Rudolf A*** – Dismissed (Austria, 2021)

The subject matter of the complaint is whether the respondent violated the first and second complainants' right to confidentiality (under §1(1) DSG) by obtaining their "most personal" data - which the Austrian DPA understood to mean their address data, specifically title, name, date of birth and address - from the customer and prospect file systems of other address and direct marketing companies.Please note that this type of company is specific to the Austrian legal system. For further information please see: https://www.rtr.at/TKP/was_wir_tun/telekommunikation/anbieterservice/information_for_providers.en.html The respondent argued that it had the commercial authority of an address publishing and direct marketing company, and therefore lawfully processed the complainant's personal data. They supported this claim by handing over declarations of the data providers to the Austrian DPA. The Austrian DPA assessed the documents the respondent provided, and held that the processing of the complainant's address data was lawful because (i) the respondent had a valid trade licence "for the exercise of the trade of address publishers and direct marketing companies", (ii) only obtained the relevant data for advertising purposes, (iii) processed the data in line with the principle of proportionality per §151(3) Trade Regulation Act 1994.