Law · Key cases
Key cases
The 39 court rulings that shaped European privacy law, newest first. Each one quotes what the court ruled, word for word, with the case number and a link to the official judgment.
EU Court of Justice
- Dun & Bradstreet Austria (explanation)A woman refused a mobile phone contract after an automated credit check was entitled to an explanation of the procedure and principles actually used. Where trade secrets or other people's data are involved, the controller must give them to the regulator or court, which decides what she sees.2025 · C-203/22
- Koninklijke Nederlandse Lawn TennisbondThe Dutch tennis federation gave members' data to sponsors for payment. A purely commercial interest can be a legitimate interest if it is lawful, but the processing must be strictly necessary and not outweighed by the members' rights.2024 · C-621/22
- Schrems v Meta (data minimisation)Data minimisation stops a social network from gathering and using all personal data, on and off the platform, for targeted advertising without limits of time or type. Speaking publicly about one's sexual orientation does not let the network use other data about it for ads.2024 · C-446/21
- IAB EuropeThe 'TC String' that records a user's cookie and advertising choices is personal data when it can reasonably be linked to an identifier such as an IP address. IAB Europe, which wrote the rules, can be a joint controller even without access to the data.2024 · C-604/22
- SCHUFA Holding (Scoring)A credit agency's automated score is itself an automated decision under GDPR Article 22 when a lender or other business relies heavily on it to decide whether to enter into, carry out or end a contract with the person.2023 · C-634/21
- Deutsche WohnenA company can be fined under the GDPR without first pinning the breach on a named manager or employee. But a fine is only possible if the company committed the breach intentionally or negligently.2023 · C-807/21
- Nacionalinis visuomenės sveikatos centrasLithuania's public health centre, which had a COVID-19 app developed, could be a controller although it processed no data itself. Joint control needs no formal agreement between the parties, and fines require intent or negligence.2023 · C-683/21
- Meta Platforms v BundeskartellamtGermany's competition authority could find that Meta's data terms broke the GDPR when examining abuse of dominance, while cooperating with data protection authorities. The Court read the 'contract' and 'legitimate interests' grounds narrowly, and said dominance does not rule out valid consent but weighs on whether it is free.2023 · C-252/21
- F.F. v Österreichische Datenschutzbehörde (the copy)The right to a copy of one's data means a faithful and understandable reproduction of all of it. This can include copies of extracts from documents, or whole documents, where that is essential to exercise GDPR rights.2023 · C-487/21
- Österreichische Post (damages)A breach of the GDPR does not on its own give a right to compensation: the person must show damage caused by it. But national law cannot require non-material damage, such as distress, to reach a minimum level of seriousness.2023 · C-300/21
- OT v Vyriausioji tarnybinės etikos komisijaLithuanian law required online publication of officials' declarations of interests, including names of spouses or partners. The Court held this went too far, and that data which indirectly reveal sensitive facts, such as sexual orientation, are special category data.2022 · C-184/20
- Facebook Ireland v GegevensbeschermingsautoriteitUnder the one-stop shop the lead authority normally handles cross-border cases. But another national authority may take a company to court in its own country in the situations where the GDPR lets it act, if it respects the cooperation procedures.2021 · C-645/19
- Schrems IIThe Court declared the EU-US Privacy Shield invalid because of US surveillance law. Standard contractual clauses remain valid, but data sent abroad under them must get protection essentially equivalent to EU law, and regulators must stop transfers where it does not.2020 · C-311/18
- Planet49A pre-ticked checkbox does not give valid consent to cookies. This is so whether or not the cookie data are personal data, and users must be told how long cookies last and whether third parties can access them.2019 · C-673/17
- GC and OthersThe strict rules on sensitive data, and on data about criminal proceedings, also bind search engines when they handle delisting requests. As a rule such links must be removed unless keeping them is strictly necessary for the public's freedom of information.2019 · C-136/17
- Google v CNILWhen a search engine grants a 'right to be forgotten' request, EU law requires it to delist the link on its versions for all EU Member States, not worldwide, and to take measures that discourage users in the EU from reaching it.2019 · C-507/17
- Fashion IDAn online shop that embedded Facebook's 'Like' button is a joint controller with Facebook for collecting visitors' data and sending it to Facebook, but not for what Facebook does with the data afterwards.2019 · C-40/17
- Jehovan todistajatNotes taken by Jehovah's Witnesses during door-to-door preaching are not a purely personal activity. The religious community is a joint controller with its preaching members, even though it never sees the notes.2018 · C-25/17
- Wirtschaftsakademie Schleswig-HolsteinA business that runs a Facebook fan page is a controller, jointly with Facebook, for the data collected about the page's visitors. The German authority could also act against Facebook's German establishment.2018 · C-210/16
- NowakA trainee accountant asked for his exam script. The Court held that a candidate's written answers and the examiner's comments on them are his personal data, confirming that 'personal data' covers opinions and assessments, not just private facts.2017 · C-434/16
- Manni (company registers)A businessman has no general right to have his name removed from the public companies register. Member States may let people ask, case by case and in exceptional situations, for access to be limited long after the company was dissolved.2017 · C-398/15
- BreyerA dynamic IP address kept by a website operator is personal data for that operator if it has legal means to identify the person using information held by the internet access provider. National law also cannot rule out weighing the operator's legitimate interests.2016 · C-582/14
- Schrems IAfter the Snowden revelations, Max Schrems complained about Facebook sending his data to the United States. The Court held that national authorities can examine such complaints despite a Commission adequacy decision, and declared the Safe Harbor decision invalid.2015 · C-362/14
- RynešA home security camera that also films a public space, such as the street, is not covered by the household exemption, so data protection law applies to it.2014 · C-212/13
- Google Spain (Costeja)A Spanish man wanted Google to stop showing, under his name, 1998 newspaper notices about the auction of his property to recover social security debts. The Court held that a search engine is a controller and can be required to delist such links, the origin of the 'right to be forgotten'.2014 · C-131/12
- Digital Rights IrelandThe Court struck down the EU Data Retention Directive, which required telecoms providers to keep everyone's traffic and location data so authorities could use them against serious crime. The interference with privacy and data protection went beyond what was strictly necessary.2014 · C-293/12 and C-594/12
- ASNEF and FECEMD (legitimate interests)Spain could not add a condition that data processed under the legitimate interests ground must come from public sources. Member States cannot narrow that ground with extra rules, and people can rely on it directly in court.2011 · C-468/10 and C-469/10
- Bavarian Lager (access to documents)When someone asks an EU institution for documents containing personal data, the data protection rules for EU institutions apply in full. The Commission could withhold names of meeting participants because the requester gave no express and legitimate reason for needing them.2010 · C-28/08 P
- Commission v Germany (independent regulators)Data protection authorities must be completely independent, free from any outside influence including the state's. Germany broke EU law by placing the regional authorities that supervise private companies under state scrutiny.2010 · C-518/07
- Rijkeboer (access to past disclosures)The right of access covers who received your data in the past, not just who receives it now. Keeping that record for only one year was too short unless longer storage would be an excessive burden.2009 · C-553/07
- HuberGermany's central register of foreign EU citizens was lawful only if it held just the data needed to apply residence law. Keeping named records for statistics was not necessary, and a crime-fighting database only for non-German EU citizens was discriminatory.2008 · C-524/06
- LindqvistMrs Lindqvist put pages on the internet naming people from her parish, with details such as their jobs, hobbies and one person's foot injury. The Court held this was processing of personal data, including health data, but that uploading data to a site hosted in the EU is not in itself a transfer to a non-EU country.2003 · C-101/01
European Court of Human Rights
- López Ribalda v SpainSupermarket staff were filmed by hidden cameras after large stock losses. The Grand Chamber found no violation: reasonable suspicion of serious misconduct justified the covert filming here, though the slightest suspicion would not.2019 · 1874/13 and 8567/13
- Bărbulescu v RomaniaA sales engineer was dismissed after his employer read his Yahoo Messenger chats, including private ones. The Grand Chamber found a violation because the national courts did not check whether he had been warned in advance and whether the monitoring was justified and limited.2017 · 61496/08
- Haralambie v RomaniaA man asked in 2002 to see the file the communist-era secret police (Securitate) had kept on him and was only invited to consult it in 2008. The Court found that the ineffective access procedure breached his right to respect for private life.2009 · 21737/03
- S. and Marper v United KingdomThe police kept the fingerprints, DNA samples and DNA profiles of two people who were never convicted, with no time limit. The Grand Chamber held that keeping such data from everyone suspected but not convicted, without distinction, breached the right to private life.2008 · 30562/04 and 30566/04
- Copland v United KingdomA college employee's phone calls, emails and internet use were monitored. The Court held that work emails and internet use are protected by Article 8, and found a violation because no law regulated such monitoring at the time.2007 · 62617/00
- Gaskin v United KingdomA man who grew up in local authority care was refused parts of his care records because some contributors would not consent. The Court found a violation: an independent authority had to be able to decide on access when a contributor did not answer or refused consent.1989 · 10454/83
Court of Appeal of England and Wales (Civil Division)
No case matches.
The rulings are quoted from the official texts: EUR-Lex for the EU Court of Justice, HUDOC for the European Court of Human Rights, and the National Archives for the English court. The plain-English lines are Fino’s own and are not legal advice. For the meaning of a word, see the Glossary.