare's terms and conditions when using their service. The contract specifies that:
  * personal data may transit any of the 200 servers used by Cloudflare;
  * Standard Contractual Clauses are relied upon for the transfer of data to third countries, based on the Commission Decision 2010/87/UE of 5 February 2010 on Standard Contractual Clauses for the transfer of personal data to processors established in third countries;
  * Cloudflare is authorized to use sub-processors from outside their group, including companies from third countries;
  * Cloudflare may be subject to requests of disclose by US government institutions that may be inconsistent with the GDPR; and those requests may forbid the notification to the data controller about these requests.
The DPA held that use of standard contractual clauses does not imply that the controller does not have the obligation to ensure an equivalent level of protection when data is transferred to third countries, implementing adequate safeguards that allow to maintain such level of protection, according to the CJEU Schrems II Judgment[1]. This is also related to the accountability principle from Article 5(2) GDPR.
The DPA remarks that, according the Schrems II Judgment, the transfer of data to the United States may result in violations of fundamental rights, given that the US legislation allows for access to the data because of national security and public interest reasons. Such inferences are not reasonable, as limitations to fundamental rights are not clearly defined; as there are no clear and precise rules on the application of such measures or minimum requirements to protect against risks of abuse; there is no requirement for a necessity test; and there are no enforceable rights for data subjects or legal remedies.
The Portuguese DPA found that the National Institute had not undertaken a sufficient Data Protection Impact Assessment, had not consulted the supervisory authority prior to processing, and had therefore not adopted adequate additional safeguards before using the services of a data processor who was headquartered in the United States.
The DPA concluded that Portuguese citizens lack any guarantees in regards to their data being collected by the National Statistical Institute, as US legislation does not offer a similar level of protection than the GDPR. The controller had neither been able to demonstrate that the data is not effectively transferred to the US, not had they implemented any supplementary adequate measures to ensure a similar level of protection, which they are obliged to do as a data controller.
Therefore, the CNPD ordered the National Statistical Institute to suspend any processing of personal data for the census in the US or any other third country without adequate levels of protection, within 12 hours of their decision being issued.
The CNPD also remarked that the National Institute should obtain guarantees that compliance with GDPR is assured when contracting with processors or sub-processors.

CNPD (Portugal) - Deliberação 2021/533


The DPA held that there was enough evidence to start a sanctioning procedure. Especially considering the lack of legally binding instruments between the processor and the subprocessors involved in the delivery of a package to the data subject. Considering that the subprocessor had to process personal data controlled by Carrefour, there was a breach of the GDPR.
With this, the Spanish DPA established that a possible fine of €90,000 could be imposed for the breach of Articles 28(2) and 28(3) of the GDPR. The data processor decided to finalize the procedure by paying the reduced fine of €72,000, which implies admitting the breach of the data protection rules.

AEPD (Spain) - EXP202208230


holding_Datatilsynet (Denmark) - 2021-432-0056

Based on the documentation submitted, the DPA found that the processing activities entailed a high risk for the data subjects' rights and freedoms that could not be mitigated, and referred to Article 36(1) GDPR and Article 36(2) GDPR.
The DPA ordered the municipality to:
  * Change the data processing agreement with Google so that the DPA's remarks in their 14 July and 18 August decisions to Helsingor municipality, are implemented. This includes, at a minimum, a clarification of where and if Google acts as a sole controller and any uncertainties that may entail that Google acts beyond their role as a processor, see Article 28(3)(a) GDPR.
  * Document that all transfers of personal data to insecure third countries, are in line with the GDPR.
  * Describe all data flows and identify the personal data that are shared with the vendor, and clarify when the vendor acts as a sole or joint controller. This documentation must include the whole technology stack used by the municipality (for this processing activity).
  * Update their data protection impact assessment based on all identified risks.
  * Consult the DPA if the DPIA shows any high risks the municipality is not able to mitigate.
  * If any processing activities are still not in line with the GDPR before the DPA's deadline 3 November 2022, present a final plan for bringing them in line with the GDPR.

Datatilsynet (Denmark) - 2021-432-0056


holding_Garante per la protezione dei dati personali (Italy) - 9542096

The Garante found that the defensive statements were not enough to overcome its initial findings and close the proceedings. On the other hand, since the access request was fulfilled 62 days after its submission, the DPA found a violation of Article 12(3) in relation to Article 15 GDPR. The Garante hence applied an administrative fine as per Article 83(5) GDPR. The amount of such fine was set at €2000, taking into account the negligent nature of the delay, the fact that the polyclinic cooperated with the Supervisory Authority, and the lack of “previous relevant infringements”, or “previous provisions” as per Article 58 GDPR, ascribed to Poliambulatorio Talenti.


No legal basis under Article 6 GDPR
The CNIL found that the processing of personal data taken from LinkedIn users who had limited their visibility lacked a legal basis. The CNIL highlighted that users who had selected options 3 and 4, had expressly limited the visibility of their contact details. The mere fact that users had limited and not entirely denied access to their contact details did not provide authorisation for the controller to harvest this data as users could not reasonably expect for this processing to occur.
No clear data retention period adhered to under Article 5(1)(e) GDPR
The CNIL found that the controller's storage limitation policy entailed an automatic extension of the storage period and potentially led to an indefinite storage of personal data without a clear set storage limitation. According to the CNIL, this was not proportional and did not meet the requirements under Article 5(1)(e) GDPR.
Failure to provide adequate transparency under Article 12 GDPR and information under Article 14 GDPR
In addition to the fact that the controller had only informed data subject’s four years after it had begun processing their personal data, the CNIL criticised that the controller sent the email exclusively in English.
Failure to provide access to data under Article 15 GDPR
The CNIL found that the controller did not provide all available information as to the source of the data. Even if the controller could not trace the specific source of the data for each data subject, it was found to have been aware of some sources and should have disclosed these. The CNIL further criticised that these sources were not listed in the privacy policy.
For the above breaches of the GDPR, the CNIL issued a fine of €240,000. The CNIL ordered the company to rectify its data processing within a six-month period (before the 18 June 2025). Specifically it ordered the controller to:
  * Stop collecting the data of LinkedIn users who had selected to limit the visibility of their contact details and to delete this data. If the controller cannot identify which users had limited their data visibility, it should inform all data subjects of the processing and the option to object to it within three months. The CNIL specified that the collected data must only be used for this purpose.
  * Cease the automatic renewal of the storage period pending a personal data update.
  * Inform data subjects of the processing in a language they understand.
  * Adequately respond to access requests and include all available information on the source of the personal data collected.

CNIL (France) - SAN-2024-020


holding_Rb. Den Haag - C/09/581706 / HA RK 19-593

According to the court, the exercise of the rights granted to the data subjects by the GDPR is not unlimited. In order to protect the legitimate interests of the data controller (not to have to decide continuously on repeated requests and be subjected to lengthy litigation, but to know, within a workable period, whether its decision can still be submitted to the courts or not), there are limits to the frequency with which data subjects can make use of their rights. Article 12(5) of the GDPR provides in this respect that a controller may refuse to comply with a data subject request where that request is manifestly unfounded or excessive, in particular because of its repetitive nature.
However, Article 12(5) of the GDPR does not contain a clear answer as to when a request may be dismissed as repetitive, nor whether, as in the present case, this can be done after only one repeated request within two months of receiving the negative answer. In addition, it is not clear to the court how Article 12(5) relates to the right to object deriving from Article 21(1), which the data subjects can exercise "at any time", neither how the submission of a repeated request relates to the situation where the national law sets a period of six weeks for lodging an appeal and where such period has expired.
The domestic court therefore proposes to ask the following questions to the European Court of Justice:
1) Do the words "at any time" in Article 21(1) of the GDPR mean that data subjects, following receipt of a negative decision in response to a request for removal, are entitled to submit a repeated request (when there is not any change in the facts or circumstances relating to the data subject's situation)?
2) If yes, is the data controller nevertheless allowed, under Article 12(5)(b) of the GDPR, to refuse to comply with the request because of its repetitive nature?
3) Is it relevant how much time elapsed between receipt of the controller's decision rejecting the previous request and the submission of the new (repeated) request by the data subjects? If so, how much time must have elapsed as a minimum before the data subject can submit a new (repeated) request?
4) Does it make any difference if the national law lays down a time-limit within which the data subjects must lodge their appeal against a (negative) decision of a controller, and that time limit has expired at the time when the repeated request is lodged? Is it possible, immediately after the expiry of the time-limit, to submit a new identical request to which the controller would have to reply as to the substance and against which - according to the letter of Article 35(2) - an appeal could (still) be lodged?
5) Does it make any difference if, when the original (rejected) request was made, the data subject was assisted by a professional legal adviser, such as a lawyer?


Upon hearing further submissions by the parties, the BVwG issued its final decision on the remaining part of the case on 29 November 2023.
In the second partial judgment the court considered the two parts of the DSB’s decision that had not already been decided, namely: (2a) the order to the controller to disclose the names of all recipients of the data subject’s personal data and (1) the declaration that the controller violated the data subject’s right to access as it failed to fully comply with his request under Article 15 GDPR.
The Court first of all held that, part (2a) of the DSB’s decision should be dismissed, as the controller in its later submissions sufficiently proved that it was impossible for it to identify all recipients of the data subject’s personal data and thus it could and can not comply with the order to disclose their names.
As regards part (1) of the DSB’s decision, the BVwG held that, even though it was indeed impossible for the controller to identify the recipients of the data subject's personal data, this was due to the fact that the controller did not take the appropriate steps to save information about the transmission of personal data to recipients, even though controllers are generally obliged to do so. This, in turn, resulted in the data subject not being able to exercise its other rights under the GDPR and the controller could not comply with its obligation under Article 19 GDPR. For this reason, the court held that the GDPR violation did not just take place in the past but was still ongoing and the data subject's request was still not complied with. Further, the court rejected the argument that the list of recipients of the controller is covered by trade secret protection. As a matter of fact, the court considered that this would lead to the impossibility to ever apply Article 15(1)(c) GDPR, and the interpretation of a law leading to its disapplication is unlawful according to the case-law of the Austrian supreme court. Also, in this specific case, the existence of trade secret protection was negated by the controller at the oral hearing.
In light of the above, the BVwG concluded that the controller violated the data subject’s right to access under Article 15(1)(c) GDPR as it failed to store information about the recipients of his personal data and thus was unable to provide it to the data subject.

BVwG - W214 2233132-1/27E


The Court ruled that the controller’s decision to deny the data subject’s request is justified.
The Court recognised that, under Article 7(6)(i) Dutch Access and correction rights regulation, a request for access may be partially or fully denied if it is necessary and proportionate to protect the rights and freedoms of others. Thereby, the tipster’s anonymity and the public interest in maintaining such anonymity outweighed the data subject’s interest in disclosure, as the investigation led to the benefit recovery, not the tip.
Other claims, including harassment by anonymous tipsters and privacy violations by the controller, were deemed irrelevant to the decision.
The appeal was dismissed and the data subject’s arguments were rejected.

Rb. Den Haag - SGR 22/2863


holding_LfD (Lower Saxony) - Fine EUR 900,000 against bank

The DPA found that the analysis of large amounts of data to create customer profiles could not be based on Article 6(1)(f). It followed that processing based on a legitimate interest requires a balancing act between the interest of the controller and the fundamental rights and freedoms if the data subject. The controller had to consider the reasonable expectations of the data subjects.
The DPA argued that a data subject could not reasonably expect large amounts of its personal data to be analyzed by the controller to better target its advertising. Third-party data enrichment, like the use of commercial credit reporting agency data, further overrides the interest of the controller and tips the balancing test in favor of the data subject.
The DPA held that in addition, data enrichment from a third-party source and linking it to profiles could also not be based on legitimate interest. This could potentially link data from all areas of life to an accurate customer profile, which could also not be reasonably expected by a customer. Customer consent (see Article 6(1)(a)) is required.
The controller cooperated with the DPA throughout the process.
For the violation, the DPA fined the controller €900,000.


The Court upheld the reasoning of the Court of Appeal, and stated that the company had the authorisation and obligation to keep the processed data on outgoing and incoming calls. Furthermore, it bore the burden of proof in disputes on the provision of services. This was especially important for the user to verify whether the billed amount corresponds to the volume of data and whether the data was provided correctly.
On the application of the GDPR, the Court upheld the reasoning of the Court of Appeal supported by an opinion of the Czech DPA. According to the Court, the processing of incoming call data is personal data, however, the company is entitled to process and store the data for a limited period under legal obligation (Article 6(1)(c) GDPR) and legitimate interests (Article 6(1)(f) GDPR). This is also the case on processing for the extent necessary to provide services and for billing and payments, even if it relates to a person other than the data subject.

NS - 33 Cdo 347/2023


The BVwG did not (yet) take a decision on the merit of the case but stalled the procedure because the Austrian Supreme Court (OGH) had already filed a request for preliminary ruling on the question the interpretation of Article 15(1)(c) GDPR in February 2021. Once the CJEU has passed its judgment on the matter, the BVwG will reopen the case.

BVwG - W211 2230221-1


The BVwG rejected the appeal and fully upheld the decision by the DSB.
On the issue of storage duration of the data on payment defaults, the BVwG agreed with the DSB's reasoning and held that none of the data must be erased at the time of the decision. All the data stored could still be considered relevant for assessing the data subject's creditworthiness.
With regards to the non-information under Article 14 GDPR, the BVwG applied a "narrow concept" of lawfulness under Chapter II GDPR: The lawfulness of processing is only determined by Article 5 et seqq. GDPR. A violation of Article 13 or 14 GDPR can be fined under Article 83(5) GDPR but it does not affect the lawfulness of processing as such.

BVwG - W274 2232028-1/3E


The litigation chamber of the BE DPA concluded that the processing took place without legal basis (Article 6.1.f not applicable), without privacy policy and without information to the individuals whose data were collected indirectly.

APD/GBA (Belgium) - 39/2020


Regarding the legal basis of the processing operations, the APD noted that the controller’s privacy policy did not clearly state the legal basis under Article 6 GDPR. The APD found a possible violation of Article 13(1) GDPR which requires the controller to inform the data subject of the legal basis.
Moreover, the APD pointed out that this processing, which uses, among other things, location and IP address to assign a unique ID to a visitor, must in principle be based on consent. The APD therefore found a possible breach of Articles 5(1)(a) and 6 GDPR.
Regarding the use by other parties of the technology, the APD indicated that the complaint is specifically directed towards the controller, and that it is up to each controller to ensure that their processing activities are in compliance with the GDPR. Therefore, the APD only examined the activities that took place under the responsibility of the controller.
Regarding the access and erasure request, the APD considered that it appeared from the elements provided that there was an email exchange between the data subject and the controller, but as the content of this communication had not been provided, the DPA could not assess whether the controller’s response met the requirements of the GDPR.
Nonetheless, the APD added that if personal data is obtained by submitting an erasure request, it cannot be used thereafter to send out marketing emails, under the principle of purpose limitation under Article 5(1)(b) GDPR. The APD therefore found a possible violation of Article 5(1)(b) GDPR.
Finally, the APD also noted that the controller had not appointed a representative in the European Union under Article 27 GDPR.
Thus, the APD issued a warning for (i) failing to comply with the information obligation under Article 13 GDPR, (ii) for using the contact details of the data subject to send marketing emails and thus possibly violating Article 5(1)(b) GDPR, (iii) for failing to appoint a representative in the European Union under Article 27 GDPR and (iv) for possibly violating Articles 6 and 5(1)(a) GDPR.

APD/GBA (Belgium) - 51/2024


holding_AP (The Netherlands) - Boete voor gemeente Voorschoten

The Dutch Data Protection Authority (DPA) has determined that the municipality unlawfully processed personal data related to waste disposal. The data in question included the chip number of waste containers or tokens, associated address details, date and time of container emptying or underground container access, location data, and type of waste. As the chip number links this data to an address, it directly or indirectly identifies residents.
The DPA assessed whether the municipality could rely on Article 6(1)(e) GDPR—necessity for the performance of a task in the public interest—as a legal basis. The purpose of the processing was clearly defined as reducing residual waste by regulating disposal. Moreover, the stated purpose could be achieved by the processing of personal data. After all, the address information plays a key role in limiting the amount of residual waste that a household can offer. The purpose of the processing also fits within the public task.
The short-term processing of personal data via the chip reader on garbage trucks was deemed necessary for verifying whether a container was provided by the municipality and had not been emptied recently. Similarly, for underground containers, checking whether a token granted access and whether disposal limits were exceeded was considered necessary. However, storing detailed records of which token or container was used, when, where, and for which type of waste was not deemed essential unless part of a diftar (differentiated waste collection) system, which the municipality of Voorschoten does not operate. Since long-term storage of waste disposal data was unnecessary for fulfilling a public interest task, the processing lacked a valid legal basis and was deemed unlawful.
On 24 May 2023, the waste management board informed the DPA that it would reduce the retention period for container disposal data to 14 days. Previously, data was retained for as long as a container remained in use (for overground containers) or up to five years (for underground containers).
Additionally, the DPA found that the municipality failed to adequately inform residents about the processing of their personal data, as required under Article 14 GDPR. While some information was provided, it did not clearly specify which personal data was processed, for what purpose, or on what legal basis. For example, letters informing residents about new underground containers with tokens did not disclose how personal data would be processed. The DPA concluded that the municipality had failed to meet GDPR transparency requirements.


The Court upheld the Luxembourgish DPA’s decision.

The legal basis of legitimate interest
The Court rejected all the controller's arguments on the legal basis of legitimate interest. First, the Court held that the controller failed to provide evidence that the controller’s processing of personal data pursued the interest of the wider community in a vital Internet economy.
Second, the Court held that in the original procedure involving the Luxembourgish DPA, the controller failed to establish that processing personal data was necessary for interest-based advertising. The controller merely stated that personal data were necessary without carrying out a concrete analysis of necessity.
Third, the Court observed that the DPA did not need to assess the balancing of legitimate interest because the controller failed to establish that the processing of personal data was necessary to begin with. In this regard, the Court referred to the case law of the EU Court of Justice[1] and specifically to the so-called “three-step test” for legitimate interest.
Finally, the Court pointed out that the controller still relied on legitimate interest to some extent in order to provide targeted advertising. Therefore, the processing of personal data in the context of interest-based advertising was still unlawful. The controller also failed to specify which data processing operation relied on consent, and failed to mention its reliance on consent in any of the privacy notices on its websites.

The controller's transparency obligations
The Court essentially confirmed all of the DPA’s findings. With regards to recipients of personal data for the purpose of providing interest-based advertising, the Court observed that the controller did not even provide precise enough information on the categories of recipients involved.

The right to object
The Court rejected the controller's claim that its granular opt-out system was more respectful of the data subjects' wishes. In this regard, the Court observed that the controller merely stated this argument without providing any evidence. The Court also pointed out that the controller failed to show that the opt-out system retained the users’ advertising preferences when re-connecting to the controller’s websites.

Other data subject's rights
The Court rejected the controller’s argument about re-identification. The Court clarified that interest-based advertising necessarily requires the identification of the users’ terminal equipment. For this reason, the Court clarified that Article 11 did not apply to the case.

TA Luxembourg - 46578


holding_ANSPDCP (Romania) - ING Bank N.V. Amsterdam – Bucharest Branch (2)

The ANSPDCP found that the controller sent (through its processor) to a contractual partner, files containing outdated information. The data were outdated because the employees of the insurance policy monitoring department did not check and process the insurance policies in accordance with the working procedure. A number of 270 data subjects were affected because the technical and organizational measures implemented by the controller before the incident were not sufficient and led to the violation of the confidentiality of personal data.


holding_Rb. Rotterdam - C/10/576091/HA RK 19-701

First, the Court examines the basis of the applicant's request pursuant to Article 12 of the Code of Civil Procedure which requires to state fully and truthfully the relevant facts, and to submit all the document relevant to the application. In this regard, the Court considered that the applicant did not comply with this obligation. Indeed, the Court pointed out there is no docuiment showing that the applicant submitted an inspection request of the procedural files at stake.
Then, the Court clarified that both the ePrivacy Directive and the GDPR apply. It considered that the right of inspection of document including personal data is not absolute. However, it stated that the access right and the right of inspection have to be understood as a right to a complete overview of all personal data, in a form that enables the data subject to inspect his or her data and to check that they are correct and have been processed lawfully. Regarding the format, the Court recalled that the data subject cannot expect to be provided with the original document and that the material form depends on the concrete circumstances.
Finally, the Court considered that in any cae, the applicant's purpose was not to verify the accuracy and lawfulness of the personal data processed but to use them to prove his innocence in the case he was involved against the State and in any proceedings to be brought against the State. Thus, the court ruled that the applicant could not invoke the right to inspection because his claim did not concern the protection of his personal data and therefore, there was an abuse of rights.
As a consequence, the court considered the applicant's claim as inadmissible.


holding_Persónuvernd (Iceland) - Case no. 2021101926

The DPA first held that the controller processed the data legally on the basis of legitimate interest pursuant to Article 6 GDPR. Although the data subject had an interest in the protection of their personal data, Google LLC's financial interests and the interest of the public to access information on the Internet outweighed it.
Moreover, in its second analysis, the DPA also held that the data subject could no rely on their right to be forgotten according to Article 17 GDPR to remove the search results in the Google search engine. The DPA noted that, according to Article 17(3)(a) GDPR, the right to be forgotten may not apply to the extent that it conflicts with exercising the right of freedom of expression and information. In the case at hand, it was of particular significance that the concerned data subject held a public role. The DPA elaborated that public figures may enjoy a lesser degree of privacy protection than private persons due to the importance of being able to freely discuss issues that may be relevant to the public. Moreover, the DPA considered that the press coverage was only about the data subject's job and the conditions at their workplace but not about their personal conduct in private life.
Consequently, the public's right to freedom of information was considered set aside the complainant's right to be forgotten.


The CNIL orders PERFORMECLIC to pay an administrative fine of €7300. It also issued an injunction to bring the processing into compliance with the provisions of the French Post and Electronic Communications Code and the GDPR, accompanied by a penalty payment of 1,000 euros per day of delay at the end of a two-month period following notification of the decision. Finally, the French DPA has made its decision public.
The CNIL based its decision on the following grievances :

On the competence of the French DPA
At the time of the audit, the manager of the company indicated to the CNIL that the operational activities of the company were carried out from Morocco and that, in the near future, he intended to end the company's activities in France and carry them out in their entirety from Morocco, so that the GDPR did not apply in this case.
As per Articles 3 GDPR and 8 of the French Data Protection Act, the CNIL retains its jurisdiction and confirms the application of the GDPR insofar as the company is established in France, and addresses its prospecting messages to the French public only.

On the failure to obtain the consent of the person concerned by a direct marketing operation by means of electronic mail
According to article L. 34-5(1) of the French Post and Electronic Communications Code, "direct prospecting by means of an automated electronic communications system, a fax machine or electronic mail using the contact details of a natural person, subscriber or user, who has not previously expressed his consent to receive direct prospecting by this means, is prohibited". With regard to this article, the notion of consent should be understood as any expression of free, specific and informed will by which a person agrees to the use of personal data concerning him/her for the purpose of direct prospecting. Thus, the consent of individuals must be obtained before sending any commercial e-mail.
In this case, the absence of elements attesting the effective existence of a valid consent of the persons concerned, in relation to the number of reports received by the association SIGNAL SPAM concerning the company (163,126 reports over the period from 1 January 2019 to 11 June 2019 making it the issuer of e-mails most reported by French Internet users to SIGNAL SPAM over this period) leads the Cnil's sub commission to retain a breach of Article L. 34-5 of the French Post and Electronic Communications Code.

On the failure to ensure the adequacy, relevance and non-excessiveness of the personal data processed by the company
The CNIL recalls the provisions of Article 5(1)(c) GDPR, according to which personal data must be adequate, relevant and limited to what is necessary for the purposes for which they are processed (data minimisation).
In the present case, the CNIL notes that the prospecting files contained the telephone number of the prospects. However, it emerges from the monitoring operations that this information is not used by the company, which only addresses marketing by e-mail.
Consequently, the French DPA considers that the telephone number should not have been collected and processed by the company and should have been deleted from the databases. In these circumstances, the restricted formation considers that the company has failed to comply with the obligation provided for in Article 5(1)(c) GDPR to process only adequate, relevant personal data limited to what is necessary for the purposes for which they are processed.

On the failure to comply with the obligation to process personal data for no longer than is necessary for the purposes for which they are processed
Article 5(1)(e) GDPR provides that personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data are processed.
According to the findings of the CNIL, it appears that the company kept prospect data for more than three years, with the contact details of approximately 5 million prospects having only opened the prospecting e-mails sent by the company, without any further action on their part, in particular without having clicked on one of the links contained in the said prospecting e-mails.
The CNIL finds that the provisions of Article 5(1)(e) GDPR have been breached, emphasising in particular that the starting point set by the company to calculate the retention period for prospect data cannot be the simple opening of an email, insofar as the opening of an email does not necessarily reflect the prospect's interest in the products or services of the sender of the message, as the prospect may have opened the email by mistake or automatically, in particular due to the operation of his email software. By proceeding in this way, the company has not ensured the effective interest of the subjects in the commercial prospecting messages that it sends.

On the failure to comply with the obligation to inform the data subjects
Article 14 GDPR requires the controller to provide the data subject with several pieces of information, such as the identity and contact details of the controller, the purposes of the processing operation, its legal basis, the categories of personal data concerned, the recipients of these data, the storage period, or the terms and conditions of the rights granted to the data subjects. In addition, this information must be provided at the latest at the time of the first communication with the individual.
In this case, the CNIL notes that in emails sent to prospects, information is provided by a standard mention at the bottom of the email. However, the CNIL points out that the company must provide individuals with complete information, whether it be from this first level of information given in the e-mails or by allowing them easy access to additional information, within a second level of information.
However, the mention provided for at the end of e-mails sent to prospective customers does not include all the elements provided for by Article 14 GDPR. The CNIL also notes that no hypertext link refers to more complete information than that standard mention in the mail. Consequently, the CNIL retains the failure to comply with the information obligation referred to in Article 14 GDPR.

On the failure to respect the right to object of data subjects
In this case, the CNIL holds that the company carries out its commercial emailing activity by silos: the personal data of prospects contained in the database is replicated within nine different accounts, and each account is associated with two different domain names. Thus, when a person clicks on an unsubscribe link to exercise their right of opposition, they are unsubscribed from the account used to send the prospecting campaign in question but not from the other accounts used by the company for other campaigns.
Article 21(2) GDPR provides that where personal data are processed for marketing purposes, the data subject shall have the right to object at any time to the processing of personal data concerning him for such marketing purposes, including profiling insofar as it relates to such direct marketing.
With regard to this article, the CNIL notes that the management of marketing campaigns by silos by the company makes it ineffective for individuals to oppose the processing of their data by the company for the purposes of commercial e-mailing when this right is exercised by means of the unsubscribe link at the bottom of the e-mail messages. Indeed, when a person clicks on an unsubscribe link to exercise his or her right to object, that person is unsubscribed only from the account used to send the prospecting campaign concerned but not from the other accounts used by the company for other campaigns.
In order to defend itself, the company has indicated to the delegation of control that, in order to be unsubscribed from all accounts used for sending prospecting emails by the company, the person concerned must either make this request by replying by return message to the prospecting emails received, or fill in an online form available from the PERFORMECLIC.FR domain.
In this respect, the CNIL recalls that Article 12(2) GDPR requires the data controller to facilitate the exercise of the rights conferred on the data subject under Articles 15 to 22 GDPR, which the company has in any event failed to do by not offering the data subjects a satisfactory means of exercising their rights and by not informing them of the existence of channels enabling them to unsubscribe from all accounts and inviting them to use them to exercise their right of opposition.

CNIL (France) - SAN-2020-016


The DPA held that the controller processed personal data in absence of a valid contractual relationship with the data subject. In particular, the controller had full access to all crucial information (especially the decision of the insolvency court and records kept in public registries) proving that the data subject was not obliged to repay the debt in question. The controller failed to prove the lawfulness of the processing in violation of its accountability obligation. For this reason, DPA imposed a €10,000 fine for the violation Articles 5(1)(a), 5(2), and 6 GDPR.
The DPA also held that the controller created undue barriers to the exercise of the data subject’s rights by demanding the update of the identification information. The controller had at its disposal a variety of personal identification information such as VAT number, date of birth, and father's name. The identification of the data subject was possible even without the ID number. For this reason, the DPA fined the controller €10,000 for violating Article 12(2) GDPR.

HDPA (Greece) - 25/2022


holding_Persónuvernd (Iceland) - 2020092288

In its decision from 23 November 2021, the Icelandic DPA came to conclusion that the Ministry had breached several principles of the data protection legislation. More specifically, the Icelandic DPA found that the Ministry had (1) collected a large amount of users´ personal data without having a lawful basis; (2) failed to obtain a valid consent for processing of users´ data, (3) required extensive access rights to users´ mobile devices, in violation of the principle of data minimisation and (4) failed to provide the users with adequate information on the use of their data.
Furthermore, the Icelandic DPA stated that both the Ministry and YAY had failed to implement appropriate technical and organizational security measures to ensure the protection of the users´ personal data.
The Icelandic DPA imposed an administrative fine of 7,5 million ISK (approx. €50.800) on the Ministry, and a fine of 4 million ISK (approx. €27.100) on YAY ehf. for violation of Articles 5, 6, 7, 12, 13, 24, 25, 28(3) and 32 GDPR.

Persónuvernd (Iceland) - 2020092288


holding_APDCAT (Catalonia) - EXP202409570

The DPA began their investigation on 19th November 2024.
The DPA highlighted the fact that the parents were informed that without consenting to the photographs of their child being taken, they could not proceed with registration, and held that the consent given would not have been “free”, as required in Article 7 GDPR. The DPA according found that the controller infringed Article 7 GDPR.
The DPA also noted that the absence of anonymisation software on the part of the controller was not an excuse for not offering the parents a genuine choice in consenting to the processing.
The DPA initially set the fine at €1,000 but pursuant to Law 39/2015, a Spanish law concerning administrative proceedings, the DPA informed the controller that it may acknowledge its responsibility for the alleged violations and/or make a voluntary payment of the proposed fine. Each of these actions reduces the imposed fine by 20%. The controller opted to reduce the fine by 40%, both acknowledging its responsibility for the violations and paying the reduced sanction amount of €600.
The controller was also ordered to bring their processing in line with the requirements of Article 7 GDPR.

APDCAT (Catalonia) - EXP202409570


holding_AP (The Netherlands) - 7.04.2022

The DPA found that the Dutch Tax and Customs Administration had registered about 244,273 individuals and 30,000 business owners in the FSV from 4 November 2013 to 27 February 2020. The Tax and Customs Administration processed personal data (including data relating to health, nationality and criminal data). The DPA has concluded that the Tax and Customs Administration had violated several principles of data processing, including transparency, purpose limitation, accuracy and storage limitation.
First of all, the DPA concluded that there was no legal basis for processing of personal data. The Tax and Customs Administration could not successfully invoke the 'legal obligation' under Article 6(1)(c) GDPR as a basis for this processing since there was no obligation to process signals of (possible) fraud. This resulted in a breach of Article 5(1)(a) GDPR and Article 6(1) GDPR in conjunction with Article 8 of the Dutch Personal Data Protection Act (Wbp).
Secondly, the DPA also found that the purposes of personal data collection in FSV were not well-defined, breaching Article 5(1)(b) GDPR in conjunction with Article 7 Wbp.
Thirdly, the FSV contained inaccurate and non-updated personal data and no reasonable steps were taken to rectify or delete such personal data. This resulted in a breach of Article 5(1)(d) GDPR in conjunction with Article 11(2) Wbp.
Furthermore, the DPA concluded that personal data in the FSV were kept longer than the applicable retention period and hence longer than necessary, violating Article 5(1)(e) GDPR in conjunction with Article 10(1) Wbp.
In addition, the Tax and Customs Administration did not take sufficient technical and organizational measures with respect to access security, logging, and logging controls to ensure an adequate level of security for the personal data in the FSV. Thus, it violated Article 32(1) GDPR in conjunction with Article 13 Wbp.
Finally, the DPA found that the Tax and Customs Administration did not properly and timely involve the DPO in the implementation of FSV's data protection assessment. With this, the Tax and Customs Administration violated Article 35(2) GDPR and Article 38(1) GDPR.
These violations had serious implications for those who were incorrectly listed as fraudsters. For example, those who were listed in the FSV could not qualify for payment plans or debt settlements. On top of these violations, the DPA also considered the fact that the Dutch Tax and Customs Administration had committed serious violations of the GDPR before, such as in 2018. Consequently, it imposed a fine of €3,700,000 considering all of the above. The Dutch Tax and Customs Administration does, however, have the option to object to this penalty.

AP (The Netherlands) - 7.04.2022


The Spanish DPA considered that the data subject provided a photograph without date and time and, based on this, it was impossible to specify which was her private area on a location plan. Also, AEPD considered that the allegations were insufficient as they do not provide a proper "screen print" of what is being captured by the data controller or the specific orientation of the camera.
AEPD highlighted that individuals can install cameras, but only on their own private property and it must be oriented towards his own private property.
The Spanish DPA considered that the data controller had a camera system in place that was poorly oriented and deficient in terms of information signs. It was concluded that the information signs had irregularities, since it did not have an effective address to which any person can address himself.
The Spanish DPA fined €600 the controller for installing security cameras that focused beyond his private property, violating Article 5(1)(c) and 13 GDPR.
AEPD determined the removal of the cameras in question or the reorientation of the cameras, in accordance with current legislation, so that they do not record or capture images of the data subject's private space. In addition, the controller must include an informative sign in accordance with the regulations.

AEPD (Spain) - EXP202209001