Österreichische Post AG – Court Ruling (Austria, 2023)

The controller was a logistics and postal service provider also active in the fields of direct marketing and address publication. The data subject requested the controller to provide access to personal data concerning them pursuant to Article 15 GDPR. Deeming the controller’s reply insufficient, the data subject went to court to enforce their right to access. The data subject asked a full disclosure of which data were effectively shared and with whom, as the controller’s reply did not comply with the principles of accuracy and comprehensibility under Article 12(1) GDPR. During the civil proceeding it became clear that the controller processed and shared with third-parties data concerning the data subject’s marketing profile and potential political affinities with third-parties. However, the controller did not disclose the identity of specific recipients in the access request, but only their broad categories (e.g. advertising companies, IT-companies, NGOs). The controller denied that statistical data about data subjects’ political and philosophical affinities (the so-called marketing profiles) were personal data covered by the GDPR. The controller also replied that it could not disclose recipients’ identity because of several reasons, such as business confidentiality and a disproportionate effort on its side, as it did not keep a record of all the disclosure operations. Also, the controller argued that there is no obligation to disclose the identity of specific recipients under the GDPR, but only the categories of recipients. The first instance court upheld the controller’s defense. The court of appeal confirmed this judgement, stating that the GDPR gives the controller a free choice whether to share specific recipients or broad categories of recipients. As the controller disclosed such categories during the first instance proceeding, Article 15 GDPR was not violated. The Austrian Supreme Court sent a preliminary reference to the CJEU, which decided the case with j