Court case W298 2274626-1/8E – Court Ruling (Austria, 2024)

The data subject had brought a complaint to the Austrian DPA against the controller, a political party. The data subject detailed that he had visited the controller’s website and noticed that Google reCaptcha was being used on the website even though the data subject had deactivated Google reCaptcha. After the data subject had deactivated all cookies and functions such as Google reCaptcha, he clicked on the “become a member” page on the website, which showed the transfer of 615 packages of information from and to Google. The data subject declared that he had not agreed to the data transfer and that he wasn’t adequately informed that his IP address and the connected data would be transferred to Google. Therefore, Google would have knowledge of which party the data subject wanted to become a member of. The controller told the DPA that the information on the data subject’s membership sign-up remained entirely confidential and could not be accessed by others. The controller saw itself responsible for the content of the website while the design was carried out by an external person. Further, users had the option to reject cookies through the cookie banner. If cookies were rejected then no storage nor data transfer took place. The data subject added on the 20 April 2023, that after the complaint with the DPA, the controller continued the practice. Google Fonts was automatically downloaded and users were only informed of this in the privacy policy after the download had been completed. The DPA found that the data subject’s right to privacy had been infringed upon through implementing Google reCaptcha and processing the data subject’s IP address, certain unique identifiers and browser data. The cookie “_GRECAPTCHA” was held not to be of technological necessity and therefore required the data subject’s explicit consent. Therefore, none of the legal basis under Article 6(1) GDPR applied. The controller appealed this decision to the Federal Administrative Court (Bundesverwaltungsgericht – BVwG). It argued that the DPA had not analysed with which browser and operating system the data subject had accessed the website. The BVwG held that the data subject had not given his clear consent to the reCatpcha data processing. Even though the controller had not listed Article 6(1)(f) GDPR as a legal basis for processing, the court analysed whether this could legitimize the data processing. The Google reCaptca service was held to be unnecessary and therefore the controller could not rely on a legitimate interest. Therefore, none of the legal bases under Article 6(1) GDPR applied and the data processing violated the data subject’s right to privacy under §1(1) of the Austrian Data Protection Act. The BVwG therefore upheld the decision of the DPA.