Court case W274 2320278-1 – Court Ruling (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that an address publishing service must give users access to their personal data when it is involved in marketing communications. This matters because it reinforces the rights of individuals to know how their data is used, especially in marketing. Companies must ensure they comply with these access requests to avoid legal issues.
What happened
The court decided that the address publishing service must provide access to personal data when involved in marketing communications.
Who was affected
Individuals whose address data was shared with clients for marketing purposes were affected.
What the authority found
The court held that the company must comply with the code of conduct requiring access to personal data as outlined in GDPR Article 15.
Why this matters
This ruling emphasizes the importance of transparency and user rights in data handling. Companies involved in direct marketing should review their processes to ensure they are providing access to personal data as required.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 29 September 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
An address publishing service and direct marketing company (the controller) sent the address data of a data subject to clients as part of its business activities. The clients are both end-customers who engage in sending communication e.g. for fund raising purposes, as well as industry partners that create and sell data sets to direct marketing companies. After the controller sends the personal data to its clients, it deletes the data. The controller is subject to the code of conduct for address publishing services and direct marketing companies pursuant to Article 40 GDPR. As far as the rights of the data subjects are concerned, according to the code of conduct, the controller is obliged to give full access to the data subjects’ data as provided for by Article 15 GDPR in case the controller is directly involved in the marketing communication. In case the controller provides the address data for a client’s marketing campaign and is therefore not involved in the direct marketing communication, the controller is obliged to instruct the client to provide in its communication with the data subjects the information that the address data has been obtained from the controller. The data subject is not on the so-called “Robinson list” for persons who do not wish to have their address data distributed for marketing purposes. The data subject requested access to their personal data from the controller, specifically concerning information about recipients and categories of recipients. The controller provided information on the categories of recipients but not the specific recipients. An additional access request by the data subject concerning information about the specific recipients was denied by the controller on the grounds that it is not possible to provide such information because of the sector specific practices in direct marketing. According to its deletion practice, the controller was not in possession of the requested data. Upon the subsequent complaint filed by
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W274 2320278-1 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W274 2320278-1 - Austria (2026). Retrieved from cookiefines.eu
Last updated: