Court of Justice judgments
Judgments of the Court of Justice of the European Union on the General Data Protection Regulation, newest first. Checked against CURIA and EUR-Lex on 28 October 2026.
- C-474/24, AR and Others v Österreichische Datenschutzbehörde and Others
Judgment of 14 July 2026ECLI:EU:C:2026:579
Publishing the names and sanctions of athletes who broke anti-doping rules falls within the GDPR; it is not in principle health data unless the substance or method reveals health information; national law may require publication if it allows an individual balancing and excludes recreational athletes, vulnerable persons and whistleblowers.
- C-199/24, ND v Legal Newsdesk Sweden AB, anciennement Garrapatica AB
Judgment of 9 July 2026ECLI:EU:C:2026:564
Member States cannot use Art. 85(1) to create derogations beyond those allowed by Art. 85(2) for processing that is not journalistic, academic, artistic or literary.
- C-484/24, NTH Haustechnik GmbH v EM
Judgment of 18 June 2026ECLI:EU:C:2026:496
National procedural rules that require courts to consider all evidence submitted by the parties can be a valid legal basis for processing personal data in that evidence, provided clear and foreseeable national case-law sets the conditions for its use.
- C-414/24, Datenschutzbehörde and Dr. G S v Bundesministerin für Justiz and D GmbH
Judgment of 18 June 2026ECLI:EU:C:2026:493
A supervisory authority may not reject a complaint just because court proceedings on the same matter are already pending.
- C-526/24, Brillen Rottler GmbH & Co. KG v TC
Judgment of 19 March 2026ECLI:EU:C:2026:216
Even a first access request can be refused as excessive if the controller proves it was made with abusive intent, such as manufacturing a damages claim; a breach of the right of access can give rise to compensation, including for loss of control, if actual damage is shown.
- C-97/23 P, WhatsApp Ireland Ltd v European Data Protection Board
Judgment of 10 February 2026ECLI:EU:C:2026:81
A controller can bring an action for annulment before the EU courts against an EDPB binding decision in a dispute between authorities: the Court set aside the General Court's order of inadmissibility, declared the action admissible and sent it back for a ruling on the merits.
- C-422/24, Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik
Judgment of 18 December 2025ECLI:EU:C:2025:980
Data recorded by body cameras worn by ticket inspectors are collected from the data subject, so information must be given under Art. 13, not Art. 14.
- C-492/23, X v Russmedia Digital SRL and Inform Media Press SRL
Judgment of 2 December 2025ECLI:EU:C:2025:935
An online marketplace operator is a controller of personal data in ads published on its site; before publication it must identify ads with sensitive data, check the advertiser is the person concerned or has explicit consent, take security measures against copying, and cannot rely on the hosting exemptions of the e-Commerce Directive for these GDPR duties.
- C-655/23, IP v Quirin Privatbank AG
Judgment of 4 September 2025ECLI:EU:C:2025:655
The GDPR does not itself give a right to a court order stopping future unlawful processing, though national law may; negative feelings from loss of control can be damage if proven; fault and any injunction cannot reduce compensation.
- C-247/23, VP v Országos Idegenrendészeti Főigazgatóság
Judgment of 13 March 2025ECLI:EU:C:2025:172
A public register must rectify inaccurate data on a person's gender identity; reasonable evidence may be required, but not proof of gender reassignment surgery.
- C-638/23, Amt der Tiroler Landesregierung v Datenschutzbehörde
Judgment of 27 February 2025ECLI:EU:C:2025:127
National law may designate as controller an administrative unit without legal personality, and need not list each processing operation, if the unit can meet a controller's duties and the law at least implicitly sets the scope of the processing.
- C-203/22, CK v Magistrat der Stadt Wien
Judgment of 27 February 2025ECLI:EU:C:2025:117
For automated decisions, 'meaningful information about the logic involved' means explaining the procedure and principles actually applied, in an understandable way; where trade secrets or third-party data are claimed, the controller must give them to the authority or court to balance.
- C-383/23, Criminal proceedings against ILVA A/S
Judgment of 13 February 2025ECLI:EU:C:2025:84
'Undertaking' in Art. 83 has the competition-law meaning, so the maximum fine is a percentage of the whole group's worldwide turnover, which is also relevant to setting an effective and proportionate fine.
- C-394/23, Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect
Judgment of 9 January 2025ECLI:EU:C:2025:2
Making customers state a title (Mr or Ms) to buy a train ticket is not necessary for the contract and cannot rest on legitimate interest where customers were not told of that interest, the data are not strictly necessary, or the risk of discrimination outweighs it; the right to object does not change the necessity test.
- C-416/23, Österreichische Datenschutzbehörde v F R
Judgment of 9 January 2025ECLI:EU:C:2025:3
Complaints count as 'requests' under Art. 57(4); an authority cannot treat them as excessive just because there are many, it must show abusive intent; it may then charge a fee or refuse, choosing the proportionate option.
- C-65/23, MK v K GmbH
Judgment of 19 December 2024ECLI:EU:C:2024:1051
Works agreements on employee data must meet Arts. 5, 6(1) and 9 as well as Art. 88(2), and courts can fully review whether processing under them is necessary.
- C-169/23, Nemzeti Adatvédelmi és Információszabadság Hatóság v UC
Judgment of 28 November 2024ECLI:EU:C:2024:988
The exception from informing people when national law provides for obtaining or disclosing data applies also to data the controller generates itself; the authority may check that national law gives adequate safeguards.
- C-621/22, Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens
Judgment of 4 October 2024ECLI:EU:C:2024:858
A purely commercial interest, such as selling members' data to sponsors, can be a legitimate interest if it is lawful, but the processing must be strictly necessary and pass the balancing test.
- C-446/21, Maximilian Schrems v Meta Platforms Ireland Limited
Judgment of 4 October 2024ECLI:EU:C:2024:834
Data minimisation prevents a social network from using all personal data it collects, on or off the platform, for targeted advertising without limits of time or type; a person who speaks publicly about their sexual orientation does not thereby allow the network to process other data about it for advertising.
- C-21/23, ND v DR
Judgment of 4 October 2024ECLI:EU:C:2024:846
Competitors may sue under unfair-competition law for GDPR breaches; order data entered to buy pharmacy-only medicines online are health data even without a prescription.
- C-200/23, Agentsia po vpisvaniyata v OL
Judgment of 4 October 2024ECLI:EU:C:2024:827
A commercial register that publishes company documents is a controller and recipient of the personal data in them; it cannot refuse erasure of unrequired data; loss of control can be non-material damage.
- C-507/23, A v Patērētāju tiesību aizsardzības centrs
Judgment of 4 October 2024ECLI:EU:C:2024:854
An apology can be sufficient compensation for non-material damage where it fully compensates the harm; the controller's attitude and motives cannot reduce compensation.
- C-768/21, TR v Land Hessen
Judgment of 26 September 2024ECLI:EU:C:2024:785
After finding a breach, a supervisory authority need not impose a fine or other corrective measure where that is not appropriate, necessary or proportionate to remedy the shortcoming.
- C-17/22, HTB Neunte Immobilien Portfolio and Ökorenta Neue Energien Ökostabil IV
Judgment of 12 September 2024ECLI:EU:C:2024:738
Giving one investor the contact details of all indirect investors in a fund can be necessary for the contract only if objectively indispensable to it; it may otherwise rest on legitimate interest if strictly necessary and the balance favours it.
- C-757/22, Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V
Judgment of 11 July 2024ECLI:EU:C:2024:598
Consumer associations can bring representative actions for failures to inform users about purposes and recipients, because such failures are infringements 'as a result of the processing'.
- C-590/22, AT and BT v PS GbR and Others
Judgment of 20 June 2024ECLI:EU:C:2024:536
A proven fear that data were disclosed to third parties can be non-material damage even without proof of actual disclosure; damages do not have a punitive function.
- C-182/22, JU and SO v Scalable Capital GmbH
Judgment of 20 June 2024ECLI:EU:C:2024:531
Damages under Art. 82 are purely compensatory; non-material damage from a breach is not by nature less significant than physical injury; small damage may receive small compensation; 'identity theft' requires actual misuse of identity.
- C-741/21, GP v juris GmbH
Judgment of 11 April 2024ECLI:EU:C:2024:288
Infringement alone is not damage; the controller cannot escape liability by blaming an employee acting under its authority; fine criteria in Art. 83 are not used to set damages.
- C-604/22, IAB Europe v Gegevensbeschermingsautoriteit
Judgment of 7 March 2024ECLI:EU:C:2024:214
A consent string recording a user's ad-tracking choices is personal data where it can reasonably be linked to an identifier such as an IP address; a sector body that sets binding rules for such strings can be a joint controller even without access to the data, but not automatically for later ad processing by others.
- C-687/21, BL v MediaMarktSaturn Hagen-Iserlohn GmbH
Judgment of 25 January 2024ECLI:EU:C:2024:72
Staff mistakenly handing a document to the wrong person does not by itself show inadequate security measures; compensation is compensatory only; where the wrong recipient demonstrably did not read the data, a purely hypothetical risk of misuse is not damage.
- C-33/22, Österreichische Datenschutzbehörde v WK
Judgment of 16 January 2024ECLI:EU:C:2024:46
A national parliament's committee of inquiry is not outside the GDPR merely because it scrutinises the executive or investigates a security agency; where the Member State has a single supervisory authority, that authority can hear complaints about the committee.
- C-231/22, État belge v Autorité de protection des données
Judgment of 11 January 2024ECLI:EU:C:2024:7
A body that runs a national official journal can be a controller of the personal data in what it publishes, even without legal personality, where national law sets the purposes and means; it may be responsible jointly with the bodies that send it the documents.
- C-667/21, ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts
Judgment of 21 December 2023ECLI:EU:C:2023:1022
A medical service may process an employee's health data to assess work capacity under Art. 9(2)(h), but it also needs an Art. 6(1) basis; compensation under Art. 82 is compensatory, not punitive, and requires fault-based liability with a presumption of fault.
- C-340/21, VB v Natsionalna agentsia za prihodite
Judgment of 14 December 2023ECLI:EU:C:2023:986
A data breach by third parties does not in itself prove that security measures were inadequate; the controller bears the burden of proving appropriateness; fear of misuse after a breach can be non-material damage.
- C-456/22, VX and AT v Gemeinde Ummendorf
Judgment of 14 December 2023ECLI:EU:C:2023:988
National rules may not impose a de minimis threshold for non-material damage, but the person must show consequences beyond the mere infringement.
- C-26/22, UF and AB v Land Hessen
Judgment of 7 December 2023ECLI:EU:C:2023:958
Credit agencies may not keep insolvency-discharge data longer than the public register; a person who objects can obtain erasure absent overriding grounds; and supervisory authority decisions on complaints are subject to full judicial review.
- C-634/21, OQ v Land Hessen
Judgment of 7 December 2023ECLI:EU:C:2023:957
Automated credit scoring by a credit agency is itself an automated individual decision under Art. 22(1) where a third party, such as a bank, draws strongly on the score to decide whether to contract with the person.
- C-683/21, Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija
Judgment of 5 December 2023ECLI:EU:C:2023:949
A body that commissioned an app and helped decide its purposes and means can be a controller without processing the data itself; joint control needs no formal arrangement; using real personal data to test software is processing; and a fine requires intent or negligence and can cover processing done by a processor on the controller's behalf.
- C-807/21, Deutsche Wohnen SE v Staatsanwaltschaft Berlin
Judgment of 5 December 2023ECLI:EU:C:2023:950
A company can be fined without first identifying a natural person who committed the breach, but only if it acted intentionally or negligently; for undertakings, the cap is based on the group's turnover under the competition-law notion of undertaking.
- C-319/22, Gesamtverband Autoteile-Handel e.V. v Scania CV AB
Judgment of 9 November 2023ECLI:EU:C:2023:837
Vehicle-type rules create a legal obligation (Art. 6(1)(c)) on car manufacturers to make vehicle identification numbers available to independent operators as controllers; the Court also explained that a VIN can be personal data for someone who can reasonably link it to the vehicle's keeper.
- C-307/22, FT v DW
Judgment of 26 October 2023ECLI:EU:C:2023:811
The first copy of one's data must be free even if the request has no data protection motive; national law cannot make patients pay for it; a patient is entitled to a full copy of medical records where needed to check accuracy.
- C-659/22, RK v Ministerstvo zdravotnictví
Judgment of 5 October 2023ECLI:EU:C:2023:745
Checking the validity of COVID certificates with a national mobile app is 'processing' of personal data, even when no data are stored.
- C-252/21, Meta Platforms Inc and Others v Bundeskartellamt
Judgment of 4 July 2023ECLI:EU:C:2023:537
A competition authority may find GDPR breaches when examining abuse of dominance, in cooperation with data protection authorities; collecting off-platform data that reveal sensitive traits is special-category processing; personalised advertising from such data cannot rest on contract necessity and only narrowly on legitimate interest; dominance does not bar valid consent but weighs on whether it is freely given.
- C-579/21, Proceedings brought by J.M
Judgment of 22 June 2023ECLI:EU:C:2023:501
Access requests made after 25 May 2018 cover earlier processing; people are entitled to the dates and purposes of consultations of their data, but generally not the names of employees who consulted it.
- C-487/21, F.F. v Österreichische Datenschutzbehörde and CRIF GmbH
Judgment of 4 May 2023ECLI:EU:C:2023:369
The right to a copy means a faithful and intelligible reproduction of all the data; it can include copies of extracts or whole documents where needed for the person to exercise their rights, taking account of others' rights.
- C-60/22, UZ v Bundesrepublik Deutschland
Judgment of 4 May 2023ECLI:EU:C:2023:373
A failure to conclude a joint-controller arrangement or keep a record of processing does not by itself make processing unlawful or give a right to erasure or restriction.
- C-300/21, UI v Österreichische Post AG
Judgment of 4 May 2023ECLI:EU:C:2023:370
A breach of the GDPR alone does not give a right to compensation: damage and causation must be shown, but there is no seriousness threshold; the amount follows national rules, subject to EU principles.
- C-34/21, Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums
Judgment of 30 March 2023ECLI:EU:C:2023:270
National employment data rules that only repeat general GDPR conditions are not 'more specific rules' under Art. 88 and must be disapplied unless they are a valid legal basis under Art. 6(3).
- C-268/21, Norra Stockholm Bygg AB v Per Nycander AB
Judgment of 2 March 2023ECLI:EU:C:2023:145
When a civil court is asked to order disclosure of a document containing third parties' personal data, the GDPR applies and the court must weigh those persons' interests, applying proportionality and data minimisation.
- C-453/21, X-FAB Dresden GmbH & Co. KG v FC
Judgment of 9 February 2023ECLI:EU:C:2023:79
Confirms national just-cause protection for DPOs; a conflict of interests exists where the DPO also has tasks that involve deciding purposes and means of processing, assessed case by case.
- C-154/21, RW v Österreichische Post AG
Judgment of 12 January 2023ECLI:EU:C:2023:3
The right of access includes the actual identity of recipients to whom data were disclosed, not just categories, unless they cannot be identified or the request is manifestly unfounded or excessive.
- C-132/21, BE v Nemzeti Adatvédelmi és Információszabadság Hatóság
Judgment of 12 January 2023ECLI:EU:C:2023:2
Complaints to an authority, appeals against its decisions and direct court actions against controllers can be pursued in parallel and independently; Member States set rules to avoid conflicting outcomes.
- C-460/20, TU and RE v Google LLC
Judgment of 8 December 2022ECLI:EU:C:2022:962
A person seeking delisting of allegedly inaccurate content need not first obtain a court ruling; they must show manifest inaccuracy with evidence reasonably required; for photo thumbnails, their own informative value is assessed.
- C-77/21, Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság
Judgment of 20 October 2022ECLI:EU:C:2022:805
Copying customer data into a test database can be compatible further processing under Art. 6(4), but keeping the data there longer than needed for testing breaches storage limitation.
- C-184/20, OT v Vyriausioji tarnybinės etikos komisija
Judgment of 1 August 2022ECLI:EU:C:2022:601
Publishing online the declarations of interests of public officials, including names of spouses and partners, is disproportionate; data that can indirectly reveal sexual orientation are special-category data.
- C-534/20, Leistritz AG v LH
Judgment of 22 June 2022ECLI:EU:C:2022:495
Member States may give data protection officers stronger protection against dismissal than the GDPR, such as dismissal only for just cause, if this does not undermine the GDPR's aims.
- C-319/20, Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband eV
Judgment of 28 April 2022ECLI:EU:C:2022:322
National law may let consumer associations sue for GDPR breaches without a mandate and without identifying specific victims, through unfair-practices or consumer law.
- C-245/20, X and Z v Autoriteit Persoonsgegevens
Judgment of 24 March 2022ECLI:EU:C:2022:216
A court that temporarily gives journalists access to case documents containing personal data, so they can report on proceedings, acts in its 'judicial capacity', so the data protection authority is not competent to supervise that act.
- C-175/20, SIA 'SS' v Valsts ieņēmumu dienests
Judgment of 24 February 2022ECLI:EU:C:2022:124
A tax authority that collects large amounts of personal data from a business must respect the principles in Art. 5(1); it may only derogate from them on the basis of a legislative measure under Art. 23(1).
- C-439/19, Proceedings brought by B
Judgment of 22 June 2021ECLI:EU:C:2021:504
Penalty points for traffic offences are data on criminal offences under Art. 10; the GDPR precludes a law making them publicly available without the requester showing a specific interest, or passing them on to businesses for reuse.
- C-645/19, Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit
Judgment of 15 June 2021ECLI:EU:C:2021:483
A non-lead supervisory authority may go to court over cross-border processing only in the situations where the GDPR gives it competence and while respecting the cooperation and consistency procedures; the defendant need not have an establishment in that State.
- C-61/19, Orange Romania SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Judgment of 11 November 2020ECLI:EU:C:2020:901
The controller must prove that consent was given by active behaviour after clear information; a contract with a pre-ticked box for storing ID copies does not show valid consent, nor does a form that makes refusal harder.
- C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems
Judgment of 16 July 2020ECLI:EU:C:2020:559
Transfers under standard contractual clauses require essentially equivalent protection, assessed case by case including access by foreign authorities; authorities must suspend or prohibit transfers that cannot be protected; the Commission's SCC decision stays valid; the EU-US Privacy Shield decision is invalid.
Related (earlier law or other instruments)
Judgments on Directive 95/46/EC, which the GDPR replaced, or mainly on another instrument.
- C-413/23 P, European Data Protection Supervisor v Single Resolution Board
Judgment of 4 September 2025ECLI:EU:C:2025:645
Instrument: Regulation (EU) 2018/1725 (EU institutions; definitions mirror the GDPR)
On appeal, the Court held that pseudonymised data are not necessarily personal data for every recipient, but that the controller's duty to inform people about recipients is judged from the controller's own position at the time of collection; it set aside the General Court's judgment and sent part of the case back.
- C-129/21, Proximus NV v Gegevensbeschermingsautoriteit
Judgment of 27 October 2022ECLI:EU:C:2022:833
Instrument: GDPR together with the ePrivacy Directive
Consent to appear in phone directories, given once, covers all directory publishers; a request to be removed is an erasure request, and the controller must inform other controllers it supplied.
- C-597/19, Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA
Judgment of 17 June 2021ECLI:EU:C:2021:492
Instrument: GDPR together with the IP Enforcement and ePrivacy Directives
A copyright holder's systematic recording of IP addresses of file sharers, and the internet provider's disclosure of subscribers' names for a damages claim, can rest on legitimate interest, provided the request is justified, proportionate and not abusive, and any obligation to disclose is based on a legislative measure.
- C-511/18, La Quadrature du Net and Others v Premier ministre and Others (joined cases C-511/18, C-512/18 and C-520/18)
Judgment of 6 October 2020ECLI:EU:C:2020:791
Instrument: Mainly the ePrivacy Directive 2002/58; the GDPR is relied on only for one question
National laws may not require general and indiscriminate retention of traffic and location data as a preventive measure, subject to narrow exceptions (national security threats, IP addresses, civil identity, expedited retention under judicial control).
- C-673/17, Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. v Planet49 GmbH
Judgment of 1 October 2019ECLI:EU:C:2019:801
Instrument: GDPR together with the ePrivacy Directive (Art. 5(3))
A pre-ticked checkbox does not give valid consent to cookies, whether or not the data are personal data; users must be told how long cookies last and whether third parties can access them.
- C-136/17, GC and Others v Commission nationale de l'informatique et des libertés (CNIL)
Judgment of 24 September 2019ECLI:EU:C:2019:773
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
The ban on processing sensitive and criminal-offence data applies to search engines when they handle delisting requests; they must in principle delist such links unless a strict balancing, including the public's interest in the information, justifies keeping them.
- C-507/17, Google LLC, successor in law to Google Inc. v Commission nationale de l'informatique et des libertés (CNIL)
Judgment of 24 September 2019ECLI:EU:C:2019:772
Instrument: GDPR together with Directive 95/46
A search engine that grants delisting need not do so on all versions worldwide, but must do so on all EU versions and use measures to discourage EU users from reaching the links.
- C-40/17, Fashion ID GmbH & Co.KG v Verbraucherzentrale NRW eV
Judgment of 29 July 2019ECLI:EU:C:2019:629
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
A website that embeds a social plugin is a joint controller with the plugin provider for collecting and sending visitors' data, but only for that stage; each must pursue a legitimate interest, and the site must obtain any consent and give information for the stage it controls.
- C-25/17, Proceedings brought by Tietosuojavaltuutettu
Judgment of 10 July 2018ECLI:EU:C:2018:551
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
Notes taken by members of a religious community during door-to-door preaching are not a purely personal activity and can form a filing system; the community can be a controller jointly with its members even without access to the data.
- C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH
Judgment of 5 June 2018ECLI:EU:C:2018:388
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
The administrator of a fan page on a social network is a controller jointly with the network; a supervisory authority can act against the network's local establishment in its own Member State.
- C-582/14, Patrick Breyer v Bundesrepublik Deutschland
Judgment of 19 October 2016ECLI:EU:C:2016:779
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
A dynamic IP address held by a website operator is personal data where the operator has lawful means to identify the user with additional data held by the internet access provider; national law may not exclude legitimate interest as a basis for such processing in advance.
- C-362/14, Maximillian Schrems v Data Protection Commissioner
Judgment of 6 October 2015ECLI:EU:C:2015:650
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
Declared the Safe Harbour adequacy decision invalid; an adequacy decision does not stop data protection authorities examining complaints about transfers.
- C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González
Judgment of 13 May 2014ECLI:EU:C:2014:317
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
A search engine operator processes personal data and is a controller for that processing; EU law applies where it has an establishment selling advertising in a Member State; and a person can ask it to remove links to information about them that is inadequate, irrelevant or no longer relevant, after a balancing of rights.