Court case W274 2320278-1 – Court Ruling (Austria, 2026)

An address publishing service and direct marketing company (the controller) sent the address data of a data subject to clients as part of its business activities. The clients are both end-customers who engage in sending communication e.g. for fund raising purposes, as well as industry partners that create and sell data sets to direct marketing companies. After the controller sends the personal data to its clients, it deletes the data. The controller is subject to the code of conduct for address publishing services and direct marketing companies pursuant to Article 40 GDPR. As far as the rights of the data subjects are concerned, according to the code of conduct, the controller is obliged to give full access to the data subjects’ data as provided for by Article 15 GDPR in case the controller is directly involved in the marketing communication. In case the controller provides the address data for a client’s marketing campaign and is therefore not involved in the direct marketing communication, the controller is obliged to instruct the client to provide in its communication with the data subjects the information that the address data has been obtained from the controller. The data subject is not on the so-called “Robinson list” for persons who do not wish to have their address data distributed for marketing purposes. The data subject requested access to their personal data from the controller, specifically concerning information about recipients and categories of recipients. The controller provided information on the categories of recipients but not the specific recipients. An additional access request by the data subject concerning information about the specific recipients was denied by the controller on the grounds that it is not possible to provide such information because of the sector specific practices in direct marketing. According to its deletion practice, the controller was not in possession of the requested data. Upon the subsequent complaint filed by the data subject with the DPA, the DPA held that the controller violated Article 15(1)(c) GDPR by not providing information on the specific recipients. The controller appealed the decision to the Austrian Federal Administrative Court (the court). The court held that the controller was not obliged under the GDPR to store the data about the specific recipients. However, the controller is obliged to comply with the principle of data minimisation (Article 5(1)(c) GDPR) as well as the principles of storage limitation (Article 5(1)(e) GDPR) and purpose limitation (Article 5(1)(b) GDPR). The storage period of personal data is to be reduced to the minimum. If there was a general obligation to store the data on the recipients, the controller would have to store that data for the sole purpose of answering to a theoretical access request by the data subject. This would contradict the logic of the data minimisation principle because the controller could always argue, when faced with a possible violation of the principles of data minimisation or storage limitation, that it stored the data for the purpose of a future access request. According to the court, Article 11 GDPR and Recital 64 postulate the general principle that the data minimisation principle enjoys priority over an obligation to store data for the sole purpose of providing information in an access request. In line with the jurisprudence of the CJEU, the court held that the court must balance the interest of the data subject to receive access to the information with the controller’s interest to delete the data in order not to be burdened with the storage of the data. Such a balancing of interest in the context of the storage period of data can also be derived from Article 24(1) GDPR that lays down the criteria to consider for the implementation of technical and organisational measures and the demonstration of compliance. Depending on the outcome of the balancing of interest, the controller can be obliged to protocol information on the recipients. This can be the case when the data concerned requires special protection. In the specific case, the code of conduct for address publishers did not impose on the controller the obligation to store the data on the recipient. The code of conduct obliges the controller to give access to all data pursuant to Article 15 GDPR in case the controller has stored their own marketing data. Therefore, the storage of data is a prerequisite of the access request. But this provision does not deal with the obligation to store data. The data subject’s right to data protection is not impaired because of the negation of a general obligation of the controller to store the data on recipients. This is because of the legal obligation under national law to provide direct marketing communication with an indication of the source from which the personal data has been obtained from. In case the direct marketing is conducted by a client of the controller, the controller is obliged to instruct the client to provide its communication with such an indication. Therefore, the source of their personal data is in any case communicated to the data subject. According to the court, the data subject can also expect any third party that has obtained their data from the controller to actually contact the data subject and provide the information on where the data has been obtained from. This is because it would be economically disadvantageous for the client to buy the data and not use it for contacting the data subject, running the risk that the address of the data subject might become outdated. The data subject did not make use of the possibility to be listed in the “Robinson list”, by which they would avoid the processing of their data by the controller. On the other side, the interest of the controller not to be subject to an administrative burden by storing additional data, which runs counter the principle of data minimisation, must be considered. Since the data in question does not enjoy special protection, the balancing of interest results in favour of the controller.