DPA case DSB-D122.970/0004-DSB/2019 (classifieds portal) – Order (Austria, 2019)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian authority ordered a classifieds portal to delete a user's profile after the user complained about their data being mishandled. The company asked for more personal information than necessary to verify the user's identity. This decision highlights the importance of respecting user privacy rights, especially regarding data deletion requests.
What happened
The Austrian DSB ordered a classifieds portal to delete a user's profile and associated data.
Who was affected
A pseudonymous user of the classifieds portal who requested the deletion of their data.
What the authority found
The authority found that the company violated the user's right to erasure under GDPR by demanding unnecessary identity information.
Why this matters
This case emphasizes that companies must handle user data requests properly and not ask for excessive information. It serves as a reminder for businesses to streamline their data verification processes.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 8 November 2019 the Austrian DSB upheld a pseudonymous classifieds-portal user’s erasure complaint in DSB-D122.970/0004-DSB/2019. Registration required only a first name and email address. The controller could verify the user against those existing account details and should not have demanded an extensive form and additional identity data for which it had no comparison information. The authority found a breach of the erasure right under GDPR Articles 12(2) and 17(1) and ordered deletion of the profile and associated data within two weeks. No monetary fine was imposed. RIS states that the decision is legally final. The 2018 dates concern the request and complaint, rather than the decision date.
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DSB-D122.970/0004-DSB/2019 (classifieds portal) in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DSB-D122.970/0004-DSB/2019 (classifieds portal) - Austria (2019). Retrieved from cookiefines.eu
Last updated: