unknown (claimant) – Court Ruling (Austria, 2021)

The defendant conducts (i.a.) business as an address publisher under § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) and sells personal data for third-party marketing purposes. Starting in 2017, the defendant had created information on the presumed "affinities for political parties" of the entire Austrian population. This was done by gathering and combining information from anonymized polls and statistics on election results via an algorithm. As a result, individuals were assigned to one or more marketing groups and classifications regarding political affinity depending on their place of residence, age, gender, etc. The defendant had (i.a.) assessed that the claimant was likely to be interested in the far-right Austrian Freedom Party (FPÖ). After the claimant had learned this (following an access request under Article 15 GDPR), he filed a lawsuit against the defendant. He requested (i) an injunction that the defendant had to refrain from processing data on his presumed political opinions and (ii) € 1,000 in damages since he considered the alleged affinity to the FPÖ an insult, shameful and highly damaging to credit. The defendant had not disclosed the claimant's data to third parties. By 04.06.2019, the defendant had erased all data on "affinities for political parties", including those of the claimant. Throughout all court instances, the defendant argued that data on the "affinity for a political party" do not qualify as personal data, let alone special categories of personal data. The first-instance court (Landesgerichts für Zivilrechtssachen Wien) upheld the request for an injunction but rejected the request for damages, stating that the threshold for compensable immaterial damage had not been reached. The second-instance court (Oberlandesgericht Wien) confirmed this judgment. Both claimant and defendant appealed against this decision: the claimant appealed against the rejection of his request for damages, the defendant against the injunction to refrain from processing the claimant's data. # Do data on the "affinity for a political party" qualify constitute personal data under Article 4(1) GDPR? # If so, do they qualify as special categories of personal data under Article 9 GDPR? # Is the defendant obliged to refrain from processing the claimant's data on the (presumed) affinity for a political party in the future? # Is the claimant entitled to damages under Article 82 GDPR? Regarding the the claimant's entitlement to damages under Article 82 GDPR, the Austrian Supreme Court (Oberster Gerichtshof - OGH) requested a preliminary ruling from the CJEU under Article 267 TFEU. See here for further details. The OGH consequently only decided on the disputes described in points 1, 2 and 3. The OGH confirmed the lower courts' judgments: # The relevant data constitute personal data under Article 4(1) GDPR. Even though they have been created using non-personal data (polls, statistics) the defendant assigned the "affinity for a political party" to individual natural persons - such as the claimant. If the alleged affinity is actually correct is not relevant. Neither is the fact, that it only expresses the assumed likeliness of a data subject to be interested in a certain political party and not the data subject's actual political beliefs or voting behaviour. In its reasoning, the OGH referred to its judgment 6Ob127/20z (that deals with marketing classifications by the defendant) and the Austrian Federal Administrative Court's (Bundesverwaltungsgericht - BVwG) decision W258 2217446-1 (that also concerned the processing of data the "affinity for a political party" by the defendant. # The data also qualify as special categories of personal data under Article 9 GDPR. The OGH agreed with the BVwG's reasoning in W258 2217446-1 and held that that the purpose of Article 9 GDPR is to protect data subjects from the risk of severe discrimination as a result of processing certain kinds of data. As alleged data on political preferences already harbour the potential for discrimination, they must be treated as data on political opinions pursuant to Article 9 GDPR. # The OGH also upheld the lower courts' injunction. Article 79 GDPR foresees an effective judicial remedy where the data subject considers their rights under the GDPR violated. According to the prevailing opinion among legal scholars in Austria and Germany this includes includes injunction suits. The processing of the claimant's data on the "affinity for a political party" was unlawful due to the lack of the claimant's consent under Article 9(2)(a) GDPR. The facts that the defendant had deleted the claimant's data on his "affinity for a political" party" does not exclude the danger of the defendant creating such data again in the future. Furthermore, the defendant never gave up its standpoint that the processing of the claimant's data was lawful. Hence, the OGH held that there was a danger of repetition and upheld the injunction.