Court case VwGH Ro 2025/04/0007-7 – Court Ruling (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Another Austrian court case involved a company accused of improperly processing personal data for targeted advertising. The court found that the data protection authority did not provide enough evidence to support the fine. This ruling shows that companies can challenge penalties if the evidence is lacking.
What happened
A company was fined for unlawfully processing personal data for targeted marketing, but the fine was annulled.
Who was affected
The company that was found to have processed personal data without adequate legal justification.
What the authority found
The court agreed with the company that the data protection authority did not prove the necessary culpability for the fine.
Why this matters
This ruling indicates that companies can successfully contest fines if the evidence is insufficient. It serves as a reminder for authorities to ensure robust investigations.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The controller was an address publisher and direct advertising company that operated a data application to provide advertisers with personal data for targeted marketing measures. In 2019, following media reports concerning the alleged sale of personal data, particularly information about natural persons’ political party affinity, the Austrian DPA (DSB) initiated an ex officio investigation against the controller. Based on its investigation, the DPA found that the controller had unlawfully processed political party affinity data and unlawfully further processed parcel-frequency data, and had infringed its obligations concerning the DPIA and record of processing activities. It consequently imposed a fine of €18,000,000. The controller appealed to the Federal Administrative Court (BVwG), arguing that the commission of an infringement by a legal person was not, in itself, sufficient for a fine to be imposed under the GDPR. It claimed that since a legal person could not act on its own, the culpable conduct of a natural person had to be identified and attributed to it. The controller argued that the DPA had failed to establish such attribution. The court agreed and, on 26 November 2020, annulled the fine. It found that the DPA had failed to establish that natural persons acting on behalf of the controller had engaged in culpable conduct. The DPA filed an extraordinary official appeal against this judgment with the Austrian Supreme Administrative Court (VwGH). The court stayed the proceedings pending the CJEU’s preliminary ruling in Case C-807/21 (Deutsche Wohnen SE), as the questions referred in that case were also relevant to the appeal proceedings. The CJEU published its judgement on this matter on 5 December 2023. The CJEU held that a fine under Article 83(4) GDPR, Article 83(5) GDPR and Article 83 (6) GDPR may be imposed on anyone who qualifies as a controller where it is established that the controller committed the relevant infringement intentionally or negligentl
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case VwGH Ro 2025/04/0007-7 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case VwGH Ro 2025/04/0007-7 - Austria (2026). Retrieved from cookiefines.eu
Last updated: