A website operator that embeds a social plugin which causes a visitor's browser to request content from the plugin provider and transmit the visitor's personal data to that provider can be a controller under Article 2(d) of Directive 95/46. Its responsibility is limited to the processing operations for which it actually determines the purposes and means - here, the collection of the data and its disclosure by transmission.

Where a website operator embeds a social plugin that causes a visitor's browser to request content from the plugin provider and transmit the visitor's personal data to that provider, any consent required under Articles 2(h) and 7(a) of Directive 95/46 must be obtained by the operator only for the processing operations for which it determines the purposes and means. In the same situation, the duty to inform under Article 10 of Directive 95/46 also falls on the operator, but only as regards the processing operations for which it actually determines the purposes and means.

A set of personal data collected in the course of door-to-door preaching, consisting of the names and addresses and other information concerning the persons contacted, is a "filing system" if the data are structured according to specific criteria that, in practice, enable them to be easily retrieved for subsequent use. It is not necessary that the set includes data sheets, specific lists or other search methods.

A religious community may be a controller, jointly with its members who engage in preaching, for personal-data processing carried out by those members in the context of door-to-door preaching organised, coordinated and encouraged by that community. That is so even if the community does not have access to the data and even if it has not given its members written guidelines or instructions on the processing.

The administrator of a fan page hosted on a social network is a 'controller' within the meaning of Article 2(d) of Directive 95/46.

In circumstances such as those at issue, a candidate's written answers in a professional examination and an examiner's comments on those answers are personal data.

As EU law currently stands, it is for the Member States to decide whether the natural persons referred to in Article 2(1)(d) and (j) of Directive 68/151 may ask the authority responsible for keeping the relevant central, commercial or companies register to decide, case by case, whether it is exceptionally justified, on compelling legitimate grounds relating to their particular situation, to limit, after a sufficiently long period following the dissolution of the company concerned, access by third parties to personal data about them entered in that register to third parties that can demonstrate a specific interest in consulting that data.

A dynamic IP address recorded by an online media services provider when someone accesses its publicly accessible website is personal data for that provider where the provider has legal means to identify the person by combining that IP address with additional data held by the internet service provider.

An administrative document prepared before a decision on a residence-permit application contains "personal data" under Article 2(a) of Directive 95/46 to the extent it contains data about the applicant, including data appearing in the legal analysis in that document. The legal analysis itself is not "personal data".

A residence-permit applicant has a right of access to all personal data concerning him that are processed by national administrative authorities within the meaning of Article 2(b) of Directive 95/46. That right is satisfied if the applicant receives a full summary of those data in an intelligible form, i.e. a form that lets him know the data and check that they are accurate and processed in compliance with the directive so that he can exercise the rights it gives him.

A search engine processes personal data when it finds information containing personal data that third parties have published online, indexes it automatically, stores it temporarily, and makes it available to users in an order of preference. The search engine operator is the controller for that processing.

A working-time record that shows, for each worker, when working hours begin and end and the related breaks and intervals is "personal data" under Article 2(a) of Directive 95/46.