CJEU C-416/23 Österreichische Datenschutzbehörde (Excessive requests) 9 Jan 2025
Art. 57(4) 'requests' include 'complaints' in 57(1)(f) and 77(1) and aren't 'excessive' due to volume alone; DPAs must show abuse, and can then charge a reasonable fee or refuse to act after considering all circumstances and ensuring their choice is justified.
Jan 14, 2025
—
4 min read
You might also like
CJEU C-621/22 KNLTB (legitimate interests) 4 Oct 2024
members
–
4 min read
[update] Article 6(1)(f) allows disclosure for a commercial interest if the processing is *strictly* necessary and not outweighed by the interests, rights or freedoms of the data subjects. The interest doesn't have to be determined by law, but it must be lawful. And CJEU nudges consent again.
CJEU T-384/20 RENV OC v Commission (C-479/22 P)
members
–
4 min read
🔥 Update: After the CJEU sent the case back, the General Court has ordered the European Commission to pay a Greek scientist €50,000 for unlawfully processing her personal data in a press release, causing reputational, career and health-related harm.
CJEU T-553/23 Latombe v Commission 3 Sep 2025
members
–
3 min read
[🇬🇧 version finally available!] "The General Court dismisses the action for annulment" and the EU-US DPF remains valid.