Court case W108 2263948-1/4E – Court Ruling (Austria, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that a telecommunications company did not breach data protection rules after a customer suspected a data leak. This is important because it clarifies the responsibilities companies have in communicating with users about data issues.
What happened
The court found that the telecommunications company did not fail to protect the customer's personal data or notify them of a breach.
Who was affected
The customer who installed a door camera and suspected a data breach was affected.
What the authority found
The court determined there was no unauthorized access to the customer's data and the account blocking was a legitimate anti-spam measure.
Why this matters
This ruling reinforces that companies must communicate clearly with customers about data issues, but also shows that not all technical problems constitute a data breach. Businesses should ensure they have robust communication strategies in place.
GDPR Articles Cited
National Law Articles
A data subject installed at the front door of his house a camera provided by a telecommunications service provider, the controller. After noticing that he no longer received e-mail notifications from the front door camera he contacted the controller and received different and contradictory information about the causes of system's malfunctioning in different occasions. On this basis, he suspected that his personal data had been leaked due to a ransomware attack and again contacted the controller about this. The data subject later found out that his account had been automatically blocked and the controller replied that this occurred because the account had been improperly used. The data subject was thus certain that he had been subject to a personal data breach, which the controller should have informed him about under Article 12 GDPR in a transparent manner. As a consequence, he believed that this violated his rights under several GDPR provisions, including Article 22 GDPR and filed a complaint with the Austrian DPA (DSB). However, due to a delay in the procedure, the data subject filed an appeal before the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG) as he claimed that the DSB failed to take a decision within the prescribed time limit. On the basis of the submissions of the parties, the BVwG first of all ascertained that there had been no unauthorised access to the data subject's data and that the controller had credibly demonstrated that there had been no hacker attack, hence there had been no violation of Article 12 GDPR, Article 5 GDPR and Article 34 GDPR. The BVwG instead determined that the blocking of the complainant's email account was set by an algorithm due to unusually high activity as an anti-spam measure. Effectively, the controller had submitted that it noticed a high number of e-mails were being sent from the data subject's account within a short period of time, and suspected a misuse of his account. As regards the s
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W108 2263948-1/4E in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W108 2263948-1/4E - Austria (2023). Retrieved from cookiefines.eu
Last updated: