- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Court case W214 2233132-1/27E – Court Ruling (Austria, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
An Austrian court ruled on a complaint about a company's failure to fully disclose personal data processing details. The court ordered the company to provide some information but dismissed part of the request, stating it was impossible for the company to identify all data recipients. This decision emphasizes the importance of transparency in data handling.
What happened
The Austrian court ordered a direct marketing company to disclose some information about the personal data it processed but dismissed the request for names of all data recipients.
Who was affected
The individual who filed the complaint regarding the company's handling of his personal data.
What the authority found
The court ruled that while the company must provide some information, it could not identify all recipients of the personal data, thus limiting the disclosure requirement.
Why this matters
This ruling reinforces the need for companies to be transparent about data processing while recognizing practical limitations in identifying all data recipients. It serves as a reminder for businesses to improve their data management practices.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 March 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject filed a complaint with the DSB claiming a violation of his right to access under Article 15 GDPR. The DSB partially upheld the complaint of the data subject, ordering the controller, an address publisher and direct marketing company, to disclose to the data subject information about the target groups of personal data about him being processed for advertising purposes and the names of the recipients of such data as it failed to fully comply with the access request. The controller then appealed the decision before the BVwG, claiming that it is not obliged to disclose such information. The BVwG started evaluating the case but then suspended the proceedings, pending the decision of the CJEU in case C-154/21 and issued only a partial decision on 17 May 2022 (BVwG - W214 2233132-1/13E) annulling parts of the DSB's decision. In January 2023, the CJEU delivered its judgment in case C-154/21 and the BVwG continued the case in May 2023. Upon hearing further submissions by the parties, the BVwG issued its final decision on the remaining part of the case on 29 November 2023. In the second partial judgment the court considered the two parts of the DSB’s decision that had not already been decided, namely: (2a) the order to the controller to disclose the names of all recipients of the data subject’s personal data and (1) the declaration that the controller violated the data subject’s right to access as it failed to fully comply with his request under Article 15 GDPR. The Court first of all held that, part (2a) of the DSB’s decision should be dismissed, as the controller in its later submissions sufficiently proved that it was impossible for it to identify all recipients of the data subject’s personal data and thus it could and can not comply with the order to disclose their names. As regards part (1) of the DSB’s decision, the BVwG held that, even though it was indeed impossible for the controller to identify the recipients of the data subject's personal data, t
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W214 2233132-1/27E in AT
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
29 November 2023
Authority
Datenschutzbehörde
About this data
Cite as: Cookie Fines. Court case W214 2233132-1/27E - Austria (2023). Retrieved from cookiefines.eu
Last updated: