search

… Article 32 of / and the principle of effectiveness of EU law must be interpreted as meaning that, in order to assess the appropriateness of the security measures implemented by the controller under that article, an expert’s report cannot constitute a systematically necessary and sufficient means of proof. 5. …

… Article 82(1) of / must be interpreted as meaning that the fear experienced by a data subject with regard to a possible misuse of his or her personal data by third parties as a result of an infringement of that regulation is capable, in itself, of constituting ‘non-material damage’ within the meaning of that provision. [Signatures] * Language of the case: Bulgarian. …

… The principle of accountability of the controller, set out in Article 5(2) of / and given expression in Article 24 thereof, must be interpreted as meaning that, in an action for damages under Article 82 of that regulation, the controller in question bears the burden of proving that the security measures implemented by it are appropriate pursuant to Article 32 of that regulation. 4. …

… Article 17(1)(d) of / must be interpreted as meaning that the controller is required to erase unlawfully processed personal data as soon as possible. [Signatures] * Language of the case: German. …

… Article 17(1)(c) of / must be interpreted as meaning that the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where he or she objects to the processing pursuant to Article 21(1) of that regulation and there are no overriding legitimate grounds capable of justifying, exceptionally, the processing in question. 4. …

… Article 78(1) of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that a decision on a complaint adopted by a supervisory authority is subject to full judicial review. 2. …

… JUDGMENT OF THE COURT (First Chamber) 7 December 2023 (*) (Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - (EU) / - Article 22 - Automated individual decision-making - Credit information agencies - Automated establishment of a probability value concerning the ability of a person to meet payment commitments in the future (‘scoring’) - Use of that probability value by third parties) In Case C-634/21, REQUEST for a …

… Kranenborg, acting as Agents, after hearing the Opinion of the Advocate General at the sitting on 16 March 2023, gives the following Judgment 1 This request for a preliminary ruling concerns the interpretation of Article 6(1) and Article 22 of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data …

… On those grounds, the Court (First Chamber) hereby rules: Article 22(1) of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that the automated establishment, by a credit information agency, of a probability value based on personal data relating …

… Article 83 of / must be interpreted as meaning that an administrative fine may be imposed pursuant to that provision only where it is established that the controller, which is both a legal person and an undertaking, intentionally or negligently committed an infringement referred to in Article 83(4) to (6) thereof. [Signatures] * Language of the case: German. …

… JUDGMENT OF THE COURT (Grand Chamber) 5 December 2023 (*) (Reference for a preliminary ruling - Protection of personal data - (EU) / - Article 4(7) - Concept of ‘controller’ - Article 58(2) - Powers of supervisory authorities to apply corrective powers - Article 83 - Imposition of administrative fines on a legal person - Conditions - Discretion of the Member States - Requirement that the infringement be intentional or negligent) In Case C-807/21, REQUEST for a preliminary ruling …

… Meessen, acting as Agents, after hearing the Opinion of the Advocate General at the sitting on 27 April 2023, gives the following Judgment 1 This request for a preliminary ruling concerns the interpretation of Article 83(4) to (6) of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection …

… Article 4(7) and Article 26(1) of / must be interpreted as meaning that the classification of two entities as joint controllers does not require that there be an arrangement between those entities regarding the determination of the purposes and means of the processing of personal data in question; nor does it require that there be an arrangement laying down the terms of the joint control. 3. …

… JUDGMENT OF THE COURT (Grand Chamber) 5 December 2023 (*) (Reference for a preliminary ruling - Protection of personal data - (EU) / - Article 4(2) and (7) - Concepts of ‘processing’ and ‘controller’ - Development of a mobile IT application - Article 26 - Joint control - Article 83 - Imposition of administrative fines - Conditions - Requirement that the infringement be intentional or negligent - Responsibility and liability of the controller for the processing of personal data carried …

… Article 4(2) of / must be interpreted as meaning that the use of personal data for the purposes of the IT testing of a mobile application constitutes ‘processing’, within the meaning of that provision, unless such data have been rendered anonymous in such a manner that the subject of those data is not or is no longer identifiable, or unless it involves fictitious data which do not relate to an existing natural person. 4. …

… (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, ‘the GDPR’), and therefore also with the tasks conferred on it under the latter regulation. …

… European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ 2018 L 295, p. 39). 4 According to the European Data Protection Board, however, those provisions, and the issues raised by the present appeal, overlap and intersect inseparably with those of …

… Article 61(1) of Regulation 2018/858, read in conjunction with Article 61(4) and point 6.1 of Annex X to that regulation, must be interpreted as meaning that it establishes a ‘legal obligation’, within the meaning of Article 6(1)(c) of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection …

… (EU) / - Article 6(1)(c) - Processing of personal data - Legal obligation on car manufacturers to make vehicle identification numbers (VIN) available to independent operators) In Case C-319/22, REQUEST for a preliminary ruling under Article 267 TFEU from the Landgericht Köln (Regional Court, Cologne, Germany), made by decision of 4 May 2022, received at the Court on 11 May 2022, in the proceedings Gesamtverband Autoteile-Handel eV v Scania CV AB, THE COURT (Third Chamber), composed of K. …

… (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’). 2 The request has been made in proceedings between Gesamtverband Autoteile-Handel eV (‘Gesamtverband’), a German trade association representing wholesalers of motor vehicle parts, and Scania CV AB …

… The Amtsgericht München (Local Court, Munich, Germany) seeks the Court’s guidance as to the interpretation of the concept of non-material damage in Article 82 of (EU) / (3) and the conditions under which compensation for such damage is available. It asks, in particular, whether the theft of that data constitutes ‘identity theft’ to which recital 75 of the GDPR refers. II. Legal framework - European Union law 2. …

… Provisional text OPINION OF ADVOCATE GENERAL COLLINS delivered on 26 October 2023(1) Joined Cases C-182/22 and C-189/22 JU (C-182/22) SO (C-189/22) v Scalable Capital GmbH (Request for a preliminary ruling from the Amtsgericht München, (Local Court, Munich, Germany)) (Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - (EU) / - Article 82(1) - Right to compensation for damage caused by data processing that infringes …

… Article 82(1) of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that the theft by an unknown offender of a data subject’s sensitive personal data may give rise to a right to compensation for non-material damage upon proof of an infringement …

… The first sentence of Article 15(3) of / must be interpreted as meaning that, in the context of a doctor-patient relationship, the right to obtain a copy of personal data undergoing processing means that the data subject must be given a faithful and intelligible reproduction of all those data. …

… JUDGMENT OF THE COURT (First Chamber) 26 October 2023 (*) (Reference for a preliminary ruling - Processing of personal data - (EU) / - Articles 12, 15 and 23 - Data subject’s right of access to his or her data undergoing processing - Right to obtain a first copy of those data free of charge - Processing of a patient’s data by his or her medical practitioner - Medical records - Reasons for the request for access - Use of data for the purpose of triggering the liability of the person …

… Kranenborg, acting as Agents, after hearing the Opinion of the Advocate General at the sitting on 20 April 2023, gives the following Judgment 1 This request for a preliminary ruling concerns the interpretation of Article 12(5), Article 15(3) and Article 23(1)(i) of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive …

… JUDGMENT OF THE COURT (Eighth Chamber) 5 October 2023 (*) (Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data - (EU) / - Article 4(2) - Concept of ‘processing’ of personal data - Mobile application - Verification of the validity of ‘EU Digital COVID Certificates’ issued pursuant to Regulation (EU) 2021/953) In Case C-659/22, REQUEST for a preliminary ruling under Article 267 TFEU from the Nejvyšší správní soud (Supreme …

… Ondrůšek, acting as Agents, having decided, after hearing the Advocate General, to proceed to judgment without an Opinion, gives the following Judgment 1 This request for a preliminary ruling concerns the interpretation of Article 2(1) and Article 4(2) of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ( …

… On those grounds, the Court (Eighth Chamber) hereby rules: The concept of ‘processing’ personal data referred to in Article 4(2) of (EU) / of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as including the verification, using a national mobile application, …