Court case W211 2281997-1/5 E – Court Ruling (Austria, 2024)

Upon opening the controller’s website, a cookie banner popped up with an option to ‘accept all’ cookies or to ‘manage settings’. Once the data subject selected the ‘manage settings’ button and tried to refuse consent another banner popped up explaining that only by accepting certain tracking cookies the platform can operate in a meaningful way and that therefore consent is required. The data subject, represented by noyb, lodged a complaint with the Austrian DPA against the controller of the website, an Austrian news magazine. They alleged a violation of Article 5(1) GDPR and 6(1) GDPR for being forced to consent to Google and other tracking cookies in order to access the content on the controller’s website. Firstly, the DPA noted that the media privilege as per Article 85 GDPR did not apply as the data processed via the aforementioned services was not used for the dissemination of journalistic information. In fact, the data processing was carried out purely for advertising or analysis purposes and therefore, the media privilege does not apply. Secondly, the Austrian DPA stated that the cookies in question are not strictly necessary and their use must therefore be subject to consent by the data subject. However, the consent in the present case cannot be considered ’voluntary’ pursuant to Article 4(11) GDPR as the data subject did not have a real choice and was not in a position to refuse consent. Thirdly, the DPA concluded that legitimate interests according to Article 6(1)(f) GDPR are not relevant, as there is already a violation of the applicable ePrivacy legislation that requires consent. For that reason, the DPA held that the processing lacked a legal basis under Article 6(1) GDPR and breached the principle of good faith under Article 5(1)(a) GDPR. As a result, the DPA ordered the controller to adjust its cookie banner and resolve the above mentioned GDPR violations within 8 weeks of the decision. However, the controller appealed the decision before the Austrian Federal Administrative Court (‘Bundesverwaltungsgericht’ or ‘BVwG’). The BVwG does not consider that consent was actually forced and therefore involuntary. As an introduction, the BVwG recalled Article 7(4) GDPR which precludes the so-called ‘tying’. This means that the performance of a contract may not be made dependent upon the consent to process personal data, which is not needed for the performance of that contract. The BVwG referred to the German Data Protection Conference (‘DSK’) which, according to the BVwG, did not consider a provision of ‘free’ service offers ‘payed’ by users with their consent to be contrary to Article 7(4) GDPR.. Such offer should be presented to data subjects as a contractual agreement at the time of its conclusion. As a result, personal data could became the subject of a primary performance obligation of a legal transaction. The BVwG did not state explicitly how these considerations apply in the present case. Further, the BVwG refers to the CJEU judgment in C-252/21. This judgment would not be applicable in the present case. The BVwG emphasized that in the present case the controller is not in a dominant market position comparable to the one of Meta in C 252/21. The users’ freedom of choice is not affected the same way as described in the CJEU judgment C-252/21. The controller’s website cannot be compared to the pressure of a quasi-monopolistic online service that would not be accessible without consent. Additionally, the BVwG acknowledged that while data protection laws can limit private autonomy, in this case the controller had the right to determine the conditions for accessing its content, which includes requiring consent to tracking cookies (‘data as compensation for service’). A different interpretation of Article 6(1)(a) GDPR would not be proportionate. The court emphasized that users had alternative means to access the content, such as through a print edition or a digital subscription, and thus there was no disproportionate infringement on user rights. Consequently, the data subject cannot claim a right to access the website content under its preferred conditions, and the controller is not obliged to provide such access. The BVwG concluded that the controller obtained valid consent and annulled the decision of the DPA. This decision was appealed by the Austrian DPA to the Supreme Administrative Court (‘Verwaltungsgerichtshof’).