Court case W108 2280724-1 – Court Ruling (Austria, 2024)

The data subject visited a website, for which the controller was responsible. Upon accessing the website, the data subject was presented with a 'Consent Management Platform (CMP or cookie banner)' that, according to the data subject, violated Article 6 GDPR. The data subject filed a complaint to the Austrian DPA (DSB) on 10 August 2021. The data subject was represented by noyb. During the proceedings before the DPA: * the controller claimed to have reworked the design of the CMP and to have deleted the contested personal data of the data subject; * the data subject replied to this statement claiming that even though the violations identified in the complaint had been remedied by the new design of the CMP, certain cookies were then classified as 'strictly necessary' (within the meaning of Article 5 (3) ePrivacy Directive) and thus set as 'always active'; * in response, the controller claimed not to have processed any personal data without the data subjects consent. In addition, the controller explained that the note 'always active' for certain cookies was incorrect and had only not been removed by the time of the data subject's statement for technical reasons; * the data subject explained that the cookies had still been incorrectly classified and various non-required cookies were set without interaction with the banner. The controller claimed they had revised the cookie settings and the banner again and the contested cookies that were not deemed strictly necessary were not being set anymore if consent was not given; * the data subject stated their data was indeed processed without their consent upon visiting the website and that the processor had not explained in sufficient detail to what extent certain cookies were considered strictly necessary. The DPA dismissed the complaint. However, it also officially instructed the processor in point 3) of their decision to adapt the website and the banner in such a way to be compliant with Article 4(11) GDPR and Article 4(7) GDPR and Article 7(3) GDPR, respectively. The controller lodged a timely appeal against point 3) of the decision with Austrian Federal Administrative Court (BVwG). The controller claimed that the design of the cookie banner was in compliance with Article 7(3) GDPR as it already has a sufficiently marked option to revoke consent. Furthermore, the processor claimed not to have set cookies that are not technically necessary and the website is therefore already in compliance with Article 4(11) GDPR and Article 4(7) GDPR. The controller submitted an additional statement on June 6, 2024 that it decided not to operate the website any further and redirect visitors to a different website. The processor claimed that this provided another reason to annul point 3) of the decision of the DPA. The data subject issued multiple statements during the proceedings, claiming that the new website violates Article 4(11) and Article 4(7) GDPR and Article 7(3) GDPR in the same way as the previous website did. The court gave way to the appeal of the controller and annulled the contested point 3) of the DPA decision. After the changes made to the design of the CMP, there were clear textual instructions given as to how to grant or revoke consent. It was then as easy for an averagely informed, attentive and circumspect consumer to grant consent as to revoke it and the CMP was therefore already in compliance with Article 7(3) GDPR. Upon visiting the latest version of the website, there were only strictly necessary cookies in terms of Article 5(3) [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058 ePrivacy Directive] active without consent and there was no processing of personal data that violated Article 4(11) and Article 4(7) GDPR.