DPA case D130.2269 – Dismissed (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A complaint about data transfers to China was dismissed by the authority. This is important because it shows that not all data transfers are automatically allowed under GDPR.
What happened
The authority dismissed a complaint regarding personal data transfers to the People's Republic of China.
Who was affected
A customer who used an e-marketplace platform and had their data transferred to China.
What the authority found
The authority ruled that the complaint was admissible but ultimately did not find grounds for action regarding the data transfers.
Why this matters
This decision highlights the complexities of international data transfers and the need for companies to understand the legal requirements for such actions.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA was acting upon a complaint addressing the subject matter of third country personal data transfers. The controller, established in Ireland, operates an e-marketplace platform within the Union that connects costumers with independent vendors mostly located in Asia. The use of the controller’s platform requires potential costumers to create an account with the platform. When a customer orders a product via the platform, the controller establishes the contact between the costumer and the vendor. The parties of the purchase contract, however, are the customer and the vendor, not the controller. The processing of personal data in the context of providing the controller’s platform takes place within the Union and in the United Kingdom. In case of an order, the personal data is transferred to the vendors registered on the platform who offer the requested product. A customer (data subject) created an account with the controller’s platform in 2024. He logged into his account on the platform another time in 2024 and once in 2026, shortly after the procedure before the DPA was concluded. During his log-in in 2026, the data subject placed an order via the controller’s platform. In the course of the order, the data subject’s personal data was transferred to the People’s Republic of China and to two companies within the US. The European Commission has issued an adequacy decision pursuant to Article 45 GDPR concerning data transfers to the US (so-called “Data Privacy Framework”). Both US companies are featured on the “Data Privacy Framework List”. There is no adequacy decision concerning data transfers to the People’s Republic of China. The Irish DPA has declared itself not competent for the procedure at hand. The DPA held that the complaint at hand cannot be considered an abusive exercise of rights and was legally admissible. The question arose because the DPA considered the complaint as part of a campaign against processing of transfers of personal data to the Peop
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case D130.2269 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case D130.2269 - Austria (2026). Retrieved from cookiefines.eu
Last updated: