Court case G 287/2022-16, G 288/2022-14 – Court Ruling (Austria, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Austrian Constitutional Court found that a law giving media companies a broad exemption from data protection rules was unconstitutional. This matters because it means media companies in Austria must now follow stricter data protection standards. The decision could impact how media outlets handle personal information in their reporting.
What happened
The Austrian Constitutional Court ruled that a law exempting media companies from data protection rules was unconstitutional.
Who was affected
Individuals whose personal information was published by media companies without adequate protection.
What the authority found
The court decided that the blanket exemption for media companies violated the requirements of Article 85 GDPR.
Why this matters
This ruling means media companies in Austria can no longer rely on a broad exemption from data protection laws, aligning them more closely with GDPR standards. Media outlets should review their data handling practices to ensure compliance with stricter rules.
GDPR Articles Cited
National Law Articles
Prompted by two complaints again decisions of the Austrian DPA, which were brought in before it, the Austrian Federal Administrative Court questioned the constitutionality of § 9(1) Austrian Data Protection Law (DSG) and sent an application to the Austrian Constitutional Court for the assessment of the constitutionality of § 9(1) DSG. Besides through the GDPR, and in contrast to the majority of other EU member states, data protection in Austria is also covered by the constitutional right to data protection and secrecy pursuant to § 1 DSG. This stood in contrast with § 9(1) DSG, which provided a blanket data protection exemption for a broad category of media actors. The first complaint, which the Federal Administrative Court took note of, was the case G 287/2022, which concerned an alleged data protection breach of a media company. The company had published a report and images of a house search, including unredacted pictures of a data subject's business card. The DPA rejected the complaint, arguing that considering the "media privilege" pursuant to § 9(1) DSG, it was not competent to handle the complaint. In complaint number two, concerning case G 288/2022, data subjects argued that a publishing company and a broadcasting company had unlawfully disclosed a "data leak" at an e-mail box attributable to the data subjects. Similar to the complaint mentioned above, the DPA deemed itself not competent pursuant to § 9(1) DSG. The data subjects in both cases appealed to the Federal Administrative Court which further sent an application to the Constitutional Court for the assessment of the constitutionality of § 9(1) DSG. The Austrian Constitutional Court sided with the data subjects and held that the "blanket" exemption, which § 9(1) Data Protection Act gives to media owners and journalists, is unconstitutional and not in line with the requirements of Article 85 GDPR. § 9(1) DSG provides - in implementation of the obligation under EU law pursuant to Article 85(1) GDPR
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case G 287/2022-16, G 288/2022-14 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case G 287/2022-16, G 288/2022-14 - Austria (2022). Retrieved from cookiefines.eu
Last updated: