CJEU - DPO Hub

AG Tour on DPA complaints (C-416/23 Österreichische Datenschutzbehörde - excessive requests)

members – 2 min read

Advocate General Opinion: The Art. 57(4) concept of 'requests' covers 'complaint' in 57(1)(f) and 77(1) and aren't 'excessive' just because there are many in a certain period; the DPA must show abusive intent, and can then charge a fee or refuse to act.

Sep 6, 2024

CJEU C-154/21 RW v Österreichische Post (recipients)

members – 3 min read

You have the right to know to whom your personal data have been disclosed, with the actual identity of the recipients. (2023 ruling added to Right of access Topic page.)

Aug 16, 2024

AG Szpunar (C-394/23 Mousse)

members – 2 min read

Advocate General Opinion: On the principles of data minimisation and lawfulness of processing—where the 🇫🇷 CNIL made a somewhat startling decision on what's 'necessary for the performance of a contract'! + remember to spell out your legitimate interest when you collect the data!

Aug 9, 2024

CJEU C-757/22 Meta Platforms Ireland (representative action) 11 Jul 2024

members – 2 min read

Consumer protection groups can take legal action against controllers they believe violate data subjects' rights, including the right to information. With C-319/20, this ruling *could* be a bit of a bombshell! #classaction

Jul 14, 2024

CJEU C-461/22 MK (legal guardian) 11 Jul 2024

members – 1 min read

A former legal guardian who acted in a professional capacity is a controller and must comply with the GDPR, including the right of access.

Jul 14, 2024

CJEU C-590/22 PS (incorrect address) and C-182/22 Scalable Capital

members – 5 min read

⚖️ 9 points interpreting Art. 82(1), including: its aim is to compensate for damage, not to punish or deter GDPR violations; fear alone or stolen personal data can trigger claims if proven; and national courts can grant minimal compensation for minor damage.

Jun 25, 2024

CJEU C-229/23 HYA and Others II (ePD)

members – 1 min read

Article 15(1) of the ePD allows Member State law to require that judges' decisions authorising wiretaps must include their own written reasons, even if the police's applications already provide detailed justifications.

Jun 18, 2024

CJEU C-487/21 Österreichische Datenschutzbehörde v CRIF (right to copy)

members – 5 min read

You have the right to a faithful and intelligible copy of all your personal data, even full documents or extracts from documents or databases, if that's crucial for your rights and while respecting others' rights and freedoms.

Jun 14, 2024

AG Medina on the 14(5)(c) derogation (C-169/23 Másdi)

members – 2 min read

Advocate General Opinion: First interpretation of the Art. 14(5)(c) derogation! It applies to all data not collected from the data subject, a DPA can check all conditions of it, and the 'measures' aren't related to Art. 32.

Jun 10, 2024

AG Medina on invalid consent (C-200/23 Agentsia po vpisvaniyata)

members – 2 min read

Advocate General Opinion: Interesting views on invalid consent and insufficient basis in Union or national 🇧🇬 laws for relying on Art. 6(1)(c) and (e), cf. 6(3)—and implications for erasure requests.

Jun 10, 2024

CJEU C-579/21 Pankki S 22 Jun 2023

members – 4 min read

You have the right of access to data processed before the GDPR took effect, if you requested it after that date, and to know when and why it was accessed—but not by whom, unless crucial for your rights and while respecting others' rights and freedoms.

May 27, 2024

Interesting non-GDPR CJEU case on gender change (C-4/23 Mirin)

members –

💡 (Non-GDPR/ePrivacy) Advocate General Opinion stating that Member States can't refuse to recognise changed name and gender approved in another MS.

May 24, 2024