DPA case 2021-0.432.224 – Dismissed (Austria, 2021)

The controller is active in the field of address trading and direct marketing. It offers its customers the service to store (within a pre-determined period of time) incoming mails at one of its offices, which is close to the customer's residential or company address. The data subject ordered this service on-site by filling in a form at a touch-pad terminal which asked for his name, address and date of birth. The form also contained a note that the data can be transferred to third parties for the purpose of direct marketing and that the customer can forbid this transfer by unticking the pre-ticked box below. The text on the side of the pre-ticked box said "I do not object to the transfer of data". Afterwards the data subject lodged a complaint with the Austrian DPA (DSB) arguing that the controller violated Articles 4(11), 6(1)(a) and 7 GDPR because the box was pre-ticked and, therefore, the consent to the processing was not given freely. The controller argued that it processes this data under Article 6(1)(f) GDPR and the purpose of the box is not to obtain consent from its customers but rather to give them the opportunity to object against the processing according to Article 21 GDPR. It further stated that it did not transfer any information of the data subject to a third party since the data subject objected against the transfer. The DSB rejected the complaint because it did not find any violation of the GDPR by the controller. The DSB found that no transfer to third parties took place and that the controller did not violate Articles 4(11), 6(1)(a) and 7 GDPR, because the purpose of the pre-ticked box was to give the data subject the possibility to object against the transfer and not obtain its consent.