DPA case DSB-D130.073/0008-DSB/2019 – Complaint Upheld (Austria, 2019)

The email address of a minor (complainant) was used to register an account on two dating websites of the respondent. The complainant's email address subsequently received dating-related emails sent by the respondent. These emails included 'contact recommendations' and other notifications. The complainant did not register the account himself. The complainant alleged that by not implementing a double opt-in process for user registrations, the respondent violated Article 5 GDPR, Article 6 GDPR, and Article 32 GDPR, and § 1 para 1 DSG (the Austrian Data Protection Act), which protects the confidentiality of data subjects where the data subjects have such an interest that deserves protection. The complainant also alleged that their personal data (the email address) was unlawfully processed by the respondent. The respondent disputed this and alleged that an account could not be fully used as long as the email address provided was not confirmed through a double opt-in process. The DSB held that sending emails to an unconfirmed email address contrary to the requirements of Article 32 GDPR violated the complainant's right to confidentiality under § 1 para 1 DSG (the Austrian Data Protection Act).