DPA case DSB-D124.3420 – Dismissed (Austria, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian man complained that his personal data was shared between two gambling companies without his consent. The Austrian data protection authority found that the sharing of his data was lawful because it was necessary for the companies to defend their interests in a legal dispute. This ruling emphasizes the need for companies to understand when they can share personal data legally.
What happened
The Austrian data protection authority dismissed a complaint regarding the sharing of a man's personal data between two gambling companies.
Who was affected
The person affected was a man who had previously sought refunds from two different online gambling companies.
What the authority found
The authority ruled that the sharing of the man's data was lawful as it was necessary for the companies' legitimate interests in a legal case.
Why this matters
This case illustrates that companies can share personal data in legal contexts, but they must ensure they have a valid reason. Businesses should be aware of their rights and responsibilities when handling customer data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject gambled online on the website of a gambling company (hereinafter: company B), established in Malta. When the data subject lost some money, he demanded a refund from company B, claiming that the company's online gambling services were illegal, at least in Austria from where the data subject accessed the online casino. Company B then refunded the money. The data subject later opened account with a different online gambling company (hereinafter: company C), which was a part of the same group of companies as company B. The data subject once again demanded a refund of his losses. He based it on the same claim as before: alleged illegality. However, company C refused to give a refund. The data subject then brought the dispute to court. Company C wanted to defend itself in the legal proceedings by demonstrating that the data subject abused his rights by claiming refunds whenever he lost money. For this reason, company B transferred the data subject's personal data to company C. The personal data concerned the data subject's previous refund claim at company B. Company C then transferred this data to the law firm representing it in the legal proceedings (the controller). As a result, the data subject filed a complaint with the Austrian DPA against the controller about the use of his personal data in the court proceedings. He stated that the exchange of personal data from company B to company C was neither covered by the privacy policy of company B nor did he give consent to it. The data was therefore unlawfully processed by the controller in the court proceedings against company C. The DPA held that the processing of the personal data by the controller was lawful pursuant to Article 6(1)(f) GDPR as it was necessary for the purposes of a legitimate interest pursued by the controller or by a third party. The court used Article 9(2)(f) GDPR to interpret legitimate interests under Article 6(1)(f) GDPR as including the establishment, exercise or defence of l
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DSB-D124.3420 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DSB-D124.3420 - Austria (2022). Retrieved from cookiefines.eu
Last updated: