- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DSB (Austria) – Court Ruling (Austria, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that a kindergarten shared personal information about children without proper consent from their guardians. This ruling matters because it emphasizes the need for clear consent when sharing personal data. Small businesses should ensure they have permission before disclosing any personal information.
What happened
A private kindergarten shared a list of children's names and details with the municipality without obtaining consent from their guardians.
Who was affected
The minors attending the kindergarten and their legal guardians were affected by the unauthorized sharing of their information.
What the authority found
The court decided that the kindergarten did not have the right to share the children's information with the municipality without consent from their guardians.
Why this matters
This ruling reinforces the importance of obtaining consent before sharing personal data. It serves as a warning for organizations to be diligent about privacy regulations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 21 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The two data subjects of this case are minors. They are visiting a private kindergarten. The private kindergarten gave – with the consent of the legal guardians of the data subjects – a list to the municipality of its seat (the controller) which consisted of the name, date of birth and date of admission of all kids attending the kindergarten. Because the municipality did not want to bear the costs for children having their residence in another municipality, it sent a letter to all parents requesting them to take the letter to the municipality of their residence and ask for their financial support. This letter consisted of the already mentioned list as well as another list which additionally contained the days of absence, overall days and the calculated share of costs of each child. The controller did not ask the legal guardians of the data subjects for their consent before sending the letter out to all parents. The data subjects – represented by their legal guardians – filed a complaint with the DPA. The DPA sustained the complaint. The Federal Administrative Court (Bundesverwatungsgericht – BVwG) upheld the decision of the DSB. The court concluded that the head of the kindergarten was a third party according to Article 4(10) GDPR with respect to the sending of the letters. The consent given to the head of the kindergarten did not extend to the municipality and did not encompass the disclosure of the data to the other legal guardians.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (2)
Other cases involving DSB (Austria) in AT
Court Ruling
Details
About this data
Cite as: Cookie Fines. DSB (Austria) - Austria (2021). Retrieved from cookiefines.eu
Last updated: