unknown (claimant) – Court Ruling (Austria, 2021)

Court Ruling
DPA OLGWien18 February 2021Austria
final
Court Ruling

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

An Austrian court dealt with a case where a person wanted to know exactly who received their personal data. The company only provided general categories of recipients, not specific names. The court asked the European Court of Justice to clarify if companies must name specific data recipients under GDPR.

What happened

A person requested specific names of data recipients, but the company only provided general categories.

Who was affected

Individuals who want to know exactly who has received their personal data.

What the authority found

The Austrian Supreme Court referred a question to the CJEU, asking if GDPR requires companies to name specific data recipients.

Why this matters

This case could clarify whether companies must disclose specific data recipients, which would impact how businesses handle data access requests. It highlights the importance of transparency in data sharing practices.

GDPR Articles Cited

Art. 12(1) GDPR
Art. 15(1)(c) GDPR
Decision AuthorityOGH
Reviewed AuthorityOLG Wien (Austria)
Full Legal Summary
Detailed

On 15.01.2019 the claimant sent and access request under Article 15 GDPR to the defendant and requested i.a. information on concrete recipients of their personal data under Article 15(1)(c) GDPR. The defendant replied by referencing to its data protection notice which of course only listed categories of potential data recipients but did not name any concrete recipients. The claimant filed a lawsuit with the Regional Court for Civil Matters Vienna (Landesgericht für Zivilrechtssachen Wien - LGfZRS Wien), requesting that the defendant had to name concrete recipients. In the course of the court procedure, the defendant stated that the claimant's data have been disclosed to the defendant's customers, which include "companies conducting advertising in the mail-order business and stationary trade, IT companies, address publishers and associations, NGOs or political parties". Again, the defendant did not name any concrete recipients. Nevertheless, the LGfZRS Wien dismissed the case. After an unsuccessful appeal to the Higher Regional Court Vienna (Oberlandesgericht Wien - OLG Wien), the claimant flied an appeal with the Austrian Supreme Court (Oberster Gerichtshof - OGH). The OGH stayed the procedure and referred to following question to the CJEU under Article 267 TFEU: Does the right to information on recipients under Article 15(1)(c) GDPR necessarily also extend to concrete recipients of personal data if the data has already been disclosed? The OGH also provided a summary of existing legal opinions on the question of naming concrete recipients vs. stating only categories of recipients and argued that Article 15(1)(c) GDPR should be interpreted in light of the purpose of that provision. In the view of the OGH, the right to access is also a tool for the data subject to effectively exercise its rights under Article 16 et seqq. GDPR. Therefore, the controller should not have a choice to state only categories of recipients because that would hinder data subjects to exercise

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Violations (1)

Third-Party Cookies Without Consent
critical

Third-party tracking cookies or scripts are loaded without obtaining prior user consent.

Art. 13, 14 GDPR

Related Cases (0)

No other cases found for unknown (claimant) in AT

This is the only recorded case for this entity in this jurisdiction.

Details

Ruling Date

18 February 2021

Authority

DPA OLGWien

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. unknown (claimant) - Austria (2021). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: