CJEU C-541/24 Naltov 5 Jun 2025 (dismissed)
members
–
The CJEU dismissed the case because the referring court's questions didn't relate to a real legal dispute. Listing it here for completeness.
CJEU GC T-70/23 Data Protection Commission v European Data Protection Board 29 Jan 2025
members
–
2 min read
The General Court dismissed DPC's actions against the EDPB and ordered them to pay the costs, meaning they must conduct new investigations and issue new Art. 60(3) draft decisions for the three 2022 Art. 65 Binding Decisions in cases against Meta (Facebook, Instagram, WhatsApp).
CJEU C-416/23 Österreichische Datenschutzbehörde (Excessive requests) 9 Jan 2025
members
–
4 min read
Art. 57(4) 'requests' include 'complaints' in 57(1)(f) and 77(1) and aren't 'excessive' due to volume alone; DPAs must show abuse, and can then charge a reasonable fee or refuse to act after considering all circumstances and ensuring their choice is justified.
CJEU C-33/22 Österreichische Datenschutzbehörde 16 Jan 2024
members
–
2 min read
A ruling on the GDPR's material scope clarifying that DPAs can oversee parliamentary committees' personal data processing, as they're not automatically excluded or classified as national security matters under the GDPR.
CJEU C-768/21 Land Hessen (DPA obligation to act) 26 Sep 2024
members
–
3 min read
⏰ Quickly deal with data breaches and listen to the DPA to reduce the chance of a fine (and keep access logs >3 months). DPAs aren't required to exercise a corrective power, like impose a fine, if not appropriate, necessary or proportionate to remedy the violation and ensure full GDPR compliance.