Judgments on the GDPR and national data protection law
Courts in the EU, and in particular the CJEU, repeatedly issue landmark judgments on the European General Data Protection Regulation (GDPR) and data protection law. We analyse these rulings and explain what they mean in practice.
CJEU ruling on compensation following a hacker attack
The CJEU rules on the conditions under which data subjects affected by a data protection breach or hacker attack can claim damages.
Is Art. 9 GDPR an independent legal basis?
What is the relationship between Art. 6(1) GDPR and Art. 9(2) GDPR – and is it sufficient to fulfil the latter in order to be allowed to process special categories of personal data?
Can a verbal disclosure constitute processing within the meaning of the GDPR?
The CJEU rules on the concept of processing and the objectives of the GDPR.
Can competitors issue warnings for GDPR violations?
The CJEU rules on whether the GDPR has a blocking effect vis-à-vis national competition law. The consequences could be expensive for some companies – but are not the end of the world.
Do online retailers have to provide guest accounts and what are they allowed to use customer data for
The Hamburg Regional Court clarifies key questions regarding the processing of personal data in online shops – at least for some providers.
CJEU defines data protection damages in the case of immaterial and hypothetical damage
Several judgements on the determination of immaterial damage and the assessment of such damage under the GDPR provide new certainties for data controllers.
Pseudonymisation of data can amount to anonymisation
The EGC ruled on whether data protection law does not apply to the pseudonymisation of personal data if the recipient has no possibility of re-identification.
CJEU clarifies responsibility and the question of fault for the imposition of fines
In order to impose GDPR fines, it must be established who is responsible for the processing activity and whether and, if so, who must be at fault. The CJEU has now provided clarity.
CJEU defines right to a copy under Art. 15 GDPR
In what form and to what extent must copies of personal data be provided when data subjects exercise their data protection rights? The CJEU provides clarity and sets new standards.
The Federal Cartel Office may also find GDPR violations at Meta
The CJEU has cast doubt on the voluntary nature of consent on Facebook, allowing national competition regulators to investigate data protection breaches in certain circumstances.
