CJEU - DPO Hub

CJEU C-654/23 Inteligo Media 13 Nov 2025

members – 7 min read

If a user creates a free account and gets access to articles, newsletters and the option to pay for further content, this falls under Art. 13(1) and (2) ePD as 'sale of a service' and 'direct marketing', and you don't need a legal basis under Art. 6 GDPR, in line with Art. 95 GDPR.

Nov 13, 2025

CJEU C-413/23 P EDPS v SRB (Concept of personal data) 4 Sep 2025

members – 5 min read

Pseudonymised data isn’t always personal in every case to everyone – but measures must be effective. Comments are personal by nature – no need to assess content, purpose or effects. Whether a person can be identified must be assessed from the controller’s perspective, when collecting the data.

Nov 2, 2025

CJEU T-553/23 Latombe v Commission 3 Sep 2025

members – 4 min read

🔥 Latombe to appeal! New CJEU case number: C-703/25 P | "The General Court dismisses the action for annulment" and the EU-US DPF remains valid.

Oct 31, 2025

CJEU C-621/22 KNLTB (legitimate interests) 4 Oct 2024

members – 4 min read

[update] Article 6(1)(f) allows disclosure for a commercial interest if the processing is *strictly* necessary and not outweighed by the interests, rights or freedoms of the data subjects. The interest doesn't have to be determined by law, but it must be lawful. And CJEU nudges consent again.

Oct 21, 2025

CJEU T-384/20 RENV OC v Commission (C-479/22 P)

members – 4 min read

🔥 Update: After the CJEU sent the case back, the General Court has ordered the European Commission to pay a Greek scientist €50,000 for unlawfully processing her personal data in a press release, causing reputational, career and health-related harm.

Oct 7, 2025

CJEU C-199/24 Legal Newsdesk Sweden 4 Sep 2025 AG Opinion

members – 3 min read

AG Szpunar: National law can’t make defamation the only remedy if criminal conviction data are published online for payment. Publishing conviction records online for payment, without any processing or editing, isn’t processing for journalistic purposes.

Sep 16, 2025

CJEU C-655/23 Quirin Privatbank 4 Sep 2025

members – 3 min read

GDPR offers no judicial remedy outside erasure requests to stop future unlawful processing, but Member States may. Non-material damage covers negative feelings – if proven. A controller’s fault doesn’t affect compensation, and a court order banning repeat GDPR violations can’t reduce or replace it.

Sep 7, 2025

CJEU C-383/23 ILVA (GDPR fine) 13 Feb 2025

members – 4 min read

2 Sep: 💸 ILVA fined €201k | When fining a controller in a corporate group, DPAs must base the maximum fine on the *group’s* total worldwide turnover from the prior business year. A crucial ruling for anyone in a company group – here's also text you can copy for an email to your Management/Board.

Sep 2, 2025

CJEU C-422/24 Storstockholms Lokaltrafik 1 Aug 2025 AG Opinion

members – 2 min read

AG Medina: When personal data is collected through body cameras worn by ticket inspectors working for a public transport company (🇸🇪 SL), Article 13 applies, not Article 14, as it’s collected directly from the data subject.

Aug 6, 2025

CJEU C-40/17 Fashion ID 29 Jul 2019

members – 4 min read

You’re a (joint) controller if you use third-party tools on your website that share personal data with the provider – but only for parts where you (jointly) determine purposes and means. If you collect the data, you must inform and get consent, and each controller must pursue a legitimate interest.

Jun 17, 2025

CJEU C-541/24 Naltov 5 Jun 2025 (dismissed)

members –

The CJEU dismissed the case because the referring court's questions didn't relate to a real legal dispute. Listing it here for completeness.

Jun 8, 2025

CJEU C-769/22 Commission v Hungary (Values of the EU) 5 Jun 2025 AG Opinion

members – 1 min read

AG Ćapeta: Hungary violated EU law by introducing national legislation restricting or prohibiting access to LGBTI content – and the Court should also find a stand-alone breach of Article 2 TEU, which sets out the EU’s fundamental values. A case relevant for policymakers and Member States.

Jun 8, 2025