Dr. Markus A*** (Complainant) – Complaint Upheld (Austria, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian authority upheld a complaint against a company that refused to disclose how it calculated marketing scores for a person, claiming trade secrets. The decision stressed that individuals have the right to understand how their data is used, even if profiling is involved. Companies should be transparent about data processing methods.
What happened
A company refused to provide information on how it calculated marketing scores for an individual, citing trade secrets.
Who was affected
Individuals who were profiled by the company using marketing scores like 'Dominanten Geo Milieus'.
What the authority found
The Austrian authority ruled that the company must provide information on the logic behind the marketing scores, as they constitute personal data.
Why this matters
This ruling emphasizes the need for transparency in data processing and profiling. Companies should be prepared to explain their data processing methods to individuals, even when claiming trade secrets.
GDPR Articles Cited
National Law Articles
Entities Involved
The respondent had calculated marketing scores called „Dominanten Geo Milieus“ regarding the complainant. These scores consisted of alleged likelihoods (expressed in a percentage number) that the complainant would belong to certain demographic groups, such as "conservatives", "traditionalists", "hedonists" or "digital individualists". In May 2019, the complainant sent an access request under Article 15 GDPR to the respondent, requesting i.a. information under Article 15(1)(h) GDPR on how the marketing scores have been calculated. In June 2019, the respondent replied, stating that the requested information will not be provided because it qualifies as a trade secret within the meaning of § 4(6) Austrian Data Protection Act (Datenschutzgesetz - DSG). (Note: §4(6) DSG is considered as national law adopted under Article 23(1)(i) GDPR.) Consequently, the complainant filed a complaint with the Austrian DPA (Datenschutzbehörde - DSB). * Is the respondent under the obligation to provide information under Article 15(1)(h) GDPR ("meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject") to the respondent regarding the marketing scores „Dominanten Geo Milieus“? * If so, could the respondent invoke a trade secret within the meaning of § 4(6) DSG and rightfully refuse to provide said information? The DSB initially held, that the marketing scores at hand constitute personal data under Article 4(1) GDPR as they have been assigned to individual natural persons. Furthermore, the DSB held that the processing activities leading to the creation of these marketing scores constitute profiling within the meaning of Article 4(4) GDPR. Taking into account recital 71 GDPR and [https://ec.europa.eu/newsroom/article29/items/612053 WP 251 rev.01], the DSB emphasized that the GDPR differentiates between profiling under Article 4(4) GDPR and automated decision making under Article 22 GDPR: for a proces
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Dr. Markus A*** (Complainant) in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Dr. Markus A*** (Complainant) - Austria (2020). Retrieved from cookiefines.eu
Last updated: