CJEU, Judgment of 20 May 2003, C-465/00 and others, Österreichischer Rundfunk
CJEU decision on the disclosure of income data of public-sector employees and on the requirements for clear and precise legal bases for interferences with Articles 7 and 8 of the Charter of Fundamental Rights (CFR).
1 Overview
The joined cases concerned the obligation of Austrian bodies subject to audit to report the income data of employees of public institutions to the Court of Audit and to publish those data. The CJEU assessed that measure against Articles 6 and 7 of Directive 95/46/EC and against the fundamental rights to respect for private life and to the protection of personal data.
Reference: CJEU, judgment of 20 May 2003, C-465/00, C-138/01, C-139/01, Österreichischer Rundfunk
2 Significance for the principles of the GDPR
The CJEU confirmed the requirements as to the clarity and precision of a legal basis for the processing of personal data. The legal basis must govern the scope and application of the processing with such clarity that the processing is foreseeable for the data subject (para. 77 of the judgment). That requirement underlies the principle of lawfulness (Article 5(1)(a) GDPR) and is expressly taken up in Recital 41, second sentence, GDPR.
About the author
About the author
This article was written by Dr. Thomas Helbing, specialist lawyer for IT law in Munich.
Since 2020 and continuously through today (2026), Handelsblatt has recognized Dr. Helbing as one of "Germany's Best Lawyers" in IT law and data protection law.
According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the leading lawyers for data protection and IT law and is listed among the top 100 lawyers in Germany (2024/25). Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel.
Dr. Helbing has many years of advisory experience in data protection and IT law and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups.
His professional background covers the full spectrum of IT and technology law practice. He began his career at a major international law firm, then gained in-house experience at a DAX-listed company, and is himself an entrepreneur and founder of several digital ventures. He also has hands-on programming experience, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one.
For many years, his clients have included technology companies and SaaS providers, leading German research institutions and a systemically important German bank. His advisory focus lies in particular on GDPR compliance, the data economy, SaaS, AI regulation and IT contract law.
German Federal Constitutional Court (BVerfG), judgment of 15 December 1983, 1 BvR 209/83 and others, Census
Landmark decision of the BVerfG on the right to informational self-determination and on the requirements for data processing by the state.
CJEU, Judgment of 16 December 2008, C-524/06, Huber
CJEU decision on the necessity of the data processing in the central register of foreign nationals and on the proactive obligation to erase and to rectify.