Court case W252 2237416-1 – Court Ruling (Austria, 2023)

The data subject made an access request with the controller – a mail services provider. The controller delivered targeted political advertisements and the data subject why they were assigned to certain political affinities. However, in the data subject's view, the controller’s reply was not complete. For example, it did not contain the sources of the data and how the data subject was associated with certain political preferences for the purpose of political advertising. The data subject lodged a complaint with the Austrian DPA. The Austrian DPA upheld the complaint and found a violation of Articles 12(1) and 15(1)(g) and (h) GDPR, as the controller did not provide information about the sources and about how the affinity between the data subject and certain political groups had been inferred. The controller appealed the decision, arguing that the information asked by the data subject was not personal data but only “marketing classifications” to which neither profiling within the meaning of the GDPR nor Article 22(1) GDPR applied. The court upheld the controller's appeal. First, according to the judges, the sources were duly disclosed in the answer to the access request. The disclosure was also transparent and comprehensible, complying with the requirements of Article 12(1) GDPR. Second, concerning the alleged violation of Article 15(1)(h) GDPR, the court found that the controller provided sufficient information to understand the logic behind the automated decision-making pursuant to Article 22(1) and (4) GDPR. As a matter of fact, data processed were address, age and sex of the data subject; the method used a “statistical” one; and the purpose of the processing was to avoid to deliver irrelevant advertisement to the data subject. The court did not concern itself with the problem whether the processing at issue was profiling, nor with the issue whether the “marketing classifications” were actually personal data. The court stated that the disclosure of the algorithm