VKI – Court Ruling (Austria, 2019)

The Austrian consumer organization ("Verein für Konsumenteninformation", VKI) has sued the provider of encrypted digital terristrial TV in Austria ("Simply TV") under the Austrian implementation of the Unfair Terms Directive 93/13/EEC (§ 6 Konsumentenschutzgesetz - KSchG) because it allegedly used 29 illegal clauses in its Terms of Service. Two clauses (18 and 19) concern data processing. The other parts of the judgment are irrelevant for the purpose of this page. = "The personal data provided by the subscriber as well as data on the type and frequency of his use of the services provided by Simply TV shall be collected, stored, used by Simply TV - insofar as this is necessary for the processing of subscriptions, for the provision of customer services as well as for the invoicing of remuneration - and transmitted to commissioned companies for the purposes of order data processing pursuant to § 11 Data Protection Act 2000." = "Simply TV may send electronic messages (in particular e-mail, SMS) to the subscriber for the purpose of informing him of offers from Simply TV in the pay-TV sector which are similar to the packages and/or channels already subscribed to by the subscriber. Simply TV will only transmit such messages if the subscriber has provided Simply TV with the relevant contact details (in particular e-mail address, telephone number) as part of the subscription. The subscriber may object to the transmission of such messages at any time in writing (post, fax, e-mail: infoservice@s*****.at). The subscriber will be informed of his right of revocation at each transmission of such messages." = VKI claimed that the clause is intransparent, as the controller does not inform about (1) the concrete companies data is shared with, (2) the the fact that the data subject can withdraw his consent at any time and because (3) the data subject may get the false impression that the clause would generally allow to use personal data as describted in the clause during the entired contractual relationship. The controller claimed that there is no duty to name each recipient and that the processing of data was necessary to fullfil thee contract and for the best possible customer service. = VKI claimed that this clause violates the implementation of Article 13(2) of ePrivacy Directive 2002/58/EG in § 107 of the Austrian Telecommunications Act (TKG), as it does not allow to opt-out from direct marketing communications. The controller claimed that the clause explicitly refers to the right to object. Both clauses were found to be invalid. = The Court joined the view of VKI that the limitation on processing that is necessary for certain purposes (if read in the grammatical meaning) is only limited to the controller, while there is no purpose limitation for sharing data with third parties. The clause would thereby allow to share any data for any purpose with any third party. This was frond to be unfair within the meaning of the Unfair Terms Directive 93/13/EEA. The court further held that the clause "for purposes of processing by the processor under § 11 Data Protection Act 2000" is ins transparent and not understandable to the average consumer. There was no need to reassess the issue under GDPR, as this clause was already unlawful under the Austrian implementation of Directive 95/46. = The Court joined the view of VKI and focused on the fact that objection to direct marketing messages under Article 13(2) of the ePrivacy Directive has to be possible "without any difficulty" ("problemlos"). In the case of text messages (SMS) a consumer has to switch to another form of communication, which is not "without any difficulty", especially when consumers are away from home. It agreed with the lower Courts that it is ins transparent that a possibility to object is not already presented at the time of signing the contract.