Verein für Konsumenten Information (VKI) – Court Ruling (Austria, 2021)

The plaintiff (the Austrian association Verein für Konsumenten Information) sued the defendant (an online shopping platform operating throughout Austria) over several business practices, terms and conditions they found in violation with consumer protection law and the GDPR. More precisely, the association criticized several non-transparent contractual clauses on interests and creditworthiness checks as well as the defendant making decisions based on classifications by external credit scoring agencies in violation of Article 22 GDPR. The defendant argued that the association had no right to take legal action under applicable data protection law. In this regard, the appealing court already decided that the association lacks the legitimacy to assert data protection violations. The OGH decided that the previous court failed to take into account that the systematic infringement of Article 22 GDPR in connection with consumer credit ratings could in fact allow the association to take legal action under the GDPR. The court decided that the appeal is admissible because the legitimacy of the plaintiffs associations under §§ 28 and 29 of the Austrian Consumer Protection Act (Konsumentenschutzgesetz - KSchG) is not ultimately clarified. The court refers to a parallel case of the plaintiff currently pending at the CJEU as part of an preliminary ruling procedure. In this regard, the CJEU has to decide on whether the GDPR precludes national rules from granting associations the power to take legal action against unfair business practices or violations of consumer protection laws without a mandate and irrespective of the violation of specific rights of individual data subjects (see here). Until this decision is delivered by the CJEU the present procedure is put on hold.