Court case W214 2233132-1/27E – Court Ruling (Austria, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled that an address publisher must provide a person with information about how their personal data is used for advertising. This matters because it reinforces the right of individuals to know what companies do with their data, which is important for privacy.
What happened
The court ordered the address publisher to disclose information about the target groups and recipients of a person's personal data used for advertising.
Who was affected
The person who filed the complaint, whose personal data was being processed by the address publisher.
What the authority found
The court found that while the company could not identify all recipients of the personal data, it still violated the person's right to access their data by not fully complying with the request.
Why this matters
This ruling highlights the importance of transparency in data processing. Companies should ensure they can provide users with complete information about their data usage when requested.
GDPR Articles Cited
A data subject filed a complaint with the DSB claiming a violation of his right to access under Article 15 GDPR. The DSB partially upheld the complaint of the data subject, ordering the controller, an address publisher and direct marketing company, to disclose to the data subject information about the target groups of personal data about him being processed for advertising purposes and the names of the recipients of such data as it failed to fully comply with the access request. The controller then appealed the decision before the BVwG, claiming that it is not obliged to disclose such information. The BVwG started evaluating the case but then suspended the proceedings, pending the decision of the CJEU in case C-154/21 and issued only a partial decision on 17 May 2022 (BVwG - W214 2233132-1/13E) annulling parts of the DSB's decision. In January 2023, the CJEU delivered its judgment in case C-154/21 and the BVwG continued the case in May 2023. Upon hearing further submissions by the parties, the BVwG issued its final decision on the remaining part of the case on 29 November 2023. In the second partial judgment the court considered the two parts of the DSB’s decision that had not already been decided, namely: (2a) the order to the controller to disclose the names of all recipients of the data subject’s personal data and (1) the declaration that the controller violated the data subject’s right to access as it failed to fully comply with his request under Article 15 GDPR. The Court first of all held that, part (2a) of the DSB’s decision should be dismissed, as the controller in its later submissions sufficiently proved that it was impossible for it to identify all recipients of the data subject’s personal data and thus it could and can not comply with the order to disclose their names. As regards part (1) of the DSB’s decision, the BVwG held that, even though it was indeed impossible for the controller to identify the recipients of the data subject's personal data, t
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W214 2233132-1/27E in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W214 2233132-1/27E - Austria (2023). Retrieved from cookiefines.eu
Last updated: