A court that, at the request of another judicial body, authorises a bank to disclose data on the bank accounts of judges, public prosecutors and investigating magistrates, and of their family members, to that body is not a controller.

Under points 1 and 2 of Article 4 of Regulation 2016/679, disclosing the first name, surname, signature and contact details of a natural person representing a legal person is processing of personal data. It makes no difference that the disclosure is made solely to identify the natural person authorised to act on behalf of that legal person.

Article 4(7) does not preclude national legislation from designating, as controller, an auxiliary administrative entity with no legal personality or legal capacity of its own, even if the legislation does not precisely specify the processing operations for which it is responsible or their purpose - provided that, first, the entity can fulfil under that legislation a controller's obligations towards data subjects regarding personal data protection and, second, that legislation determines, explicitly or implicitly, the scope of the processing for which the entity is responsible.

The authority responsible for a Member State's commercial register that publishes, in that register, personal data contained in a company's constitutive instrument submitted with an application to register the company is both a 'recipient' of those data and - in so far as it makes them available to the public - a 'controller' of them within Article 4(7) and (9) of Regulation 2016/679, even where that instrument contains personal data not required by Directive 2017/1132 or by that Member State's law.

The handwritten signature of a natural person is 'personal data' within the meaning of Article 4(1) of Regulation 2016/679.

An opinion of a Member State supervisory authority issued under Article 58(3)(b) of Regulation 2016/679 does not by itself exempt from liability under Article 82(2) the authority responsible for maintaining that Member State's commercial register, where that authority is a 'controller' within the meaning of Article 4(7).

A former guardian who acted in a professional capacity for a person under guardianship is a 'controller' under Article 4(7) in relation to personal data about that person in the guardian's possession. Processing of those data must comply with all GDPR provisions, including Article 15.

A string such as the TC String, which records an internet or app user's preferences about consent to the processing of their personal data by website or application providers, data brokers and advertising platforms, is personal data if it can, by reasonable means, be linked to an identifier such as the IP address of the user's device and thereby identify the user. It remains personal data in those circumstances even if the sectoral organisation holding that string cannot, without external input, access the data processed by its members under its rules or combine the string with other factors.

A sectoral organisation is a joint controller where it offers its members a consent framework that it has established, containing binding technical rules and detailed rules on the storage and dissemination of personal data relating to that consent, and where, in the circumstances of the case, it influences the processing at issue for its own purposes and thereby determines, jointly with its members, the purposes and means of that processing. It can be a joint controller even if it does not itself have direct access to the personal data processed by its members under those rules. That joint controllership does not automatically extend to later processing by third parties, such as website or application providers, of users' preferences for targeted online advertising.

Orally disclosing information about possible ongoing or completed criminal proceedings concerning a natural person is processing of personal data within Article 4(2), where that information forms part of a filing system or is intended to form part of one. In that situation, the disclosure falls within the material scope of the GDPR.

An agency or body responsible for a Member State's official journal - required under national law to publish, as they stand, official acts and documents prepared by third parties under their own responsibility and sent to it by a judicial authority for publication - may be a controller of the personal data in those acts and documents, even without legal personality, where national law determines the purposes and means of that processing.

Unauthorised disclosure of personal data, or unauthorised access to those data by a 'third party' within the meaning of Article 4(10), is not enough by itself to show that the controller's technical and organisational measures were not 'appropriate' within the meaning of Articles 24 and 32.

A controller is not exempt from paying compensation under Article 82(1) and (2) of Regulation 2016/679 merely because the damage was caused by unauthorised disclosure of, or access to, personal data by a 'third party' within the meaning of Article 4(10); in that case, the controller must prove that it was in no way responsible for the event that caused the damage.

An entity that entrusted an undertaking with developing a mobile IT application and, in that context, helped determine the purposes and means of the personal-data processing carried out through that application may be a controller under Article 4(7), even if it did not itself process the data, did not expressly agree to specific processing operations or to the application being made available to the public, and did not acquire the application. That is not so if, before the application was made available to the public, the entity expressly objected to that making available and to the resulting processing of personal data.

Two entities may be joint controllers under Article 4(7) and Article 26(1) even without an arrangement between them on the purposes and means of the processing, and even without an arrangement laying down the terms of their joint control.

Using personal data to test a mobile application is "processing" under Article 4(2), unless the data have been made anonymous so that the data subject is not or is no longer identifiable, or the data are fictitious and do not relate to an existing natural person.

Article 61(1) of Regulation 2018/858, read with Article 61(4) and point 6.1 of Annex X to that regulation, imposes a 'legal obligation' under Article 6(1)(c) of Regulation 2016/679 on car manufacturers to make the VINs of the vehicles they manufacture available to independent operators acting as 'controllers' within Article 4(7) of Regulation 2016/679.

Checking, through a national mobile application, whether interoperable COVID-19 vaccination, test or recovery certificates issued under Regulation 2021/953 are valid, when a Member State uses those certificates for national purposes, is 'processing' of personal data within Article 4(2).

A dominant position in the market for online social networks does not by itself prevent users from validly consenting, within the meaning of Article 4(11) of Regulation 2016/679, under point (a) of the first subparagraph of Article 6(1) and Article 9(2)(a) of that regulation, to the operator's processing of their personal data. But dominance is an important factor in deciding whether that consent was in fact valid, in particular freely given, and the operator must prove that it was.

A subscriber's personal data may be included in publicly available telephone directories and directory enquiry services published by providers other than the subscriber's telephone operator only if that subscriber has given GDPR consent within the meaning of Article 4(11). That consent may be given either to the operator or to one of those providers.

It is for the data controller to show that the data subject gave consent to the processing of personal data by active behaviour and that, beforehand, the data subject received information about all the circumstances of that processing in an intelligible and easily accessible form, using clear and plain language, so that the consequences of consent could be easily understood and the consent was given with full knowledge of the facts. A telecommunications contract clause stating that the data subject was informed of, and consented to, the collection and storage of a copy of the identity document for identification purposes does not prove valid consent where the box for that clause was ticked by the controller before signature, or where the contract terms are capable of misleading the data subject into thinking the contract cannot be concluded without that consent, or where the controller unduly affects the freedom to refuse by requiring the data subject to fill out an additional form recording that refusal.

Consent to the storage of information, or access to information already stored, on a website user's device by cookies is not valid if it is given through a pre-checked box that the user must deselect to refuse consent.

The rules on consent to cookies do not differ according to whether the information stored or accessed on a website user's device is personal data.