Case law - Legal.digital (Page 3)

OLG Celle Overturns Lower Court's Decision on Excessiveness of Data Subject's Access Request

The Higher Regional Court of Celle overturned the decision of a lower court, holding that the motivation of a data subject's Article 15 GDPR access request is irrelevant to the legitimacy of the request. https://gdprhub.eu/index.php?title=OLG_Celle_-_8_U_165/22

Case law

"Rotterdam Court Orders Tax Authority to Conduct More Extensive Search in Access Request Case"

When the Dutch Tax Administration answers a data subject's access request, it should search beyond the general system it uses and provide specific information as to the purpose of the processing, the potential recipients and the source of the data. https://gdprhub.eu/index.php?title=Rb._Rotterdam_-_ROT_

Case law

Data protection meets civil procedure – the ECJ decision in Norra Stockholm Bygg

Blogpost 14/2023 The recent case of Norra Stockholm Bygg represents another important data protection decision from the ECJ. The decision addresses the application of the General Data Protection Regulation (‘GDPR’) to Member State courts when they are handling personal data, and therefore has important practical significance for civil procedure

Case law

Is the new ICT vendor liable for loss of data from old ICT environment?

District Court of North Holland February 15, 2023, IT 4241; ECLI:NL:RBNHO:2023:2471 (Pit v. OfficeGrip Holding c.s.) This case deals with the question of whether a new ICT supplier is liable for damages resulting from the loss of data from its client's old ICT environment. The

Case law

Automated loan processing called 'profiling' by CJEU advocate general

Advocate General of the Court of Justice of the European Union Priit Pikamäe ruled automated processing to determine an individual's probability of obtaining a loan constitutes profiling under the EU General Data Protection Regulation. Pikamäe's decision states the "GDPR establishes a 'right' for the person concerned not to be subject

Case law

Amsterdam court, Austrian DPA rule on Facebook data use, tracking

The Amsterdam District Court ruled Facebook Ireland processed Dutch users' personal data for advertising purposes without a legal basis and provided users' data to third parties without proper notification from 2010-2020. The court said "no compensation could be claimed in these proceedings." In response to a complaint by privacy advocacy

Case law

Request for access to (enforcement) file

Rotterdam District Court February 15, 2023, IT 4233; ECLI:NL:RBROT:2023:1605 (plaintiff v. defendant) Administrative Law. In this case, the court assessed whether the defendant was correct in determining that the claimant's objection (to the letter dated January 18, 2022) was inadmissible because the letter was not a

Case law

EU Court releases annual statistics 2022

The number of cases pending before the EU Court and EU Court remains stable. The structural increase of recent years in the number of cases thus continues despite the aftermath of the corona pandemic. In particular, the themes of rule of law, environment, privacy and EU measures in the context

Case law

German Constitutional Court blocks police use of surveillance software

The German Federal Constitutional Court ruled the use of Palantir surveillance software by police in Hesse and Hamburg unconstitutional, Euractiv reports. In the case, the German Society for Civil Rights argued the software could be used for predictive policing. The court said, "in terms of both the data and the

Case law

EU Court: an authorization to intercept telephone calls does not need to be individually justified

The e-Privacy Directive does not preclude a national practice under which authorizations to use special intelligence techniques are granted by a court in the form of a text drafted in advance in general terms without individualized reasoning. However, the precise reasons for granting the authorization must be easily and unambiguously

Case law

CJEU clarifies GDPR principles of purpose limitation and storage limitation

The purpose limitation principle does not preclude a controller from capturing and storing in a test database established for testing and error correction purposes personal data previously collected and stored in another database. However, such "further processing" of personal data must be compatible with the specific purposes for which the

Case law

CJEU: GDPR applicable to processing of personal data in the context of the organization of elections in a member state

The General Data Protection Regulation (GDPR) applies in the context of the organization of national, local and European elections in a Member State. The GDPR does not prevent the competent national authorities from adopting an administrative act of general application limiting or excluding the possibility of video recording the counting

Case law

CJEU: processing personal data liable to disclose indirectly sexual orientation constitutes processing of special categories of personal data

In 'Vyriausioji Tarnybinės Etikos Komisija' the CJEU held that the name of civil servants' spouse, cohabitant or partner and of the subject of their transactions (indirectly sexual orientation) are special categories of personal data. The Court relies on the broad definition of "data concerning health" in article 4(15) GDPR

Case law

Dirkzwager: ABRvS geeft uitleg aan het AVG-begrip "de instelling, uitoefening of onderbouwing van een rechtsvordering"

Privacybescherming is niet absoluut. Dat staat zelfs letterlijk zo in de privacywetgeving. De AVG bevat daarom ook allerlei uitzonderingen. Een van de uitzonderingen die enkele keren terugkomt in de AVG ziet op de verwerking van persoonsgegevens in het kader van "de instelling, uitoefening of onderbouwing van een rechtsvordering". Tot op

Case law

Collection and retention, by the French blood donation service (EFS), of personal data reflecting applicant’s presumed sexual orientation without proven factual basis: violation of Article 8 of the Convention

https://hudoc.echr.coe.int/eng-press

Case law

EU-Hof: gegevens waaruit indirect de seksuele geaardheid van een persoon kan worden afgeleid vormen gevoelige gegevens in de zin van de AVG

The processing of personal data that may indirectly reveal sensitive information about an individual, such as information about their sexual orientation, may qualify as processing of "special categories of personal data" within the meaning of the AVG. The processing of such sensitive data is prohibited in principle. This is the

Case law

CJEU: PNR Directive Valid if Limited to the “Strictly Necessary”

In a landmark ruling of 21 June 2022, the CJEU (Grand Chamber), upheld the EU’s regime to collect and use records of travellers, provided that it is strictly interpreted in line with the EU’s fundamental rights. In addition, indiscriminate processing of the data in cases of flights carried

Case law

CJEU Clarifies Exceptions to Data Retention in Irish Case

On 5 April 2022, the CJEU added another chapter to the long history of the admissibility of data retention in the EU. In a case concerning the data retention law in Ireland, the CJEU confirmed that general and indiscriminate retention of traffic and location data relating to electronic communication is

Case law

CJEU: The PNR is only for terrorist threat and the 5 year retion period only for targeted passengers

Thomas Wahl has a great analysis: […] in these situations restrictions to citizens’ rights are only proportional, if there is a genuine and present or foreseeable terrorist threat to which the Member State concerned is confronted or, in the absence of that, application is limited to certain routes or travel patterns

Case law

Regional Labour Court of Schleswig-Holstein: controller to pay €2,000 in non-material damages for publishing a promotional video with the data subject

The controller filmed the data subject in their work environment and published a thirty-six second video on Youtube for promotional purposes. The data subject had previously given verbal consent to the filming but had not received any further information about the purpose of the filming or their rights. https://gdprhub.

Case law

EU-Hof: consumentenbeschermings-verenigingen mogen representatieve vorderingen instellen tegen inbreuken op de bescherming van persoonsgegevens

An association representing consumer interests may bring a representative action against the alleged perpetrator of a personal data breach. A specific breach of a data subject's right to the protection of his or her personal data is not required to bring such a claim. In addition, such a claim can

Case law

A-G: rechtmatig verzamelde en opgeslagen persoonsgegevens mogen onder voorwaarden tijdelijk in een extra interne databank worden bewaard

Lawfully collected and stored personal data may be retained in an additional internal database, to the extent that it pursues the same data processing purposes as the original data collection. That is the opinion of Advocate General Pikamäe to the EU Court in response to questions from a Hungarian judge.

Case law

EU-Hof: het aan journalisten ter beschikking stellen van gerechtelijke stukken waarin persoonsgegevens zijn opgenomen behoort tot uitoefening van rechtelijke taak

It is part of the exercise of judicial functions by a court within the meaning of the AVG to make documents originating from a judicial proceeding -in which personal data are included- temporarily available to journalists in order to enable them to better report on the course of that proceeding.

Case law

The Hague Court of Appeal rules on lawyer (firm) duty of confidentiality under GDPR

General Data Protection Regulation (Avg). Whistleblower. Lawyer (firm) duty of confidentiality. (Machine translated) https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:GHDHA:2021:2793

Case law

"Rotterdam court lifts block on plaintiff's OneDrive account after insufficient substantiation by Microsoft"

Microsoft has blocked plaintiff's email and OneDrive account. Microsoft has not sufficiently substantiated that the OneDrive account contains an image that is inappropriate, exploitative and harmful to children. The block must be lifted. The judgment was declared unenforceable with respect to lifting the blockade on the image that Microsoft claims