Data subject – Court Ruling (Austria, 2026)

The data subject was an existing customer of a telecommunications provider (the controller). An unknown third party used the data subject’s name, date of birth and bank account number to order a mobile phone contract and smartphone through the controller’s online shop without the data subject’s knowledge and provided a delivery address that had no connection to the data subject. The controller did not verify the identity of the person placing the order or compare the delivery address with the data subject’s existing address information. Despite instruction to require identity verification for the delivery, the delivery company handed the package to an unknown third party and recorded the data subject as the recipient. The data subject lodged a complaint with the Austrian Data Protection Authority (DPA), alleging that the controller had allowed a third party to use their personal data to conclude a contract without adequate identity verification. The controller argued that it had selected personal delivery with an identity check as an appropriate security measure. It also argued that the delivery company was independently responsible for the failure to check the recipient’s identity. The DPA upheld the complaint. The controller appealed to the Austrian Federal Administrative Court. First, the court held that the controller had violated Article 5(f) GDPR, Article 24 GDPR and Article 32 GDPR by failing to implement adequate technical and organisational measures to prevent identity fraud. Second, the court held that the controller had violated Article 5(1)(d) GDPR, which requires controllers to ensure the accuracy of personal data. By failing to verify the data subject’s identity or check the delivery address against the information already held for this existing customer, the controller had failed to take adequate measures to ensure data accuracy. Third, the court rejected the controller’s argument that arranging personal delivery with an identity check was sufficien