CJEU, Judgment of 7 May 2009, C-553/07, Rijkeboer
CJEU decision on the storage period for information about recipients of personal data and on the practical effectiveness of the right of access.
1 Overview
Mr. Rijkeboer, who lived in Rotterdam, had requested information as to the recipients to which the municipality had transmitted data from the population register in the preceding two years. National rules provided for information on such transmissions to be erased after just one year. The CJEU examined whether that limitation was compatible with Directive 95/46/EC.
Reference: CJEU, judgment of 7 May 2009, C-553/07, Rijkeboer
2 Significance for the principles of the GDPR
The CJEU held that the Member States must determine the storage period for information on recipients in such a way that the data subject's right of access remains practically effective. The judgment encapsulates the interplay between storage limitation (Article 5(1)(e) GDPR) and data subject rights (Article 15 GDPR): a storage period that is too short may make the exercise of rights of access impossible in practice. Conversely, the right of access does not justify unlimited retention.
About the author
About the author
This article was written by Dr. Thomas Helbing, specialist lawyer for IT law in Munich.
Since 2020 and continuously through today (2026), Handelsblatt has recognized Dr. Helbing as one of "Germany's Best Lawyers" in IT law and data protection law.
According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the leading lawyers for data protection and IT law and is listed among the top 100 lawyers in Germany (2024/25). Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel.
Dr. Helbing has many years of advisory experience in data protection and IT law and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups.
His professional background covers the full spectrum of IT and technology law practice. He began his career at a major international law firm, then gained in-house experience at a DAX-listed company, and is himself an entrepreneur and founder of several digital ventures. He also has hands-on programming experience, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one.
For many years, his clients have included technology companies and SaaS providers, leading German research institutions and a systemically important German bank. His advisory focus lies in particular on GDPR compliance, the data economy, SaaS, AI regulation and IT contract law.
CJEU, Judgment of 16 December 2008, C-524/06, Huber
CJEU decision on the necessity of the data processing in the central register of foreign nationals and on the proactive obligation to erase and to rectify.
CJEU, Judgment of 8 April 2014, C-293/12 and others, Digital Rights Ireland
CJEU decision on the invalidity of the Data Retention Directive: requirements for clear and precise legal bases and for data security.