J*Club – Court Ruling (Austria, 2022)

The controller operates a cross-company and cross-sector customer loyalty programme called "J*Club". Customers of participating retail outlets can register as members, collect points based on their purchases and subsequently redeem these points to receive discounts, etc. According to the privacy policy, the legal basis for the processing is consent pursuant to Article 6(1)(a) GDPR which is voluntary and can be revoked at any time. In October 2019, the Austrian Data Protection Authority (DSB) conducted ex officio investigations and found that the controller's procedure did not fulfill the requirements of consent, therefore Article 6(1)(a) GDPR could not be used as a legal basis for processing. Since the controller had not made use of other legal bases, the processing was unlawful. The controller appealed that decision before the Federal Administrative Court (BVwG). It argued that it had used legitimate interest, Article 6(1)(f) GDPR, beside consent as a legal basis. Subsequently, in December 2019, the DSB amended its decision. It held that 1) the request for consent by the controller does not meet the requirements pursuant to Article 4(11) GDPR and Article 7 GDPR and that no other legal basis can be considered and the aforementioned processing is therefore unlawful. 2) the controller shall be prohibited from processing personal data for the purpose of profiling within the scope of Clause 1 and 3. 3) the complainant shall be granted a period of six months to implement point 2. The BVwG granted the controller's appeal and annuled the decision in its entirety without replacement. It held that the DSB had incorrectly only based its decision on the lack of consent and not on other possible legal bases, thus not performed an exhaustive investigation. According to the BVwG, the sole examination of the legal basis of consent could not necessarily establish a violation of the principle of lawfulness and thus also no entitlement to the remedial power under Article 58(2)(d