- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
A*** GmbH (commercial register code: FN *5*1*91r) – Violation Found (Austria, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A*** GmbH sought approval to monitor compliance with certain codes of conduct but was only allowed to monitor one. This matters because it shows that organizations must have consent from code holders to monitor compliance.
What happened
A*** GmbH was accredited to monitor compliance with one code of conduct but was denied accreditation for two others due to lack of consent.
Who was affected
A*** GmbH and the holders of the codes of conduct they sought to monitor.
What the authority found
The Austrian data protection authority ruled that A*** GmbH could not be accredited to monitor compliance with codes where the holders did not consent.
Why this matters
This decision sets a precedent that organizations need explicit consent from code holders to monitor compliance. Companies should ensure they have proper agreements in place before seeking accreditation.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 19 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In December 2019, an Austrian company ("A*** GmbH") requested accreditation to monitor compliance with three different codes of conducts under Article 41 GDPR (redacted as "code S***", code M*** and code U***"). These codes had been approved by the DSB under Article 40(5) GDPR. Inverstigations by the DSB showed that: *The holder of the DSB-approval for code S*** explicitly wanted A*** GmbH to be accredited to monitor compliance with this code of conduct. *The holder of the DSB-approval for code U*** was explicitly against A*** GmbH beeing accredited to monitor compliance with this code of conduct *The holder of the DSB-approval for code M*** did not give a statement on whether they wanted A*** GmbH to be accredited to monitor compliance with this code of conduct. However, in August 2020, the DSB had received a request by another body wanting to be accredited to monitor compliance with code M***. *Can a body be accredited to monitor compliance with a code of conduct under Article 41 GDPR if the holder of the of the code's approval is against this accreditation ("non-consensual accreditation")? *Can a body be accredited to monitor compliance with a code of conduct under Article 41 GDPR if the holder of the of the code's approval prefers a different body to be accredited to do so? The DSB accredited A*** GmbH to monitor compliance with code S*** but rejected the request for accreditation for the monitoring of code U*** and code M***. Regarding code U*** the DSB held that the holder of the DSB-approval for this code has expressly denied its cooperation with A*** GmbH regarding the monitoring for this code under Article 41 GDPR. Regarding code M*** the DSB held that the holder of the DSB-approval for this code code has expressed its willingness to cooperate regarding the monitoring under Article 41 GDPR not towards A*** GmbH, but towards another body. As a result, there were neither *monitoring mechanisms to carry out the mandatory monitoring of compliance with the
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for A*** GmbH (commercial register code: FN *5*1*91r) in AT
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
28 September 2020
Authority
Datenschutzbehörde
About this data
Cite as: Cookie Fines. A*** GmbH (commercial register code: FN *5*1*91r) - Austria (2020). Retrieved from cookiefines.eu
Last updated: