BF (data subject) – Court Ruling (Austria, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled on a case involving a smart heat meter that recorded personal data without a proper legal basis. This ruling is important because it clarifies how companies must handle personal data when using technology.
What happened
The court found that the energy company did not unlawfully process personal data from the smart heat meter installed in a user's apartment.
Who was affected
The person who had the heating supply contract with the energy company was directly affected.
What the authority found
The court decided that the energy company acted as a private entity and complied with data processing rules for necessary data collection.
Why this matters
This ruling sets a precedent for how companies can process personal data under contracts. It shows that businesses must ensure they have a valid legal basis for collecting and using personal information.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 24 April 2026.
Processing notes: articles corrected, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject had a heating supply contract with a private energy company, the controller. On 17 October 2019, the controller installed a smart heat meter in the data subject’s apartment. The device recorded various consumption and technical data, including energy usage, flow rates, and temperatures. It also stored historical operational data for error detection. The controller read the meter once per year on-site. Although the device technically supported remote reading via a radio module, the controller did not use this function. On 21 September 2020, the data subject filed a complaint with the DPA, arguing that the device unlawfully processed personal data and that the controller required a specific legal basis as a public authority. The DPA rejected the complaint on 11 October 2021. The data subject appealed to the court. First, the court held that the controller was not a public authority. It acted as a private company under a contractual relationship and had no statutory powers to exercise authority. Therefore, Article 6(1)(f) GDPR could apply. Second, the court held that the processing of consumption data (such as energy use, flow, and temperatures) complied with Article 6(1)(c) GDPR. National law required the collection and storage of such data for billing, energy efficiency, and system operation. This law satisfied the requirements of Article 6(3) GDPR by defining the purpose, scope, and retention periods. Third, the court held that the processing of additional technical and historical data (such as error logs and operational records) complied with Article 6(1)(f) GDPR. The controller had a legitimate interest in ensuring the proper functioning and maintenance of the device. The processing was necessary for detecting faults and maintaining system reliability. Finally, the court found that the data subject’s interests did not override the controller’s interests. Access to detailed historical data required specialised tools, and the data was only used i
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (1)
Other cases involving BF (data subject) in AT
Details
About this data
Cite as: Cookie Fines. BF (data subject) - Austria (2024). Retrieved from cookiefines.eu
Last updated: