Court case W176 2249328-1/4Z – Court Ruling (Austria, 2022)

The controller was the parent company of a conglomeration that operated a cross-company and cross-sector customer loyalty programme. Customers at participating retail outlets could register as members, collect points on the basis of their purchases and subsequently redeem them to receive discouts and other perks. The controller processed personal data obtained from participants in the loyalty program to, among others, automatically generate consumer profiles to create targeted ads. The controller claimed consent as the legal basis for this processing pursuant to Article 6(1)(a) GDPR and in its privacy policy stated that this consent was voluntary and could be revoked at any time. The DPA initiated an official investigation and, based on the results of this investigation, also initiated administrative penal proceedings against a subsidiary of the controller. On 26.7.21, the DPA fined the subsidiary €2,000,000 for using legally invalid consent and thus unlawfully processing the personal data of participants in its loyalty program. The subsidiary appealed to the Federal Administrative Court (BVwG). The DPA also initiated administrative penal proceedings against the controller (the parent company), fining it €8,000,000 for the unlawful processing of personal data relating to the loyalty program. The controller also appealed this decision to the BVwG, arguing that, among others, there was not only a lack of the necessary elements of the offence but that the controller could not be found at fault for the violation. The Court stayed proceedings pending a ruling by the European Court of Justice (CJEU) in C-807/21 - Deutsche Wohnen SE. In that case the Higher Regional Court Berlin (KG Berlin) referred the following questions: 1) Is Article 83(4) to (6) 1 to be interpreted as incorporating into national law the functional concept of an undertaking and the principle of an economic entity, as defined in Articles 101 and 102 TFEU, as a result of which, by broadening the principle of a legal entity underpinning Paragraph 30 of the Gesetz über Ordnungswidrigkeiten (Law on administrative offences; ‘the OWiG’), proceedings for an administrative fine may be brought against an undertaking directly and a fine imposed without requiring a finding that a natural and identified person committed an administrative offence, if necessary, in satisfaction of the objective and subjective elements of tortious liability? 2) If Question 1 is answered in the affirmative: Is Article 83(4) to (6) to be interpreted as meaning that the undertaking must have intentionally or negligently committed the breach of an obligation vicariously through an employee (see Article 23 of Council Regulation (EC) No 1/2003 1 ), or is the objective fact of breach caused by it sufficient, in principle, for a fine to be imposed on that undertaking (‘strict liability’)?