LDE-Resources

The Official Course Script

This is the official open-book script for ‚European Data Law‘, authored by Prof. Dr. Thomas Hoeren. Provided as a free PDF download, it is the essential resource for following the course and preparing for the exam.

FREE Download

Also Available: The German Print Edition

For in-depth study and for your personal library, a comprehensive German print version of the script is available for purchase. It’s the perfect companion for German-speaking students and legal practitioners who prefer a physical copy for annotation and reference.

Purchase Your Copy

Exclusive Benefit for Course Participants

As a participant in the certificate course, you receive exclusive access to our comprehensive weekly lecture slides.

Released 1-2 weeks before each lecture, these presentations are always up-to-date, featuring discussions on the very latest real-world cases and legal developments. They serve as a valuable companion to the main script and build into a comprehensive reference work for your continued practice.

Please note: These materials are an exclusive resource, available only to enrolled participants of this certificate course.

Apply now!

Deepen Your Understanding: our Videos & Podcasts

Our Videos and Podcast - Learn at your own speed

Law of the digital Economy on Youtube
ITM Exclusive Podcasts

Re-Watch the Course

Our course offers flexible viewing options to fit your schedule. Engage directly with lecturers and participants in our interactive Zoom sessions, or watch the live broadcast on YouTube. For maximum flexibility, every lecture is archived as a Video on Demand (VoD), allowing you to review the material anytime, anywhere.

LDE 1: Winter Term

LDE 1: Summer Term

The LDE Podcast: Learn on the Go

Prefer to listen? All our lectures are also available as an audio-only podcast on Spotify. It’s the perfect way to study during your commute, at the gym, or wherever you are. Simply click below and follow us.

LDE Season 1: Winter Term

LDE Season 2: Winter Term

Other ITM Podcasts

Key Legal Sources and further Reading

Landmark Rulings

Law is shaped by its application in court. Here you will find a curated collection of landmark rulings from the European Court of Justice (ECJ) and other key courts. Each entry includes a brief summary of the case’s significance, helping you to bridge the gap between legal theory and real-world practice.

European Rulings (chronological order, newest to oldest)

ECJ, 04.10.2024, C‑446/21 – Schrems III
This judgment reinforces strict boundaries on how personal and sensitive data may be used under EU law. Social media platforms like Facebook cannot process all types of personal data, including data obtained outside the platform, without limits, for the purpose of targeted advertising. The GDPR principle of data minimization prohibits the unlimited and indiscriminate use of personal data without differentiation according to its type for targeted advertising. Even if a user publicly discloses their sexual orientation, the platform can not process additional sensitive data on that topic gathered from third-party sources.
ECJ, 27.03.2024, C-639/23 – Amazon DSA
This ruling is a recent example of what it means to be classified as a VLOP under the DSA, i.e. to be more closely regulated as a company. By decision of May 23, 2023, Amazon was designated a VLOP. As a result, Amazon was also obliged to make an ad archive publicly available at. Amazon took action against this obligation and filed a lawsuit at concerning the disclosure of confidential information. The ECJ dismissed this action in its ruling of March 27, 2024.
ECJ, 07.03.2024, C-604/22 – IAB Europe
This judgment addresses the IAB’s Transparency and Consent Framework (TCF), a widely used standard in online advertising. The ECJ ruled that the TC String, a digital signal containing user consent preferences, is personal data under the GDPR. Furthermore, it held that a standard-setting industry body like IAB Europe can be considered a „joint controller“ for the processing of this data, as it influences the data processing operations of its members, even without having direct access to the data itself.
ECJ, 07.03.2024, C-479/22 P – OC v Commission (OLAF)
This case further refines the concept of an „identifiable“ person under the GDPR. The ECJ overturned the General Court’s test of what an „average reader“ could identify and reaffirmed the „relative“ approach. Data is personal if the controller or „any other person“ has „means reasonably likely to be used“ to identify the individual. The assessment must consider objective factors like the cost and time required for identification. The combination of several pieces of non-sensitive information (e.g., gender, nationality, project details) in a press release was deemed sufficient to make a person identifiable without disproportionate effort.
ECJ, 09.11.2023, C-319/22 – VIN Number as Personal Data
This ruling clarifies that a Vehicle Identification Number (VIN) constitutes personal data for any party, such as an independent auto parts dealer, that has reasonable means to link the VIN to an identifiable person (e.g., the vehicle owner). A party sending VINs without those means to a party with them, they are still obligated to adhere to the GDPR.
ECJ, 12.10.2023, C-645/22 – R.A. et al. v. Luminor Bank
This judgment strengthens the protection of consumers against unfair terms without automatically giving preference to contractual nullity. Regarding the consequences of unfair terms in consumer loan agreements, the court clarifies that, even if a consumer requests the amendment rather than the annulment of such a term, national courts must examine whether the annulment of the entire contract would have particularly adverse consequences for the consumer. An amendment to the contract to maintain the balance is only permitted if the nullity of the contract would have significant disadvantages for the consumer and there are no dispositive legal provisions as a substitute
ECJ, 04.07.2023, C-252/21 – Meta Platforms
This ruling clarifies the relationship between competition law and data protection. The ECJ confirmed that a national competition authority can find a GDPR violation when establishing an abuse of a dominant market position. However, the authority must cooperate with the competent data protection authorities. The court also provided a strict interpretation of the legal bases for data processing under the GDPR, stating that processing is only „necessary for the performance of a contract“ if it is objectively indispensable, and that a company’s legitimate interest in personalized advertising does not, in principle, override the user’s fundamental rights.
ECJ, 04.05.2023, C-487/21 – CRIF (Novak)
This case concerns the scope of the right of access under Article 15 GDPR, specifically what constitutes a „copy“ of personal data. The ECJ ruled that the term „copy“ implies that the data subject must be given a faithful and intelligible reproduction of all their data. This includes providing extracts from documents or even entire documents or database extracts if this is essential to enable the data subject to effectively exercise their rights under the GDPR.
GC, 26.04.2023, T-557/20 – SRB v EDPS
This judgment affirmed the „relative“ approach to defining personal data. The court ruled that when pseudonymized data is disclosed to a recipient, it does not qualify as personal data for that recipient if they do not have the legal means to re-identify the data subject. The key is the perspective of the data recipient. This decision has significant implications for data sharing, suggesting that transferring pseudonymized data to a party unable to re-identify individuals might not be considered a disclosure of personal data under the GDPR. (Note: This case is currently under appeal before the ECJ as C-413/23 P).
ECJ, 22.06.2021, C-682/18, C-683/18 – YouTube and Cyando
This judgment clarifies that operators of platforms such as YouTube do not commit a “communication to the public” and are therefore not directly liable under copyright law as long as they merely host content neutrally, have no specific knowledge of illegal content and delete or block it immediately after being notified. If the platform leaves its neutral role – for example by highlighting infringing uploads or a business model that promotes them – it may lose its liability of Art. 14 E-Commerce Directive.
ECJ, 03.12.2020, case C-62/19 – Star Taxi App
This judgment contains statements by the ECJ on the question of what constitutes an information society service as it is defined in the directive on electronic commerce, 2000/31/EG. In the underlying case, the classification of a cab app that did not offer pricing, payment processing or quality control was in question – however the CJEU concluded that the directive may apply to a product even with these few specifications. The implications of the ruling may be important when it comes to the question of how a product can be classified in data law.
ECJ, 11.11.2020, C-61/19 – Orange Romania
This judgment deals with the applicability of the requirements for consent within the meaning of the GDPR. Accordingly, the interpretation of the requirements for consent, as set out in the GDPR, must also be linked to consent in other data protection acts. In this respect, the GDPR should, according to the ECJ, also have an impact on other EU legal acts and not be viewed in isolation.
ECJ, 16.07.2020, C-311/18 – Schrems II
This judgment invalidated the Privacy Shield, the successor to Safe Harbor, reaffirming that US surveillance law is fundamentally incompatible with EU data protection standards. More importantly, while upholding Standard Contractual Clauses (SCCs) in principle, it shifted a massive compliance burden onto companies by requiring them to verify, on a case-by-case basis, that the recipient country’s laws provide adequate protection, effectively making every data exporter a mini-regulator.
ECJ, 01.10.2019, C-673/17 – Planet49
This ruling clarified the requirements for valid consent for the use of cookies under EU data protection law. The ECJ held that consent given through a pre-ticked checkbox is not valid, as it does not constitute a clear, affirmative act. The judgment established that an active opt-in from the user is required. Furthermore, website operators must provide users with clear information about the duration of the cookies and whether third parties will have access to them.
ECJ, 13.09.2018, case – C-54/17, C-55/17 – Wind Tre.
In this decision, the ECJ made some fundamental statements on the application of EU law in conflict of laws cases, which may also be relevant for data law cases, for example when it comes to a conflict between the GDPR and another legal act. As explained in para. 60, a conflict only exists if there is a relationship between the provisions in question that goes beyond a mere divergence or a simple difference and shows a divergence that cannot possibly be overcome by a formula aimed at reconciliation, which allows the coexistence of two facts without having to distort them.
ECJ, 19.10.2016, C-582/14 – Breyer
This ruling clarified that dynamic IP addresses can be personal data. It established the „relative“ approach to identifiability: data is personal if the controller has a legal means to identify the individual, even if this requires information from a third party (like an ISP). This broadened the scope of data protection law and harmonized the interpretation of „personal data“ across the EU.
ECJ, 05.10.2015, C-362/14 – Schrems I
This ruling invalidated the EU-US Safe Harbor framework, the primary legal basis for thousands of companies transferring personal data to the US. It established that mass surveillance practices by a third country are incompatible with the EU’s standard of „essentially equivalent“ protection and empowered national data protection authorities to scrutinize international data flows independently of the European Commission.
ECJ, 01.10.2015, case C-230/14, para. 31 – Weltimmo.
In this ruling, the ECJ established fundamental standards for determining when both providers and users are established in the EU. The requirements for this are low; an establishment is assumed for any real and effective activity carried out by means of a fixed arrangement, even if it is only minor. Although the judgment was issued even before the GDPR came into force in 2016, the judgment is still relevant today when assessing the territorial applicability of other legal acts in data law
ECJ, 16.07.2015, C-170/13 – Huawei v ZTE
This landmark judgment establishes the conditions under which the holder of a Standard-Essential Patent (SEP) can seek an injunction against an alleged infringer without abusing its dominant position under Art. 102 TFEU. The court outlined a specific set of procedural steps (often called the „FRAND-dance“), requiring the SEP holder to first alert the alleged infringer of the infringement and then make a specific, written license offer on Fair, Reasonable, and Non-Discriminatory (FRAND) terms. The alleged infringer must then respond diligently and in good faith. This framework balances the rights of patent holders with the need to prevent anticompetitive behavior.
ECJ, 11.09.2014, case C-291/13, para. 28 et seq. – Papasavvas
This ruling has established the prevailing opinion today that a service on the Internet is paid for even if it is only in some sense commercially oriented. As it is today widely seen, it is not absolutely necessary for a user to pay a direct fee as in money; remuneration in a legal sense thus can also be achieved via data transfer. This decision, which has already been confirmed in this or a similar form by the ECJ on several occasions (see CJEU, 15 Sep. 2016, case C-484/14para. 41 – McFadden/Sony; CJEU, 4 May 2017, case C-339/15, para. 36 – Vanderborght), has far-reaching significance for the applicability of many legal acts of data law that require a commercial service for its applicability
ECJ, 13.05.2014, C-131/12 – Google Spain
This landmark ECJ judgment established the „right to be forgotten“ (now codified in Art. 17 GDPR), fundamentally reshaping the responsibilities of online intermediaries. It confirmed that search engine operators are data controllers, established the extraterritorial reach of EU data protection law, and created a powerful right for individuals to control their digital footprint by requesting the removal of links from search results.
ECJ, 12.07.2011, C-324/09 – L’Oréal
The judgment establishes the conditions under which online marketplaces such as eBay can be held liable for trademark infringements committed by their users. Plattform operators are liable if they play an active role in the advertising or processing of trademark-infringing offers. In addition, trademark owners can claim injunctive relief against such platforms if their services are systematically used to infringe trademark rights. The ruling strengthens the protection of intellectual property in digital commerce.
ECJ, 23.03.2010, C-236/08 to C-238/08 — Google France.
In this judgment, the ECJ deals with the legal classification of intermediaries and online search engines. The ECJ indicates a tendency to classify intermediary services such as browsers as host providers – which has far-reaching consequences in practice. This is not least because the DSA has raised a number of rules that require a clear-cut classification of these services.
CJEU, 09.11.2004, C-203/02 – The British Horseracing Board Ltd & Ots v. William Hill Organization Ltd.
This ruling fundamentally shaped the interpretation of sui generis database law under the EU Database Directive and the scope of the application of data protection law to databases.The ECJ clarified that the protection does not concern the generation, but only protects investments in the collection, verification or presentation of existing data. As the British Horseracing Board had generated the data itself, it did not enjoy protection under sui generis law.

National Rulings

OLG Cologne, 23.05.2025, 15 UKl 2/25 – Meta AI Use
This judgment on Meta’s planned use of publicly shared user data from Facebook and Instagram to train artificial intelligence systems establishes that an unlawful “combining” of personal data under the DMA requires the purposeful connection of data from the same individual. Integration of data from both platforms therefore does not constitute an unlawful “combining” of personal data. Furthermore, provided that sufficient safeguards such as de-identification and the right to object are in place, data processing for artificial intelligence training is justified under Article 6(1)(f) GDPR on the basis of legitimate interests.
BGH, 14.05.2013, VI ZR 269/12 – Google Autocomplete
This BGH ruling is a key German precedent for algorithmic liability. It established that the operator of a search engine can be held liable for defamatory suggestions generated by its algorithm, attributing the output to the operator. However, it applied a „notice-and-takedown“ liability model, rejecting a duty for proactive monitoring, which has shaped the debate on platform liability in Germany.
BVerfG, 15.12.1983, 1 BvR 209/83 u.a. – Volkszählungsurteil (Census Judgment)
This seminal ruling of the German Federal Constitutional Court is the birthplace of modern data protection law in Germany. It established the „right to informational self-determination“ as a fundamental constitutional right, providing the doctrinal foundation for all subsequent data protection legislation and jurisprudence. It defined the core principle that individuals must be able to control the disclosure and use of their personal data.

Academic Deep Dive

For those who wish to explore specific topics in greater detail, this section offers a curated list of academic articles, essays, and book chapters. These resources, including publications by our own lecturers, provide diverse perspectives and in-depth analysis beyond the core curriculum.