unknown (claimant) – Court Ruling (Austria, 2021)

Court Ruling
DPA OLGLinz18 February 2021Austria
final
Court Ruling

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

An Austrian court dealt with a case where a person wanted to know exactly who received their personal data. The company only provided general categories of recipients, not specific names. The court asked the European Court of Justice to clarify if companies must name specific data recipients under GDPR.

What happened

A person requested specific names of data recipients, but the company only provided general categories.

Who was affected

Individuals who want to know exactly who has received their personal data.

What the authority found

The Austrian Supreme Court referred a question to the CJEU, asking if GDPR requires companies to name specific data recipients.

Why this matters

This case could clarify whether companies must disclose specific data recipients, which would impact how businesses handle data access requests. It highlights the importance of transparency in data sharing practices.

GDPR Articles Cited

AI-verified

Art. 4(1) GDPR
Art. 79(GDPR)
Art. 15(1) GDPR
View original scraped data
Art. 4(1) GDPR
Art. 15(1) GDPR
Art. 79(GDPR)

Original data from scraper before AI verification against source document.

National Law Articles

AI-identified

§ 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO)
§ 228 Austrian Civil Procedure Act (Zivilprozessordnung - ZPO)
Decision AuthorityOGH
Reviewed AuthorityOLG Linz (Austria)
Source verified 20 March 2026
articles corrected
national law identified
authority corrected
Full Legal Summary
Detailed

The controller (defendant) is the biggest logistics and postal service provider in Austria. Its main business activities include the transport of letters, advertising mail, print media, and parcels. Furthermore, the defendant also conducts business as an address publisher under § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) and sells personal data for third-party marketing purposes. On 14.01.2019 the data subject (claimant) sent an access request under Article 15 GDPR to the controller on which the controller replied to on 14.02.2019. Besides data such as name and phone number the controller stated to process certain "marketing classifications" under § 151(6) GewO. These "marketing classifications" are calculated based on a a variety of socio-demographic circumstances (e.g. age, place of residence, level of education) and express a statistic probability of the data subject belonging to a certain demographic group (e.g. "do-it-yourselfer", "night owl", "person with affinity for investments"). The data subject was not content with the controller's reply and filed a lawsuit for the provision of access under Article 15 and erasure under Article 17 GDPR in connection with Article 21 GDPR. Furthermore, the data subject requested a declaratory judgment that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject. The first instance court (Regional Court Wels - LG Wels) rejected the lawsuit, holding that the controller had already fulfilled the data subject's requests. Following an appeal by the data subject, the second instance court (Higher Regional Court Linz - OLG Linz) partially overturned this decision and held that the data subject had indeed a legal interest in the claimed declaratory judgment. Consequently, it held that the controller is under the legal obligation to provide access to the data su

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Violations (1)

Third-Party Cookies Without Consent
critical

Third-party tracking cookies or scripts are loaded without obtaining prior user consent.

Art. 13, 14 GDPR

Details

Ruling Date

18 February 2021

Authority

DPA OLGLinz

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. unknown (claimant) - Austria (2021). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: