Monitoring References to the Court of Justice of the European Union
Field of law
48 case reports
The Polish tax administration imposed an additional toll charge on the basis of journey data it had kept after the national retention period expired, relying on the general limitation period for the charge. A court in Łódź asks whether the GDPR allows that, whether the source of the data matters, and whether a court must refuse to rely on data kept unlawfully.
A customer of Trezor, the hardware wallet maker, signed up for its newsletter and now complains that his data were processed on servers in the United States. The Austrian Supreme Court asks whether handing data to a processor needs its own legal basis under the GDPR, and whether consent to a newsletter is informed if the subscriber was not told that a processor outside the EU would send it.
A Dutch card issuer asked a customer of twelve years to identify again online with a photo of an identity document and a selfie. The customer refused and the card was cancelled. The Hoge Raad asks whether storing a face photo for identification is biometric processing, whether the anti-money laundering rules require a copy of the identity document at all, and whether a photograph reveals racial or ethnic origin.
The European Data Protection Board issued an opinion on 'consent or pay' models that every national regulator will apply to Meta. Meta tried to annul it and claim damages; the General Court threw the case out as inadmissible without a hearing. The appeal asks whether a document that binds no one in law but everyone in practice can be taken to court.
A Dutch foundation is suing four Amazon companies for GDPR damages on behalf of everyone affected, without any of them having asked it to. The Rechtbank Rotterdam asks whether Article 80 of the GDPR — which lets a data subject 'mandate' a body to act — leaves room for the Dutch opt-out class action, and for the extra conditions Dutch law imposes on who may bring it.
A Facebook user's name, gender, user ID and phone number turned up on the internet, scraped and published by a third party. The Landgericht Erfurt asks whether that bare fact — the loss of control over one's data, even briefly — is non-material damage under Article 82 of the GDPR, and whether it matters that most of the data were already public.
The Unfair Commercial Practices Directive bans calling a product 'free' if the consumer has to pay anything. Germany's consumer federation says Facebook charges in personal data. The Bundesgerichtshof asks the Court, in a single sentence, whether data and consent are a 'cost'.
Four years after the Court struck down public access to beneficial ownership registers, the replacement directive lets Member States shield an owner in 'exceptional circumstances to be laid down in national law'. Luxembourg defined those circumstances as the very risk that already triggers the shield. The Tribunal d'arrondissement asks what is left of the condition.
Bulgarian prosecutors want voice samples from a suspect and propose to get them by compelling answers to harmless questions, on pain of a fine or criminal consequences. Sofia City Court asks whether the right not to incriminate oneself permits it — and the answer turns on a list in a recital.
A financial supervisor obtains a court order to inspect. Does that order hand it the exclusive power to decide what data it takes, or must the scope be fixed in advance by the subject matter of the inspection? A Lithuanian administrative court asks.
Bulgaria's national health system holds every diagnosis, prescription and operation a person has had, and opens the whole file to doctors, insurers and prosecutors with no technical limit on what they read. Six questions from the Supreme Administrative Court ask whether Article 9 GDPR permits any of it.
By judgment of 25 January 2018 (ECLI:EU:C:2018:37) the Court held that Mr Schrems had not lost his consumer status for his own Facebook account through his books, lectures and campaigning, so he could sue Facebook in Vienna.
By judgment of 20 December 2017 (ECLI:EU:C:2017:994) the Court held that a candidate's written answers in a professional examination — and the examiner's comments on them — are the candidate's personal data, opening access and rectification rights adapted…
By judgment of 2 October 2018 (ECLI:EU:C:2018:788) the Court held that police access limited to the identity data of SIM-card holders is not a serious interference with fundamental rights and may therefore be justified for investigating offences that are…
On 5 June 2018 the Grand Chamber ruled (ECLI:EU:C:2018:388) that the administrator of a Facebook fan page is a joint controller, together with Facebook, of the processing of visitors' data through the Insights statistics — and that the German supervisory…
By judgment of 27 September 2017 (ECLI:EU:C:2017:725) the Court held that requiring exhaustion of administrative remedies before a data-protection claim reaches a court is compatible with Article 47 of the Charter if it causes no substantial delay or…
By judgment of 4 May 2017 (ECLI:EU:C:2017:336) the Court ruled, in the words of the operative part: “Article 7(f) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the…
By Grand Chamber judgment of 16 May 2017 (ECLI:EU:C:2017:373) the Court held that a company fined for refusing to answer a cross-border tax-information order may invoke Article 47 of the Charter: the national court must be able to review whether the…
Joined with Tele2 Sverige and decided by Grand Chamber judgment of 21 December 2016 (ECLI:EU:C:2016:970): yes, Digital Rights Ireland's standards bind national regimes — Article 15(1) of the e-Privacy Directive, read with the Charter, precludes general and…
By judgment of 15 March 2017 (ECLI:EU:C:2017:214) the Court ruled, in the words of the operative part: “1.
By judgment of 19 October 2016 (ECLI:EU:C:2016:780) the Court held that the Framework Directive does not prevent a Member State from merging its telecoms regulator into a multi-sector authority, but dismissing the NRA's president and board before the end…
On 9 March 2017 the Court ruled (ECLI:EU:C:2017:197) that there is no general right to have personal data erased from the companies register: the publicity of such registers pursues legal certainty for third parties and data may be kept indefinitely.
On 28 July 2016 the Court ruled (ECLI:EU:C:2016:612) that in a collective injunction action the law applicable to assessing contract terms is determined by the Rome I Regulation even though the action itself falls under Rome II.
On 21 December 2016 the Grand Chamber ruled in the joined Tele2/Watson cases (ECLI:EU:C:2016:970) that Article 15(1) of the e-Privacy Directive, read with the Charter, precludes national legislation imposing general and indiscriminate retention of traffic…
Can the Dutch Data Protection Agency exert any control over companies based in the UK and the USA which conduct covert surveillance on Dutch territory? And in the event of an individual’s data processing law rights under Dutch law being … Continue reading → Continue reading →
Canada and the EU have negotiated a new Passenger Name Record Agreement. A plank of the Agreement involves the transfer and processing of data. The European Parliament is asking the CJEU for a legal opinion on the compatibility of that … Continue reading → Continue reading →
By judgment of 19 October 2016 (ECLI:EU:C:2016:779) the Court held that a dynamic IP address registered by a website operator is personal data where the operator has legal means to have the visitor identified via the access provider.
By judgment of 23 November 2016 (ECLI:EU:C:2016:890) the Court ruled, in the words of the operative part: “1.
By judgment of 1 October 2015 (ECLI:EU:C:2015:638) the Court ruled, in the words of the operative part: “Articles 10, 11 and 13 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995, on the protection of individuals with…
By judgment of 1 October 2015 (ECLI:EU:C:2015:639) the Court gave "establishment" a broad, flexible reading: even minimal real and effective activity through stable arrangements — a Hungarian-language property site, a local representative, a Hungarian bank…
On 6 October 2015 the Grand Chamber declared the Safe Harbour adequacy decision invalid (ECLI:EU:C:2015:650): a regime permitting generalised access by US authorities to transferred data compromised the essence of Article 7 of the Charter, and the absence…
On 6 October 2015 the Grand Chamber declared the Safe Harbour adequacy decision invalid (ECLI:EU:C:2015:650): a regime permitting generalised access by US authorities to transferred data compromised the essence of Article 7 of the Charter, and the absence…
By judgment of 18 December 2014 (ECLI:EU:C:2014:2466) the Court ruled, in the words of the operative part: “1.
By judgment of 16 July 2015 (ECLI:EU:C:2015:485) the Court ruled, in the words of the operative part: “Article 8(3)(e) of Directive 2004/48/EC of the European Parliament and of the Council of 29 April 2004 on the enforcement of intellectual property rights…
By judgment of 11 December 2014 (ECLI:EU:C:2014:2428) the Court held that camera surveillance covering, even partially, a public space falls outside the "purely personal or household" exemption, so data-protection law applies to a home CCTV system filming…
When you use a telephone or go onto the internet a company registers and stores data about you. Companies are obliged to do this not for billing purposes but because of the EU’s data retention Directive 2006/24/EC. Can you access … Continue reading →
Are Articles 3, 4, 5, 6, 7, 8 and 9 of the EU’s data retention Directive 2006/24/EC compatible with Articles 7, 8 and 11 of the EU Charter of Fundamental Rights? Facts There are three actions to this reference from the Austrian Constitutional Court. Each concerns the EU’s data retention Directive…
By judgment of 7 November 2013 (ECLI:EU:C:2013:715) the Court ruled, in the words of the operative part: “Article 13(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to…
Are the Dutch rules that require people to be fingerprinted if they want a Dutch passport compatible with EU law? Facts In 2010, Ms Roest applied for a passport but refused to be fingerprinted because of the unforeseen consequences of supplying this biometric data. That is to say, it was not clear…
The reference was decided in the joined Willems judgment of 16 April 2015 (ECLI:EU:C:2015:238): the fingerprint obligation for passports stands (as upheld in Schwarz), and Regulation 2252/2004 does not govern any subsequent storage or use of the biometrics…
The reference was decided in the joined Willems judgment of 16 April 2015 (ECLI:EU:C:2015:238): Regulation 2252/2004 does not apply to identity cards at all, whatever their travel validity — so the fingerprint requirement for Dutch ID cards was a purely…
By judgment of 16 April 2015 in the joined Willems cases (ECLI:EU:C:2015:238) the Court held that Regulation 2252/2004 obliges the taking of fingerprints for passports (as upheld in Schwarz) but does not govern any subsequent use or storage of that…
For the purposes of the EU’s Data Processing Directive 95/46, is a Dutch document known as a ‘minuut’ just a civil servant’s description for applying the law to a person’s asylum application, or is it also personal data to which a person can have access? Facts The Dutch legal system has a great…
On 17 October 2013 the Court upheld the validity of Regulation 2252/2004 (ECLI:EU:C:2013:670): taking and storing fingerprints in passports interferes with Articles 7 and 8 of the Charter, but the interference is justified by the aim of preventing…
The EU Commission has asked the Court of Justice of the European Union whether the Anti-Counterfeiting Trade Agreement (ACTA) complies with the EU law. Facts ACTA is the acronym for the Anti-Counterfeiting Trade Agreement. It is a treaty supplementing another key piece of international law…
On 8 April 2014 the Grand Chamber declared the Data Retention Directive 2006/24 invalid in its entirety (ECLI:EU:C:2014:238): blanket retention of everyone's traffic and location data, without differentiation, limits or objective access criteria, exceeded…
On 13 May 2014 the Grand Chamber delivered one of the most consequential judgments in EU law (ECLI:EU:C:2014:317): a search engine is a controller processing personal data when it indexes the web, the Directive reached Google through its Spanish…
On 17 July 2014 the Court ruled (ECLI:EU:C:2014:2081) that the legal analysis in an immigration case minute is not itself personal data — the applicant's data contained in it are — and that the right of access can be satisfied by a full and intelligible…