Court case W258 2243523-1/9E – Court Ruling (Austria, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court ruled that a real estate company did not properly delete a person's personal data after she requested it. This is important because it highlights the responsibility companies have to respect people's requests for data deletion. Businesses must ensure they fully erase personal data when asked to do so.
What happened
The real estate company failed to fully erase a person's personal data after she requested deletion.
Who was affected
A property owner who requested her personal data to be deleted but continued to receive messages from the company.
What the authority found
The Datenschutzbehörde determined that the company violated the person's right to deletion by not fully erasing her data.
Why this matters
This case shows that companies must take deletion requests seriously and ensure they comply fully. Small businesses should implement clear processes for handling data deletion requests.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A real estate development company, the controller, contacted an owner of real estate, the data subject, asking her whether she would be interested in selling her property. The data subject claimed to have requested deletion of her personal data under Article 17 GDPR but kept receiving messages from the controller thereafter. Thus, on 26 April 2020, the data subject filed a complaint with the Austrian DPA (Datenschutzbehörde, DSB). In its submissions, the controller argued that it obtains data about real estate properties on sale by requesting access to the land registry of property addresses and it processes personal data according to Article 6(1)(f) GDPR. Further, the controller stated that it nonetheless complied with the deletion request as it pseudonymised the data of the data subject and added a note next to the address of her property that it should no longer be consulted in the land registry. The DSB held that the controller did violate the data subject’s right to deletion as it failed to fully erase her personal data. First, according to the DSB, the interests of the data subject outweighed those of the controller and that it was still possible to identify the data subject using the address of her property. The controller decided to appeal the DSB’s decision on 14 May 2021 to the Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG), claiming that the DSB failed to properly assess the case. The controller submitted that it deleted the data of the data subject when she requested it and then her data mistakenly reappeared in her database, which is why she was contacted again by the controller. However, the controller remedied this by pseudonymising her data. Hence, the DSB should have differentiated between the two processing activities: the data subject only requested deletion of her data with respect to the first set of processing activities. As regards the second set of processing activities, the data subject never asked for erasure.
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case W258 2243523-1/9E in AT
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case W258 2243523-1/9E - Austria (2024). Retrieved from cookiefines.eu
Last updated: