Court case W252 2282050-1/12E – Court Ruling (Austria, 2024)

On the 09 August 2022, a data subject, represented by noyb, filed a complaint with the Austrian DPA (Datenschutzbehörde – DSB) alleging that the controller unlawfully processed their personal data without the data subject's valid consent. The data subject alleged that, due to the use of dark patterns by the controller, the principle of transparency was violated and that the withdrawal of consent was not as easy as its issuance. Therefore, the data subject requested the erasure of their personal data. The option to reject cookies was a link, which was only identifiable as a link when hovering over it with the mouse. The accept button on the other hand was strongly highlighted by being placed in the middle of the banner and in a colour with strong contrast to the background. On the 22 September 2023, the DSB issued a decision on the following three points: Point 1: The data subject’s right to erasure had been violated under Article 17 GDPR. Point 2: The data subject’s right to privacy had not been violated under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&FassungVom=04-11-2022 §1(1) of the Austrian Data Protection Act] (Datenschutzgesetz - DSG). Point 3.a: The DSB ordered the controller to alter its cookie banner to make the “reject all cookies” appear in equal format to the “accept all cookies” option. Point 3.b: The controller must implement a function, which makes the revocation of consent just as simple as its declaration. The controller appealed points 1, 3a and 3b of the decision to the Austrian Federal Administrative Court (Bundesverwaltungsgericht – BVwG). The controller posited that the GDPR does not require the “accept” and “reject” buttons to be displayed in an equal format. Further, it added that the revocation of consent was available through a footer link on the website which lead to the cookie settings. The court rejected the controller’s appeal. Point 1: The data of the data subject, at the