Controller (subsidiary of parent company) – Court Ruling (Austria, 2026)

The parent company operated a customer loyalty programme through its subsidiary, the controller, starting 2 May 2019. The controller managed the operational business and processed personal data of registered customers, including profiling activities based on customer data. The controller designed the profiling consent forms, determined the data processing activities, prepared the privacy documentation, implemented technical and organisational measures, and established GDPR compliance processes. The parent company only financed the controller. On 12 October 2021, the Austrian DPA fined the parent company €8,000,000. The DPA considered the parent company and the subsidiary to be joint controllers under Article 26 GDPR. It held that the consent forms used for profiling did not meet the requirements for valid consent under Article 4(11) and Article 7 GDPR. It further held that the profiling lacked a valid legal basis under Article 6(1) GDPR because the consent was invalid. The parent company appealed. The Federal Administrative Court annulled the fine and terminated the proceedings. The DPA then appealed to the Austrian Supreme Administrative Court. First, the court referred to the case law of the Court of Justice of the European Union on the concept of controller under Article 4(7) GDPR and joint controllership under Article 26 GDPR. The court noted that a party qualifies as a controller only if it actually influences the purposes and means of the relevant processing operations. Merely establishing and financing a subsidiary did not automatically create joint controllership, as the parent company didn't exercise actual influence over the specific processing activities. As a result, the parent company was not a joint controller under Article 26 GDPR. Second, the court also rejected the DPA’s reliance on CJEU judgments such as Jehovan todistajat, Fashion ID and others, as those cases involved direct influence over concrete processing operations, which was absent here. Finally, the court rejected the DPA’s appeal.