- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
1) unknown data subject (complainant in the procedure before the DSB) – Court Ruling (Austria, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Austrian court is considering a case where a person complained about not receiving specific details about who received their personal data. The court paused the case because it is waiting for guidance from the European Court of Justice on how to interpret the law. This situation shows that users have the right to know exactly who has their data.
What happened
A person requested information about the actual recipients of their personal data but was only given general categories.
Who was affected
The individual who filed a complaint with the Austrian Data Protection Authority.
What the authority found
The court has not yet made a decision but is seeking clarification on the law regarding data recipient information.
Why this matters
This case could set a precedent for how companies must disclose information about data recipients, reinforcing users' rights to transparency.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 21 March 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject filed a complaint with the Austrian Data Protection Authority (DSB) against the controller, requesting to be provided with recipients to whom the personal data had been shared under Article 15(1)(c) GDPR, rather than mere categories of recipients. The controller refused, arguing that a controller has a right to choose whether to provide a data subject with information on actual data recipients or rather just categories thereof. Further, the controller argued that the disclosure of actual data recipients would reveal its trade secrets. The DSB upheld the data subject's complaint and ordered the controller to provide the data subject with information on the actual data recipients. The controller filed an appeal against that decision with the Austrian Federal Administrative Court (BVwG), repeating its arguments brought forward before the DSB. The BVwG did not (yet) take a decision on the merit of the case but stalled the procedure because the Austrian Supreme Court (OGH) had already filed a request for preliminary ruling on the question the interpretation of Article 15(1)(c) GDPR in February 2021. Once the CJEU has passed its judgment on the matter, the BVwG will reopen the case.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for 1) unknown data subject (complainant in the procedure before the DSB) in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. 1) unknown data subject (complainant in the procedure before the DSB) - Austria (2021). Retrieved from cookiefines.eu
Last updated: