Court case 4Ob84/19k – Court Ruling (Austria, 2019)

A business added names and other personal information from a list of Austrian registered psychotherapists, which had been publicly available on a federal ministry‘s website, to their own register of psychotherapists and psychotherapists in training with supervision. The commercial website offered paid features for listees including prioritisation in search results and the possibility to add further information such as links and pictures. Action was brought by an association of Austrian psychotherapists in order to stop the publishing of listee's names without consent or, alternatively, stop providing a perceived competitive advantage to paying listees. The featuring of entries was seen as misleading since it was not clearly indicated that those were part of a paid advertising package. Can the defendant rely on Article 6 (1) (f) GDPR/legitimate interest as a basis for the processing and were appropriate information requirements according to Article 14 GDPR met? Can the defendant’s activities be challenged under competition law? The Austrian supreme court (Oberster Gerichtshof der Republik Österreich - OGH) refers to § 28 of the Austrian data protection act (Datenschutzgesetz - DSG) and concludes that this exclusively grant rights for group actions by associations and other bodies in front of the national data protection authority, but not in front of courts. In addition, it finds, was the association not explicitly legitimised by its individual members to bring such action for them, nor had it claimed to be doing so. It supports this by reference to Article 80 (2) GDPR which require an explicit provision from the national legislator for action brought by an organisation without explicit commission from the data subject. Hence, due to a lack of active legitimation to bring the action, it does not review the applicability of Article 6 (1) (f) and 14 GDPR. Regarding privacy related claims based on competition law, the supreme court raises the question of general