unknown (claimant) – Court Ruling (Austria, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian court dealt with a case where a person wanted to know exactly who received their personal data. The company only provided general categories of recipients, not specific names. The court asked the European Court of Justice to clarify if companies must name specific data recipients under GDPR.
What happened
A person requested specific names of data recipients, but the company only provided general categories.
Who was affected
Individuals who want to know exactly who has received their personal data.
What the authority found
The Austrian Supreme Court referred a question to the CJEU, asking if GDPR requires companies to name specific data recipients.
Why this matters
This case could clarify whether companies must disclose specific data recipients, which would impact how businesses handle data access requests. It highlights the importance of transparency in data sharing practices.
GDPR Articles Cited
On 15.01.2019 the claimant sent and access request under Article 15 GDPR to the defendant and requested i.a. information on concrete recipients of their personal data under Article 15(1)(c) GDPR. The defendant replied by referencing to its data protection notice which of course only listed categories of potential data recipients but did not name any concrete recipients. The claimant filed a lawsuit with the Regional Court for Civil Matters Vienna (Landesgericht für Zivilrechtssachen Wien - LGfZRS Wien), requesting that the defendant had to name concrete recipients. In the course of the court procedure, the defendant stated that the claimant's data have been disclosed to the defendant's customers, which include "companies conducting advertising in the mail-order business and stationary trade, IT companies, address publishers and associations, NGOs or political parties". Again, the defendant did not name any concrete recipients. Nevertheless, the LGfZRS Wien dismissed the case. After an unsuccessful appeal to the Higher Regional Court Vienna (Oberlandesgericht Wien - OLG Wien), the claimant flied an appeal with the Austrian Supreme Court (Oberster Gerichtshof - OGH). The OGH stayed the procedure and referred to following question to the CJEU under Article 267 TFEU: Does the right to information on recipients under Article 15(1)(c) GDPR necessarily also extend to concrete recipients of personal data if the data has already been disclosed? The OGH also provided a summary of existing legal opinions on the question of naming concrete recipients vs. stating only categories of recipients and argued that Article 15(1)(c) GDPR should be interpreted in light of the purpose of that provision. In the view of the OGH, the right to access is also a tool for the data subject to effectively exercise its rights under Article 16 et seqq. GDPR. Therefore, the controller should not have a choice to state only categories of recipients because that would hinder data subjects to exercise
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Violations (1)
Third-party tracking cookies or scripts are loaded without obtaining prior user consent.
Art. 13, 14 GDPR
Related Cases (0)
No other cases found for unknown (claimant) in AT
This is the only recorded case for this entity in this jurisdiction.
Similar Cases
Enforcement actions with similar violations
Details
About this data
Cite as: Cookie Fines. unknown (claimant) - Austria (2021). Retrieved from cookiefines.eu
Last updated: