DPA case 2025-0.813.131 – Complaint Upheld (Austria, 2025)

A data subject purchased tickets from an event organizer (the controller), and provided his email address for ticket delivery. The controller then sent a newsletter containing advertising for an upcoming event. The email included the data subject’s email address in the CC field, which resulted in disclosure of his address to a large, indefinite group of third parties. The data subject had never consented to receiving marketing communications or to the disclosure of his email address to third parties. He subsequently filed a complaint with the Austrian Data Protection Authority (DSB), claiming that the controller had violated his right to secrecy under [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=1&Paragraf=1&Anlage=&Uebergangsrecht= § 1 DSG] and the GDPR. The DSB upheld the complaint, finding that the controller unlawfully violated the complainant’s right to secrecy. First, sending a marketing email without prior consent constituted an interference with the data subject’s right to secrecy under [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=1&Paragraf=1&Anlage=&Uebergangsrecht= § 1 DSG]. Second, disclosing the complainant’s email address in an open CC field to multiple recipients violated the principle of data minimization under Article 5(1)(c) GDPR, as no legitimate interest or consent justified the disclosure. The DPA therefore established both violations, holding the controller accountable for processing the data subject’s personal data in an unlawful manner.