Court case W171 2305420-1 – Court Ruling (Austria, 2026)

The data subject visited a news website operated by the controller on 20 January 2021. During the visit, the website set cookies after the data subject interacted with the cookie banner and processed the data subject's personal data. On 11 August 2021, the data subject filed a complaint with the Austrian DPA. The complaint alleged that the controller's cookie banner used dark patterns, did not provide a rejection option on the first layer, and enabled the placement of non-essential cookies without valid consent. The data subject requested that the DPA order the deletion of the collected data, stop the processing and impose a fine. The controller argued that it had deleted the relevant data during the proceedings and that no ongoing infringement existed. It also maintained that the data subject had never submitted an erasure request directly to the controller under Article 17 GDPR. On 28 October 2024, the DPA dismissed the data subject's complaint but, acting on its own initiative, ordered the controller to redesign its cookie banner and stop setting certain non-essential cookies before obtaining consent. The data subject appealed. They argued that the controller had not sufficiently proven the deletion of the data, that tracking activities likely continued, and that the DPA should have ordered the deletion of all data collected after the complaint had been filed. First, the court held that the data subject could not rely on Article 17 GDPR because no erasure request had been submitted to the controller before the complaint was filed. It found that a valid request to the controller is a prerequisite for a complaint concerning the right to erasure. The draft complaint previously sent to the controller did not constitute an Article 17 GDPR request because it primarily challenged the cookie banner and sought intervention by the DPA rather than erasure from the controller. Second, the court accepted that the controller had deleted the personal data collected through the cookies during the administrative proceedings. The court considered the controller's submissions credible and noted that the data subject had effectively acknowledged the deletion. Third, the court rejected the argument that Article 17 GDPR entitled the data subject to an order preventing future processing. The court relied on the judgment of the Court of Justice of the European Union in Quirin Privatbank AG (Case [https://infocuria.curia.europa.eu/tabs/document?source=document&text&docid=303866&pageIndex=0&doclang=DE&mode=req&dir&occ=first&part=1 C-655/23]) and held that neither Article 17 GDPR nor any other GDPR provision grants data subjects a standalone right to obtain a preventive injunction against future processing. Consequently, the controller could not be ordered to refrain from future cookie-based processing under the data subject's erasure claim. Finally, the court held that the request to stop the unlawful processing had become moot because the personal data collected on 20 January 2021 had already been deleted. The court also noted that data subjects do not have a subjective right to require a DPA to adopt a specific corrective measure under Article 58 GDPR. The court therefore confirmed the dismissal of the complaint.