Court case W252 2248630-1 – Court Ruling (Austria, 2023)

The data subject created an account with the controller in order to purchase goods online. In this context, they allegedly were forced to give consent to the processing of their personal data for the purpose of advertising. The data subject lodged a complaint with the Austrian DPA. The Austrian DPA declared the processing unlawful. The controller appealed the decision, arguing that the data subject was not actually "forced" to create a customer account to purchase the goods. As a matter of fact, they could have ordered the goods by using a so-called “guest” option, which would not imply any processing for advertising purposes. To the contrary, the creation of a customer account implies that a user wants to have access to discounts and be informed about offers concerning the controller's products. The court upheld the controller’s appeal. Pursuant to Article 4(11) GDPR, consent must be freely given. In light of Article 7(4) GDPR, this is clearly not the case when the conclusion of a contract is made dependent on the data subject’s consent, unless consent is necessary for the performance of the contract. Thus, the court checked the nature of the contract in the case at issue. The court found that it was not possible to separate the creation of an account with the controller from the purchase of goods online. Such an account did not exclusively serve the purpose of sharing offers and discounts with the data subject. The purchase of goods could rather be seen as the main object of the contract. For such a purpose consent to the processing of personal data for advertising was not necessary. The court then checked whether the guest option could be a valid alternative to achieve the object of the agreement. The court rejected the DPA’s argument that the guest option was no valid alternative to the creation of an account with regard to the purchase of online goods. The court acknowledged that the use of a guest option entails an additional effort for the user, namely the effort of filling the fields that are auto-filled for the holder of a customer account. However, such an effort was not disproportionate. In light of the above, the court overturned the DPA's decision and declared that consent to the processing was freely given.