{"id":87980,"date":"2026-11-05T10:57:25","date_gmt":"2026-11-05T09:57:25","guid":{"rendered":"https:\/\/www.lexxion.eu\/?post_type=dpi&#038;p=87980"},"modified":"2026-11-05T10:57:25","modified_gmt":"2026-11-05T09:57:25","slug":"data-protection-insider-issue-162","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-162\/","title":{"rendered":"Data Protection Insider, Issue 162"},"content":{"rendered":"<p><b><i>Table of Contents:<\/i><\/b><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"20\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><a href=\"#ECtHR Rules on the Legitimacy of Surveillance of Prison Visiting Rooms\">ECtHR Rules on the Legitimacy of Surveillance of Prison Visiting Rooms\u00a0<\/a><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"20\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><a href=\"#CJEU Refuses to Rule on Data Protection Complaints on the Basis of Inadequately Specified Claims\">CJEU Refuses to Rule on Data Protection Complaints on the Basis of Inadequately Specified Claims\u00a0<\/a><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"20\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><a href=\"#AG Medina: Automatically Excluding Payment Options Must Comply with Article 22 GDPR\">AG Medina: Automatically Excluding Payment Options Must Comply with Article 22 GDPR\u00a0<\/a><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"20\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><a href=\"#German Federal Court of Justice Rules on Right of Access\">German Federal Court of Justice Rules on Right of Access\u00a0\u00a0<\/a><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"20\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"5\" data-aria-level=\"1\"><a href=\"#EDPB Releases New Opinions\">EDPB Releases New Opinions\u00a0<\/a><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">In the present edition, we inform our readers of: one ECtHR judgment on the surveillance of prison visiting rooms; one CJEU judgment regarding data processing in employment; one AG Opinion on assessing the necessity of resorting to automated decision-making when excluding certain payment options online; one German Federal Court of Justice judgment on the right of access to one\u2019s data as processed by credit scoring companies; and one new EDPB document.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:0,&quot;335559740&quot;:240}\">\u00a0<\/span><\/p>\n<h2 id=\"ECtHR Rules on the Legitimacy of Surveillance of Prison Visiting Rooms\">ECtHR Rules on the Legitimacy of Surveillance of Prison Visiting Rooms<\/h2>\n<p><span data-contrast=\"auto\">On 13<\/span><span data-contrast=\"auto\">th<\/span><span data-contrast=\"auto\"> October, the ECtHR ruled in the case of <\/span><i><span data-contrast=\"auto\">Cengiz v. T\u00fcrkiye. <\/span><\/i><span data-contrast=\"auto\">In terms of the facts, the case essentially concerned \u201cthe monitoring and recording of conversations between the applicant and his family members in the prison visiting room after the entry into force, on 10 August 2021, of section 83(4) of Law no. 5275, which provides for the monitoring and recording of visiting-room conversations involving prisoners convicted of terrorist offences or organised crime and those considered dangerous\u201d. Whilst the applicant complained of these measures before prison authorities and before the national courts, these complaints were unsuccessful. Accordingly, the applicant brought the case before the ECtHR, complaining that \u201cthe monitoring and recording of his conversations with family members in the prison visiting room constitutes an infringement of his right to respect for his private and family life and of his right to confidential communication under Article 8 of the Convention\u201d.<\/span> <span data-contrast=\"auto\">The Court found an infringement. The Court recognised that the surveillance of prisoners\u2019 interactions with family members in the prison visiting room \u2013 also covert \u2013 constitutes an infringement of Article 8. The Court then moved to consider whether the measures were in accordance with the law, and, in light of the applicable legal framework, considered there to be no issue with this criterion. Finally, however, the Court considered whether the interference was necessary in a democratic society. In this regard, the Court essentially considered that, at each level of national consideration of the measures in question \u2013 from the prison authorities, through each of the national courts \u2013 there had been a lack of specific consideration of the applicant\u2019s circumstances, and that such individual consideration is necessary in a democratic society. <\/span><i><span data-contrast=\"auto\">Editorial note: the summary is based on the press release in English, and an electronic translation of French judgment, as, at the time of writing, there was no version of the case available in a language in which the editors are fluent. In this regard, we cannot guarantee the accuracy of the source material or, in consequence, of this summary. Accordingly, all interested in the case should consult original versions themselves.\u00a0<\/span><\/i><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/hudoc.echr.coe.int\/#{%22itemid%22:[%22001-252741%22]}\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"none\">https:\/\/hudoc.echr.coe.int\/#{%22itemid%22:[%22001-252741%22]}<\/span><\/a><span data-contrast=\"auto\">; <\/span><a href=\"https:\/\/hudoc.echr.coe.int\/eng-press#{%22fulltext%22:[%2225406\/22%22]}\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"none\">https:\/\/hudoc.echr.coe.int\/eng-press#{%22fulltext%22:[%2225406\/22%22]}<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h2 id=\"CJEU Refuses to Rule on Data Protection Complaints on the Basis of Inadequately Specified Claims\">CJEU Refuses to Rule on Data Protection Complaints on the Basis of Inadequately Specified Claims<\/h2>\n<p><span data-contrast=\"auto\">On 21<\/span><span data-contrast=\"auto\">st<\/span><span data-contrast=\"auto\"> October, the CJEU ruled in the case of <\/span><i><span data-contrast=\"auto\">FC v European Investment Fund (EIF).<\/span><\/i> <span data-contrast=\"auto\">In terms of the facts, the case essentially concerns a job application. The applicant had many years work experience \u2013 including 9 in journalism and many more as an entrepreneur \u2013 in relation to which the EIF had an open position. The applicant\u2019s application for this position, however, was rejected. The applicant requested \u201cdetailed explanations regarding the rejection of her application\u201d and referred the issue to \u201cthe EIF Data Protection Officer, informing him of her request for access to information concerning the processing of her personal data. In particular, she asked for his support in this process, explaining that was \u2018determined to find out and understand in detail the logic behind the profiling of\u2026personal data and how this profiling\u201d led \u201cto a decision that affects\u201d her \u201cto understand if\u2026rights and freedoms have been fully respected\u201d. In response, the EIF communicated to the applicant that the \u201capplication was not taken forward due to\u201d the relevant \u201cprofessional experience being in excess of what was required in the job advertisement. The job advertisement required that candidates should have: \u201cBetween three (3) and five (5) years of post-graduation\u201d\u201d. In relation to these facts, the applicant requested that the Court should: \u201cannul the contested decision\u2026order the EIF to pay her a minimum amount of EUR 10 000 in compensation for non-material damage\u201d and \u201corder the EIF to pay her compensation for loss of opportunity\u201d. The case thus only tangentially concerned the processing of personal data \u2013 in substance, the case primarily concerned two pleas, \u201cthe first alleging that the vacancy notice\u201d was unlawful \u201cin so far as it established an unlawful eligibility criterion, and the second alleging unlawful application of that criterion\u201d. In this respect, the Court considered issues related to personal data processing in relation to the applicant\u2019s suggestion that the \u201cEIF\u2026incurred non-contractual liability\u201d, specifically in relation to the applicant\u2019s allegations of \u201cinfringements of the EIF\u2019s obligations in relation to the processing of personal data\u201d. In this regard, the applicant complained that \u201cthe EIF data protection officer did not\u2026\u2018comment anything regarding the lack of clear and easily accessible information on the Applicant\u2019s right to access her personal data (results of her profiling) and did\u201d not \u201cprovide her with any information regarding her options to contest the disputed decision\u2019\u201d. Unfortunately, despite a number of interesting issues being raised by the case, the Court eventually decided not to consider the issue in substance at all, and rejected the applicant\u2019s claims. The Court merely stated that \u201calthough the applicant relies on several data processing regulations, she never specifies which provisions of those regulations were allegedly infringed. In those circumstances, she cannot be considered to have identified in a sufficiently precise manner the breaches committed by the EIF in the processing of her personal data. Since the claims regarding those alleged breaches are not accompanied by sufficient details to enable their merits to be assessed, they cannot be accepted\u201d.\u00a0<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/infocuria.curia.europa.eu\/tabs\/jurisprudence?lang=EN&amp;searchTerm=T%252D471%252F24&amp;publishedId=T-471%2F24&amp;logicDocId=id_328400\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"none\">https:\/\/infocuria.curia.europa.eu\/tabs\/jurisprudence?lang=EN&amp;searchTerm=T%252D471%252F24&amp;publishedId=T-471%2F24&amp;logicDocId=id_328400<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h2 id=\"AG Medina: Automatically Excluding Payment Options Must Comply with Article 22 GDPR\">AG Medina: Automatically Excluding Payment Options Must Comply with Article 22 GDPR<\/h2>\n<p><span data-contrast=\"auto\">On 15<\/span><span data-contrast=\"auto\">th<\/span><span data-contrast=\"auto\"> October, AG Medina advised the Court on the interpretation and application of Article 22 GDPR (on automated decision-making and profiling) in relation to automatically excluding payment options online in <\/span><i><span data-contrast=\"auto\">Verein f\u00fcr Konsumenteninformation v. Universal Versand GmbH<\/span><\/i><span data-contrast=\"auto\">. As to the facts of the case, the applicant in the main proceedings, a consumer protection NGO in Austria (hereinafter VKI) complained that an online commerce service (hereinafter Universal Versand) would automatically exclude the instalment payment option and the option to pay via a bill for clients they classified as untrustworthy. VKI argued that such individual decisions are taken automatically and in breach of Article 22. As the dispute escalated to the CJEU, AG Medina was called to advise the Court on whether this practice is indeed a result of an automated decision-making in the sense of Article 22(1) and if so, whether it complies with the legality requirements in Article 22(2)(a). As to the question on whether individuals can benefit from the prohibition in Article 22(1) from being subject to automated decisions when such decisions consist in the exclusion of certain payment options, AG Medina pointed out that three conditions have to be fulfilled: (1) there must be a \u201cdecision\u201d, which is taken (2) \u201csolely on automated processing, including profiling\u201d and which (3) \u201cproduces legal effects concerning him or her or similarly significantly affects him or her\u201d. She noted that the referring court has doubts whether the third condition is fulfilled. She opined that where the exclusion of certain payment options, based on an automated assessment of an individual\u2019s creditworthiness, could prevent that individual from purchasing an item online (entering a contractual relationship with the commercial entity), then this would fulfil the requirement of producing \u201clegal effects concerning him or her or similarly significantly\u201d affecting him or her. Then, AG Medina moved on to analyse the conditions which such a decision needs to fulfil in order to comply with Article 22(2)(a), namely assessing whether it \u201cis necessary for entering into, or performance of, a contract between the data subject and a data controller\u201d. She first examined whether such an automated creditworthiness assessment was necessary for the fulfilment of a contract and advised the Court to leave this question to the referring court by providing guidance on how to assess necessity. One point she specifically focused on is proving the necessity (objective appropriateness) of the collected personal data for the assessment of the creditworthiness and further noted that the burden of proof should lie with the online commerce entity. Finally, and further on the necessity requirement, AG Medina was of the opinion that for resorting to automated decisions as in the present case, there should be no alternative option to achieve the pursued objective. When considering the appropriateness of alternative options, AG Medina suggested that the controller may take into account factors such as time-saving for customers and cost-saving for the online commercial entity.<\/span><i><span data-contrast=\"auto\"> Editorial note: the summary is based on the German version of the Opinion, as no English translation was available at the time of writing.\u00a0<\/span><\/i><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/infocuria.curia.europa.eu\/tabs\/document\/C\/2025\/C-0568-25-00000000RP-01-P-01\/CONCL\/328160-DE-1-html\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"none\">https:\/\/infocuria.curia.europa.eu\/tabs\/document\/C\/2025\/C-0568-25-00000000RP-01-P-01\/CONCL\/328160-DE-1-html<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h2 id=\"German Federal Court of Justice Rules on Right of Access\">German Federal Court of Justice Rules on Right of Access<\/h2>\n<p><span data-contrast=\"auto\">On 21 October, the German Federal Court of Justice ruled on the right of access to one\u2019s personal data under Article 15(1)(h) GDPR when this data is used for producing a creditworthiness score<\/span><span data-contrast=\"auto\">. As to the facts of the case, the applicants are private persons who submitted access requests to their data in 2023 with SCHUFA \u2013 a credit scoring company in Germany &#8211; on the basis of Article 15. SCHUFA did provide them access to certain information, but the applicants were dissatisfied, arguing mainly that they did not understand how SCHUFA calculated their score. They submitted complaints with different lower courts in Germany, which rejected the applicants&#8217; complaints. The appeal courts admitted partially the appeals, especially as concerns the argument that an automated decision took place and that SCHUFA should provide more detailed information on how the scores were calculated. With its judgment, the Federal Court sent the cases back to the appeal courts and provided them with guidance as to how to revise the judgments. First, the Federal Court established that the appeal courts should actually examine whether the contested scoring constitutes an automated decision which produces significant effects on the applicants. This would be the case, according to the Court, where the recipients of the score \u2013 e.g. a bank \u2013 would rely on that score in order to take a decision in relation to the applicant \u2013 e.g. deny them a loan. The Court further ruled that it should be for the applicants to prove this reliance. As to this burden of proof, the Court clarified that it should not be placed too high \u2013 it should be sufficient for the applicant to prove that a credit score was transmitted to an entity which around the same time took a decision which produced negative effects on the applicant. In such a situation, there is a presumption that the entity heavily relied on the credit score. The Federal Court further advised the appeal courts that, should they reach the conclusion that automated decisions were indeed involved, the information which SCHUFA provided to the applicants in response to their access requests in 2023 would not fulfil the requirements of Article 15(1)(h). <\/span><i><span data-contrast=\"auto\">Editorial note: the summary is based on the press release in German, as published on the court\u2019s website.<\/span><\/i><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/www.bundesgerichtshof.de\/SharedDocs\/Pressemitteilungen\/DE\/2026\/2026198.html?nn=373478\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"none\">https:\/\/www.bundesgerichtshof.de\/SharedDocs\/Pressemitteilungen\/DE\/2026\/2026198.html?nn=373478<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h2 id=\"EDPB Releases New Opinions\">EDPB Releases New Opinions<\/h2>\n<p><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;335559685&quot;:360}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Over the past couple of weeks, the EDPB published the following significant document:\u00a0\u00a0<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"34\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">\u201cStatement 1\/2026 of the EDPB on smart glasses\u201d.<\/span><span data-ccp-props=\"{&quot;134233279&quot;:true}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{&quot;134233279&quot;:true,&quot;335559685&quot;:720}\">\u00a0<\/span><\/p>\n<p><a href=\"https:\/\/www.edpb.europa.eu\/documents\/statement\/statement-of-the-edpb-on-smart-glasses_en\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"none\">https:\/\/www.edpb.europa.eu\/documents\/statement\/statement-of-the-edpb-on-smart-glasses_en<\/span><\/a><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Table of Contents: ECtHR Rules on the Legitimacy of Surveillance of Prison Visiting Rooms\u00a0 CJEU [&hellip;]<\/p>\n","protected":false},"author":144,"featured_media":87979,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","dpi-category":[],"dpi-tag":[4391,4393,4194,4390,4269,4394,4388,4392,4395,4389],"class_list":["post-87980","dpi","type-dpi","status-publish","has-post-thumbnail","hentry","dpi-tag-automated-decision-making","dpi-tag-credit-scoring","dpi-tag-edpb","dpi-tag-employment","dpi-tag-eu-institutions","dpi-tag-online-payments","dpi-tag-prisoners","dpi-tag-profiling","dpi-tag-right-of-access-to-ones-data","dpi-tag-surveillance"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/87980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi"}],"about":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/types\/dpi"}],"author":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/users\/144"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/comments?post=87980"}],"version-history":[{"count":1,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/87980\/revisions"}],"predecessor-version":[{"id":87982,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi\/87980\/revisions\/87982"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media\/87979"}],"wp:attachment":[{"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/media?parent=87980"}],"wp:term":[{"taxonomy":"dpi-category","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-category?post=87980"},{"taxonomy":"dpi-tag","embeddable":true,"href":"https:\/\/www.lexxion.eu\/en\/wp-json\/wp\/v2\/dpi-tag?post=87980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}