Court case W292 2298015-1 – Court Ruling (Austria, 2026)

The data subject was a customer of a bank (controller). The data subject withdrew their consent to the processing of their e-mail address and phone number by the controller, and requested the deletion thereof. The data was not deleted. The controller tried to call the data subject in order to discuss the necessity of processing of their phone number, and send them an e-mail about the matter. The controller contacted the data subject again on the matters of possible usage of their bank account in violation of contract, and change of terms of service. Consequently, the data subject sought the termination of the contractual relationship with the controller. Because of unpaid bills, the contract could not be terminated. In order to discuss the matter, the controller tried to contact the data subject again. Eventually, the account of the data subject with the controller was closed. The data subject requested access to their data from the controller. The controller tried to call the data subject again on that matter. The data subject lodged a complaint with the DPA. The DPA held that the controller called the data subject in violation of the GDPR because the calls were not necessary for the performance of a contract between the parties pursuant to Article 6(1)(b) GDPR. Moreover, the DPA held that the controller could not rely on Article 6(1)(f) GDPR because the data subject must not reasonably expect to be called after requesting the deletion of their phone number. The controller appealed the decision by the DPA. The court overruled the decision of the DPA. The court distinguished between before and after termination of the contract. It held that before contract termination, the processing of the data subject’s e-mail address and phone number was necessary for the performance of the contract. In particular, contact details are necessary to be able to contact the data subject per phone call or e-mail about possible security threats concerning the data subject’s bank account. The intended calls of the controller concerned matters of the contractual relationship. Before and after contract termination, the processing was lawful under Article 6(1)(c) GDPR in conjunction with national provisions of banking law that require the controller to store certain personal data of their customers, amongst them the e-mail address and phone number, for ten years after termination of the contractual relationship. The court added that the processing was lawful under Article 6(1)(f) GDPR because of legitimate interests of the controller. For the balancing of interest, the sphere that the personal data belongs to can be used as an argument of assessing the level of protection of the the personal data. The processing of the data subject’s phone number and e-mail address concerned the social sphere of the data subject because this type of personal data is typically revealed to third persons as a means of communication. The data does not belong to the domestic sphere, neither is it specially protected pursuant to Article 9 GDPR. Therefore, the interest of the controller prevail. The data subject could reasonably expect their data to be processed for the purpose of resolving the contractual relationship. The court held held that the processing was lawful.