Brigitte A. (complainant) – Complaint Upheld (Austria, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Austrian Datenschutzbehörde upheld a complaint against a company for not informing a customer about data processing for five months. This is important because it shows that companies must promptly inform customers about how their data is used. The case stresses the need for transparency in data handling.
What happened
A company delayed informing a customer about the processing of her data for five months.
Who was affected
The customer who bought windows and was not informed about the processing of her personal data.
What the authority found
The Datenschutzbehörde found that the company violated GDPR by failing to inform the customer in a timely manner about the data processing.
Why this matters
This decision highlights the importance of timely communication with customers about data use. Companies should ensure they provide clear and prompt information to comply with GDPR requirements.
GDPR Articles Cited
National Law Articles
Entities Involved
On 17 January 2020, the complainant received a letter (dated 8 January 2020) from the respondent informing her that the windows she had bought in 2019 might have defective hardware and that she should therefore contact a call centre to have them checked. She then contacted the manufacturer and the seller of the windows on 21 January 2020, who sent her a scan of the respondent's request. The letter from the respondent to the seller of the windows was dated 8 August 2019, whereas the letter from the respondent to the complainant was dated 8 January 2020 (received on 17 January 2020). This meant that the respondent had processed her data for about 5 months without informing her. Moreover, the letter did not comply with the provisions of Article 14 of the GDPR. Copies of the letter of 8 January 2020 and the letter of 8 August 2019 (both in Polish) were attached to the submission. Violation of the right to information pursuant to Article 14 GDPR A. The above-mentioned information must in principle be provided within a reasonable period of time, but within one month at the latest. If the personal data is to be used for communication with the data subject, at the latest at the time of the first communication (Art. 14(3)(a) and (b) GDPR). However, Art. 14(1) to (4) GDPR shall not apply if and to the extent that the data subject already has the information (para. 5 leg. cit.). Pursuant to Section 24(6) DPA, a respondent may subsequently remedy the alleged infringement by complying with the complainant's requests until the conclusion of the proceedings before the data protection authority. As can be seen from the findings, the respondent provided information about the purposes of processing, the categories of data processed and the storage period in the ongoing proceedings before the data protection authority. It is also clear who is responsible for the data processing and was sufficiently informed about the rights of the data subjects and the right of appeal to a supe
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Brigitte A. (complainant) in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Brigitte A. (complainant) - Austria (2021). Retrieved from cookiefines.eu
Last updated: