CJEU - DPO Hub (Page 2)

CJEU C-413/23 P EDPS v Single Resolution Board 6 Feb 2025 AG Opinion

members – 1 min read

A much-anticipated case on the concept of personal data, but the AG only advices the CJEU to set aside the General Court’s ruling and send the case back to decide on the second plea (breach of good administration and fair procedure). We're still in the dark on several aspects.

Feb 6, 2025

CJEU C-492/23 Russmedia Digital and Inform Media Press 6 Feb 2025 AG Opinion

members – 1 min read

AG Szpunar: Marketplace operators are processors for ad data (must protect it) and controllers for advertisers' data (must verify identity). Liability applies if you actively manage, modify or promote content.

Feb 6, 2025

DPO Hub 2024 CJEU GDPR-related rulings

members – 1 min read

A list of all GDPR-related (plus one) CJEU rulings from 2024 with titles, dates, DPO Hub snippets, tags and CJEU keywords (with key Articles etc.).

Feb 4, 2025

CJEU GC T-70/23 Data Protection Commission v European Data Protection Board 29 Jan 2025

members – 2 min read

The General Court dismissed DPC's actions against the EDPB and ordered them to pay the costs, meaning they must conduct new investigations and issue new Art. 60(3) draft decisions for the three 2022 Art. 65 Binding Decisions in cases against Meta (Facebook, Instagram, WhatsApp).

Jan 31, 2025

CJEU C-416/23 Österreichische Datenschutzbehörde (Excessive requests) 9 Jan 2025

members – 4 min read

Art. 57(4) 'requests' include 'complaints' in 57(1)(f) and 77(1) and aren't 'excessive' due to volume alone; DPAs must show abuse, and can then charge a reasonable fee or refuse to act after considering all circumstances and ensuring their choice is justified.

Jan 14, 2025

CJEU C-394/23 Mousse 9 Jan 2025

members – 5 min read

Processing customers' titles to personalise communication based on gender isn’t essential for performing a contract; nor is it for a legitimate interest if they weren't informed beforehand, the processing isn't strictly necessary, or the balancing test goes in their favor.

Jan 13, 2025

CJEU C-21/23 Lindenapotheke 4 Oct 2024

members – 5 min read

NB! Updated re: explicit consent. Competitors can take legal action against your GDPR violations if considered an illegal unfair commercial practice. Special category personal data threshold is lowered: ordering pharmacy-only medicinal products online is considered sharing health data.

Jan 12, 2025

CJEU C-61/22 Landeshauptstadt Wiesbaden 21 Mar 2024

members – 1 min read

A ruling on Regulation 2019/1157 on ID card security, where the CJEU clarified that its adoption couldn’t violate Article 35 of the GDPR, as it wasn’t subject to a DPIA requirement. (They also concluded that the regulation was invalid!)

Dec 29, 2024

CJEU LED C-80/23 Ministerstvo na vatreshnite raboti (Registration of biometric and genetic data II) 28 Nov 2024

members – 3 min read

Law Enforcement Directive: Competent authorities must prove that systematically collecting biometric and genetic data of accused persons is strictly necessary under LED Article 10; they can't leave it up to a court.💡 But the truly interesting part lies in 'strictly necessary'.

Dec 29, 2024

CJEU C-33/22 Österreichische Datenschutzbehörde 16 Jan 2024

members – 2 min read

A ruling on the GDPR's material scope clarifying that DPAs can oversee parliamentary committees' personal data processing, as they're not automatically excluded or classified as national security matters under the GDPR.

Dec 29, 2024

CJEU C-687/21 MediaMarktSaturn 25 Jan 2024

members – 3 min read

Accidental disclosure ≠ poor measures. Compensation is purely compensatory, not punitive, and requires proof of harm caused by a violation—though the severity of it doesn't affect the amount. Fear alone isn’t enough if no misuse occurred.

Dec 29, 2024

CJEU C-507/23 Pateretaju tiesibu aizsardzibas centrs (PTAC) 4 Oct 2024

members – 2 min read

A GDPR breach isn't automatically "damage" under Article 82(1). An apology may compensate for non-material damage if it fully remedies the harm and it's impossible to restore the original situation, but whether you're sorry or not doesn't matter (but maybe it can prevent matters from escalating).

Dec 28, 2024