- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Court case Ra 2020/04/0187 – Court Ruling (Austria, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A court ruling in Austria found that a data authority's fine against a company for selling personal data was unlawful. The court stated that the authority failed to properly attribute the actions to specific individuals responsible for the violations. This ruling is significant as it clarifies the need for accountability in data protection cases.
What happened
The Austrian court annulled a fine against a data publisher for not properly attributing violations to responsible individuals.
Who was affected
The company involved in the sale of personal data and the individuals responsible for the alleged violations.
What the authority found
The court ruled that the data authority's fine was unlawful due to a lack of proper attribution of responsibility.
Why this matters
This ruling sets a precedent for how data protection authorities must document and attribute violations. Companies should be aware that accountability is crucial in data protection enforcement.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 21 March 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The controller is an address publisher and direct advertising company that operates a data application in order to provide advertisers with personal data for targeted marketing measures. In 2019, the Austrian Data Protection Authority (DSB) initiated an ex officio investigation against the controller, following media reports about the alleged sale of personal data, in particular information about the political affinity of individual persons. Based on the findings, the DSB issued a fine of €18,000,000. The natural persons responsible for the infringements belonged to the economic unit formed by the controller as a legal person. Therefore the infringement was attributed to the controller. The controller appealed to the Federal Administrative Court (BVwG), arguing that it was not sufficient for a legal person to have committed a criminal offence for a fine to be imposed on it under the GDPR. As a legal person that cannot act on its own, the actions of a natural person must also be attributed to it but the DSB had omitted this attribution. The BVwG agreed with the controller's reasoning. Since the DSB had not named the natural person whose breach of the GDPR was to be attributed to the controller, the DSB's decision proved to be unlawful. The DSB filed an extraordinary official appeal against this decision with the Austrian Supreme Administrative Court (VwGH). It referred to the pending case of the Higher Regional Court of Berlin (KG Berlin) before the Court of Justice of the European Union (CJEU) (Case C-807/21) where the question at issue - as in the case at hand - is whether the supervisory authority must record and name those natural persons who are responsible for the infringement in order to enable attribution to the legal person, or whether this is not necessary. The DSB therefore requested to refer the question of the direct criminal liability of a legal person under Article 83 GDPR and the question of the compatibility of § 30 Datenschutzgesetz (Austrian Data
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case Ra 2020/04/0187 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
24 February 2022
Authority
DPA VwGH
About this data
Cite as: Cookie Fines. Court case Ra 2020/04/0187 - Austria (2022). Retrieved from cookiefines.eu
Last updated: