Court case W256 2234976-1 and W256 2234976-2 – Court Ruling (Austria, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that two companies unlawfully published personal information about a marksman without his consent. This case highlights the importance of obtaining permission before sharing someone's personal details online. Businesses should be careful not to share information without explicit consent.
What happened
Two companies published reports containing the name and image of a marksman without his explicit consent.
Who was affected
A marksman whose name and image were published in reports on two websites.
What the authority found
The court decided that both companies unlawfully processed the marksman's personal data, as he never agreed to the publication.
Why this matters
This case emphasizes the need for businesses to secure consent before publishing personal information. It sets a precedent for similar cases involving unauthorized data sharing.
GDPR Articles Cited
National Law Articles
The data subject was marksmen from 2012 until about 2017 and participated in competitions. Controller 1 (first appellant in the present case) operates a website that offered shooting accessories and lessons. Controller 2 (second appellant in the present case) also operates a website where they added blogposts concerning these competitions and offered shooting lessons including advertisement for a company. Several reports by the two controllers, published on their respective websites, included an image and the name (and nickname) of the data subject. However, the data subject had never explicitly consented to this publication nor was there a contractual agreement at any time. The publications were mainly for advertising purposes. Controller 1 issued two of the reports in question; on 30 July 2015 and on 9 November 2015. Controller 2 published the other two reports, namely on 10 August 2016 and on 18 September 2016. The controllers took down the reports in September 2018 and November 2018, respectively. On 17 February 2019, the data subject filed two complaints before the DSB (Austria) for infringement of their fundamental right to data protection by the two controllers. The DSB joined the two cases in its decision of 13 July 2020 accepting the complaint and deciding in favour of the data subject: According to this decision, controller 1 unlawfully processed the data subject’s personal data from 9 November 2015 until 30 September 2018. Controller 2 unlawfully processed the same data from 10 August 2016 until November 2018. Both controllers appealed against this decision before the Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG), claiming that their activities were covered by the media exception of [https://www.ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597&Artikel=2&Paragraf=9&Anlage=&Uebergangsrecht= § 9(1) Austrian Data Protection Act] (Datenschutzgesetz - DSG). First, the BVwG considered the application o
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W256 2234976-1 and W256 2234976-2 in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W256 2234976-1 and W256 2234976-2 - Austria (2023). Retrieved from cookiefines.eu
Last updated: