Reference - Cases & enforcement
Reference · Landmark CJEU/ECtHR cases & major fines
A handful of cases and fines come up again and again. Know what each one decided and the principle it established - examiners use them as scenario anchors.
| Case | Year | What it established |
|---|---|---|
| Digital Rights Ireland | 2014 | CJEU struck down the Data Retention Directive as invalid |
| Google Spain / Google v AEPD | 2014 | Established the right to be forgotten; search engines are controllers of data in third-party pages |
| Schrems I | 2015 | CJEU invalidated Safe Harbor (US access for national security not limited) |
| Breyer | 2016 | A dynamic IP address can be personal data if the holder can lawfully obtain identification |
| Schrems II | 2020 | Invalidated the Privacy Shield; SCCs remain valid but need a case-by-case assessment |
| CJEU C-184/20 | 2022 | Data liable to indirectly reveal sensitive info falls under the Article 9 prohibition (special category by inference) |
| Planet49 | 2019 | Cookie consent must be active; a pre-ticked box is not valid consent |
| Barbulescu v Romania (ECtHR) | 2017 | Workplace monitoring must be proportionate, with prior notice |
| Organisation | Amount | Reason |
|---|---|---|
| Google (CNIL) | €50 million (2019) | Lack of transparency and valid consent for ad personalisation; one-stop-shop did not apply |
| H&M (German SA) | €35.2 million (2020) | Secret monitoring/profiling of employees |
| Meta (Irish DPC) | €390 million (2023) | Unclear legal basis for personalised ads (transparency) |
| WhatsApp (Irish DPC) | €225 million (2021) | Insufficient transparency about data handling (Articles 13/14) |
| Meta (Irish DPC) | €1.2 billion (2023) | US data transfers contrary to Schrems II - the record GDPR fine |
CJEU vs ECtHR
The CJEU (Luxembourg) interprets EU law and decided Schrems I/II, Google Spain, Breyer. The ECtHR (Strasbourg) enforces the ECHR and is not an EU court. Don't let a scenario blur the two.
Key terms - quick answers
What is “CJEU”?
Court of Justice of the European Union (Luxembourg) - interprets EU law, including the GDPR; an EU institution.
What is “ECtHR”?
European Court of Human Rights (Strasbourg) - enforces the ECHR; NOT an EU institution.