Table of Contents:
In the present edition, we inform our readers of: one ECtHR judgment on the surveillance of prison visiting rooms; one CJEU judgment regarding data processing in employment; one AG Opinion on assessing the necessity of resorting to automated decision-making when excluding certain payment options online; one German Federal Court of Justice judgment on the right of access to one’s data as processed by credit scoring companies; and one new EDPB document.
ECtHR Rules on the Legitimacy of Surveillance of Prison Visiting Rooms
On 13th October, the ECtHR ruled in the case of Cengiz v. Türkiye. In terms of the facts, the case essentially concerned “the monitoring and recording of conversations between the applicant and his family members in the prison visiting room after the entry into force, on 10 August 2021, of section 83(4) of Law no. 5275, which provides for the monitoring and recording of visiting-room conversations involving prisoners convicted of terrorist offences or organised crime and those considered dangerous”. Whilst the applicant complained of these measures before prison authorities and before the national courts, these complaints were unsuccessful. Accordingly, the applicant brought the case before the ECtHR, complaining that “the monitoring and recording of his conversations with family members in the prison visiting room constitutes an infringement of his right to respect for his private and family life and of his right to confidential communication under Article 8 of the Convention”. The Court found an infringement. The Court recognised that the surveillance of prisoners’ interactions with family members in the prison visiting room – also covert – constitutes an infringement of Article 8. The Court then moved to consider whether the measures were in accordance with the law, and, in light of the applicable legal framework, considered there to be no issue with this criterion. Finally, however, the Court considered whether the interference was necessary in a democratic society. In this regard, the Court essentially considered that, at each level of national consideration of the measures in question – from the prison authorities, through each of the national courts – there had been a lack of specific consideration of the applicant’s circumstances, and that such individual consideration is necessary in a democratic society. Editorial note: the summary is based on the press release in English, and an electronic translation of French judgment, as, at the time of writing, there was no version of the case available in a language in which the editors are fluent. In this regard, we cannot guarantee the accuracy of the source material or, in consequence, of this summary. Accordingly, all interested in the case should consult original versions themselves.
https://hudoc.echr.coe.int/#{%22itemid%22:[%22001-252741%22]}; https://hudoc.echr.coe.int/eng-press#{%22fulltext%22:[%2225406/22%22]}
CJEU Refuses to Rule on Data Protection Complaints on the Basis of Inadequately Specified Claims
On 21st October, the CJEU ruled in the case of FC v European Investment Fund (EIF). In terms of the facts, the case essentially concerns a job application. The applicant had many years work experience – including 9 in journalism and many more as an entrepreneur – in relation to which the EIF had an open position. The applicant’s application for this position, however, was rejected. The applicant requested “detailed explanations regarding the rejection of her application” and referred the issue to “the EIF Data Protection Officer, informing him of her request for access to information concerning the processing of her personal data. In particular, she asked for his support in this process, explaining that was ‘determined to find out and understand in detail the logic behind the profiling of…personal data and how this profiling” led “to a decision that affects” her “to understand if…rights and freedoms have been fully respected”. In response, the EIF communicated to the applicant that the “application was not taken forward due to” the relevant “professional experience being in excess of what was required in the job advertisement. The job advertisement required that candidates should have: “Between three (3) and five (5) years of post-graduation””. In relation to these facts, the applicant requested that the Court should: “annul the contested decision…order the EIF to pay her a minimum amount of EUR 10 000 in compensation for non-material damage” and “order the EIF to pay her compensation for loss of opportunity”. The case thus only tangentially concerned the processing of personal data – in substance, the case primarily concerned two pleas, “the first alleging that the vacancy notice” was unlawful “in so far as it established an unlawful eligibility criterion, and the second alleging unlawful application of that criterion”. In this respect, the Court considered issues related to personal data processing in relation to the applicant’s suggestion that the “EIF…incurred non-contractual liability”, specifically in relation to the applicant’s allegations of “infringements of the EIF’s obligations in relation to the processing of personal data”. In this regard, the applicant complained that “the EIF data protection officer did not…‘comment anything regarding the lack of clear and easily accessible information on the Applicant’s right to access her personal data (results of her profiling) and did” not “provide her with any information regarding her options to contest the disputed decision’”. Unfortunately, despite a number of interesting issues being raised by the case, the Court eventually decided not to consider the issue in substance at all, and rejected the applicant’s claims. The Court merely stated that “although the applicant relies on several data processing regulations, she never specifies which provisions of those regulations were allegedly infringed. In those circumstances, she cannot be considered to have identified in a sufficiently precise manner the breaches committed by the EIF in the processing of her personal data. Since the claims regarding those alleged breaches are not accompanied by sufficient details to enable their merits to be assessed, they cannot be accepted”.
AG Medina: Automatically Excluding Payment Options Must Comply with Article 22 GDPR
On 15th October, AG Medina advised the Court on the interpretation and application of Article 22 GDPR (on automated decision-making and profiling) in relation to automatically excluding payment options online in Verein für Konsumenteninformation v. Universal Versand GmbH. As to the facts of the case, the applicant in the main proceedings, a consumer protection NGO in Austria (hereinafter VKI) complained that an online commerce service (hereinafter Universal Versand) would automatically exclude the instalment payment option and the option to pay via a bill for clients they classified as untrustworthy. VKI argued that such individual decisions are taken automatically and in breach of Article 22. As the dispute escalated to the CJEU, AG Medina was called to advise the Court on whether this practice is indeed a result of an automated decision-making in the sense of Article 22(1) and if so, whether it complies with the legality requirements in Article 22(2)(a). As to the question on whether individuals can benefit from the prohibition in Article 22(1) from being subject to automated decisions when such decisions consist in the exclusion of certain payment options, AG Medina pointed out that three conditions have to be fulfilled: (1) there must be a “decision”, which is taken (2) “solely on automated processing, including profiling” and which (3) “produces legal effects concerning him or her or similarly significantly affects him or her”. She noted that the referring court has doubts whether the third condition is fulfilled. She opined that where the exclusion of certain payment options, based on an automated assessment of an individual’s creditworthiness, could prevent that individual from purchasing an item online (entering a contractual relationship with the commercial entity), then this would fulfil the requirement of producing “legal effects concerning him or her or similarly significantly” affecting him or her. Then, AG Medina moved on to analyse the conditions which such a decision needs to fulfil in order to comply with Article 22(2)(a), namely assessing whether it “is necessary for entering into, or performance of, a contract between the data subject and a data controller”. She first examined whether such an automated creditworthiness assessment was necessary for the fulfilment of a contract and advised the Court to leave this question to the referring court by providing guidance on how to assess necessity. One point she specifically focused on is proving the necessity (objective appropriateness) of the collected personal data for the assessment of the creditworthiness and further noted that the burden of proof should lie with the online commerce entity. Finally, and further on the necessity requirement, AG Medina was of the opinion that for resorting to automated decisions as in the present case, there should be no alternative option to achieve the pursued objective. When considering the appropriateness of alternative options, AG Medina suggested that the controller may take into account factors such as time-saving for customers and cost-saving for the online commercial entity. Editorial note: the summary is based on the German version of the Opinion, as no English translation was available at the time of writing.
German Federal Court of Justice Rules on Right of Access
On 21 October, the German Federal Court of Justice ruled on the right of access to one’s personal data under Article 15(1)(h) GDPR when this data is used for producing a creditworthiness score. As to the facts of the case, the applicants are private persons who submitted access requests to their data in 2023 with SCHUFA – a credit scoring company in Germany – on the basis of Article 15. SCHUFA did provide them access to certain information, but the applicants were dissatisfied, arguing mainly that they did not understand how SCHUFA calculated their score. They submitted complaints with different lower courts in Germany, which rejected the applicants‘ complaints. The appeal courts admitted partially the appeals, especially as concerns the argument that an automated decision took place and that SCHUFA should provide more detailed information on how the scores were calculated. With its judgment, the Federal Court sent the cases back to the appeal courts and provided them with guidance as to how to revise the judgments. First, the Federal Court established that the appeal courts should actually examine whether the contested scoring constitutes an automated decision which produces significant effects on the applicants. This would be the case, according to the Court, where the recipients of the score – e.g. a bank – would rely on that score in order to take a decision in relation to the applicant – e.g. deny them a loan. The Court further ruled that it should be for the applicants to prove this reliance. As to this burden of proof, the Court clarified that it should not be placed too high – it should be sufficient for the applicant to prove that a credit score was transmitted to an entity which around the same time took a decision which produced negative effects on the applicant. In such a situation, there is a presumption that the entity heavily relied on the credit score. The Federal Court further advised the appeal courts that, should they reach the conclusion that automated decisions were indeed involved, the information which SCHUFA provided to the applicants in response to their access requests in 2023 would not fulfil the requirements of Article 15(1)(h). Editorial note: the summary is based on the press release in German, as published on the court’s website.
https://www.bundesgerichtshof.de/SharedDocs/Pressemitteilungen/DE/2026/2026198.html?nn=373478
EDPB Releases New Opinions
Over the past couple of weeks, the EDPB published the following significant document:
- “Statement 1/2026 of the EDPB on smart glasses”.
https://www.edpb.europa.eu/documents/statement/statement-of-the-edpb-on-smart-glasses_en