--- title: "Court of Justice judgments on the GDPR" canonical: "https://dposchool.com/gdpr/cases" source: - "https://curia.europa.eu/juris/liste.jsf?num=C-474/24&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-199/24&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-484/24&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-414/24&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-526/24&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-97/23%20P&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-422/24&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-492/23&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-413/23%20P&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-655/23&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-247/23&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-638/23&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-203/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-383/23&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-394/23&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-416/23&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-65/23&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-169/23&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-621/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-446/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-21/23&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-200/23&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-507/23&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-768/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-17/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-757/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-590/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-182/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-741/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-604/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-687/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-33/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-231/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-667/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-340/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-456/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-26/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-634/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-683/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-807/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-319/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-307/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-659/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-252/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-579/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-487/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-60/22&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-300/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-34/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-268/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-453/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-154/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-132/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-460/20&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-129/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-77/21&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-184/20&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-534/20&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-319/20&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-245/20&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-175/20&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-439/19&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-597/19&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-645/19&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-61/19&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-511/18&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-311/18&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-673/17&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-136/17&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-507/17&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-40/17&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-25/17&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-210/16&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-582/14&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-362/14&language=en" - "https://curia.europa.eu/juris/liste.jsf?num=C-131/12&language=en" source_note: "Only the judgment as published by the Court of Justice is authoritative." text_as_of: "2026-10-28" language: "en" publisher: "DPO School" --- # Court of Justice judgments Judgments of the Court of Justice of the European Union on the General Data Protection Regulation, newest first. Checked against CURIA and EUR-Lex on 28 October 2026. ## [C-474/24, AR and Others v Österreichische Datenschutzbehörde and Others](https://dposchool.com/gdpr/case/c-474-24) Judgment of 14 July 2026 · ECLI:EU:C:2026:579 Publishing the names and sanctions of athletes who broke anti-doping rules falls within the GDPR; it is not in principle health data unless the substance or method reveals health information; national law may require publication if it allows an individual balancing and excludes recreational athletes, vulnerable persons and whistleblowers. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-474/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0474) ## [C-199/24, ND v Legal Newsdesk Sweden AB, anciennement Garrapatica AB](https://dposchool.com/gdpr/case/c-199-24) Judgment of 9 July 2026 · ECLI:EU:C:2026:564 Member States cannot use Art. 85(1) to create derogations beyond those allowed by Art. 85(2) for processing that is not journalistic, academic, artistic or literary. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-199/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0199) ## [C-484/24, NTH Haustechnik GmbH v EM](https://dposchool.com/gdpr/case/c-484-24) Judgment of 18 June 2026 · ECLI:EU:C:2026:496 National procedural rules that require courts to consider all evidence submitted by the parties can be a valid legal basis for processing personal data in that evidence, provided clear and foreseeable national case-law sets the conditions for its use. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-484/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0484) ## [C-414/24, Datenschutzbehörde and Dr. G S v Bundesministerin für Justiz and D GmbH](https://dposchool.com/gdpr/case/c-414-24) Judgment of 18 June 2026 · ECLI:EU:C:2026:493 A supervisory authority may not reject a complaint just because court proceedings on the same matter are already pending. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-414/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0414) ## [C-526/24, Brillen Rottler GmbH & Co. KG v TC](https://dposchool.com/gdpr/case/c-526-24) Judgment of 19 March 2026 · ECLI:EU:C:2026:216 Even a first access request can be refused as excessive if the controller proves it was made with abusive intent, such as manufacturing a damages claim; a breach of the right of access can give rise to compensation, including for loss of control, if actual damage is shown. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-526/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0526) ## [C-97/23 P, WhatsApp Ireland Ltd v European Data Protection Board](https://dposchool.com/gdpr/case/c-97-23-p) Judgment of 10 February 2026 · ECLI:EU:C:2026:81 A controller can bring an action for annulment before the EU courts against an EDPB binding decision in a dispute between authorities: the Court set aside the General Court's order of inadmissibility, declared the action admissible and sent it back for a ruling on the merits. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-97/23%20P&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0097) ## [C-422/24, Integritetsskyddsmyndigheten v AB Storstockholms Lokaltrafik](https://dposchool.com/gdpr/case/c-422-24) Judgment of 18 December 2025 · ECLI:EU:C:2025:980 Data recorded by body cameras worn by ticket inspectors are collected from the data subject, so information must be given under Art. 13, not Art. 14. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-422/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0422) ## [C-492/23, X v Russmedia Digital SRL and Inform Media Press SRL](https://dposchool.com/gdpr/case/c-492-23) Judgment of 2 December 2025 · ECLI:EU:C:2025:935 An online marketplace operator is a controller of personal data in ads published on its site; before publication it must identify ads with sensitive data, check the advertiser is the person concerned or has explicit consent, take security measures against copying, and cannot rely on the hosting exemptions of the e-Commerce Directive for these GDPR duties. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-492/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0492) ## [C-655/23, IP v Quirin Privatbank AG](https://dposchool.com/gdpr/case/c-655-23) Judgment of 4 September 2025 · ECLI:EU:C:2025:655 The GDPR does not itself give a right to a court order stopping future unlawful processing, though national law may; negative feelings from loss of control can be damage if proven; fault and any injunction cannot reduce compensation. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-655/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0655) ## [C-247/23, VP v Országos Idegenrendészeti Főigazgatóság](https://dposchool.com/gdpr/case/c-247-23) Judgment of 13 March 2025 · ECLI:EU:C:2025:172 A public register must rectify inaccurate data on a person's gender identity; reasonable evidence may be required, but not proof of gender reassignment surgery. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-247/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0247) ## [C-638/23, Amt der Tiroler Landesregierung v Datenschutzbehörde](https://dposchool.com/gdpr/case/c-638-23) Judgment of 27 February 2025 · ECLI:EU:C:2025:127 National law may designate as controller an administrative unit without legal personality, and need not list each processing operation, if the unit can meet a controller's duties and the law at least implicitly sets the scope of the processing. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-638/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0638) ## [C-203/22, CK v Magistrat der Stadt Wien](https://dposchool.com/gdpr/case/c-203-22) Judgment of 27 February 2025 · ECLI:EU:C:2025:117 For automated decisions, 'meaningful information about the logic involved' means explaining the procedure and principles actually applied, in an understandable way; where trade secrets or third-party data are claimed, the controller must give them to the authority or court to balance. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-203/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0203) ## [C-383/23, Criminal proceedings against ILVA A/S](https://dposchool.com/gdpr/case/c-383-23) Judgment of 13 February 2025 · ECLI:EU:C:2025:84 'Undertaking' in Art. 83 has the competition-law meaning, so the maximum fine is a percentage of the whole group's worldwide turnover, which is also relevant to setting an effective and proportionate fine. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-383/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0383) ## [C-394/23, Mousse v Commission nationale de l'informatique et des libertés (CNIL) and SNCF Connect](https://dposchool.com/gdpr/case/c-394-23) Judgment of 9 January 2025 · ECLI:EU:C:2025:2 Making customers state a title (Mr or Ms) to buy a train ticket is not necessary for the contract and cannot rest on legitimate interest where customers were not told of that interest, the data are not strictly necessary, or the risk of discrimination outweighs it; the right to object does not change the necessity test. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-394/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0394) ## [C-416/23, Österreichische Datenschutzbehörde v F R](https://dposchool.com/gdpr/case/c-416-23) Judgment of 9 January 2025 · ECLI:EU:C:2025:3 Complaints count as 'requests' under Art. 57(4); an authority cannot treat them as excessive just because there are many, it must show abusive intent; it may then charge a fee or refuse, choosing the proportionate option. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-416/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0416) ## [C-65/23, MK v K GmbH](https://dposchool.com/gdpr/case/c-65-23) Judgment of 19 December 2024 · ECLI:EU:C:2024:1051 Works agreements on employee data must meet Arts. 5, 6(1) and 9 as well as Art. 88(2), and courts can fully review whether processing under them is necessary. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-65/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0065) ## [C-169/23, Nemzeti Adatvédelmi és Információszabadság Hatóság v UC](https://dposchool.com/gdpr/case/c-169-23) Judgment of 28 November 2024 · ECLI:EU:C:2024:988 The exception from informing people when national law provides for obtaining or disclosing data applies also to data the controller generates itself; the authority may check that national law gives adequate safeguards. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-169/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0169) ## [C-621/22, Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens](https://dposchool.com/gdpr/case/c-621-22) Judgment of 4 October 2024 · ECLI:EU:C:2024:858 A purely commercial interest, such as selling members' data to sponsors, can be a legitimate interest if it is lawful, but the processing must be strictly necessary and pass the balancing test. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-621/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0621) ## [C-446/21, Maximilian Schrems v Meta Platforms Ireland Limited](https://dposchool.com/gdpr/case/c-446-21) Judgment of 4 October 2024 · ECLI:EU:C:2024:834 Data minimisation prevents a social network from using all personal data it collects, on or off the platform, for targeted advertising without limits of time or type; a person who speaks publicly about their sexual orientation does not thereby allow the network to process other data about it for advertising. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-446/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0446) ## [C-21/23, ND v DR](https://dposchool.com/gdpr/case/c-21-23) Judgment of 4 October 2024 · ECLI:EU:C:2024:846 Competitors may sue under unfair-competition law for GDPR breaches; order data entered to buy pharmacy-only medicines online are health data even without a prescription. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-21/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0021) ## [C-200/23, Agentsia po vpisvaniyata v OL](https://dposchool.com/gdpr/case/c-200-23) Judgment of 4 October 2024 · ECLI:EU:C:2024:827 A commercial register that publishes company documents is a controller and recipient of the personal data in them; it cannot refuse erasure of unrequired data; loss of control can be non-material damage. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-200/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0200) ## [C-507/23, A v Patērētāju tiesību aizsardzības centrs](https://dposchool.com/gdpr/case/c-507-23) Judgment of 4 October 2024 · ECLI:EU:C:2024:854 An apology can be sufficient compensation for non-material damage where it fully compensates the harm; the controller's attitude and motives cannot reduce compensation. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-507/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0507) ## [C-768/21, TR v Land Hessen](https://dposchool.com/gdpr/case/c-768-21) Judgment of 26 September 2024 · ECLI:EU:C:2024:785 After finding a breach, a supervisory authority need not impose a fine or other corrective measure where that is not appropriate, necessary or proportionate to remedy the shortcoming. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-768/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0768) ## [C-17/22, HTB Neunte Immobilien Portfolio and Ökorenta Neue Energien Ökostabil IV](https://dposchool.com/gdpr/case/c-17-22) Judgment of 12 September 2024 · ECLI:EU:C:2024:738 Giving one investor the contact details of all indirect investors in a fund can be necessary for the contract only if objectively indispensable to it; it may otherwise rest on legitimate interest if strictly necessary and the balance favours it. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-17/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0017) ## [C-757/22, Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V](https://dposchool.com/gdpr/case/c-757-22) Judgment of 11 July 2024 · ECLI:EU:C:2024:598 Consumer associations can bring representative actions for failures to inform users about purposes and recipients, because such failures are infringements 'as a result of the processing'. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-757/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0757) ## [C-590/22, AT and BT v PS GbR and Others](https://dposchool.com/gdpr/case/c-590-22) Judgment of 20 June 2024 · ECLI:EU:C:2024:536 A proven fear that data were disclosed to third parties can be non-material damage even without proof of actual disclosure; damages do not have a punitive function. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-590/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0590) ## [C-182/22, JU and SO v Scalable Capital GmbH](https://dposchool.com/gdpr/case/c-182-22) Judgment of 20 June 2024 · ECLI:EU:C:2024:531 Damages under Art. 82 are purely compensatory; non-material damage from a breach is not by nature less significant than physical injury; small damage may receive small compensation; 'identity theft' requires actual misuse of identity. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-182/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0182) ## [C-741/21, GP v juris GmbH](https://dposchool.com/gdpr/case/c-741-21) Judgment of 11 April 2024 · ECLI:EU:C:2024:288 Infringement alone is not damage; the controller cannot escape liability by blaming an employee acting under its authority; fine criteria in Art. 83 are not used to set damages. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-741/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0741) ## [C-604/22, IAB Europe v Gegevensbeschermingsautoriteit](https://dposchool.com/gdpr/case/c-604-22) Judgment of 7 March 2024 · ECLI:EU:C:2024:214 A consent string recording a user's ad-tracking choices is personal data where it can reasonably be linked to an identifier such as an IP address; a sector body that sets binding rules for such strings can be a joint controller even without access to the data, but not automatically for later ad processing by others. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-604/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0604) ## [C-687/21, BL v MediaMarktSaturn Hagen-Iserlohn GmbH](https://dposchool.com/gdpr/case/c-687-21) Judgment of 25 January 2024 · ECLI:EU:C:2024:72 Staff mistakenly handing a document to the wrong person does not by itself show inadequate security measures; compensation is compensatory only; where the wrong recipient demonstrably did not read the data, a purely hypothetical risk of misuse is not damage. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-687/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0687) ## [C-33/22, Österreichische Datenschutzbehörde v WK](https://dposchool.com/gdpr/case/c-33-22) Judgment of 16 January 2024 · ECLI:EU:C:2024:46 A national parliament's committee of inquiry is not outside the GDPR merely because it scrutinises the executive or investigates a security agency; where the Member State has a single supervisory authority, that authority can hear complaints about the committee. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-33/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0033) ## [C-231/22, État belge v Autorité de protection des données](https://dposchool.com/gdpr/case/c-231-22) Judgment of 11 January 2024 · ECLI:EU:C:2024:7 A body that runs a national official journal can be a controller of the personal data in what it publishes, even without legal personality, where national law sets the purposes and means; it may be responsible jointly with the bodies that send it the documents. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-231/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0231) ## [C-667/21, ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts](https://dposchool.com/gdpr/case/c-667-21) Judgment of 21 December 2023 · ECLI:EU:C:2023:1022 A medical service may process an employee's health data to assess work capacity under Art. 9(2)(h), but it also needs an Art. 6(1) basis; compensation under Art. 82 is compensatory, not punitive, and requires fault-based liability with a presumption of fault. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-667/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0667) ## [C-340/21, VB v Natsionalna agentsia za prihodite](https://dposchool.com/gdpr/case/c-340-21) Judgment of 14 December 2023 · ECLI:EU:C:2023:986 A data breach by third parties does not in itself prove that security measures were inadequate; the controller bears the burden of proving appropriateness; fear of misuse after a breach can be non-material damage. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-340/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0340) ## [C-456/22, VX and AT v Gemeinde Ummendorf](https://dposchool.com/gdpr/case/c-456-22) Judgment of 14 December 2023 · ECLI:EU:C:2023:988 National rules may not impose a de minimis threshold for non-material damage, but the person must show consequences beyond the mere infringement. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-456/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0456) ## [C-26/22, UF and AB v Land Hessen](https://dposchool.com/gdpr/case/c-26-22) Judgment of 7 December 2023 · ECLI:EU:C:2023:958 Credit agencies may not keep insolvency-discharge data longer than the public register; a person who objects can obtain erasure absent overriding grounds; and supervisory authority decisions on complaints are subject to full judicial review. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-26/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0026) ## [C-634/21, OQ v Land Hessen](https://dposchool.com/gdpr/case/c-634-21) Judgment of 7 December 2023 · ECLI:EU:C:2023:957 Automated credit scoring by a credit agency is itself an automated individual decision under Art. 22(1) where a third party, such as a bank, draws strongly on the score to decide whether to contract with the person. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-634/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0634) ## [C-683/21, Nacionalinis visuomenės sveikatos centras prie Sveikatos apsaugos ministerijos v Valstybinė duomenų apsaugos inspekcija](https://dposchool.com/gdpr/case/c-683-21) Judgment of 5 December 2023 · ECLI:EU:C:2023:949 A body that commissioned an app and helped decide its purposes and means can be a controller without processing the data itself; joint control needs no formal arrangement; using real personal data to test software is processing; and a fine requires intent or negligence and can cover processing done by a processor on the controller's behalf. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-683/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0683) ## [C-807/21, Deutsche Wohnen SE v Staatsanwaltschaft Berlin](https://dposchool.com/gdpr/case/c-807-21) Judgment of 5 December 2023 · ECLI:EU:C:2023:950 A company can be fined without first identifying a natural person who committed the breach, but only if it acted intentionally or negligently; for undertakings, the cap is based on the group's turnover under the competition-law notion of undertaking. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-807/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0807) ## [C-319/22, Gesamtverband Autoteile-Handel e.V. v Scania CV AB](https://dposchool.com/gdpr/case/c-319-22) Judgment of 9 November 2023 · ECLI:EU:C:2023:837 Vehicle-type rules create a legal obligation (Art. 6(1)(c)) on car manufacturers to make vehicle identification numbers available to independent operators as controllers; the Court also explained that a VIN can be personal data for someone who can reasonably link it to the vehicle's keeper. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-319/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0319) ## [C-307/22, FT v DW](https://dposchool.com/gdpr/case/c-307-22) Judgment of 26 October 2023 · ECLI:EU:C:2023:811 The first copy of one's data must be free even if the request has no data protection motive; national law cannot make patients pay for it; a patient is entitled to a full copy of medical records where needed to check accuracy. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-307/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0307) ## [C-659/22, RK v Ministerstvo zdravotnictví](https://dposchool.com/gdpr/case/c-659-22) Judgment of 5 October 2023 · ECLI:EU:C:2023:745 Checking the validity of COVID certificates with a national mobile app is 'processing' of personal data, even when no data are stored. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-659/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0659) ## [C-252/21, Meta Platforms Inc and Others v Bundeskartellamt](https://dposchool.com/gdpr/case/c-252-21) Judgment of 4 July 2023 · ECLI:EU:C:2023:537 A competition authority may find GDPR breaches when examining abuse of dominance, in cooperation with data protection authorities; collecting off-platform data that reveal sensitive traits is special-category processing; personalised advertising from such data cannot rest on contract necessity and only narrowly on legitimate interest; dominance does not bar valid consent but weighs on whether it is freely given. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-252/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252) ## [C-579/21, Proceedings brought by J.M](https://dposchool.com/gdpr/case/c-579-21) Judgment of 22 June 2023 · ECLI:EU:C:2023:501 Access requests made after 25 May 2018 cover earlier processing; people are entitled to the dates and purposes of consultations of their data, but generally not the names of employees who consulted it. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-579/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0579) ## [C-487/21, F.F. v Österreichische Datenschutzbehörde and CRIF GmbH](https://dposchool.com/gdpr/case/c-487-21) Judgment of 4 May 2023 · ECLI:EU:C:2023:369 The right to a copy means a faithful and intelligible reproduction of all the data; it can include copies of extracts or whole documents where needed for the person to exercise their rights, taking account of others' rights. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-487/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0487) ## [C-60/22, UZ v Bundesrepublik Deutschland](https://dposchool.com/gdpr/case/c-60-22) Judgment of 4 May 2023 · ECLI:EU:C:2023:373 A failure to conclude a joint-controller arrangement or keep a record of processing does not by itself make processing unlawful or give a right to erasure or restriction. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-60/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0060) ## [C-300/21, UI v Österreichische Post AG](https://dposchool.com/gdpr/case/c-300-21) Judgment of 4 May 2023 · ECLI:EU:C:2023:370 A breach of the GDPR alone does not give a right to compensation: damage and causation must be shown, but there is no seriousness threshold; the amount follows national rules, subject to EU principles. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-300/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0300) ## [C-34/21, Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums](https://dposchool.com/gdpr/case/c-34-21) Judgment of 30 March 2023 · ECLI:EU:C:2023:270 National employment data rules that only repeat general GDPR conditions are not 'more specific rules' under Art. 88 and must be disapplied unless they are a valid legal basis under Art. 6(3). [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-34/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0034) ## [C-268/21, Norra Stockholm Bygg AB v Per Nycander AB](https://dposchool.com/gdpr/case/c-268-21) Judgment of 2 March 2023 · ECLI:EU:C:2023:145 When a civil court is asked to order disclosure of a document containing third parties' personal data, the GDPR applies and the court must weigh those persons' interests, applying proportionality and data minimisation. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-268/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0268) ## [C-453/21, X-FAB Dresden GmbH & Co. KG v FC](https://dposchool.com/gdpr/case/c-453-21) Judgment of 9 February 2023 · ECLI:EU:C:2023:79 Confirms national just-cause protection for DPOs; a conflict of interests exists where the DPO also has tasks that involve deciding purposes and means of processing, assessed case by case. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-453/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0453) ## [C-154/21, RW v Österreichische Post AG](https://dposchool.com/gdpr/case/c-154-21) Judgment of 12 January 2023 · ECLI:EU:C:2023:3 The right of access includes the actual identity of recipients to whom data were disclosed, not just categories, unless they cannot be identified or the request is manifestly unfounded or excessive. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-154/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0154) ## [C-132/21, BE v Nemzeti Adatvédelmi és Információszabadság Hatóság](https://dposchool.com/gdpr/case/c-132-21) Judgment of 12 January 2023 · ECLI:EU:C:2023:2 Complaints to an authority, appeals against its decisions and direct court actions against controllers can be pursued in parallel and independently; Member States set rules to avoid conflicting outcomes. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-132/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0132) ## [C-460/20, TU and RE v Google LLC](https://dposchool.com/gdpr/case/c-460-20) Judgment of 8 December 2022 · ECLI:EU:C:2022:962 A person seeking delisting of allegedly inaccurate content need not first obtain a court ruling; they must show manifest inaccuracy with evidence reasonably required; for photo thumbnails, their own informative value is assessed. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-460/20&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0460) ## [C-77/21, Digi Távközlési és Szolgáltató Kft. v Nemzeti Adatvédelmi és Információszabadság Hatóság](https://dposchool.com/gdpr/case/c-77-21) Judgment of 20 October 2022 · ECLI:EU:C:2022:805 Copying customer data into a test database can be compatible further processing under Art. 6(4), but keeping the data there longer than needed for testing breaches storage limitation. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-77/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0077) ## [C-184/20, OT v Vyriausioji tarnybinės etikos komisija](https://dposchool.com/gdpr/case/c-184-20) Judgment of 1 August 2022 · ECLI:EU:C:2022:601 Publishing online the declarations of interests of public officials, including names of spouses and partners, is disproportionate; data that can indirectly reveal sexual orientation are special-category data. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-184/20&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0184) ## [C-534/20, Leistritz AG v LH](https://dposchool.com/gdpr/case/c-534-20) Judgment of 22 June 2022 · ECLI:EU:C:2022:495 Member States may give data protection officers stronger protection against dismissal than the GDPR, such as dismissal only for just cause, if this does not undermine the GDPR's aims. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-534/20&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0534) ## [C-319/20, Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband eV](https://dposchool.com/gdpr/case/c-319-20) Judgment of 28 April 2022 · ECLI:EU:C:2022:322 National law may let consumer associations sue for GDPR breaches without a mandate and without identifying specific victims, through unfair-practices or consumer law. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-319/20&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0319) ## [C-245/20, X and Z v Autoriteit Persoonsgegevens](https://dposchool.com/gdpr/case/c-245-20) Judgment of 24 March 2022 · ECLI:EU:C:2022:216 A court that temporarily gives journalists access to case documents containing personal data, so they can report on proceedings, acts in its 'judicial capacity', so the data protection authority is not competent to supervise that act. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-245/20&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0245) ## [C-175/20, SIA 'SS' v Valsts ieņēmumu dienests](https://dposchool.com/gdpr/case/c-175-20) Judgment of 24 February 2022 · ECLI:EU:C:2022:124 A tax authority that collects large amounts of personal data from a business must respect the principles in Art. 5(1); it may only derogate from them on the basis of a legislative measure under Art. 23(1). [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-175/20&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0175) ## [C-439/19, Proceedings brought by B](https://dposchool.com/gdpr/case/c-439-19) Judgment of 22 June 2021 · ECLI:EU:C:2021:504 Penalty points for traffic offences are data on criminal offences under Art. 10; the GDPR precludes a law making them publicly available without the requester showing a specific interest, or passing them on to businesses for reuse. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-439/19&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0439) ## [C-645/19, Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit](https://dposchool.com/gdpr/case/c-645-19) Judgment of 15 June 2021 · ECLI:EU:C:2021:483 A non-lead supervisory authority may go to court over cross-border processing only in the situations where the GDPR gives it competence and while respecting the cooperation and consistency procedures; the defendant need not have an establishment in that State. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-645/19&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0645) ## [C-61/19, Orange Romania SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)](https://dposchool.com/gdpr/case/c-61-19) Judgment of 11 November 2020 · ECLI:EU:C:2020:901 The controller must prove that consent was given by active behaviour after clear information; a contract with a pre-ticked box for storing ID copies does not show valid consent, nor does a form that makes refusal harder. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-61/19&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0061) ## [C-311/18, Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems](https://dposchool.com/gdpr/case/c-311-18) Judgment of 16 July 2020 · ECLI:EU:C:2020:559 Transfers under standard contractual clauses require essentially equivalent protection, assessed case by case including access by foreign authorities; authorities must suspend or prohibit transfers that cannot be protected; the Commission's SCC decision stays valid; the EU-US Privacy Shield decision is invalid. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-311/18&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311) ## Related (earlier law or other instruments) Judgments on Directive 95/46/EC, which the GDPR replaced, or mainly on another instrument. ### [C-413/23 P, European Data Protection Supervisor v Single Resolution Board](https://dposchool.com/gdpr/case/c-413-23-p) Judgment of 4 September 2025 · ECLI:EU:C:2025:645 Instrument: Regulation (EU) 2018/1725 (EU institutions; definitions mirror the GDPR) On appeal, the Court held that pseudonymised data are not necessarily personal data for every recipient, but that the controller's duty to inform people about recipients is judged from the controller's own position at the time of collection; it set aside the General Court's judgment and sent part of the case back. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-413/23%20P&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0413) ### [C-129/21, Proximus NV v Gegevensbeschermingsautoriteit](https://dposchool.com/gdpr/case/c-129-21) Judgment of 27 October 2022 · ECLI:EU:C:2022:833 Instrument: GDPR together with the ePrivacy Directive Consent to appear in phone directories, given once, covers all directory publishers; a request to be removed is an erasure request, and the controller must inform other controllers it supplied. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-129/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0129) ### [C-597/19, Mircom International Content Management & Consulting (M.I.C.M.) Limited v Telenet BVBA](https://dposchool.com/gdpr/case/c-597-19) Judgment of 17 June 2021 · ECLI:EU:C:2021:492 Instrument: GDPR together with the IP Enforcement and ePrivacy Directives A copyright holder's systematic recording of IP addresses of file sharers, and the internet provider's disclosure of subscribers' names for a damages claim, can rest on legitimate interest, provided the request is justified, proportionate and not abusive, and any obligation to disclose is based on a legislative measure. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-597/19&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0597) ### [C-511/18, La Quadrature du Net and Others v Premier ministre and Others (joined cases C-511/18, C-512/18 and C-520/18)](https://dposchool.com/gdpr/case/c-511-18) Judgment of 6 October 2020 · ECLI:EU:C:2020:791 Instrument: Mainly the ePrivacy Directive 2002/58; the GDPR is relied on only for one question National laws may not require general and indiscriminate retention of traffic and location data as a preventive measure, subject to narrow exceptions (national security threats, IP addresses, civil identity, expedited retention under judicial control). [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-511/18&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0511) ### [C-673/17, Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. v Planet49 GmbH](https://dposchool.com/gdpr/case/c-673-17) Judgment of 1 October 2019 · ECLI:EU:C:2019:801 Instrument: GDPR together with the ePrivacy Directive (Art. 5(3)) A pre-ticked checkbox does not give valid consent to cookies, whether or not the data are personal data; users must be told how long cookies last and whether third parties can access them. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-673/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0673) ### [C-136/17, GC and Others v Commission nationale de l'informatique et des libertés (CNIL)](https://dposchool.com/gdpr/case/c-136-17) Judgment of 24 September 2019 · ECLI:EU:C:2019:773 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) The ban on processing sensitive and criminal-offence data applies to search engines when they handle delisting requests; they must in principle delist such links unless a strict balancing, including the public's interest in the information, justifies keeping them. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-136/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0136) ### [C-507/17, Google LLC, successor in law to Google Inc. v Commission nationale de l'informatique et des libertés (CNIL)](https://dposchool.com/gdpr/case/c-507-17) Judgment of 24 September 2019 · ECLI:EU:C:2019:772 Instrument: GDPR together with Directive 95/46 A search engine that grants delisting need not do so on all versions worldwide, but must do so on all EU versions and use measures to discourage EU users from reaching the links. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-507/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0507) ### [C-40/17, Fashion ID GmbH & Co.KG v Verbraucherzentrale NRW eV](https://dposchool.com/gdpr/case/c-40-17) Judgment of 29 July 2019 · ECLI:EU:C:2019:629 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) A website that embeds a social plugin is a joint controller with the plugin provider for collecting and sending visitors' data, but only for that stage; each must pursue a legitimate interest, and the site must obtain any consent and give information for the stage it controls. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-40/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0040) ### [C-25/17, Proceedings brought by Tietosuojavaltuutettu](https://dposchool.com/gdpr/case/c-25-17) Judgment of 10 July 2018 · ECLI:EU:C:2018:551 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) Notes taken by members of a religious community during door-to-door preaching are not a purely personal activity and can form a filing system; the community can be a controller jointly with its members even without access to the data. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-25/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0025) ### [C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH](https://dposchool.com/gdpr/case/c-210-16) Judgment of 5 June 2018 · ECLI:EU:C:2018:388 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) The administrator of a fan page on a social network is a controller jointly with the network; a supervisory authority can act against the network's local establishment in its own Member State. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-210/16&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62016CJ0210) ### [C-582/14, Patrick Breyer v Bundesrepublik Deutschland](https://dposchool.com/gdpr/case/c-582-14) Judgment of 19 October 2016 · ECLI:EU:C:2016:779 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) A dynamic IP address held by a website operator is personal data where the operator has lawful means to identify the user with additional data held by the internet access provider; national law may not exclude legitimate interest as a basis for such processing in advance. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-582/14&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0582) ### [C-362/14, Maximillian Schrems v Data Protection Commissioner](https://dposchool.com/gdpr/case/c-362-14) Judgment of 6 October 2015 · ECLI:EU:C:2015:650 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) Declared the Safe Harbour adequacy decision invalid; an adequacy decision does not stop data protection authorities examining complaints about transfers. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-362/14&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0362) ### [C-131/12, Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González](https://dposchool.com/gdpr/case/c-131-12) Judgment of 13 May 2014 · ECLI:EU:C:2014:317 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) A search engine operator processes personal data and is a controller for that processing; EU law applies where it has an establishment selling advertising in a Member State; and a person can ask it to remove links to information about them that is inadequate, irrelevant or no longer relevant, after a balancing of rights. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-131/12&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0131) This is reference material, not legal advice. ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / Judgments Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents