Court case W256 2234851-1 – Court Ruling (Austria, 2023)

On 22 February 2019, a data subject submitted an access request to the controller, a logistics and postal service provider acting in its capacity as an address publisher and direct marketing company, that initially did not answer his request at all. Against this background, the data subject filed a complaint with the DSB. After hearing the controller, the DSB established that it did reply to the access request and it considered the complaint to be without object. In response to this, the data subject claimed that such answer was incomplete, as it did not receive information about the data recipients and of the existence of profiling. The DSB thus considered the complaint anew, as the claimed infringement changed to incomplete provision of information under Article 15 GDPR. In its submissions, the controller held that it did provide information about the categories of recipients and it did not inform the data subject about profiling, as it did not carry out such activities. The DSB partially admitted the complaint, holding that the controller infringed the data subject’s right to access as it did not provide sufficient information as to the data recipients, without explaining why providing such information would affect her protected interest as an address publisher. It also held that the controller failed to provide meaningful information about the logic involved and the scope and effects of processing according to Article 15(1)(h) GDPR as regards the marketing classification, which is to be considered “profiling” under Article 4(4) GDPR. The DSB thus ordered the controller to duly inform the data subject about the above mentioned within a period of four weeks. The controller still believed the information it provided to be complete, since it lawfully chose to provide information about the categories of recipients and not the recipients themselves and it considered that marketing classifications do not constitute personal data and that it did not carry out profiling activities. The controller thus appealed the DSB decision before the BVwG. However, on 9 March 2023, before the BVwG issued its final judgment, the controller submitted that, given some recent case-law of the BVwG and of the CJEU, it recognized that its activities as an address publisher constitute profiling within the meaning of Article 4(4) GDPR. In line with case C-154/21 the controller also provided the data subject with information about the specific recipients of her personal data. However, it still claimed that the obligations of Article 15(1)(h) GDPR do not apply to its activities as it does not engage in automated-decision-making under Article 22(2) GDPR. The controller submitted that the scope and effects of the marketing classifications are defined in the Austrian Commercial Code ([https://www.ris.bka.gv.at/eli/bgbl/1994/194/P151/NOR40096343 Gewerbeordnung, GewO)] and they are only used to set target groups for third party marketing purposes and they help selecting the addresses where higher response rates to advertisement are expected in order to increase advertisement accuracy. With respect to the data subject’s access request about the data recipients, the BVwG held that the controller had eventually complied with its obligation under Article 15 GDPR. As regards the provision of information about profiling, the BVwG first of all held that marketing information clearly constitutes personal data as per Article 4(1) GDPR. Equally so, that processing of such information constitutes profiling under Article 4(4) GDPR. Further, the BVwG considered the controller’s position that it did not carry out profiling within the meaning of Article 22 GDPR and therefore did not have to comply with the obligation of Article 15(1)(h) GDPR. The BVwG held in this respect that even though under Article 15(1)(h) GDPR it can be understood that a controller has to inform a data subject about the existence of automated decision-making including profiling, it is clear from the wording of the second part of the Article that further information about the logic involved must be provided only when the conditions of Article 22(1) GDPR and Article 22(4) GDPR are met. In the case at hand, so the BVwG, it did not appear from the submissions of the controller that it carries out profiling within the meaning of Article 22 GDPR, thus, the BVwG held that the controller did not have to comply with the obligation of Article 15(1)(h) GDPR to provide further meaningful information about the logic involved. Hence, the BVwG concluded that the controller complied with its obligations under Article 15 GDPR.