# Case Law Judgments on data protection law, for example of the CJEU, the General Court, the German Federal Court of Justice (BGH) and other German courts. > Quelle: https://www.thomashelbing.com/en/wissen/dsgvo-hub/rechtsprechung > Sprache: en Judgments on data protection law, for example of the CJEU, the General Court, the German Federal Court of Justice (BGH) and other German courts. * [1.4.1 German Federal Constitutional Court (BVerfG), judgment of 15 December 1983, 1 BvR 209/83 and others, Census](/docs/dsgvo-hub/rechtsprechung/1.4.1-bverfg-volkszaehlung): Landmark decision of the BVerfG on the right to informational self-determination; basis for the principles of transparency and accuracy under the GDPR. * [1.4.2 CJEU, judgment of 20 May 2003, C-465/00 and others, Österreichischer Rundfunk](/docs/dsgvo-hub/rechtsprechung/1.4.2-eugh-oesterreichischer-rundfunk): Publication of income data of public-sector employees; requirements as to the clarity and precision of the legal basis. * [1.4.3 CJEU, judgment of 16 December 2008, C-524/06, Huber](/docs/dsgvo-hub/rechtsprechung/1.4.3-eugh-huber): Necessity of the data processing in a central register of foreign nationals; proactive obligation to erase and to rectify. * [1.4.4 CJEU, judgment of 7 May 2009, C-553/07, Rijkeboer](/docs/dsgvo-hub/rechtsprechung/1.4.4-eugh-rijkeboer): Duration of the storage of recipients of a data transmission; interpretation of the principles with regard to rights of access. * [1.4.5 CJEU, judgment of 8 April 2014, C-293/12 and others, Digital Rights Ireland](/docs/dsgvo-hub/rechtsprechung/1.4.5-eugh-digital-rights-ireland): Data retention; requirements for clear and precise legal bases and for data security. * [1.4.6 CJEU, judgment of 13 May 2014, C-131/12, Google Spain](/docs/dsgvo-hub/rechtsprechung/1.4.6-eugh-google-spain): Derivation of the "right to be forgotten" from the principles of data processing; obligation to erase where the data lose their relevance to the purpose. * [1.4.7 CJEU, judgment of 1 October 2015, C-201/14, Bara](/docs/dsgvo-hub/rechtsprechung/1.4.7-eugh-bara): Transparency requirements for transmissions of personal data between public authorities. * [1.4.8 CJEU, judgment of 20 December 2017, C-434/16, Nowak](/docs/dsgvo-hub/rechtsprechung/1.4.8-eugh-nowak): Examination answers and examiner's comments as personal data; limits of the right to rectification in the case of time-related data. * [1.4.9 CJEU, judgment of 24 November 2011, C-468/10 and C-469/10, ASNEF](/docs/dsgvo-hub/rechtsprechung/1.4.9-eugh-asnef): Exhaustive character of the list of grounds for lawful processing and balancing of interests under the Data Protection Directive; decisive for Article 6(1)(f) GDPR. * [1.4.10 CJEU, judgment of 1 October 2019, C-673/17, Planet49](/docs/dsgvo-hub/rechtsprechung/1.4.10-eugh-planet49): Requirements for valid consent in the online context (active conduct, no pre-ticked boxes). * [1.4.11 CJEU, judgment of 11 December 2019, C-708/18, Asociaţia de Proprietari](/docs/dsgvo-hub/rechtsprechung/1.4.11-eugh-asociatia-de-proprietari): Video surveillance in an apartment building; three-stage test under Article 6(1)(f) GDPR and restrictive interpretation of necessity. * [1.4.12 CJEU, judgment of 4 May 2017, C-13/16, Rīgas satiksme](/docs/dsgvo-hub/rechtsprechung/1.4.12-eugh-rigas-satiksme): Interpretation of Article 7(f) of the Data Protection Directive (predecessor provision to Article 6(1)(f) GDPR); three-stage test and necessity. * [1.4.13 CJEU, judgment of 29 July 2019, C-40/17, Fashion ID](/docs/dsgvo-hub/rechtsprechung/1.4.13-eugh-fashion-id): Lawfulness of embedding social plugins; legitimate interests in the case of joint controllership under Article 26 GDPR. * [1.4.14 CJEU, judgment of 24 September 2019, C-136/17, GC and Others/CNIL](/docs/dsgvo-hub/rechtsprechung/1.4.14-eugh-gc-cnil): De-listing requests against search engine operators; normative precedence of data protection and privacy in the case of name-based searches. * [1.4.15 CJEU, judgment of 1 August 2022, C-184/20, Vyriausioji tarnybinės etikos komisija](/docs/dsgvo-hub/rechtsprechung/1.4.15-eugh-vyriausioji): The list of grounds for lawful processing in Article 6(1) GDPR is exhaustive; publication of declarations of interests on the internet and special categories under Article 9 GDPR. * [1.4.16 CJEU, judgment of 4 July 2023, C-252/21, Meta Platforms/Bundeskartellamt](/docs/dsgvo-hub/rechtsprechung/1.4.16-eugh-meta-bundeskartellamt): Scope of the necessity criterion under Article 6(1)(b) and (f) GDPR; "objectively indispensable" rather than merely "useful"; interaction with Article 9 GDPR. * [1.4.17 CJEU, judgment of 30 March 2023, C-34/21, Hauptpersonalrat der Lehrerinnen und Lehrer](/docs/dsgvo-hub/rechtsprechung/1.4.17-eugh-hauptpersonalrat): Scope of specific national rules on employee data protection (§ 23 of the Hesse Data Protection and Freedom of Information Act (HDSIG), § 26 of the German Federal Data Protection Act (BDSG)) and limits of the opening clauses. * [1.4.18 CJEU, judgment of 2 March 2023, C-268/21, Norra Stockholm Bygg](/docs/dsgvo-hub/rechtsprechung/1.4.18-eugh-norra-stockholm-bygg): Further processing for new purposes and Article 6(4) GDPR; requirements of necessity and proportionality. * [1.4.19 CJEU, judgment of 8 December 2022, C-180/21, Inspectoratul General pentru Imigrări](/docs/dsgvo-hub/rechtsprechung/1.4.19-eugh-inspectoratul-general): Processing by public authorities in judicial proceedings; delimitation between Article 6(1)(c) and Article 6(1)(e) GDPR. * [1.4.20 CJEU, judgment of 11 December 2014, C-212/13, Ryneš](/docs/dsgvo-hub/rechtsprechung/1.4.20-eugh-rynes): Private video surveillance and purely personal or household activity under Article 2(2)(c) GDPR (at the time the Data Protection Directive). * [1.4.21 German Federal Administrative Court (BVerwG), judgment of 27 September 2018, 7 C 5/17](/docs/dsgvo-hub/rechtsprechung/1.4.21-bverwg-7-c-5-17): Requirements for national legal bases for data processing in the public sector; limits of general catch-all clauses. * [1.4.22 BVerwG, judgment of 27 March 2019, 6 C 2/18](/docs/dsgvo-hub/rechtsprechung/1.4.22-bverwg-6-c-2-18): Article 6(1)(e) GDPR does not apply to private parties in the absence of an act conferring public authority; requirements for the national legal basis. * [1.4.23 BGH, judgment of 20 February 2018, VI ZR 30/17, Ärztebewertung III (Jameda)](/docs/dsgvo-hub/rechtsprechung/1.4.23-bgh-jameda-aerztebewertung-iii): Balancing of interests in the case of rating portals; reassessment as a result of changed business models. * [1.4.24 CJEU, judgment of 27 October 2022, C-129/21, Proximus](/docs/dsgvo-hub/rechtsprechung/1.4.24-eugh-proximus): Objection to direct marketing and further use of publicly accessible data. * [1.4.25 CJEU, judgment of 11 November 2020, C-61/19, Orange România](/docs/dsgvo-hub/rechtsprechung/1.4.25-eugh-orange-romania): Requirements for a pre-formulated declaration of consent; clear distinction from other contractual matters, burden of proof on the controller. * [1.4.26 CJEU, judgment of 22 June 2021, C-439/19, Latvijas Republikas Saeima ("B")](/docs/dsgvo-hub/rechtsprechung/1.4.26-eugh-b-latvijas-saeima): Improvement of road safety as a public interest within the meaning of Article 6(1)(e) GDPR; classification of road traffic offenses as criminal offenses within the meaning of Article 10 GDPR. * [1.4.27 CJEU, judgment of 12 September 2024, C-17/22 and C-18/22, HTB Neunte Immobilien Portfolio and Ökorenta](/docs/dsgvo-hub/rechtsprechung/1.4.27-eugh-htb-oekorenta): Judge-made law as a legal obligation within the meaning of Article 6(1)(c) GDPR; requirements of clarity, foreseeability and proportionality. * [1.4.28 BGH, order of 18 August 2020, 5 StR 175/20](/docs/dsgvo-hub/rechtsprechung/1.4.28-bgh-5-str-175-20): Admissibility of unlawfully obtained video recordings in criminal proceedings despite an infringement of the GDPR; balancing in the individual case. * [1.4.29 CJEU, judgment of 9 January 2025, C-394/23, Mousse](/docs/dsgvo-hub/rechtsprechung/1.4.29-eugh-mousse): Necessity under Article 6(1)(f) GDPR; the right to object under Article 21 GDPR is not to be taken into account in the assessment of necessity. * [1.4.30 CJEU, judgment of 4 October 2024, C-446/21, Schrems/Meta](/docs/dsgvo-hub/rechtsprechung/1.4.30-eugh-schrems-meta): Scope of the concept of sensitive data under Article 9(1) GDPR in the context of advertising on social networks; interpretation of the exception for data "manifestly made public" and obligation to impose a time limit. * [1.4.31 CJEU, judgment of 4 October 2024, C-21/23, Lindenapotheke](/docs/dsgvo-hub/rechtsprechung/1.4.31-eugh-lindenapotheke): Ordering medicinal products that are pharmacy-only but not subject to prescription generates data concerning health within the meaning of Article 9(1) GDPR; pursuit of data protection infringements by competitors under unfair competition law. * [1.4.32 CJEU, judgment of 7 December 2023, C-634/21, SCHUFA Holding (Scoring)](/docs/dsgvo-hub/rechtsprechung/1.4.32-eugh-schufa-scoring): Automated decision-making and profiling under Article 22 GDPR; limits of Member State implementation; the balancing exercise must not be pre-empted. * [1.4.33 CJEU, judgment of 4 October 2024, C-621/22, Koninklijke Nederlandse Lawn Tennisbond](/docs/dsgvo-hub/rechtsprechung/1.4.33-eugh-koninklijke-nederlandse-lawn-tennisbond): Commercial interest as a legitimate interest within the meaning of Article 6(1)(f) GDPR; balancing in the case of transmission of members' data to third parties offering gambling. * [1.4.34 CJEU, judgment of 17 June 2021, C-597/19, M.I.C.M.](/docs/dsgvo-hub/rechtsprechung/1.4.34-eugh-m-i-c-m): Legitimate interest of third parties in the identification of IP addresses in order to pursue copyright infringements; interpretation of Article 6(1)(f) GDPR. * [1.4.35 CJEU, judgment of 25 November 2021, C-102/20, StWL Städtische Werke Lauf a.d. Pegnitz](/docs/dsgvo-hub/rechtsprechung/1.4.35-eugh-stwl-pegnitz): Concept of direct marketing under the ePrivacy Directive; advertising displayed in an email inbox in the guise of messages constitutes direct marketing and requires consent. * [1.4.36 BGH, order of 23 June 2020, KVR 69/19, Facebook (antitrust proceedings)](/docs/dsgvo-hub/rechtsprechung/1.4.36-bgh-facebook-kvr-69-19): Interim antitrust proceedings with knock-on effects for data protection law: narrow interpretation of the performance characteristic of the contract in the context of Article 6(1)(b) GDPR. * [1.4.37 CJEU, judgment of 19 October 2016, C-582/14, Breyer](/docs/dsgvo-hub/rechtsprechung/1.4.37-eugh-breyer): Dynamic IP addresses as personal data; processing to ensure the functionality of a publicly accessible website as a legitimate interest under Article 7(f) of the Data Protection Directive. * [1.4.38 CJEU, judgment of 7 December 2023, C-26/22 and C-64/22, SCHUFA Holding (Libération de reliquat de dette)](/docs/dsgvo-hub/rechtsprechung/1.4.38-eugh-schufa-liberation): Three-stage test under Article 6(1)(f) GDPR for the storage of information from public registers by credit information agencies; relationship to the right to object and the right to erasure. * [1.4.39 CJEU, judgment of 4 May 2023, C-60/22, Bundesrepublik Deutschland (BAMF)](/docs/dsgvo-hub/rechtsprechung/1.4.39-eugh-c-60-22-bamf): Infringements of Article 26 GDPR (joint controllership) and Article 30 GDPR (records of processing activities) do not render the processing unlawful; separation of the formal documentation obligation from substantive lawfulness. * [1.4.40 CJEU, judgment of 12 January 2023, C-154/21, RW/Österreichische Post](/docs/dsgvo-hub/rechtsprechung/1.4.40-eugh-c-154-21-oesterreichische-post): Right of access under Article 15(1)(c) GDPR: the controller must in principle name the specific recipients; limitation to categories only as a narrowly defined exception. * [1.4.41 CJEU, judgment of 10 July 2018, C-25/17, Jehovah's Witnesses](/docs/dsgvo-hub/rechtsprechung/1.4.41-eugh-zeugen-jehovas): Broad concept of a filing system: handwritten notes made during door-to-door visits fall within the Data Protection Directive where the data are retrievable on the basis of specific criteria; joint controllership of a religious community. * [1.4.42 CJEU, judgment of 1 October 2015, C-230/14, Weltimmo](/docs/dsgvo-hub/rechtsprechung/1.4.42-eugh-weltimmo): Broad interpretation of the concept of an establishment for the purposes of the territorial scope (Article 3(1) GDPR); a stable arrangement with minimal but real activity suffices; limits of the power of national supervisory authorities to impose penalties. * [1.4.43 CJEU, judgment of 6 November 2003, C-101/01, Lindqvist](/docs/dsgvo-hub/rechtsprechung/1.4.43-eugh-lindqvist): Publication of personal data on a website is processing that falls within the scope of application; the household exemption does not apply where data are disclosed to an indefinite number of persons; narrow interpretation of the exclusions from the material scope. * [1.4.44 CJEU, judgment of 16 January 2024, C-33/22, Committee of Inquiry](/docs/dsgvo-hub/rechtsprechung/1.4.44-eugh-untersuchungsausschuss): The GDPR applies in principle also to a parliamentary committee of inquiry; exception only for activities in the field of national security (Article 2(2)(a) GDPR). * [1.4.45 CJEU, judgment of 22 June 2022, C-534/20, Leistritz](/docs/dsgvo-hub/rechtsprechung/1.4.45-eugh-leistritz): The stricter German special protection against dismissal for data protection officers (§ 6(4) BDSG) is compatible with the prohibition on removal from office under Article 38(3), second sentence, GDPR, provided that the objectives of the GDPR are not undermined. * [1.4.46 CJEU, judgment of 9 February 2023, C-453/21, X-FAB](/docs/dsgvo-hub/rechtsprechung/1.4.46-eugh-x-fab): Conflict of interests under Article 38(6) GDPR where tasks are assigned that determine the purposes and means of the processing; assessment in the individual case; stricter national rules on removal from office permissible. * [1.4.47 Bar Court of Appeal for North Rhine-Westphalia (AGH NRW), judgment of 12 March 2021, 1 AGH 9/19](/docs/dsgvo-hub/rechtsprechung/1.4.47-agh-nrw-1-agh-9-19): The legal advisory tasks of the data protection officer under Article 39 GDPR constitute a legal service permitted by statute (§ 1(3) of the German Legal Services Act (RDG)); licensing requirement for external data protection officers under the RDG. * [1.4.48 German Regional Labor Court of Hamm (LAG Hamm), judgment of 6 October 2022, 18 Sa 271/22](/docs/dsgvo-hub/rechtsprechung/1.4.48-lag-hamm-18-sa-271-22): Payroll accounting and personnel administration for around 80 employees do not constitute a core activity within the meaning of Article 37(1)(b) GDPR; voluntarily designated data protection officer without special protection against dismissal under § 6(4) BDSG. * [1.4.49 CJEU, judgment of 5 June 2018, C-210/16, Wirtschaftsakademie Schleswig-Holstein](/docs/dsgvo-hub/rechtsprechung/1.4.49-eugh-wirtschaftsakademie): The operator of a Facebook fan page is jointly responsible with the network; landmark decision on the broad interpretation of joint controllership under Article 26 GDPR (no equivalent participation, no access to the data required). * [1.4.50 CJEU, judgment of 16 July 2020, C-311/18, Schrems II](/docs/dsgvo-hub/rechtsprechung/1.4.50-eugh-schrems-ii): The EU-US Privacy Shield is invalid; the standard contractual clauses are tenable only with a supplementary assessment of the level of protection in the third country in the individual case. Basis of the obligation to carry out a transfer impact assessment. * [1.4.51 CJEU, judgment of 6 October 2015, C-362/14, Schrems (Safe Harbor)](/docs/dsgvo-hub/rechtsprechung/1.4.51-eugh-schrems-i): The Safe Harbor arrangement is invalid; the national supervisory authorities may examine transfers independently notwithstanding an adequacy decision. The opening of the chain of US adequacy decisions. * [1.4.52 CJEU, judgment of 27 February 2025, C-203/22, Dun & Bradstreet Austria](/docs/dsgvo-hub/rechtsprechung/1.4.52-eugh-dun-bradstreet): Scope of the right of access to the logic involved in an automated decision under Article 15(1)(h) GDPR; explanation of the procedure and principles instead of disclosure of the algorithm; in camera proceedings where trade secrets stand in the way. --- ## About the author This article was written by [Dr. Thomas Helbing, specialist lawyer for IT law in Munich](https://www.thomashelbing.com/en). Since 2020 and continuously through today (2026), Handelsblatt has [recognized](https://www.thomashelbing.com/en#auszeichnungen) Dr. Helbing as one of **"Germany's Best Lawyers"** in IT law and data protection law. According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the **leading lawyers for data protection and IT law** and is listed among the **top 100 lawyers in Germany (2024/25)**. Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel. Dr. Helbing has **many years of advisory experience in data protection and IT law** and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups. His [professional background](https://www.thomashelbing.com/en#stationen) covers the **full spectrum of IT and technology law practice**. He began his career at a major international law firm, then gained **in-house experience at a DAX-listed company**, and is himself an **entrepreneur and founder of several digital ventures**. He also has **hands-on programming experience**, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one. For many years, his [clients](https://www.thomashelbing.com/en#referenzen) have included **technology companies and SaaS providers**, leading **German research institutions** and a **systemically important German bank**. His advisory focus lies in particular on **GDPR compliance, the data economy, SaaS, AI regulation and IT contract law**.