Court case W292 2267784-1 – Court Ruling (Austria, 2023)

Court Ruling
Datenschutzbehörde18 December 2023Austria
final
Court Ruling

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

In May 2018, a data subject, respresented by noyb - European Centre for Digital Rights, filed a complaint with the Austrian DPA. The latter referred the case to the Irish DPC as lead supervisory authority under Article 56 GDPR and a cooperation procedure under Article 60 GDPR was initiated. On 11 January 2023, the DSB transmitted to the data subject the final decision by the DPC in accordance with Article 60(7) GDPR and informed her that the EDPB’s binding decision under Article 65(1)(a) GDPR would be published thereafter. Two days later, on 13 January 2023, the DSB transmitted the binding decision of the EDPB of 5 December 2022 to the data subject. The DSB informed the data subject that the parts of the original complaint that were not addressed by the DPC's decision are still pending before the DPC. On 7 February 2023, the data subject filed an appeal with the BVwG, claiming that the transmission of the DPC’s decision by the DSB should be considered a partially dismissing or rejection decision within the meaning of Article 60(9) GDPR. Since the DPC and the EDPB failed to address some of the points raised in the complaint, the communications of the DSB, together with the decision of the DPC could not be interpreted as a positive decision in accordance with Article 60(7). In the complainant's view, the communication by the DSB therefore constitutes an official decisions within the meaning of [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10005768&FassungVom=2019-05-09&Artikel=&Paragraf=58&Anlage=&Uebergangsrecht= section 58 et seqq. of the Austrian General Law on Administrative Procedures (Allgemeines Verwaltungsverfahrensgesetz, AVG)]. In its submissions, the DSB argued that Article 60(7) GDPR applied in this case and the DPC would still be handling the case. The BVwG first of all assessed whether the pronouncement of the DSB constituted a decision within the meaning of [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Ge

Decision AuthorityBVwG
Reviewed AuthorityDSB (Austria)
Full Legal Summary

In May 2018, a data subject, respresented by noyb - European Centre for Digital Rights, filed a complaint with the Austrian DPA. The latter referred the case to the Irish DPC as lead supervisory authority under Article 56 GDPR and a cooperation procedure under Article 60 GDPR was initiated. On 11 January 2023, the DSB transmitted to the data subject the final decision by the DPC in accordance with Article 60(7) GDPR and informed her that the EDPB’s binding decision under Article 65(1)(a) GDPR would be published thereafter. Two days later, on 13 January 2023, the DSB transmitted the binding decision of the EDPB of 5 December 2022 to the data subject. The DSB informed the data subject that the parts of the original complaint that were not addressed by the DPC's decision are still pending before the DPC. On 7 February 2023, the data subject filed an appeal with the BVwG, claiming that the transmission of the DPC’s decision by the DSB should be considered a partially dismissing or rejection decision within the meaning of Article 60(9) GDPR. Since the DPC and the EDPB failed to address some of the points raised in the complaint, the communications of the DSB, together with the decision of the DPC could not be interpreted as a positive decision in accordance with Article 60(7). In the complainant's view, the communication by the DSB therefore constitutes an official decisions within the meaning of [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10005768&FassungVom=2019-05-09&Artikel=&Paragraf=58&Anlage=&Uebergangsrecht= section 58 et seqq. of the Austrian General Law on Administrative Procedures (Allgemeines Verwaltungsverfahrensgesetz, AVG)]. In its submissions, the DSB argued that Article 60(7) GDPR applied in this case and the DPC would still be handling the case. The BVwG first of all assessed whether the pronouncement of the DSB constituted a decision within the meaning of [https://ris.bka.gv.at/NormDokument.wxe?Abfrage=Bundesnormen&Ge

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Related Cases (0)

No other cases found for Court case W292 2267784-1 in AT

This is the only recorded case for this entity in this jurisdiction.

Details

Ruling Date

18 December 2023

Authority

Datenschutzbehörde

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. Court case W292 2267784-1 - Austria (2023). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: