Article 6: Lawfulness of processingAI-relevant

A credit agency may not keep data on a debt discharge longer than the public register does. A supervisory authority's decision on a complaint is subject to full judicial review.

A vehicle identification number is personal data for anyone who reasonably has the means to link it to the keeper. Manufacturers have a legal obligation to make these numbers available to independent repairers.

National rules on employee data are only more specific rules under Article 88 if they meet the requirements of paragraph 2. Otherwise they must be disregarded, unless they form a legal basis under Article 6(3).

The GDPR also applies where a civil court orders a staff register to be produced as evidence. The court must weigh the interests of the data subjects and apply data minimisation, for instance through pseudonymisation.

Copying customer data into a test database can be compatible further processing, but the data may not stay there longer than needed for testing and fixing errors.

Data that indirectly reveal sensitive information, such as a partner's name revealing sexual orientation, fall under Article 9. Publishing declarations of interests online went further than necessary.

Penalty points for traffic offences are criminal offence data. A law that makes them available to anyone without a specific interest, or passes them to businesses for re-use, breaches the GDPR.

CCTV in the common areas of an apartment building can rely on legitimate interests without consent, provided the conditions of that basis are met.

The Grand Chamber finds no violation of Article 8 ECHR in covert video surveillance of cashiers, given the reasonable suspicion of serious theft and the limited duration and scope.

A website embedding a Facebook button is a joint controller, but only for collecting and transmitting visitor data. Consumer associations may bring proceedings on behalf of data subjects.

The Grand Chamber finds a violation of Article 8 ECHR in the reading of an employee's messages. National courts must check, among other things, whether prior notice was given, whether there was a legitimate reason and whether less intrusive means were available.

The legitimate interests basis does not oblige disclosure of data to a third party who wants to bring a damages claim, but does not preclude such disclosure under national law. The Court set out the three cumulative conditions for that basis.

A dynamic IP address is personal data for a website operator that has legal means to have the user identified through the internet service provider. National law may not exclude the legitimate interests basis in advance.

Member States may not add extra conditions to the legitimate interests basis, such as requiring that the data come from public sources. The provision has direct effect.

Necessity is an autonomous concept of EU law. A central register of foreign EU citizens is only necessary if it contains just the data required and makes applying the law more effective.

Describes the roles and responsibilities of social media platforms and advertisers in targeted advertising and the legal bases that fit.

Addresses how payment service providers under PSD2 may process personal data, with attention to legal basis, third party data and special categories.

Covers video surveillance under the GDPR, including the household exemption, legal basis, biometric data, transparency duties and storage periods.

Clarifies when processing is genuinely necessary for performing a contract with the data subject in online services, and when another legal basis is needed.

Assesses employee monitoring with new technologies and stresses that consent at work is rarely free and that monitoring must be necessary and proportionate.

Elaborates the balancing test for legitimate interests, with attention to the nature of the interest, the impact on data subjects and additional safeguards.

Elaborates the purpose limitation principle, covering the requirement of specified purposes and the factors for testing whether further processing is compatible.

Amazon processed personal data for interest-based advertising on the basis of legitimate interest, which was not a valid legal basis. It also fell short on informing users and on honouring rights such as access, rectification and erasure.

The administrative tribunal upheld the fine on 18 March 2025. On appeal, the Administrative Court annulled the decision on 12 March 2026 and sent the case back to the CNPD, because the CNPD had not assessed whether Amazon acted intentionally or negligently and had not weighed which corrective measure was most appropriate. The core findings of infringement were confirmed; the Article 21 complaints were held to fall outside the scope of the inquiry.

For years, managers at the Nuremberg service centre kept extensive notes on the private lives of hundreds of employees, including illnesses, holidays, family problems and religion. The data were used to build profiles and inform employment decisions.

The date is the date of the press release; according to reports H&M did not object, so the fine is final.

In 2018 the tennis association provided members' personal data for payment to two sponsors, who then approached the members with advertising. The AP found there was no valid legal basis and, for part of the members, an incompatible further use of the data.

Decision of 20 December 2019, announced on 3 March 2020. After the Court of Justice judgment (C-621/22, 4 October 2024), the AP and KNLTB agreed in October 2025 to end the proceedings; the AP is reducing the fine to EUR 250,000, minus the cost of an awareness campaign. A final new fining decision was announced for June 2026 at the latest but was not found.

When creating a Google account on an Android phone, information about the processing was scattered and unclear. Consent to personalised advertising was not sufficiently informed, specific or unambiguous.

The Conseil d'État dismissed Google's appeal on 19 June 2020; the fine is final.