Der Standard – Court Ruling (Austria, 2025)

Der Standard (the controller) is an Austrian daily newspaper. The website implemented a pop-up window, which gave the data subject the option of consenting to the use of cookies for web analysis and advertising, or to pay a monthly subscription and access the website without advertising (also known as “Pay or Okay”). A data subject chose the option of accepting cookies, as they did not want to take out a paid subscription, but also regularly deleted their cookie history because they did not want to be tracked. The data subject brought a complaint to the DPA on 13 August 2021, arguing that they had been forced to consent to extensive processing of their data or take a paid subscription. The data subject was represented by noyb. Furthermore, the blanket consent to all data processing does not comply with the GDPR. The controller argued that data processing for advertising purposes was necessary for the provision of its services. In addition, the “Pay or Okay” model was permissible, according to a previous decision of the DPA. Finally, the uniform consent to several data processing operations was permissible under the GDPR. In its decision on 29 March 2023, the DPA stated that the “Pay or Okay” model followed by the controller violated Article 5(1)(a) GDPR and Article 6(1)(a) GDPR, as it lacked granularity. This meant that the data subject could not choose which processing activities to consent to, and was forced to consent to all processing activities (or pay a subscription fee). In addition, the DPA ordered the controller to delete the data subject’s personal data if it was still processed within a month of the decision. However, the DPA dismissed the data subject’s request to issue a processing ban. The controller appealed the decision to the Federal Administrative Court, contesting the decision that there was a violation and the order to delete the data. The data subject also appealed the decision, contesting the decision to dismiss the request to issue a processing ban. The Court first stated that personal data was processed when the data subject visited the controller’s website, in agreement with the reasoning of the DPA. Recording the preferences of the data subject’s consent through a TC stringA TC string is a "combination of letters and characters which encodes and records user preferences through consent management platforms (CMPs), when they visit a website or app. The TC String is then shared with ad platforms and other participants of the ad-tech ecosystem". For more information, see https://privacymatters.dlapiper.com/2024/03/cjeu-ruling-clarifies-data-protection-and-e-privacy-issues-in-the-ad-tech-space/ falls under the definition of personal data according to Article 4(1) GDPR and CJEU case law.C-673/17, para. 45, 67; ECJ 07.03.2024, C-604/22 para. 50 The Court then stated that the data processing under the “Pay or Okay” model does not fall under the definition of media privilege. The GDPR allows for derogations in its provisions in cases where it is necessary to reconcile the right to data protection and the right to freedom of expression and information. However, processing personal data through cookies could not be considered processing for journalistic purposes, as it does not in itself contribute to a debate of general interest. According to the Court, this was the case even if the processing finances the working framework for journalists. Finally, the Court agreed with the reasoning of the DPA that the controller could not argue that the processing was exclusively for journalistic purposes, as it was also not fully aware of the data transferred to social media platforms or its use. In terms of the granularity of consent and the “Pay or Okay” model, the Court first noted that the DPA is not bound by previous legal opinions. The Court found a violation of Article 6(1)(a) GDPR, as consent was not granular; the data subject did not have the option of consenting to a specific processing purpose, but instead could only give a blanket consent to the controller’s processing. This is supported by EDPB Guidelines,See EDPB, 'Guidelines 05/2020 on consent under Regulation 2016/679', 4 May 2020 (Version 1.1) (available https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052020-consent-under-regulation-2016679_en) and EDPB, 'Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms', 17 April 2024 (available https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion_202408_consentorpay_en.pdf). which state that in consent or pay models data subject should be able to choose which individual purposes they wish to consent to, rather than only having the option to consent to a bundle of all processing purposes. The Court dismissed the controller’s argument that the purposes of optimising the website and advertising were closely connected. Therefore, the data subject’s consent was not valid. The Court saw no need to consider the other legal bases under Article 6(1) GDPR, as the controller cannot retroactively invoke another legal basis when consent is not valid. Finally, the Court upheld the decision of the DPA in rejecting a processing ban. The Court noted that the data subject does not have the subjective right to a specific remedy, and that the DPA had correctly rejected the request to issue a processing ban.