DPA case 2025-0.587.686 – Complaint Upheld (Austria, 2024)

The data subject published an online advertisement offering a property for sale on a public marketplace website. The advertisement contained his name and telephone number and included, prominently at the beginning of the description, the statement “Makler sind nicht erwünscht!” (“No real estate agents!”). Despite this explicit notice, a real estate company (the controller) used the contact details contained in the advertisement to call the data subject in order to discuss a potential acquisition of the property. The data subject subsequently lodged a complaint with the Austrian Data Protection Authority (DSB), alleging a violation of his right to confidentiality. The DSB upheld the complaint and held that the controller unlawfully processed the data subject’s personal data. The authority found that the use of the data subject’s name and telephone number to initiate contact constituted processing under Article 4 GDPR and that the controller acted as a controller. As no consent or other legal basis applied, the only possible justification was legitimate interests under Article 6(1)(f) GDPR. While the controller’s commercial interest in brokering or acquiring property qualified as a legitimate interest, and contacting the seller was in principle suitable for that purpose, the decisive factor was the balancing of interests.Because the data subject had explicitly and clearly stated that he did not wish to be contacted by brokers, he could not reasonably expect such contact. His interests and fundamental rights therefore outweighed the controller’s commercial interests. Accordingly, the DSB held that the controller lacked a lawful basis for the processing and violated the data subject’s right to confidentiality.