DPA case 2025-0.533.437 – Dismissed (Austria, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A lawyer requested information from a platform about a user who had posted an ad using his client's name without permission. The Data Protection Authority found that the lawyer acted lawfully in seeking this information to protect his client’s interests. This case highlights that lawyers can access personal data when necessary for their professional duties.
What happened
A lawyer sought user profile data from a platform to prove unauthorized use of his client's identity.
Who was affected
The person whose data was accessed, who had used the lawyer's client's name in an online profile.
What the authority found
The Data Protection Authority ruled that the lawyer's actions were lawful under GDPR because they served legitimate interests.
Why this matters
This decision clarifies that legal professionals can process personal data to fulfill their duties, emphasizing the importance of legitimate interests in data handling.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject alleged that a lawyer (the controller) representing his client , violated his right to secrecy under [https://www.jusline.at/gesetz/dsg/paragraf/artikel1zu1 §1(1) of the Austrian Data Protection Act (DSG)] and Articles 4, 6, and 15 of the GDPR. The controller, acting for his client (who has the same name and whose address appeared in an online advertisement), requested information from the platform because an ad had been posted using his client’s name and address even though the client was not registered and denied having posted it. The platform responded with data from the user profile, which in fact belonged to the data subject, who had used the address of the controller’s client in his profile even though he no longer resided there and had not updated his information. The controller later submitted the obtained profile data as evidence in a civil court proceeding to show unauthorized use of his client’s identity and the allegedly wrongful sale of items connected to a family dispute. The data subject contended that the controller acted improperly by using his data in the civil proceedings. The controller argued that he acted in accordance with his professional mandate under [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001673&Artikel=&Paragraf=8&Anlage=&Uebergangsrecht= §8 RAO], and that the processing was lawful under Article 6(1)(f) GDPR, based on legitimate interests, as well as Article 15 GDPR regarding the right of access. The Data Protection Authority concluded that there was no violation of the right to secrecy. The lawyer was deemed the data controller under Article 4(7) GDPR when processing the data in question. The processing, requesting the user profile data from the website and disclosing it in civil proceedings, was lawful because it served the legitimate interests of the controller under Article 6(1)(f) GDPR in representing his client and was necessary to uncover the unauthorized use οf his clien
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2025-0.533.437 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2025-0.533.437 - Austria (2025). Retrieved from cookiefines.eu
Last updated: