unknown (claimant) – Court Ruling (Austria, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian court dealt with a case where a person wanted to know exactly who received their personal data. The company only provided general categories of recipients, not specific names. The court asked the European Court of Justice to clarify if companies must name specific data recipients under GDPR.
What happened
A person requested specific names of data recipients, but the company only provided general categories.
Who was affected
Individuals who want to know exactly who has received their personal data.
What the authority found
The Austrian Supreme Court referred a question to the CJEU, asking if GDPR requires companies to name specific data recipients.
Why this matters
This case could clarify whether companies must disclose specific data recipients, which would impact how businesses handle data access requests. It highlights the importance of transparency in data sharing practices.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
The controller (defendant) is the biggest logistics and postal service provider in Austria. Its main business activities include the transport of letters, advertising mail, print media, and parcels. Furthermore, the defendant also conducts business as an address publisher under § 151 Austrian Trade Regulation Act (Gewerbeordnung 1994 - GewO) and sells personal data for third-party marketing purposes. On 14.01.2019 the data subject (claimant) sent an access request under Article 15 GDPR to the controller on which the controller replied to on 14.02.2019. Besides data such as name and phone number the controller stated to process certain "marketing classifications" under § 151(6) GewO. These "marketing classifications" are calculated based on a a variety of socio-demographic circumstances (e.g. age, place of residence, level of education) and express a statistic probability of the data subject belonging to a certain demographic group (e.g. "do-it-yourselfer", "night owl", "person with affinity for investments"). The data subject was not content with the controller's reply and filed a lawsuit for the provision of access under Article 15 and erasure under Article 17 GDPR in connection with Article 21 GDPR. Furthermore, the data subject requested a declaratory judgment that the controller is under the legal obligation to provide access to the data subject regarding certain "marketing classifications" under Article 15 GDPR in the case of further access requests by the data subject. The first instance court (Regional Court Wels - LG Wels) rejected the lawsuit, holding that the controller had already fulfilled the data subject's requests. Following an appeal by the data subject, the second instance court (Higher Regional Court Linz - OLG Linz) partially overturned this decision and held that the data subject had indeed a legal interest in the claimed declaratory judgment. Consequently, it held that the controller is under the legal obligation to provide access to the data su
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Violations (1)
Third-party tracking cookies or scripts are loaded without obtaining prior user consent.
Art. 13, 14 GDPR
Related Cases (1)
Other cases involving unknown (claimant) in AT
Similar Cases
Enforcement actions with similar violations
Details
Ruling Date
18 February 2021
Authority
DPA OLGLinz
About this data
Cite as: Cookie Fines. unknown (claimant) - Austria (2021). Retrieved from cookiefines.eu
Last updated: